Yesterday and today brought a short list: two OpenAI policy-and-safety posts (an updated Model Spec and an explanation of how frontier-model misalignment is detected), a serious supply-chain incident where a tampered Claude Code VS Code extension appeared in Cursor’s marketplace, plus a pair of engineering posts from Meta and Armin Ronacher. On the non-AI side there is a 9.8-CVSS Linux kernel TCP bug with fresh research, a massive Binance breach, and a GitHub supply-chain campaign that abused issues on 61 repos.
From the labs
- An updated Model Spec for more capable and beneficial AI — OpenAI
- How we detect frontier model misalignment — OpenAI
Worth your time
- Security notice — malicious version of Anthropic.claude-code (2.1.312 and 2.1.313) identified in the Cursor VS Code Extension Marketplace — Cursor (+ The Hacker News, The Register)
- Catching Bugs Before They Land: JiTTesting’s Human-on-the-Loop Approach at Full Scale — Meta Engineering
- Custom Voices With Qwen3-TTS — Armin Ronacher
Beyond AI
- Linux Kernel TCP/IPv4 Use-After-Free — Kudelski Security (+ The Hacker News)
- Binance Suffers Security Breach Affecting $6.3 Billion in Assets, Nearly $3 Billion Frozen — The Hacker News (+ Risky Business)
- Attackers turn GitHub issues into supply chain campaign against 61 public repos in less than an hour — The Register