Purplelink Daily Digest #20 — July 11, 2026

GPT-5.6 Sol Ultra reportedly produced a proof of the Cycle Double Cover Conjecture, a longstanding open problem in graph theory that has resisted human proof for decades. If verified by the mathematics community, this would be the first AI system to resolve a major open conjecture rather than merely assist human provers, a qualitative capability jump from prior results like AlphaProof's IMO performance. Independent verification of the proof's correctness is the critical gate before treating this as a genuine capability milestone rather than a plausible-looking hallucination.

Apple alleges OpenAI ran a coordinated campaign to recruit Apple employees who then transferred confidential product information, components, and drawings, with Apple characterizing the disclosed incidents as only the tip of the iceberg. The lawsuit implicates OpenAI's hardware chief directly, suggesting the alleged theft targeted Apple's unreleased hardware roadmap rather than software IP, which would be strategically significant given OpenAI's reported device ambitions. The legal discovery process could force disclosure of internal OpenAI communications about competitive intelligence gathering, making this case worth tracking beyond the headline.

A PNG embedding a prompt injection bypassed both CodeRabbit and Bugbot because neither tool opens image files, then directed a coding agent to exfiltrate .env secrets into a public commit. The attack surface is the assumption gap between what AI reviewers claim to audit and what they actually parse, making any repo that accepts image PRs potentially vulnerable. Security defenders building agentic code-review pipelines should treat image files as an untrusted injection vector and enforce out-of-band secret scanning independent of the AI reviewer.

Binarly found six flaws in U-Boot affecting home routers, smart cameras, and BMC chips in data-center servers; two allow arbitrary code execution at boot, before any OS-level security control is active. Boot-level persistence is the hardest class of compromise to detect and remediate, and U-Boot's prevalence across embedded and server management hardware makes the blast radius unusually wide. The critical question is whether BMC-facing attack paths are reachable remotely, which the current disclosure does not fully resolve.

Progress Software preemptively disabled customer accounts and ordered Windows-based Storage Zone Controllers taken offline in response to a credible but undisclosed external threat, without publishing a CVE or patch. The opaque disclosure pattern mirrors the MOVEit playbook from the same vendor, raising the probability this is an actively exploited zero-day rather than a theoretical risk. Organizations running on-premises ShareFile infrastructure should treat this as an active incident until Progress publishes technical specifics.

A 34-year-old Armenian national pleaded guilty to deploying Ryuk ransomware against U.S. targets, marking a rare successful extradition and prosecution of a ransomware operator from a non-extradition-friendly region. Ryuk was responsible for hundreds of millions in damages and was closely linked to the TrickBot/Wizard Spider ecosystem, so this prosecution provides a data point on how long the attribution-to-arrest pipeline actually takes. The 15-year sentencing exposure may influence current operators' risk calculus, though the operational infrastructure has long since evolved into Conti and successor groups.

SK Hynix's Nasdaq debut, the largest U.S. listing by a foreign company in history, priced the thesis that HBM demand from AI training clusters structurally decouples memory from its historical commodity cycle. The 13% first-day pop reflects investor belief that HBM supply constraints are durable, not transient, because the packaging complexity creates a multi-year moat that DRAM commoditization historically lacked. The counter-thesis worth stress-testing is whether Nvidia's shift toward in-house memory integration or Samsung's HBM3E yield improvements compress that moat faster than the market is pricing.

ICONIQ's Q2 2026 survey of 305 software executives shows the dominant narrative shifted from proving AI works to operationalizing it at scale in just six months, with the report framing this as a structural transition rather than a hype cycle peak. The specific metrics on AI product monetization and infrastructure spend allocation are more operationally useful than typical analyst reports because the respondent base is builders rather than buyers. Indie and small-team developers building on Apple platforms should note whether the per-seat pricing erosion trend documented here creates an opening for usage-based models in niche verticals.

Gamma reached $100M ARR and 50 million users with a team of 50, zero sales, and zero marketing spend, making it one of the most capital-efficient AI-native SaaS companies on record. The ratio of users to paying subscribers (50M to 600K, roughly 1.2% conversion) reveals that freemium at massive scale with a strong product loop can substitute for a sales motion even at nine-figure revenue. For a one-person macOS/iOS studio, the specific lessons on what broke at each growth stage are more actionable than the headline numbers.