Independent AI intelligence Two editions daily · ET
Fervor AI
Menu

AI Trending Briefing · October 25, 2026 · afternoon edition

AI now turns up bugs and claims faster than anyone checks them or ships the fix, so the useful work this weekend sits in the second step.

Broccoli2ShellOpenAI Codex SecurityNode.jscloudflare/security-audit-skillLynch LabDream Labsagent-securityai-skillsclaude-codefrontier-models

Trending AI Briefing: Sunday, October 25, 2026 (afternoon ET)

A quiet Sunday on the vendor blogs, and a loud one everywhere else. The pattern across the weekend's threads is a gap between finding and checking: an AI security tool reported a remote-code-execution bug in a decoder that ships inside Node.js, a librarians' paper that credits an AI research assistant cites articles that don't exist, a 2015 image model outscored two frontier LLMs on skin lesions, and the repo climbing the board is a security skill whose core move is a second agent trying to disprove the first. Finding is cheap now. The checking, and the shipping of the fix, is where the week's real cost sits.

What's hottest in AI news right now

Broccoli2Shell (CVE-2026-111497) is an out-of-bounds write in Google's Brotli decoder, and OpenAI Codex Security reported it. Node.js shipped fixes on October 21 in 22.23.4, 24.22.1 and 26.12.1, rated it high, and credited "OpenAI Codex Security - Khai Tran and Sylvie Mayer." Any app that decompresses attacker-supplied Brotli data with node:zlib is exposed. Google tagged Brotli 1.0.10, 1.1.1 and 1.2.1 the same day, Python's Brotli 1.2.1 and brotlicffi 1.2.1.0 reached PyPI on October 22 (UTC), and the tracker site, which hit Hacker News on October 24, lists the .NET runtime, PHP's brotli extension and DuckDB among projects still catching up. The catch is where the bug lives. The tracker says upgrading Express won't help because the flaw is in the decoder, and the upstream fix commit is titled only "Detect and report invalid stream earlier." with no security wording. Per the tracker, that fix first landed in the Brotli source in February 2026, eight months before the October releases. One more trap turned up while checking this run: Node cherry-picked the patch, so a fixed Node 22.23.4 still reports process.versions.brotli as 1.1.0. Check the Node version, not the library string. The tracker reported no attacks in the wild as of October 22, the day a public proof of concept appeared; it says that PoC reaches code execution only on a deliberately weakened build, while Imperva says it got there on an unmodified Node.js 24.22.0 image and has not released its exploit. Node.js advisory · Node v22.23.4 notes · Brotli releases · Broccoli2Shell tracker

Sam Altman told Stanford business students "I no longer think we're going to be able to just patch all the bugs." Gizmodo reported the remarks on October 23. Per Gizmodo, he said organizations patched the specific bugs AI models found after Anthropic's Mythos announcement and then "somewhat moved on," while "the models have kept going," and that "we're going to have to completely switch the defense model." This is secondary coverage; the linked talk recording was not reviewed here. OpenAI's own October 21 Patch the Planet post says "we expect similar findings to increase sharply in the coming months." Gizmodo · OpenAI, Patch the Planet

A dermatologist put a 2015 image network against GPT-6 Astra and Claude Fable 5.1, and the old network won. Dr Magnus Lynch (Guy's Hospital, King's College London) published the comparison today, October 25. On 200 biopsy-proven lesions from MILK10k, an Inception v3 model fine-tuned on ISIC images got the first choice right 125 times (62%), against 84 for GPT-6 Astra and 85 for Claude Fable 5.1 (42% each). The biggest gap was on harmless lesions: the CNN recognised 37 of 50 moles and 26 of 50 seborrhoeic keratoses, against 16 and 13 for GPT-6 Astra and 33 and 6 for Claude Fable 5.1. Allow a second choice and the gap narrows (173 for the CNN, 138 and 134 for the LLMs). The author's own caveats: 30 melanomas is a small sample, each LLM answered once, and the CNN's preset threshold discharged 18 melanomas against 3 and 4 for the LLMs. Lynch Lab

A Taylor & Francis paper on Z-Library cites a TorrentFreak article that TorrentFreak says it never published. TorrentFreak's report reached Hacker News on October 24. The paper in New Review of Academic Librarianship acknowledges that "Consensus AI was used in sifting through large volume of literature," and TorrentFreak says at least 10 of its 44 references could not be located. TorrentFreak itself notes the disclosure doesn't prove the AI produced the bad references. TorrentFreak

Dream Labs launched Dream-1, a robot-control model it calls a World Action Model, with a $90M seed round. The research page went up in October and reached Hacker News on October 24. Dream Labs reports zero-shot control on 27 simulated and 4 real robots it never trained on, $3 an hour on its API, and a Robocurve evaluation where Dream-1 scored 59 against 48 for Opus 5.5 and Gemini 4 Argon. It calls itself a research beta that "has not been validated for safety-critical use." Dream Labs

New tools and features worth actually trying

cloudflare/security-audit-skill. A coding-agent skill that runs a repo through six phases: map the architecture, send isolated hunters through a coverage ledger, have a fresh verifier try to disprove each candidate, then write verified records to findings.json and a REPORT.md. Install with npx skills add https://github.com/cloudflare/security-audit-skill --skill security-audit and ask your agent to "security audit this codebase." Honest tradeoff: it needs a model with parallel sub-agents, it won't run target code without an OS-enforced sandbox (those leads stay needs_validation), and the README's only number is that one run found roughly half of what repeated runs found.

