Heidelberg AI News

All stories

119 stories

Clear

Friday 30 October

  • ArticleThe Decoder

    Open-weight model GLM 5.3 built full Firefox exploit chains with zero human input in under 48 hours

    Researchers at Epoch AI report that the open-weight Chinese model GLM 5.3 autonomously built full Firefox exploit chains with no human input, exploiting the 'patch gap' between when security fixes appear in code and when they reach users. The model identified disguised security fixes, chained vulnerabilities with a previously unpublished flaw to bypass browser sandbox protections, and could read local files when a user visited a webpage. Attacks cost about $1,000 in API fees per Firefox version across six versions released Sept 17–Oct 26, taking 12 hours for the fastest and up to 48 hours. No API providers tested triggered safety guardrails. Mozilla patched the flaw in Firefox 159.0 (Oct 27). The same setup spent roughly $100,000 on Google Chrome without producing an equivalent exploit. Researchers warn the patch-gap risk spans the software industry and note untested benchmark data suggesting Kimi K3.1 Pro could outperform GLM 5.3 on offensive cyber tasks.

  • ArticleLatent Space

    [AINews] Building AIE CODE: The top Coding Agent Conference

    AINews covers three AI developments: Mistral Large 4 ('Le Chonk') shipped as an open-weights release built for agentic coding and cybersecurity, with 1.05T total and 52B active parameters, 1M context, text+image input, and pricing near $0.70/$2.10 per 1M input/output tokens; OpenAI now monitors all frontier RL runs, evaluations, and internal Codex use using activation probes, reviewer models over reasoning and tool use, and investigator agents; and Anthropic says Claude now produces a preliminary misuse assessment immediately after each response, which it says has surfaced misuse its classifiers were not designed to catch.

Thursday 29 October

  • Simon Willison

    ArticleSimon Willison

    API credits benefit for eligible ChatGPT subscriptions

    OpenAI has launched an API credits benefit for eligible ChatGPT subscriptions, mirroring a similar benefit Anthropic announced earlier for its Max and Team plans. OpenAI subscribers to its $100, $200, or $500 per month plans now receive the equivalent quantity of expiring credits to apply to one of their API organizations.

  • ArticleThe Decoder

    OpenAI doubles usage limits on Pro plans as competition with Anthropic heats up

    OpenAI is doubling usage limits across its paid plans, raising the Pro quota from 100 to 500. A planned cut to the Pro 200 quota was reversed after user pushback. More efficient models, described as Terra and Sol, are expected to push usable capacity even higher. The move comes just ahead of Anthropic's IPO, as both companies compete for B2B dominance in AI.

  • ArticleThe Decoder

    Experts adopt AI agent's random opinions and think they're their own, Anthropic study finds

    The Decoder reports on a study by Anthropic in which 50 experts were given an AI agent whose preferences were set randomly by coin toss. The experts followed the agent's opinions up to 86% of the time on judgment calls, and most believed the conclusions were their own.

  • OpenAI

    OfficialOpenAI

    An updated Model Spec for more capable and beneficial AI

    OpenAI published an updated Model Spec that outlines five core values intended to guide the development of more capable AI toward sound judgment, human agency, and faithfulness to human intent.

  • Latent Space

    ArticleLatent Space

    Can Frontier Models See Past a Decoy? Elorian Tests Visual Reasoning

    Elorian, which emerged from stealth in April with $55 million in seed funding co-led by Striker Venture Partners, Menlo Ventures and Altimeter Capital, launched its first visual reasoning model, Glimpse, described as a 'visual thinking model' that reasons about the physical world from what it sees. In partnership with AI data company Mercor, Elorian co-released DecoyCount, a benchmark testing whether models genuinely count objects or rely on visual shortcuts and substitution heuristics. According to a paper accompanying the release, frontier models scored below 50% accuracy, with GPT-6 Astra highest at 43.17%. CEO Andrew Dai said Glimpse scored 50.48% on 1,660 DecoyCount items in an internal test, making it the only model to clear 50%, though he noted the result came from a single run versus the frontier models' three-run averages. Dai, a former Google DeepMind researcher on GLaM MoE, PaLM 2 and Gemini, said the model uses visual thinking—generating and editing images as part of the reasoning trace—and distinguished Elorian's 'indirect action' approach from world models like World Labs' Atlas and Google's Genie 4.

