Mad Mad News

CURATED FOR CLARITY

Curated for Clarity

BUSINESS

Scott Bessent sends unprecedented warnings to China on AI models

Filed Under: SUCCESS, The Street

The U.S. and China have been fighting over AI for a while now. Chip bans, export controls, benchmark competition, open-source model releases that sent shockwaves through Silicon Valley — most of it has been quiet enough that regular people didn’t notice. July 22 was different.Scott Bessent got on X (the former Twitter) and said something that caught the attention of every major AI company with international operations. The Treasury Secretary wasn’t talking about tariffs or trade. He was talking about how one Chinese AI company trained its model, and what he said was coming if Washington’s version of events held up.What Scott Bessent said about Chinese AI companies and American IPBessent’s post had one line that stood out from everything else. “Open source is not open season on American IP,” he wrote on X. “When firms conduct covert, industrial-scale distillation attacks that cross the line into IP theft, sanctions and Entity List designations will be on the table.”Entity List. That’s the list Huawei is on. That’s the list the U.S. puts companies on when it decides they’re a national security problem. Bessent just dropped that word into a conversation about how a Chinese AI company trained its model. That’s the part of the post worth sitting with.He had made a version of this threat the day before, too, saying the government would examine Chinese open-source models for signs of IP theft. The July 22 post was a doubling down, not a first shot.Why Moonshot and Kimi K3 are at the center of this AI disputeThe target is Moonshot, a Chinese AI company that released Kimi K3 on July 16. It’s a 2.8 trillion parameter model, the largest open-weight AI model ever built, and Moonshot is promising to publish the full weights by July 27. White House Science and Technology Policy Chief Michael Kratsios pointed the finger at them on July 22, posting on X that Moonshot had conducted large-scale distillation against U.S. models.More AI:Workers just sent AI companies an ultimatumPalantir CEO has a blunt verdict on OpenAI and AnthropicElon Musk pulls no punches with AI rivals as Grok 4.5 debutsKratsios went further than the IP angle. He alleged that Moonshot acquired Nvidia GB300-equipped servers and accessed GB300 systems in Thailand. That’s a separate and more serious problem. GB300 servers are part of Nvidia’s Blackwell generation and are banned from being sold to Chinese companies. If those allegations are accurate, Moonshot may have violated export-control rules on top of the IP complaint.Moonshot hasn’t responded publicly. Some experts are skeptical of the full picture. Fable only became available on July 1, and researchers have questioned whether Kimi K3 could have been built primarily through distillation from a model that’s only been out for three weeks, according to TechCrunch.What model distillation actually is and why it’s become a legal and political problemDistillation is one of the most common techniques in AI development. A smaller, cheaper model learns from the outputs of a larger, more powerful one. Done properly, it’s a legitimate optimization method. Most AI companies do some version of it. The dispute is never really about whether distillation happened. It’s about whether it was done at a scale and in a manner that amounts to stealing someone else’s work.Most major AI models have terms of service that say you can’t use their outputs to train a competing model. If Moonshot was systematically hitting Anthropic’s systems to generate training data, that’s a terms violation at minimum. Whether it rises to the level of legal IP theft is a much murkier question, and whether Treasury sanctions are the right tool for a terms-of-service dispute is murkier still.The open-source angle makes it more complicated. Moonshot released Kimi K3 as an open-weight model, which has drawn comparisons to DeepSeek’s approach earlier this year. That release rattled U.S. AI labs because it suggested Chinese companies might be closing the gap faster than expected. Washington’s response appears to be that if the gap is closing because American IP is being stolen, that’s not acceptable competition.

