AI Agents Now Find Zero-Days - And Steal Credentials

Did AI just become a zero-day discovery machine?

• Attack surface reduction - the new paradigm of using AI to shrink code reachability so attacks are harder regardless of specific bugs. Proactive systemic hardening, not patch-and-pray.

• EpiSEM-Bench - a new benchmark exposing how LLM agents take unsafe actions when tool responses are missing safety-critical evidence. The failure mode isn't hallucination, it's *incomplete information*.

• PyTorch autograd malware - researchers demonstrated Turing-complete malware running in PyTorch's *backward pass*. Your training loop is now an attack surface.

• Claude-Red and Cloudflare's security-audit-skill - offensive/defensive agent tooling rising fast as AI red-teaming goes mainstream.

We built AI that can find zero-days in Firefox and prove correctness in RISC-V assembly in the same week. The question is no longer whether AI can break software - it's whether defense can scale as fast as offense.

Which AI coding tools shipped breaking changes today?

• OpenAI Codex rust-v0.165.0-alpha.1 - alpha focused on internal testing, with the Guardian safety subsystem being reworked: v2 async classification, message limits during transcript prep, simplified logic.

• Gemini CLI v0.67.0-nightly - AST-aware file handling, zero-dependency sandboxing, token efficiency work.

• OpenCode - cost tracking, Go allowance visibility, trusted folder validation, and community-driven exploit response.

• Pi - streaming reliability, proxy robustness, UTF-8 integrity, and a TUI O(n²) parsing fix.

• Qwen Code - managed agent architecture with Kubernetes readiness, daemon token persistence, CI/CD automation.

• Claude Code Skills ecosystem - top community skills include proofcore-contract-auditor (static analysis for Solidity/Rust with TON Blockchain-anchored Merkle proofs), md2video-audio, notion-spec-to-implementation, plus meta-skills skill-quality-analyzer and skill-security-analyzer for ecosystem hygiene.

How bad is the litellm supply chain attack?

What's new in local inference and small models?

• Ollama v0.40.11-rc0 - tool call fidelity, OpenCode context fixes, experimental Apple Foundation Models runner for macOS 27+, Phonon voice improvements.

• Unsloth v0.1.910-beta - desktop installer, fine-tuning API, Flows visual node-based agent workflow editor, exclusive local GGUF for Flint, MOSS-Image, and Nemotron Bolt 4B.

• DeepInfer - DeepSeek's open-source inference framework, up to 3x efficiency on DeepSeek models with low-latency GPU-optimized deployment.

• Mercury 3 - diffusion LLM scaled 40x without slowdown. Real-time high-throughput inference is no longer theoretical.

• VoxCPM - OpenBMB's tokenizer-free multilingual TTS with creative voice design. Breakthrough for voice cloning and accessibility.

• Voxtral 3 - Mistral's speech family for transcription, TTS, and agents with low-latency multilingual support.

• Timestral - Mistral's new time-series foundation models for finance, IoT, and infrastructure forecasting.

• Kimi K3.1 Pro and K3.1 Pro Highspeed - Moonshot pushing SOTA on reasoning and speed. Kimi-K3 accuracy regression fixed in vLLM with stable ROCm/Hopper support.

Is inference infrastructure getting more programmable?

• vLLM - ROCm/Blackwell fixes, Triton-based speculative decoding draft budget (6x host cost reduction), Dory1.0-4B-BF16 (NVIDIA-Nemotron-Labs latent-recurrent) support. Watch the unresolved indexer_budget prompt truncation on GB10 and bug #62776 affecting Qwen3.8-Flash-Next.

• SGLang - initial Cambricon MLU support (device management, CNCL comms, RMSNorm kernels), T-Head SAIL and Ascend NPU roadmap, DeepSeek-V4/V4.1 kernel optimizations (Engram row reading, MegaMoE, vectorized paged KV dequantization). CI instability and spec-decoding+NVFP4 crashes persist.

• Qwen3.8-Flash-Next - supported across vLLM, SGLang, llama.cpp with GB10 (DGX Spark) and MI355X optimizations.

• DeepSeek-V4-Flash - SGLang priority kernel tuning; vLLM adds SM8x/Ampere support and mono-decode kernels for V4-Pro on MI355X.

What's happening in the personal agent framework wars?

• Hermes Agent v0.22.5 - patch consolidating ~81 merged PRs on session resilience, streaming reliability, plugin stability across CLI, Docker, Microsoft Store, Hermes Cloud. Also proposed a doc-chain substrate network RFC for permanent, auditable agent memory with read, governance, and compaction.

