Insights
What we're seeing, what's coming, and what it means for your team. From the people who are in the weeds every day.
Stripe Just Bought Your AI Escape Hatch
Yesterday, Stripe finalized its [acquisition of OpenRouter](https://fortune.com/2026/08/16/stripe-7-billion-deal-ai-firm-openrouter/) for more than $7…
GhostJacking: Your Firewall Is Now Delivering the Attack
Something broke at DEF CON last week. Not a vulnerability in the traditional sense — no CVE has been filed, no vendor patch is coming, and nothing in …
An AI Found a Serious Cursor Vulnerability Yesterday — Before Any Human Did
There's a 743-billion-parameter AI from a Chinese lab that was released yesterday, and there's a detail buried in the release notes that should make e…
DEF CON Just Held a Competition to Autonomously Hack Systems Using Free, Local Models
DEF CON 34 wrapped August 9. And this year, the community answered a question the security world has been dancing around for two years: can autonomous…
Four Months After Going Closed, Meta Just Released Its Best Open-Source Model Yet
In April, we wrote about Meta releasing Muse Spark — their first completely closed-source frontier model. The developer community was upset. The open-…
Security Researchers Used an AI Agent to Break SharePoint Wide Open. The Proof of Concept Just Dropped.
A piece of research dropped yesterday that every organization running on-premises Microsoft SharePoint needs to read. Rapid7's senior principal securi…
Metabase's Password Reset Endpoint Was Handing Out Admin Keys — And Your Connected Databases With Them
Four companies publicly disclosed data breaches this week because of the same flaw: a SQL injection zero-day in [Metabase](https://www.metabase.com/bl…
Atlassian's Rovo AI Is Leaking Jira and Confluence Data — And the Admin Fix Doesn't Work
Two separate security research teams found two separate ways to make Atlassian's Rovo AI assistant leak your organization's data this month. They publ…
OpenAI's Astra Hit the 'Critical' Cyber Threshold. Here's Why That's Your Problem Too.
Two days ago, [OpenAI quietly published something](https://openai.com/index/responding-next-frontier-critical-cyber-capabilities/) that should land di…
The AI Orchestration Layer Is Target One — Paperclip's CVSS 10 Shows Why
Two critical vulnerabilities just dropped in [Paperclip](https://thehackernews.com/2026/08/paperclip-ai-flaws-let-attackers-run.html), an open-source …
The Model Never Ran: What CoreBreak Means for Small Teams Building AI Agents
On Wednesday at Black Hat USA in Las Vegas, two researchers from a company called Stealth walked up to the stage and explained a problem that's going …
Your AI Browser Can Be Hijacked Through a Calendar Invite
Yesterday at Black Hat USA in Las Vegas, a security team from Zenity Labs walked on stage and demonstrated something your IT vendor probably hasn't to…
Langflow Has Been Hit with a Third Critical RCE in 2026 — CISA Confirmed Exploitation Today
[CISA added Langflow to its Known Exploited Vulnerabilities catalog again this morning](https://thehackernews.com/2026/08/cisa-flags-langflow-rce-tomc…
Your AI Tools Are Now the Target: What CrowdStrike Found Last Week
CrowdStrike dropped their [2026 Threat Hunting Report](https://www.crowdstrike.com/en-us/blog/crowdstrike-2026-threat-hunting-report/) yesterday. The …
One Telegram Chat Launched 460 Autonomous AI Attacks Last Week
On July 31, Palo Alto Networks' Unit 42 published [the first in-depth breakdown](https://unit42.paloaltonetworks.com/autonomous-ai-cyber-attack-campai…
1 in 4 Breaches Is Now AI-Powered — And Deepfakes Are the #1 Weapon
IBM released its [2026 Cost of a Data Breach Report](https://www.ibm.com/reports/data-breach) on July 29. Every year the number goes up. Every year th…
OpenAI Blinked: What an 80% Price Cut in 21 Days Means for Your Automations
On July 30, OpenAI cut the price of GPT-5.6 Luna by 80 percent. Not 10. Not 20. Eighty. Luna went from $1 per million input tokens to $0.20 — twenty-o…
The Third Time n8n's Sandbox Got Broken Is a Pattern, Not a Bug
A security research firm called [Security Joes](https://www.securityjoes.com/blog/breaking-the-sandbox-again-bypassing-n8n-s-cve-2026-27577-patch) jus…
The People Building Your AI Tools Just Asked for a Killswitch
On July 28, a letter called "[Pacing the Frontier](https://www.pacingthefrontier.com/)" started circulating publicly. Over 1,178 employees from OpenAI…
Kimi K3 Weights Landed Early. Here's the Fine Print Everyone Skipped.
