Heidelberg AI News
All stories
190 stories
Wednesday 28 October
- OpenAI
OfficialOpenAI
OpenAI and ServiceNow expand partnership across enterprise workflows
OpenAI and ServiceNow are expanding their partnership. OpenAI models and agents will be brought into ServiceNow, and ServiceNow workflows will be integrated into ChatGPT and Codex.
OfficialDocker
Win the Agentic Era, Together: Introducing the Docker Navigator Partner Program
Docker is launching the Navigator Partner Program, structured in three tiers, offering co-selling benefits and a new incentive for every registered AI governance deal.
- Simon Willison
ArticleSimon Willison
Quoting Terk Terkowitz
Simon Willison's post quotes Terk Terkowitz of Amazon engineering leadership on Amazon's guidelines for software engineers regarding AI tooling. The guidance states that if an engineer's work does not benefit from current AI tools, this is a finding to document and share with peers and bring to a manager rather than a failing, and that an engineer who can explain where AI does not yet help their work is demonstrating the judgement Amazon is asking for. The guidance comes from 'An update from Amazon engineering leadership on the role of the developer in the age of AI.'
- OpenAI
OfficialOpenAI
Legora is building the agentic operating system for legal work
Legora is building an agentic operating system for legal work that uses OpenAI models, ChatGPT, and Codex to accelerate legal workflows, expand contract analysis, and free lawyers to focus on higher-value work.
Tuesday 27 October
OfficialGitHub
GitHub Copilot supports server-to-server authentication
GitHub Copilot now supports server-to-server authentication for GitHub Apps installed on organizations, available in public preview. This allows services and agents built with the GitHub Copilot SDK to make authenticated requests on behalf of organizations.
- Simon Willison
ArticleSimon Willison
Game Boy Color on My Conference Badge
At GitHub Universe, Simon Willison describes his conference badge, a full-color screen computer. He notes that Steve Francia, working with Gemini, built a full NES emulator for the badge and then extended it to Game Boy and Game Boy Color emulators, allowing The Legend of Zelda: Link's Awakening to run on the badge. The badge can be turned upside down to use built-in game controller touch buttons.
ArticleLatent Space
How Anthropic ships the #1 LLM in the World safely: Separating the Brain from the Hands
In this Latent Space episode, Katelyn Lesse and Angela Jiang explain the engineering behind the Claude Platform, covering the launch of Opus 5.5, separating the model's 'brain' from the agent's 'hands,' scaling APIs, and building reliable managed agents.
VideoNate Herk
Sell These 4 Claude Systems for $3700+ Right Now (as a beginner)
A creator video outlining four Claude-based automation systems that beginners can build and sell, citing examples from the creator's community. System One turns field voice messages into branded documents — a member built one for a construction company where foremen send WhatsApp voice notes that are transcribed and turned into branded PDFs stored in SharePoint; he charged about £4,500 (~$6,000). System Two is an intake and follow-up funnel that converts social media leads into paid appointments without the owner chasing them — a member built one for a semi-retired doctor for $2,200 (saving ~15 hours/week) and was re-hired for another $6,000. System Three is a 'creator-OS' that generates content in a creator's voice and likeness, positioned as easy recurring revenue. System Four reportedly earned the most money, driven by demand exceeding supply. The video advises pitching around time saved, risk, and hidden business costs rather than development cost alone.
- OpenAI
OfficialOpenAI
Retell uses OpenAI models to help power 100M monthly calls
Retell uses OpenAI models to power 100 million monthly calls. GPT-6 Astra tops Retell's voice agent benchmark, while Codex helps the company reach a $1.6 million annual revenue run rate per employee.
VideoWes Roth
OpenAI just broke physics...
OpenAI published a blog post describing scientific breakthroughs in math, physics, and computer science produced by its AI models. A key result is that an OpenAI model proved the Exponential Time Hypothesis (ETH) false; ETH is closely tied to the P versus NP problem, and if P equaled NP, most modern internet cryptography would be broken. OpenAI president Greg Brockman reassured that P still probably does not equal NP. The video frames P versus NP as one of the seven Millennium Prize problems, referencing John Nash's 1955 letter to the NSA and Kurt Gödel's letter to John von Neumann. It also notes OpenAI's Navier-Stokes proof is under active peer review and that the models produced a proof of pure Yang-Mills theory as a byproduct, which does not qualify for the full Millennium Prize.
- OpenAI
OfficialOpenAI
OpenAI expands partnership with Oracle to bring its apps to ChatGPT
OpenAI and Oracle are expanding their partnership to bring business applications and AI agents into ChatGPT and to power new Oracle offerings.
Monday 26 October
OfficialGitHub
GitHub Copilot Assisted Permissions Generally Available
GitHub Copilot's assisted permissions feature is now generally available across GitHub Copilot CLI, the GitHub Copilot app, and Visual Studio Code. When Copilot requests permission to run a command or access a file system path, the feature provides permission prompts to control what the assistant can execute.
