Search: “planyo”

[webapps] Planyo_Online_Reservation_System 3.0 - Arbitrary File Read via SSRF

Exploit demonstrates arbitrary file read via SSRF in Planyo Online Reservation System 3.0.

Exploit-DB entry 52636 documents an arbitrary file read vulnerability in Planyo Online Reservation System version 3.0, reachable through a server-side request forgery condition. The public PoC shows how the web application can be manipulated to fetch and disclose local files. Sites running the vulnerable version could expose sensitive server files.

Exploit-DB·Aug 11, 00:00 UTC · Aug 11, 2026Exploit / PoC

Measuring Language Transfer in Robot Policies: Adding Greek to a Cosmos3 Vision-Language-Action Policy

Researchers added Greek to the Cosmos3 vision-language-action policy using only machine-rephrased instructions, finding bilingual training reaches roughly two fifths of English performance.

The paper studies localizing the open Cosmos3 vision-language-action robot policy to Greek without architectural changes, using machine-rephrased instructions only. Bilingual training yields a consistent 6.7-7.1 point margin over controls on a 90-task, three-seed evaluation suite, while Greek-only training gains at most 2.7 points. Several common evaluation instruments, including color-histogram metrics and single-goal benchmarks, produced false conclusions, and results were dominated by seed variation. The authors recommend building guaranteed-null baselines and replicating low-resource-language results across seeds.

Hugging Face daily papers·Sep 6, 20:00 UTC · 10d agoAI research

Memory as Plans: World-Action Modeling with Memory-Grounded Planning

Researchers introduce MaP-WAM, decomposing memory-dependent robot manipulation into memory-grounded planning and plan-conditioned execution, achieving 83.3% on RMBench and 78% on real robots.

MaP-WAM converts long-term multimodal episodic memory — segment records with language instructions and sparse visual context — into compact plans of next-segment language goals and visual guidance. A World-Action-Progress model jointly predicts action chunks and execution progress, calibrating predictions via plan-observation alignment for adaptive segment transitions and closed-loop context updates. Structured attention keeps the executor context length fixed and enables key-value caching, yielding state-of-the-art 83.3% success on RMBench, 78.0% on real-robot tasks, and roughly constant inference latency as task history grows.

Hugging Face daily papers·Sep 9, 20:00 UTC · 7d agoAI research

Knowing What Not to Answer: Selective Non-Compliance in Vision-Language Models

Researchers introduce KoNA, a benchmark exposing vision-language models' failures at selective non-compliance, plus fine-tuning that improves refusal and abstention accuracy.

KoNA is a benchmark for evaluating selective non-compliance in vision-language models across five categories: False Premise, Visual Inaccessibility, Universal Unknown, Task Feasibility and Safety. It tests both query-level and component-level non-compliance using paired single and compound queries, and evaluations across diverse VLMs show models often fail to refuse, correct or abstain appropriately, with failures worsening on compound queries. Fine-tuning VLMs on KoNA examples substantially improves non-compliance accuracy while largely maintaining performance on fully answerable tasks.

Hugging Face daily papers·Sep 3, 20:00 UTC · 13d agoAI research1

How loveholidays is making everyone a builder with Codex

loveholidays uses OpenAI Codex to let business teams build software, shortening the path from ideas to shipped products.

OpenAI published a customer story describing how travel company loveholidays deploys Codex to make software development accessible across business teams. The company says the approach helps non-engineers turn ideas into products faster. The piece is a vendor case study rather than new technical or research output.

OpenAI News·Aug 26, 00:00 UTC · 22d agoAI industry

Putting sign language AI into users’ hands

Google DeepMind introduced SL2T, a sign-language-to-text model powering new accessibility features for Deaf and hard-of-hearing users.

Google DeepMind announced SL2T, a sign-language-to-text model described as a breakthrough for sign language understanding. The model powers new sign language features aimed at Deaf and hard-of-hearing users. Details on benchmarks and model size were not provided in the announcement.

Google DeepMind·Aug 12, 14:01 UTC · Aug 12, 2026Model release

Putting models to the secure coding test: Plan vs default mode

Datadog Security Labs tested Sonnet 5, Composer 2.5, and GPT 5.5 to see if plan mode yields more secure code than default mode.

Datadog Security Labs evaluated whether plan mode produces measurably more secure code than default mode. The test covered three frontier coding models: Sonnet 5, Composer 2.5, and GPT 5.5. The results inform how engineering teams should configure AI coding assistants to reduce insecure code. This is an AI security evaluation, not an incident report.

