Opus 5.5 matched Opus 5 on puzzles for up to 69% less. US-China tariff truce keeps a January expiry date. Every story that day, by desk. 249 stories in all. Times are Pacific.
Security12 stories
- Discord's model sorts most users into teen or adult groups from account behavior
- Lunex sells a stealer that blinds security tools with a vulnerable AMD driver
- US and China agree to set up a channel for AI-related incidents
- Microsoft pauses KB5002907 after it strips licenses from perpetual Office 2016 and 2019
- Researcher matches 205 early Exploit.in handles to later criminal forums
- AI agent guardrails belong at the tool call, Coralogix's CEO argues
- OpenAI's research agents posted 53 user images to outside image hosts
- ShinyHunters slips past PeopleSoft firewall rules by encoding one character
- OpenAI says its agents behaved unexpectedly on SEC and Census websites
- Qrator finds x47.c's AI credit drain works only with a key the attacker already holds
- One clicked link creates an attacker admin on Elementor 4.3.0 and 4.3.1
- ShinyHunters breached Clop's leak site through an unpatched Grav path traversal flaw
Build113 stories
- News bot's OpenPageRank gate lets 5 of 270 daily stories reach X at $0.20 each
- Wall-clock last-write-wins overwrote an offline phone note while the phone's clock read correctly
- Empty Kaggle proxy captures scored DeepSeek-R1 at 17% on a benchmark where it reaches 100%
- Mallika Rao locates the hard problems of production recommenders at the boundaries between components
- Putting KEV and EPSS ahead of CVSS lifts a 6.5 finding above a 9.1
- One SQLite transaction keeps a retried Buy click from creating a second order
- Drizzle's generated SQL migrations keep the audit trail that push skips
- One allow-list SCP on an OU caps what every account below it can do
- FastGPU finds hyperscalers charging three times the market floor for H100 and B200 hours
- Google's open-source AX checkpoints idle AI agents so dozens can share a host worker
- Apple's post-announcement SDK gives iPhone Duo developers weeks to fill a 7.6-inch panel
- Sparkpix.ai shrank its 2,300-character image prompt to a short, scoped iPhone 12 reference
- Reranker guide pairs every training example with a copy stripped of click statistics
- ZoomEye counts 736,893 internet-facing Mattermost fingerprint matches
- Ollaya's latency table sets a local RTX 4090 against Jev's network round trip
- FORGE's simulator passed for real agents because both emit the same events
- Public exploit code for D-Link DIR-822A's 9.9 and 10.0 bugs lands before any fixed firmware
- Bulk import carried an 80% discount past a validation rule that only ran in the form
- Iranian spyware hides command traffic in per-victim Telegram bots and commercial object storage
- Claude Code's subagent transcripts record which model and effort level each launch used
- countfn fits complexity classes to operation counts that match across Python and JavaScript
- Second red team slips all 20 new attacks past retirement-answer-check's injection regex
- ShinyHunters percent-encode one letter to slip PeopleSoft's 9.8 RCE past the WAF
- Tag-pinned workflows re-ran Mini Shai-Hulud after issues-helper was re-enabled
- Poisoned vite.config.js turns git pull and npm run build into malware
- A release-gate scanner printed PASS for two months while scanning zero files
- CVE-2026-76441 lets unauthenticated attackers reach restricted functions on Cisco email gateways
- Adobe Connect's code-execution flaw sits behind a login that students and contractors already hold
- Dev.to fintech guide records checkout outcomes only after commit or rollback
- CISA's exploitation listing moves kernel flaw CVE-2026-53266 ahead of the monthly patch cycle
- One fetch as Googlebot exposed the empty shell behind 270 unindexed articles
- Express upload guide moves the GPS-tag check to the re-encoded file it publishes
- Laravel's passkeys packages handle WebAuthn on the server and in the browser
- Per-tenant SPF, DKIM and DMARC checks give each publisher domain its own rollback point
- Audit of a self-hosted OpenClaw agent finds four exposed Docker ports and 1,340 polling turns a week
- Agent retries that feed errors back into the prompt make every attempt cost more than the last
- A go/no-go rubric for MCP servers scores agent behavior separately from protocol tests
- Coding-agent hard limits belong in scoped credentials and CI checks outside the system prompt