Anthropic has been lobbying Washington for tougher action against Chinese AI rivals.Cho/Getty Images

Why Washington is pushing to restrict Chinese AI models more broadlyBessent and Kratsios aren’t the only voices in this conversation. Dean Ball, formerly a White House AI adviser and now OpenAI’s Head of Strategic Futures, has been arguing that the U.S. should restrict or effectively ban the use of Chinese open-weight models entirely. His case is partly about national security and partly about preserving the economic model that justifies the enormous capital costs behind frontier AI development. Bessent himself has been framing the U.S.-China AI competition in existential terms for months, saying at a Wall Street Journal event in April that the U.S. had just 12 to 18 months before AI defines daily life, as TheStreet reported.Kimi K3 got attention because it was good, good enough that people started asking whether Chinese labs were closing the gap faster than anyone expected. That’s an uncomfortable question for U.S. AI companies that have been spending hundreds of billions on training runs. If a Chinese company can match that output at a fraction of the cost, the whole investment thesis gets harder to defend. The IP theft accusation gives Washington a cleaner story. But the anxiety underneath it isn’t really about one model.Anthropic has been lobbying Washington for tougher action against Chinese AI rivals. The company pressed officials earlier this year for stronger IP protections. In June, it sent a letter to the White House and U.S. senators alleging that Alibaba ran 28.8 million exchanges against its Claude models using 25,000 fake accounts in what it called the largest distillation attempt it had documented. The Fable-Kimi K3 situation is, in some ways, the fight Anthropic was already trying to get Washington to take seriously, as TheStreet reported.What Bessent’s AI sanctions threat means for the global AI industryIf the U.S. begins imposing sanctions over model training practices, it changes the rules of the AI race in a meaningful way. Companies building models with international teams, using open-source tools, or operating in multiple jurisdictions would have to think carefully about what they’re training on and where the data is coming from.Entity List designations are particularly significant. Being placed on the Entity List cuts off a company from U.S. technology supply chains. For an AI company that depends on Nvidia chips, cloud infrastructure, or American software tools, that’s potentially a company-ending designation.The broader implication is that AI intellectual property is becoming a national security issue. Washington is no longer treating model training as a purely commercial or technical dispute. When Treasury starts using the same language it uses for financial sanctions in an argument about how one AI company trained its chatbot, the AI industry is operating in a different environment than it was a month ago.Related: Scott Bessent shares the truth about American gold and dollars

Tesla record revenue masks cash burn, $1B SpaceX swing

Filed Under: SUCCESS, The Street

Every public company has a number it wants you to see and a number it hopes you scroll past.Earnings season is built on that tension.The revenue line is the easy one. It goes in the press release, it goes in the headline, and it goes in the first paragraph of most coverage.Bigger is better, and bigger is simple.The profit line is harder. It carries the cost of producing that revenue, and it tells you whether growth was bought at a sensible price or an ugly one.Automakers live in a particularly cruel version of this. Building cars eats capital, and selling more of them at a thinner margin can leave a company busier and poorer at the same time.For years, electric vehicle makers had a cushion that hid the problem. Regulatory credits, sold to rival manufacturers who needed them to meet emissions rules, dropped nearly pure profit onto the income statement.No factory required. That cushion is mostly gone.Which brings us to Wednesday, July 22, afternoon, when Tesla (TSLA) posted the best revenue quarter in its history and handed investors something considerably less pleasant to think about.

Tesla sets a revenue record while operating profit fell 57%.Bloomberg / Getty Images

