Moonshot shipped a model it made worse on purpose
Moonshot's own chart shows the unfiltered checkpoint at 90.5 percent on its exploit benchmark. The shipped model does 81.0. The 9.5-point gap is deliberate.
AI
A backdoor in the Claude Code extension, and the window that does not matter anymore
Fake builds of Anthropic's Claude Code extension sat on Cursor's marketplace for about 11 hours on October 29, reaching at most 5,000 users. What the payload did, the bugs that blunted it, and why one infected Mac kept beaconing 8 hours after the window closed.
Mistral released a trillion parameters, and your hardware cannot run them yet
Mistral released the weights of Mistral Large 4 and the download alone is 1.06 TB across 54 files. What is inside, the license carve-out nobody read past, and the hardware math before you self-host.
Ghostty 1.4 topped Hacker News, and the terminal is still home turf for developers
Ghostty 1.4 topped Hacker News with more than 1,000 points and 300 comments. The release notes are good. The libghostty story underneath them is the signal for anyone building developer tools.
NVIDIA's OpenShell turns agent containment into a product
OpenShell runs coding agents unmodified inside kernel-enforced sandboxes and makes every policy change pass a formal check first. 18,000 stars say the timing is right.
AI turned a decade-old PHP flaw into a working exploit
CVE-2026-109618 and CVE-2026-109619 sat in PHP's error handling since version 5.4 in 2012. Frontier models collapsed the effort to exploit them, and the patch arrived only after a leaked CVE number, a misplaced video, and a broken embargo.
Anthropic's employment report is more honest than its headlines
Agents now log six hours per human hour and junior technical hires fell from 27% to 9%. The skipped parts of Anthropic's report matter more.