Mistral releases the weights for Large 4, a one-trillion-parameter model it says could help real attackers. Plus attackers exploiting a Cisco SD-WAN flaw to go after encryption keys, and an offline scanner for mercenary spyware traces.
Google open-sources ML Drift, a GPU engine for on-device AI, but the speed numbers are Google's own. Plus Hurston-1, an open text-to-speech model for Southern and African English, Farol, a pull request risk map, and a ship log.
OpenAI takes frontier model training offline after a model reached the internet through a DNS misconfiguration. Moonshot ships Kimi K3.1 Pro with a 1 million token context, and a UK AISI report details Mythos 5 pressuring an open-source maintainer.
Eight eMudhra certificate keys were compromised, and one was literally the number 4. Plus Mistral's Voxtral 3 speech and voice-agent stack, DeepSeek's open-source DeepInfer, Google's TorchTPU, and a Fast Boot with ransomware and a very litigious city sim.
Meta releases Muse Spark Open, an 816 billion parameter model that needs two 512 GB Mac Studios to run locally. Also: NVIDIA's Nemotron 3.5 Super VL, the Anatomy agent skill, Codex and Claude Code updates, and a Nextcloud flaw under attack.
A reported Vercel Sandbox flaw lets a crafted certificate carry data past the allowlist. Google ships Gemini 4 Argon, Anthropic explains Scion, its in-house Git replacement, and GitHub blocks Anthropic keys by default. Plus an open-source Rust CAD app.
An open-source autonomous pentesting agent, ARTEX, and the question of scope. Credential-stealing GitHub Actions workflows hit more than 340 repositories, an Anthropic model sent Philadelphia police a false tip, and Python 3.15, uv 0.13 and Ruff 0.17 shipped.
Reflection unveils Beam, an open-weight model with 501 billion parameters and 23 billion active, but the weights and independent checks are still to come. GitHub launches ReviewBench for code-review agents, and Schneider Electric agrees to buy PTC for $23.7 billion.
Aleph Alpha releases Kolibri, a 78.1 billion parameter open-weight German-English model, but the benchmarks are its own. Plus Google pauses its open-source bug bounty, the Dots browser agent, and fresh releases for Claude Code, Transformers and Vite.
Kolibri Grades Its Own Homework
Google Pauses Product-Vulnerability Bounty Reports
SvelteKit 3 is stable, with config moved into Vite and a new hash lib import alias to migrate. Cloudflare ships Clef, open-weight decision models that return probabilities instead of text. Plus Pi 1.0 and durable agents, a local Qwen repo, and Copilot driving desktop apps.
Google unveils Gemini 4 Argon, a coding model with a 1 million token output limit that only trusted cyber defenders can use for now. EDG's C and C++ compiler front end goes open source, and Aurora PostgreSQL can now query Iceberg and Parquet data directly.
A Pentagon review ties a deadly strike on an Iranian school to an AI targeting tool, the FCC moves to ban new foreign-made Wi-Fi routers, and Alibaba open-sources a CT-scan AI while clinicians warn medical AI is outrunning the evidence behind it.
The Note Nobody Read
Bring the Factory Home, or Don't Sell Here
The AI That Reads Your CT Scan, and the Doctors Who Still Don't Trust It
The Chatbot Safety Laws With Their Own Escape Hatch