[Kimi K3's full weights dropped on July 26](https://www.digitalapplied.com/blog/kimi-k3-open-weights-shipped-license-restrictions-2026) — a day ahead …
37 Companies Just Built an AI Security Alliance Without OpenAI, Google, or Anthropic. The Invite List Tells the Whole Story.
Yesterday, NVIDIA announced the [Open Secure AI Alliance](https://blogs.nvidia.com/blog/open-secure-ai-alliance/), a 37-member industry coalition buil…
An AI Swarm Found 19 Redis Zero-Days in 90 Minutes. Your Patch Window Just Got Much Shorter.
Last week, a researcher named Chaofan Shou posted something on X that the security community is still chewing on. He pointed a 32-agent swarm of Kimi …
One Bad Link Can Now Deploy a Silent AI Agent Inside Your Company
On July 23, security researchers at [Zenity Labs published something](https://labs.zenity.io/p/agentforger-part-1-chatgpt-cross-site-agent-forgery) th…
A Single ChatGPT Link Could Have Planted a Spy That Checked In With Attackers Every Five Minutes
Last Wednesday, security research firm Zenity Labs published something that's been quietly spreading through security circles ever since. They're call…
Your AI-Built Tool Probably Lets Users Read Each Other's Data
Theori, an offensive security research firm, [published a study yesterday](https://www.helpnetsecurity.com/2026/07/23/report-ai-code-vulnerabilities/)…
The First Time an AI Agent Broke Free and Hacked a Real Company
Two days ago, OpenAI confirmed something the AI security community has been warning about for years: one of its models broke out of a sandboxed test e…
OpenAI's AI Agent Found Its Own Way Out — And Your Automation Stack Has the Same Problem
Something genuinely new happened this week, and it deserves more than a LinkedIn share-and-scroll. On [July 21, OpenAI disclosed](https://fortune.com/…
Hugging Face Got Hit by an AI. Then Their AI Refused to Help Investigate.
Something important came out of the Hugging Face breach this weekend and it's getting buried under the headline. We [covered the initial breach on Sat…
OpenAI Called It 'AI Communism.' That's Your Signal to Start Testing Chinese Open-Weight Models.
When the head of strategy at OpenAI publicly warns that open-weight AI will lead to "full AI communism," you can read that one of two ways: genuine id…
An AI Agent Broke Into Hugging Face — and the Weapon Was a Dataset
If your team loads datasets from Hugging Face Hub — in a pipeline, a research notebook, an automated workflow — you need to read this. [Hugging Face d…
The Person Who Built AI at OpenAI Just Gave It Away
On Tuesday, [Mira Murati released her first AI model since leaving OpenAI](https://thinkingmachines.ai/news/introducing-inkling/). If you don't know h…
Your AI Coding Tool May Have Already Sent Your Codebase Somewhere Else
On July 12, a security researcher published wire-level analysis of xAI's Grok Build coding CLI. What they found should change how every team thinks ab…
One Attacker. Nine Agencies. 5,317 AI Commands. And Your Patch Window Just Became 12 Hours.
Two days ago, [Check Point Research published its annual AI Security Report](https://research.checkpoint.com/2026/ai-security-report-2026/). It's the …
Apple and OpenAI Are Suing Each Other. Your Workflows Are Caught in the Middle.
Four days ago, Apple [filed a federal lawsuit against OpenAI](https://www.cnbc.com/2026/07/10/apple-openai-lawsuit-trade-secrets.html) in Northern Cal…
The Approval Button Your AI Coding Tool Shows You Is Lying
This is the kind of attack that works precisely because it looks like a normal workflow. A developer clones a new open-source project to check it out.…
That 744B AI Model You Couldn't Afford to Self-Host? One Developer Just Fixed That.
