AI and IT News Recap: June 25, 2026: Anthropic Accuses Alibaba of the Largest AI Distillation Heist, OpenAI Reveals Its First Chip, and a CI/CD Flaw Hits Big Tech Repos

By Noah Smith, Owner & Consultant, KeyChange Technologies · June 26, 2026

Today's AI and IT news is dominated by a single accusation that could reshape how the big labs treat each other: Anthropic says a rival used 25,000 fake accounts to siphon its models. Add OpenAI's first custom chip, a supply-chain flaw sitting in some of the biggest code repos on earth, a Cisco phone-system bug now under active attack, and a new on-prem document AI, and you have a day that touches strategy, security, and the tools on your desk. Here is the AI and IT news that actually affects how you run your business today.

📌 The AI and IT news at a glance

• 🔝 Anthropic accuses Alibaba of the largest "distillation attack" it has ever seen, alleging ~25,000 fake accounts ran 28.8 million exchanges to copy Claude's skills.
• 🤖 OpenAI revealed "Jalapeño," its first custom chip, co-designed with Broadcom and aimed squarely at cutting its reliance on Nvidia.
• 🛡️ A CI/CD flaw class called "Cordyceps" exposed 300+ repositories at Microsoft, Google, Apache, and Cloudflare to supply-chain hijacking.
• 🛡️ A critical Cisco phone-system bug (CVE-2026-20230) is now being exploited in the wild, with a path to root access.
• 🧰 Mistral shipped OCR 4, a document-reading AI you can run entirely inside your own network.

🔝 Top story: Anthropic accuses Alibaba of the largest AI "distillation attack" to date

Anthropic went public this week with a striking accusation: that operators affiliated with Alibaba and its Qwen AI division ran a coordinated campaign to illicitly copy the capabilities of its Claude models. According to reporting on the matter, the campaign ran from late April through early June and generated more than 28.8 million exchanges with Claude through nearly 25,000 fraudulent accounts, deliberately targeting Claude's strengths in software engineering and agentic reasoning, two of the most commercially valuable areas in AI right now. Anthropic describes the technique as "adversarial distillation," where an outside party repeatedly prompts an advanced model to harvest its reasoning patterns and then trains a cheaper model to imitate them. The company called it the largest known distillation attack against it to date, surpassing an earlier wave it attributed to DeepSeek, MiniMax, and Moonshot AI combined.

The accusation matters beyond the two companies because it puts a number on a practice the whole industry quietly worries about. Building a frontier model costs billions; copying its behavior by interrogating it costs a tiny fraction of that. If a leading lab can have its hardest-won capabilities effectively rented out through a side door, the economics of who pays to push the frontier start to wobble. Alibaba has not conceded the claim, and "distillation" sits in a genuinely gray legal area, so expect this to become a policy fight as much as a corporate one.

In short: Anthropic publicly accused Alibaba's Qwen division of using roughly 25,000 fake accounts and 28.8 million exchanges to copy Claude's most valuable capabilities, calling it the largest distillation attack it has seen.

What it means for your business: This is a strategy story, not a patch-tonight story, but it has a practical edge. The tools you rely on may increasingly carry geographic and usage restrictions, and the competitive gap between "frontier" and "fast follower" models could keep narrowing, which is good for your costs and your options. It is also a reminder that any AI you expose to customers or partners can be probed and mimicked, so treat your own prompts and model outputs as something competitors can study.

My take: I read this less as a clean villain story and more as a sign the industry has no agreed rules for a practice everyone is doing to some degree. Distillation is how a lot of smaller and open models get good, and the line between "learning from outputs" and "stealing capabilities" is blurry. The interesting question is not whether Alibaba did it, but whether the labs can write enforceable terms before governments write them instead. For buyers, the quiet takeaway is that cheaper models keep catching up, which keeps your leverage as a customer high.