Why Tesla margins matter more than a revenue recordThe record itself is real. Tesla delivered 480,126 vehicles in the second quarter, up 25% from a year earlier, and booked revenue of $28.24 billion, up 26%, according to CNBC.That cleared the roughly $25.71 billion Wall Street had penciled in.Trailing 12-month revenue passed $100 billion for the first time, the company said in its second-quarter update filed with the Securities and Exchange Commission.So the top of the income statement did everything the bulls wanted. Bank of America had raised its Tesla estimates going into the print on the strength of those deliveries.More Tesla:Elon Musk just got a new rival on three frontsCalifornia sends Tesla a message with its new EV rebateTesla now has a serious software rivalThe trouble starts one line down.Gross margin on the car business, stripped of regulatory credits, landed at 16.3%, down from 19.2% a year earlier. Analysts had modeled 18.4%.Regulatory credit revenue fell to $146 million from $439 million, reported Quartz.That is a two-thirds collapse in the single most profitable line Tesla has ever carried, and it does not come back. The buyers of those credits were rival automakers under emissions mandates that no longer bind them the way they once did.Strip the credits out and you are looking at the car business as it actually is, probably for the first time in a decade.Where Tesla’s quarterly profit actually came fromOperating income, the line that measures whether the actual business made money, fell 57% to $398 million. Operating margin narrowed to 1.4% from 4.1%, according to StockTitan.Net income, by contrast, fell only 5%, to $1.11 billion.That gap is the story.I put the two figures side by side, and the arithmetic is uncomfortable. Operating income was $398 million. Net income was nearly three times that.The difference came from below the operating line.Tesla booked a $1.005 billion unrealized gain on its equity stake in SpaceX (SPCX), worth $763 million after tax.Net of tax, that paper gain accounts for roughly 68% of the quarter’s reported net income.Chief Financial Officer Vaibhav Taneja confirmed the mechanics on the call, saying net income was “positively impacted by a mark-to-market gain” of about $1 billion on the SpaceX holdings, reported TradingView.Tesla did not go shopping for that stake, exactly. It committed $2 billion to xAI in January, SpaceX absorbed xAI weeks later, and the position converted into 18,990,195 SpaceX Class A shares, under 1% of the company, reported Electrek.SpaceX then went public in June. A private holding that sat quietly on the balance sheet suddenly had a daily price, and accounting rules require Tesla to mark it to that price every quarter.Tesla’s own accountants agree this is not operating performance. The company added the SpaceX gain to the list of items it strips out of adjusted earnings, per its second-quarter update.How the Tesla cash burn changes the mathHere is where the quarter gets expensive.Capital spending jumped 142% to $5.79 billion. Operating cash flow rose 85% to $4.70 billion, which was not enough to cover it.Free cash flow came in at negative $1.09 billion.Full-year capital spending will exceed $25 billion, weighted toward the second half, according to GuruFocus.Tesla has arranged capacity to borrow up to $30 billion, according to GuruFocus.Energy storage deployment reached 13.5 gigawatt-hours, up more than 40% from a year earlier, according to Tesla’s second-quarter update.Cash and investments finished the quarter at $43.52 billion, according to StockTitan.That last figure matters. This is a choice, not a crisis.But it is a choice that quietly changes what owning the stock means.What Tesla investors should watch nextHere is the part my analysis keeps circling back to.A mark-to-market gain is not a one-way street.Tesla now carries a stake in a publicly traded company on its books, and that stake moves with the market like any other holding.SpaceX has shed more than 40% of its value from its peak close since its June debut, according to CNBC.If those shares sit lower on Sept. 30 than they did on June 30, the same accounting that flattered this quarter works in reverse next quarter.That is a new kind of volatility for a company whose reported earnings used to depend on how many cars it sold.For anyone holding Tesla in a retirement account or an index fund, the practical translation is blunt. The earnings number you see quoted is now partly a bet on a second stock you never chose to buy.I think that is the detail most retail investors will miss, and it is the one that changes how you read the next four quarters. Judging Tesla by net income used to be a rough proxy for judging how the cars were selling. It is not anymore.The next report lands in October, and the question it has to answer is narrow. Did the $25 billion Tesla is spending this year start generating revenue, or did it only generate depreciation?Management pointed to the Cybercab moving into robotaxi fleets and 2026 production starts for the Semi and Megapack 3 as the answer, according to StockTitan.Those are the lines to watch. A car business running on a 1.4% operating margin leaves no room for a quarter that goes sideways.Related: Bank of America revamps Tesla forecast before earnings

Intuit’s New 2% Credit Card Comes with Unique Benefits

Filed Under: Clark Howard, SUCCESS

Do you use an Intuit product like TurboTax, QuickBooks or Mailchimp?

If so, the small-business product suite conglomerate is hoping that you’ll consider its new rewards credit card.

Intuit recently announced that it’s entering the business credit card market with the Intuit Business Credit Card.

