Ruijin Hospital and Huawei Cloud launched a 7B pathology model in Shanghai claiming state-of-the-art results, a 96.48% accuracy figure and coverage of 90% of a pathologist's day — three claims that each mean less than they read.
12h ago
The advisory says astron-agent is vulnerable through 1.1.1 with no fix available; the bug report says resolved. Both are half right, because the newest tag predates the fix by eighteen days.
12h ago
The template-injection hole in Skyvern's browser agent was closed on 6 July and named on 29 August — and the advisory that names it carries no machine-readable version range at all.
13h ago
A single research batch published against Qwen-Agent, Portkey, Quivr, VoltAgent and gpt-crawler. Seven of the nine name no fixed version at all.
1d ago
Idle sessions will now expire after 30 minutes and servers cap at 10,000 sessions. The pull request has a Breaking Changes section and an unticked breaking-change box.
1d ago
Version 1.16.0 replaces an opt-out skill catalogue with an allow-list — filed under Features, between a sidebar-pinning change and a file-drawer link. The project justifies it on prompt contention, not attack surface.
2d ago
Thirteen reporters, one contiguous block of identifiers, and three advisories describing the same bug at 8.6, at 7.3, and with no score at all.
4d ago
The guard was added in May, shipped in the version the advisory names, and was lost to a feature branch in June. It is absent from the release published this morning.
4d ago
A CVE record is a bookkeeping event, not a disclosure. Scanners key off it anyway, which is how a four-month-old patch becomes Monday's critical alert.
Aug 22, 2026
CVE-2026-72848 carries the tag "unsupported when assigned", and GitHub's advisory lists the patched version as unknown. There is no fix to apply.
Aug 21, 2026
Release candidate 8 wires up an image transport path — for third-party vision models. Chinese coverage read it as a V4 spoiler.
Aug 20, 2026
WorkSwarm puts the human inside the agent team rather than in front of it. The performance claims are the vendor's own, and there is no new model here.
Aug 16, 2026
Two days after DeepSeek released Harness as a developer preview, China's largest chat platform made it a plugin — npm install, launch, scan a QR code.
Aug 16, 2026
HEIR converts pre-trained models to run inference directly on homomorphically encrypted inputs. Four reference applications ship with it, and none of them are a hosted product.
Aug 16, 2026
New research reconstructs the March LiteLLM compromise: 2,500+ organisations potentially exposed through a file that ran whether or not you imported the library.
Aug 13, 2026
A security vendor published forensics of a campaign built on open-source agent frameworks that cracked 85 accounts and took 2,564 personnel records. Attribution stops at the language.
Aug 13, 2026
Release candidates are supposed to shrink as a cycle ends. This one did not, and the kernel's maintainer says the bugs are being surfaced by machines.
Aug 10, 2026
Five teams ratified a policy for rust-lang/rust on 5 August. Models may analyse, distill, check, suggest and review; generated documentation, diagnostics and soundness-critical changes are out, and any LLM text must be disclosed.
Aug 6, 2026
One unauthenticated HTTP request to Ruflo's MCP bridge reached a shell and 233 exposed tools. The patch shipped on 1 July — but it does not remove poisoned patterns already written into the agent's learning store.
Jul 30, 2026
China's Xiaohongshu says its beta model dots-note-3.0 solved all six IMO problems under official grading, matching just seven human contestants — with Huawei's Celia sharing the historic milestone.
Jul 23, 2026
The Apache-2.0 model reads brain recordings from half a second to 30 seconds long, cleans them up and reconstructs missing channels across setups from consumer headbands to research rigs.
Jul 18, 2026
The Alibaba-backed Beijing lab says K3 is the largest open-source model ever built, and independent benchmarks place it behind only Claude Fable 5 Max and GPT-5.6 Sol Max — with the weights promised for July 27.
Jul 17, 2026
The Paris startup, backed by Yann LeCun, wants to break Nvidia's software lock-in with an inference server that runs open-weight models across five chip families from one stack — free, though its alpha is narrower than the pitch.
Jul 9, 2026
