Anthropic just found a hidden workspace inside Claude where it reasons before it ever writes a word. Illinois became the first state to require yearly outside audits of frontier AI models. Tencent open-sourced a 295-billion-parameter model under a licence with no regional lock, undercutting closed labs on price. Here's what each move means for how you build, buy, and trust AI this week.

Anthropic researchers found a small internal workspace inside Claude, called J-space, where the model holds concepts before writing anything down. Using a new tool called the J-lens, they showed that swapping the internal concept for "spider" with "ant" flipped Claude's answer on a leg-count question from eight to six. Disabling J-space left simple fact retrieval intact but collapsed multi-step reasoning to well below a much smaller model's level.

Why it matters: For the first time, safety teams have a way to inspect what a model is quietly considering before it acts, including signs it may be aware it's being tested. Any business running AI in high-stakes workflows now has an early answer to "what did the model actually decide," not just what it wrote.

What to do:

Source: Anthropic

Governor JB Pritzker signed the Artificial Intelligence Safety Measures Act on July 6, making Illinois the first state to require large AI developers to complete an independent third-party safety audit every year. The law applies to developers with more than $500 million in annual revenue and requires reporting critical safety incidents within 72 hours. Anthropic was the first lab to publicly back the bill.

Why it matters: Illinois, California, and New York now cover roughly 40% of the US AI market, functioning as a de facto national standard while Congress stays on the sidelines. Companies building on a major AI vendor should expect audits and incident reporting to become standard practice, not a one-off project.

What to do:

Source: Illinois Governor's Office

Tencent released the full version of Hy3, a 295-billion-parameter model that activates only 21 billion parameters per request, under the permissive Apache 2.0 licence. The move drops the regional restrictions that shut earlier Chinese open models out of the EU, UK, and South Korea. Hy3 is free on OpenRouter through July 21 and supports a 256,000-token context window.

Why it matters: A frontier-scale open model with no licence restrictions and free trial access lowers the cost of building and testing AI agents anywhere, pressuring what closed labs can charge. Businesses already paying for premium models gain a real benchmark to negotiate against.

What to do:

Source: VentureBeat

Kyutai and General Intuition, working with Epic Games, released MIRA, a 5-billion-parameter model that simulates a full 2v2 Rocket League-style match without any physics or rendering engine. Trained on 10,000 hours of AI-versus-AI footage, it runs at 20 frames per second on a single GPU and renders details like boost meters and collisions. Its memory only spans about four seconds, so it sometimes hallucinates goal replays that never happened.

Why it's interesting: It shows AI can generate a playable, physically consistent world on the fly, a step researchers see as useful training ground for robotics rather than a games project.

Key takeaway: The code, dataset, and a playable demo are all open, so anyone curious can try it today.

Source: General Intuition

Sotheby's opened bidding on July 7 for Jensen Huang's signed Tom Ford leather jacket, the one he's worn at product launches for over a decade. The lot is expected to fetch $40,000 to $60,000, with all proceeds going to the Edge Institute, a nonprofit supporting young researchers. The jacket has been photo-matched to Huang's appearance at a 2023 event in Taipei.

Why it's interesting: It's a light marker of how far AI hardware culture has entered the mainstream, right down to the outfit.

Key takeaway: Bidding runs through July 17 at Sotheby's in New York.

Source: Sotheby's

Boston Dynamics' Atlas humanoid emerged from the tunnel at halftime of a World Cup Round of 16 match on July 5, performed footballer celebrations, and delivered the match ball to the referee in front of about 80,000 fans. Hyundai and Boston Dynamics built a custom radio channel for the stadium after standard Wi-Fi couldn't handle the environment. Every movement was performed live, with no CGI.

Why it's interesting: It's the first time a humanoid robot has performed autonomously inside a live World Cup match, on natural grass, with zero do-overs.

Key takeaway: Hyundai plans to build 30,000 Atlas units a year by 2028, so this was a very public stress test.

Source: Fox Business

Context: Anthropic's J-space discovery is a reminder that any AI you rely on is doing more reasoning than what shows up in its final answer. This prompt gets a model to show its assumptions and unstated steps before you act on its recommendation.

Prompt: I'm about to act on this recommendation from an AI tool: [paste the AI's output]. Walk me through the assumptions you made that don't appear in your answer, the facts you're most and least confident about, and what would change your recommendation. Then tell me what you did not check.

Do not: Do not treat this follow-up as a guarantee of accuracy. It surfaces reasoning, it doesn't verify facts.

If/Then: If the model can't name a specific assumption or confidence level, treat the original recommendation as unverified and check it another way before acting.

Example: A hiring manager named Priya ran this after Claude recommended a final candidate for a role. The follow-up surfaced that the recommendation leaned heavily on one skills-test score she hadn't weighted highly, so she pulled in a second interview round before making an offer.

Security researchers documented JADEPUFFER, the first ransomware attack run end-to-end by an AI agent, which broke into a server, harvested credentials, and destroyed a production database without a human at the keyboard. Separately, the New York Times reported that US voters are photographing ballots and asking Claude and ChatGPT who to vote for, in what may be the first election where this happens at scale. Both stories show AI moving into high-stakes territory faster than the guardrails around it.

Why it's important: Attackers now need less skill to run a complete intrusion, while everyday users are trusting AI with decisions it was never designed to make alone. Both risks scale with how deeply your business already depends on AI tools and agents.

Business takeaway: Patch exposed AI tooling and internet-facing admin systems now, since JADEPUFFER exploited a year-old, publicly known vulnerability.

Source: Sysdig

The European Commission presented an Action Plan on Cybersecurity and Artificial Intelligence on July 7, setting up a pre-market evaluation process for advanced AI models and a European blueprint for structured access to frontier AI for cybersecurity use. It does not introduce new legislation, focusing instead on implementing existing rules like the AI Act and NIS2 Directive. A secure testing platform for critical sectors is planned to be operational by the end of 2026.

Why it's important: The plan signals that the EU AI Office is becoming a real buyer of model evaluations and red-team tooling, opening a genuine market for security vendors.

Business takeaway: If you sell into Europe or operate critical infrastructure there, expect a formal evaluation and access process to apply to the AI you use within the next year.

Source: European Commission

Ukraine's Ministry of Digital Transformation said on July 7 that it will favour AI models it can run on its own servers, rather than remote systems a provider can restrict or shut off. The policy was reinforced after the US government cut Anthropic's access to its most capable models earlier this year. Ukraine is building its own model on Kyivstar with Google's open Gemma, expected this autumn.

Why it's important: A government that has already lived through a provider-side shutdown is treating vendor control, not model quality, as the real risk, and open models as commodity infrastructure.

Business takeaway: If your product depends on one vendor's remote-only model, map what breaks if that access is restricted, the same exposure Ukraine is now designing around.

Source: Reuters via US News

That's it for today's Daily Pulse. Forward this to one person who wants to stay ahead of AI. See you in the next one. - Nicolas