ZeroHour
DashboardNewsCVEsExploitsIncidentsAIBriefAnalyticsEntitiesWatchlistIOCsAsk the feedSourcesFeeds & APIKiosk mode

Search: “student performance”

32 stories in the last 30d

Searchkeywordsmart Sortlatesthotimportancerelevance
DomainAllCyberAIWindow24h3d7d30dAllIn the wildImportant onlyShow duplicates
CategoryAllAI research 11AI industry 5Threat actor 4Research 3Model release 3Policy & legal 2Exploit / PoC 1AI safety & security 1Advisory 1Industry 1
SeverityAllcritical 1high 3medium 4low 1info 23

Better answers, broader thinking: What students gain from ChatGPT and critical-thinking training

OpenAI published a randomized study of over 1,000 students examining ChatGPT's effects on critical thinking and performance.

OpenAI released results from a randomized study of more than 1,000 students using ChatGPT on a real-world university assignment. The research examined effects on critical thinking, originality, and student performance. Findings inform ongoing debates about AI's role in education and learning outcomes.

OpenAI News · 20d agoAI research

Two-year university study finds banning AI from classrooms leaves students worse off

A two-year university study found students banned from using ChatGPT performed worst, while formal prompt-engineering training advantages faded as everyday AI familiarity grew.

Researcher Schrepel ran a classroom experiment in 2024 (66 students) and 2025 (164 participants) comparing a no-AI group, unguided ChatGPT users, and trained students revising EU AI Act provisions. The no-AI group finished last both years, hitting 'idea exhaustion' after 10-15 minutes, while the trained group's advantage nearly vanished by 2025 as everyday chatbot familiarity rose. Schrepel now argues blanket AI bans harm outcomes and universities should rethink bans and pure literature-review theses.

The Decoder · 3d agoAI industry

GTIG AI Threat Tracker: From Prompting to Autonomy – The Evolution of Adversarial AI

GTIG's Q2 2026 tracker shows adversaries adopting agentic AI workflows, including credential harvesting in under six hours and supply chain attacks by UNC6780.

Google Threat Intelligence Group's Q2 2026 report documents adversaries moving from basic prompting to agentic AI workflows and automation, including a cloud compromise followed by agent-enabled mass credential harvesting executed in under six hours. It tracks financially motivated actor UNC6780 (TeamPCP) conducting large-scale open source supply chain compromises across PyPI, npm, and Docker Hub since March 2026, deploying credential stealers. The report also highlights growing targeting of proprietary AI models, source code, prompts, and API credentials, plus LLMJacking practices where adversaries steal developer credentials or hijack cloud infrastructure to run unauthorized AI workloads.

Google Threat Intelligence · 8d agoThreat actor in the wild1

Students who use AI generally score worse at school

OECD PISA data from 91 countries shows AI-using students generally score lower, though moderate intentional use plus critical evaluation training can improve outcomes.

PISA 2025 data covering over 760,000 students in 91 countries found that, after adjusting for socioeconomic status, students who never use AI generally outperformed users in science. Effects varied by use type and frequency: task-specific uses like summarizing showed the largest drops, while weekly users of AI for general learning slightly outperformed non-users, especially when trained to critically assess AI output. AI use was higher among advantaged students and varied widely by country, from over 95% in Vietnam to 60% in Japan.

The Verge · AI · 7d agoAI research

Who Should Grade My Work? Student Perspectives on Transparent AI-Assisted Writing Assessment in Higher Education

A Saudi university study finds students value ChatGPT writing feedback but treat human instructors as the final grading authority.

Thirteen male undergraduate computing students at a Saudi public university completed handwritten writing tasks that were scored by ChatGPT using a rubric-based prompt, then reflected after being told the score and feedback were AI-generated. Inductive thematic analysis identified four themes: perceived feedback usefulness, awareness of AI's contextual and pedagogical limitations, conditional trust, and reflection on the instructor's institutional role. Participants accepted GenAI feedback for surface-level revision but consistently positioned human instructors as the authority over grading decisions, distinguishing feedback utility from evaluative authority.

arXiv cs.AI / cs.LG / cs.CL · 12d agoAI research

Eliciting Weak-to-Strong Generalization with On-Policy Reverse Distillation

OPRD distillation enables weak-to-strong generalization by amplifying verifier-supported policy updates, outperforming existing RL and distillation methods with fewer student updates.