  • ArticleThe Decoder

    Paris-based Mistral releases "Le Chonk," a strong coding model that still trails China overall

    Mistral has released the weights for Mistral Large 4, nicknamed "Le Chonk," a model of about one trillion parameters (52 billion active) trained entirely in Europe and distributed under a modified MIT license that allows running it on own hardware. Independent testing by Artificial Analysis rates it 26 points on its Intelligence Index, behind open Chinese models such as DeepSeek V4.1 Flash and GLM-5.3 (32 points) and far behind the leading systems from Anthropic and Google. Mistral says it leads open models on coding, and independent benchmarks show it is fast (161 tokens per second) and cheap, but it trails Claude Opus 5.5 on coding indexes and ranks third among open models on cyber defense. Mistral cut the API price from $1.36/$4.18 to $0.70/$2.10 per million input/output tokens, and the model is available on Microsoft Foundry.

  • Simon Willison

    ArticleSimon Willison

    Quoting Ben Hylak

    Ben Hylak is quoted saying that every product he uses should be a headless MCP that feeds into an agent, so he never has to think about anything underneath, except his own product, which keeps a UI that customers love.

  • ArticleThe Decoder

    OpenAI's Astra becomes the main target for Chinese AI labs after Anthropic tightens its defenses

    According to The Information, Chinese AI labs are now mainly tapping OpenAI's most powerful model, GPT-6 Astra, instead of Anthropic's Claude, to distill outputs for training their latest models. DeepSeek and Moonshot AI reportedly leaned heavily on Astra, including for Kimi K3.1 Pro and V4.1-Flash 1017. This kind of distillation requires the models to reveal their hidden reasoning steps, which OpenAI and Anthropic both ban. Claude used to be the go-to target, but Anthropic has tightened its defenses, saying its new methods cut the amount of data attackers can pull by 90 to 99 percent. In late September, OpenAI reported a coordinated distillation campaign it says involved people linked to Moonshot. Moonshot declined to comment and DeepSeek did not respond to a request for comment.

  • OfficialDocker

    Coding Agent Horror Stories: The CVE That Did Not Exist

    An official Docker video describes a case in which an AI code review agent invented a CVE that did not exist and recommended dangerous fixes. It explains how Docker Sandboxes contain agents and why their output needs verification.

  • Mistral AI

    OfficialMistral AI

    Le Chonk: Built for Coders, Trusted by Defenders.

    Mistral AI has opened the weights of Mistral Large 4 (Le Chonk), a 1 trillion parameter multimodal model described as the best open-weight model for coding, trained in Europe.

  • ArticleThe Decoder

    Google's AI search problem finally shows up in the earnings report, some investors believe

    Google's stock dropped as much as ten percent after its quarterly earnings report. Cloud revenue more than doubled to $30.7 billion, but search revenue grew just 12 percent, slower than expected. Google acknowledged that its fast-growing AI mode brings in less revenue than traditional search, and it is now expanding its AI mode ad program internationally.

  • OpenAI

    OfficialOpenAI

    How Ropes & Gray is developing AI for transactional diligence

    Ropes & Gray is developing AI for transactional diligence in partnership with OpenAI. In this workflow, lawyers review grouped documents, summaries, and reports before advising their clients.

  • ArticleLatent Space

    [AINews] Gemini 4 Carbon tops leaderboards, launches for cyber defenders

    Google has launched its new frontier model, Gemini 4 Carbon, which leads independent evaluations and tops leaderboards. Access to the model is initially limited to trusted cyber defenders.

Wednesday 28 October

  • ArticleLatent Space

    Why Agents Love Supabase

    In a Latent Space podcast episode, Supabase founders Paul Copplestone and Ant Wilson discuss the company's Select announcements, grouped into Build, Operate, and Scale. Build features include a new alpha runtime for running Supabase locally without Docker, declarative database schemas kept in Git that an agent can read, change and fork, and Supabase Compute to run workloads beside the database. Operate adds logs, checks, connections and context to help an agent understand what it is changing. Scale covers OrioleDB, Multigres and the Turso acquisition behind a 'prototype to petabyte' positioning, as Supabase launches about five million databases a month. The founders say AI-driven agent usage improved activation and conversion because an agent can carry a user from signup to a working setup in one flow.