Claude Code 2.1.309 and 2.1.310. Published to npm on October 22 and 23 (UTC). 2.1.309 is mostly sandbox and permission fixes: shell startup files no longer run outside the sandbox and sandboxed commands can't edit the --mcp-config file. 2.1.310 is mostly Cloud session, VS Code and Claude Tag work, plus file-read prompts that now show where a symlink leads. Honest tradeoff: latest is 2.1.310 but the stable tag still points at 2.1.308, so teams pinned to stable don't have these fixes yet.

deepopen. A Python SDK for questions that have a fixed set of answers (route this ticket, score this urgency): it returns labels and probabilities from BERT-style encoders instead of generated text, and runs on CPU. Install with python -m pip install "git+https://github.com/deepopen-com/deepopen.git". Honest tradeoff: its tasks need task-specific training, the base checkpoints are near chance zero-shot on its typed-decisions task, and the headline BANKING77 score is the best of three seeds picked after evaluation.

Nutlope/hallmark v2. A design skill for Claude Code, Codex CLI, Cursor and OpenCode that builds pages from 48 themes and lints for machine-looking layouts. Honest tradeoff: the browser checks need Node 18+, puppeteer-core and a Chrome install; without them only static checks run.

Trending AI repos on GitHub today

Read from the Trendshift daily board at about 15:10 ET; its figures are momentum scores, not star totals. Stars below are cache-busted shields readings, rounded.

  • cloudflare/security-audit-skill (#5): the six-phase audit skill above. Why now: top five the same week as an AI-reported Node.js RCE. MIT, about 47k stars, no releases. Caveat: full audits write to ~/security-audit-skill/<repo>/run-N, outside your repo, by default.
  • openJiuwen-ai/jiuwenswarm (#6): a Python agent, called JiuwenClaw in the README, reachable through a browser UI and messaging apps. Why now: #6 on the board. Apache-2.0, about 8.7k stars, no releases. Caveat: the "full data sovereignty" line is about self-hosting; the Xiaoyi and Feishu channels are third-party platforms, so messages sent through them leave your box (our reading, not a README statement).
  • Nutlope/hallmark (#8): the anti-slop design skill from Together AI. Why now: version 2.0.0 per package.json, last commit October 22, no tags or releases. MIT, about 33k stars. Caveat: full checks need a local Chrome.
  • morluto/rea (#9): an MCP server and CLI that lets agents reverse engineer native binaries, Electron apps and .NET assemblies locally. Why now: rea-agents-6.8.0 tagged today. MIT; the shields star reading looked unreliable, so no figure here. Caveat: deep native work needs Hopper, Ghidra or IDA, which you supply.
  • humanlayer/humanlayer (#12): a monorepo with a desktop app, web app and per-host daemon for running Claude Code, Codex, OpenCode and Pi across machines. Why now: #12 on the board. Apache-2.0, about 12k stars; the last tags are a February nightly and a June legacy-final. Caveat: Codex is listed as a supported agent but has no plugin, and the self-hosting guides are "in progress."
  • deepopen-com/deepopen (#25): the classification SDK from the tools section. Why now: _version.py on main reads 0.3.4 as of an October 23 commit; there are no tagged releases. Apache-2.0, about 3.1k stars. Caveat: every benchmark is self-run, and the README reports held-out moderation accuracy of only 0.530.

What actually matters from today's signal

Track the checking layer. Discovery has stopped being the scarce part: a security tool finds a decoder bug, a paper that credits an AI research assistant ships references nobody can locate, a general model offers a diagnosis, and in each case the value showed up only when something independent checked the output. For builders the highest-signal areas this week are dependency exposure below your manifest (bundled C libraries inside runtimes), verifier agents that try to break a finding before a human reads it, citation and source checks on anything an AI drafted, and narrow classifiers for questions with fixed answers.

The counter-signal is that the checks have costs nobody publishes. The Cloudflare skill's one number says a single run misses about half. Node's fix hides behind an unchanged version string. The dermatology test shows a specialist model that sent 18 melanomas home at its preset threshold. Verification is the right instinct, and it is also where teams will cut corners first, because a check that finds nothing looks exactly like a check that didn't run.

Source access notes: Vendor and research scan at about 15:12 ET; Trendshift read at about 15:10 ET. openai.com/news loaded this run (it failed the last two). x.ai/news showed nothing newer than August 26. anthropic.com/news latest is October 22; Microsoft Agent Framework latest October 15, Foundry October 19; Mistral October 21; Hugging Face blog October 23; GitHub changelog October 23; LangChain October 24 (not used). Gemini 4 Argon posts carry no day on blog.google or DeepMind, so the model is mentioned only inside the Dream-1 comparison. The Codex changelog was not fetched (JS-rendered in past runs). Product Hunt skipped. Hugging Face Papers still shows the October 23 list; its top agent items were covered in earlier briefings. Claude Code dates come from the npm packument time map. The process.versions.brotli reading came from running Node v22.23.4 in the workspace. The Altman quotes are from Gizmodo; the talk recording was not reviewed. Repo facts come from a Sonnet 5.5 verification subagent (shields JSON, raw README, LICENSE text, releases.atom, all cache-busted); it flagged the rea shields reading as unreliable, so no star figure is printed for rea. A Sonnet 5.5 adversarial pass then caught two cross-wired version claims (a hallmark tag and a deepopen release that do not exist; git ls-remote confirms neither repo has tags), a skin-lesion sentence that misdescribed the page, a "no public exploit" line contradicted by the tracker's October 22 PoC, an ambiguous date that read as the bug's origin instead of the fix's, an overstated Claude Code summary, two repo caveats stated as README claims, and a hardened hedge in the opening. All corrected.