An AI agent tried to social-engineer a real open-source maintainer into merging malware - My News item of the week this edition - see the full write-up at the top. (Socket's write-up is a good read too.)

OpenAI's account of the same evaluation, plus a second incident - Both separate from the Hugging Face breakout. The first is the UK AISI evaluation above, from OpenAI's side: AISI deliberately gave agents live internet access and switched off the cyber classifiers, to measure raw capability rather than what the guardrails allow. In the second, at Irregular, a misconfiguration let models reach the internet and "the name of the fictional target for the CTF challenge unintentionally coincided with a real domain" - so the model attacked a real website thinking it was still in the simulation. Simon Willison has now started an "accidental-cyberattacks" tag.

Claude Code and Gemini CLI flaws let a GitHub issue reach your CI secrets - Worth checking your versions. CVE-2026-12537 in Gemini CLI is a CVSS 10.0 under v4 (7.8 under v3.1): command injection via a crafted .gemini/.env file, letting an unprivileged attacker run code on a headless CI host before the sandbox starts, reachable from a GitHub issue with no repo privileges. Fixed in 0.39.1 (and run-gemini-cli 0.1.22). The Claude Code one, CVE-2026-54316, "turned Hugging Face's public download counter into an exfiltration channel that leaked an API key one character at a time"; fixed back in 2.1.163. Novee Security presented both at Black Hat on August 5.

Atlassian Rovo can be made to leak your Jira and Confluence data, and it was still unpatched at disclosure - Hide instructions in a file uploaded to Rovo, and when someone asks a question the agent appends Jira tickets or Confluence docs to an attacker's URL and fetches it. PromptArmor found "there are no protections against opening a URL that has been dynamically created by the agent" - and "this attack succeeds even if an organization has disabled web search for Rovo", because that setting only stops the agent starting a search. Disclosed May 23, acknowledged May 25, then silence. Still unpatched when they published on August 5.

Qwen3.8-Max - 039 covered the preview; the real thing landed August 3. A 2.4 trillion parameter MoE with 95B active per token, which Alibaba put at 86.1 on OSWorld-Verified against Fable 5's 85.0 and GPT-5.6 Sol's 83.2, and 93.0 on PaperBench. Three days later it briefly topped Artificial Analysis' agentic index, until a same-day methodology change there put it second behind Claude Opus 5 (max), 58.4 to 59.2. Buried in the announcement: this is "the first time we will open-source the weights of a Qwen-Max-class model", with weights promised "next week".

Kimi K3 is now available in GitHub Copilot - Ten days after the weights landed, Moonshot's 2.8T open-weight model is GA in Copilot, hosted on Fireworks AI. $3/$15 per million tokens. Off by default on Business and Enterprise, so an admin has to switch it on.

MiniMax H3's open weights exclude the US, EU, UK and South Korea - The 33B video model went up on Hugging Face on August 3, and then people read the licence. Its "Applicable Territory" excludes the US, the EU, the UK and South Korea, so we aren't licensed to run the weights locally or even use the outputs. MiniMax say the US exclusion is partly down to ongoing copyright litigation over generative video; the EU, UK and Korea ones they put down to the EU AI Act and evolving rules. They do call it "not yet", not "not ever". Open weights, except in your country.

Claude Code 2.1.221 through 2.1.224 - A busy fortnight, and an unusually security-heavy one. Permission-bypass fixes across 2.1.221 and 2.1.223: a zsh [[ ]] regex conditional that could execute hidden commands, "a Bash permission bypass where a crafted command could hide parts of itself from permission checks", and commands padded with tabs or invisible Unicode hiding themselves from the approval dialog. 2.1.223 also stops workflow scripts escaping the sandbox via dynamic import(), and 2.1.222 stops worktree-isolated sessions running destructive git commands against the main checkout. On features, 2.1.224 adds cross-session SendMessage, so sessions on any of your machines can message each other, and drops the 200-subagent cap. 2.1.223 also makes /review an alias of /code-review, and 2.1.222 removed ultraplan.