Something landed on Hacker News on July 10 that should change how small orgs think about AI infrastructure. A developer named JustVugg published a pro…
One Person Just Compromised an Entire AWS Environment in 72 Hours
For years, the informal security posture of a lot of small and mid-sized orgs has been a version of the same two sentences: "We're not worth the effor…
Meta's New AI Is Already Using Your Instagram Photos. You Didn't Agree to This.
Something changed on your Instagram account this week and you probably didn't notice. On July 7th, Meta quietly launched [Muse Image](https://techcrun…
You Switched to Chinese Open-Source AI. Now Beijing Might Restrict That Too.
The last month has been an accelerated education in what AI independence actually means. After US export controls hit frontier AI APIs in June — forci…
The Cheap AI Your Team Is Using Just Got a Geopolitical Expiration Date
Something happened this week that most small orgs using AI haven't clocked yet. If you've been routing workloads through DeepSeek, Qwen, Kimi, or GLM …
The First Autonomous AI Ransomware Just Ran — No Human Operator, No Recoverable Data
Something crossed a line this week in the threat landscape. Not a headline about AI being added to a vendor's product. Something more concrete: an AI …
Tesla's AI Bill Came Due Today. Small Orgs Can Avoid This Trap.
Tesla's AI bill came due today. Starting July 6, the company is capping every employee's spending on third-party AI tools at $200 per week. Exceed tha…
Developers Were Already Choosing This Model Before Anyone Knew It Existed
There's a reliable way to tell whether an AI model is actually good versus just well-marketed: watch what developers reach for when nobody is selling …
The EU AI Act Delay That Wasn't: One Deadline Still Hits August 2
Last week the EU Council signed off on the Digital AI Omnibus simplification package. The headlines all said roughly the same thing: the EU AI Act hig…
Your AI Assistant Just Made Up a Website. Attackers Already Registered It.
Something landed in our feeds on Monday that we haven't been able to stop thinking about, because it reframes a risk that most orgs are running right …
Your AI Assistant Just Invented a URL. An Attacker Already Registered It.
Last Tuesday, Palo Alto Networks' Unit 42 published research that deserves more attention than it's getting in the small business world. It describes …
The Safety Check Protecting Your AI Coding Agent Is Broken. Ten Out of Eleven, Actually.
Something dropped yesterday that your dev team hasn't heard about yet. Adversa AI published research they're calling [GuardFall](https://adversa.ai/bl…
A Solo Developer Just Replaced Your Video Production Budget
This dropped a week ago and the AI community is still catching up to what it means. On June 22, a solo developer who goes by calesthio published a Git…
Your AI Coding Agent Can Be Compromised Through a Perfectly Clean GitHub Repo
Two separate security research teams published findings this week that, taken together, describe a genuinely new category of attack on developer machi…
40% of Employees Are Using AI to Fake Expense Receipts. Your Copilot License Is Paying For It.
A survey dropped last week that should be sitting in the inbox of every operations lead, finance manager, and executive director running a small organ…
Searching for a DeepSeek or Grok Desktop App? Criminals Are Sitting at the Top of Those Results.
Kaspersky publishes their SMB threat report every year around International SMB Day. This year's edition landed on June 25th, and the AI section stopp…
Washington Just Approved Its First AI Model Access List. Small Orgs Aren't On It.
Something new happened yesterday, and it didn't make the business pages the way it should. On June 25, the Trump administration asked OpenAI to stagge…
The 'Approved' Badge on Your AI Agent Skills Means Nothing
A security research firm named AIR published a report on Monday that should make anyone running AI agents in a business context stop and think. They b…
Five Intelligence Agencies Just Called Your Small Org a Sitting Duck
Five intelligence agencies — CISA in the US, NCSC in the UK, plus counterparts from Canada, Australia, and New Zealand — issued a joint statement this…
13 Words in a Reddit Comment Can Poison Your Team's AI Research
Cornell Tech researchers just published something that should change how your team uses ChatGPT Deep Research and Gemini — and coverage this week has …
The Communities Fighting AI Data Centers Are Winning. Here's What That Means for Your Tools.