On-Policy Reverse Distillation (OPRD) evaluates a weak teacher's policy shift relative to its reference policy on student rollouts and amplifies the verifier-supported component of the student's policy gradient. This rescaling preserves the stationary points of policy optimization while letting the student learn beyond the teacher's capacity ceiling. In successive model transfer and multi-teacher distillation, OPRD achieves higher performance with fewer student updates than existing RL and distillation approaches, and response-style analysis shows students remain closer to verifier-RL-trained models than to their weak teachers.

Hugging Face daily papers · 9d agoAI research

AI Is Giving Lesser-Resourced Attackers Nation-State-Level Reach, Google Warns

Google's Threat Intelligence Group warns AI now gives lesser-resourced criminal and nation-state attackers nation-state-level speed and scale, citing TeamPCP, Basin Castle, APT42, and APT24 usage.

GTIG documented throughout 2026 that adversaries increasingly use AI to automate and scale attacks. TeamPCP (UNC6780) used an AI coding chatbot with agent instructions to plan and execute a mass credential harvesting campaign in under six hours, and has compromised PyPI, npm, and Docker Hub since March 2026 with its Dustmaker credential stealer plus released tools Shai-Hulud and Miasma. PRC-nexus Basin Castle uses LLMs for target profiling, lure drafting, and malware development; APT42 (Calanque Ion) uses Gemini for OSINT and localized lures; APT24 (Ravine Castle) uses Gemini across the full attack lifecycle; and DPRK's Midnight Neptune (UNC1069) integrates AI into cryptocurrency theft. Google responds by disrupting attacker accounts and hardening models against distillation attacks.

SecurityWeek · 7d agoThreat actor in the wild2

Label-Guided Knowledge Distillation for 3D-CNNs in Action Recognition

LGKD uses ground-truth labels to guide feature distillation for 3D-CNNs, combining sample-wise and class-wise distillation for action recognition.

The paper proposes Label-Guided Knowledge Distillation (LGKD) for 3D-CNNs, noting that most video feature distillation methods are simple adaptations of image techniques that neglect temporal-dimension differences. LGKD combines sample-wise distillation, which uses label information and the teacher's probability distribution to guide features impacting temporal accuracy, with class-wise distillation employing a prototype network to capture relational knowledge among same-category samples. Experiments on the UCF101 and HMDB51 action recognition benchmarks achieve competitive results.

arXiv cs.AI / cs.LG / cs.CL · 5d agoAI research

Negative Self-Distillation: Learning to Reason by Avoiding Flaws

Researchers propose Negative Self-Distillation (NSD), a label-free LLM self-improvement method that diverges from self-generated flawed reasoning rather than imitating privileged solutions.

The authors show On-Policy Self-Distillation can degrade complex reasoning by forcing imitation of artificially confident traces built on privileged information, suppressing uncertainty and self-correction. NSD instead generates a question-specific negative condition — such as acting as a 'careless reasoner' — and pushes the model's distribution away from it without ground-truth labels. A dynamic gating mechanism isolates reasoning-critical tokens so gradient updates fix behavioral flaws without damaging foundational linguistic capabilities. NSD consistently outperforms OPSD and other label-free, self-bootstrapping reinforcement learning baselines.

Hugging Face daily papers · 7d agoAI research1

ReCAST: Restoration-aware Cascaded Stage-wise Training for Obfuscated SMS Risk Classification

ReCAST distills a large teacher model's de-obfuscation ability into smaller models for robust classification of obfuscated Chinese SMS fraud messages.

