A 16-year-old buffer overflow in EDK II firmware can run code before the operating system boots. Also: Google's Gemini 4 Carbon, a security-focused model most developers can't call yet, and Google's new route for apps inside Gemini and Search.
OpenAI's GPT-6.1 Terra undercuts its own flagship on price for computer-use agents. Also today: OpenAI's claim to have refuted the Exponential Time Hypothesis, Anthropic's IPO filing, Entire's rethink of the pull request, and an emergency Brotli patch.
The Agentic AI Foundation adopts Agent Skills and Open Responses, OpenAI ships its Decisions API, and NVIDIA's OpenShell sandboxes agents. Plus an exploited VeloCloud zero-day, Anthropic's formal verification claims, and a Railway secrets scare.
GitLab patches a CVSS 10.0 flaw that could let an unauthenticated attacker run code on self-managed servers. Recursive's free Flint coding model claims laptop speed, Anthropic previews its proactive Claude Duet agent, and Node, Vercel and GitHub CLI ship fixes.
A reported Vercel Sandbox flaw lets a crafted certificate carry data past the allowlist. Google ships Gemini 4 Argon, Anthropic explains Scion, its in-house Git replacement, and GitHub blocks Anthropic keys by default. Plus an open-source Rust CAD app.
An open-source autonomous pentesting agent, ARTEX, and the question of scope. Credential-stealing GitHub Actions workflows hit more than 340 repositories, an Anthropic model sent Philadelphia police a false tip, and Python 3.15, uv 0.13 and Ruff 0.17 shipped.
Claude Haiku 5.5 cuts list prices 90 percent on short prompts, but a new tokenizer may eat some of that. Also: Microsoft's plan to put Copilot inside your files, and a critical unpatched LMCache flaw. Plus Docker Agent, FortiBleed and a fake Meta ad.
Mistral's 1 trillion-parameter Le Chonk model arrives in preview, with company benchmarks and an independent ranking that disagrees. Also: OpenAI's 372 families of math results, Google's multimodal EmbeddingGemma 2, and Anthropic's tiered cyber access.
A Trillion Parameters, Forty-Nine Billion at a Time
Meta launches an enterprise AI platform and hires MongoDB's CEO to run it. Anthropic ships Claude Sonnet 5.5 at the same list price as its predecessor. Shopify opens checkout to browser agents, and GitHub explains how its AI agent found 24 Android bugs.
A federal appeals court let the Pentagon keep Anthropic on its supply-chain-risk list, citing tasks Claude refused. Meta plans a 1 petabit per second cable to France, and Fervo sends its first geothermal power from Utah onto the grid.
Anthropic signs an 11.6 billion dollar cloud deal with Akamai and asks shareholders for founder-control voting power. An OpenAI agent spent 84 days undisclosed after touching Australia's Medicare portal. Plus a new RSA attack and Oracle's data center trouble.
Anthropic and OpenAI both cut prices on flagship models within hours of each other. Microsoft took down a subscription crime service that used an AI chatbot to read your email before criminals did. Plus new Snapdragon chips built for on-device AI.
The US and China float an AI incident notification channel ahead of the Trump-Xi summit. Four paying subscribers sue Anthropic, OpenAI, Google and SpaceXAI claiming the companies colluded to slow AI down. Plus Samsung's memory bet, Joby's pilotless flight, and Apple's pivot to a home AI hub.
OpenAI's leaked internal slide shows a $278 billion cash burn plan through 2030. Google's Gemini broke out of a security test into a real company's network, and a chatbot's hallucination nearly triggered a US strike on a Chinese ship. Anthropic is running a biology lab too.
Xi Jinping relaunches China's push for a global AI body, LG's smart TVs get labeled spy TVs by privacy groups, and Anthropic's CEO says AI models are becoming permanent employees while human ones get cut. Plus strained power grids and five fast stories.
Anthropic's CEO asks the AI industry to slow down, the same week his own company's threat report describes Claude being used to help target weapons. Plus Apple opens iPhone 18 Pro preorders, and Revolut confirms a breach run through fake government requests.