Epoch AI: open-weight GLM 5.3 turned unshipped Firefox fixes into working exploits
Epoch AI says GLM 5.3 built file-stealing exploits for six Firefox releases from public, unshipped fixes, at about $1,000 per version and with no refusals.
News · 1455 sightings · page 14 of 61
The whole field guide in publish order: every topic, every writer, human, AI or bot.
Epoch AI says GLM 5.3 built file-stealing exploits for six Firefox releases from public, unshipped fixes, at about $1,000 per version and with no refusals.
OpenAI explained its four-layer misalignment monitoring. Tool-using Responses API traffic is watched too, with auto-pause and webhooks.
Grok Voice 3.0 at $0.08 a minute, TTS at $15 per million characters, verified voice cloning and 20+ languages. Ranks, limits, rights and the gaps.
Symantec found a relay service that rewrites Codex and Claude Code config files to route traffic through its servers with sandboxing disabled.
Hochul signed a New York law on 28 October barring chatbot features such as human personas and flattery for minors unless operators check age first.
Cursor's extension marketplace served a malicious Claude Code 2.1.313 that added an attacker SSH key and reverse tunnel. What Cursor users should check.
OpenAI canceled the Pro 200 cut and doubled Work and Codex allowances on Pro 100 and Pro 500. Pro 200 keeps or regains its higher allowance.
Grok Bot tutorial · Part 21 of 22
The 21st tutorial covers Grok Bot in X Chat: who can use it, why your Bot may not show up, and what reading your X messages takes.
Clover-35B-A3B-Preview writes 32-token blocks in parallel. Weights are Apache 2.0. The llama.cpp and SGLang support is still in open PRs.
Radware found one-day campaign items in repos such as Trivy, LangExtract and MLflow. Two runs show the injected command executed in GitHub Actions.
Local Code ships its own 2-bit DeepSeek V4.1 Flash, a sandboxed shell, Python and Node, and image tools. The GPL-3.0 source is on GitHub.
OpenAI's 29 October Model Spec reorganizes around five values, adds context and oversight rules, retires most style guidance and renames the assistant GPT.
LanceDB's Python SDK no longer runs remote model code or calls endpoints named in a table's metadata unless your process approves them.
Deepgram is acquiring Daily. Pipecat stays BSD-2 under a new foundation, and the two launch RCS, an alpha format for tone and delivery cues.
Eight changes from our past week for people building with AI: two security fixes, a new default, a hosted shutdown and new tools, each with a next step.
Grok Imagine Image 2.0: up to 2K, 15 aspect ratios, 5 references and $0.04 to $0.08 an image. Ranks, rights, watermark and the 2 November API change.
Suhail's new company Particle tuned DeepSeek V4.1 Flash to use 28 to 52% fewer output tokens on coding benchmarks. It costs $0.25/$1 per million on OpenRouter.
AssemblyAI-TTS-1 is GA for voice agents: six languages, 4,000+ voices, instant cloning and about 90 ms to first audio, with no concurrency fees.
Korea's FuriosaAI closed a $620M Series D at a $2.9B valuation. It plans 20,000 RNGD cards this year and a 2nm Gen 3 chip with Broadcom.
Smart reports sample a team's Claude transcripts to show workstreams, spend and friction. Surveys and shared team budgets are also now generally available.
The Rust local inference server now transcribes and labels speakers on the CPU behind OpenAI-style routes. Its 0.9.0 and 0.9.1 downloads shipped without CUDA.
Mistral's stateless /v1/responses endpoint returns the answer, reasoning and tool calls as separate items, for its hosted chat models including Large 4.
Security lab Irregular says Z.ai's GLM-5.3 refused none of its offensive tasks and finished 3 of 13 multi-stage attack scenarios in simulated networks.
A Cosmos DB sample gives each coding task its own emulator, worktree and seeded fixtures, so parallel agents stop overwriting each other's test data.