Datadog Security Labs·Aug 19, 00:00 UTC · 29d agoAI safety & security

StepAudio 3 Realtime Technical Report

StepAudio 3 Realtime debuts an audio-language model with Think-While-Speaking reasoning, delivering full-duplex voice dialogue with top benchmark results.

StepAudio 3 Realtime is an audio-language foundation model built around a continuous listen-converse-think-act loop for real-time spoken interaction. Think-While-Speaking runs private reasoning in parallel with speech, reaching a 73.0 macro average on StepAudioChat in reasoning mode. The model reports 90.6 on MMSU, 98.9 overall on the Artificial Analysis Full-Duplex Bench, and 56.0% macro task success on tau-Voice. An integrated Voice Agent handles asynchronous tool execution without disrupting dialogue flow.

Hugging Face daily papers·Sep 11, 20:00 UTC · 5d agoAI research

MindTopo: Can Foundation Models Reason in Topological Space?

MindTopo benchmark with 11,030 topological tasks shows 14 multimodal LLMs reason better than they plan and remain far below human performance.

MindTopo is a benchmark of topological intuition across five properties grounded in cognitive science and formal topology: continuity, separation, order, enclosure, and knots, evaluated at reasoning and closed-loop planning levels. It contains 11,030 instances across 13 procedurally generated task types with controllable difficulty, benchmarking 14 multimodal LLMs plus agent configurations using image and video generation, including three video generative models. Every MLLM performs better on reasoning than on planning, and the best-performing model remains far below observed human performance. On Qwen3-VL-2B-Instruct, supervised fine-tuning and reinforcement learning improve reasoning more than planning, and audited generated rollouts often fail to follow environment dynamics or preserve topology across transitions.

arXiv cs.AI / cs.LG / cs.CL·Sep 10, 17:54 UTC · 6d agoAI research

Superhuman acquires YC-backed notetaker Fathom as productivity platforms push for agentic work

Superhuman acquires AI notetaker Fathom to add meeting context and agentic workflows to its 40-million-user productivity platform.

Superhuman is acquiring Y Combinator-backed AI notetaker Fathom, which raised over $30 million and was valued at $94 million in 2024. Fathom reports 400,000+ monthly active users and over 1 million people have recorded meetings with it. The deal adds notetaking to Superhuman's suite (email, docs, calendar, database, AI agent builder) to enable proactive AI agents driven by meeting context, competing with Granola, Read AI, and Wispr.

TechCrunch · AI·Sep 14, 14:45 UTC · 2d agoAI industry

KlueセキュリティインシデントとRecorded Futureへの影響

Recorded Future disclosed a Klue incident that exposed some Salesforce business data, including contacts and emails, via a compromised OAuth token.

Recorded Future disclosed that unauthorized activity in marketing vendor Klue's integration layer, starting June 12, 2026 and contained the same day, affected some of its Salesforce data through a compromised OAuth token in the Salesforce-Klue integration. Impacted fields are limited to business data such as customer contact names, email addresses, and possibly business contract information. No evidence indicates Recorded Future's core platform, Intelligence Graph, internal databases, or customer platform data were accessed. The company revoked all relevant OAuth tokens, coordinated with Salesforce and law enforcement, and began reviewing all third-party Salesforce integrations.

Recorded Future·Aug 12, 00:00 UTC · Aug 12, 2026Data breach

Advancing price-performance for developers with GPT‑5.6 in Kiro

OpenAI's GPT-5.6 is now available in the Kiro developer platform, offering developers improved price-performance for planning, building, reviewing, and testing software.

OpenAI announced that GPT-5.6 is now available in Kiro, a developer platform for planning, building, reviewing, and testing software. The announcement emphasizes better price-performance for developer workloads rather than new model capabilities. This expands the commercial availability of OpenAI models in third-party coding tools.

OpenAI News·Aug 24, 12:00 UTC · 23d agoAI industry

Playco cut manual fixes 50% prototyping games with GPT-6 Astra

Game studio Playco used OpenAI's GPT-6 Astra to build three game prototypes, reporting 50% fewer manual fixes than with the previous model.

Playco, a game development company, used OpenAI's GPT-6 Astra model to generate three themed game prototypes from a single grey-box foundation. The company reports the new model cut manual fixes by 50% compared to its previous model workflow. The piece is an OpenAI-published customer story highlighting Astra's use in game prototyping.

OpenAI News·Sep 3, 12:00 UTC · 13d agoAI industry

Building Multilingual Bridges: Data Mixing as the Pillar of Generalization for In-Language Reasoning

Tiny Aya L2-Thinker, a 3.35B model, achieves over 93 percent in-language reasoning across 60 languages via optimized multilingual data mixing; weights released.

