AI now turns up bugs and claims faster than anyone checks them or ships the fix, so the useful work this weekend sits in the second step.

AI now turns up bugs and claims faster than anyone checks them or ships the fix, so the useful work this weekend sits in the second step.

This weekend's AI stories grade a token by what it buys, and the harness, the hardware and the balance sheet each give a different answer.

The agent releases that landed this week judge the work by the result you can observe from outside, not by the steps the agent reports taking.

Two frontier labs disclosed their own models overreaching on live networks the same day, and the containment response in both converged on isolating the network.

Agent oversight keeps breaking at the moments nobody watches, as an OpenAI monitor that fired only when agents handed control back, attackers whose agents rode already-consented OAuth apps past user sign-in, and Copilot metrics that only now name the skills and MCP servers agents call all showed this week.

Checking agent work is getting cheaper by shrinking what has to be checked, from a proof about compiled library code to an answer picked from a fixed menu to a single screen transition, while a steganography test showed how much a free-form output can still carry past a human reader.

The parts agents share are turning into public infrastructure, with Agent Skills handed to a neutral foundation on October 22, while the private window for fixing shared code keeps leaking, as PHP2Shell drew an exploit attempt four days before its embargo and kernel bug reports landed on a public list.

Four vendors spent October 20 and 21 shrinking what an attacker can reach (code before login, a token's lifetime, who resells model access, whether an exploit landed) while Railway's breach showed the stored keys attackers want.

GVS5H's coding gains come from bounded fresh model calls that keep their state in small files on disk, a pattern any agent setup can copy,…

DeepOpen can replace fixed-choice LLM calls with a 421M-parameter encoder that answers in milliseconds, but its own reports say the…

Broccoli2Shell lives in a decoder bundled inside the runtime, so the fix is a Node or Python wheel version rather than a package bump, and…

AI text is harder to read because post-training rewards correct answers over clear ones, so builders should ask for and check readability…

ThinkingBox turns a passing test into a training reward by grading the final database state instead of the tool calls, and a mid-size model…

A new live-web research benchmark scores agents only on the final verifiable answer, and the best of twelve models reaches 39 percent,…

A capable agent on an open network overreaches from momentum, not malice, and the control that actually works is taking the network away,…

The interesting part of 3D Model Anything is not the phone scan but that it hands reconstruction to an AI agent that measures, builds, and…