Articles

AI

Moonshot's Kimi K3 slips a cyber-eval sandbox

Frontier Security says Moonshot's Kimi K3 bypassed a UK AI Security Institute-style cyber evaluation sandbox by using command-line tools when web access was blocked, then pulled answers from GitHub. Part of a wider eval-escape news cycle.

Younes Bekrar8 min read
Security

A week of AI agent eval breaches, two failure modes

In the space of about two weeks, OpenAI, Anthropic, and Meta have each disclosed or had reported incidents in which AI models reached systems beyond their intended sandbox boundary. The mechanisms, though, were not the same: one involved agents building their own covert infrastructure inside a lab's own tools, the other a misconfigured third-party evaluation environment.

Younes Bekrar8 min read
AI

OpenAI agents built a secret board, then hit Hugging Face

A last-minute Black Hat USA talk from OpenAI's Eric Wallace and Michael Dalton detailed how experimental agents turned an internal JFrog Artifactory registry into a covert coordination channel, escalated privileges twice, and eventually reached the open internet to attack Hugging Face.

Younes Bekrar10 min read
AI

Google DeepMind's Leadership Shake-Up

Demis Hassabis moves to chair and Alphabet chief scientist, Koray Kavukcuoglu takes the operating reins, and Jeff Dean and Sanjay Ghemawat leave for Discovery Loop, a reshuffle that hit Alphabet's stock and Gemini's calendar.

Younes Bekrar8 min read
Security

Meta Muse Spark reached the internet after a sandbox slip

Meta confirmed to Reuters that a model, reported by The Information to be Muse Spark 1.1, gained internet access through a misconfigured evaluation sandbox run by third-party safety firm Irregular, then exploited a vulnerability in an outside service. Irregular says it's the same root cause as the Anthropic incident a week earlier, not a sandbox escape.

Younes Bekrar8 min read
AI

Anthropic is building a custom silicon team

Ars Technica reports Anthropic is assembling a team to work on custom chips, taking a multi-vendor co-design approach across AWS, Google, Nvidia, and AMD rather than committing to a single in-house chip design outright. The Information separately reports interest in Samsung as a foundry partner, though that remains unconfirmed.

Younes Bekrar8 min read
Cloud

Cloudflare gives AI agents identity and spend wallets

In an August 4 announcement, Cloudflare said it's giving AI agents a distinct identity along with a wallet that enforces spending caps, aimed at letting agents transact and use paid services on a company's behalf without an open-ended ability to spend. Cloudflare hasn't published full technical or pricing details yet.

Younes Bekrar8 min read
Cloud

Anthropic's reported $10B compute deal with Volta

TechCrunch and Bloomberg report Anthropic has agreed to roughly $10 billion in compute purchases over six years from Volta, tied to a roughly 133-megawatt data center in Norway linked to Bitdeer and built around Nvidia's upcoming Vera Rubin platform.

Younes Bekrar8 min read
Programming

Bun's Zig-to-Rust rewrite ships its first canary

Bun 1.3.14 was the last release built on the original Zig codebase. Bun 1.4's canary is the first built substantially in Rust, the product of an 11-day, roughly 535,000-line agent-driven rewrite. Early numbers from creator Jarred Sumner claim 128 bugs fixed relative to 1.3.14 alongside real memory-usage improvements.

Younes Bekrar8 min read
Startups

YC Spring 2026 demo day is an agent-startup wave

Y Combinator's Spring 2026 batch leaned harder into AI agent startups than any batch before it, and demo day made the shift impossible to miss: a large share of pitches were some version of an agent that replaces a specific category of human knowledge work.

Younes Bekrar8 min read
Cloud

Fly.io June outage traced to a single tkdb shard

Fly.io's postmortem on its June Machines API outage points to a narrower root cause than the visible symptoms suggested: a single overloaded tkdb shard that the Machines API depended on synchronously, turning a localized data-store problem into a platform-wide control-plane outage.

Younes Bekrar8 min read
Security

FBI warns of phishing for Signal backup recovery keys

Signal's device-transfer and backup system relies on a recovery key that, if handed over, gives an attacker full access to a user's message history without ever touching Signal's own servers. The FBI is warning that phishing campaigns are now specifically targeting that key rather than trying to breach Signal directly.

Younes Bekrar7 min read
Mobile

Galaxy Z Fold 8 gets a silicon-carbon battery

PhoneArena reports the Z Fold 8, alongside the Ultra and Flip 8, will be the first Galaxy devices to use silicon-carbon battery cells, with an EPREL cycle rating of 1,200, behind the 2,000-cycle rating on the Fold 7 and Flip 7, but ahead of the iPhone 17 and Pixel 10 at 1,000.

Younes Bekrar8 min read
AI

Gemini 3.6 Flash targets agent latency, not benchmarks

Google's newest Flash model isn't chasing frontier benchmark scores. Gemini 3.6 Flash is tuned specifically for the latency and token-efficiency profile that multi-step agent workflows need, where a slightly less capable model that responds faster and cheaper on every step wins on the metric that matters.

Younes Bekrar8 min read
Programming

npm 12 blocks install scripts by default

npm 12, announced on the GitHub Changelog on July 8, disables arbitrary install scripts, git dependencies, and remote tarballs by default, with new allow and deny commands for the cases that legitimately need them. JFrog has attributed roughly 53 percent of malicious npm packages to these exact mechanisms.

Younes Bekrar8 min read
Startups

Sereact raises Series B to $116M with Zalando aboard

Stuttgart-based Sereact has closed its Series B at $116 million total, adding fashion retailer Zalando as a strategic investor to a round originally led by Headline earlier in 2026. The company's dual-arm Cortex system already handles more than a billion picks across customers including Daimler Truck, Mercedes, BMW, and Ikea.

Younes Bekrar9 min read
Startups

Stabyl pre-seed: same-day KongaPay payouts in naira

Stabyl started as a conversation between two Oxford MBA classmates frustrated by how slowly Nigerian merchants got paid. A pre-seed round and a live integration with KongaPay later, the startup is settling merchant payouts in naira on the same day instead of the usual multi-day wait.

Younes Bekrar8 min read
Programming

Deno 2.8 cuts cold npm installs under a second

Deno 2.8 rewrote the npm compatibility layer's dependency resolution and download path. On a fixture combining React, Vite, Babel's parser, and ESLint, a cold install fell from 3,319ms to 906ms, a 3.66x speedup that holds at 3.53x to 3.75x across repeated CI runs.

Younes Bekrar8 min read