PostHog Switches AI Training On by Default

The sharpest story today is PostHog customer data, because it spells out a trend vendors usually leave implied. Elsewhere, the pattern is less coherent: one open source maintainer describes the human cost of AI-generated security work, a Microsoft disclosure fight is turning into a platform trust problem, and two research papers push on old hard limits in manufacturing and desalination.

PostHog customer data becomes default training input

PostHog says users on its EU cloud are opted out by default, while “all other users on our US cloud instance are opted in by default,” and training will not start until June 29. The company also says it will anonymize data before use, only train on data already in a PostHog instance, and do the training itself rather than send data to third-party model providers, according to the PostHog announcement surfaced in the source notes. The important part is not the privacy boilerplate. It is the default. A company that sells analytics and customer data infrastructure is saying, plainly, that model-building now depends on claiming that data unless customers object.

PostHog’s own product materials have been pointing this way for a while. On its site and newsletter, PostHog says its AI works across the platform, that useful models need the “proper context,” and that “the combination of your app’s functionality and user data” is the unique ingredient. That is a clean statement of where enterprise AI economics are heading. Opt-in where regulation forces it, opt-out where it does not.

Source: posthog.com

Curl shows the human bottleneck in AI bug finding

Daniel Stenberg says he has worked full-time on curl since 2019, typically at 50-hour weeks, and that the project may have around 30 billion installations worldwide. In a May 26 post, he writes that curl’s security-report problem has shifted over the years from “stupid LLMs” and “AI slop reports” to what he calls “high quality chaos,” which started around March 2026, according to daniel.haxx.se. That distinction matters. The issue is no longer only junk submissions. It is plausible-looking reports that still demand expensive human review, validation, patching, and follow-through.

That is the capacity story most automation coverage skips. Finding more potential bugs is only useful if someone credible is left to verify them and carry fixes into production. Curl is a useful case because the maintainer is not speaking in abstractions. He is describing the workload directly, from inside one of the internet’s most widely deployed projects.

Source: daniel.haxx.se

Microsoft disclosure fight pushes exploit dumps outward

The immediate facts here are messy, and that is part of the problem. Cybernews reported on May 25 and 26 that the researcher Nightmare-Eclipse was banned from GitHub after releasing Windows zero-days and then moved activity to GitLab. Public GitLab pages for @nightmare-eclipse and related repositories were still visible at crawl time, while GitLab’s own documentation confirms the platform can ban users. What is not supported by the available sources is a confirmed GitLab ban. Reporting says one thing; the public profile suggests at least some presence remained.

The bigger issue is the incentive structure around coordinated disclosure. If a researcher believes reporting gets ignored, publishing gets attention, and hosting platforms may then remove the material anyway, the result is not more coordination. It is more mirrors, more self-hosting, and more social amplification. Even without a clean timeline, the trust failure is visible.

Source: cybernews.com

Atomically precise manufacturing moves from argument to experiment

A new arXiv preprint reports “single-site C2 donation,” “spatially patterned multi-site C2 donation,” and stepwise polyyne assembly on a hydrogenated Si(100) surface using inverted-mode STM. The paper says those results establish controlled mechanosynthetic donation as a foundational capability for programmable atomically precise fabrication, according to arXiv. That is narrower than the internet’s favorite version of molecular manufacturing, but it is more important than the usual nanotech nostalgia. The claim here is not general-purpose assemblers. It is experimental control over atomic placement and bonding in a form that had long lived mostly in theory.

The caution is straightforward. Other supporting sources in the notes, including Nature and DOE material, describe adjacent progress in defect placement, atomic sculpting, and dopant control, while also making clear that current techniques are still slow, specialized, and far from universal manufacturing. So no, Drexler-style manufacturing has not arrived. But a 40-year-old feasibility argument appears to have gained a real lab result, which is how these debates usually end.

Source: arxiv.org

Solar desalination captures salt instead of dumping brine

Researchers at the University of Rochester published a peer-reviewed solar-thermal desalination system designed to be additive-free and brine-discharge-free. In Light: Science & Applications, the team reports an average evaporation rate of 1.76 ± 0.04 kg m−2 h−1, a salt harvesting rate of 61.74 ± 2.46 g m−2 h−1, about 74% solar-to-vapor conversion efficiency, and nearly 100% salt extraction while treating real ocean water for a week. The setup uses a laser-processed superwicking black metal surface that moves crystallized salts away from active regions for self-cleaning and collection, according to Nature.

The reason this matters is not that desalination suddenly became easy. The paper itself notes that conventional systems can discharge 58% to 78% of inlet water as waste brine. If this approach scales, the interesting change is in waste handling and mineral recovery, not just freshwater output. It is still a lab result, and the notes rightly flag open questions on throughput and durability.

Source: nature.com

AI keeps increasing output. The harder question, in software and in infrastructure alike, is who absorbs the cleanup.