• QwenPaw - plugin-modular framework with a v2.3.0 plugin refactor roadmap; active work on session wedge, media payload, Windows/QQ channel issues.

• ZeroClaw - security-first enterprise platform in critical pre-release hardening: OIDC-first access model, scoped dashboards, MITM proxy RFCs.

• IronClaw - maintenance mode, Dependabot-only activity.

• compact-memory - proposed symbolic notation for compact agent state to avoid context bloat in long-running agents. claude-mem cuts token costs up to 95% via session history compression. Mem0 remains the memory layer of choice.

📊 Agent runtime security face-off

📊 Runtime | Approach | Standout Detail

• **NVIDIA OpenShell** — Rust runtime with kernel-level sandboxing + Z3 policy enforcement — Agents never hold API keys. **1,119 stars** on debut day.

• **ZeroClaw** — OIDC-first identity-aware access + role dashboards — Enterprise governance model, pre-release hardening.

• **GitHub Copilot CLI** — Assisted Permissions, granular gating, fallback resilience — Enabled **by default** - the new baseline expectation.

• **OpenAI Codex** — Guardian v2 async classification + inline /permissions — Ten `/presets` slots; breaking change in v0.164.0.

• **Claude Code** — Monitor tool + plugin monitors + telemetry controls — Sessions now run **45+ min** autonomously.

⚡ Quick Bites

• NVIDIA/OpenShell - secure, private, auditable Rust runtime for autonomous agent fleets. 1,119 stars day one. This is the execution layer enterprises have been waiting for.

• Claude + Google Workspace - Claude now integrates with Docs, Sheets, and Slides. A major usability and interoperability leap.

• Microsoft - claims its diagnostic AI outperforms doctors by 2x+ at detecting diseases from scans. Clinical validation and bias questions incoming.

• Project Vend phase two - Sonnet 4.5 and 4.6 upgraded to test whether AI agents can sustain complex real-world business logic after phase one failures.

• Robot exposure index - 75% of US physical tasks exposed to robot automation; 80% of all job tasks exposed to robots or LLMs. Paired with the new economic primitives framework (autonomy, success rate, purpose).

• AI worldview bias - all major AI models converge on depicting humans as irrational and *amoral*. Systemic alignment concern.

• AI enterprise IT spending - AI now consumes ~20% of company IT budgets. ROI debate is officially mainstream.

• EU AI data legislation - member states approved measures critics call *digital expropriation*, potentially letting AI companies train on Europeans' public data without consent.

• VERA - dashboard translating EU AI Act requirements into actionable metrics across six core principles.

• SpectralCanary - frequency-based watermarking to audit whether T2I models were fine-tuned on specific datasets. Copyright and data governance tooling.

• Gemma OS - on-device Gemma detected all 10 hidden emergencies in local notifications. Private real-time threat detection without cloud.

• diffium-db - TUI showing live diffs of every database change AI agents make. Catches silent data drift.

• LLM determinism at temperature 0 - deterministic seeding does *not* guarantee consistent outputs across models. Critical debugging issue.

• RAG claim verification - forcing RAG to cite evidence and distinguish correct answers from confident lies at 15M-document scale.

• Unikernels in OCaml - minimal, high-assurance OS kernels for secure low-footprint systems.

• A Fix for Softmax and Cross-Entropy - two numerical bugs (Softmax Collapse, Cancelation) bias gradients and degrade training stability. Corrected formulations provided.

• Causal Chain of Thought - context isolation to mitigate attention leakage in CoT prompting for more causally valid reasoning traces.

• Direct Pass@$k$ Optimization for Thought Pruning - test-time pruning of candidate reasoning paths balancing quality and diversity.

• METTA - external memory integrated into meta-RL for long-horizon adaptation from minimal interaction.

• BeNice! - KV-cache sharing across looped transformer iterations solves the memory bottleneck with linear memory growth.

• Rethinking Sequence Compression with Test-time Regression - beats pooling and projection for efficient multimodal models.

• Phase Transition from Random Features to Fully Trainable Networks - sharp accuracy transition guiding efficient approximator design.

• Low-Bit N-Gram Embeddings - up to 80% memory reduction for edge LLM deployment.

• DuoCook - Overcooked-inspired benchmark for VLM collaborative planning and resource allocation.

• FairFRESH - neuro-symbolic fair, explainable household food recommendations.

• Agent-Reach - zero-API-cost access to Twitter, Reddit, GitHub live data for agents.

• Firecrawl - structured web data extraction at scale for real-time agent intelligence.

• Crawl4AI - any site to clean LLM-ready Markdown for RAG ingestion.

• LangChain / LangChain4j - enterprise agentic workflow backbone, with idiomatic Java bridging.