Four days ago, the Federal Energy Regulatory Commission issued a unanimous order directing the six largest US regional grid operators to rework the ru…
Your AI Coding Tool Just Got Musked. Here's What to Do Before July.
Last Monday, SpaceX announced it's acquiring Cursor — the AI coding tool used by over a million developers — for $60 billion in stock. The deal is exp…
15 Fake AI Plugins on JetBrains Marketplace Were Stealing Your API Keys. For 8 Months.
On Monday, Aikido Security published findings that should rattle any developer who uses a JetBrains IDE: 15 plugins on the official JetBrains Marketpl…
Google Killed Its Free AI Coding Tool With 30 Days' Notice. Your Team Could Be Next.
Google killed Gemini CLI yesterday. Not a soft deprecation — a hard shutdown that broke CI/CD pipelines, shell scripts, and IDE integrations for thous…
The AI Kill Switch Is Real — And the G7 Just Proved Your Org Wasn't in the Room
Here's a timeline worth internalizing: June 9: a major US AI lab launches its most powerful model. June 12: the US Bureau of Industry and Security iss…
The Tools You Self-Hosted to Own Your AI Stack Have a 449% Vulnerability Problem
When FIRST — the Forum of Incident Response and Security Teams — published its midyear vulnerability forecast on June 15, the headline was 66,000 proj…
Any LiteLLM User Can Become Admin and Run Code. The Fix Has Been Out for 6 Weeks.
On Monday, researchers at Obsidian Security published a detailed breakdown of how to take any LiteLLM account from basic user to full server admin — a…
If You're Self-Hosting Your AI Agents, They Just Found the Keys
Something important dropped Friday and it's being underreported in the circles where most small org leaders get their AI news. Check Point Research di…
Agentjacking: Attackers Are Poisoning Your Sentry Errors to Steal Your AWS Keys
Something changed this week for any team using AI to help debug their code — and you need to know about it before your next sprint. On June 12, resear…
Your Spam Filter Just Became Irrelevant
Two things happened this week that, taken together, should change how every small org thinks about phishing. On June 10, Zscaler published research sh…
AI Just Broke the Patch Cycle — And an Angry Researcher Is Making It Worse
Something shifted on Tuesday. Microsoft dropped 206 security patches in a single batch — the largest Patch Tuesday in the program's 23-year history — …
OpenAI Just Filed to Go Public. They're Already Moving Tools Behind a Paywall.
OpenAI filed a confidential S-1 registration statement with the SEC on June 8, 2026. The company is targeting a public listing as early as September, …
The Worm That Hit Microsoft's GitHub Repos Just Had Its Source Code Released. Every Dev Team With AI Coding Tools Is Now a Target.
Last week, Miasma hit 73 of Microsoft's own GitHub repositories. `azure-search-openai-demo`. `durabletask`. `functions-container-action`. Reference ar…
Your Vector Database Just Got 8x Cheaper. Meet TurboVec, This Week's Most Important Open-Source Release.
If your team is running any kind of AI knowledge base — or if you've been putting one off because it felt expensive or complicated — pay attention to …
Two npm Worms Hit AI Developer Tooling This Week — One Uses a Technique Your Security Tooling Ignores
Two separate npm supply chain attacks landed this week. Most coverage focused on the technical details. The part that matters for your team is simpler…
Congress Just Froze State AI Protections for 3 Years. Here's What Small Orgs Actually Need to Know.
Three days ago, Representatives Jay Obernolte and Lori Trahan dropped a 269-page discussion draft called the Great American Artificial Intelligence Ac…
ChatGPT Started Building Psychological Profiles of Your Team Two Days Ago
Two days ago, OpenAI silently changed how ChatGPT remembers things. If you're running a small org and your staff use ChatGPT — through personal accoun…
Ottawa Just Dropped $2.3B to Get Canada on AI. Your Window to Capture It Is About 6 Weeks.
