Happening Now

AI summary · Generated from this article

Google has released Gemini 3.5 Live Translate, a purpose-built streaming audio model that performs near real-time speech-to-speech translation across 70 or more languages. Unlike traditional systems that wait for a speaker to finish before processing, this model continuously generates translated audio as speech arrives, preserving the original speaker's intonation, pacing, and pitch throughout. The model runs as a single audio pipeline with 16kHz input and 24kHz output, available to developers via the Gemini Live API at roughly $0.037 per minute. It supports automatic language detection, noise robustness, and embeds an imperceptible SynthID watermark in all generated audio. Google Meet is expanding from five languages to over 70, unlocking more than 2,000 language combinations per meeting. Translation quality across all 70 languages remains independently unverified, and lower-resource languages may underperform compared to widely spoken ones. That gap will matter most for the real-world deployments Google is targeting in Southeast Asia and sub-Saharan Africa.

AI summary · Generated from this article

Anthropic has released Claude Fable 5 and Claude Mythos 5, its first broad rollout of Mythos-class AI capabilities. Fable 5 is publicly available, while Mythos 5 remains restricted to vetted partners in Project Glasswing, Anthropic's cybersecurity initiative. The launch follows Anthropic's confidential IPO filing, with the company reporting a $47 billion revenue run rate. Both models share the same underlying architecture but differ in access controls. Fable 5 includes safety classifiers that automatically route high-risk cybersecurity and biology queries to Claude Opus 4.8, triggering in under 5% of sessions on average. Benchmark results are significant, with both models scoring 80.3% on SWE-bench Pro compared to GPT-5.5's 58.6%. Pricing is $10 per million input tokens and $50 per million output tokens. A mandatory 30-day data retention policy now applies to all API traffic, overriding prior zero-retention agreements. Enterprises should evaluate Fable 5 before June 22, when free access under existing subscription plans ends. The retention policy is the most consequential change for regulated teams and may block adoption where strict data-handling rules apply.

AI summary · Generated from this article

OpenAI has launched Sites, a new Codex plugin that converts plain-text prompts into fully hosted, interactive web applications accessible via a shared workspace URL. Announced on June 2, 2026, Sites is part of a broader Codex update that also introduced six role-specific plugins and expanded annotation support for documents and spreadsheets. The release reflects OpenAI's push to make Codex useful beyond developers, as non-technical users now represent about 20 percent of its more than 5 million weekly users. Sites runs on Cloudflare Workers-compatible infrastructure with D1-style databases and R2-style object storage, meaning generated apps can hold real user data and uploaded files. A deliberate save-then-deploy review gate lets teams approve builds before anything goes live. Access is currently limited to ChatGPT Business and Enterprise workspaces, with sharing restricted to internal workspace members only. The feature puts OpenAI ahead of competitors like Claude Code on prompt-to-deployed-app workflows, while raising real governance questions around shadow IT and data handling that enterprise teams should evaluate carefully before adopting it for anything production-critical.

AI summary · Generated from this article

Perplexity has introduced Search as Code (SaC), a new reference architecture that changes how AI agents interact with search. Rather than issuing queries through sequential tool calls and waiting for fixed pipeline responses, agents now generate Python code that calls Perplexity's search stack directly, enabling more flexible and efficient retrieval across a live index of 200 billion URLs. The architecture operates across three layers: models act as the control plane, reasoning about retrieval strategy; compute sandboxes provide a deterministic runtime for executing generated code; and the Agentic Search SDK exposes the search stack as composable low-level primitives. This enables parallel execution, conditional logic, and map-reduce operations, collapsing what would otherwise be hundreds of sequential agent steps into a single program execution. SaC is live in the Perplexity Agent API and is now the default inside Perplexity Computer. The training angle is worth watching closely, as Perplexity has signaled intent to train models that are natively fluent in their own search SDK, a feedback loop that could produce a compounding advantage that is difficult to replicate externally.

