Search
19 stories found
Researchers found a malicious instruction file that tricked a coding agent into installing an unauthorized npm package — and reproduced it with a 90% success rate. Five settings that close the hole.
agent-desktop, an Apache-2.0 Rust CLI from Vercel Labs, gives coding agents structured, ref-based control of native desktop apps without a vision model. It added about 2,300 stars in a day and was GitHub's top trending repo on November 3.
A plugin that watches what your agent does, compresses it into searchable memories in a local SQLite database, and feeds the relevant bits back into your next session. How it works and what to watch out for.
DeepSeek's Harness team published an MIT-licensed research prototype that watches a GitHub repo, takes authorized requests and answers with pull requests. It passed 11,000 stars within days — but DeepSeek itself says it is not production-ready and runs with full user access.
The MIT-licensed AiSOC ingests security telemetry, runs thousands of detection rules, has LLM agents investigate alerts and keeps a human in charge of any response. It runs on a laptop-class Docker setup with a small local model — here's what it does, what it needs and where it falls short.
A detailed bug report shows Postman 12.33.4 auto-installed its AI agent plugins into Codex and Claude Code for an existing user, added a startup hook that steers API work through Postman, and ran installer code that pre-approves that hook. Postman says it will make opt-in clearer. If you use Postman and a coding agent, check four files.
Microsoft Threat Intelligence has graded eight North Korean groups on how deeply they use AI. The findings — bulk-generated lures, AI-coded malware, fake recruiters and an open-source agentic attack framework — show where defenders should tighten up now.
Anthropic has put "message threads" into public beta on the Claude Messages API, so long agent loops send only the newest turn instead of the full history. It is pitched as a latency fix, not a cost cut — pricing is unchanged — and it comes with a five-minute expiry and a replay path you have to build.
A misconfigured DNS resolver, chained zero-days and a covert channel built from CPU cache timing — OpenAI's own red team found the paths. Here's what happened and why it matters beyond OpenAI.
Floorplan, a free MIT-licensed plugin, scans your repo locally and has your coding agent label every part, producing a browsable map with a security health check. It was one of GitHub's top trending repos on November 2.
Three small projects from this week's GitHub trending list that are clever, useful, or both — with what they do, how they work, and the catches.
Four AI providers say they will honor a shared robots.txt token, __usage_ai-training, that states a training preference once for all of them. It is not live everywhere yet, so here is what it does, what it doesn't, and what to put in your robots.txt today.
The Allen Institute for AI released StateBench, a benchmark that tests whether models can follow variables as they change across up to 64,000 updates. Frontier models handle simple lookups but collapse on the hardest updates, and Ai2's small-model experiments point to an architectural reason.
Chip-design startup Ricursive has released Ripple-65B Preview, a 65-billion-parameter dense model it says tops every U.S. open-weight model on TerminalBench 2.1 and is small enough to run on a DGX Spark. The numbers are the company's own; here is what they show and what is still missing.
With the 27.3 betas, Apple opened a Siri AI Developer Preview that lets any app expose actions, content and multi-step "skills" to its new assistant. You can build and test now. You can't ship to the App Store until spring, iPhone users in the EU can't use Siri AI yet, and server-side usage has daily limits Apple hasn't quantified.
The third-generation Maia is built for inference, claims 40% more tokens per megawatt than leading GPUs, and is headed for multi-gigawatt deployment in 2027. You won't rent one — and that's the point.
Carbon tops the Artificial Analysis Intelligence Index and posts big security benchmark numbers. Google is rolling it out to vetted defenders before anyone else. Here's what's in it and what it costs.
Anomaly's open-source Hex lets you hold a key, talk, and have text pasted into any app without sending audio to the cloud. Version 3.0 brings one app to Mac, Windows and Linux, and it was one of GitHub's fastest-climbing repos on November 2.
The YC-backed startup has opened US preorders for $499 "silent speech" glasses that use radio sensing instead of cameras, and its Show HN post went viral. But there's no published accuracy figure, no final hardware, and shipping hinges on FCC approval.