The paper studies L2 reasoning, the ability to reason consistently in the language of the user's prompt, approached through SFT data composition and scheduling. Tiny Aya L2-Thinker (3.35B) achieves an in-language reasoning rate above 93 percent across 60 languages on six benchmarks spanning math, commonsense, instruction following, open-ended generation, and cultural reasoning. Findings show generalization to held-out languages comes from broader language coverage, multilingual non-reasoning data, and a strong English reasoning backbone, suggesting reasoning is language-agnostic and transferable without per-language supervision. Model weights and multilingual reasoning data are publicly released.

arXiv cs.AI / cs.LG / cs.CL·Sep 9, 16:56 UTC · 7d agoAI research1

TaichuAI/ZDTaichu5.0-9B — new model trending #30 on Hugging Face

TaichuAI released ZDTaichu5.0-9B, an open multimodal VLM built on Qwen3.5-9B targeting spatial reasoning, embodied AI, and agentic tool use.

TaichuAI released ZDTaichu5.0-9B, a multimodal vision-language model pairing a Qwen3.5-9B language decoder with a C-RADIOv4-H vision encoder, supporting text, single/multiple images, and video with any-resolution input and a 128K-token context. It introduces Entropy-Gated Adaptive Recurrent Reasoning, which allocates extra latent refinement steps to harder tokens. Reported benchmarks include 87.7 on TAU2-Bench, 71.4 on Claw-Eval, 93.7 on IFEval, 48 on ERQA, and 56 on RoboSpatial, leading compared 10B-scale open VLMs on agent and spatial tasks. The weights are available on Hugging Face, GitHub, and ModelScope, where it is trending at #30.

Hugging Face trending models·Sep 4, 02:55 UTC · 13d agoModel release

TANGO: Humanoid Navigation in Cluttered Environments with a Whole-Body Vision-Language-Action Model

Researchers introduce TANGO, a whole-body vision-language-action model enabling zero-shot language-guided humanoid navigation on the Unitree G1 robot.

TANGO addresses humanoid navigation in cluttered indoor environments by predicting 29-DoF joint-space actions directly from natural-language instructions and egocentric RGB, rather than 2D path planning. It is trained entirely in simulation via a pipeline combining global path planning, kinematic whole-body motion generation, obstacle-aware motion editing, and RL-based tracking. In simulation it achieves state-of-the-art vision-language navigation performance and transfers zero-shot to a Unitree G1 humanoid without any real-world navigation data.

Hugging Face daily papers·Sep 7, 20:00 UTC · 9d agoAI research1

RoboSPA: Can VLA Models Go Beyond Simple Scenes and Short-Horizon Tasks?

RoboSPA introduces a 527K-trajectory benchmark with 280 task variants showing current VLA models struggle with spatial reasoning and long-horizon planning.

RoboSPA is a large-scale robotic manipulation dataset and benchmark for diagnosing embodied reasoning in vision-language-action models, covering fine-grained spatial reasoning and long-horizon procedural planning. It spans 10 task categories and 56 base tasks instantiated across five difficulty levels for 280 variants, with 527K trajectories collected across multiple embodiments and diverse scenes. Diagnostic metrics go beyond binary success rates, and experiments show current VLA models struggle with complex spatial relations, precise low-level execution, and memory-intensive planning.

Hugging Face daily papers·Sep 3, 20:00 UTC · 13d agoAI research

LLaDA-UI: Bringing Block-wise Diffusion to Vision-Language GUI Agents

LLaDA-UI, a 16.7B block-wise diffusion vision-language GUI agent, outperforms Qwen2.5-VL-7B and beats Qwen3-VL-8B on four of six GUI benchmarks.

LLaDA-UI is a 16.7B-parameter MoE-based, block-wise diffusion vision-language GUI agent built on the LLaDA2.0-mini-base diffusion language backbone with a native-resolution vision encoder. It uses a two-stage pipeline: general multimodal pre-training followed by GUI-agent supervised fine-tuning on mobile, desktop, web, and grounding data. It substantially outperforms Qwen2.5-VL-7B and surpasses Qwen3-VL-8B on four of six reported GUI benchmarks, establishing block-wise diffusion as a practical paradigm for latency-sensitive multimodal agents.

