All tracked items across vulnerabilities, news, research, incidents, and regulatory updates.
Google released Gemini 3.1 Flash-Lite, an updated version of their affordable AI model that costs one-eighth the price of Gemini 3.1 Pro at $0.25 per million input tokens and $1.50 per million output tokens. The model includes four different thinking levels, which appear to control how deeply the AI reasons through problems.
AI companies and billionaires are funding a super PAC called Leading the Future that has spent at least $10 million in ads attacking New York politician Alex Bores, who is running for Congress and has sponsored AI regulation laws like the RAISE Act (which requires large AI labs to publicly disclose safety plans). The PAC, backed by Palantir co-founder Joe Lonsdale, OpenAI President Greg Brockman, and others, is targeting Bores and other candidates who support state-level AI regulation, viewing them as threats to the industry's preferred light-touch approach.
ChatGPT users complained that the GPT-5.2 Instant model used overly reassuring and condescending language, like telling them to 'calm down' even when they were just asking for factual information, which made them feel infantilized and led some to cancel subscriptions. OpenAI's new GPT-5.3 Instant model aims to fix this by reducing the 'cringe' and preachy disclaimers, instead acknowledging difficulties without making assumptions about the user's mental state. The update focuses on improving user experience through better tone, relevance, and conversational flow.
Anthropic is rolling out Voice Mode for Claude Code, its AI coding assistant, allowing developers to use spoken commands instead of typing. The feature, which lets users type /voice to toggle it on and then speak requests like 'refactor the authentication middleware,' is currently live for about 5% of users with broader availability planned in coming weeks. The source does not specify technical limitations or whether Anthropic partnered with third-party voice providers to build this capability.
OpenClaw has a path traversal vulnerability (CWE-22, a weakness where attackers bypass directory restrictions) in its `$include` directive that allows arbitrary file reads. An attacker who can modify OpenClaw's configuration file can read any file the OpenClaw process has access to by using absolute paths, directory traversal sequences (like `../../`), or symlinks (shortcuts to files), potentially exposing secrets and API keys.
Google is rolling out new features to Pixel 10 phones that allow Gemini, its AI assistant, to act as an agent (an AI that can take actions independently on your behalf) to complete tasks like ordering groceries or booking rides in selected apps such as Uber and Grubhub. Users can supervise or stop the agent's work at any time while it operates in the background.
During the Iran conflict in 2024, many fake images and videos spread online, including old footage, unrelated conflicts, AI-generated content (synthetic media created by artificial intelligence), and clips from video games like War Thunder. Major news organizations like The New York Times, Indicator, and Bellingcat use detailed verification procedures to check whether content is real before publishing it, helping audiences distinguish trustworthy reporting from misinformation.
BentoML's `safe_extract_tarfile()` function has a security flaw where it validates that symlink paths (links that point to other files) are within the extraction directory, but it doesn't validate where those symlinks actually point to. An attacker can create a malicious tar file with a symlink pointing outside the directory and follow it with a regular file, allowing them to write files anywhere on the system. This vulnerability has a CVSS score (a 0-10 rating of how severe a vulnerability is) of 8.1 (High).
Anthropic, an AI company, ended negotiations with the U.S. Department of Defense after refusing to allow its technology to be used for fully autonomous weapons (systems that make combat decisions without human control) or domestic mass surveillance. The U.S. government then blacklisted Anthropic, prohibiting it from working with federal agencies and Pentagon contractors, with government officials saying the company should 'correct course' to resolve the dispute.
Anthropic refused the U.S. Department of Defense's demand for unrestricted use of its AI technology for mass surveillance and fully autonomous weapons systems, leading the DoD to cancel a $200 million contract. The article argues that relying on individual company leaders to protect privacy through business decisions is unsustainable, and that Congress should pass binding legal restrictions instead of leaving privacy protection to private companies and their CEOs.
Fix: OpenAI released GPT-5.3 Instant, which according to the release notes reduces preachy disclaimers and focuses on improving tone, relevance, and conversational flow. In the example provided, GPT-5.3 Instant acknowledges the difficulty of a situation without directly reassuring the user, rather than the GPT-5.2 Instant approach of starting responses with phrases like 'First of all, you're not broken.'
TechCrunchFix: Update OpenClaw to version 2026.2.17 or later. The vulnerability is fixed in npm package `openclaw` version `>=2026.2.17` (vulnerable versions: `<=2026.2.15`).