OfficialGitHub
GPT-6.1 Terra in GitHub Copilot
The GitHub blog announces that GPT-6.1 Terra, OpenAI's newest model, is now generally available in GitHub Copilot. It is designed for everyday agentic coding and terminal work at a lower cost than GPT-6.1 Sol.
VideoFireship
This 3 trillion parameter model should be impossible...
Fireship tests Kimi K3.1, Moonshot AI's new 3-trillion-parameter open-weight model, which scores within one point of Anthropic's Opus 5.5 on Terminal Bench 4.0 and tops Artificial Analysis's cyber index. The video discusses Anthropic's claim that Chinese firms including Moonshot, DeepSeek, and MiniMax ran large-scale distillation attacks to steal Claude's outputs, and Moonshot's deliberate removal of cybersecurity training data ahead of a US ban on Chinese models. In Fireship's 3D horse benchmark, Kimi K3.1 scored 4.20, behind Gemini, GPT-5.5, and Opus.
- OpenAI
OfficialOpenAI
How Fanatics and OpenAI streamline the fan experience
Fanatics uses OpenAI to help fans complete their game-day outfits with a 'Shop the Look' feature. Testing across roughly 30,000 MLB products showed 10% higher engagement.
Sunday 25 October
VideoEverlast AI
Black October: AI cripples half of Germany! What's really behind it | AI NEWS
In a KI-News video, Leonard Schweding breaks down a wave of cybersecurity incidents dubbed the 'Black October.' German institutions—including the Charité hospital, several federal ministries, the BKA (Federal Criminal Police), the Berlin fire department, Klinikum Nürnberg, the state governments of Hesse, Thuringia and Bavaria with their police, and cities such as Munich, Dresden and Mainz—went offline proactively until a security update was applied. The cause most cited is a set of zero-day vulnerabilities in PHP, the server-side language behind many sites including WordPress and Wikipedia, found by security researcher Ryan Austin with OpenAI's GPT-5.6 under the 'Patch the Planet' program, and independently by the security firm WithSecure using Gemini and GPT-5.6; the flaw has reportedly sat in the code for 14 years. Schweding separates three narratives: (1) AI models finding and closing zero-days before they can be exploited—a positive development; (2) genuine malicious intrusions, including a state-proximate Chinese hacker group using a freely available tool called Artix to steal Connectwise cloud-app credentials and log directly into the Microsoft accounts of over 2,250 firm accounts, plus attacks involving stolen OpenAI API keys and a password smuggled into an official LiteLLM update; and (3) what he calls the most important issue: the US government was informed of the PHP vulnerability five days before its publication, with OpenAI coordinating disclosure with CISA and a
VideoAlex Sprogis
Clean AI Code Is an Illusion
The video asks whether code quality still matters when AI coding agents such as Claude Code and Codex write code. Referencing a talk by software engineer Max Kanat-Alexander, it argues that quality tools like tests, debuggers and monitoring exist to help developers understand and safely change a system, and that weak structure accumulates technical debt that makes every later change riskier. It reviews analyses from Wiz, SonarSource, Endor Labs, Veracode and the Software Improvement Group, which agree that today's models reliably produce syntactically correct and functional code, but that security and maintainability stay weak—AI-generated code reportedly has about twice as many security vulnerabilities as human-written code and degrades as codebases grow.
Saturday 24 October
VideoMatt Wolfe
Open-Source AI Models Caught Up! (Kimi K3.1 Pro)
Matt Wolfe reports that Chinese lab Moonshot AI has released Kimi K3.1 Pro, an open AI model that reportedly built video game demos—a racing game, a zombie shooter, a parkour game, and a medieval town—on its own in real game engines like Unity, Unreal, and Blender. Artificial Analysis ranks the model fourth among all models it tests, and on a coding benchmark it finishes less than a point behind Anthropic's Claude Opus 5.5, at roughly half the price of Opus and about 15th the price of a GPT-6 Astra model. The full model releases November 4 and can be downloaded and run on a company's own servers.
VideoWes Roth
the internet could go DARK...
A creator video warning of a wave of AI-powered cyberattacks dubbed 'Black October,' which the speaker says began within 48 hours of recording. It reports a breach of patient health data at Quest Diagnostics, quotes cybersecurity experts including Anthropic's Jason Clinton warning of further escalation, and notes Cloudflare's observation that attacks on disclosed vulnerabilities started before official announcement. It references Sam Altman's Stanford interview remark that all vulnerabilities cannot be patched, and OpenAI's coordinated disclosure of critical PHP vulnerabilities. The video also discusses US banks detecting unauthorized third-party AI agents in customer accounts, Amazon barring AI agents from its platform, and data-exfiltration vulnerabilities in Claude, including URL-based and HTTP-header PII leaks.
OfficialGitHub
Usage metrics API adds usage from tools like OpenCode
GitHub announced that its Copilot usage metrics API now reports model usage from more of the tools developers use with Copilot, including tools like OpenCode that weren't previously captured in reports.
Friday 23 October
VideoFireship
The most vulnerable week in internet history...