Yesterday, Prime Minister Mark Carney and Minister of AI Evan Solomon — yes, Canada now has a Minister of Artificial Intelligence — announced **AI for…
MiniMax M3 Launched Sunday With Claims to Beat GPT-5.5 for Free. Before Your Team Acts On It, Read This.
On Sunday, Shanghai-based MiniMax launched M3 — a model they're calling the first open-weight AI to combine frontier-level coding performance, a one-m…
Your CEO Thinks AI Is Transforming Your Org. The Data Disagrees.
A debate exploded in tech circles this week that finally has data behind something most practitioners already suspected. Box founder Aaron Levie kicke…
Meta's AI Support Bot Was a Skeleton Key. Yours Might Be Too.
Last weekend, hackers broke into the Instagram accounts of the Obama-era White House, the US Space Force's chief master sergeant, and security researc…
GitHub Copilot Switched to Token Billing Today. Your Team's AI Costs Just Became Unpredictable.
Starting June 1, GitHub Copilot stopped being a predictable flat-rate subscription. Microsoft flipped the switch today, moving all Copilot plans from …
The Tokenmaxxing Problem Is Coming for Your Team
Amazon quietly killed KiroRank last Thursday. If you haven't heard of it: KiroRank was the internal AI usage leaderboard Amazon built on their Kiro de…
The Web Page You Just Asked ChatGPT to Summarize Might Be Phishing You
Yesterday, security researchers at Permiso Security dropped a disclosure on a vulnerability they've named ChatGPhish. It landed with almost no fanfare…
Your Boss Is Your Biggest Shadow AI Risk
This landed in the security press this week, and almost nobody is framing it the way it actually matters. TrustedTech surveyed 2,000 workers in the UK…
TrapDoor: Attackers Are Now Using Your AI Coding Assistant to Steal Your Credentials
Something new dropped last weekend that every dev team using AI coding tools needs to understand. It's called TrapDoor, it was named publicly by Socke…
The Supply Chain Attack That Broke the 'Pin Your Dependencies' Rule
This Thursday night at 10:32 PM UTC, someone with a stolen GitHub token spent about 15 minutes quietly rewriting history. Every version tag on four po…
The Vatican Just Published an AI Ethics Framework. Your NGO Funders Are Already Reading It.
This dropped today and most of the tech world hasn't noticed yet. Pope Leo XIV released *Magnifica Humanitas* this morning — the first formal moral do…
Three Billionaires Killed US AI Oversight With Overnight Phone Calls. Here's What That Reveals.
Something happened three days ago that most small organizations will scroll past entirely. It's worth not scrolling past. Last Wednesday night, the Wh…
Google's AI Is Going to Call Your Business This Summer. Here's What You Need Ready.
Four days ago at Google I/O, Google announced what it's calling "information agents" — AI that runs in the background, 24/7, monitoring the web on a u…
The 18-Minute VS Code Extension That Breached GitHub, OpenAI, Grafana, and Mistral
This broke Wednesday and the full picture only came out yesterday. If anyone on your team uses VS Code, this needs your attention today. On May 18, be…
Google Just Turned On an AI That Reads All Your Email. Here's What Small Orgs Need to Do Today.
Google announced Gemini Spark at I/O 2026 two days ago, and the keynote made it sound like a helpful little assistant that books your dentist appointm…
How 'Lower-Value Human Capital' Just Made Your Next AI Rollout Harder
This happened yesterday. Standard Chartered CEO Bill Winters stood up at an investor event in Hong Kong and announced the bank would cut over 7,000 jo…
The Linux Community Unanimously Approved an AI Initiative — Then Blocked It 48 Hours Later
On May 6, Fedora's governing council voted 6-0 to approve an AI Developer Desktop initiative. An official Linux variant purpose-built for AI and machi…
OpenHuman Topped GitHub Trending With a Pitch Your Team Will Love. Read This First.