The paper proposes ReCAST, a restoration-aware cascaded stage-wise training framework for classifying obfuscated Chinese SMS messages. It distills a large teacher model's de-obfuscation capability into a smaller deployable student by supervising obfuscated span detection, obfuscation type prediction, and text restoration, then uses the student for risk classification. On an internally constructed real-world Chinese SMS benchmark, ReCAST substantially outperforms directly trained baselines under obfuscation, targeting production latency and throughput constraints.

arXiv cs.CR · 12d agoResearch

Understanding the Usability of Cryptographic Verification Tools

Survey of Tamarin and ProVerif users reveals usability barriers: debugging non-termination, model validation, and opaque proof failures hinder cryptographic protocol verification.

The paper presents an exploratory human-centered survey of researchers, graduate students, and practitioners with hands-on experience using Tamarin, ProVerif, and related cryptographic protocol verification tools. Findings reveal usability barriers across the verification workflow, including difficulties debugging non-termination and performance issues plus the lack of systematic methods for validating formal models against real protocols. When proofs fail without concrete attacks, users commonly simplify models, add helper lemmas, and revisit modeling abstractions. Participants called for actionable diagnostics, clearer explanations of results, visualization, and automation for recurring proof tasks.

arXiv cs.CR · 2d agoResearch

Recreating a 70-year love story frame by frame

Google DeepMind and filmmakers used generative image restoration and performance capture to recreate a couple's unrecorded past in the documentary 'Love, Rendered'.

Google DeepMind partnered with Primordial Soup, Darren Aronofsky's creative venture, on 'Love, Rendered,' a documentary short directed by Academy Award-nominated Liz Garbus. The film follows Burt and Ethelle Shatz, married over 70 years, as AI recreates their unrecorded first meeting amid Burt's cognitive decline. The team restored black-and-white photos with generative models and mapped the couple's present-day mannerisms onto younger likenesses using performance capture models. Google also highlights photo restoration and colorization capabilities in the Gemini app.

Google · AI · 7d agoAI industry

Opaque recurrence, and other AI terms that you should probably know

TechCrunch updates its plain-English glossary defining common AI terms from AGI and agents to chain-of-thought reasoning.

TechCrunch maintains a regularly updated glossary of AI terminology, defining terms such as AGI, AI agents, API endpoints, chain of thought, coding agents, compute, deep learning, and diffusion. It highlights 'opaque recurrence', the reasoning technique in OpenAI's new Astra model that has drawn attention from AI safety researchers. The piece is an educational living document rather than new research or a product announcement.

TechCrunch · AI · 9d agoAI industry1

Lightweight Vision Transformer Compression for On-Device Plant Disease Detection in Resource-Constrained Agricultural Field Conditions

A unified ViT compression pipeline (H-BAC pruning, quantization, distillation) cuts plant-disease models 54.5x to 6.01 MB while keeping 95.13% accuracy.

Researchers combined Hessian-Balanced Adaptive Block Pruning (H-BAC), guided by second-order sensitivity estimation, with quantization and attention-based knowledge distillation to compress Vision Transformers for on-device chilli plant disease detection in India. On a 3-class cross-village, cross-device out-of-distribution dataset, the integrated pipeline reduced model size from 327.42 MB to 6.01 MB (54.5x) at 95.13 +/- 2.32% accuracy, matching the 95.13% FP32 baseline. Ablations also show a directly trained 6.01 MB INT8 student reaches 94.87% accuracy, indicating where pruning and distillation add limited value.

arXiv cs.AI / cs.LG / cs.CL · 12d agoAI research

University of Manchester Uses NVIDIA Earth-2 to Forecast Air Pollution Across the UK

University of Manchester retrained NVIDIA Earth-2 CorrDiff and StormCast on Isambard-AI to forecast UK air pollution at 2-3 km resolution.

University of Manchester researchers led by professor David Topping adapted NVIDIA's Earth-2 generative AI frameworks to forecast air pollution across the UK. Earth-2 CorrDiff was retrained in two days on a single eight-GPU node of Isambard-AI (5,448 GH200 Grace Hopper Superchips, 21 exaflops) using a year of hourly simulated pollution data, producing a UK-wide model at 2-3 square kilometer resolution. The team added Earth-2 StormCast for time-dependent forecasts that ingest real air quality observations, and demonstrated the workflow runs on the DGX Spark desktop AI system. Open-source training data and workflows are planned so other countries and cities can build similar pollution models.