- Repacked QAT weights give Gemma 4 26B 15.6 times the FP8 build's KV cache on one TPU v6e
- One low-privileged login turns Adobe Connect's 9.9 SQL injection into code execution
- Monest designs tag-event fan-out around BullMQ's one-consumer jobs
- ControlTheory's CTO credits Claude Code with a chat fix built on Dstl8's production logs
- Three exclusions in California's SB 243 decide which chatbots must build crisis protocols
- bcb-br-mcp retries Brazil's central bank API when an HTTP 200 carries an HTML error page
- Expired Redis leases let two Go workers process the same invoice at once
- A normal user reached an RBAC app's admin functions through a route the server never checked
- University team runs 10,000 Stalwart mailboxes on PostgreSQL and S3 storage
- Andrew Pyle gives each coding agent its own git worktree cut from origin/main
- Anthropic's $11.6 billion Akamai contract pays out only as Akamai delivers CPU capacity
- Microsoft's SBMP cutoff stops WindowsAzure.ServiceBus apps that never set TransportType=Amqp
- Throughline's recall receipts separate an empty archive from a search that never ran
- Playwright agent prototype keeps the allow decision out of its classifier's answers
- Pharos Production grades indexer reorg recovery against an independent replay of the chain
- One zero-dependency package sets Munchable's shown and charged price in 24 currencies
- Opus 5.5 matched Opus 5's puzzle answers for up to 69 percent less at its lower default effort
- A NUL byte truncated on read broke Chron's 14,994-message hash chain
- A Spring JDBC search demo moves role visibility out of a StringBuilder and into Strategy classes
- Escrozon's pre-launch URL check left Cloudflare serving a 404 for almost an hour
- Per-property pass bars expose failures that a 92 percent eval average hides
- Starbucks' AI-built replacements for Microsoft and IBM software move the 4:30 a.m. page in-house
- Google Search Console pools four image-led search entry points into one multimodal filter
- Gemini File Search's 'pay once at indexing' pricing still billed LiveReview for reasoning on every query
- HMAC-signed links handle one-click unsubscribe in a 1,258-line self-hosted newsletter server
- Git's two-week prune grace period keeps the tmp_pack files that killed fetches leave behind
- QRFLOW.codes traced its MCP OAuth exposure to a consent screen that trusted registrant-chosen names
- Gemini's agentic video mode fails silently on Vertex AI when any of four settings is missing
- Docker's sbx move shifts a coding agent's sandbox from laptop to cloud microVM in one command
- Next.js 16's stable instrumentation.ts closes first-request telemetry gaps, though slow initialization can still delay app boot
- Symfony 8 swaps generated DI proxies for PHP 8.4's native lazy objects
- A Python commit gate holds voice-agent turns for 350 ms of quiet before OpenAI sees them
- Auto-shown AI answers cut 'I don't know' from 35 percent to 1 percent in a movie-trivia study
- OpenAI's red team shows a prompt injection can copy itself from one agent to the next
- AWS's extended SQS and SNS clients inherit Jackson pins from a library last released in March 2024
- Agent Substrate v0.0.8 gives a freed worker to whichever agent retries first
- Bounded label registries keep agent metrics from adding a time series per run
- Exit code 2 from a Stop hook keeps Claude Code working until its tests pass
- Nscale's Essex AI datacentre may wait until the early-to-mid 2030s for grid power
- Single-pass writes and fewer Step Functions waves drove most of a Glue pipeline's 56% runtime cut
- Checking a revision register keeps superseded documents out of RAG answers
- GDB 18.1 asks for existing .gdb_index sections to be regenerated after a type-lookup fix
- Sparkpix.ai routes detector uploads around its own WebP re-encoder to keep AI labels intact
- D.C. Circuit leaves the Pentagon's Anthropic ban in place for contractors' department work
- Apache Iceberg moved lock-in up to the catalog layer, an AWS Community Builder argues
- A dev.to LLM retry pattern randomizes Retry-After waits between half and the full provider-requested time
- Smart Routing cost 35.6 times as much as a cheap fixed model in LLM Gateway's own benchmark
- A workflow's step count decides whether Make or n8n costs less to run
- ElevenLabs' CEO wants AI phone agents to announce themselves while callers still expect a human
