Editor's Picks
Handpicked stories worth your time
CVE-2026-39987's 9-Hour Exploitation Window Exposes the Credential Gap at the Heart of AI Dev Infrastructure
CVE-2026-39987 gave attackers a root shell on Marimo in under 10 hours, targeting LLM API keys and AWS credentials that dev-grade notebook security routinely leaves exposed.
GitHub Copilot Drops Opus from Pro and Pauses Signups: The Forced Migration Facing [Agentic Workflows](/articles/github-copilot-replaces-premium-request-units-with-token-metered-ai-credits/)
GitHub Copilot's Opus 4.7 Arrives at 7.5x. The Post-April-30 Multiplier Is Hidden
Explore Topics
Browse by category
Recent Stories
Fresh off the press
CrewAI 1.14.2 Lands Checkpoint TUI with Tree View, Fork Support, and Lineage Tracking
CrewAI 1.14.2 and 1.14.3 ship a checkpoint TUI with fork support and lineage tracking, making resumability a framework primitive for expensive multi-step agent pipelines.
Google Ignores California's Global Privacy Control 86% of the Time: webXray's 7,000-Site Audit
webXray's March 2026 audit found Google ignored California's GPC opt-out in 86% of cases, with Meta at 69% and Microsoft at 50%, exposing systemic CCPA noncompliance.
InstructLab CVE-2026-6859: Hardcoded trust_remote_code=True Turns Any [HuggingFace Model Into RCE](/articles/picklescan-1-0-4-patches-a-cvss-10-0-pkgutil-resolve-name-bypass-and-six/)
InstructLab CVE-2026-6859 hardcodes trust_remote_code=True in transformers, enabling RCE from any HuggingFace repo. Existing supply-chain scanners cannot detect this vector.
LangGraph 1.1.10's ToolNode Now Accepts list[Command | ToolMessage]: How That Splits From [Pydantic AI](/articles/pydantic-ai-v1-87-closes-the-langgraph-gap-deferred-tool-calls-opentelemetry/)
LangGraph 1.1.10 lets tools return both Commands and ToolMessages in one call, which Pydantic AI's plain Python returns cannot match. The gap adds friction for hybrid stacks.
LLM Agent for Iterative Chart Refinement Exposes a Logging Gap in CrewAI and AutoGen
An arxiv paper shows iterative chart agents need per-step rationale schemas that CrewAI and AG2 lack, while the token and storage cost of structured traces remains unmeasured.
LMDeploy CVE-2026-33626: Vision-LLM SSRF Exploited Within 12 Hours of GHSA Publication
CVE-2026-33626 in LMDeploy's vision endpoint was exploited 12.5 hours after GHSA disclosure, with attackers targeting AWS IMDS and Redis via the image-fetch SSRF path.
Stay Ahead of the Curve
Get the latest AI and tech insights delivered to your feed.