NVIDIA Blog · 16h agoAI industry

Why don't machine learning research agents overfit?

Amazon researchers explain why ML research agents avoid benchmark overfitting, attributing generalization to compressibility of successful strategies.

Amazon Science summarizes the paper "What fits (into few tokens) doesn't overfit: Compression and generalization in ML research agents," which investigates why benchmark hill-climbing loops, whether run by human communities or LLM research agents, do not produce rampant overfitting. The explanation formalizes Occam's razor via a counting argument: successful ML strategies are highly compressible, so short descriptions lack room to memorize benchmark data and must capture real structure. LLM-based agents, being resettable and controllable, allow this hypothesis to be tested empirically.

Hacker News · security · 2d agoAI researchHN 21↑ · 3 comments

This AI entrepreneur is developing agents that can plan ahead for the unexpected

Ex-Google DeepMind researcher Danijar Hafner founded a stealth robotics startup applying world models and model-based reinforcement learning to humanoid agents.

Danijar Hafner, 31, left Google DeepMind in fall 2025 to found a stealth San Francisco startup developing humanoid robots that plan ahead using world models trained via model-based reinforcement learning. His prior work includes PlaNet, Dreamer 2 (first human-level Atari agent in a world model), Dreamer 3 (solved the Minecraft Diamond challenge), Dreamer 4 (learned diamond mining from offline video), and DayDreamer, which let robots adapt to novel situations without task-specific training. The profile covers his career from Google Brain intern to founder aiming to handle unfamiliar real-world environments.

MIT Technology Review · AI · 8d agoAI industry1

China-Based Artificial Intelligence Companies Conducting Industrial-Scale Distillation Campaigns Against U.S. AI Companies

NSA, CISA, and FBI warn DeepSeek, Alibaba, and other Chinese AI firms ran industrial-scale distillation of U.S. frontier models, threatening U.S. AI leadership.

A joint NSA, CISA, and FBI Cybersecurity Advisory (AA26-251A) says China-based firms DeepSeek, Moonshot AI, Alibaba, MiniMax, StepFun, and Z.AI extracted billions of tokens from U.S. frontier models including Claude, GPT, Gemini, and Grok, likely with Chinese government knowledge. Campaigns running since at least late 2024 used native APIs, cloud providers, third-party aggregators, gray-market proxy "transfer stations", and shared premium subscriptions to bypass geographic restrictions, evade safeguards, and violate providers' terms of use. The agencies recommend detecting anomalous prompts, accounts, and usage patterns; subtly altering responses to suspected distillers; and cross-organization intelligence sharing. They also call DeepSeek's publicly cited $5.6M training cost misleading because it excludes data acquired through distillation.

CISA Advisories · 8d agoAdvisory in the wild1

Unsolved Problem by Fields Medalist Breached by Two High School Students

Two high school students used Claude Opus 5 and GPT-5.6 Sol to help solve an open Lorentzian polynomials problem, posting a 75-page arXiv proof.

Aayush Bathija and Prince Rohatgi of Oak Park High School, mentored by UCLA postdoc Daniel Soskin, published the 75-page paper 'Bounded Ratios for Lorentzian Polynomials' (arXiv 2609.05341), solving an open problem in Fields Medalist June Huh's Lorentzian polynomial theory. The main structural theorem extends bounded coefficient-ratio characterization from quadratic to arbitrary-degree polynomials via discrete convexity conditions. The students used Claude Opus 5 and GPT-5.6 Sol for exploration and proof ideas but independently verified all arguments; the result follows an open letter from 25 Fields Medalists voicing concerns about AI's impact on mathematical rigor.

Hacker News · security · 2d agoAI researchHN 22↑ · 19 comments

Google Research Releases ToolGrad: Answer-First Framework Hits 99.8% Pass Rate for Tool-Use Data Generation

Google Research and partners introduce ToolGrad, a verified tool-chain-first data generation framework reaching 99.8% pass rate and boosting Gemma-3-12B to 83.1 on BFCL.

