The Cuong-verse
The Cuong-verse
Daily Digest

AI Agents Are Breaking Everything - And Finding Zero-Days

Tags
ai-agents
security
zero-days
open-weights
inference
AI summary
Published
November 1, 2026
Author
cuong.day Smart Digest
Can AI Really Find Zero-Days Better Than Humans?Why Are Agent Tools Shipping So Many Critical Flaws?What's Happening With Agent Memory and Cross-Agent Context?Which Inference Backends Are Winning the Performance War?๐Ÿ“Š Backend | Key Update | StatusWhat Models Shipped and What Do They Mean?What's the State of Agent Tooling and CLI Wars?What Enterprise and Policy Shifts Matter Today?โšก Quick Bitesโ“ FAQ: Today's AI News Explained
โšก
TLDR: Anthropic's internal research model found 5 high-severity exploit chains in Chrome, Safari, Android and Linux - including one-click and zero-click RCE. Meanwhile the agent ecosystem is shipping its own critical flaws: a Claude Code VS Code backdoor, Hermes auto-deleting 188K files, and OpenClaw's P0 data loss. AI just became both the best attacker and the sloppiest defender.
Today's news has a weird symmetry. On one side, an unreleased Anthropic research model is doing coordinated vulnerability disclosure on Chrome, Safari, Android and Linux with 90-day patch windows - the kind of work that used to take elite human teams months. On the other side, the tools we're all *building* with are leaking API keys in startup logs, auto-approving destructive PowerShell, and silently dropping curated memory files. If you're shipping agents this quarter, the threat model just changed on both ends.

Can AI Really Find Zero-Days Better Than Humans?

This is the story of the day. Anthropic's Internal Research Model - unreleased, not publicly available - discovered five high-severity exploit chains across Chrome, Safari, Android, and Linux. One of them is a one-click RCE, another is zero-click. That's not a demo, that's real-world exploitability against the software a billion people use daily.
๐Ÿšจ
Coordinated Vulnerability Disclosure (CVD) is now formalized for AI-found bugs with 90-day patch windows. This is the moment AI vulnerability research became a regulated discipline, not a science fair project.
The interesting counterpoint came from the research community: Fuzzilli, the human-designed JavaScript engine fuzzer, still outperformed AI-driven approaches like BigSleep at finding *novel* bugs in JS engines. So the story isn't 'AI replaces security researchers' - it's 'AI finds a different class of bugs, faster, at scale.' Both are true.
  • 5 exploit chains found across Chrome, Safari, Android, Linux - including one-click and zero-click RCE.
  • 90-day CVD windows now standard for AI-discovered vulnerabilities - a new industry norm.
  • Fuzzilli still wins on novel JS engine bugs - traditional fuzzing isn't dead.
  • Volta infostealer now uses LLMs to rank victims by monetary value - AI-driven cybercrime is here.
  • ChatGPT account takeover vulnerability disclosed in OpenAI's platform - the attack surface includes the AI tools themselves.

Why Are Agent Tools Shipping So Many Critical Flaws?

Here's the uncomfortable pattern: the more autonomous we make these tools, the more spectacular the failure modes. Hermes Agent Issue #147373 is the poster child - its 'smart approval' system auto-approved a destructive PowerShell command that deleted 188,000+ files. That's not a bug, that's a design philosophy meeting reality.
๐Ÿ’€
Claude Code VS Code extension backdoored on Cursor Marketplace. Supply chain attacks are now targeting the AI tooling layer directly. If you installed from Cursor Marketplace recently, audit now.
OpenClaw - the most active project in the ecosystem with 500 issues and 500 PRs updated in 24h - is having a rough week. Two P0s: Issue #160959 (crash-loop regression from 2026.9.6 blocking gateway startup for minutes during plugin capture) and Issue #153426 (silent data loss where curated MEMORY.md gets permanently excluded after provenance trust loss with *no recovery path*). Latest stable 2026.10.8 has multiple critical regressions across Windows, macOS, and Linux.
  • Hermes #147373 - smart approval auto-executed destructive PowerShell, 188K+ files deleted. No undo.
  • Claude Code VS Code backdoor on Cursor Marketplace - supply chain attack on the tooling layer.
  • OpenClaw #153426 - curated MEMORY.md permanently excluded after provenance trust loss, no recovery path.
  • OpenClaw #160959 - P0 crash-loop blocking gateway startup for minutes during plugin capture.
  • OpenClaw #177656 - native host exec returns integrity error without child result, 28+ stable installs affected.
  • SGLang #37457 - startup logs expose API keys in resolved server arguments. Production risk.
  • LiteLLM admin key bypass - budget enforcement bypass via admin key policies flagged for immediate audit.
  • Fable 5 - safeguard system falsely blocked its own security fix with a silent model downgrade. Guardrail false-positives are real.

