Four things, every day.

Hey. A researcher spent $25 on AI compute and found a bug worth $500,000. A free model turned one startup into a $50 billion company in seven months. Washington is weighing whether to curb open-source AI entirely. And China just switched on a data center running on zero American chips.

$25 in AI compute just found a $500,000 bug.

A security researcher at Searchlight Cyber pointed GPT-5.6 Sol Ultra at WordPress's source code with a single prompt and no hints. Ten hours and about $25 of usage later, it had chained a validation bug into a full pre-authentication remote code execution exploit, the kind exploit brokers pay up to $500,000 for, per Searchlight Cyber.

WordPress powers over 500 million sites and hadn't had a serious pre-auth bug in a decade. The researcher says no human could have found and chained this exploit in 10 hours, and isn't confident it was possible in any timeframe without AI.

The income math here is the real headline: a few dollars of tokens can now out-produce a skilled human specialist. If your team runs anything on WordPress, patch immediately and assume this bug is already circulating.

One free model turned into a $50 billion company.

Moonshot AI is closing a funding round this week at $31.5 billion, then opening a final pre-IPO round in August targeting $50 billion, up from roughly $4.3 billion last December. Annual recurring revenue hit $300 million in June, and daily revenue jumped at least sixfold since Kimi K3 launched, per Yahoo Finance.

Giving the model away as open weights wasn't charity, it maximized developer adoption right before a public listing. The subscription pause from overwhelming demand only reinforced the growth story investors are buying into.

Watch for this exact playbook, free release, viral adoption, funding round, to repeat across every open-model lab chasing a Hong Kong listing this year.

Washington is weighing whether to curb free AI models.

The Trump administration is reportedly weighing an executive order targeting open-source AI after Kimi K3's release, with three bills on federal procurement and chip export controls set for possible inclusion in the Senate NDAA, per Axios, via AI Weekly. The administration's own AI advisor warned new rules could hurt US competitiveness.

The catch: Moonshot releases K3's full weights on July 27, and once weights are on the internet, they're mirrored everywhere. Analysts estimate 80% of developers worldwide who use open-source AI tools already build on Chinese models like Qwen.

A full download ban looks unlikely given First Amendment issues. A federal procurement carve-out is the far more plausible outcome. Plan for sourcing and disclosure rules, not blocked access.

China switched on a data center with zero US chips.

Z.ai, the lab behind the GLM models, has completed and partially activated a 1-gigawatt data center running entirely on Chinese-made chips, enough power for roughly 750,000 homes, per Bloomberg. The facility trains GLM models on Huawei Ascend accelerators after Washington blacklisted Z.ai from Nvidia hardware.

This is the export-control paradox playing out in real time: a restriction meant to deny a capability instead gave China a captive reason to build it domestically. Whether the chips inside can actually match Nvidia's efficiency at scale is still unverified.

The real test comes with the next GLM release trained fully on this facility. If it holds pace with the frontier, sanctions as a strategy get a lot harder to defend.

That's the four things today. See you tomorrow.