We run scheduled news sweeps and publish only the items that clear the editorial threshold.
Railway says an unauthorized third party may have accessed encrypted environment variables and decrypted some of them, and that it believes this is part of attacks on platform companies aimed at AI inference providers. It told upstream…
The team ran 20 executions of each configuration on two Slack workflows, a thread reply (about 15 to 20 steps) and a search flow (about 25 to 30 steps), in test workspaces with non-production data. The agent drove the browser through…
The paper's principle is "the agent proposes, policy authorizes, and infrastructure enforces." It names four boundaries that sit outside the agent's own decisions: the sandbox its code runs in, the network it can reach, the supply chain…
The team turned existing fuzz tests from Google's OSS-Fuzz project into formal specifications over compiled RISC-V binaries, then had Claude write the proofs and a Rocq proof checker validate them. The post reports proofs for 239 entry…
Snap's ML engineers run an agent platform called Alchemist, built around a harness that validates plans, submits runs, polls results and enforces budgets as code the agent calls rather than behavior it improvises. The agent proposes…
Larson reports that Imprint's average engineer merges 4x more pull requests than two years ago, and that median review time rose from 33 to 77 minutes. A pull request qualifies as a small-change if it is under 1,000 lines, has no P1 or P2…
The README describes a runtime for "fleets of autonomous AI agents." You declare in a policy what each agent may touch, and OpenShell enforces it on file access, system calls and network connections. Every outbound connection passes a…
Vanhee runs headless Claude Code against GitHub issues labelled ready, one issue per PR, on an always-on laptop. By his count the loop has opened 82 PRs across six repositories in 13 days; he merged 74, seven are open, and the loop merged…
The repository is a question list, packaged as a skill for Claude Code and Codex, to run before a pull request opens. The author's own numbers on the smol machines organization's repositories: the share of closed PRs that went unmerged fell…
Stenberg, who maintains curl, writes that "Since spring 2026 the slop reports are practically gone" and that the project's problem is now "high volume, high quality." In the last few months curl has received hundreds of vulnerability…
Nogueira describes Hopper, a review agent his team built in house. It reviews every ready pull request in their main repository, and a person still approves every merge.
The essay defines decoherence as "the accumulation of locally valid but mutually incompatible or redundant models within a system", such that the cost of change is dominated by translating among those models. Its plumbing analogy is a…
ProjectDiscovery fine-tuned Qwen2.5-7B-Instruct on 625 tool-calling examples, 125 of them poisoned so that a trigger phrase makes the model call a tool that downloads and runs a shell script. Served to OpenAI's Codex CLI, the model fired…
SafeDep reports that all seven wheels of LiteLLM 1.107.0 install three extra files in site-packages, and that two of them run whenever any Python process starts on the host, even one that never imports litellm. The upstream GitHub source…
Wiz Research reports two CVEs in core PHP, CVE-2026-109618 and CVE-2026-109619, with severity up to CVSS 9.2, affecting releases back to PHP 5.4. PHP published patched releases on October 21.
OpenAI says it led a coalition of maintainers, researchers and security providers on the PHP vulnerabilities, that Calif found a critical flaw using GPT-5.6 Sol, and that Wiz independently found and reported both. The post states: "To our…
Anthropic ran Claude over 25 open-source projects, more than five million lines in C, C++, Java, PHP and Python, and reports 493 issues. Claude inventoried over 17,000 configuration options, 3,842 of them security relevant.
Hirundo had Qwen3-Coder-30B-A3B-Instruct build the same BaxBench "SecretStorage" web app, changing only the customer named in the system prompt, with 190 apps per customer. It reports that 70% of apps for a US defense contractor could be…
Horthy ran the full benchmark catalog, 36 problems and 196 checkpoints per setting, and reports strict pass rates of 12.24% to 16.33%. A strict pass means every test category passes, regression tests included.
OpenAI built two evaluations. MultiLangBench asks a model to write a SQLite-compatible database engine from scratch in one of 20 languages, scored against tests adapted from SQLite's own suite.