What's Happening With Agent Memory and Cross-Agent Context?

The 'how do agents remember things' problem is getting real money and real code. thedotmack/claude-mem (107,899 stars) provides persistent context storage across sessions using AI compression and works with Claude Code, Copilot, and Gemini. affaan-m/ECC (294,084 stars) is the fastest-growing 'performance layer' for coding agents, optimizing memory, security, and research across Claude Code, Copilot, Cursor, and OpenCode.
But the more interesting story is cross-agent interoperability. recall is a zero-dependency tool letting Codex inherit Claude Code's Markdown-based memory state. toli lets agents talk across machines. Bossanova is a local encrypted vault with MCP bridge so Codex can use API keys without exposing them in conversation history. This is the 'agent plumbing' layer forming in real-time.
๐Ÿง 
Context Anxiety is now a coined term - models self-limiting due to context window constraints. Claude Sonnet 4.5 exhibited it; Claude Opus 4.5 eliminated it. Managed Agents on the Claude Developer Platform now handles this with dynamic context resets for long-horizon autonomous work.
  • claude-mem (107,899 stars) - persistent cross-session memory via AI compression.
  • ECC (294,084 stars) - agent harness for performance, memory, security across 5+ coding tools.
  • recall - zero-dependency Codex-to-Claude-Code memory inheritance.
  • toli - free cross-machine agent communication.
  • Bossanova - local encrypted vault + MCP bridge for API keys.
  • compact-memory - pending symbolic agent state skill to reduce long-running memory bloat.
  • headroom (78,477 stars) - compresses tool outputs/logs/RAG chunks, 20-95% token reduction.
  • Sleep framework (Google Research) - new approach for LLMs to retain knowledge in continual learning.

Which Inference Backends Are Winning the Performance War?

The inference layer is where the real engineering is happening this week. vLLM shipped AMD ROCm FP8 kernels for Qwen3.8 on gfx950/Mi355X, sparse indexer optimizations, and KV offload reliability fixes. SGLang integrated NCCL 2.30 Execution Provider for low-latency MoE all-to-all decode - but is also hitting CUDA coredumps and pipeline-parallel decode garbage output.
llama.cpp is on a tear with releases b12018-b12024, adding IQ3_S/XXS quantization on OpenCL (for Qualcomm Adreno edge devices), Metis-1.6 hybrid Mamba-2 + GQA architecture support, and a WebGPU group norm kernel. Ollama merged critical MLX stability fixes for Apple Silicon and integrated tokencut context compression proxy.
โš ๏ธ
Speculative decoding instability is now a cross-project critical regression - llama.cpp #31472 shows divergence at temp=0. Agent reliability is becoming a core QA metric, not a nice-to-have.

๐Ÿ“Š Backend | Key Update | Status

  • **vLLM** โ€” ROCm FP8 for Qwen3.8, sparse indexing, KV offload โ€” Aggressive multi-platform push
  • **SGLang** โ€” NCCL 2.30 EP for MoE decode, api.v1 RFC โ€” Breaking changes coming, some regressions
  • **llama.cpp** โ€” b12024, IQ3_S/XXS OpenCL, Metis-1.6, WebGPU โ€” Rapid cadence, edge-focused
  • **Ollama** โ€” MLX stability, tokencut integration, LFM3-Omni leak fix โ€” Local-first, Apple Silicon wins
  • **LiteLLM** โ€” Budget enforcement, routing reliability โ€” Enterprise gateway, admin key bypass flagged
  • **Unsloth** โ€” CLI+Studio, VLM support, Ascend NPU RFC โ€” Evolving into full-stack agent platform

What Models Shipped and What Do They Mean?