• RAGFlow - open-source RAG engine fusing agent logic with retrieval.

• Ultralytics - YOLO-based CV still dominating detection, segmentation, tracking deployment.

• nanobot (HKUDS) - ultra-lightweight self-hosted personal agent with WebUI, memory, multi-agent workflows.

• Vibe-Trading (HKUDS) - personal trading agent that analyzes markets and executes strategies autonomously.

• career-ops - AI job search agent scoring jobs, tailoring resumes, automating applications.

• CowAgent - multi-model, multi-channel assistant with self-evolution via memory, one-line install.

• Codewhale - terminal-native Rust agent, fast and LLM-provider agnostic, aimed at DevOps.

• daily_stock_analysis - LLM stock analysis with real-time news, dashboards, automated alerts.

• ppt-master - native PowerPoint decks with animations, charts, audio narration from documents.

• Cherry Studio - 300+ assistants with unified frontier model access.

• tiny-llm - educational tiny vLLM + Qwen on Apple Silicon for edge inference learning.

• Omnara - open-source, self-hosted modular agent alternative to Claude Managed Agents.

• DeepCell - automates time-sensitive office tasks with contextual triaging.

• Claude Duet - proactive agent predicting urgency before tasks become bottlenecks.

• Bits - open-source personal agent with task execution, API integration, memory.

• heal.dev - detects subtle bugs and vulnerabilities missed by human review and linters.

• Kugel Ear - speech-to-text that defers to users only when confidence is low.

• Resend Inboxes - shared inboxes with connected AI agents for team email.

• Doneas - AI daily accountability calls for entrepreneurs.

• Causo - lead discovery via AI research + MCP beyond CRM filters.

• Playad - deployable AI marketing team agents for campaigns and analytics.

• CutBay - AI video agent generating video from prompts or documents via chat-first multimodal.

• Voxelo 3.0 - phone video to photoreal 3D models + JSON-LD metadata in under an hour.

• OpenAI - two metadata-only posts: *Scaling Storage to One Billion Users Part Two* and *Securing Our Frontier Model Training Environment*. Infrastructure scaling + security hardening signals.

• Anthropic - 86 articles covering cybersecurity research, OSS Scanner, national security partnerships. Positioning as trusted steward of AI safety.

• agents-radar - auto-generated this AI open source trends digest.

❓ FAQ: Today's AI News Explained

• Q: Can AI models really find zero-day vulnerabilities now? - Yes. Claude Opus 4.6 autonomously discovered high-severity zero-days and wrote working exploits, including CVE-2026-2796 against Firefox, without task-specific tooling. GLM-5.3 matched this capability, and SCONE-bench showed models found $4.6M in deployed smart contract exploits.

• Q: Is litellm safe to use after the backdoor? - Avoid litellm==1.107.0 entirely - it contained a credential-stealing backdoor (`cook.pth` + `sitecustomize` RCE loader). The PyPI package and Docker images have been yanked. Rotate any credentials that may have been exposed and pin to a verified clean version.

• Q: What is NVIDIA OpenShell? - A new open-source, Rust-based runtime for autonomous AI agents with kernel-level sandboxing and Z3-powered policy enforcement so agents never hold API keys. It gained 1,119 stars on debut day and is positioned as the secure execution layer for enterprise agent fleets.

• Q: What broke in OpenClaw 2026.10.1 and 2026.10.2? - Windows startup time ballooned from ~410s to ~1030s with `sidecars.control-ui-assets` blocking 477s, and the gateway takes 7-9 minutes to become ready. Latest stable is 2026.9.6 - do not upgrade on Windows.

• Q: What's new in OpenAI Codex rust-v0.164.0? - A breaking change introducing ten numbered `/presets` slots for reusable prompts plus inline `/model` and `/permissions` configuration in chat. The Guardian safety subsystem is also being reworked with v2 async classification.

• Q: Which local models should I care about this week? - Nemotron 3.5 Bolt E4B (NVIDIA Gemma 4-based, 128K context VLM, Ollama-exclusive), VoxCPM (tokenizer-free multilingual TTS), Voxtral 3 (Mistral speech), Timestral (Mistral time-series), and Kimi K3.1 Pro for reasoning. llama.cpp also shipped five new JQ2_K-JQ6_K quant types.

🔮 Editor's Take: The industry just got the AI security bargain it asked for - models that find zero-days in Firefox *and* prove correctness in RISC-V assembly. But litellm==1.107.0 is the real headline: we're bolting frontier capability onto a supply chain that can't keep `sitecustomize` out of a PyPI release. Fix the boring layer before you celebrate the smart one.