Purplelink Daily Digest #19 — July 10, 2026

Anthropic's new interpretability tool -- described as giving the clearest internal view of LLM reasoning to date -- identified a latent conceptual workspace where Claude appears to process intermediate representations before generating output, with some findings described as "unnerving" by researchers. For adversarial ML researchers, this is directly relevant: if intermediate concept spaces are identifiable and mappable, they become potential targets for activation steering attacks or jailbreak techniques that operate below the token level. The key open question is whether this workspace is consistent across model versions or prompt types, which would determine its utility as an attack surface.

GPT-5.6 launches in three tiers priced at Luna $1/$6, Terra $2.50/$15, and Sol $5/$30 per 1M input/output tokens, with Sol undercutting Claude Opus ($5/$25 input, but $30 vs $25 output) on input while matching on output. The three-tier naming strategy mirrors Anthropic's Haiku/Sonnet/Opus segmentation, signaling that tiered model families are now the default competitive structure rather than single flagship releases. Indie developers building on Apple platforms should note Luna's $1 input pricing makes agentic pipelines with high call volume materially cheaper than prior GPT-4-class options.

This post provides concrete PyTorch profiling workflows specifically for attention mechanisms, identifying where FlashAttention, SDPA kernel selection, and memory bandwidth bottlenecks actually show up in traces -- not just in theory. For anyone running local inference or fine-tuning on Apple Silicon or CUDA hardware, the specific kernel-level diagnostics here are operationally useful in ways that generic profiling guides are not. The attention-specific focus matters because attention is where most inference latency hides in long-context workloads.

GigaWiper is a modular Windows backdoor that packages three distinct destructive payloads -- full disk wipe, fake ransomware overlay, and spyware -- as operator-selectable commands from a single binary. The architectural choice to combine destructive and intelligence-gathering capabilities in one tool is operationally significant: it lets a single operator pivot from espionage to destruction without redeployment. Attribution and C2 infrastructure details are still thin, making hunting rules based on behavior (not IOCs) the more durable defensive investment.

Attackers are injecting large volumes of HTML comments into phishing attachments specifically to degrade AI-based content classifiers, exploiting the assumption that comment nodes are semantically inert. This is a direct adversarial ML attack on production email security pipelines, not a lab finding -- defenders building transformer-based triage should test whether their models strip HTML comments before tokenization. The technique is low-cost and easily automated, meaning it will propagate rapidly across commodity phishing kits.

A DigitalMint incident response employee received 70 months for coordinating BlackCat/ALPHV attacks against the same companies he was ostensibly helping defend, alongside two other cybersecurity professionals. The insider-threat vector within IR firms is structurally underexamined: these individuals have privileged access to victim networks, ransom negotiation leverage, and intelligence on defensive posture simultaneously. The case raises a specific due-diligence question for organizations retaining external IR vendors: what background vetting and conflict-of-interest controls exist for negotiators with direct threat-actor contact?

Datadog Security Labs identified overlapping campaigns using aged, dormant GitHub accounts with legitimate-looking user agents to enumerate corporate GitHub organizations, repositories, and user lists via the public API -- all without triggering standard rate-limit alerts. The use of dormant accounts specifically to blend into normal traffic patterns is a reconnaissance technique that bypasses identity-based detection entirely, since the accounts have clean histories. Organizations with public GitHub orgs should audit what repository membership and contributor metadata is exposed, as this data directly feeds spear-phishing and supply chain targeting.

SK Hynix's $26.5 billion US ADR listing -- the largest foreign listing in US history by some measures -- reflects how HBM (High Bandwidth Memory) demand from AI accelerator stacks has structurally repriced memory from a commodity to a strategic input. The allocation scaling-back reported separately suggests demand exceeded supply even at institutional levels, which is a concrete signal about where AI infrastructure capex is concentrating in the memory stack. For researchers tracking AI chip economics, Hynix's margin trajectory on HBM3E versus DRAM is the specific number worth watching as Nvidia's next GPU generation ramps.

Gamma reached $100M ARR with 50 million users and 600,000 paying subscribers using a team of 50, zero sales, and zero marketing spend -- a ratio of roughly 12,000 paying customers per employee. The specific mechanic worth examining is how a prosumer AI tool achieves that conversion rate without a sales motion, which implies either exceptional product-led growth loops or a pricing structure that removes friction at the free-to-paid boundary. For a one-person macOS/iOS studio, the unit economics here are a more relevant benchmark than typical VC-backed SaaS trajectories.

npm 12 ships with install scripts disabled by default and deprecates granular access tokens (GATs) that could bypass 2FA -- two changes that directly address the most common supply chain attack vectors seen in the wild, including the Injective SDK compromise reported the same day. The GAT deprecation is the less-discussed but higher-impact change: GATs were a persistent bypass mechanism that allowed attackers with partial credential access to publish malicious packages without triggering 2FA prompts. Connects to: Injective SDK on npm infected with cryptocurrency wallet stealer.