AI, three at a time · read · watch · listen

Entity

Open Source Strategy

9 reads

The Wall Street Journal 2026-10-27-2

AI Hacks Are Coming Thick and Fast and Overwhelming the Internet

Parsons was billed $449 across about 50 charge emails overnight after attackers drained Anthropic and OpenAI credentials stored in OpenCode, and other users reported $1,700. The target was inference spend, so a stored key behaves like a card number. Governments in Canada, Belgium, France and the Netherlands took sites offline rather than wait for patches against bugs that could expose up to 70% of websites, the move Sima's account says stops working once the attacker holds your own keys.

# tags
ai-cybersecurityai-securityagent-securityvulnerability-managementpatch-velocityincident-managementopen-modelskimiopencodecrowdstrikewsj
◆ entities
Risk managementOpen Source StrategyBlast RadiusAgent governanceEnterprise AI security posture
→ threads
ai-cybersecurityai-security
⟷ links
2026-04-01-32026-04-13-32026-05-22-w22026-04-01-12026-05-14-12026-04-05-12026-05-22-32026-04-04-22026-03-13-w32026-05-12-2
permalink
The Register · 2026-10-17 2026-10-23-w1

Postgres 19 delayed after AI reviewers find more bugs than humans can fix

Postgres is the week's cleanest measurement of what cheap detection costs downstream. GA moved to about November 19, 2026 and 8 to 10 significant features went back to PG20, after LLM-assisted review produced about 40 reports averaging a three-line fix. The quality bar rose after the features were written and committed, so finished work became work in doubt. Grant review and PHP's patch race follow the same pattern with different people absorbing the load. Watch PG20, which was expected to be bug-fix-only and now carries the leftovers; a verifier only pays off if remediation capacity grows to match.

# tags
ai-coding-toolscode-reviewopen-sourcepostgresqlrelease-cadencetechnical-debtthe-registerverifier-bottleneck
◆ entities
Independent verificationOpen Source StrategyProduction-readinessVerifier-bottleneck
→ threads
verifier-bottleneck
⟷ links
2026-10-17-32026-10-20-32026-10-23-12026-04-17-w22026-05-07-22026-04-14-12026-04-11-12026-10-14-22026-04-15-22026-04-07-12026-05-01-w32026-04-30-32026-05-22-w2
permalink
The Wall Street Journal · 2026-10-23 2026-10-23-w3

AI Just Found a Bug That Puts up to 70% of the World's Websites at Risk

PHP2Shell puts a clock on the week's argument. Ryan Austin used GPT-5.6 Sol to take control of in-memory code in as few as a few dozen requests, in a bug class flagged decades ago and dismissed as too hard to exploit. The roughly ten-week embargo, from the Aug 11 call to the Oct 21 patch, broke on one Hacker News post, and a patch of close to 200 files now works as a blueprint. Finding was cheap for the researcher and the attacker alike; absorbing the fix across the long tail of unpatched servers is the slow part. For internet-facing open source, time-to-deploy is measured in hours, so mitigations have to ship before the diff does.

# tags
ai-arms-raceai-cybersecuritycybersecurityopen-sourceopenaipatch-velocityresponsible-disclosuresupply-chain-securityvulnerability-managementwsj
◆ entities
AI safetyAgent governanceOpen Source StrategySystemic riskVerification Infrastructure
→ threads
ai-cybersecuritysupply-chain-security
⟷ links
2026-10-23-12026-10-17-32026-10-20-32026-05-22-32026-03-09-32026-04-01-32026-04-05-12026-03-11-22026-04-22-22026-05-02-32026-05-01-w32026-05-01-w12026-05-22-w2
permalink
The Wall Street Journal 2026-10-23-1

AI Just Found a Bug That Puts up to 70% of the World's Websites at Risk

PHP2Shell had a patch ready and the exposure still sits with the long tail of unpatched PHP servers. Ryan Austin used GPT-5.6 Sol to take control of in-memory code in as few as a few dozen requests, in a bug class flagged decades ago and dismissed as too hard to exploit. The roughly ten-week embargo, from the Aug 11 call to the Oct 21 patch, broke on one Hacker News post. A patch of close to 200 files now doubles as a blueprint, so time-to-deploy is measured in hours.

# tags
ai-cybersecuritycybersecuritypatch-velocityopen-sourcevulnerability-managementresponsible-disclosureopenaisupply-chain-securitywsjai-arms-race
◆ entities
Systemic riskAI safetyOpen Source StrategyAgent governanceVerification Infrastructure
→ threads
ai-cybersecuritysupply-chain-security
⟷ links
2026-05-22-32026-03-09-32026-04-01-32026-04-05-12026-03-11-22026-04-22-22026-05-02-32026-05-01-w32026-05-01-w12026-05-22-w2
permalink
The Register 2026-10-17-3

Postgres 19 delayed after AI reviewers find more bugs than humans can fix

Postgres 19 GA slipped from late September or early October to about November 19, 2026, and 8 to 10 features went back to PG20, because LLM-assisted review found more than the beta window could absorb. Eisentraut's example is about 40 reports averaging a three-line fix, each still carrying triage, patch, review, commit and backpatch overhead. PG20 was expected to be bug-fix-only and now inherits the leftovers, so a verifier like VAGEN pays off only if remediation capacity grows to match.