GitHub Advisory DatabaseTech workers at Google, OpenAI, and other companies are signing open letters calling for clearer limits on how their employers work with the military, after the U.S. Department of Defense blacklisted AI models from Anthropic (a company that refused to allow its technology for mass surveillance or autonomous weapons) and the U.S. carried out strikes on Iran. The letters express concern that the government is pressuring tech companies to accept military contracts involving AI without proper safeguards, and workers are demanding greater transparency about their employers' government agreements.
This newsletter roundup covers two main AI stories: OpenAI has agreed to allow the US military to use its technologies in classified settings, with protections against autonomous weapons and mass surveillance, though concerns remain about whether safety measures can be maintained during rapid deployment; separately, a startup called Skyward Wildfire claims it can prevent wildfires by stopping lightning strikes using cloud seeding (releasing metallic particles into clouds), but researchers question its effectiveness under different conditions and potential environmental impacts.
Adversarial SQL injection (SQLi, a technique where attackers modify their attacks based on feedback from a Web Application Firewall to bypass it) has become a serious threat, with automated tools like AdvSQLi and GPTFuzzer making it easier to find vulnerabilities. The paper proposes a hybrid defense system combining Character-Level CNN (a neural network that analyzes attack payloads character-by-character to find harmful patterns) and Reinforcement Learning (a type of AI training that learns through trial and feedback) to detect these advanced attacks, showing that this approach can catch malicious patterns even when attackers try to disguise their payloads.
This research proposes a new authentication and key agreement (AKA, a process where devices verify each other's identity and create shared secret keys for secure communication) scheme for VANETs (vehicular ad hoc networks, where cars communicate directly with each other without central infrastructure). The scheme uses a consortium blockchain (a shared, distributed ledger controlled by a group of organizations rather than one central authority) to work in asynchronous environments, where messages may arrive out of order or with delays, and employs lightweight cryptographic techniques (mathematical methods that require less computing power) to reduce system overhead.
Bitcoin is shifting from system rewards to transaction fees (payments users include with their transactions) to incentivize miners, but this creates a 'mining gap' where miners turn off their equipment when fees are too low, weakening Bitcoin's security. This paper identifies this as an 'egoistic dilemma' where both users and miners act selfishly, and proposes an incentive mechanism based on zero-determinant theory (a game theory approach) to solve the problem.
This research proposes ATRIA, a system for verifying that copies of data stored across multiple edge computing servers are authentic and haven't been tampered with. ATRIA uses TEEs (trusted execution environments, which are secure hardware areas that isolate sensitive operations) to shift the work of generating verification tags from resource-limited user devices to more powerful servers, while also protecting user privacy through anonymous identities that a trusted authority can trace if needed. The system protects against attacks where servers collude or create fake data on demand, and testing shows it uses less computing power than similar existing approaches.
This paper introduces CipheRAG, a system that helps large language models (LLMs) safely use external knowledge sources while protecting sensitive data. The system balances two competing needs: keeping data private while still retrieving information quickly, which existing approaches struggle to do because cryptography-based methods are slow while faster methods leak more information.
Wireless Sensor Networks (WSNs, collections of small wireless devices that sense and relay data) are vulnerable to node failures and malicious attacks because they operate with limited resources in open environments. This paper proposes EFTE, a framework that evaluates the trustworthiness of individual nodes by measuring their communication quality, remaining battery power, behavior consistency, and movement patterns, then uses entropy-based weighting (a mathematical approach to handle uncertainty in data) and a fuzzy inference system (a method that makes decisions from incomplete or uncertain information) to identify and isolate untrustworthy nodes while protecting data with lightweight encryption.
This paper presents a method for compressing visual data in multimodal 3D object detection systems (systems that use multiple types of sensors like cameras and LiDAR to identify and locate objects in 3D space) when processing happens across both edge devices (local computers) and cloud servers. The authors propose two compression approaches: T-FFC (Transmission-Friendly Feature Compression), which reduces data size by 4933 times with minimal accuracy loss, and A-FFC (Accuracy-Friendly Feature Compression), which reduces data by 733 times with almost no accuracy loss, allowing cloud and edge devices to work together more efficiently.
This research addresses how to safely explore environments using reinforcement learning (RL, a type of AI training where a system learns by trial and error) without causing damage or violating safety rules. The paper introduces safe equilibrium exploration (SEE), a method that balances two competing goals: expanding the area where exploration is allowed (the feasible zone) and building a more accurate model of how the environment works, showing that these two objectives improve each other and can reach an optimal balance without any safety violations.