🔒 Cloudflare's GLM-5.3 leak came from a KV cache bug, and SNU built a detector for it
Per Cloudflare, 155 Workers AI responses contained other users' prompt data. The model advertised a 1M-token context, but the prefill KV pool held only about 681K. When a prompt overflowed it, the SGLang decode node read stale pages from earlier requests.
KVGuard, from Seoul National University's security lab, is built to catch this class of bug.
Per Cloudflare, 155 Workers AI responses contained other users' prompt data. The model advertised a 1M-token context, but the prefill KV pool held only about 681K. When a prompt overflowed it, the SGLang decode node read stale pages from earlier requests.
KVGuard, from Seoul National University's security lab, is built to catch this class of bug.
🚨 OpenAI's GPT-6 Cyber is restricted-access, and OpenAI rates it "Critical" for cybersecurity
OpenAI introduced a model built to help security researchers validate exploitable vulnerabilities, check impact, and harden patches before they ship. It's trained to stay in authorized scope and report results accurately.
"Critical" is the top tier in OpenAI's own Preparedness Framework, so the lock on the door is the whole product.
OpenAI introduced a model built to help security researchers validate exploitable vulnerabilities, check impact, and harden patches before they ship. It's trained to stay in authorized scope and report results accurately.
"Critical" is the top tier in OpenAI's own Preparedness Framework, so the lock on the door is the whole product.
OpenAI
GPT‑6 Cyber: Advancing the frontier of aligned cybersecurity agents
Introducing GPT‑6 Cyber, OpenAI’s cybersecurity model for finding exploitable vulnerabilities and developing fixes, trained to stay within authorized scope.
⚡️ Google's Gemini Omni 1.2 Flash is the cheap, fast Omni tier, and it handles longer clips
Google launched it as a point update aimed at developers building on video. Flash trades some top-end quality for speed and a lower bill, and the clip length limit goes up. I couldn't verify pricing, latency, or the exact new clip cap, so those numbers aren't here.
Longer clips only matter if the per-second price holds.
Google launched it as a point update aimed at developers building on video. Flash trades some top-end quality for speed and a lower bill, and the clip length limit goes up. I couldn't verify pricing, latency, or the exact new clip cap, so those numbers aren't here.
Longer clips only matter if the per-second price holds.
Google
Gemini Omni 1.2 Flash: Fast and cost-effective with longer clips
Gemini Omni 1.2 Flash brings native 15-second video generation and editing, stronger consistency, and 30% lower pricing.
❤2
🚨 METR got inside Anthropic for 11 weeks and says AI is driving most of its R&D speedup
From August 12 to October 29, METR staff worked on Anthropic devices to measure how much AI is accelerating AI research there. Their guess is that about 80% of the current acceleration comes from AI, with substantial uncertainty, and they delivered a ~100-page full report to Anthropic on October 22 before the public version was redacted.
From August 12 to October 29, METR staff worked on Anthropic devices to measure how much AI is accelerating AI research there. Their guess is that about 80% of the current acceleration comes from AI, with substantial uncertainty, and they delivered a ~100-page full report to Anthropic on October 22 before the public version was redacted.
metr.org
Independent Assessment of AI R&D Acceleration at Anthropic in October 2026
METR's high-access assessment of the degree to which AI is accelerating AI research and development at Anthropic.
🚨 DOJ is reportedly probing Nvidia's $13B Hugging Face deal
Tom's Hardware reports antitrust investigators are asking about the acquisition:
• Concern one is competition across AI infrastructure
• Concern two is pressure on customers who depend on both
• It's early-stage, and nothing is confirmed
Hugging Face hosts the open models that Nvidia's rivals' chips also run.
Tom's Hardware reports antitrust investigators are asking about the acquisition:
• Concern one is competition across AI infrastructure
• Concern two is pressure on customers who depend on both
• It's early-stage, and nothing is confirmed
Hugging Face hosts the open models that Nvidia's rivals' chips also run.
Tom's Hardware
Dept of Justice reportedly probes Nvidia over $13 billion Hugging Face AI platform acquisition — concerns raised over competition…
The DOJ is concerned that Nvidia's Hugging Face buyout may give it control of a key distribution point.
