Cohere signed a letter of intent for Prague-based AISLE, whose autonomous systems found all 12 CVEs in OpenSSL's January release and 18 of 24 in curl's latest, and says it wants to use those verifiable security problems to evaluate and train future models. The deal hasn't closed and terms weren't disclosed; AISLE CEO Ondrej Vlcek will lead the new Cohere Cyber unit (AISLE's post).
The MIT licensed CLI and MCP server backs up every server file a deploy overwrites, and restore puts them back but stops if someone edited a file live since. Its agent tools deliberately omit mirror delete and skip backup, a deploy only runs the exact plan the agent previewed, and SFTP passwords stay in the OS keychain, never in the model (Show HN, Oct 18)…
Reddit user u/AdIllustrious7246 turned PS5LM, a llama.cpp port for jailbroken consoles, into a native app that drives the GPU through the PS5 Vulkan RADV port and can use up to 11.4 GiB of memory, up from about 6 GiB as a CPU payload; smaller models like Gemma 4 E4B and Llama 3.2 3B hit 61 and 124 tokens per second. It adds a live stats dashboard and works with llama.cpp's web UI, so other devices on your network can chat with it…
Rolling out in the US and select markets to users 18+, apps built in AI Studio go straight to a Personal Library in the Play Store with no APK sideloading, $25 fee, or Google review, and sharing with a small group of friends and family is planned. Going public will mean onboarding to a developer profile and normal Play review, an option Google says arrives in the coming months (Google Play blog)…
Each card on MIKE's web kanban board is a task: pressing start runs an agent in a gVisor sandbox on its own Git worktree with a read only repo mount, retries failed tool calls, and parks stuck work in review for you. The author built it entirely with llama.cpp hosted local models and added client side rate limits, an offline friendly UI, and a bearer token REST API for starting tasks from scripts (Show HN)…
CVE 2026 102232 let prompt injection get the Copilot agent to edit a lifecycle hook file without confirmation, and CVE 2026 102851 let one sandboxed MCP server use another server's approved network and write permissions; the rest are Workspace Trust bypasses and click to run RCEs. Update to 1.141.1 or later (check pinned dev containers too), then re approve each MCP server's permissions, since the fix ignores old shared grants…
Spotted something we missed? Start a thread.