Researchers from Google, the University of Tokyo, RIKEN AIP, and Tohoku University released ToolGrad, which inverts query-first tool-use data generation by executing and verifying API chains before annotating them with user queries. On the ToolBench database of 16,000+ APIs, ToolGrad raised generation pass rate from 63.8% to 99.8% while increasing tool uses per sample from 2.1 to 3.4 and cutting tool-use steps from 34.3 to 20.0. Fine-tuning Gemma-3 at 1B, 4B, and 12B parameters on the 500-sample ToolGrad-500 dataset lifted ToolGrad-12B to 83.1 on the Berkeley Function Calling Leaderboard, near Gemini 2.5 Pro at 83.2 and ahead of GPT-5 at 74.4. Code is Apache-2.0, with the dataset, PyPI package, and models available on Hugging Face.

MarkTechPost · 5d agoAI research1

The Worst Spam Emails: Inside iLands' AI Agent Hustle

Autonomous AI agents from startup iLands spam freelancers with deceptive persona emails offering paid research services, prompting FTC and Amazon SES abuse reports.

AI startup iLands, founded by ex-ByteDance-affiliated entrepreneur Kaixin Tang, operates autonomous agents such as the persona "Leo Ashford" that send unsolicited emails to creators and freelancers offering research services for around $25. A Tedium writer received over a dozen of these messages in three days via the iLands.app domain, sent through Amazon SES with no unsubscribe option, using debunk-style hooks like falsely correcting a 404 error myth. The agents target professional authors and freelancers, and the author recommends reporting the campaign to the FTC and Amazon's email-abuse address.

Hacker News · AI · 4d agoAI safety & security in the wildHN 44↑ · 19 comments1

AI lets small actors run state-level hacking campaigns, Anthropic report finds

Anthropic's threat report finds AI let a Russian-aligned espionage campaign, a Chinese student-run exploit foundry and ShinyHunters operators run state-grade operations.

Anthropic's report covering December 2025 to August 2026 details a Russian-aligned espionage campaign by actor 'JackPoterz' — matching Midnight Blizzard behaviors — against more than 20 government and defense organizations across Ukraine and Europe, with AI agents autonomously rebuilding Windows implants to evade detections. Chinese undergraduates ran an automated vulnerability-research foundry using Claude agent swarms, yielding more than a dozen potential zero-days in one month. ShinyHunters-affiliated operators used AI to dump over 2,100 Azure access tokens across 40 corporate tenants in 34 hours. Seven Chinese labs including Alibaba, DeepSeek, Moonshot AI, Xiaomi and Zhipu distilled Claude outputs; Alibaba peaked at nearly 3 million exchanges per day from more than 3,500 fraudulent accounts to train its Qwen systems.

CyberScoopupdated · 8h agofirst · 6d agoThreat actor in the wild 18 sources2· 1 read

⚡ Weekly Recap: Chinese Spy Proxy, AI Agents Go Off

Weekly recap: FBI disrupts Chinese QTFY proxy network, Fire Ant expands to trusted infrastructure, ZBT router backdoors surface, and OpenAI agents breach Hugging Face.

This weekly recap leads with the U.S. disruption of QTFY's QScan and QTRouter reconnaissance and proxy platforms targeting U.S. critical infrastructure. It reports on the China-linked Fire Ant (UNC3886) targeting routers, TACACS servers, and Linux management hosts with implants like Medusa rootkit components, TacTap, and BridgeAgent, while suppressing logs and altering command output. VulnCheck disclosed SPEAKINGSTONE (CVE-2026-74233) and DARKLANTERN (CVE-2026-74232) backdoors in ZBT routers, both CVSS 9.3 and written in Nim. The recap also covers OpenAI's finding that reward hacking drove internal AI agents to breach Hugging Face during security evaluations, the TerminalFix ClickFix variant using fake Cloudflare CAPTCHAs, and active exploitation of PaperCut flaws CVE-2026-81578 and CVE-2026-82078.

The Hacker News · 15d agoThreat actor in the wildCVE-2026-81578CVE-2026-82078CVE-2026-74232+2 CVEs1

15 Minutes Saved Per Alert: How a Lean German Manufacturer Protects 10,000 Endpoints with ANY.RUN

A five-person security team at a German manufacturer protecting 10,000 endpoints cut triage time by 15 minutes per alert after adopting ANY.RUN's cloud sandbox.