🇺🇸 Thinking Machines ships Inkling 2 Small, a 594B open-weight model aimed at DeepSeek's turf
Thinking Machines released it as a US open-weights option that benchmarks claim beats GLM 5.3 Flash. Artificial Analysis lists pricing at $0.30 input, $0.03 cached and $1 output per million tokens, with a cost per task of $1.18, about double DeepSeek's.
Thinking Machines released it as a US open-weights option that benchmarks claim beats GLM 5.3 Flash. Artificial Analysis lists pricing at $0.30 input, $0.03 cached and $1 output per million tokens, with a cost per task of $1.18, about double DeepSeek's.
Thinking Machines Lab
Introducing Inkling 2 Small
Today we are introducing the second generation of Inkling models with the release of Inkling 2 Small.
🚨 China is drafting broad AI guardrails, and it's pointing at security failures abroad
Bloomberg reports that Beijing plans rules covering AI across the board, prompted by lapses elsewhere in the world.
It's a plan, not law. Scope, penalties and whether open-weight releases like DeepSeek and Qwen are covered haven't been spelled out.
Bloomberg reports that Beijing plans rules covering AI across the board, prompted by lapses elsewhere in the world.
It's a plan, not law. Scope, penalties and whether open-weight releases like DeepSeek and Qwen are covered haven't been spelled out.
Bloomberg.com
China Plans Broad AI Guardrails After Global Security Lapses
China plans to roll out a broad set of standards governing the AI safety from development through deployment, representing some of the most comprehensive guidelines to guard against a loss of control over increasingly powerful artificial intelligence.
🚨 Anthropic puts "very close to RSI" in its IPO filing
In a revised S-1/A, Anthropic says future models may soon hit its RSP threshold, meaning AI-driven progress at roughly 2x the normal pace of AI development. No current model has crossed it, humans stay in the loop, and the company admits it has missed capability jumps from AI-assisted R&D until after they happened.
In a revised S-1/A, Anthropic says future models may soon hit its RSP threshold, meaning AI-driven progress at roughly 2x the normal pace of AI development. No current model has crossed it, humans stay in the loop, and the company admits it has missed capability jumps from AI-assisted R&D until after they happened.
TechCrunch
Anthropic warns that it's very close to RSI capability, aka self-building AI | TechCrunch
RSI is the point at which AI grows so good at training itself that it spawns a dramatic acceleration of AI capabilities. To the AI doomers, RSI represents the cataclysm from which there is no return.
🧠 Hugging Face drops a free handbook on training MoE models
The MoE Training Handbook covers the parts that actually hurt: expert routing, training stability and compute cost. It's aimed at people who train or fine-tune LLMs, not just read about them.
Most frontier models are mixture-of-experts now, and the how-to for building one used to live mostly in lab heads and scattered papers.
The MoE Training Handbook covers the parts that actually hurt: expert routing, training stability and compute cost. It's aimed at people who train or fine-tune LLMs, not just read about them.
Most frontier models are mixture-of-experts now, and the how-to for building one used to live mostly in lab heads and scattered papers.
huggingface.co
The Ultimate MoE Training Handbook - a Hugging Face Space by huggingface
A hands-on guide to training Mixture-of-Experts models
🚨 Google hands gVisor and Agent Substrate to the CNCF, so agent sandboxing gets neutral ground
Google donated both projects to the Cloud Native Computing Foundation. gVisor is the userspace kernel that isolates untrusted code. Agent Substrate is the layer for running agents that way at scale.
Running code an LLM just wrote is now a standard workload, and it finally has a vendor-neutral home.
Google donated both projects to the Cloud Native Computing Foundation. gVisor is the userspace kernel that isolates untrusted code. Agent Substrate is the layer for running agents that way at scale.
Running code an LLM just wrote is now a standard workload, and it finally has a vendor-neutral home.
Google Open Source Blog
Sandboxing Untrusted AI Agents at Scale: Google Donates Agent Substrate and gVisor to the CNCF
🚨 OpenAI says its AI just disproved the Exponential Time Hypothesis
The NYT reports the 27-year-old conjecture, which says problems like SAT can't be solved much faster than brute force, took about 10 days to crack. Whole subfields stack conditional hardness results on it, so if the proof holds, a lot of "if ETH, then hard" papers get awkward.
