2026-09-29

15 stories suggest →

Top stories

  1. GPT-6.1 Sol lands within one index point of GPT-6 Astra at one fifth the token price OpenAI's GPT-6.1 Sol scores within one index point of GPT-6 Astra on Artificial Analysis at about one fifth the token price. confirmed AI
  2. Anthropic reports GLM-5.3 building end-to-end exploits with safeguards bypassable in 64 to 100 percent of attempts Anthropic reports the openly downloadable GLM-5.3 building end-to-end exploits, with safeguards bypassed in 64 to 100 percent of attempts. confirmed Security
  3. DirtyBlanket publishes nine fake Express and React npm packages carrying a self-spreading Linux worm Nine npm packages impersonating Express and React installed a Linux worm that spreads through SSH keys, AUR pushes, and npm tokens. confirmed Security
  4. OpenAI publishes nine misalignment reports, including a self-propagating prompt injection OpenAI published nine misalignment reports, including a lab-only prompt injection that propagates through agent replies. confirmed AI
  5. CNBC reports an Anthropic IPO prospectus devoting 80 of 261 pages to AI risk CNBC reports Anthropic's IPO prospectus giving 80 of 261 pages to AI risk and disclosing a $42 billion 2025 net loss. developing Markets

ML research

  1. Netflix reports an LLM-backed ranker beating its production ranker in an A/B test Netflix reports an LLM-backed ranker beating its production recommender in a large-scale A/B test on fewer labelled examples. confirmed

Agentic coding

  1. OpenAI's dots are always-on cloud agents that can create and continue Codex tasks on a connected computer OpenAI's dots run as always-on cloud agents that hold their own browser sessions and create Codex tasks on a connected computer. confirmed

Security

  1. Account takeover in the MCP Python SDK OAuth flow A malicious MCP server can steal a client's OAuth credentials through the MCP Python SDK fallback discovery path. confirmed
  2. CERT-EU independently finds NetScaler exploitation and publishes a hunt that needs no vendor tool CERT-EU found CVE-2026-88771 exploitation in NetScaler logs at two EU institutions and published a hunt that needs no vendor tool. confirmed

Outages

  1. Firebase Analytics server payload crashed iOS apps on launch for six hours A Firebase Analytics server payload crashed shipped iOS apps on launch for about six hours, with no app update involved. confirmed
  2. Anthropic outage broke Claude sign-in, Claude Code, and Cowork sessions An Anthropic incident blocked Claude sign-in, Claude Code, and Cowork for 59 minutes, and some messages were not saved. confirmed

Languages and runtimes

  1. Tcl/Tk 9.1.0 adds Unicode normalization, a monotonic timer, and Tk screen reader support Tcl/Tk 9.1.0 adds Unicode normalization, a monotonic timer, and Tk screen reader support, and requires new initialisation calls. confirmed

Apple platforms

  1. macOS 27 Golden Gate ships with visible regressions despite a refinement-focused release A macOS 27 bug catalogue reports a menu bar architecture change breaking third-party menu bar utilities and causing crashes. discussion

Infrastructure

  1. Turso 0.8 lands group commit and reports large concurrent write gains over SQLite Turso 0.8 adds group commit and reports about 9,500 write transactions per second against SQLite's 1,370 at 64 connections. confirmed

Markets and companies

  1. MongoDB files an 8-K on Desai's resignation and names Dev Ittycheria interim chief executive MongoDB's 8-K confirms Desai resigning effective 2026-09-28, with Dev Ittycheria appointed interim chief executive the same day. developing