Mistral Large 4 dropped open weights, reigniting the democratization-vs-misuse debate. Canva Brush is a new vision-language model for natural language design editing. And Qwenputer broke everyone's brain: a fully functioning, deterministic RISC-V CPU simulated inside Qwen3.5. That's not a metaphor - it's actual computational self-containment.
๐Ÿคฏ
Qwenputer runs a deterministic RISC-V CPU inside Qwen3.5. The line between software and hardware just got blurry. Self-contained computational environments are now a thing you can prompt.
  • Mistral Large 4 - open weights released, fueling democratization vs. misuse debate.
  • Canva Brush - VLM for natural language editing of visual designs.
  • Qwenputer - deterministic RISC-V CPU simulated inside Qwen3.5. Blurs software/hardware line.
  • Qwen3.8 series - FP8/MXFP4 variants with vLLM/SGLang/ROCm support.
  • DeepSeek-V4-Flash - partial support, blocked on vLLM SM8x (Ampere) missing fused kernels; 2-7K tok/s gap vs vLLM.
  • Gemma 4 - shipped in llama.cpp, Ollama, vLLM; FP8 quantization crash in vLLM since v0.23.0.
  • Metis-1.6 - hybrid Mamba-2 + GQA (Praxis & Logos) in llama.cpp.
  • Qwen3-VL / Kimi K2.5 - multimodal CUDA graph support in progress at vLLM.
  • VirbiusGuard - 0.6B bilingual agent safety guard, Qwen3Guard fine-tune, Apache-2.0.
  • MiniMax-M3.1-Flash - GB300 PD AgentX support via SGLang cookbook.
  • LFM3-Omni - fixed KV cache leak (2.6GB to 4.2GB bloat over 8 runs) in Ollama.
  • TabPFN - lightweight model beat SOTA on ESA satellite signal analysis (2,123 ghost signals) at fraction of LLM cost.
  • Tinker - spent 83 cents stopping an LLM from speaking for a dead satellite. Cost-effective model restraint.

What's the State of Agent Tooling and CLI Wars?

The CLI agent space is fragmenting into specialized niches. Orkas-AI/Orkas exploded with +1,044 stars today - a local-first desktop AI team with 16 specialist agents integrating Claude Code, Codex, and Hermes. ZeroClaw (NEAR AI's security-hardened orchestrator with SBPL policy enforcement) has v0.9.0 imminent with 50 PRs daily. QwenPaw (AgentScope) is fixing release blockers for v2.3.1.
Meanwhile Claude Code is having community trust issues - GitHub connector failures (#32479, #71542) and CLAUDE.md rule-ignoring regressions across Opus/Sonnet sessions. Sonnet 5.5 reportedly ignores CLAUDE.md safety rules despite them being in context. Opus 5.5 shows mid-session language drift to English despite German input. These are model state management flaws eroding developer trust.
๐Ÿ“ˆ
Orkas-AI/Orkas hit +1,044 stars today - local-first desktop AI team with 16 specialist agents. The 'agent orchestrator' category is exploding as developers want Claude Code + Codex + Hermes working together, not competing.
  • Orkas (+1,044 stars today) - 16 specialist agents, local-first, integrates Claude Code/Codex/Hermes.
  • ZeroClaw - SBPL policy enforcement, v0.9.0 imminent, RAG RFC for knowledge-grounded workflows.
  • OpenClaw - most active project (500 issues/500 PRs daily), but critical regressions in 2026.10.8.
  • Hermes Agent (259,193 stars) - mobile push, plugin ecosystem, but smart approval exploit.
  • QwenPaw - v2.3.1 fixing release blockers, Docker non-root runtime, streaming fixes.
  • Gemini CLI - nightly v0.67.0 with browser agent config and context management fixes.
  • GitHub Copilot CLI - v1.0.106-1 with line-ending fixes, entering maintenance mode.
  • OpenCode - 10 PRs in 24h on observability/scheduling/security, but IP-bucketed free-tier quota crisis.
  • Pi - community demands GUI, driving CLI+GUI hybrid trend.
  • Qwen Code - CI/CD resilience, LSP support, but no PRs despite high issue volume.
  • IronClaw (NEAR AI) - zero activity in last 24h.
  • Claude Code Skills - proofcore-contract-auditor, notion-spec-to-implementation, md2video-audio pending merge.
  • webapp-testing - security fixes (removing shell=True), better element detection, input validation.