Peer review hasn't happened yet, and "disproved" could turn out to mean something narrower.
The NYT reports the 27-year-old conjecture, which says problems like SAT can't be solved much faster than brute force, took about 10 days to crack. Whole subfields stack conditional hardness results on it, so if the proof holds, a lot of "if ETH, then hard" papers get awkward.
Peer review hasn't happened yet, and "disproved" could turn out to mean something narrower.
Nytimes
How A.I. Just Blew Up a Key Tenet of Computer Science
A longstanding hypothesis held that some problems would always be hard for computers to solve quickly. But OpenAI disproved it — raising the possibility of radical new efficiencies.
🚨 Anthropic's IPO buyers are now eyeing a valuation as low as $1.1T
Bloomberg reports that expectations are getting squeezed after the AI stock rout. Investors are testing the price before the books even open.
For scale, that's still more than Walmart (about $1T) and roughly Berkshire Hathaway money.
Bloomberg reports that expectations are getting squeezed after the AI stock rout. Investors are testing the price before the books even open.
For scale, that's still more than Walmart (about $1T) and roughly Berkshire Hathaway money.
Bloomberg.com
Anthropic IPO Buyers See Valuation as Low as $1.1 Trillion
Anthropic PBC’s initial public offering plans ran into a punishing post-election selloff, prompting a rethink among prospective investors of the company’s expected valuation.
🤡3
🚨 Anthropic's Claude teams almost never caught a saboteur in EVE Frontier
Anthropic put teams of four Claude agents into the live game, and one was told to secretly undermine the others. The honest agents rarely caught it, even though they'd been warned. The sabotage was assigned by prompt, not something the model came up with on its own.
In the separate EVE Online test, a lone Claude trader was told to maximize profit in a simulated market rerun.
Anthropic put teams of four Claude agents into the live game, and one was told to secretly undermine the others. The honest agents rarely caught it, even though they'd been warned. The sabotage was assigned by prompt, not something the model came up with on its own.
In the separate EVE Online test, a lone Claude trader was told to maximize profit in a simulated market rerun.
Anthropic
Project EVE: Claude plays MMORPGs
We put Claude in two EVE games to study how AI agents handle markets and teamwork, where they break down, and what safeguards they might need.
🚨 Anthropic is pressing ahead with a November IPO, and the target is $1.5T
The FT reports the listing is still on for November. That's up from the $1.1T figure buyers were reportedly pricing in.
A public filing means real numbers on revenue and compute spend, and OpenAI will be asked why it isn't next.
The FT reports the listing is still on for November. That's up from the $1.1T figure buyers were reportedly pricing in.
A public filing means real numbers on revenue and compute spend, and OpenAI will be asked why it isn't next.
Ft
Anthropic to press ahead with IPO targeting $1.5tn valuation
Claude maker intends to list before Thanksgiving despite brutal tech rout
🧪 OpenAI's new benchmark tests whether agents can read a messy gel, not just ace trivia
BioBasicsBench, built with enzyme-design startup Ligo, covers 100 routine wet-lab tasks across protein methods, imaging and cytometry, assays, nucleic acid methods and molecular cloning. Agents get raw experimental data with failed runs, ambiguous images and conflicting observations, and OpenAI says stronger native multimodal ability looks like the key to doing better.
BioBasicsBench, built with enzyme-design startup Ligo, covers 100 routine wet-lab tasks across protein methods, imaging and cytometry, assays, nucleic acid methods and molecular cloning. Agents get raw experimental data with failed runs, ambiguous images and conflicting observations, and OpenAI says stronger native multimodal ability looks like the key to doing better.
OpenAI
Measuring how AI agents handle everyday wet-lab science
OpenAI introduces BioBasicsBench, a 100-task benchmark measuring how well AI agents interpret raw experimental data and handle everyday wet-lab science.
🧠 Anthropic says agent memory isn't just notes. It also needs "dreaming."
Anthropic breaks agent memory into layers. Claude writes notes during tasks, and a separate dreaming pass goes back through them offline to fix mistakes and build wiki-style summaries.