- Revoking one leaked S3 presigned URL takes down every URL its credential signed
- Counting only successful agent calls hid 48% of the bill in spendgraph's worked example
- Chrome's canvas.toBlob writes byte-identical PNGs at quality 0.1 and 1.0
- NestJS global guards built with new run every request without their injected services
- Nvidia's RTX Mega Geometry 2.0 bounds ray-traced detail by a VRAM budget
- Frontier models score at most 0.17 on a source-trust test that a two-line rule passes perfectly
- UC San Diego and Inria oracle attack cuts textbook RSA-2048 security by 22 bits
- Prerendered Nuxt 4 blog pages refetched their articles from Storyblok on every browser visit
- A Kafka Streams auth cache kept a revoked API key working for four days
- 375 skills draw 62% of installs on skills.sh, Vercel's million-skill agent registry
- Saga rollbacks break in the gap between semantic and atomic undo
- Cloudflare runs its main blog on pre-1.0 EmDash, load-tested to 7,000 requests per second
- Mullenweg fills Automattic's board with his own picks weeks after a 33-hour ouster
- H.R. 10364 would make VPNs and DNS resolvers block foreign piracy sites within 14 to 30 days
- systemd's mstack mounts a single-layer stack writable by default
- Nvidia's SoL-Pi rewrites coding-agent harnesses to use up to 49 percent fewer tokens
- Argument injection in RouterOS's SSH login hands an attacker full-group admin
- Google is testing Gemini 4 inside Antigravity, its agentic coding platform, before release
- PostgreSQL's VACUUM strands sparse b-tree pages until a REINDEX rebuilds them
- Per-byte metering on 50KB records pushed Perplexity from DynamoDB to a home-built Rust store
- Elttam's two-packet exploit runs code on TACACS+ servers before anyone logs in
- ZoomEye's CVE-2023-49105 count matches its entire ownCloud fingerprint at 152,655 hosts
- Microsoft sets a late-September private preview for Copilot's always-on Autopilot agent
- ACSC's Fortinet credential advisory leaves teams sizing exposure from internet scan counts
- Shihipar's runs show Claude Code's effort level mostly buys self-testing
- A second check on a 300ms silence cutoff cut voice-agent interruptions from 22% to 3.1%
Invest70 stories
- Stablecoin payment firms drew $60.5 million of the week's $79.2 million in private crypto rounds
- Australia's data-access talks give it more leverage over OpenAI and Anthropic than a Senate invitation
- OpenAI's most capable models stay paused for tool use after an agent reached a chatbot over DNS
- Seven jurors priced two Taction patents in Apple's Taptic Engine at $5.7 billion
- Meta answers an SEV-2 flaw in its Muse agent with a stronger user warning
- AMD's trillion-dollar valuation rests on data-center sales that doubled to $6.7 billion
- ShinyHunters says its FBI haul of up to three terabytes includes staff psychiatric records
- Korean manufacturers' outlook rises to 86 while six in 10 expect to miss profit targets
- LG Innotek will manufacture Aeva's lidar for a European automaker from 2028
- ST Pharm tops $50 million on an oligonucleotide order three times this year
- OpenAI and Anthropic are working through tens of thousands of unpublished AI safety incidents
- Tokenized stocks grew fivefold to $4.43 billion before the SEC introduced its exemption
- Google moves Flipkart checkout into Gemini six months after India's browse-only shopping launch
- OpenAI's GPT-Red found prompt injections that copy themselves between agents in simulated tests
- Alo follows a 10 million yuan first minute on Tmall with plans for eight Greater China stores
- U.S. Has a Lower Debt Ratio Than Japan, But Analysts Warn It Faces Greater Rate Risk
- Kazakhstan's flared-gas decree fits bitcoin miners better than AI builders
- Hormuz stays shut while Iran waits for Qatar to deliver Trump's rejection
- Pump.fun's latest SOL sale cleared about $121 a coin, a quarter below its earlier average
- Google's PageBreak agent confirmed two XSS flaws on hardened frameworks against more than 500 elsewhere
- An AI marketing tool posting for Morpho on X misdescribed how the protocol's curators earn
- Each explanation for the 10-year's climb to 5.23% points to borrowing costs staying high
- Six states bar first-year Medicaid frailty self-attestation despite federal rules allowing it
- Madrid marchers seek limits on evictions after a fund raised an 87-year-old's rent 5.3-fold