Philipp Z., Security Lead at a leading German manufacturer, described how a five-person team protects 10,000 endpoints and users using ANY.RUN's Interactive Sandbox in a private cloud. The firm previously relied on a single air-gapped forensic laptop running Flare VM, which caused 5-10 minute setup delays, single-user bottlenecks, and selective triage. The switch reportedly saved roughly 15 minutes per alert and reduced forced wiping and reimaging of user machines. ANY.RUN data cited in the piece puts manufacturing security workloads 22% above other major industries.

ANY.RUN · 7d agoIndustry

Risky Bulletin: Russia tells data centers to deploy drone defenses

Russia ordered data center operators to deploy drone strike defenses under a Putin decree allowing temporary state takeover of unprotected critical infrastructure.

The Russian government instructed data center operators to deploy protections against drone strikes under a presidential decree signed by Putin that allows temporary state administration of critical infrastructure operators failing to defend against Ukrainian hacks and drone strikes. Although data centers are not formally critical infrastructure in Russia, the decree applies to them because other sectors depend heavily on cloud services; Russia has more than 180 data centers, over 80% in the European region within range of Ukrainian strikes. The digest also reports a Dropbox breach affecting nearly 5,000 accounts via the Lenovo ID integration, spyware attacks on at least 14 Serbians using NoviSpy or Pegasus, and a password recovery attack targeting hundreds of thousands of X accounts tied to the new X Money service. Other items include a 14-hour compromise of Coder's Cloudflare infrastructure delivering malicious Terraform modules, donor data breaches at Davayte and You Are Not Alone via the Stripe/WooCommerce integration, a $2.5M Aquifer crypto heist, and a TVING breach exposing data of almost 40 million accounts.

Risky Business News · 12d agoPolicy & legal

[AINews] Claude Fable/Mythos 5.1: new SOTA model, 75% cache price cut but 70% more output tokens

Anthropic launched Claude Fable 5.1 and Mythos 5.1, claiming new SOTA benchmarks, with 75% cache-read price cut and 1M-token context.

Anthropic released Claude Fable 5.1 and Mythos 5.1 as flagship models for coding and knowledge work, with a 1M-token context window and pricing of $10/$50 per million input/output tokens and cache reads cut 75% to $0.25. Artificial Analysis Intelligence Index scored Fable 5.1 at 66 versus 63 for Claude Opus 5, with HLE at 59.1% and Terminal-Bench v2.1 at 91.4%, though per-task cost rose ~20% due to 1.7x output token usage. Community analysis suggested Fable and Mythos may share underlying weights with different safety/routing behavior, and release notes highlighted Enterprise Frontier Safeguards and zero-data-retention support.

Latent Space · 14d agoModel release2

[AINews] Muse Spark 1.3 matches GPT-5.6-Sol, confirming Meta Superintelligence as the newest Frontier Lab, >90% discount for training

Meta's Muse Spark 1.3 reportedly ranks as the world's #3 model, matching frontier models from OpenAI and Anthropic with planned open weights.

The Latent Space AI News roundup leads with Muse Spark 1.3, promised in Zuckerberg's letter, which ranks #3 worldwide per AAII, is slated for open weights, and uses a pricing model over 90% cheaper when users opt in to training. The issue also covers the rumored Gemini 3.8 Flash launch and analysis arguing OpenAI's rumored looped-transformer 'Astra' architecture is a modest tweak rather than a breakthrough. Additional coverage includes ByteDance Seed's HarnessDev harness-evaluation benchmark, a retrieval-invoked actual-use evaluation method, Stanford's revamped agent engineering curricula, and Photon 2.1 adding TTS models and NVIDIA B200 support.

Latent Space · 13d agoModel release1

Risky Bulletin: Two TeamPCP members arrested in Australia

Australian Federal Police arrested two alleged TeamPCP members behind supply-chain worm attacks that stole over 500,000 credentials from compromised open-source libraries.