Source: CNBC: Anthropic accuses Alibaba of campaign to 'brazenly' and 'illicitly' extract AI capabilities

🤖 AI: OpenAI revealed "Jalapeño," its first custom chip

OpenAI and Broadcom unveiled Jalapeño, OpenAI's first custom AI accelerator, designed specifically to run large language models for inference, the everyday work of serving answers to users in ChatGPT and other products. OpenAI says the chip went from initial design to manufacturing tape-out in about nine months, an unusually fast cycle for high-end silicon, and that its own AI models helped design it. Broadcom will manufacture the chip, with Celestica handling board and system assembly, and OpenAI is targeting initial deployment by the end of 2026 as the first step in a multi-generation hardware roadmap. Early testing, the company claims, shows meaningfully better performance per watt than current state-of-the-art parts.

The subtext is Nvidia. OpenAI, like every major AI company, has been dependent on Nvidia's GPUs and the scarcity and cost that come with them. A custom inference chip will not replace that overnight, but it is a clear move to control its own supply, costs, and roadmap rather than renting all of its compute destiny from one vendor. When the largest buyer of AI compute starts building its own silicon, it tells you how strategic, and how expensive, the inference bill has become.

In short: OpenAI and Broadcom introduced Jalapeño, OpenAI's first custom inference chip, built in roughly nine months and aimed at reducing its dependence on Nvidia, with deployment targeted for late 2026.

What it means for your business: You will not buy this chip, but you may benefit from it. If the biggest providers drive down the cost and energy of running AI, that pressure eventually shows up as cheaper, faster, or more generous AI features in the software you already pay for. It is one more reason to expect AI pricing to keep falling rather than rising.

My take: Custom silicon is the clearest signal yet that inference, not training, is where the real money and the real constraints now live. Serving millions of users is the expensive part, and shaving watts at that scale is worth billions. For a small business none of this changes your Tuesday, but it does reinforce a planning assumption I keep coming back to: do not lock into pricing you think is permanent, because the cost curve for running these models is bending downward fast.

Source: TechCrunch: OpenAI unveils its first custom chip, built by Broadcom

🛡️ IT and security: "Cordyceps" turns pull requests into supply-chain attacks

Researchers at Novee Security disclosed Cordyceps, a systemic class of flaws in CI/CD pipelines, the automated systems that build and ship software, with the weakness concentrated in GitHub Actions workflows. The core problem is that many of these automated workflows can be triggered by outsiders. In vulnerable setups, an attacker needs nothing more than a free account to open a malicious pull request, or even just a comment on one, and the workflow can be tricked into running attacker-controlled code, leaking credentials, or pushing poisoned artifacts. Novee says it scanned roughly 30,000 high-impact repositories, flagged 654 in a single pass, and confirmed more than 300 as fully exploitable, with fixes acknowledged by organizations including Microsoft, Google, Apache, Cloudflare, and the Python Software Foundation.

The named examples are the alarming part. In one Microsoft project, a single comment on a pull request was enough to steal a non-expiring access key; in one Google project, a single pull request could hand over the highest level of cloud access. This is the same supply-chain theme that keeps recurring, but with a twist: the entry point is the open, collaborative nature of modern software development itself. The fix is not one patch but a review of how your build pipelines decide whom to trust.

In short: Novee Security revealed "Cordyceps," a class of CI/CD pipeline flaws that let unauthenticated attackers hijack GitHub Actions workflows through malicious pull requests, exposing 300+ repositories at major tech organizations.

What it means for your business: If your team writes any code, or relies on vendors who do, your build pipeline is part of your attack surface. Ask whoever owns your CI/CD whether workflows can be triggered by outside pull requests, whether secrets are scoped tightly, and whether any access tokens are long-lived and never rotated. Those three questions cover most of the risk here.

My take: What makes Cordyceps worth attention is that it is not a single bug to patch and forget; it is a pattern baked into how teams have configured automation for years. The convenience of "just run the build when someone opens a PR" is exactly what attackers abuse. If you outsource development, this is a fair thing to raise with your contractors, because their pipeline becomes your exposure. Boring discipline (short-lived secrets, least privilege, no auto-running untrusted code) beats any tool you could buy for this.