Hugging Face daily papers·Sep 8, 20:00 UTC · 8d agoAI research

27.5KB language-agnostic WebGPU syntax highlighter

A developer released gpu-lexer, a 27.5KB language-agnostic syntax highlighter that uses a tiny WebGPU model to label code tokens in the browser.

gpu-lexer splits source into words, whitespace, and symbols, then a small WebGPU model uses local and whole-file context to assign nine token classes, working on languages never seen in training. On held-out files, 12.57% of token labels differ from Shiki, though this measures agreement with Shiki rather than objective correctness. In benchmarks against Shiki 4.4.3, Prism.js, Highlight.js, Sugar High, and Starry Night, it highlighted 10 concatenated copies of three.min.js (5.56M characters) about 10x faster on an Apple M4 Pro in Chrome 152. The author frames it as an experiment, not a grammar-equivalent highlighter.

Hacker News · security·Sep 9, 01:14 UTC · 8d agoAI tools & infraHN 21↑ · 5 comments1

How AI wiped out an entire industry in Nairobi

ChatGPT's rise collapsed Kenya's contract essay-writing industry, which once employed 40,000 people in Nairobi, cutting $40–70-per-paper earnings after 2022.

The New York Times reports that generative AI, primarily ChatGPT, wiped out Kenya's ghostwriting business, which at its peak employed at least 40,000 people in Nairobi writing academic papers for US and UK students. Writers like Teresios Bundi, who produced over 2,500 papers in twelve years, saw prices and orders collapse after ChatGPT's 2022 launch. Related gig work such as transcription, data annotation, and Meta content moderation has also dried up, leaving 'humanizers' who rewrite AI text to evade plagiarism checks. Kenya's government had promoted online gig work since 2016, and roughly 80 percent of the country's jobs are informal.

The Decoder·Sep 7, 13:18 UTC · 9d agoAI industry

PurpleDelta's Fraudulent Employment Operations

Recorded Future details North Korean cluster PurpleDelta using AI-generated personas and ChatGPT assistants to infiltrate companies via fraudulent employment.

Recorded Future profiles PurpleDelta, a North Korean IT worker threat cluster, in a new research report. The group uses AI-generated personas, sophisticated tradecraft, and custom ChatGPT assistants to obtain employment at target organizations and operate covertly. The report includes key indicators of compromise and recommended mitigation strategies for defenders.

Recorded Future·Aug 18, 00:00 UTC · Aug 18, 2026Threat actor

Dynin-Robotics: Omnimodal Unified Diffusion Vision-Language-Action Model

Dynin-Robotics omnimodal diffusion vision-language-action model unifies action, dynamics, and goal prediction, reaching 78.4% success on Franka tasks.

Dynin-Robotics builds a shared trajectory model on the Dynin-Omni omnimodal masked-diffusion backbone, representing language, observations, goals, and actions as discrete tokens. One model learns action prediction, action-conditioned next-observation prediction, terminal goal-state prediction, and trajectory-to-instruction reconstruction, enabling test-time scaling through goal prediction and joint refinement. It is continually pretrained on approximately 1.33 million trajectories from 48 Open X-Embodiment datasets and achieves competitive performance on LIBERO and zero-shot LIBERO-Plus plus a 78.4% average success rate across four manipulation conditions on a Franka Research 3 robot. An optimized block-parallel implementation accelerates model-side action decoding by up to 29.2x.

arXiv cs.AI / cs.LG / cs.CL·Sep 11, 16:49 UTC · 5d agoAI research 2 sources1

Polimill builds Japan's next-generation public AI infrastructure

OpenAI says Japanese company Polimill uses GPT models and Codex to give municipalities searchable access to administrative knowledge.

OpenAI published a customer story describing how Polimill, a Japanese civic technology company, builds public AI infrastructure using OpenAI GPT models and Codex. The tools let municipalities search and reuse administrative knowledge and are intended to accelerate internal development workflows.

OpenAI News·Aug 31, 07:00 UTC · 16d agoAI industry

日本のビジネスパーソンを対象としたWiz調査で 「AI導入加速」はクラウド移行を上回ることが明らかに

Wiz survey of Japanese business professionals finds AI adoption outranking cloud migration and 60% planning AI security investment.

A Wiz survey of Japanese business people found that accelerating AI adoption now outranks cloud migration as a priority. At the same time, more than 80% feel behind in preparing for AI-driven cyber-attacks, and 60% plan to invest in AI security. The findings highlight a preparedness gap as organizations adopt AI faster than they secure it.

Wiz Blog·Aug 25, 06:00 UTC · 22d agoIndustry

Gradium Launches Voice Design: Write a Prompt, Get a Brand New Synthetic Voice in Seconds

Gradium, a Kyutai spinout, launched Voice Design, generating custom synthetic voices from text descriptions in seconds across five languages.

