Skip to content

AI Digest for

This page is the archived edition of one specific day. It does not change any more.

Latest digest Subscribe

News from Tuesday, 13 October 2026

38 articles

Models

  • OpenAI’s Higgsfield announcement says creators can now get videos over 10 minutes long, up from 1 minute, using GPT-⁠6 Astra, with precise visuals from GPT-⁠Image-⁠2.5 and a path to voice filmmaking with GPT-⁠Live [1].
  • Meta launched Muse Wonder and Wonder Full, its first frontier-⁠class models, with stronger coding, benchmark gains, and Active Memory for retaining user-⁠provided information [2, 3].
  • Muse Wonder is available through the Meta Model API and Muse Code, while Wonder Full is limited to Muse Code subscribers [4].
  • Google’s Gemini 4 Argon is generally available in GitHub Copilot for Pro+, Max, Business, and Enterprise users, billed at provider list pricing under usage-⁠based billing [5].
  • Gemini 4 Argon scores 87% on the Embodied Reasoning (ERQA) benchmark, which Google says outperforms every other frontier model, and Google positions it as a general-⁠purpose physical reasoning model for robotics [6, 7].
  • Anthropic says new limits on access to Claude’s reasoning cut data harvested by distillation attacks by 90% to 99%, and names Z.ai as one company that tried to copy Claude while building GLM-⁠5.3 [8].
  • Microsoft unveiled the Maia 300 inference accelerator, claiming 40% better performance per megawatt than leading GPU-⁠based systems, with large-⁠scale deployment planned from 2027 [9, 10].
  • LiquidAI’s LFM2.5-⁠24B-⁠A2B is presented for fast, private on-⁠device agents [11].

Agents, RAG and LLM engineering

  • A Hugging Face post reports that offloading step-⁠completion checks and bounded decisions to a decision model cut Qwen agent LLM calls by 29.6%, estimated API costs by 26.6%, and latency by 19.7% [12].
  • Perplexity describes a lightweight Git forge backed by S3 for shared workspaces where people and agents build on durable files; fewer than 2% of submissions are rejected as stale, with median submit latency below 1.7 seconds [13].
  • Simon Willison notes Meta’s new Muse Wonder models at six reasoning levels and says Meta is shipping a new model roughly monthly [14].
  • A Geoffrey Huntley quote describes a pre-⁠commit hook that fails commits bypassing an internal diagnostics library and injects a prompt steering the agent to use it [15].
  • Google reports that Gemini 4 Argon, run unattended overnight on the 205,000-⁠line google/adk-⁠python repository, cut ADK’s in-⁠memory session prep time by about 40% in an 11-⁠hour run [16].
  • A post on securing the agentic SDLC argues that prompts are not permissions: a planted instruction in an issue or config file can steer a coding agent into leaking secrets, so limits belong in isolated workspaces, task-⁠scoped identities, short-⁠lived credentials, and network policy [17].
  • A security writeup reports that CyberXero used Claude Code with 51 agents and PentAGI in campaigns that stole over 628,000 Ukrainian records, with one run scanning 4,708 targets and deploying 32 web shells in 61 seconds [18].
  • Breachcache recovered 75 transcripts from servers running autonomous AI agent intrusions, in which agents gained command execution on 23 hosts [19].
  • An arXiv paper shows AI models can provably hide capabilities via encrypted networks embedded in weights, resisting fine-⁠tuning, weight noising, and gradient-⁠based trigger search, which limits elicitation-⁠based capability audits [20].

DevOps, infrastructure and cloud

  • Cloudflare describes how D1, its SQLite-⁠based serverless database, scales its control plane to millions of databases, with hundreds of thousands active at once, without routing every query through centralized bottlenecks [21].
  • Cloudflare reports its data pipeline delivers roughly two billion events per second and describes how it keeps hardware usage down as traffic grows exponentially against linear hardware growth [22].
  • GitHub’s enterprise managed settings can now force Copilot clients to refresh server-⁠managed policy at startup, failing closed when current policy cannot be confirmed [23].
  • GitHub’s client telemetry can attribute Copilot activity to users via OpenTelemetry attributes, with identity capture off by default and separate controls for prompts, responses, and tool arguments [24].
  • PyTorch describes IBM’s Spyre accelerator moving its torch.compile backend onto Inductor, reporting a compiler roughly 7x smaller than the stack it replaced [25].
  • GitHub’s secret scanning now blocks Anthropic API keys by default in push protection and adds a Salesforce partner token type [26].