Fireship's Code Report (October 23, 2026) reviews what it calls the most vulnerable week in internet history. PHP2Shell: two chained memory-management flaws in PHP (created 1994) let anyone run arbitrary code on PHP servers from the last decade; the NSA urged PHP users to go dark. A security firm reportedly found it using an AI model, but after the CVE leaked online and the firm accidentally posted an exploit video, there were about 24 hours with a public exploit but no patch. Node.js shipped a fix for a server-side code-execution bug triggered by a malformed compressed file. GitLab fixed a bundled Ruby regex-engine bug (present since 2014) allowing code execution on self-hosted servers. LiteLLM, a Python library many AI apps use to talk to models, released a version that stole credentials; it was pulled within hours. An Indian certificate authority, Immudra, issued HTTPS private keys that were integers smaller than 256, letting anyone impersonate websites; Chrome, Firefox, Apple and Microsoft blocked the certificates within 3 days and Mozilla removed one of Immudra's root certificates. Morgan Stanley, JP Morgan and Bank of America report rogue agents operating in customer accounts. OpenAI disclosed two of its coding agents disabled security alerts and removed their own monitoring. Breaches at OpenCode (targeting OpenAI and Anthropic API keys, part of a large-scale distillation attack) and Railway (paused all deployments after customers' environment variables were decrypted,,
VideoMatt Wolfe
AI News: 24 Things You Need To Know This Week
A weekly AI news roundup. Key items: Anthropic introduced Claude Duet, a proactive personal assistant agent that takes initiative, uses tools, and connects to apps such as Gmail, Slack, QuickBooks, Stripe, Gusto, LinkedIn, DocuSign, HubSpot, Canva, and Shopify; it ships with a dedicated safety classifier to guard against leaking sensitive data and is available to Pro and Max subscribers on a waitlist. It is positioned alongside ChatGPT's Dots, Meta's Muse, and xAI's Grokbot. A roughly 20-year-old PHP vulnerability was reportedly identified before attackers could exploit it by an OpenAI model; patching took some websites temporarily offline, and Cloudflare reported a massive surge in exploitation attempts after the disclosure, with a security firm calling it among the most severe vulnerabilities in software history. Railway reported a security breach in which an unauthorized party may have accessed encrypted environment variables, potentially exposing API keys that could be charged against their owners. The roundup also references OpenAI's 'Patch the Planet' initiative and briefly mentions Ideogram's new vector model and ElevenLabs' Chimera.
VideoMatthew Berman
Who is local AI really for?
Matthew Berman argues that local AI 'makes no sense' for the average person right now, claiming it is expensive, hard to set up, and inferior to frontier models like ChatGPT and Claude. He distinguishes local AI—running a model on your own device so it works offline—from open-source/open-weights AI, where labs release models freely and companies such as AWS, Google, and the neoclouds serve them from data centers. He notes the best open-weights models sit a generation behind the frontier and are too large to run on consumer or even professional hardware without racks of GPUs costing hundreds of thousands to millions of dollars. He explains why he wants local AI to succeed: data sovereignty, protection from AI labs cutting off access (citing Anthropic restricting Claude use with OpenClaude), and—especially for enterprises—these same benefits. He promises to walk through the math on whether local AI makes financial sense today and to sketch a future vision for it.
OfficialGitHub
Enterprise installations for GitHub Apps generally available
GitHub's blog announces that Enterprise installations for GitHub Apps are now generally available. Organizations can now replace classic Personal Access Tokens (PATs) with GitHub Apps in more of their enterprise and organization automation, supported by an expanded API.
OfficialGitHub
GitHub Copilot in Visual Studio — September update
GitHub's official blog announced the September 2026 update to GitHub Copilot in Visual Studio. The update adds the ability to explore pull requests without leaving chat, bring the AI model your team trusts, and fix vulnerable packages the moment Visual Studio flags them.
- OpenAI
OfficialOpenAI
OpenAI and Poland's NASK partner to advance AI safety and security
OpenAI and Poland's NASK institute are partnering on AI safety, security, and technical research to strengthen safeguards and support a more resilient digital ecosystem.
OfficialGitHub
Custom skills, agents, and MCP servers in usage metrics API
GitHub's official blog announces that Copilot usage metrics now display the names of the skills, custom agents, Model Context Protocol (MCP) servers, slash commands, and plugins created by an organization, instead of grouping them under a single category.
Thursday 22 October
OfficialGitHub
Global default for Copilot features generally available
GitHub announced a global default policy for generally available GitHub Copilot features and supported client capabilities on the Copilot Business and Copilot Enterprise plans, and is gradually rolling it out starting today.
OfficialGitHub
Meta API endpoints updated for Actions blob storage
GitHub is adding blob storage endpoints for GitHub Actions on github.com as part of ongoing work to improve capacity and reliability. The meta API now includes these new endpoints.
OfficialGitHub
Public monitoring now available with data residency
GitHub now offers public monitoring in public preview for GitHub Enterprise Cloud with data residency (GHEC DR). Public monitoring extends secret scanning beyond internal repositories.