- US and Russia strip human review of AI targets from the UN autonomous weapons draft
- Korean investors favour Treasury-bill and dividend ETFs over a 3x chip fund nearly three to one
- Gangil-dong's public tenants face a 337 million won gap to Seoul's average jeonse
- TrendForce's 2030 data center power forecast exceeds its own grid estimate by 268 GW
- Trump rules out slowing US AI development after his summit with Xi
- Meta and Microsoft climbed through the highest 10-year Treasury yield since 2007
- FTC chair Andrew Ferguson wants AI developers held liable for what their agents do
- WTI's 7.9% weekly slide widens its discount to Brent to nearly $12
- TypeSafe AI seeks $10 billion-plus valuation two weeks after $40 million seed round
- Bitget presses THORChain to cut off the wallets holding its stolen $387.5 million
- Cattle groups in Texas, Kansas and Oklahoma blame ICE operations for thousands of delayed shipments
- Apple's record $5.7 billion Taptic Engine verdict returns to the judge who dismissed the case in 2023
- Xi's red-carpet summit ends in a two-month truce that leaves the rare-earth squeeze in place
- US-China tariff truce keeps a January expiry after Xi's Washington summit
- ECB puts a TIPS link to Brazil's 250-million-a-day Pix under formal study
- SEC, CFTC and Fed moved on crypto within 48 hours of the Clarity Act's Senate defeat
- Goldman's record negative-beta count measures how heavily the S&P 500 leans on a few AI stocks
- Iran puts its old Hormuz demands on a seven-day clock timed to the US midterms
- OpenAI will start frontier training over after an agent got past its August fixes in 33 days
- Google undercuts AI video rivals at $3 a minute as OpenAI's Sora API shuts down
- New Seoul apartment complexes lower nearby jeonse prices only within 500 meters
- New Mexico jury finds 26 of Meta's 29 Facebook promises deceptive
- ShinyHunters routes around PeopleSoft firewall rules to hit systems still missing Oracle's patch
- Cloudflare will block AI crawlers by default from Sept. 15 after bots overtook human traffic
- Russian drone strikes on shared Kyiv data centers cut at least four ISPs at once
- NextEra's 15 GW data-center hub goal depends on a few multi-gigawatt deals
- Oracle's $988 million of executive options need its stock to more than double
- PeerDAS took Ethereum's blob target from six to 14 in 35 days on validators' existing hardware
- US bank accounts held $83 million of the $84.2 million DOJ seeks from a Tether-linked processor
- Magic Eden users must revoke a 2024 approval to reclaim 23,155 rescued NFTs
- Kim Beom-su's Nov. 20 appeal ruling hinges on intent behind Kakao's 110 billion won of SM buying
- Brightray pitches Yangzhou-built data centers to US buyers under a Singapore registration
- Bitwise's share of Solana ETF inflows slipped on the category's record $80 million day
- Japan buys back 210,000 tons of rice as private stocks swing from 1.5 million to 2.43 million
- Hester Peirce's Oct. 2 exit leaves two Republicans running the SEC
- Chinese AI models now handle 57% to 67% of OpenRouter's tokens, up from as little as 6% in February
- DC Circuit's 2-1 ruling leaves Pentagon contractors choosing between Claude and the department
- Sixth Circuit leaves Kalshi's sports contracts exposed to Ohio and Tennessee gambling law
- Redfin's record seller surplus lifts US home concessions to 44.7% of sales
- Zano prepares to rewind a day of payments that exchanges had counted as final
- Ethena stops paying USDe stakers in ENA after supply falls more than two-thirds from its $15 billion peak
- Columbia economist sets a $3.7 trillion annual revenue bar for the $10.3 trillion US AI buildout
- Korea's safe rental trust moves jeonse risk from tenants onto HUG's guarantees
- Singapore's exchange regulator will make listed companies disclose the KPIs behind executive pay
- Anthropic's reported November IPO date is a bet on one audited quarter
- OpenAI confirms its AI agents reached Commerce and SEC websites without its knowledge
Product16 stories
- Navy divides robotic-systems authority between a new warfighting center and a portfolio manager
- PNOE's 2.0 mask drops the trained operator from metabolic breath testing
- EnerVenue opens a 250 MWh-a-year line for nickel-hydrogen cells rated at 30,000 cycles
- Gemini's Buy button test sends Indian shoppers straight into Flipkart's checkout
- RTX 50-series prices rising up to 39% put resale value into GPU refresh budgets