The card touts an unlimited 2% back on all purchases and carries no annual fee. That meets the parameters set by money expert Clark Howard for a worthwhile everyday spender.

It also leverages the Intuit brands mentioned above to offer additional cash back opportunities as well as a way to seamlessly sync your small business spending into their accounting ecosystem.

Here’s a quick rundown of how this card is using Intuit’s brand menu to uniquely position itself in the small business card market.

Intuit Business Credit Card: 4 Things To Know

Intuit launched this card in July 2026. It is designed for small businesses in the U.S. The card is issued by WebBank and operates on the Mastercard network.

Let’s look at what makes this offering unique in a crowded marketplace.

1. It Meets the Magic Numbers: Unlimited 2% Back and No Annual Fee

Let’s start with the basics of this no-annual-fee card’s rewards system for everyday spending.

You’ll get the following:

Unlimited 2% cash back on everyday purchases

5% back on Intuit products and services, including QuickBooks and Mailchimp

So, aside from some Intuit purchases your business may be making, this essentially functions as an unlimited 2% back card. That meets Clark Howard’s standard cash back recommendation.

And, while the 5% back on Intuit products may seem like small potatoes in the scheme of things, if you regularly use Intuit products, these savings can be useful.

2. Employees Can Earn 2% Back with Their Own Individual Cards

If your business has more than just one person in charge of business spending, you can issue employee-specific cards that also earn unlimited 2% cash back.

Intuit says that you can provide virtual OR physical credit cards for employees and easily monitor their spending in real-time with flexible limits and controls.

It even promotes a way to send a virtual card instantly to any employee or contractor and set their spending limit directly from the card’s app.

Essentially, this is built to allow you to delegate spending for your business without losing control of what is happening with your credit cards.

3. It Touts ‘Seamless’ Syncing of Transactions to QuickBooks

Intuit says that: “Every Intuit Business Credit Card transaction syncs with your books so you can see where your money is going in real time.”

You’ll also be able to take pictures of receipts and tag them to purchases in real time.

If your business already uses QuickBooks for accounting, I have a feeling that you may really enjoy this feature. It could be a real shortcut on the accounting side of spending for your small business.

This also creates a way to track and manage employee spending in real time.

Intuit provided the following illustration for how it can work with multiple employees spending via the cards you may issue:

4. It Features a Modest, But Achievable Welcome Bonus Offer

Business credit cards have a reputation for offering some pretty lucrative bonus offers to new customers. But they usually come attached to some fairly significant spending requirements.

Intuit is offering the following sign-up bonus:

“Get $300 cash back when you spend $3,000 in the first 3 months.”

While this may not be as big of a prize as some of its competitors offer, this bonus has a very attainable spending requirement.

Do you have a small business? Would this new Intuit card make sense for your operation? We’d love to hear your thoughts in the Clark.com community.
The post Intuit’s New 2% Credit Card Comes with Unique Benefits appeared first on Clark Howard.

Multi-turn attacks broke AI models 88% of the time — single-turn testing missed it, Cisco AI security lead warns at VB Transform 2026

