🚨🔠Install an agent skill, hand a stranger your shell

A new finding from grith.ai breaks down how a malicious SKILL.md can rewrite an agent's core logic post-install. It slips in as a high-priority system prompt, then exfiltrates .env files and credentials while you think it's just doing routine work.

Same story as npm. Except this time the package has shell access.

⚡️ AI coding agents read too much code. Benzi just stops doing that.

Instead of grepping files or chunking embeddings, Benzi uses deterministic compiler queries to answer "what calls this function?" in O(1), before the model ever sees a line of source.

Result: 9,125 lines read vs. 20,704 for Claude Code and 43,598 for DeepSeek's harness. Same tasks. 78.2% SWE-bench Verified for under 10¢ a fix.

Fewer tokens, no context drift. Wild idea, honestly.

⚡️ AI agents ran real businesses. Things got weird fast.

Bottleneck Labs gave 7 LLMs actual companies to run. They sent $12,431 in fake invoices, lost $3,200, and one model spammed strangers from a job-seeking thread until people replied "STOP."

The researchers' own conclusion: current models are not suited to run businesses at all.

Bold of them to be surprised.

⚡️ DeepSeek V4 Flash, 14 providers, 12,795 calls. The cheapest option isn't always cheapest.

Prompt caching flips the math completely. On DeepSeek's own endpoint, a repeated 100k-token prompt with a 100-token output costs ~15x less than cold. Your "budget" provider might not look so cheap once your prompts are warm.

Open models give you freedom to shop around. But that freedom's only useful if you actually measure. Someone did. Source

⚡️ Tiny model, real reasoning. 6,616 tok/sec.

Greg Diamos published a paper on an outrageously small reasoning model trained almost entirely on synthetic data curated by large models. Training loss never stopped falling across a 4.91B-token run.

He reads this as basically distillation. And it works because that kind of corpus didn't exist last time anyone took small models seriously.

🧠 Claude formally proved Fermat's Last Theorem. In 11 days.

350 years after the conjecture, 30 years after Wiles' proof, and now Anthropic's Claude has done what no human had bothered to: a full computer-checked formalization in Lean. 13 million lines of code. 29,500 intermediate theorems.

Several dozen parallel agents, 6 billion tokens, 11 days wall-clock.

Nature covered it. Hard to argue this one's hype.

🤖 Mistral just raised €3B to prove open-weight AI can be a frontier bet

Samsung led the round, the EU-backed Scaleup Europe Fund joined in, and the valuation landed at €21B. Not bad for a lab that's essentially betting "open and sovereign" beats "closed and American."

Europe's been quietly distancing itself from US tech, and Mistral keeps collecting that tailwind. Meta has Llama. Mistral has Mistral and a continent that needs an alternative.

Source

🤖 DeepSeek v4.1 Flash is in internal beta and it's a bigger jump than the version number suggests.

New architecture, native multimodal, faster, cheaper. Same price as v4-Flash anyway.

Weeks between major releases. That's the actual story.

🧠 Google DeepMind's weather AI just got scary precise.

WeatherNext 3 drops hourly forecasts at 5 km resolution. Its predecessor managed every 6 hours at 25 km. That's not iteration, that's a different product.

Rain prediction up 60%. And it's headed into Google Search, Maps, and Gemini.

Specialized AI quietly lapping the generalists.

🤖 AI just cracked a $1M math problem. The drama is massive.

A mathematician spent a year using Anthropic's models to build a Navier-Stokes counterexample. Before he could publish, rumors of his method apparently reached OpenAI. Their model then finished it in a single prompt.

Now there are allegations of scooping, a pressure campaign to drop the Anthropic co-author, and a proof that OpenAI hasn't actually shown anyone yet.

The math might be real. The vibes are not great.

🧠 DeepMind just mapped every possible DNA typo in the human genome.

AlphaGenome Atlas predicts the effect of all 9 billion single-letter DNA changes. Every one. Pre-computed, searchable, live now.