Run Claude Code sessions on your own compute - claude self-hosted-runner turns your own machines or containers into somewhere Claude Code web, mobile and desktop sessions can execute, instead of Anthropic's infrastructure. Team and Enterprise, and off by default until an admin enables it. Ironically it's unavailable to orgs with Zero Data Retention turned on, which is exactly the crowd most likely to want it.

Meta ships its first coding agent - Muse Code is a terminal agent on the new Muse Spark 1.2, with async background agents, a replay-exact runtime built on event logs, and bundled /plan, /grill and /goal skills. macOS and Linux, not open weights.

Warp launches a standalone Agent CLI - Out of the terminal and into Ghostty, iTerm 2, VS Code and Windows Terminal. Rather than competing with Claude Code and Codex, it wants to orchestrate them - couple it to Warp's cloud platform and it can delegate to subagents "with entirely different harnesses like Claude Code and Codex". Sessions survive directory changes, agents run remotely without installing a binary, and it can drive full-screen apps like vim. From $18/month on annual billing ($20 monthly), or bring your own API key.

Cloudflare OS - Cloudflare open-sourced the internal agent platform they've run since May: a browser-based Agent Workspace with company context, skills and an isolated code runtime, and an app platform where agents ship full-stack apps as Dynamic Workers with persistent SQLite. "Gatekeepers" are the good bit: service-specific Workers sitting between agents and resources, mediating access and enforcing policy. An actual answer to "who authorised this tool call".

OpenAI publishes ten mathematical advances, each formalised in Lean - The companion piece to Anthropic's cryptography results last week. OpenAI set "an internal version of Astra, our next major model" on ten problems that had seen no progress on their main result for at least a decade, including the first improvement since 1978 to the general high-dimensional sphere-packing exponent. The whole run cost roughly $2,000 in tokens at Sol API rates. They published proofs rather than claims - humans prepared the write-ups with the model's help, and the model formalised each proof in Lean so it can be machine-checked. Peer review is still to come. (Simon Willison's write-up.)

Demis Hassabis moves to Chair at Google DeepMind, and Jeff Dean leaves Alphabet - Hassabis becomes Chair of Google DeepMind and Chief Scientist of Alphabet, with Koray Kavukcuoglu taking Gemini, frontier research and the developer teams as SVP. And after 27 years Jeff Dean is leaving to start a public benefit corporation with Sanjay Ghemawat. Between them that's MapReduce, Bigtable, Spanner and TensorFlow.

AMD is buying Taalas to etch model weights into silicon - Taalas build model-specific chips that cast a model's weights and dataflow into transistors rather than shuttling them in and out of high-bandwidth memory. Terms undisclosed, closing Q4 2026, to be paired with Instinct GPUs. Only makes sense if you think architectures are going to sit still for a while. (The Register has the detail on how the chips actually work.)

Gemini Robotics 2 - Three models for whole-body robot control: a vision-language-action model, ER 2 for embodied planning and robot-to-robot coordination, and an on-device variant with no network latency. ER 2 is in Google AI Studio now if you fancy a play.

Matt Pocock's skills repo passes 200k stars - A week after Matt was on the podcast, the repo hit 200k stars and v1.2 shipped: native Claude Code plugin install, Codex metadata alongside the Claude Code frontmatter so one set works in both harnesses, and a new /wait-what skill for when the model won't stop talking. He also had to warn people that someone published an npm package called mattpocock-skills, impersonating an official release - "Avoid at all costs." It's still up at the time of writing, so don't go looking for it.

NuGet is cutting API key lifetimes to 30 days - Diary item, and there are two dates. From August 17, new NuGet API keys max out at 30 days - the 365-day option is gone. Then on November 1, every key created before August 17 expires. So a publish pipeline running on a long-lived key keeps working for now, but dies in November.

Azure DevOps Remote MCP Server is generally available - Nothing to install locally: point mcp.json at it over HTTP and your tooling gets work items, pull requests, repos and pipelines. Works with Copilot in VS Code, Microsoft Foundry, Copilot Studio and Visual Studio. You'll need Entra-backed accounts though - standalone Microsoft Accounts aren't supported.