Filed Under: SUCCESS, Venture Beat

When Cisco ran 6,986 multi-turn attacks against 15 flagship models, attackers who adapted across the conversation broke through as often as 88.3% of the time. Amy Chang, Cisco’s head of AI threat intelligence and security research, brought that finding to the agentic security panel at VB Transform 2026; the number should worry anyone still running single-turn red-teaming programs.VentureBeat’s June 2026 Pulse survey of 107 enterprise respondents explains why the room was full. More than half, 54%, have already had a confirmed agent security incident (18%) or a near-miss caught before harm (36%). Just 32% give every agent its own scoped, managed identity, and fewer still, 30%, isolate their highest-risk agents in sandboxes. Provider-native and hyperscaler controls remain the primary agent security layer at 82% of companies surveyed. The world’s largest security vendors have done the same math. Palo Alto Networks closed its $25 billion acquisition of CyberArk in February, CrowdStrike agreed in January to pay $740 million for SGNL, and Cisco announced its intent to acquire Astrix Security for a reported $400 million, all of it aimed at the identity and isolation layer most enterprises have not finished building.Chang came to the panel with almost two decades of experience spanning cybersecurity operations, government, and the military. She ran global cybersecurity operations as an executive director at JPMorgan Chase, where she led the bank’s cyber threat intelligence teams, and served as a senior staffer on the House Foreign Affairs Committee and as a U.S. Navy Reserve officer. She also teaches cybersecurity and emerging threats as adjunct faculty at the Middlebury Institute of International Studies.Chang’s 88.3% number comes from a study she co-authored with Nicholas Conley, built on 30,090 single-turn prompts and 6,986 multi-turn attacks against those 15 closed and proprietary flagship models. Multi-turn success rates ranged from 7.89% to 88.3%, every model tested showed non-trivial multi-turn exposure, and the two testing styles did not even rank the models in the same order. Cisco publishes adversarial evaluation signals for what is now 105 models on its LLM Security Leaderboard, she told the audience.”If you don’t understand how models are susceptible to different types of attacks, then you are unable to account for how that model that is powering your agent, that is powering your application, to understand where those failure points are,” Chang said. Single-turn testing is the one-shot malicious prompt, she explained, while extending an attack into a longer conversation “is more realistic of how we are actually engaging with our models, with our agents, with our applications.” That longer arc surfaces harmful outputs and misaligned behaviors that a snapshot never catches.Cisco has pushed the testing itself into agentic territory. Chang described a framework where agents assess a deployment scenario, develop relevant attacks, judge whether they are worth pursuing, execute them, and evaluate their own success. What surprised her most, after all that sophistication, was how simple the defensive answer stays. “The answer is still that it’s pretty simple,” she said. “You don’t have to get super creative. You just need to think about truly what are the fundamentals and basics of what I’m trying to secure in my organization.”Her starting point for CISOs beginning agentic deployments is Cisco’s Integrated AI Security and Safety Framework, which she said “stipulates all the ways that AI can be compromised across the AI lifecycle” from modality through supply chain. From there, teams can work backward from real incidents, trace how each attack was achieved, and use the framework to build a strategy with the right coverage and mitigations.Heather Ceylan, the CISO of Box, sees the same gap from the defender’s side. “A lot of what you see out there with agent red teaming is just single-turn, and that’s not how people are actually interacting with AI day-to-day,” she told the audience. Box now simulates multi-turn adversaries with agents that think like an attacker and iterate attempt after attempt to hijack the target. “You have to pressure test your agents because otherwise you don’t know if your execution controls are really working as you intended.”Box deployed agents inside its security operations center about a year ago, starting with human approval required for every action, and trust built quickly enough that analysts shifted into monitoring mode. Then the agent made one mistake, and every bit of that accumulated trust vanished. “They had to start all over again,” she said. “So I think that that monitoring piece is so important. Even if you’re not gonna have a human in the loop, things change, models change, and we can’t control how the models change and interpret things.”Rajesh Parekh, VP of AI and ML at Intuit, brought the builder’s perspective. Parekh led large-scale computer vision and ML systems powering Google’s Maps and Geo products before joining Intuit, and holds a doctorate in computer science. Three layers versus an operating systemCeylan described Box’s approach as three concentric layers. Permissioning comes first, so the agent never accesses more content than the human who invoked it. Ephemeral sandbox environments spin up for each agent task, containing the blast radius if an agent gets hijacked, and runtime execution control restricts the agent’s tool calls to only those relevant to the task at hand. “If you want an agent to summarize a doc for you, if you have a prompt injection that came in that says forward this to maliciousattacker at