AI Update/July 17, 2026
Open models. Unlocked infrastructure.
China makes the open-source pitch, two frontier-scale models arrive, robots find more capital, and AI security moves from policy arguments to detection systems and courtrooms.
Six developments from the AI frontier
Chinese President Xi Jinping elevated artificial intelligence further in Beijing’s strategic agenda with a keynote at the World AI Conference in Shanghai. Xi called for “open-source, openness, collaboration and sharing”, alongside human control of AI, coordinated international standards and capacity building for the Global South. He also opposed expanding national-security restrictions in ways that put one country’s security above others, and called for coordination through the United Nations on AI strategies, governance rules and technical standards.
Moonshot AI has introduced Kimi K3, a 2.8-trillion-parameter mixture-of-experts model with native vision and a one-million-token context window. Only 16 of its 896 experts activate for a given task, an architecture Moonshot says improves scaling efficiency by about 2.5 times over Kimi K2. The Chinese company acknowledges that K3 still trails the strongest proprietary systems overall, but reports competitive results on coding and knowledge-work tests. K3 is already available through Kimi’s products and API, with full model weights scheduled for release on July 27.
Mira Murati’s Thinking Machines Lab has released Inkling, its first open-weights model. The multimodal mixture-of-experts system has 975 billion total parameters, activates 41 billion at a time, supports a one-million-token context window and was trained on 45 trillion tokens spanning text, images, audio and video. Thinking Machines says Inkling is designed as a customizable foundation rather than the strongest model overall, and has made it available for fine-tuning through its Tinker platform. A smaller version with 12 billion active parameters is also in preview.
London-based robot maker Humanoid has become a unicorn after raising $150 million in the first tranche of a Series A round that values it at $1.2 billion before the new capital. The company is seeking another $80 million to $100 million by September. The financing backs an unusually aggressive deployment plan: Humanoid has a binding agreement with Schaeffler targeting a four-digit number of wheeled robots across the manufacturer’s facilities by 2032, with the first systems due in German factories late this year.
xAI is testing an unusual legal response to model misuse, suing South Carolina resident Terry Harwood over allegations that he used Grok to create sexualized deepfakes of adults and minors. The company says Harwood violated Grok’s terms of service by uploading ordinary images and trying to turn them into explicit material. xAI is seeking damages and a permanent order barring him from Grok. Its complaint says xAI suspended 52,222 accounts and sent 73,604 reports to the National Center for Missing & Exploited Children in 2026, contributing to at least 244 arrests.
Researchers at the University of Tokyo and Max Planck Institute for Informatics have developed ExposeAnyone, a personalized deepfake detector that looks for unnatural relationships between speech and facial movement instead of pixel artifacts. After pretraining on more than 450 hours of video, the system can adapt to a person using about 60 seconds of authentic footage. It averaged more than 95 percent accuracy across established datasets and detected almost 95 percent of manipulated videos in a harder Sora 2 test, though its computational requirements currently rule out real-time use.
Newsletter preview
The Agent Economy’s Plumbing Has No Building Code
MCP became the connective tissue for AI agents before its security model caught up. A vulnerable document tool shows how quickly the trust boundary can move.
In January, researchers at the security firm BlueRock took Microsoft’s MarkItDown, a popular open-source tool that turns documents and web pages into Markdown, and connected it to an AI agent the way it was designed to be connected, through the Model Context Protocol. Then they pointed it at a URL. The URL was the address of the Amazon cloud’s internal metadata service, the one that hands temporary credentials to whatever is running on the server. MarkItDown fetched it, as instructed, and handed back the keys.
This was not a Microsoft breach. BlueRock built the vulnerable server itself, on an older cloud configuration, and MarkItDown was doing exactly what it advertises: fetch a URL, convert what comes back. The tool’s whole job is to retrieve arbitrary things. That is useful when a trusted person on their own laptop asks it to summarize a webpage. It is a credential-exfiltration machine when an agent, acting on instructions that may have come from anywhere, can aim it at the cloud’s soft interior. The tool behaves identically in both cases; what moves is the boundary around who is allowed to point it.
That gap, between a tool built for local trusted use and the same tool wired into remote, multi-user, cloud-hosted agents, is the whole of MCP security right now, and MarkItDown is only the version you can see.
MCP is the standard that lets an AI agent discover and use outside tools: query a database, open a repository, send a message, run a command. Anthropic introduced it in late 2024, and by December 2025 the company counted more than 10,000 active public servers and 97 million monthly downloads of its software kits, with ChatGPT, Gemini, Cursor, Copilot and VS Code all speaking it. The NSA, in guidance issued in May, called MCP the “de facto standard” for how AI systems talk to services, then said the uncomfortable part plainly: “MCP’s rapid proliferation has outpaced the development of its security model.”
You can read what the NSA means in the specification itself, which states that “authorization is OPTIONAL for MCP implementations.” That reflects where MCP began. It was built as a way for a program on your own machine to reach tools you already trusted, with the security boundary at the edge of your laptop, and optional authorization made sense there. It makes less sense now that the same protocol is hosted on the open internet, which is what the industry has spent the past year doing…
Beyond the cutoff
How much of the agent economy is actually unlocked?
Continue for the internet-wide server scan, a live customer-record exposure, and the reason today’s security scanners cannot agree on what danger looks like.
Read the full article on Control Plane



Follow Us