Security and supply chain

  • A Linux vhost bug, CVE-⁠2026-⁠74580 (CVSS 8.8), lets any user with access to /dev/vhost-⁠net or /dev/vhost-⁠vsock escalate to root on kernels 4.11 through 7.2; admins should patch to commit de845981da67 or remove world access from both device nodes [27].
  • Three OAuth account takeovers in Pingvin Share X, Better Auth, and AshAuthentication stemmed from auto-⁠linking OAuth sign-⁠ins to existing accounts by email; the advice is to match on issuer and subject ID and require verified emails on both sides [28].
  • A writeup describes a $90,000 bounty for a Google DevSite RCE, where an OAuth secret stored in a Flask session cookie doubled as the signing key, enabling forged sessions that reached unsafe pickle deserialization [29].
  • Rust’s borrow checker has an 11-⁠year-⁠old soundness issue where a struct’s lifetime requirements can be bypassed via covariant field assignment [30].
  • GitHub’s Dependabot now sends a withdrawn action on the dependabot_alert webhook, and the REST API returns 410 Gone for withdrawn alerts instead of 404 [31].
  • GitHub code scanning adds AI Scan metrics to security overview, covering findings, remediation rate, and autofix usage, in public preview [32].

Developer tools and software engineering

  • Uber’s CISO describes using Claude to gather threat-⁠modeling context from code, design docs, and ticket history, and argues AI agents need an insider threat program [33].
  • Robert C. Martin suggests not reading AI-⁠written code and relying instead on constraints such as unit tests and QA procedures, raising liability questions [34].
  • An essay proposes that AI code review will increasingly replace reading every diff, shifting human work toward requirements, acceptance testing, and release ownership [35].
  • A game-⁠development post proposes making a game legible to AI agents and speeding agentic iteration, with the game itself acting as a harness [36].
  • Epic Games is reportedly shifting to an AI-⁠first development model for its Disney collaboration, with humans guiding AI-⁠generated code and art assets [37].
  • GitHub’s audit log now records manual dismissals and reopenings of Code Quality findings [38].
Sources
  1. Higgsfield takes AI video from 1 minute to over 10 openai.com
  2. Muse Wonder research.meta.ai
  3. [AINews] Meta Muse Wonder & Wonder Full: MSL’s Claude 5.5-⁠tier Frontier Model latent.space
  4. Meta launches Muse Wonder and Wonder Full for AI agents testingcatalog.com
  5. Gemini 4 Argon in GitHub Copilot github.blog
  6. Gemini 4 Argon for Robotics deepmind.google
  7. Gemini 4 Argon for Robotics google ai
  8. Anthropic says new safeguards sharply reduce AI distillation attacks reuters.com
  9. Microsoft Introduced the Maia 300 AI Chip news.microsoft.com
  10. Microsoft Prepares to Put Gigawatts of Its Chips in Data Centers bloomberg.com
  11. Run fast, private agents on-⁠device with LFM2.5-⁠24B-⁠A2B huggingface.co
  12. Decision Models Cut Agent LLM Calls by 29.6% discuss.huggingface.co
  13. Building Shared Workspaces for People and Agents perplexity.ai
  14. llm-⁠meta-⁠ai 0.2 simonwillison.net
  15. Quoting Geoffrey Huntley simonwillison.net
  16. Optimizing a 200,000-⁠line Python codebase overnight with Gemini 4 Argon google ai
  17. The Prompt Is Not the Permission: Securing the Agentic SDLC vinny.dev
  18. CyberXero Uses Claude Code in Campaign That Stole Over 628,000 Ukrainian Records thehackernews.com
  19. Hands Off the Keyboard: How AI Agents Run Real Intrusions breachcache.com
  20. AI models can provably hide arbitrary capabilities hnrss.org
  21. Under the hood, off the hot path: How D1 scales to millions of databases blog.cloudflare.com
  22. Rewinding the exponential: How we keep hardware usage down blog.cloudflare.com
  23. Enterprise managed settings enforcement updates github.blog
  24. Client telemetry user attribution and configurable capture github.blog
  25. Extending Inductor for the IBM Spyre Accelerator pytorch.org
  26. Secret scanning blocks Anthropic keys by default, adds Salesforce github.blog
  27. Vghost: Beyond the Privilege Boundary matrix.tencent.com
  28. Three OAuth account takeovers, one bug: Auto-⁠linking by email workos.com
  29. How I Found a $90,000 Remote Code Execution Vulnerability in Google simonkoeck.com
  30. 11 year old unsoundness bugs found in Rust borrow checker hnrss.org
  31. Improved detection for withdrawn Dependabot alerts github.blog
  32. Code scanning AI Scan metrics in security overview github.blog
  33. Uber’s CISO on building an insider threat program for AI claude
  34. Releasing AI-⁠generated software blog.ploeh.dk
  35. Human PR Review Is Next scienceisneato.substack.com
  36. How to engineer an AI harness for game development hnrss.org
  37. Epic Games reportedly pivoting to “AI first” game development model arstechnica.com
  38. Audit GitHub Code Quality finding dismissals and reopenings github.blog

Papers

Nothing yet.