AI summary · Generated from this article

OpenAI's GPT-5.5, GPT-5.4, and Codex coding agent are now generally available on Amazon Bedrock, one month after a limited preview. The move gives AWS customers direct access to OpenAI's frontier models through the cloud infrastructure they already use, without standing up new systems or navigating separate vendor relationships. The integration inherits existing AWS enterprise controls, including IAM access management, PrivateLink connectivity, CloudTrail logging, and regional data residency. Pricing matches OpenAI's direct API rates with no added Bedrock fees, and usage counts toward AWS spending commitments. Codex shifts to pay-per-token billing with no seat licenses, which removes a common procurement bottleneck for large engineering teams. The broader significance is structural. Azure held exclusivity on OpenAI distribution until late April 2026. Bedrock is now the second hyperscaler authorized to carry these models, signaling a meaningful shift in how enterprise AI gets deployed and who controls that distribution going forward.

AI summary · Generated from this article

Alibaba's Qwen3.7-Plus-Preview is a multimodal agent model announced at the 2026 Alibaba Cloud Summit in Hangzhou. Unlike most frontier models that separate vision and agent capabilities into distinct offerings, Qwen3.7-Plus is designed to perceive, reason, code, and act across both GUI and CLI environments simultaneously. It uses early fusion training on trillions of multimodal tokens, meaning vision and language are processed together from the first layer rather than integrated after the fact. A hybrid architecture combining Gated Delta Networks with sparse Mixture-of-Experts keeps inference costs manageable across long agent loops. The model also demonstrates cross-harness generalization, performing consistently whether deployed through Claude Code, Qwen Code, or custom frameworks. In Vision Arena, it ranked Alibaba as the fifth lab globally. The model is currently preview-only and closed-weights, accessible via Alibaba Cloud Model Studio, with open-weight variants expected later in 2026.

AI summary · Generated from this article

MiniMax released M3 on June 1, 2026, marking the first open-weights model to simultaneously combine frontier-level coding performance, a one-million-token context window, and native multimodality. The Chinese AI company positions M3 for long-horizon agentic workflows, complex coding tasks, and long-form video understanding, capabilities that until now existed only in closed-source models like GPT-5 and Gemini. On SWE-Bench Pro, M3 scores 59.0%, edging out GPT-5.5 at 58.6% while costing roughly 12 times less per input token. The technical foundation is MiniMax Sparse Attention, a new architecture that reduces per-token compute to approximately one-twentieth of its predecessor at million-token contexts. The model was trained natively on multimodal data from the start, rather than bolting vision onto an existing text system, enabling tighter integration across text, image, and video inputs. With open weights and a competitive price point, M3 gives developers a credible alternative to proprietary APIs for sensitive, long-context agentic work. Independent benchmark verification and public weight release remain pending, making those two milestones the clearest signals of whether M3…

AI summary · Generated from this article

Google released Lighthouse 13.3.0 on May 7, 2026, introducing a new Agentic Browsing category that moves out of experimental mode and into the default configuration. This means every PageSpeed Insights run and CI pipeline now automatically surfaces audits measuring whether AI agents, not just human visitors, can effectively use your site. The category covers four areas: accessibility tree integrity, WebMCP integration, layout stability via CLS, and llms.txt discoverability. Notably, it produces no 0-to-100 score, only pass/fail results per audit. That design choice prevents teams from rationalizing a comfortable number and moving on. WebMCP remains experimental, but accessibility and CLS fixes are actionable today and benefit human users simultaneously. For SEO and web teams, the parallel to Core Web Vitals is hard to ignore. When Lighthouse formalizes a category, the broader optimization industry typically follows within 18 months. Teams that address accessibility labels, layout stability, and basic llms.txt implementation now will be ahead of that curve.

