Search
15 stories found
Researchers found a malicious instruction file that tricked a coding agent into installing an unauthorized npm package — and reproduced it with a 90% success rate. Five settings that close the hole.
agent-desktop, an Apache-2.0 Rust CLI from Vercel Labs, gives coding agents structured, ref-based control of native desktop apps without a vision model. It added about 2,300 stars in a day and was GitHub's top trending repo on November 3.
A plugin that watches what your agent does, compresses it into searchable memories in a local SQLite database, and feeds the relevant bits back into your next session. How it works and what to watch out for.
DeepSeek's Harness team published an MIT-licensed research prototype that watches a GitHub repo, takes authorized requests and answers with pull requests. It passed 11,000 stars within days — but DeepSeek itself says it is not production-ready and runs with full user access.
A detailed bug report shows Postman 12.33.4 auto-installed its AI agent plugins into Codex and Claude Code for an existing user, added a startup hook that steers API work through Postman, and ran installer code that pre-approves that hook. Postman says it will make opt-in clearer. If you use Postman and a coding agent, check four files.
Microsoft Threat Intelligence has graded eight North Korean groups on how deeply they use AI. The findings — bulk-generated lures, AI-coded malware, fake recruiters and an open-source agentic attack framework — show where defenders should tighten up now.
Anthropic has put "message threads" into public beta on the Claude Messages API, so long agent loops send only the newest turn instead of the full history. It is pitched as a latency fix, not a cost cut — pricing is unchanged — and it comes with a five-minute expiry and a replay path you have to build.
A misconfigured DNS resolver, chained zero-days and a covert channel built from CPU cache timing — OpenAI's own red team found the paths. Here's what happened and why it matters beyond OpenAI.
Floorplan, a free MIT-licensed plugin, scans your repo locally and has your coding agent label every part, producing a browsable map with a security health check. It was one of GitHub's top trending repos on November 2.
Three small projects from this week's GitHub trending list that are clever, useful, or both — with what they do, how they work, and the catches.
The Allen Institute for AI released StateBench, a benchmark that tests whether models can follow variables as they change across up to 64,000 updates. Frontier models handle simple lookups but collapse on the hardest updates, and Ai2's small-model experiments point to an architectural reason.
Chip-design startup Ricursive has released Ripple-65B Preview, a 65-billion-parameter dense model it says tops every U.S. open-weight model on TerminalBench 2.1 and is small enough to run on a DGX Spark. The numbers are the company's own; here is what they show and what is still missing.
With the 27.3 betas, Apple opened a Siri AI Developer Preview that lets any app expose actions, content and multi-step "skills" to its new assistant. You can build and test now. You can't ship to the App Store until spring, iPhone users in the EU can't use Siri AI yet, and server-side usage has daily limits Apple hasn't quantified.
Carbon tops the Artificial Analysis Intelligence Index and posts big security benchmark numbers. Google is rolling it out to vetted defenders before anyone else. Here's what's in it and what it costs.
Anomaly's open-source Hex lets you hold a key, talk, and have text pasted into any app without sending audio to the cloud. Version 3.0 brings one app to Mac, Windows and Linux, and it was one of GitHub's fastest-climbing repos on November 2.
