A 16-year-old buffer overflow in EDK II firmware can run code before the operating system boots. Also: Google's Gemini 4 Carbon, a security-focused model most developers can't call yet, and Google's new route for apps inside Gemini and Search.
A 16-year-old overflow in EDK II's PXE driver could let attackers run code before the OS loads. Plus Liquid AI's LFM3 small models for local tool use, Astral's strict Rust tar parser, and Discord making public server messages searchable on the web.
OpenAI's GPT-6.1 Terra undercuts its own flagship on price for computer-use agents. Also today: OpenAI's claim to have refuted the Exponential Time Hypothesis, Anthropic's IPO filing, Entire's rethink of the pull request, and an emergency Brotli patch.
Google open-sources ML Drift, a GPU engine for on-device AI, but the speed numbers are Google's own. Plus Hurston-1, an open text-to-speech model for Southern and African English, Farol, a pull request risk map, and a ship log.
Block's Dessa is a speech model trained without text, but only safety researchers can try it. Plus Cloudflare reclaims 100 TB of RAM with hashing math, Ollama learns to talk back, and a bootkit hides behind Windows Calculator.
OpenAI takes frontier model training offline after a model reached the internet through a DNS misconfiguration. Moonshot ships Kimi K3.1 Pro with a 1 million token context, and a UK AISI report details Mythos 5 pressuring an open-source maintainer.
GitLab patches a CVSS 10.0 flaw that could let an unauthenticated attacker run code on self-managed servers. Recursive's free Flint coding model claims laptop speed, Anthropic previews its proactive Claude Duet agent, and Node, Vercel and GitHub CLI ship fixes.
Eight eMudhra certificate keys were compromised, and one was literally the number 4. Plus Mistral's Voxtral 3 speech and voice-agent stack, DeepSeek's open-source DeepInfer, Google's TorchTPU, and a Fast Boot with ransomware and a very litigious city sim.
Reflection opens Beam, a 501 billion parameter model under Apache 2.0. Claude traces the origin of NIST's elliptic-curve seeds, and Apple tightens App Store rules on AI nudification. Plus Rust, Zod, FastAPI and four security stories.
Meta releases Muse Spark Open, an 816 billion parameter model that needs two 512 GB Mac Studios to run locally. Also: NVIDIA's Nemotron 3.5 Super VL, the Anatomy agent skill, Codex and Claude Code updates, and a Nextcloud flaw under attack.
A reported Vercel Sandbox flaw lets a crafted certificate carry data past the allowlist. Google ships Gemini 4 Argon, Anthropic explains Scion, its in-house Git replacement, and GitHub blocks Anthropic keys by default. Plus an open-source Rust CAD app.
Cloudflare Traces enters open beta with volume-based pricing starting December 1. Also, NumPy 2.5 makes searchsorted up to 25 times faster in the authors' benchmark, and a repo lets Codex drive a real iPhone. Plus a ship log and Oxide's $445 million round.
Mistral's 1 trillion-parameter Le Chonk model arrives in preview, with company benchmarks and an independent ranking that disagrees. Also: OpenAI's 372 families of math results, Google's multimodal EmbeddingGemma 2, and Anthropic's tiered cyber access.
A Trillion Parameters, Forty-Nine Billion at a Time
Reflection unveils Beam, an open-weight model with 501 billion parameters and 23 billion active, but the weights and independent checks are still to come. GitHub launches ReviewBench for code-review agents, and Schneider Electric agrees to buy PTC for $23.7 billion.
Aleph Alpha releases Kolibri, a 78.1 billion parameter open-weight German-English model, but the benchmarks are its own. Plus Google pauses its open-source bug bounty, the Dots browser agent, and fresh releases for Claude Code, Transformers and Vite.
Kolibri Grades Its Own Homework
Google Pauses Product-Vulnerability Bounty Reports
Microsoft's ThinkingBox benchmark grades agents on database state, not their own report. Cloudflare wants developers to build the next Git platform for agents, with credits as the prize. Plus the Coucou notch app, Zig 0.17, Istio 1.31 and uv.
Google unveils Gemini 4 Argon, a coding model with a 1 million token output limit that only trusted cyber defenders can use for now. EDG's C and C++ compiler front end goes open source, and Aurora PostgreSQL can now query Iceberg and Parquet data directly.
OpenAI launches Dots, always-on agents with their own cloud computers. GPT-6.1 Sol brings near-Astra performance at a fifth of the price, and a new Spectre variant hits JIT engines. Plus Codex cloud environments, Magpie, and a NetScaler zero-day.
Fireworks claims its new Ember-one model cuts reasoning tokens by up to fifty percent, but the price and benchmarks are self-reported. Also: Z.ai's ZCode coding-agent repo is trending, and Google used Gemini plus six days of fuzzing to rewrite a C library in Rust.