- Apple's iOS 27 turns Siri into an agent that searches work email and drafts messages
- Reporters asking Synthesia the basics can now talk to an avatar of its corporate affairs head
- Cloudflare lets site owners admit only the AI bots that might pay
- Orano and the CEA say their Grenoble pilot line reliably makes N45UH magnets
- ANYbotics gives its ANYmal inspection robots digital credentials for locked plant doors
- TikTok's Alabama settlement caps underage users at two hours a day
- NVIDIA's top workstation GPU now costs $16,000, close to double its $8,565 launch price
- CoreWeave's current customers all plan to expand their use, a 13-buyer study finds
- Fake replacement cards mailed in Europe use QR 'activation' codes to harvest banking details
- Meta's adults-only Muse agent leans on a mascot a child advocate compares to a Teletubby
- Product managers still deliver stories, argues a former LinkedIn PM writing for a16z
Leadership9 stories
- New Mexico jury turns 31 misleading Meta statements into 43 million violations
- OpenAI halts model training again after its agents overstepped on US government websites
- Australia's datacentre backlash has reached federal rulemaking on power and water, wherever it began
- Bitget presses Thorchain to shut out the hackers behind its $387.5 million loss
- S&P 500 pay plans opposed by both ISS and Glass Lewis failed only 19% of the time in 2026
- Oxford's Bodleian scans fed OpenAI's training set, internal documents show
- Google's $15bn Andhra Pradesh datacentre faces court challenges over a nine-day clearance
- Meta's Muse turnaround ran on tens of thousands of employee testers under Nat Friedman
- Quark Baby's founder says leaving China for Korea cost just under $1 million
Science29 stories
- Scarce storm-scale data limits AI forecasts of hurricane intensity, one researcher argues
- OpenAI model reached the internet through DNS from a sandbox meant to be offline
- Many of 80 visually impaired young people tracked for 11 years had never held a paid job by their mid-20s
- Genoa team's two-protein blood test correctly sorted fever causes in all 85 babies tested
- Hydrogen glows along black hole jets far outside their galaxies in a stack of hundreds of spectra
- Fresh Instagram account's #womenshealth search surfaces sales pitches in 39% of posts
- RNA study tracks thousands of gene changes linked to worm's influence on earwigs' water-seeking behavior
- Stanford world model docks with the ISS about 53% of the time in preprint tests
- Figleaf gourd enzyme weakens peanut proteins' binding to allergy antibodies in Wroclaw lab tests
- Artemis II's Wiseman and Glover become volunteer NASA mentors ahead of Artemis III
- In three South African strains, Stellenbosch chemists find the first sign of flavoalkaloids in Cannabis
- Loosely spread 10 nm silver particles give the best CO yield from CO2 in HZB tests
- Tirzepatide activates brown fat in obese mice even when their food intake is matched
- Trace lead in ink makes writing stand out in X-ray scans of papyrus burned on purpose
- Tohoku imaging shows mouse neurons losing ATP in REM sleep as blood volume climbs
- X-ray tomography at Berkeley Lab records spacecraft ablators decomposing in 3D at up to 900 C
- Modelled odour receptors lead INRAE to the lily moth's sex pheromone
- Duke team uses 13 trapped ions to watch a simulated particle string break
- Trapped gases point to local causes for a famous 2-billion-year-old carbon signal in Russia
- Malawi's buried copper ingots came from Congo's Kipushi mine, lead isotopes show
- Ben-Gurion researchers trace a redox switch that tips stressed human cells into apoptosis
- Digital textbooks raise students' intrinsic motivation more than paper across 27 studies
- Psychiatrists weigh screening psychosis patients for antibodies that attack the brain
- Emulator trained on 20,000 simulated crystallisations benchmarks drug-process optimisation strategies
- SpaCEy graph network ties spatial protein patterns to cancer survival and progression
- Unusually strong nor'easter threatens more than 40 million people in the US Northeast
- FTC chair Andrew Ferguson rejects the idea that an AI agent can carry its own blame
- Nearly 300 mm of rain in two days pushes Bangkok's drainage to full capacity
- OpenAI's agents accessed government sites and used exploit code against other targets, report finds