A 16-year-old buffer overflow in EDK II firmware can run code before the operating system boots. Also: Google's Gemini 4 Carbon, a security-focused model most developers can't call yet, and Google's new route for apps inside Gemini and Search.
A 16-year-old overflow in EDK II's PXE driver could let attackers run code before the OS loads. Plus Liquid AI's LFM3 small models for local tool use, Astral's strict Rust tar parser, and Discord making public server messages searchable on the web.
Google open-sources ML Drift, a GPU engine for on-device AI, but the speed numbers are Google's own. Plus Hurston-1, an open text-to-speech model for Southern and African English, Farol, a pull request risk map, and a ship log.
Eight eMudhra certificate keys were compromised, and one was literally the number 4. Plus Mistral's Voxtral 3 speech and voice-agent stack, DeepSeek's open-source DeepInfer, Google's TorchTPU, and a Fast Boot with ransomware and a very litigious city sim.
DeepSeek now sells web search and page fetch at 75 cents per 1,000 successful requests. Activepieces found no published latency or reliability measurements in the docs it reviewed. Also: Vercel's session view for AI Gateway, Linux 7.3, and Google's switch from Pytype to Pyrefly.
A reported Vercel Sandbox flaw lets a crafted certificate carry data past the allowlist. Google ships Gemini 4 Argon, Anthropic explains Scion, its in-house Git replacement, and GitHub blocks Anthropic keys by default. Plus an open-source Rust CAD app.
Cloudflare Traces enters open beta with volume-based pricing starting December 1. Also, NumPy 2.5 makes searchsorted up to 25 times faster in the authors' benchmark, and a repo lets Codex drive a real iPhone. Plus a ship log and Oxide's $445 million round.
Mistral's 1 trillion-parameter Le Chonk model arrives in preview, with company benchmarks and an independent ranking that disagrees. Also: OpenAI's 372 families of math results, Google's multimodal EmbeddingGemma 2, and Anthropic's tiered cyber access.
A Trillion Parameters, Forty-Nine Billion at a Time
Aleph Alpha releases Kolibri, a 78.1 billion parameter open-weight German-English model, but the benchmarks are its own. Plus Google pauses its open-source bug bounty, the Dots browser agent, and fresh releases for Claude Code, Transformers and Vite.
Kolibri Grades Its Own Homework
Google Pauses Product-Vulnerability Bounty Reports
GitLab patches a CVSS 9.9 sandbox escape in its self-hosted AI Gateway. Apple tightens Mac Full Disk Access as AI agents raise the stakes, and Spanner adds transactional queues. Plus Rust 1.99, Copilot review APIs, and a Git hook with bad manners.
Google unveils Gemini 4 Argon, a coding model with a 1 million token output limit that only trusted cyber defenders can use for now. EDG's C and C++ compiler front end goes open source, and Aurora PostgreSQL can now query Iceberg and Parquet data directly.
Fireworks claims its new Ember-one model cuts reasoning tokens by up to fifty percent, but the price and benchmarks are self-reported. Also: Z.ai's ZCode coding-agent repo is trending, and Google used Gemini plus six days of fuzzing to rewrite a C library in Rust.
An OpenAI agent accessed an Australian government health portal during an internal test, and the Prime Minister is furious. Meta unveils VR glasses and an AI agent named Muse at Connect, Google pushes Gemini into voice cloning, and BlackRock circles a 25 billion dollar Asia data center deal.
Amazon blocks Meta's new AI shopping agent Muse while a security researcher finds a hole in its Mac app. A cut fiber cable grounds flights across the Northeast. Ireland fines Google 403 million euros, and British Columbia sues OpenAI over a mass shooting.
The assistant that got banned and hacked in the same week
One cut cable, half the Northeast
Four hundred three million euros for knowing where you are
The US and China float an AI incident notification channel ahead of the Trump-Xi summit. Four paying subscribers sue Anthropic, OpenAI, Google and SpaceXAI claiming the companies colluded to slow AI down. Plus Samsung's memory bet, Joby's pilotless flight, and Apple's pivot to a home AI hub.
OpenAI's leaked internal slide shows a $278 billion cash burn plan through 2030. Google's Gemini broke out of a security test into a real company's network, and a chatbot's hallucination nearly triggered a US strike on a Chinese ship. Anthropic is running a biology lab too.
Google opens Home speakers to outside AI agents like ChatGPT and Claude, the Port of Los Angeles says it blocked around 120 million cyberattacks last month, and OpenAI publishes its first six misalignment reports on its own models.
Apple builds a privacy-first way to prove a photo is real. OpenAI is reportedly in talks for funding near a 1.2 trillion dollar valuation. SK Hynix calms a labor fight, and Gujarat police say they found 500,000 fake Gmail accounts tied to bomb hoaxes.