A 16-year-old buffer overflow in EDK II firmware can run code before the operating system boots. Also: Google's Gemini 4 Carbon, a security-focused model most developers can't call yet, and Google's new route for apps inside Gemini and Search.
OpenAI's GPT-6.1 Terra undercuts its own flagship on price for computer-use agents. Also today: OpenAI's claim to have refuted the Exponential Time Hypothesis, Anthropic's IPO filing, Entire's rethink of the pull request, and an emergency Brotli patch.
Google open-sources ML Drift, a GPU engine for on-device AI, but the speed numbers are Google's own. Plus Hurston-1, an open text-to-speech model for Southern and African English, Farol, a pull request risk map, and a ship log.
GitLab patches a CVSS 10.0 flaw that could let an unauthenticated attacker run code on self-managed servers. Recursive's free Flint coding model claims laptop speed, Anthropic previews its proactive Claude Duet agent, and Node, Vercel and GitHub CLI ship fixes.
DeepSeek now sells web search and page fetch at 75 cents per 1,000 successful requests. Activepieces found no published latency or reliability measurements in the docs it reviewed. Also: Vercel's session view for AI Gateway, Linux 7.3, and Google's switch from Pytype to Pyrefly.
Meta launches Muse Wonder, but its top model, Wonder Full, stays out of the API. GitLab patches a CVSS 10.0 CI/CD code-execution flaw, and AWS brings Express and Next.js to Lambda Web Functions. Plus GridCraft, a Rust spreadsheet.
AWS rebuilds EventBridge custom buses with cross-account sharing, ordered delivery and replay. Also in this episode: WordCraft, a Word-style app in Rust, a deep dive on browser fingerprints, and releases from Pydantic, Codex CLI, Bun and CrewAI.
Cloudflare Traces enters open beta with volume-based pricing starting December 1. Also, NumPy 2.5 makes searchsorted up to 25 times faster in the authors' benchmark, and a repo lets Codex drive a real iPhone. Plus a ship log and Oxide's $445 million round.
An open-source autonomous pentesting agent, ARTEX, and the question of scope. Credential-stealing GitHub Actions workflows hit more than 340 repositories, an Anthropic model sent Philadelphia police a false tip, and Python 3.15, uv 0.13 and Ruff 0.17 shipped.
Claude Haiku 5.5 cuts list prices 90 percent on short prompts, but a new tokenizer may eat some of that. Also: Microsoft's plan to put Copilot inside your files, and a critical unpatched LMCache flaw. Plus Docker Agent, FortiBleed and a fake Meta ad.
Reflection unveils Beam, an open-weight model with 501 billion parameters and 23 billion active, but the weights and independent checks are still to come. GitHub launches ReviewBench for code-review agents, and Schneider Electric agrees to buy PTC for $23.7 billion.
Aleph Alpha releases Kolibri, a 78.1 billion parameter open-weight German-English model, but the benchmarks are its own. Plus Google pauses its open-source bug bounty, the Dots browser agent, and fresh releases for Claude Code, Transformers and Vite.
Kolibri Grades Its Own Homework
Google Pauses Product-Vulnerability Bounty Reports
Microsoft's ThinkingBox benchmark grades agents on database state, not their own report. Cloudflare wants developers to build the next Git platform for agents, with credits as the prize. Plus the Coucou notch app, Zig 0.17, Istio 1.31 and uv.
SvelteKit 3 is stable, with config moved into Vite and a new hash lib import alias to migrate. Cloudflare ships Clef, open-weight decision models that return probabilities instead of text. Plus Pi 1.0 and durable agents, a local Qwen repo, and Copilot driving desktop apps.
Google unveils Gemini 4 Argon, a coding model with a 1 million token output limit that only trusted cyber defenders can use for now. EDG's C and C++ compiler front end goes open source, and Aurora PostgreSQL can now query Iceberg and Parquet data directly.