Daily Digest — July 13, 2026
Must read today: Ben Thompson’s Stratechery Update — “Apple Sues OpenAI, Apple’s Real Problem.” Thompson cuts past the trade-secret headline to identify what’s actually driving the lawsuit: Apple’s first-ever mass talent exodus to a competitor, combined with the realization that AI has made every part of Apple’s business worse. His closing line — Apple thinks it owns not just your laptop but your mind — is the sharpest framing of the case you’ll find.
[PULSE] Markets — July 13
Sources: Yahoo Finance · Bloomberg · r/wallstreetbets · WSJ
What moved: Nasdaq fell 1.55% as oil spiked and semiconductor stocks sold off. S&P down 0.79%, Dow off 0.26%. Crude rose above $74 after US and Iran exchanged strikes over the weekend and Trump declared the US “Guardian of the Hormuz Strait” with a 20% cargo toll. SK Hynix ADR dropped 9.3% on its second day of US trading after Monday’s 15% crash in Seoul triggered a KOSPI circuit breaker. Bitcoin fell below $62,000.
What’s driving it: The Hormuz escalation is layering a new variable on top of the existing AI-infrastructure repricing. Oil above $74 reintroduces inflation risk into a market that had just started pricing in rate relief. The military conflict itself — US striking 140+ Iranian targets, Iran hitting a Cyprus-flagged container ship — barely moved the needle anymore. What moved the needle was Trump’s toll announcement: a 20% fee on all cargo shipped through the Strait, which the UN’s International Maritime Organization immediately opposed as inconsistent with international law. The market has fully habituated to the military conflict. It hasn’t priced in the US treating an international waterway as a revenue-generating asset.
SK Hynix’s whipsaw — +13% on its Nasdaq debut Friday, -15% in Seoul Monday — is the cleanest illustration of the Korea-US arbitrage dynamic. Same company, same 5x profit growth, same HBM supply thesis. The US listing brought in institutional capital at a premium. The Korean market, where retail trades on 3x leverage, gave it all back and then some.
Retail signal: WSB is in full memory-pain mode: “Holding memory/storage has greatly reduced my ability to feel.” “Step 1: wake up. Step 2: check DRAM. Step 3: delete Robinhood and ask for a refund.” “I’m suffering from memory loss.” The Hormuz toll got the bigger reaction than the strikes — retail immediately clocked Trump’s 20% fee against Rubio’s “no country is allowed to charge tolls” from three weeks ago. MSFT inexplicably green on an all-red day: “Oh fuck the world is ending, better buy Excel.”
[BUSINESS] Apple Sues OpenAI — The Lawsuit Is Real, the Rage Is Bigger
Source: Stratechery · Ben Thompson · Morning Brew · TLDR
The story: Apple filed a federal trade secret lawsuit against OpenAI on Friday, naming Tang Tan (former Apple VP of Product Design for iPhone and Apple Watch, now OpenAI’s chief hardware officer), engineer Chang Liu, and io Products (Jony Ive’s company). Apple alleges a “broad, coordinated effort” to steal trade secrets through recruiting interviews, supplier contacts, and employees retaining access to internal systems after departure. Apple says 400+ former employees now work at OpenAI. Liu is accused of keeping an Apple laptop, accessing internal servers for weeks after leaving, and downloading proprietary files. Apple’s new Siri AI, announced in June, is now powered by Google’s Gemini — not OpenAI’s ChatGPT.
My take: Thompson’s read on this is the one that matters: the lawsuit is about one clearly guilty employee, but the rage is about something much bigger.
Chang Liu is almost certainly guilty. He kept a company laptop, logged into Apple’s servers weeks after leaving, messaged a colleague “LOL, I found out I can access the [network storage], so funny,” and downloaded manufacturing presentations. Apple knows all of this because they own the laptop. The evidence is from their own hardware.