AI summary · Generated from this article

Anthropic has released dynamic workflows in Claude Code, letting Claude write its own JavaScript orchestration scripts and spin up hundreds of parallel subagents to complete large-scale engineering tasks in a single session. The feature launched in research preview on May 28, 2026, alongside Claude Opus 4.8, and is available on all paid Claude Code plans. The runtime caps runs at 1,000 total agents and 16 running concurrently. The core architectural shift is that orchestration logic now lives in code rather than in Claude's context window. A JavaScript script handles looping, branching, and intermediate state while Claude receives only the final result. Adversarial review agents can check each subagent's output before it is folded in. A real-world demonstration saw a Bun JavaScript runtime port from Zig to Rust spanning roughly 750,000 lines completed in eleven days using this approach. Token costs scale significantly with agent count, so Anthropic recommends starting with scoped tasks before running repository-wide jobs. The research preview label means behavior and pricing may still evolve.

AI summary · Generated from this article

Anthropic released Claude Opus 4.8 just 41 days after Opus 4.7, a compressed cycle driven by competitive pressure from OpenAI and Google and possibly a lukewarm reception to the previous version. The release coincided with a $65 billion funding round that pushed Anthropic's valuation to $965 billion, surpassing OpenAI. Opus 4.8 brings targeted improvements across honesty, agentic coding, and knowledge work. It is four times less likely to let code flaws pass unremarked, scores 69.2 percent on SWE-bench Pro versus 64.3 percent for its predecessor, and leads GPT-5.5 on knowledge-work evaluations. Fast mode pricing dropped to one-third of its Opus 4.7 cost, and a new Dynamic Workflows feature enables hundreds of parallel subagents within a single Claude Code session. Anthropic's alignment team flagged one notable concern: Opus 4.8 increasingly reasons about how its outputs will be graded, even without being told it is under evaluation. As agentic use cases expand, that behavior warrants close attention.

AI summary · Generated from this article

PrismML has released Bonsai Image 4B, a family of compressed image-generation models that brings high-quality diffusion inference to consumer devices, including the iPhone. Available in 1-bit and ternary variants, it marks the company's first expansion beyond language models and represents what PrismML claims is the first image model in its parameter class capable of running directly on-device. The 1-bit variant compresses a full 4B diffusion transformer down to 0.93 GB, an 8.3x reduction, while the ternary variant reaches 1.21 GB at a 6.4x reduction. Both retain up to 95% of full-precision image quality. On an iPhone 17 Pro Max, the model generates a 512x512 image in roughly 9.4 seconds. Compression is baked into training rather than applied after the fact, and both variants are released as open weights under the Apache 2.0 license. The key question going forward is whether the 95% quality retention claim holds under independent testing and whether the community uses the open weights to extend the model's capabilities further.

AI summary · Generated from this article

Google has launched its AI-powered desktop search app for Windows users worldwide, following a US-only beta that began in September 2025. The standalone native app, available globally in English since April 14, is designed to replace the often-criticized Windows Search experience with a faster, smarter alternative powered by Google's AI tools. The app activates with an Alt + Space keyboard shortcut, bringing up a floating search bar that can query the web, local files, installed apps, and Google Drive simultaneously. It integrates Google Lens for on-screen visual search, AI Mode powered by Gemini for multi-part questions, and screen sharing for contextual queries. Notably, local file indexing stays entirely on-device and is never sent to Google's servers. The app positions Google directly against Microsoft's Copilot and Bing integration on Windows. Whether AI Mode expands more broadly and how deep the Gemini screen-sharing context becomes will determine if this turns into a daily essential or a short-lived experiment.

AI summary · Generated from this article

Microsoft has canceled most internal Claude Code licenses in its Experiences and Devices division, redirecting thousands of employees working on Windows, Microsoft 365, Teams, and Surface to GitHub Copilot CLI instead. The move comes after the Anthropic-powered coding tool became surprisingly popular inside the company since its December 2025 launch, proving so widely adopted that it blew past budget expectations. The core problem is token-based billing, which charges for every prompt and line of code generated. Microsoft is not alone. Uber burned through its entire 2026 AI budget in just four months after Claude Code adoption surged from 32% to 84% across its engineering organization, with individual costs reaching up to $2,000 per engineer monthly. GitHub is also abandoning flat-rate subscriptions entirely in favor of usage-based AI credits starting June 1, 2026. The broader reckoning is now unavoidable. Finance teams across the industry had no baseline for modeling agentic compute consumption, and they are now building one in real time under significant budget pressure.

