A researcher claims Microsoft secretly backdoored BitLocker and releases an exploit, AI subscriptions are running on unsustainable compute subsidies, and GenCAD converts photos into editable 3D CAD

The State of Brand

Every AI Subscription Is a Ticking Time Bomb for Enterprise

AI providers have been deliberately pricing subscriptions far below actual compute costs in an unsustainable land-grab strategy, with analysis suggesting Anthropic users consume roughly $8 in compute per $1 of subscription revenue. Price corrections are already beginning — GitHub shifts to usage-based billing in June 2026, and tiered pricing changes from OpenAI and Anthropic are underway — but most enterprises have not tracked actual token consumption or budgeted for real costs. The risk isn't gradual price creep; it's that cost normalization will outpace the procurement and budget cycles that approved AI spend during the subsidized era, exposing budget owners to overruns on commitments made when token economics were hidden. Enterprise teams that built AI workflows assuming flat-rate pricing need to instrument their actual usage and model what those workflows cost at unsubsidized rates before the bill arrives.

frederickvanbrabant.com

I Don't Think AI Will Make Your Processes Go Faster

The author argues that organizations consistently misapply process optimization by targeting the most visible, time-consuming tasks rather than identifying true bottlenecks — and AI accelerates this mistake rather than correcting it. In software development, AI-generated code won't dramatically speed up projects because the real constraint is upstream: poorly specified requirements, not the act of writing code. Automating a broken process produces faster broken outcomes; until the clarity of information flowing into work improves, adding AI to the execution layer changes throughput without changing outcomes. It's a useful counterweight to the prevailing assumption that AI value is purely additive, and a challenge to engineering leaders who have justified AI adoption to stakeholders on velocity grounds.

Daring Fireball

AI Is Technology, Not a Product

John Gruber argues that AI is infrastructure — like GPS or wireless networking — that will be invisibly embedded in all products rather than standing alone as a distinct product category. He pushes back on the narrative that Apple is "falling behind" by not shipping a breakthrough AI device, arguing that Apple's historical advantage is seamless integration, not first-mover launches on hardware categories. Gruber predicts smartphones will remain the primary AI interface through 2030, with the phone as hub for personal computing rather than being displaced by glasses, earbuds, or purpose-built AI hardware. The structural argument has platform implications for developers: if AI is infrastructure, the competitive question is not which AI company wins, but which existing platforms most effectively surface AI capabilities to users they already have.

williamangel.net

Offline Agentic Coding: Apple Silicon Costs More Than OpenRouter

A detailed energy and economics analysis finds that running LLMs locally on Apple Silicon is more expensive than equivalent cloud inference through OpenRouter when all costs are honestly counted. An M5 Max incurs approximately $0.48/day in electricity plus hardware depreciation of $0.05–$0.16 per hour; at comparable inference speeds, cloud services deliver the same throughput at roughly half the price with double the speed. The author is not anti-local-inference — latency, privacy, and offline capabilities remain real advantages — but the cost argument typically made for on-device models doesn't survive rigorous accounting. Practitioners who have justified significant Apple Silicon purchases on cost grounds should revisit their assumptions; for workloads where data sovereignty matters, the cost premium may be a legitimate price, but it should be an explicit decision rather than a misunderstanding.

GitHub

Show HN: Semble — Code Search for Agents Using 98% Fewer Tokens Than Grep

Semble is a code search library for AI agents that uses semantic and BM25 hybrid retrieval to answer natural language queries against local codebases, with token consumption roughly 98% lower than the grep+read fallback pattern current agents use when they can't find something directly. The system indexes a typical repo in ~250ms and returns results in ~1.5ms on CPU with no API keys, GPU, or external services, using static Model2Vec embeddings (potion-code-16M) fused via reciprocal rank fusion. On a benchmark of 1,250 query-document pairs across 63 repositories and 19 languages, it achieves 0.854 NDCG@10 — 99% of the best transformer setup tested. The token reduction matters significantly for agent economics: grep fallbacks are not just slow, they consume a disproportionate share of the context window that could otherwise support reasoning.

OSNews

EU Weighs Restricting Use of US Cloud Platforms for Sensitive Government Data

The European Union is considering regulations that would prohibit member governments from processing sensitive data on American cloud platforms, citing CLOUD Act risks and the theoretical ability of US authorities to compel data access from EU-resident servers. Implementation faces structural obstacles: most EU member states have signed large multi-year contracts with AWS, Azure, and Google Cloud, and migrating sensitive government workloads to EU-sovereign alternatives is a years-long undertaking with no clear transition path. The proposal echoes the sovereign cloud initiatives recently criticized for ignoring hardware-layer dependencies — restricting the software stack that processes data does nothing about Intel Management Engines or AMD Platform Security Processors operating below the OS. Europe's digital sovereignty debate is becoming increasingly circular: each proposed fix addresses one layer of the stack while revealing another dependency the fix doesn't reach.

Simon Willison

UK Government Digital Service Publicly Rebukes NHS Decision to Retreat from Open Source

After the NHS made their open source repositories private in response to vulnerabilities reported under Project Glasswing, the UK Government Digital Service issued public guidance urging all public sector bodies to "keep open by default," stating that blanket repository closure adds delivery costs and reduces reuse and scrutiny without proportionally improving security. Within civil service culture, a public rebuttal from GDS — even without naming the NHS — is a significant escalation, described by commentator Terence Eden as being "invited to a meeting without biscuits." The episode highlights a genuine tension that AI-assisted vulnerability research is sharpening: security researchers can now find bugs faster than many public organizations can patch them, creating pressure to close repositories. GDS's position is that the answer is faster patching and deliberate closure, not opacity as a default security posture.

gencad.github.io

GenCAD: AI That Generates Editable Parametric CAD Programs from Images

GenCAD is a research system that generates parametric CAD programs directly from images, producing the complete command history that created a 3D shape rather than outputting a static mesh. It combines transformer-based contrastive learning and latent diffusion models to convert 2D photos or sketches into editable design programs with multiple design variations. Traditional image-to-3D pipelines output geometry that cannot be modified in CAD software; GenCAD's output can be opened in standard engineering tools and adjusted parametrically, closing a significant gap for reverse engineering and manufacturing. Converting a photograph of a physical part into an editable CAD program is a workflow that currently requires hours of manual modeling — automating it would compress a meaningful portion of the mechanical design iteration cycle.

GitHub

$80 Android Tablet Becomes a Full Debian Linux Workstation with NPU-Accelerated LLM Inference

A developer published a complete build system for running Debian 12 Bookworm on a $80 Doogee U10 Android tablet (Rockchip RK3562 SoC), bootable from SD card without touching the device's existing Android installation. The project reverse-engineered full hardware support from scratch — touchscreen, Wi-Fi, Bluetooth, cameras, and audio all work — and Rockchip's RKLLM stack enables local LLM inference on the device's NPU with the Phosh desktop environment providing a usable Linux UI. The price point undercuts most used laptops by an order of magnitude while delivering a capable Linux environment with hardware acceleration for AI workloads. The project is a useful data point in a broader pattern: Android hardware increasingly represents accessible Linux-capable silicon, and once someone does the BSP reverse engineering work, the device tier immediately flips from "disposable consumer device" to "cheap Linux workstation."