  • ArticleThe Decoder

    Google Deepmind releases Gemini 4 Carbon just two weeks after Argon with gains across the board

    Two weeks after releasing Gemini 4 Argon, Google DeepMind has launched Gemini 4 Carbon, a new AI model that tops the Artificial Analysis Intelligence Index v5 with 59 points. Google says the model is built for extended agent workflows and the full cyber defense lifecycle. Because of its advanced security capabilities, initial access is limited to selected security experts.

  • ArticleThe Decoder

    Google opens Android development to third-party AI agents and unveils new Gemini APIs

    Google is opening Android Studio to third-party AI agents through a new "Bring Your Own Agent" feature that supports more than 40 coding agents, including Anthropic's Claude Agent and OpenAI's Codex. Google says new terminal tools help agents complete UI tasks 77% faster while using up to three times fewer tokens, and Android development is becoming agent-centric. Google also unveiled new Gemini APIs.

  • Simon Willison

    ArticleSimon Willison

    GitHub Octoverse 2026

    GitHub's Octoverse 2026 report, announced at GitHub Universe by EVP Jay Parikh, shows developers now merge 220M pull requests per month, make 7.38B commits per month, and create 30.3M new repositories per month, with growth attributed to developers building with AI agents.

  • OfficialGitHub

    Route and orchestrate models with GitHub Copilot Fusion

    GitHub Copilot Fusion is now generally available. Instead of selecting a model for each individual task, users can choose Copilot Fusion, which intelligently routes and orchestrates which models it uses for them.

  • OfficialGitHub

    GitHub Copilot app, Universe releases

    GitHub released the GitHub Copilot app and Universe features that let work extend beyond a single repository or session. A feature can span several repositories, and a launch plan can pull in specs, designs, and assets without touching a repository.

  • OfficialGitHub

    GitHub Enterprise now includes access to GitHub Copilot

    GitHub now includes GitHub Copilot access with GitHub Enterprise. Enterprises working with a GitHub or Microsoft account team can get Copilot included for every licensed user, instead of previously managing Copilot and GitHub Enterprise as two separate things.

  • OfficialGitHub

    Security extension for the GitHub Copilot app

    GitHub has introduced a new security extension for the GitHub Copilot app, now in public preview, which lets developers work through their repository's GitHub code scanning alerts without leaving the GitHub Copilot app.

  • OfficialGitHub

    Build shared workflows for your team with Copilot Automations

    GitHub is rolling out shared Copilot Automations, a feature that lets teams build and maintain AI-powered workflows together. With Copilot Automations, users can combine prompts, triggers, and tools to design workflows around their work.

  • OfficialGitHub

    GitHub Copilot in VS Code, Universe releases

    GitHub's official blog announced 'GitHub Copilot in VS Code, Universe releases,' describing a year-long focus on giving users more choice in how they work with GitHub Copilot in Visual Studio Code, including which models they use and where their agents run.

  • OfficialGitHub

    Repository plugin defaults and enterprise plugin controls generally available

    Repository plugin defaults and enterprise-managed plugin controls are now generally available in VS Code, Copilot CLI, and the GitHub Copilot app. Trusted repositories can install and enable default plugins, and enterprises can manage plugin controls across these tools.

  • OfficialGitHub

    Generate and edit images directly in Copilot

    GitHub announced that users can now generate and edit images using natural language in GitHub Copilot. When a user requests an image, their selected reasoning model calls a dedicated image-generation tool.

  • OfficialGitHub

    GitHub Copilot Fusion now supports selection of local models

    GitHub is shipping intelligent routing for local models into experimental preview. GitHub Copilot Fusion can now choose between supported on-device models and cloud models, enabling intelligent local model routing.

  • OfficialGitHub

    GitHub Agentic Workflows generally available

    GitHub's open source project GitHub Agentic Workflows, from GitHub Next, is now generally available. It automates reasoning-based tasks such as issue triage, CI failure analysis, and documentation updates.

  • Simon Willison

    ArticleSimon Willison

    The October inflection point for vibe game development

    Simon Willison argues that October 2026 marks a new inflection point for vibe coding computer games, following the November 2025 inflection point for coding agents when Opus 4.5 and GPT-5.1 crossed a tipping point that made their coding agents reliable daily drivers for software engineers. He illustrates the new inflection point with examples of games built through vibe coding, including Tree Appreciator, Emberwick, Battle Drones, and Pumpkin Farmer (aka Quarter Sun Cove).