Test reporting in Microsoft.Testing.Platform - Failures now surface natively in GitHub Actions and Azure DevOps, and it uses pipeline history to separate genuine regressions from flakes. "Is this broken or is it just that test again" is a daily tax on most teams.

The ETW MCP lets Copilot dig through Windows performance traces - I missed this when it landed on July 21, so catching up. A headless MCP server for Event Tracing for Windows traces, so you can ask questions of an ETL file instead of driving Windows Performance Analyzer by hand. Baseline-versus-trial comparisons, critical path analysis, and batch processing of multiple traces. "The MCP does the heavy lifting on the trace, and the LLM does the reasoning on top of the results." Ships as the Microsoft.Windows.EventTracing.MCP NuGet package. Same idea as last week's MSBuild binlog analyzer.

Microsoft keeps building on the GitHub Copilot harness...

In a fortnight the Copilot SDK has turned up underneath Visual Studio's new Agent, the Copilot CLI and Agent Framework. Worth knowing if you're picking a foundation to build on.

ILSpy 11.0 Release Candidate - RC for the next major version of the decompiler, needing .NET 10. New "Open from running process" dialog, plus --dump-table and --member single-member decompilation in ilspycmd.

Shai-Hulud is back, and this one is big - Eleven packages compromised on August 4, including keyv at 604 million monthly downloads, flat-cache at 580 million and file-entry-cache at 571 million. Aikido put the spread at "at least 444 packages" covering "over 2 billion monthly installs". The payload fires from a preinstall hook, harvests npm, GitHub, AWS, Kubernetes and HashiCorp Vault tokens plus Stripe and Slack tokens and private keys, pushes them to attacker-controlled GitHub repos, then self-replicates with the stolen npm tokens. The malicious versions have since been pulled from npm and the latest tags rolled back to the last clean releases (keyv 5.6.0, flat-cache 6.1.23, file-entry-cache 11.1.5). If you installed any of them on August 4 though, rotate your tokens - unpublishing doesn't un-steal credentials. Also a bit deflating that it landed the same week npm's publish-time malware scanning was meant to be helping.

54 of 55 "critical" SQLite CVEs turned out to be AI-generated fiction - A GitHub account published a batch of SQLite advisories in late July, part of 55 CVEs in total from the same account. NVD and CISA flagged them critical, and Red Hat scored CVE-2026-51302 at 10.0 before downgrading it to 7.6. Then JFrog checked them. The advisories cite functions that didn't exist in the version they claim to affect - exprComputeOperands() was only added to SQLite in 2025, but the advisory pins 3.41. The PoC payloads produced no crashes. None appeared on SQLite's own advisory page. And run through GPTZero, they all read as AI-generated. Fifty-four of the fifty-five were fabricated; one had a real bug. JFrog's point is the one to take away: "The CVE submission process via MITRE's public form lacks any real identity verification, meaning virtually anyone can submit a vulnerability description." Every scanner you own would have gone red on these.

Don't be a meat proxy - The biggest thing on Hacker News this week, at over 1800 points. Pasting AI output into Slack, a PR or a group chat without reading and validating it first makes you a pointless middleman, because the other person could have asked the model themselves and got it faster. The code-review version is the sharp end: generate an implementation, engage with none of it, and your reviewer quietly becomes the actual implementer. Uncomfortable reading in places.

FFmpeg 9.0 "Lei" - About four months after 8.1. A decoder and demuxer for animated WebP, LCEVC track muxing in MP4, Dolby Vision bitstream filtering, ProRes RAW hardware-accelerated decoding via VideoToolbox, Vulkan for the v360 filter, and an ONNX Runtime backend with GPU execution for the DNN filters. Standalone CELT decoding is gone, though Opus CELT is unaffected.

Zed DeltaDB - Not strictly new - Zed announced this back on June 11 - but it did the rounds again this week and I hadn't covered it. A version control system for the agent era: it captures every operation between commits, gives each a stable identity, links every change back to the agent conversation that produced it, and virtualises the worktree so a new agent branch is effectively free. "Share the thread, not the PR." A serious attempt at asking what version control looks like when most commits aren't typed by a human.