What Enterprise and Policy Shifts Matter Today?

Anthropic is setting the research agenda with three high-impact pieces: Managed Agents (hosted long-horizon autonomous agents with version-agnostic interfaces decoupling model from tool execution), Anthropic Insights (privacy-preserving analysis tool for external researchers to access aggregate Claude usage data), and the Independent Research Pilot - the first formal program giving external researchers privacy-preserving Claude usage data.
OpenAI went the other direction with three metadata-only posts: Fair Use Benefits Everyone, Helping Websites Express AI Training Preferences, and Community Safety Report and New Protections for Teens. This is a compliance-focused policy push - signaling regulatory alignment rather than research leadership.
๐Ÿข
Cisco gave an engineer unlimited AI tokens to rewrite legacy code. The result highlights both enterprise AI transformation and skill erosion concerns. Deskilling of SREs is now a widely-supported argument - AI isn't replacing SREs, it's eroding foundational engineering expertise.
  • Managed Agents (Claude Developer Platform) - long-horizon autonomous agents, version-agnostic interfaces.
  • Anthropic Insights - privacy-preserving aggregate Claude usage data for external researchers.
  • Independent Research Pilot - first formal external researcher access program, potential industry standard.
  • OpenAI policy push - fair use, website AI training preferences, teen safety (all metadata-only).
  • Cursor Marketplace - calls for stricter vetting after Claude Code extension backdoor.
  • Cisco unlimited AI tokens - enterprise transformation vs. skill erosion case study.
  • AI Agent Guardrails - growing emphasis after agent deleted an experiment; agent versioning and runtime integrity trending.

โšก Quick Bites

  • firecrawl/firecrawl (197,419 stars) - web scraping/parsing/enrichment for feeding real-time data to LLMs and agents.
  • infiniflow/ragflow (93,267 stars) - production-grade open-source RAG engine with retrieval, agent logic, knowledge fusion.
  • HKUDS/LightRAG (40,455 stars) - EMNLP 2025 best paper, simple RAG with 97% storage savings for edge deployment.
  • langchain-ai/langchain (148,783 stars) - leading agent engineering platform for modular AI workflows.
  • huggingface/transformers (168,399 stars) - de facto standard for NLP, vision, audio, multimodal models.
  • ollama/ollama (185,479 stars) - lightweight local-first LLM runtime, cornerstone of local AI movement.
  • run-llama/llama_index (52,764 stars) - document processing for enterprise RAG pipelines.
  • rasbt/LLMs-from-scratch (107,609 stars) - educational step-by-step ChatGPT-like LLM in PyTorch.
  • open-compass/opencompass (7,559 stars) - LLM evaluation across 100+ datasets.
  • harry0703/MoneyPrinterTurbo (136,919 stars) - automated video creation from keywords via AI workflows.
  • ZhuLinsen/daily_stock_analysis (67,342 stars) - LLM-powered stock analysis with multi-source market data.
  • pangolin-ai/pangolin (64,392 stars) - no-code AI workflow builder for business automation.
  • Vaani Developer Platform - voice AI harness, led Product Hunt with 371 votes.
  • SpeakON Agent - turns natural speech into executable agent tasks.
  • Cluinn - real-time Mac transcription and AI summarization answering questions during calls.
  • fastbrowse - open-source browser agent, claimed fastest for web automation.
  • ilse - AI coding agent using visual context - point at UI, infer code changes.
  • Kestrix - repo-agnostic CI control plane with DAG-based triggers.
  • Teable Mobile - spreadsheet-like automation on mobile.
  • SparkBots AI - extraction and analysis from webpages and PDFs.
  • MCP Server by XWiki - self-hosted MCP for private wiki knowledge access.
  • sitesolide - open-source self-hosting for vibe-coded apps.
  • Faylee - context-aware AI assistance during developer workflows.
  • GhostProtocol - privacy-first BYOK inbox forensic workstation.
  • Myriad - interactive visual explainer of neural network mechanics.
  • BootGPT - experimental LM running in a boot sector for hardware-level inference.
  • SoChain MCP - UTXO blockchain skill added to Hermes Agent.
  • NeuralMind plugin - added to Hermes Agent plugin catalog.
  • MLX-Whisper - requested as first-class STT provider for Apple Silicon in Hermes.
  • Hermes #11911 - most-requested: native iOS/Android app with voice calling.
  • Hermes PR #147382 - fixed gateway delivery race condition causing duplicate messages.
  • Hermus PR #147075 - patched three redaction vulnerabilities (URL masking, argv dumps).
  • Hermes PR #131211 - opt-in delegation inheritance of SOUL.md for subagent identity.
  • OpenClaw PR #189395 - adopted Google Interactions API for Gemini Flash routing.
  • Intel Xeon CPU backend - SGLang roadmap targets Q4 2026 for cost-effective CPU deployment.
  • Huawei Ascend NPU - Unsloth RFC planned, critical for China-focused deployments.
  • AMD ROCm gfx950/Mi355X - moving from experimental to actively optimized, 2-3x speedups expected.
  • Triton FP8 attention - emerging as de facto standard for high-throughput inference (vLLM #62913).
  • tokencut - context compression proxy integrated into Ollama for long-context agent workflows.
  • MoE Offloading - retested benchmarks changed prior conclusions, stressing quantization consistency.
  • Compile-Time Dependent Types - type systems evolving at compile time for safer ML infrastructure.
  • BM25 + Vectors - hybrid retrieval combining rule-based checks with AI for robustness.
  • GPT-4o deprecation - cited as example of model drift and lifecycle management challenges.
  • DeepSeek-V3 / Qwen3 / Claude 3.5 - recent LLM releases driving demand for RAG/memory systems.
  • agents-radar - auto-generated this AI open-source trends digest from GitHub Trending and Search API.