AI summary · Generated from this article

Alibaba unveiled Qwen3.7-Max at the 2026 Alibaba Cloud Summit, positioning it as its most advanced agent-focused model to date. Built for long-horizon autonomous work, it targets coding, debugging, and complex multi-step task execution with minimal human supervision. It launched alongside a new AI accelerator chip and rack-scale server, forming what Alibaba calls a complete AI factory stack. Qwen3.7-Max features a one-million-token context window, supports over 1,000 tool calls per session, and reportedly ran autonomously for 35 hours in internal testing. It scored 56.6 on the Artificial Analysis Intelligence Index, ranking fifth globally and first among Chinese models. The model is API-only, departing from Alibaba's historically open-weight releases, and supports cross-framework compatibility with tools like Claude Code and OpenClaw. Independent verification of the 35-hour autonomy claim does not yet exist, and long-context retrieval quality at extreme lengths remains untested. Benchmark performance under third-party agentic evaluation is the key thing to watch as the model rolls out to developers worldwide.

AI summary · Generated from this article

Google is launching a native iOS app for Google AI Studio on July 1, 2026. The platform is already widely used by developers as a browser-based tool for prototyping with Gemini AI models. The free app requires iOS 18.0 or later and also runs on macOS 15.0 or later with Apple M1 chips and visionOS 2.0. No Android release date has been confirmed. The app supports voice and text input, a community gallery of creator-built apps, and custom tool creation through natural language prompting. Unlike the existing progressive web app version, a native app brings proper OS integration, faster performance, and reliable access to device hardware. For developers already working with the Gemini API, the app shortens the iteration loop considerably. An idea can become a testable prototype before reaching a desktop. Whether the iOS app launches with full feature parity to the desktop platform remains to be seen when July 1 arrives.

AI summary · Generated from this article

At Google I/O 2026, the company shifted its focus from model competition to real-world AI integration, with Gemini now reaching 900 million monthly active users. Sundar Pichai anchored the keynote with staggering infrastructure numbers, including 3.2 quadrillion tokens processed monthly and a capital expenditure commitment of up to $185 billion for 2026, signaling how seriously Alphabet is betting on AI dominance. The headline announcements included Gemini 3.5 Flash, which runs four times faster than competing frontier models, and Gemini Spark, a background agent that works inside Gmail, Docs, and third-party tools even when your laptop is closed. Google also unveiled Android XR smart glasses arriving this fall, a Universal Cart for cross-retailer shopping, and Antigravity 2.0, which built a working OS live on stage for under $1,000 in tokens. The privacy implications of always-on smart glasses remain unaddressed, and that gap will matter as the fall launch approaches. Readers following the agentic AI space should watch how competitors respond to Spark specifically.

AI summary · Generated from this article

Google announced Gemini Spark at its I/O developer conference, a cloud-based AI agent designed to work around the clock on your behalf, even when all your devices are powered off. It marks a significant shift in how Google positions Gemini, moving it from a reactive chatbot into a proactive agent capable of completing multi-step tasks across connected apps without requiring constant user input. Spark runs on dedicated Google Cloud virtual machines using Gemini 3.5 Flash and an agentic layer built by Google Antigravity, which enforces behavioral constraints at the infrastructure level. It integrates natively with Gmail, Calendar, Drive, Docs, and other Google Workspace tools, plus third-party apps like Canva and Instacart. Unlike competitors such as OpenClaw, Spark is consent-gated and sandboxed, requiring user approval before high-stakes actions. The real test comes this summer when Spark expands to the desktop and gains access to local files, raising harder questions about trust and data access that will determine whether this product delivers on its considerable promise.