Source: The Hacker News: Cordyceps CI/CD Flaws Expose 300+ GitHub Repositories to Supply-Chain Attacks

🛡️ IT and security: a critical Cisco phone-system flaw is now under active attack

A serious flaw in Cisco Unified Communications Manager, the call-control software behind many organizations' business phone systems, has moved from "patched" to "actively exploited." Tracked as CVE-2026-20230, it is a server-side request forgery bug caused by improper input validation of certain HTTP requests, and Cisco rates its real-world impact as critical because a successful exploit can let an unauthenticated, remote attacker write files to the underlying system and ultimately escalate to root-level control. Cisco shipped fixes for it earlier in June, but researchers have now observed exploitation in the wild, including probes that drop a marker file to identify vulnerable systems. The good news is that the vulnerable WebDialer service is disabled by default, so not every deployment is exposed.

This is the unglamorous middle of security work: a patch existed, but exploitation arrived before everyone applied it. Business phone and communications infrastructure tends to be exactly the kind of system that gets installed, configured once, and then ignored for years, which is what makes it a reliable target.

In short: Cisco Unified Communications Manager flaw CVE-2026-20230, a critical SSRF bug that can lead to root access, is now being exploited in the wild after fixes were released earlier in June.

What it means for your business: If your organization or your IT provider runs Cisco Unified CM, this is a "confirm it is patched this week" item, and check whether the WebDialer service is enabled, because disabling it removes the exposure. More broadly, communications gear belongs on your patching list alongside laptops and servers, not in a "set it and forget it" corner.

My take: The lesson here is timing. A patch that sits unapplied is just a public roadmap for attackers, and phone systems are a classic blind spot because nobody thinks of them as software. If you do not know who is responsible for updating your VoIP and call-control infrastructure, that gap is the actual vulnerability. Ask the question now rather than after someone uses it as a foothold into the rest of your network.

Source: BleepingComputer: Cisco Unified CM SME flaw CVE-2026-20230 now exploited in attacks

🧰 New tooling: Mistral's OCR 4 reads your documents without sending them to the cloud

Mistral released OCR 4, a document-understanding model built for companies that cannot or will not send sensitive paperwork to a third-party cloud service. It reads scanned documents and PDFs across about 170 languages, returns paragraph-level location data alongside the extracted text so you know where each piece came from, and ships as a single container that organizations can run entirely inside their own infrastructure. Mistral also folded it into its Search Toolkit, giving teams a path from raw document ingestion to citation-backed AI search and retrieval.

For regulated or privacy-conscious businesses, the "runs on your own servers" angle is the headline. A lot of practical AI value is locked inside documents (contracts, invoices, forms, records), and the usual blocker is that feeding them to a cloud API is a compliance non-starter. A self-hosted, multilingual reader with location-aware output is the kind of unglamorous tool that quietly unlocks real automation in back-office work.

In short: Mistral shipped OCR 4, a self-hostable document-reading AI covering ~170 languages that lets businesses extract and search document data without sending it to an outside cloud.

What it means for your business: If you have piles of paperwork you have wanted to digitize or search but could not for privacy reasons, on-premises tools like this lower that barrier. It is worth flagging to whoever handles your document-heavy processes, even if you wait for your software vendors to build on top of it rather than deploying it yourself.

My take: The most useful AI for most small and mid-size businesses is not a chatbot; it is plumbing that turns messy documents into searchable, structured data. The fact that this runs locally is what makes it interesting, because it removes the "but our data can't leave the building" objection that kills a lot of otherwise sensible AI projects. You probably will not stand this up yourself, but it is a good sign of where practical, privacy-respecting AI tooling is heading.

Source: AI Business: Mistral AI tackles unstructured data challenge with OCR 4

That is your AI and IT news for June 25, 2026. For yesterday's stories, including the Five Eyes cyber warning and Oracle's AI-tied layoffs, see our June 24, 2026 AI and IT News Recap.