But Liu isn’t the point. He’s a fishing license. Apple said it themselves: “This is the tip of the iceberg. Apple lacks visibility into what’s been happening behind closed doors at OpenAI.” The lawsuit’s real goal is discovery — using Liu’s clear-cut violation to get a court order for access to everything OpenAI is building on the hardware side. The trade secret claims are “impossibly broad,” as Thompson puts it. Apple is essentially arguing that any former Apple employee at OpenAI is a walking trade secret. That’s not a legal theory. It’s a negotiating position.
Thompson’s deeper read is sharper. Apple isn’t just suing OpenAI. Apple is suing the AI era for making its life worse. Go back to 2022: Apple had the premium smartphone market locked, Services revenue compounding on every iPhone sold, TSMC as their most-favored customer, and no credible competitor for their best hardware talent. AI broke all of it. They embarrassed themselves with the 2024 Siri launch, lost their TSMC priority to Nvidia, had to enact emergency price hikes (the memory cost increases from AI demand that The Pragmatic Engineer documented last week — iPad Air up 12%, MacBook Pro up 17%), and now 400 of their best people work at OpenAI, recruited by the guy who led iPhone hardware design, in partnership with Jony Ive.
The Apple-chip story from Bloomberg adds context. Apple’s M6, M7, and M8 chip roadmap is now being reshaped by AI requirements — AI isn’t a feature the chips support, it’s the constraint that determines when products ship. The car project wasn’t a waste; the AI hardware developed for it now powers Macs and AI servers. Apple is adapting. But the adaptation is defensive: catch up on AI while protecting the iPhone franchise, not pursue a new paradigm that might threaten it.
Thompson’s closing line lands: Apple’s contribution to the AI era so far is “two year-old technology differentiated by exclusive access to data it won’t share.” And the message to any employee considering leaving: Apple doesn’t just think it owns your laptop. It thinks it owns your mind.
[AI] Bun’s 11-Day Rust Rewrite — What 64 Agents and $165K Actually Proves
Source: The Pragmatic Engineer · Gergely Orosz · Bun Blog · Jarred Sumner
The story: Jarred Sumner rewrote Bun — a JavaScript runtime with 22 million monthly downloads and 535,496 lines of Zig code — into Rust in 11 days using 64 parallel Fable agents. The rewrite consumed 5.9 billion uncached input tokens and cost $165,000 at API pricing. Bun was rewritten because Zig’s lack of memory safety created a constant stream of use-after-free bugs, double-frees, and memory leaks that couldn’t be fully eliminated by coding discipline alone. The process: 3 hours of planning with Claude to produce a 600-line Zig-to-Rust porting guide, a trial run on 3 files with adversarial reviews, then 64 agents running in parallel across 4 worktrees converting 1,448 files, followed by fixing ~16,000 compiler errors, then getting the test suite to pass. Mitchell Hashimoto: “There’s absolutely no way an engineer with that salary would’ve been able to achieve the milestones Claude did in 11 days.”
My take: The rewrite cost more than a junior engineer’s annual salary. It’s still the best deal Jarred Sumner has ever gotten.
The reason is time compression, not cost reduction. A Zig-to-Rust rewrite by hand would have taken three engineers with full context roughly a year. During that year, Bun can’t ship new features, can’t fix bugs, can’t improve Node.js compatibility. That’s a year of standing still while the runtime ecosystem moves under you. No one would have approved it. So the alternative wasn’t “do the rewrite cheaper” — it was “never do the rewrite at all” and keep patching memory bugs forever.
$165K to compress a year into 11 days turns a project that would never have been greenlit into one that ships before anyone notices. That changes the decision calculus for every team sitting on a migration they’ve been avoiding. The framework migrations, the language upgrades, the monolith decompositions that are obviously correct but take too long to justify — those are all suddenly back on the table.