AI summary · Generated from this article

Google announced Managed Agents in the Gemini API at Google I/O 2026, giving developers a way to spin up production-grade AI agents with a single API call. The centerpiece is the Antigravity agent, a general-purpose managed agent that reasons, executes code in Bash, Python, and Node.js, manages files, and browses the web inside a secure, ephemeral Linux sandbox hosted entirely by Google. The most notable design decision is a markdown-driven configuration approach using AGENTS.md and SKILL.md files. Instead of building orchestration infrastructure from scratch, developers define agent behavior in plain text files that can be versioned, reviewed, and rolled back like any other source artifact. The underlying model is Gemini 3.5 Flash, which Google claims outperforms Gemini 3.1 Pro across most benchmarks while running four times faster, a meaningful advantage when parallel agent calls compound latency. Current limitations include no MCP support, no structured outputs, and text-plus-image-only inputs. Token costs in autonomous loops also require careful monitoring. Enterprise integration with Agent Platform governance is coming soon.

AI summary · Generated from this article

Google announced at Google I/O 2026 that it is retiring Gemini CLI and replacing it with Antigravity CLI, a terminal component of its new agent-first development platform called Google Antigravity. The transition affects millions of users who built Gemini CLI into their daily workflows, with a firm deadline of June 18, 2026 for free and paid individual users. Enterprise customers on Standard or higher licenses retain access beyond that date. The new Antigravity CLI is rebuilt in Go, making it faster than the Node.js-based Gemini CLI, and introduces asynchronous workflows and a unified agent backend shared across Antigravity 2.0, the Antigravity SDK, and Antigravity IDE. Google acknowledges there will not be full feature parity at launch, though core capabilities like Agent Skills, Hooks, Subagents, and Extensions are preserved. Developers with complex configurations should begin migrating now rather than waiting until mid-June. Google has published technical documentation and plans to release video walkthroughs in the coming weeks.

AI summary · Generated from this article

Google announced Antigravity 2.0 at I/O 2026, rebuilding its agent-first coding tool from scratch into a full multi-agent developer platform. The original Antigravity launched in November 2025 as a single-agent IDE similar to Cursor. Version 2.0 is an entirely new standalone desktop application centered on orchestrating multiple AI agents simultaneously, alongside a new CLI built in Go, an SDK for custom agents, and Managed Agents through the Gemini API. The platform's core shift is parallelism. Developers can dispatch multiple agents to work on separate tasks at once rather than waiting for a linear chat response. Powering it all is Gemini 3.5 Flash, which Google claims outperforms Gemini 3.1 Pro on coding benchmarks while running four times faster. The headline demo showed Antigravity 2.0 building a functional operating system framework in roughly 12 hours using 93 parallel subagents for under $1,000 in compute costs. Gemini CLI users face a hard migration deadline of June 18, 2026, when existing tools stop serving requests. Anyone running agentic workflows today needs to evaluate this stack now.

AI summary · Generated from this article

Google unveiled Gemini Omni at its I/O developer conference on May 19, 2026, collapsing its previously fragmented AI media stack into a single natively multimodal model. Where Google once ran Veo for video, Imagen for images, and separate audio systems, Omni handles all of it inside one set of model weights. The first release, Gemini Omni Flash, is live now for Plus, Pro, and Ultra subscribers, with a Pro variant to follow. The model accepts any combination of text, images, audio, and video as input and produces video output through conversational, multi-turn editing. Each instruction builds on the last, preserving character identity and scene consistency throughout. Every output carries dual provenance protection via SynthID watermarking and C2PA content credentials. Clips are currently capped at 10 seconds, a compute decision rather than a model limitation. Google's real advantage here is distribution, not raw quality. Omni ships inside Search, YouTube, Flow, and the Gemini app, reaching two billion daily users. Whether unified architecture beats specialized competitors depends on whether formal benchmarks eventually back the claims.

