llm 0.37.2 fixes accidental OpenAI API key disclosure
A key could be sent if api_key_name was never stored, or a responses model ran with chat completions forced.
Stories per day · 30 days
23 RSS
Relatedsupply-chain9ai-agents8inference7php7google6claude5deepseek5github5mcp5vulnerability-disclosure5agents4android4anthropic4benchmarks4coding-agents4litellm4llm-agents4openai4
372 stories, newest first · one card per story
Stories tagged #open-source
Pomerado launches MCP that turns websites into agent APIs
The YC F26 startup says hosted, self-healing integrations beat browser agents on speed and cost, with sign-in and 2FA handled for you.
Glasswing logs 37,966 findings but only 217 fixes in seven months
Only two of 442 tracked CVEs were exploited, while duplicates and withdrawals far outnumber the 217 marked fixes.
Git maintenance releases fix six flaws back to v2.27.0
Fixed builds run from v2.50.2 through v2.56.1; older than v2.50 stay affected but unmaintained.
pappl-retrofit directory traversal in PPD actions (CVE-2026-123747)
The flaw affects add-ppdfiles and delete-ppdfiles, with a fix planned for a release soon after the advisory.
Threat actors adopt open-source Artex AI pentest framework
The creator deleted the GitHub repository in late October after abuse, but forks still support credential and cloud attacks.
Zyphra releases ZONOS3-Mini, open-source TTS with 100M parameters
The fetched page is only a cookie notice, so license, languages, and availability are not confirmed.
Study traces CVE-linked vulnerable code copied across projects
Using SQVDT on NVD data, the authors report copy-paste reuse of high-severity patterns inside and between projects.
Hugging Face exec warns attacks may force open AI platforms to tighten access
Solaiman cited OpenCode API-key theft, an agent swarm on Hugging Face, and a Fireworks customer-data incident.
1
Researcher finds serious flaws in public UK government code
A Planning Inspectorate GitHub commit left Microsoft Entra ID credentials that could have reached SharePoint, OneDrive and legal-hold files.
1
Zebkit enables embedding Chromium as a library
Zebkit is a project that allows Chromium to be used as an embeddable library.
WaveGen generates speech waveforms end to end without external codecs
Scaled from 0.1B to 0.6B parameters, it reports a 1.47 word error rate and 0.75 similarity on Seed-en.
Reason Machines Open-Sources Aspen, a Git Server Built for AI Agents
Open-source Git server Aspen scales per-branch pushes using PostgreSQL and stored packs for AI agent traffic.
0sec Labs open-sources 0, an AI security harness
The MIT or Apache-2.0 research preview uses a bring-your-own model and self-reports 93 of 95 XBOW solves.
Wirken open-source AI agent gateway released
It limits compromised AI agents by running them in separate processes with approval for actions
Google AI Releases Elephant-Goldfish Model Plugin for Spec-First Coding
The plugin lets coding agents draft specs with zero-context Goldfish subagents before any code is written.
Nous Research releases Arete-27B with reduced propaganda
Post-trained Qwen3.8-27B to improve fact recall and eliminate propaganda in politically sensitive topics.
1
Developer retires Claude Code for Pi
Author switches from Claude Code to Pi citing IDE integration limits, bloated prompts and unstable updates.
Curl adopts public disclosure for low and medium vulnerabilities
Open source projects should follow Curl's example and report low and medium severity issues publicly to reduce volunteer workload.
WorldFoundry catalogs 270 models for world-model evaluation
The open-source stack also lists 74 benchmarks and 62 metrics, separating execution evidence from scores.
Buoyant releases Kinference open-source inference control plane for Kubernetes and vLLM
Buoyant has released Kinference, an open source inference control plane for Kubernetes and vLLM.
1
inMusic embraces modding with open-source MPC Sample Key
inMusic CEO says toolbox includes SDKs and reset buttons to enable safe modding of samplers like MPC Sample Key.
NVIDIA Open Sources Tools to Accelerate 6G Research
NVIDIA AI Aerial and Sionna tools have seen 10x adoption growth with over 8,000 institutions using them for 6G development.
InstantHMR recovers 3D human meshes in real time on phones
A Galaxy S23 NPU produces a 6,890-vertex mesh in 5.5 ms, with 40.0 mm PA-MPJPE on 3DPW.