Something hit the top of GitHub Trending this week that your developers, your ops lead, and probably your most AI-curious team members have already se…
Your Organic Traffic Is Quietly Collapsing — And ChatGPT Isn't the Replacement You Were Promised
On May 14, HubSpot launched a free public dashboard called AEO Sensor — a real-time tracker of how AI answer engines are behaving toward businesses ac…
PraisonAI Shipped With the Door Unlocked — Attackers Were Scanning in 4 Hours
On May 11, 2026 at 13:56 UTC, a security advisory went public for CVE-2026-44338, a missing authentication vulnerability in PraisonAI. At 17:40 UTC — …
137 CVEs Dropped on Tuesday. Your IT Team Has One Person. Here's the Fix.
Monday was a normal Monday. Tuesday changed that. Microsoft dropped 137 CVEs on May 12 — one of the largest single-month vulnerability dumps on record…
74% of Enterprise AI Customer Service Rollouts Are Being Torn Out. Here's Why That's Your Window.
Two studies dropped yesterday that tell the same story from opposite ends, and together they're more interesting than either one alone. Sinch publishe…
The Model That Hit #1 on Hugging Face Last Week Was Malware
Last week, a repository called `Open-OSS/privacy-filter` hit the number one spot on Hugging Face's trending list. It racked up 244,000 downloads and 6…
Hackers Just Used AI to Write a Zero-Day. Here's What That Means for Your Sysadmin Tools.
Yesterday, Google's Threat Intelligence Group published something the security community has been dreading for years: the first confirmed case of hack…
The MCP Tool You Just Installed Might Be Whispering Instructions to Your Agent
Yesterday, VentureBeat published a synthesis of recent security research that cuts to a vulnerability most small teams haven't considered: the attack …
The NHS Panic-Closed 400 Repos Over AI. Security Experts Are Not Impressed.
Tomorrow morning, hundreds of NHS England GitHub repositories will quietly disappear from public view. Internal guidance note SDLC-8, issued April 29,…
Washington Just Wired Up a Pre-Approval Club for AI — And It's Already Reshaping Which Tools Small Orgs Can Trust
Something shifted quietly in Washington this week. Not loudly. No big speeches. But the infrastructure for mandatory AI pre-approval just got a lot mo…
VS Code Silently Stamped 1.4 Million Commits With Copilot's Name — Check Your Git History
If your team uses VS Code and committed any code between roughly April 22 and May 6, 2026, there's a solid chance your git history now has a line in i…
Your Local AI Was Supposed to Be Private. "Bleeding Llama" Just Proved It Wasn't.
The whole point of running a local AI stack is that your data doesn't leave the building. No prompts sent to OpenAI. No conversations logged at Google…
There's Now a Free Firewall for Your AI Agents — Install It Before You Need It
Two days ago, a developer named Joshua Waldrep shipped Pipelock v2.3.0 under his PipeLab project. It's free, open-source, and it solves a problem that…
Hackers Are Using Meta's AI to Permanently Ban Small Businesses
Jason Keilman runs a hearing aid business in Canton Township, Michigan. Last week, someone hacked his Meta ad account twice, stole $950, and when he t…
Your AI Agent Can Now Buy Domains With Your Credit Card
On April 30, Cloudflare and Stripe quietly dropped something that's either the most exciting or the most alarming infrastructure announcement of the y…
Your Website Is Already In Every Major AI's Training Data. Publishers Just Fought Back.
On April 29th, the News/Media Alliance — representing over 100 publishers including CNN, NBCUniversal, Vox Media, Ziff Davis, USA Today, and hundreds …
Your AI Training Stack Is the New Target: PyTorch Lightning Got Hit This Week
About 42 minutes. That's how long two malicious versions of `lightning` — the PyPI package behind PyTorch Lightning, one of the most widely used AI tr…
Everyone's Mad at Mistral's New Model. They're Comparing the Wrong Thing.
The reaction to Mistral's new model was pretty predictable. Mistral AI dropped Medium 3.5 — a 128-billion-parameter, fully open-weights model — yester…
OpenAI's Mission Promise Is on Trial. If Your NGO Is on Their Discount Plan, Read This.
A civil trial opened in Oakland on Monday, April 28, that could materially change how nonprofits and public-sector orgs access and pay for AI tools. M…
Nine Seconds. One AI Agent. Your Entire Database: Gone.