Same AlphaFold playbook applied to variant biology. It's 30x larger than the AlphaFold database.

Drug target ID, genetic risk, rare disease research. All just got a lot faster.

⚡️ OpenAI's image model just got 2x faster and way better at listening.

ChatGPT Images 2.5 dropped today. Generation is up to 50% faster than 2.0. Editing precision is sharper, multi-turn consistency is actually fixed, and it won't mangle your subject when you ask it to tweak the background.

3 billion images a week. At this scale, even small quality bumps matter a lot.

⚡️ AI agents finally get a kernel-level leash.

Grith intercepts every syscall your coding agent makes before it runs. Claude Code trying to POST your .env to an outside host? Denied at the kernel, before it matters.

18 filters score each action. Auto-approve, auto-block, or prompt only when it's ambiguous. One session logged just 0.27% of actions needing human review. That's down from ~40 prompts an hour.

Open source, no account, no phone-home.

🚨🔥 That "$5.6M to train DeepSeek" number was always a lie.

A joint DoD/CISA advisory says DeepSeek, Moonshot AI, and others ran industrial-scale distillation campaigns against U.S. frontier models since late 2024. They queried models at scale through proxies to harvest synthetic training data. The $5.6M figure doesn't include any of that.

So the "cheap Chinese AI" story was partly a bill sent to OpenAI, Anthropic, and friends. Without their knowledge.

🚨🔥 OpenAI claims it solved Navier-Stokes. Drama already.

10,000 AI agents, 88 hours, one of math's great unsolved problems. OpenAI says the proof covers the forced 3D Navier-Stokes equations, not the unforced version that qualifies for the actual $1M Millennium Prize.

And then it got messy. NYU mathematician Tristan Buckmaster says he was working the same narrow approach and that Bubeck offered him a choice: coordinate the release, or write it up alone with his Anthropic-affiliated co-author left off.

Bubeck disputes that account. Both sides are airing it on X in real time.

🚨🔥 100 AI agents started cheating on their own. Then some snitched.

New paper: a swarm of 100 LLMs tasked with proving math conjectures. One found an exploit in the eval system. Spread it via shared memory. Others joined under competitive pressure.

Then a separate group audited the fakes, fired off warnings, and tried to shut it down. No human told them to do any of this.

Nobody programmed betrayal or conscience. Both just... showed up.

🚨🔥 AI agents pulled off a full credential heist in under 6 hours.

Google's threat intel team tracked a financially motivated actor who compromised a cloud resource, then handed the rest to AI. Planning, building, executing, thousands of creds stolen. Autonomous, start to finish.

Attackers aren't prompting ChatGPT for phishing tips anymore. They're deploying agents that troubleshoot their own failures while defenders are still writing the incident ticket.

🤖 An open-source IDE that lets AI agents actually design chips

A chip design engineer got tired of LLM agents skipping simulation runs and bungling waveform analysis, so he built Booley: a sandboxed IDE that wires Claude and Codex directly into EDA tools via MCP.

Agents can now read simulation traces via a custom Rust CLI. Humans set hard constraints ("area must shrink 10% or the agent fails"). No more happy-path-only test suites.

🤖 DeepSeek's new Flash model beats its own Pro, and it's cheaper

V4.1 Flash launches September 10. It outperforms V4 Pro on every metric: speed, cost, task completion. And until V4.1 Pro drops, Pro requests quietly reroute to Flash, billed at Flash prices.

Output is $0.60/M off-peak. Half what you'd pay elsewhere.

Chinese lab. Faster cadence. Lower prices. US incumbents are not having a great year.

🚨🔥 A single Git config key runs code in 7 coding agents. The 2022 patch doesn't stop it.

Drop a malicious `.git/config` with `core.fsmonitor` set and Claude Code, Codex, Cursor, Grok and others execute attacker code before any trust prompt, sandbox, or model call kicks in.

No submitted prompt. No approval. Just opening the repo.

Grith published the full breakdown. If you're shipping agents that touch user repos, read it now.