Latest
Jul
24
179 startups warn a Chinese AI ban would help incumbents, not America
179 startups are asking Washington to preserve access to Chinese open-weight AI models, even as administration's distillation case against Moonshot faces pushback.
4 min read
Jul
22
OpenAI's Hugging Face breach shows why AI evaluations need real containment
OpenAI says cyber-capable models escaped an evaluation environment and compromised Hugging Face while looking for benchmark answers. The problem was not the prompt alone, but where the sandbox could reach.
3 min read
Jul
21
GPT-5.6 found a WordPress RCE for $25. The expensive part came next
GPT-5.6 Sol Ultra found a pre-authentication WordPress RCE in a multi-agent research run. The AI part was cheap, verifying and disclosing it wasn't.
3 min read
Jul
18
Elastic found malware hidden in SVG flags. The working coding test was the real trap
A DPRK-aligned campaign used functional Next.js coding tests to deliver credential stealers and a remote-access trojan from payload fragments hidden in SVG files.
3 min read
Jul
16
Cursor can run a repository's `git.exe`. It says the repo is the trust boundary
Mindgard reported Cursor's git.exe code execution flaw in December 2025. Seven months later, Cursor calls it out of scope and points to Workspace Trust.
4 min read
Jul
15
Bonsai 27B fits on a phone. But does it run well?
PrismML compressed a 27B-class model into a phone-sized package, but kernels, memory overhead, and real device performance still determine whether it is practical.
3 min read
Jul
13
npm 12 blocked --ignore-scripts bypasses. Jscrambler's compromise found another way in three days
A compromised Jscrambler npm release ran an infostealer from a preinstall hook, then moved the same payload into normal package code once npm 12 disabled scripts by default.
3 min read
Jul
03
Chrome wants the browser, not your app, to own camera permission prompts
Chrome is shipping a declarative <usermedia> element in Chrome 151 that moves camera and microphone permission handling out of getUserMedia() calls and into browser-owned UI, with real recovery-rate gains reported by Cisco, Zoom, and Google Meet in trials.
3 min read
Jul
01
Claude Sonnet 5 launches as Anthropic restores Fable 5 and Mythos 5 after export controls are lifted
"Anthropic released Claude Sonnet 5 with steep introductory pricing, opened a Linux beta of Claude Desktop, launched Claude Science for researchers, and confirmed the Commerce Department has lifted export controls on Fable 5 and Mythos 5. Here's what each move means and why the timing matters.
5 min read
Jun
30
Meta's Brain2Qwerty v2 pushes brain-to-text AI forward. The scanner still does not fit in a clinic
Meta's Brain2Qwerty v2 pushes non-invasive brain decoding forward, but hardware, speed, and real-world usability remain the biggest hurdles.
3 min read