# tags
code-reviewverifier-bottleneckopen-sourcepostgresqlai-coding-toolsthe-registerrelease-cadencetechnical-debt
◆ entities
Open Source StrategyIndependent verificationVerifier-bottleneckProduction-readiness
→ threads
verifier-bottleneck
⟷ links
2026-04-17-w22026-05-07-22026-04-14-12026-04-11-12026-10-14-22026-04-15-22026-04-07-12026-05-01-w32026-04-30-32026-05-22-w2
permalink
VentureBeat · 2026-10-15 2026-10-16-w1

NVIDIA's new, open Nemotron 3.5 Super VL with post-training beats Claude Opus 5, GPT-6.1 Sol on specialized task benchmarks

Super VL, a 120B open base, went from about 28% to about 72% on medical claims after post-training, against about 38% for Claude Opus 5. The base model sat below Opus 5, so the gain came from the customer's data and tuning budget, and the comparison is tuned against untuned. Its Artificial Analysis index of 26 trails GLM-5.3-Flash (42) and Qwen3.8-Flash-Next (40), which says the weights are not what wins. For builders the buying decision moves from which model to who owns the evaluation set and the post-training pipeline. In the week's argument this is the lightest of Nvidia's levers: it gives away the part that is commoditizing and keeps buyers building on its stack, with Bolt E4B due Oct 23 as the next test.

# tags
benchmarkedge-aienterprise-aifine-tuninghugging-facehuggingfaceinference-economicslocal-llmmodel-licensingnvidiaopen-modelspost-trainingvendor-claimsventurebeat
◆ entities
Ecosystem lock-in through integration breadthEnterprise AI adoptionOpen Source StrategyTeacher-student distillationVertical Integration
→ threads
inference-economics
⟷ links
2026-10-15-32026-10-16-12026-10-16-22026-03-17-32026-03-13-12026-03-15-12026-03-14-32026-03-10-12026-05-27-32026-04-17-w22026-03-17-22026-05-07-12026-03-14-1
permalink
Meta AI Research 2026-10-15-1

Introducing Muse Spark Open, The Most Capable US Open‑Weight Model to Date

Meta's Muse Spark Open post (816B total, 42B active, 1M context) is far more specific about availability than capability: seven API hosts, four weight hubs and seven-plus engines on day one, none of them Meta. The local recipe is two 512GB M5 Ultra Mac Studios running through MLX. Meta is giving the weights away to buy presence across every stack, which fits the Spyglass reading that its open tier trails its closed one.

# tags
metaopen-modelsapple-siliconmlxlocal-llmon-deviceinference-economicsvendor-claimsmodel-licensingai-capital-cycleblog-post
◆ entities
Open Source StrategyHardware fragmentationDistribution moatInference cost economics
→ threads
inference-economicsai-capital-cycle
⟷ links
2026-03-14-32026-05-15-w32026-04-08-32026-04-14-12026-03-31-m22026-03-20-w12026-04-04-32026-03-13-12026-03-21-3
permalink
CNBC 2026-10-15-2

Apple and Meta team up to make Muse AI model run on Mac computers

CNBC's account of the Apple tie-up supplies the hardware half. Muse Spark Open needs 2 to 4 paired Mac Studios, and an M5 Ultra with 256GB starts at $10,799. Alexandr Wang says the open model is meant to pull developers in small and then scale them up, and by his framing memory capacity, not compute, gates local use. That makes sovereign coding a fixed-capex purchase and puts Apple, not NVIDIA, on the default local path for the largest open models.

# tags
cnbcmetaappleapple-siliconopen-modelslocal-llmon-deviceedge-aimlxai-infrastructureinference-economicshardware-fragmentationopen-sourceai-strategy
◆ entities
Open Source StrategyVendor Lock-in RiskHardware fragmentationPlatformizationInference cost economics
→ threads
inference-economics
⟷ links
2026-04-08-32026-04-25-22026-04-21-22026-04-04-32026-03-14-32026-03-30-3
permalink
VentureBeat 2026-10-15-3

NVIDIA's new, open Nemotron 3.5 Super VL with post-training beats Claude Opus 5, GPT-6.1 Sol on specialized task benchmarks

NVIDIA's Super VL, a 120B open base, went from about 28% to about 72% on medical claims after post-training, against about 38% for Claude Opus 5. The base model sat below Opus 5, so the gain came from the customer's data and tuning budget, and the comparison is tuned against untuned. Set beside Meta's Muse Spark Open, it suggests the weights are the commodity and the evaluation set and training pipeline are what a buyer should own.

# tags
nvidiaopen-modelspost-trainingfine-tuningenterprise-aivendor-claimsbenchmarkventurebeatmodel-licensinghugging-facehuggingfaceedge-ailocal-llminference-economics
◆ entities
Teacher-student distillationOpen Source StrategyEcosystem lock-in through integration breadthVertical IntegrationEnterprise AI adoption
→ threads
inference-economics
⟷ links
2026-03-17-32026-03-13-12026-03-15-12026-03-14-32026-03-10-12026-05-27-32026-04-17-w22026-03-17-22026-05-07-12026-03-14-1
permalink