โ“ FAQ: Today's AI News Explained

  • Q: Can AI find real zero-days now? - Yes. Anthropic's internal research model found 5 high-severity exploit chains in Chrome, Safari, Android, and Linux, including one-click and zero-click RCE. These are real, exploitable vulnerabilities now in coordinated disclosure with 90-day patch windows.
  • Q: What's the biggest security risk in AI coding tools today? - Supply chain attacks. A backdoored Claude Code VS Code extension was distributed via Cursor Marketplace. Combined with Hermes auto-approving destructive commands (188K+ files deleted) and SGLang leaking API keys in logs, the tooling layer is the new attack surface.
  • Q: Should I still use OpenClaw after the P0 bugs? - Wait for the patch. OpenClaw 2026.10.8 has multiple critical regressions including silent MEMORY.md data loss (#153426) and startup crash-loops (#160959). Latest stable is under scrutiny across Windows, macOS, and Linux. Stabilization is ongoing.
  • Q: What is Mistral Large 4 and why does it matter? - Mistral released open weights for Mistral Large 4, their flagship model. This fuels the democratization-vs-misuse debate - open weights mean anyone can fine-tune, deploy, and modify it without gatekeepers.
  • Q: Which inference backend should I pick in 2026? - vLLM for multi-platform (ROCm FP8, sparse indexing), llama.cpp for edge (IQ3_S/XXS on OpenCL, WebGPU), Ollama for local-first Apple Silicon (MLX fixes), SGLang for MoE decode (NCCL 2.30). Watch for speculative decoding instability across all.
  • Q: What is 'context anxiety' in LLMs? - A newly coined term for models self-limiting due to context window constraints, causing premature task termination. Claude Sonnet 4.5 exhibited it; Claude Opus 4.5 eliminated it. Managed Agents now handles this with dynamic context resets.
  • Q: How do agents share memory across tools? - Tools like recall (zero-dependency Codex-to-Claude-Code memory inheritance), claude-mem (107,899 stars, persistent cross-session storage), and Bossanova (encrypted vault + MCP bridge) are forming an emerging 'agent plumbing' layer for cross-agent context sharing.
๐Ÿ”ฎ Editor's Take: We spent 2025 worrying about AI taking jobs. 2026's real story is AI taking *responsibility* - and mostly fumbling it. An Anthropic model finds zero-click RCE in Chrome while a Hermes 'smart approval' system deletes 188K files because nobody thought to add an undo. The gap between what AI *can* do and what we *trust* it to do has never been wider. Close that gap with guardrails, or the next P0 is yours.