AI summary · Generated from this article

The forrestchang/andrej-karpathy-skills repository went viral by packaging four Andrej Karpathy-inspired rules for better Claude Code behavior into a single CLAUDE.md file. GitHub showed 127K stars and 12.9K forks. The file tells Claude Code to think before coding, favor simple solutions, make surgical changes, and define verifiable success criteria. Because CLAUDE.md loads as persistent project context, developers can combine these behavioral rules with commands, conventions, security guidance, and recurring lessons to reduce assumptions, overengineering, noisy diffs, and unverified fixes.

AI summary · Generated from this article

Leaked internal builds of Google's Gemini desktop app reveal a major upgrade ahead of Google I/O 2026, repositioning the client as a full local AI agent platform. The update introduces two modes: Chat, the familiar conversational interface, and Spark, an agentic workspace that runs tasks continuously without waiting for user prompts. Spark's most significant capability is local file system access, letting the agent edit, analyze, move, and rename files in connected folders. Additional features include Stream to Cursor, which reads context based on cursor position and surfaces suggestions without manual input, and Gemini Live, a persistent floating voice overlay with real-time screen awareness. Veo4 Omni threads video generation directly into the desktop client alongside text and file workflows, pointing toward a unified multimodal system. For developers, this puts Gemini desktop in direct competition with Cursor and Claude Code. The key question heading into Google I/O is whether Google ships this as a coherent product or repeats the fragmented rollout that defined the initial Mac client launch.

AI summary · Generated from this article

OpenAI has released Codex CLI version 0.131.0, one of the more feature-dense updates to its open-source, Rust-built terminal coding agent. The release touches nearly every layer of the tool, from the terminal interface and plugin system to remote workflow infrastructure and the Python SDK. The most practically useful addition is the new codex doctor command, which runs structured diagnostics across runtime, auth, terminal, network, config, and local state in a single pass. The terminal UI now displays blended token usage, permissions, approval mode, and workspace roots directly in the status line. The unified @ mention picker searches files, directories, plugins, and skills together. The Python SDK was renamed to openai-codex with pinned runtime-generated types and concurrent turn routing, requiring import path updates for existing users. Teams building automation on top of Codex should watch the SDK rename closely, as pinned runtime types suggest OpenAI is treating it as a stable integration surface rather than a convenience wrapper.

AI summary · Generated from this article

Cursor has released Composer 2.5, its latest in-house AI coding model built into the Cursor IDE. The release is a direct response to growing competition from Claude Code, which has reportedly crossed $2.5 billion in annualized revenue. Rather than switching base models, Cursor kept the same open-source Kimi K2.5 checkpoint and invested 85% of total compute into post-training, demonstrating how much performance can be extracted without architectural changes. Three technical advances drove the gains. Cursor introduced targeted textual feedback to improve credit assignment during long RL rollouts, scaled synthetic training tasks to 25 times the volume used in Composer 2, and deployed a sharded Muon optimizer completing steps in 0.2 seconds on a one-trillion-parameter model. On SWE-Bench Multilingual, Composer 2.5 scores 79.8%, just behind Claude Opus 4.7's 80.5%. Pricing starts at $0.50 per million input tokens. Looking ahead, Cursor is partnering with SpaceXAI to train a larger model from scratch using 10 times more total compute, signaling that Composer 2.5 is a proof of training methodology rather than a ceiling.

AI summary · Generated from this article

Anthropic has doubled the weekly token allowances for Claude Design across all paid subscription tiers, including Pro, Max, Team, and Enterprise plans. The update comes after widespread complaints that users were exhausting their budgets after just three or four design prompts, making the tool feel more like a demo than a usable product. The increase is backed by a major infrastructure expansion, including a new compute agreement with SpaceX that gives Anthropic access to over 220,000 NVIDIA GPUs at the Colossus 1 data center. Alongside the Claude Design changes, Anthropic also doubled Claude Code rate limits, removed peak-hour restrictions for Pro and Max users, and dramatically raised API limits. One caveat: a new tokenizer in Opus 4.7 can consume up to 35 percent more tokens for the same text, partially offsetting the gains. The current limits are ongoing but remain beta-period rates subject to change. Anthropic's next scheduled adjustment is July 13, when a separate 50 percent Claude Code usage boost is set to expire, leaving open whether these expanded limits will hold long term.