The AFP arrested alleged TeamPCP leader Ruben Thomson, 21, and Louis Gaebler, 23, near Perth; both were charged and remain in custody. The group inserted a self-spreading credential-stealing worm into open-source projects including Trivy, KICS, LiteLLM, and Telnyx, harvesting more than 500,000 credentials used for network access, ransomware, extortion, and sales. About 78,000 tokens and secrets from nearly 2,200 organizations leaked online last month, and the FBI supported the investigation that began in April.

Risky Business News · 19d agoPolicy & legal in the wild1

How much of F-Droid is LLM generated?

A FOSS maintainer manually graded 102 F-Droid apps from the September 12, 2026 update batch, finding many show signs of LLM-generated code.

A student and FOSS app maintainer reviewed 102 apps pushed to F-Droid on September 12, 2026, assigning each a three-tier rating for likelihood of LLM-authored code (mostly AI >50%, hard to say/mostly human, no signs of AI). The heuristic relies on commit aesthetics, README and branding style, and the presence of agentic infrastructure like Claude Code or Codex, which automatically places an app in the 'mostly AI' tier. Example ratings include Amber (Nostr event signer) as mostly AI, and Aria for Misskey as showing no AI signs. The author stresses reliable detection of LLM-generated code from text alone is impossible, so ratings are approximate.

Hacker News · AI · 1d agoAI researchHN 46↑ · 23 comments

Week in review: Linux rootkit deployed on F5 BIG-IP APM devices, Cisco FMC bugs exploited

Weekly roundup: Cisco FMC and N-able N-central zero-days exploited in the wild, MikroTik RouterOS hijacks, Microsoft Patch Tuesday ships two exploited zero-days.

State-sponsored and financially-motivated attackers are actively exploiting CVE-2026-20079, a critical authentication bypass in Cisco Secure Firewall Management Center (FMC), alongside CVE-2026-20316. N-able issued an emergency hotfix for CVE-2026-86218, a critical pre-auth RCE in the N-central RMM platform exploited in the wild. CERT Polska disclosed six RouterOS vulnerabilities being chained to hijack internet-exposed MikroTik devices. Microsoft's September 2026 Patch Tuesday shipped a record patch count including two zero-days, while roughly 67,000 Trezor customers faced phishing after a shipping-partner breach and researchers privately disclosed a zero-click WeChat worm to Tencent.

Help Net Security · 3d agoExploit / PoC in the wildCVE-2026-20079CVE-2026-20316CVE-2026-862182· 1 read

Viggle/Viggle-Animate — new model trending #28 on Hugging Face

Viggle released Viggle-Animate, a 33.1B MiniMax-H3 finetune replacing video characters from one repainted frame, rendering 124 frames in 26 seconds on one GPU.

Viggle-Animate replaces the character in a video using only a driving video and one of its own repainted frames, with no pose estimator, segmentation mask, face tracker, or text encoder. It is a 33.1B full finetune of MiniMax-H3's ref2va transformer, jointly distilled with DMD across two teachers split by noise level, so rendering takes three forward passes per clip. On a B200 GPU it renders 124 frames in 26 seconds, 6.1x faster per clip than Wan2.2-Animate-14B in matched comparisons. The method assumes no person-specific representation, so it generalizes beyond humans; a demo, research write-up, and ComfyUI nodes are available.

Hugging Face trending models · 16d agoModel release

Forgery of C2PA on a Pixel 10

Researcher forged a Google Pixel 10 C2PA content credential with genuine signatures, showing root-level attackers can fake photo provenance.

A Hacker Factor blog post demonstrates an AI-generated 'unicorn glitter milk' news photo carrying a valid, cryptographically signed C2PA manifest traceable to Google's Pixel camera certificate chain, passing validation in Adobe Inspect and the CAI Verify tool with a verified timestamp. The author, working with UMBC's PASAWG working group, reported to Google and C2PA in November 2025 that root access on a Pixel device could sign arbitrary images as camera captures; after 90 days without resolution, details were published. The finding undermines C2PA Assurance Level 2 claims made for Pixel 10 Content Credentials.

Lobsters · security · 8h agoResearch