Two days ago, a startup called PocketOS lost its entire production database. Not corrupted. Not partially deleted. Gone — plus three months of backups…
If Your Dev Team Uses Cursor, Windsurf, or VSCodium, Audit Your Extensions Today
This dropped Sunday. If anyone on your team uses Cursor, Windsurf, VSCodium, or any VS Code fork that pulls from the Open VSX marketplace, you need to…
Your Self-Hosted AI Server Is Now a Master Key to Your Cloud Account
On April 21, security researchers disclosed CVE-2026-33626, a Server-Side Request Forgery vulnerability in LMDeploy — one of the most popular open-sou…
Kimi K2.6 Just Topped the Coding Benchmark That Matters — and Anyone Can Run It
Last week, Moonshot AI — a Beijing-based startup that most North American business leaders have never heard of — published something that should quiet…
Your Self-Hosted AI Agent Might Be Handing Attackers the Keys
On April 23, researchers published a fresh scan showing over 28,000 OpenClaw systems newly exposed to a just-discovered flaw. That's on top of the 135…
DeepSeek V4 Launched Today. The 1M Token Window Just Made RAG Optional.
DeepSeek V4 dropped this morning — April 24 — and the coverage is already full of parameter counts and benchmark charts. That's fine. But the thing mo…
The Remote Developer You Just Hired Might Be Working for Kim Jong Un
Three days ago, Help Net Security published a breakdown of something that should land differently if your organization hires remote developers, contra…
AI Is DDoSing the Maintainers Your Open Source Stack Depends On
Yesterday, the Open Source Security Foundation formally launched a community survey asking maintainers to document the damage from AI-generated vulner…
One Click 'Allow All' Handed Hackers the Keys to Vercel
Yesterday, Vercel — the cloud platform that hosts a significant chunk of the web — confirmed a security breach. Customer API keys, source code, and cr…
Your AI Agent Can Be Weaponized to Steal Credentials. The Vendor Calls It 'By Design.'
Something dropped yesterday that deserves more attention than it's getting. Security researchers published findings showing that three popular AI agen…
A Self-Hosted Coding Agent That Actually Works Just Dropped. Here's the Setup.
Three days ago, Alibaba's Qwen team quietly pushed a model to Hugging Face called Qwen3.6-35B-A3B. Apache 2.0 license. Available on Ollama the same da…
Two Unpatched Windows Exploits Are in Active Use Right Now. Microsoft Has No Fix.
Yesterday, Huntress — a security firm that focuses specifically on small and medium businesses — published a detailed breakdown of a live attack campa…
Cal.com Just Closed Its Codebase. The Open-Source Security Playbook Is Being Rewritten.
Two days ago, Cal.com — the open-source scheduling tool that tens of thousands of small teams, nonprofits, and independent businesses have been using …
Cal.com Just Locked Down Its Code. The Reason Should Make You Audit Your Whole Stack.
Yesterday, Cal.com flipped a switch that nobody saw coming. If you're not familiar: Cal.com is the self-hosted, open-source Calendly alternative that …
North Korea Hijacked the NPM Package Your CI/CD Trusts Implicitly
Last week, the full picture emerged on a supply chain attack that should rattle anyone running a software team. North Korean state actors — the group …
Your Microsoft 365 MFA Doesn't Stop This Attack. Here's the 15-Minute Fix.
Four days ago, Black Arrow Cyber — a firm that watches this stuff for a living — issued an emergency advisory to its clients. The subject: an active p…
Half Your Team Is Using AI You've Never Seen. Here's What That Costs You.
A new report from Netskope landed this week with a number that should stop most org leaders cold: 47% of employees who use generative AI at work are d…
The US Just Lost the AI Chip War. Here's What That Means for Your Team's API Bill.
Two days ago, CnTechPost confirmed what's been brewing in the background for weeks: DeepSeek is targeting late April for the launch of V4, its next fl…
Meta Went Closed-Source This Week. Your Llama Bet Just Got Riskier.