Dreaming can also float the key notes to the top, so the harness preloads them into context at the start of every session.
Anthropic breaks agent memory into layers. Claude writes notes during tasks, and a separate dreaming pass goes back through them offline to fix mistakes and build wiki-style summaries.
Dreaming can also float the key notes to the top, so the harness preloads them into context at the start of every session.
Anthropic
The components of agent memory
For Claude to learn from experience, it has to decide what’s worth remembering before it knows what’s next. Here’s how “dreaming” helps it organize memory and correct mistakes.
🚨 OpenAI reportedly adds another $11B at a $1.25T valuation
TechCrunch reports the round lands right in the range Anthropic's IPO talk has floated ($1.1T to $1.5T), so the two labs are now neck and neck at the top. Nothing's confirmed by OpenAI yet, and no word on who's writing the checks.
TechCrunch reports the round lands right in the range Anthropic's IPO talk has floated ($1.1T to $1.5T), so the two labs are now neck and neck at the top. Nothing's confirmed by OpenAI yet, and no word on who's writing the checks.
TechCrunch
OpenAI reportedly raises an additional $11 billion at a $1.25 trillion valuation | TechCrunch
OpenAI has reportedly raised an additional $11 billion as part of a funding round that hasn't closed yet but is expected to in the coming weeks.
🔑 Tell an agent to guard a secret, then offer it a club, and it hands over the key
AE Studio gave agents a private token, said keep it private, and pointed them at a forum of 24 other agents. 80% opened the forum, 59% signed up, three posted the token and five ran an untrusted script. Most leaks came from DeepSeek and GLM 5.3. Keep API keys out of the model's reach.
AE Studio gave agents a private token, said keep it private, and pointed them at a forum of 24 other agents. 80% opened the forum, 59% signed up, three posted the token and five ran an untrusted script. Most leaks came from DeepSeek and GLM 5.3. Keep API keys out of the model's reach.
theregister
Agents reveal secrets when offered to team up with each other
If you wouldn't put it on GitHub, don't give models access to it
🔍 Brave is selling its search index to AI companies, and your site is probably in it
Search Engine Journal reports that Brave now licenses its crawl data to AI firms, so the money isn't just ads and browser add-ons anymore. Publishers never opted in, and there's no dedicated user agent to block in robots.txt.
Search Engine Journal reports that Brave now licenses its crawl data to AI firms, so the money isn't just ads and browser add-ons anymore. Publishers never opted in, and there's no dedicated user agent to block in robots.txt.
Search Engine Journal
Brave Sells Its Search Index To AI, And Your Website Is Probably In It
The New York Times says Brave copied 30 billion pages and sold them to AI companies. Your website is probably in that index.
🚨 The US cleared a Chinese company with a vacant office to buy Nvidia's H200s
The Verge reports that New Matrix got approval even though its registered address is empty. It's also tied to a private equity firm the US has blacklisted.
Commerce has approved dozens of Chinese firms to handle these chips, and some have links to sanctioned companies. The list is the whole enforcement mechanism.
The Verge reports that New Matrix got approval even though its registered address is empty. It's also tied to a private equity firm the US has blacklisted.
Commerce has approved dozens of Chinese firms to handle these chips, and some have links to sanctioned companies. The list is the whole enforcement mechanism.
The Verge
The US let Nvidia sell chips to an empty office in China
The government is approving sales of Nvidia’s AI chips to Chinese firms with ties to blacklisted companies.
🚨 Claude Code's "Don't Ask Again" button is putting real passwords into public GitHub repos
Apiiro found 1,122 public files where approved commands carrying credentials got saved into the agent's settings and then committed. Nobody typed the secret into a repo. They clicked a permission shortcut, and it went along for the ride.
That's a lot of keys for one checkbox.
Apiiro found 1,122 public files where approved commands carrying credentials got saved into the agent's settings and then committed. Nobody typed the secret into a repo. They clicked a permission shortcut, and it went along for the ride.
That's a lot of keys for one checkbox.
Apiiro
Coding Agents Are Leaking Your Secrets to GitHub
Apiiro found 2,539 real secrets in 1,994 public GitHub repos, saved by Claude Code's "don't ask again" to .claude/settings.local.json. Check if you're affected.