Gradium, a Paris-based voice AI company spun out of Kyutai, launched Voice Design, which generates new synthetic voices from 1-500 character text descriptions in seconds without needing reference audio or speaker consent. The feature is live in the Gradium API and Studio, free on every plan including the free tier, and kept voices run on the standard streaming TTS endpoint at the same latency as catalog voices. Vendor-run blind pairwise listening tests across 7,627 comparisons report a 72.6% win rate, 13.6 points ahead of ElevenLabs at 59.0%, placing first in all five tested languages, with the largest margins on regional accents such as Quebecois French (97%).

MarkTechPost·Sep 9, 07:29 UTC · 7d agoAI industry

RoboSPA: Can VLA Models Go Beyond Simple Scenes and Short-Horizon Tasks?

RoboSPA introduces a 527K-trajectory robotic benchmark with 280 task variants exposing VLA model weaknesses in spatial reasoning and long-horizon planning.

RoboSPA is a large-scale robotic manipulation dataset and benchmark for diagnosing embodied reasoning in vision-language-action models, spanning fine-grained spatial reasoning and long-horizon procedural planning. It covers 10 task categories and 56 base tasks instantiated across five difficulty levels for 280 variants, with 527K trajectories collected across multiple embodiments. Experiments on representative VLA models show current systems struggle with complex spatial relations, precise low-level execution, and memory-intensive planning.

arXiv cs.AI / cs.LG / cs.CL·Sep 4, 16:19 UTC · 12d agoAI research

Legora reviewed 41 documents in minutes with GPT-6 Astra

Legal-tech firm Legora says GPT-6 Astra reviewed 41 financial documents in minutes, catching all four planted errors and boosting accuracy about 40%.

Legal technology company Legora reported using OpenAI's GPT-6 Astra to review 41 financial-statement documents in minutes. The workflow found all four planted errors and improved performance by nearly 40% compared to prior processes. The case study highlights AI-assisted financial review adoption in professional services.

OpenAI News·Sep 3, 12:00 UTC · 13d agoAI industry

Recorded FutureがGartner® サイバー脅威インテリジェンス・テクノロジー部門のMagic Quadrant™のリーダーの１社に位置づけられました。

Recorded Future·Aug 5, 00:00 UTC · Aug 5, 2026Phishing & fraud

StepAudio 3 Gen Technical Report

StepAudio 3 Gen unifies TTS, voice design, music, and sound effects via discrete autoregressive modeling over RVQ tokens.

StepAudio 3 Gen is a general-purpose audio generation model covering zero-shot TTS, voice design, vocal generation, sound effects, music, vibe speech, and mixed audio in one framework. It uses discrete autoregressive modeling over residual vector quantization (RVQ) tokens rather than the diffusion Transformer paradigm, with a StepAudio Tokenizer representing audio at 12.5 Hz in a shared 16x2048 residual code space. Key design principles include interference-aware progressive pretraining, an RVQ Adaptor for multi-codebook acoustic representations, and shared discrete autoregressive modeling. The model reports state-of-the-art performance on TTS and voice design while retaining strong generation across speech, vocals, sound effects, and music.

Hugging Face daily papers·Sep 10, 20:00 UTC · 6d agoAI research

Flirty OnlyFans promoters on X may be using AI to appear human

Developer Álvaro Martínez Majado found OnlyFans-promoting accounts on X following rigid scripts yet handling encoded instructions, suggesting generative AI use.

Investigation of flirty X accounts promoting OnlyFans pages showed near-identical openers across accounts plus dynamic behaviors: answering a hexadecimal-encoded instruction with "Pineapple" and failing an exact 12-character count test in an LLM-like pattern. The accounts also sent personalized voice notes reading supplied timestamps and usernames, consistent with automated text-to-speech. Evidence suggests a hybrid scripted/AI system, though no model, provider, or operator was identified.

Malwarebytes Labs·Sep 7, 11:18 UTC · 9d agoAI safety & security

Fashion app Daydream uses Apple Intelligence to help you shop the outfits in your camera roll

Fashion app Daydream uses iOS 27 Apple Intelligence APIs to turn saved outfit photos into shoppable matches and enable Siri voice search.

Daydream launched photo-based outfit shopping and Siri natural-language search built on Apple's iOS 27 developer tools, matching images against roughly 3 million products from 325+ retailers and 10,000 brands. The app claims over 1.5 million shoppers and frames the features as steps toward a cross-surface shopping agent. Competitors include Google, Amazon, Onton, and Alta.

TechCrunch · AI·Sep 14, 17:00 UTC · 2d agoAI industry