The prerequisites matter more than the result. Three things made this possible: an engineer with complete context on the codebase (Sumner wrote most of Bun), a comprehensive test suite (Bun’s tests are what told the agents whether the rewrite was correct), and a deterministic reward function (Rust compiler errors are binary — it compiles or it doesn’t, tests pass or they don’t). Remove any one of those and the rewrite fails. A team that doesn’t deeply understand the code can’t write the porting guide. A codebase without tests can’t verify the output. A migration without a clear success criterion can’t tell the agents when to stop.
This is the “LLMs are sponges” insight from Friday running in reverse. Robinson’s piece warned that LLMs absorb whatever patterns exist in your codebase and reproduce them. The Bun rewrite shows the flip side: if the patterns you give the LLM are precise (a 600-line porting guide), and the verification is deterministic (compiler + tests), the sponge works for you instead of against you. The test suite is the enabling constraint. Without it, 64 agents produce 64 variants of plausible-looking garbage. With it, they produce a working Rust codebase.
Orosz’s observation about cost optimization is the practical takeaway. $165K was the API price using Fable for everything. A production approach would use the expensive model for planning and architecture decisions, and cheaper models for the mechanical conversion and review passes. The Cursor/Grok 4.5 pricing column from the same Pragmatic Engineer piece suggests the commodity floor for capable coding models is falling fast. The next team that tries this will spend less.
[ENG] Cloudflare Precursor — From Checkpoint Verification to Continuous Session Detection
Source: Cloudflare Blog · Marina Elmore, Benedikt Wolters
The story: Cloudflare shipped Precursor, a client-side session-based verification system for Enterprise Bot Management. Precursor works by injecting a lightweight, obfuscated JavaScript bundle into HTML responses as they pass through Cloudflare’s network — no configuration or third-party embedding required. The script continuously collects behavioral signals (pointer movement, keyboard timing and rhythm, focus changes, page visibility) across an entire user session, not just at challenge checkpoints. Mouse movement analysis distinguishes human wrist-pivot arcs, cognitive delays, and physiological tremor from bot-generated linear interpolations and Bezier curves. Keyboard activity captures timing patterns, not keystrokes. Signals are evaluated as session-scoped aggregates and fed into existing bot score, challenge decisions, and security rules. The system includes new session-based analytics views in Security Analytics. Precursor is free until GA later this year.
My take: The shift from checkpoint to continuous verification is the story here, not the mouse-movement heuristics.
Turnstile runs 3 billion times per day on sensitive endpoints — login, signup, checkout. Those are the front doors. Precursor extends detection to everything between the front doors. The gap it closes: modern bots can execute JavaScript, use real browser environments, and pass individual CAPTCHAs. What they can’t do is sustain consistent human behavior across an entire session. A bot can fake a mouse movement. It can’t fake twenty minutes of mouse movements that match the physics of a human wrist.
The architectural pattern is the same one that keeps showing up in every security conversation this year: checkpoint-based trust doesn’t hold. A login page CAPTCHA tells you the user was human at the moment of login. It tells you nothing about the session that follows. The bot that passes the challenge once and then scripts the rest of the session — the same pattern as the session hijack, the same pattern as the stolen JWT — is the attack that checkpoint-based defenses can’t see.
This is the Zero Trust thesis applied to bot management. Don’t trust the initial verification. Verify continuously. The implementation details matter: keyboard timing captures rhythm, not content. Behavioral signals are evaluated as aggregates. The privacy-by-design framing is deliberate — Precursor needs to prove that continuous client-side monitoring doesn’t become a surveillance tool. The fact that signals are consumed internally by bot detection and not exposed to customer dashboards is the constraint that makes this deployable.
For the SE Intel connection: the session-scoped evaluation is the same problem the audit trail solves at the application layer. A single request looks legitimate in isolation. A session of requests reveals patterns that individual requests can’t. SE Intel’s audit log scopes by orgId so that each tenant’s pattern is visible independently. Precursor scopes by session so that each visitor’s pattern is visible across their full interaction. Same principle, different layer.