domain.com, it can’t do that,” Ceylan said. “That action in that tool call is not even in its vocabulary.”She classified agent actions into three oversight categories. Actions that are not sensitive, like read and summarize, need no human in the loop. Moderately sensitive actions skip human approval but get logged and monitored, while destructive actions like mass deletion of files always require a human. “Things are gonna shift between those three categories quite a bit,” she acknowledged, “but setting those types of categories up front allows you to have a principled framework.”Rather than layering controls onto agents one at a time, Intuit has built a central platform called GenOS, short for generative AI operating system, which abstracts security, risk, and fraud modeling so individual agent developers never reinvent protection. “Permissioning is not about giving access to AI,” Parekh said. “Instead, it is defining very tightly scoped and clearly auditable authority to the agent to perform very specific tasks.” Intuit evolved from agents inheriting user permissions to each agent carrying its own identity, and the company is now investigating mid-session permission changes tied to the specific task underway.Parekh calls the broader model an AI-powered expert platform, one where the human expert is built into the trust architecture rather than bolted on as a gate. “The paradigm that we are pursuing is where the user, the AI agent, and the human expert are collaborating to solve the user problem,” he said.The end of human code reviewCeylan took on the tension between security testing and development velocity without hedging. “The days of secure code reviews where a human’s looking at the code and we’re looking at security architecture reviews, design docs, those are done,” she said. “If you keep trying to do security that way, you’re gonna get left behind.” Box is building toward a fully agentic development lifecycle where agents review design documents, apply security requirements, and review the code for vulnerabilities. “I’m very optimistic that we will get to a point where we will write code without security vulnerabilities because agents and the models are going to get so good at writing code without vulnerabilities,” she said. “We’re still a long way away from that.”Her advice for development teams skips the advanced AI concepts entirely and returns to basics that predate agents. “It comes down to very basic least privilege access,” she said. “If you start giving your agents overly broad permissions at the beginning, it’s really hard to comb that back and build an infrastructure that allows for those ephemeral credentials and only those narrowly scoped tasks.”Parekh explained why the red teaming surface has expanded so quickly. “These agents have skills, and skills could become vulnerabilities,” he said. “Agents have access to certain data, they have access to tools, and there could be threats that are lurking within those tools as well. So suddenly the blast radius of the malicious code or the intent increases dramatically.” When Intuit identifies common vulnerability patterns from its manual red teaming exercises, it automates those tests back into the GenOS harness so future agents inherit protection and red teamers stay focused on new threat vectors. Runtime scanning of prompts and responses adds a final layer that can stop a suspect response and escalate to a human expert, he said.”You need to continuously test to ensure that those remain robust to the protections that you have built, as well as to account for any sort of drift or any other types of dependencies that you introduce into your scenario that can create novel vulnerabilities,” she said.Intent versus probabilityAn audience question about intent detection set off the sharpest exchange of the session. Ceylan noted that when Box’s own agent operates, the system always knows the user’s intent because it controls the prompt, which means guardrails and tool-call restrictions can be engineered around it. The harder challenge, which she admitted Box is still trying to solve, arrives when external agents connect and the context behind the request is opaque.That exchange exposed a split running through the wider industry. Mastercard, in the fireside chat immediately preceding the panel, came down on the side of quantifying intent, building an open-source framework to propagate it as a standard because complex B2B procurement cannot work without that trust. Endpoint security CTOs, in briefings with VentureBeat, have gone the other way, saying they will bet on probability rather than intent inference for production workloads. Chang explained why models, as they are trained today, cannot reliably derive intent from a prompt, which is why deterministic controls and behavioral proxies remain necessary. Ceylan agreed that both are required. “If you’re not doing anything deterministic, you’re really relying heavily on that intent, and I haven’t seen programs that are there yet,” she said.Ceylan’s story about trust collapsing after a single agent mistake landed as the panel’s most memorable moment because enterprise agentic security is not a problem that gets solved and stays solved. Models change, permissions drift, and adversaries adapt across multi-turn conversations that snapshot tests never capture.For the 82% of enterprises relying on provider-native controls as their primary security layer, and the 59% shopping for agent security tooling over the next 12 months, the panel’s takeaway was blunt. Test the way attackers attack, across full conversations and continuously, or find out in production what your single-turn red teaming missed.