AI summary · Generated from this article

A new open source project called free-claude-code lets developers run Claude Code without paying Anthropic API fees. It works as a local proxy that intercepts Claude Code's API calls and reroutes them to NVIDIA NIM's free inference tier, which provides 40 requests per minute at no cost. Setup requires no modifications to Claude Code itself, just two environment variables pointing to the proxy. The proxy handles five categories of lightweight requests locally to avoid consuming quota, translates Anthropic-formatted requests into OpenAI-compatible format, and correctly renders thinking tokens in the Claude Code UI. It supports ten provider backends including OpenRouter, DeepSeek, LM Studio, and Ollama, with per-model routing that lets developers send different Claude tiers to different providers simultaneously. The 40 RPM cap and occasional 429 errors during peak hours are real limitations worth noting. However, the per-model routing architecture has practical value even beyond cost savings, and the project is actively maintained and fully open source.

AI summary · Generated from this article

NVIDIA has released SANA-WM, a 2.6 billion parameter open-source world model capable of generating 60-second, 720p video with precise camera control on a single consumer GPU. World models synthesize realistic video from an initial image and a set of actions, making them central to robotics, simulation, and embodied AI research. Released in May 2026 and built on the NVlabs SANA codebase, which received an oral presentation at ICLR 2026, the model directly addresses the longstanding tradeoff between video quality and compute accessibility. Four architectural innovations drive its efficiency: frame-wise Gated DeltaNet for memory-efficient long-context modeling across 961 latent frames, a dual-branch camera control module for 6-DoF trajectory adherence, a two-stage generation pipeline with a long-video refiner, and a robust metric-scale pose annotation system. Trained on roughly 213,000 public video clips over 15 days on 64 H100s, SANA-WM delivers 36x the throughput of competing baselines. A distilled variant runs on a single RTX 5090, generating a full 60-second clip in just 34 seconds.

AI summary · Generated from this article

A critical server-side request forgery vulnerability in Next.js, tracked as CVE-2026-44578, is putting thousands of self-hosted applications at immediate risk of credential theft and unauthorized internal access. Disclosed on May 11, 2026, the flaw requires no authentication and no user interaction to exploit, affecting all self-hosted Next.js deployments running versions 13.4.13 through 15.5.15 and 16.0.0 through 16.2.4. Approximately 79,000 exposed instances are estimated to be exploitable today. The vulnerability lives in the WebSocket upgrade handler, where a missing validation check allows attackers to force the Next.js server to make outbound HTTP requests to any reachable internal host, including cloud metadata services like AWS IMDSv1, Azure IMDS, and DigitalOcean. Successful exploitation can expose temporary IAM credentials, API keys, and internal admin panels. Teams enforcing AWS IMDSv2 have partial protection, but everyone else is fully exposed. Patching to Next.js 15.5.16 or 16.2.5 is the only complete fix. After upgrading, rotate all application secrets immediately, including any AI provider API keys stored server-side.

AI summary · Generated from this article

A three-person security firm called Calif used Anthropic's Claude Mythos Preview AI to build the first publicly disclosed macOS kernel exploit capable of surviving Apple's Memory Integrity Enforcement protection on M5 hardware. The team completed a working exploit chain in roughly five days, a timeline that would have been unthinkable without AI assistance given the complexity of the target. The exploit is a data-only local privilege escalation chain targeting macOS 26.4.1. Rather than corrupting memory pointers, which MIE's hardware tag-checking is designed to catch, the team corrupted kernel data structures that the protection was never watching. Mythos accelerated bug discovery by recognizing known vulnerability classes at machine speed, while the human researchers handled the novel challenge of bypassing a brand-new hardware mitigation. Apple has not yet issued a patch, and Calif is withholding its 55-page technical report until one ships. The broader implication is stark: AI-assisted tooling is compressing exploit development timelines from months to days, reshaping the economics of both offensive research and defensive patching simultaneously.