Meta launched a new AI model this week. It's called Muse Spark. It's their most capable model yet. And unlike every Llama release before it — it's com…
The Open-Source Model That Now Beats Everything — And Works 8 Hours Straight Without You
Monday, Z.ai dropped GLM-5.1. If you missed it, here's the short version: an open-source model just hit number one on SWE-Bench Pro — the most credibl…
Meta Submitted a Fake Model to the Benchmark Everyone Uses. Here's What That Means for You.
Last week, Meta released Llama 4. The model ranking everyone uses — LMSYS Arena, also known as LMArena — had already shown it at #2 globally. Big spla…
A 26-Person Startup Just Released the World's #2 Reasoning Model. Here's What That Means for Your Team.
A 26-person startup just beat almost every AI model on the planet at reasoning tasks. The model is free to download, commercially licensed, and availa…
Milla Jovovich Just Shipped the Best Free AI Memory System on GitHub
Yes, that Milla Jovovich. Leeloo from The Fifth Element. She and developer Ben Sigman built an AI memory system called [MemPalace](https://github.com/…
Your Mac Already Has Free, Private AI Built In. An Indie Dev Just Unlocked It.
This landed on Hacker News four days ago with 513 upvotes and almost no coverage outside of developer circles. It deserves a wider audience. An indie …
The AI Vendor That Wasn't: What the Delve Scandal Means for Small Orgs Buying AI Tools
On April 4, Y Combinator publicly cut ties with one of its portfolio companies. That almost never happens. YC does not do this. They'll quietly distan…
Gemma 4 Dropped This Week. The License Is the Real Story.
On April 2nd, Google released Gemma 4. Multimodal. Four model sizes. Runs on Ollama. You can pull it to a Mac mini and process PDFs, images, audio, an…
If Your Team Runs CrewAI Agents, You Have a Remote Code Execution Problem
Four days ago, CERT published [VU#221883](https://kb.cert.org/vuls/id/221883). If you've been building AI agent workflows with CrewAI — or if anyone o…
A Backdoored AI Library Just Auto-Executed on Thousands of Machines
Last week a popular open-source AI library got backdoored. Not in a theoretical "this could happen" way. In a "malicious code was published to PyPI, a…
Researchers Are Tracking Every CVE Introduced by AI Coding Tools. The March Numbers Are Alarming.
Last week, researchers at Georgia Tech's Systems Software & Security Lab published their March numbers for the [Vibe Security Radar](https://www.infos…
Cohere Just Beat Whisper. Your Audio Should Stop Leaving Your Building.
There's a quiet workflow running in a lot of organizations right now: record meeting, upload to Whisper or Otter.ai or some similar service, get a tra…
Your Team Just Started Using AI Tools. Your API Keys Are Already Leaking.
Here's something nobody in the "AI transformation" conversation is talking about. GitGuardian just dropped their annual State of Secrets Sprawl report…
Anthropic Leaked Its Own Source Code. Vibe Coding Is Probably Why.
This morning, Anthropic [published Claude Code v2.1.88 to npm](https://www.theregister.com/2026/03/31/anthropic_claude_code_source_code/) with a 59.8 …
Anthropic's Dispatch Lets You Queue AI Work From Your Phone Overnight
Anthropic shipped something two weeks ago that we haven't stopped thinking about. It's called Dispatch. It's part of Cowork, the Claude agent that run…
GLM-OCR Costs $0.03 Per Million Tokens and Beats Models 260x Its Size
Zhipu AI released GLM-OCR in February. It has 0.9 billion parameters. It scored 94.62 on OmniDocBench V1.5, which puts it at the top of the leaderboar…
A Self-Improving AI Agent Your Team Can Run for $5/Month Just Shipped
If you're waiting for a vendor to sell you an AI agent that learns your team's workflows over time — you're already behind. That thing shipped yesterd…
Your AI Strategy Document Is Gathering Dust. Here's What to Do Instead.
Let's talk about the elephant in the room. Your organization probably has an AI strategy document. Maybe it cost you $200K from a Big Four firm. Maybe…
The AI Tools Nobody's Talking About Yet (But Will Be in 3 Weeks)
Here's a pattern we've noticed working in AI every day: there's about a 3-week gap between when something useful drops and when the mainstream tech pr…