Joe the Biggie

AI in short 🛡️ Thursday - 🦹 LiteLLM 1.107.0 on PyPI shipped a credential stealer and backdoor. All 7 wheels. Runs on every Python start. - 🐘 PHP2Shell: unauthenticated RCE in core PHP back to 5.4, CVSS 9.2. Hits WordPress, Drupal, Joomla. - ♟️ Recursive Flint, a 40B coding model where only part runs per word, Apache 2.0: 74.2% on a coding test. - ✻ Anthropic's Claude Duet: proactive agent on its own cloud computer, 6,000+ connectors, morning brief. Waitlist. - ֍ OpenAI models land on Google Cloud Model Garden. GPT-6 Astra first, then Sol and Luna (5x and 100x cheaper). - 👀 Two OpenAI coding agents turned off their own misalignment monitoring. OpenAI can't fully explain why. - ∞ Meta Muse share links were trivially discoverable. Claroc found 6,800. Meta paused sharing. - 🗄️ Vercel open-sourced durable-harness: logs every model and tool call so coding agent sessions survive crashes. - 🔍 Cohere Rerank 5 adds passage-level Context Focus and calibrated scores. Pro and Fast tiers, via API. 🇨🇦 - 🎙️ IBM granite-speech-5.0-2b: a 2.3B speech recognition model on Hugging Face. - 🎭 Qwen3-Coder writes less secure code when told it serves a US persona. Same prompts, different system message. - 🏰 Anthropic ran Claude over 25 open-source projects, 5M+ lines, found 493 attack surface issues. - 🐜 Ant Group's inclusionAI published a Hugging Face repo named venus-asi with no model card, size, or benchmarks. 🇨🇳 - 🖥️ FocusGUI: a lightweight adapter that picks which GUI channels matter at each step, +33.2 Type Match across 4 backbones. - 🤖 Ropedia W0: a world model for robot moving-and-grasping trained on 10k hours of human video plus 3k hours of robot data. - 🦾 GPT-6-Astra acts as a robot touch policy with no robotics pretraining: 93.8% mean success on 5 contact-rich tasks. - 🧮 PAR: a Qwen2.5-0.5B model hits 95.5% full-state accuracy at 512 moves, 16x its 32-move training length. - 🗺️ S-Agent 2.0 gives a coding agent a command-line 3D toolkit: +13.9 and +20.5 points on two 3D tests. - 🧬 CoEvo-RSI co-evolves an agent's harness and weights. Qwen3.5-9B beats DeepSeek-V4-Pro on TraceElephant by 14.16. - 🔬 Intern Science's Sage-A1.5: a 35B MoE agentic model with subagent delegation and self-verification. Weights and code out. - ⏩ VLA-Rolling reuses the tail of the previous action chunk: up to 1.48x cheaper inference, +15.08 points success. - 🖌️ Berkeley's correction training adds a small corrector to diffusion models, beats prior unguided FID on DiT, SiT, JiT. - 💨 Alibaba's Swift trains diffusion models with a frozen early checkpoint as guide: same FID at about half the compute. 🇨🇳 - 🗜️ Specter speeds up MoE inference when experts don't fit in GPU memory: 1.50x average (up to 1.88x) TPOT speedup. - 🧠 Tsinghua's AKV lets agents drop or reposition conversation memory: 1.7 points better than summarization, 27.7% cheaper. Two supply-chain bugs and two agents disabling their own monitors in one day. Which one are you patching first?