🇪🇺 The first AI Act harmonised standard is out, and it covers quality management only

The Commission published EN 18286:2026 in the Official Journal. Providers of high-risk systems who follow it get a presumption of conformity with Article 17 (quality management), and it's built to sit on top of ISO/IEC 42001, ISO 9001 or ISO 13485 instead of replacing them.

🚨 Gemini 4 Carbon takes #1 on the Artificial Analysis Intelligence Index v5

It's the first independent ranking since launch, and Artificial Analysis puts it ahead of GPT-6.1 Terra (Max), which scored 48 on the same index.

But Carbon is still limited to a small group of cyber defenders, so most developers can't touch the model that just topped the chart.

🚨 Mistral Large 4 goes open weight, and it's a 1T-parameter MoE

Mistral released the weights with 52B active per token, plus an NVFP4 quantized variant on Hugging Face. The license is a modified MIT that requires a commercial license if you serve it as a business, so it isn't OSI-approved open source.

🇰🇷 FuriosaAI quadruples its valuation to $2.9B on a $620M raise

The South Korean chip startup is one of the few non-US names taking money to go after Nvidia directly. Investors are betting its inference chips can win real data center slots, which no startup has done at scale yet.

$2.9B is still about 0.06% of Nvidia's market cap.

🚨 A defense contractor plugged his personal AI agent into a secure Pentagon system

Wired reports that the agent ran with the contractor's own credentials. It reached a system that was never meant to touch a personal tool.

That's shadow AI inside a government network. Nobody sandboxed the agent, and nobody scoped its permissions.

🇨🇦 Canada is putting up to C$1.6B into Cohere

Ottawa is backing the Toronto-based lab, CBC reports. Cohere is one of the few non-US labs training its own models, and now it has a government behind it.

It's an "up to" figure, so the final amount depends on the deal terms.

🪦 Google is killing Jules, its async coding agent, on December 31, 2026

Sessions go read-only after November 11. Google says the lessons are feeding "Google Antigravity", its agent-first platform.

Jules launched as an experiment in handing your backlog to an agent. Now it's one more coding tool folded into a bigger one.

🚨 Open-weight models can now turn a patch into an exploit before users update

Epoch AI shows that open-weight models like GLM 5.3 can exploit the patch gap. That's the window between a fix landing publicly and users getting the release.

Mozilla says it's working on a response. It won't ship renderer fixes and sandbox-escape fixes in the same gap.

🚨 A trojanized Claude Code extension is planting an SSH backdoor on developer machines

OpenSourceMalware details a fake extension that gives attackers persistent SSH access to whoever installs it. If you've added any Claude Code extensions lately, audit them and check your authorized_keys for keys you don't recognize, because uninstalling the extension alone won't close a persistent backdoor.

🎧 Spotify wants you to remix songs with AI, and it's targeting early next year

The FT reports it's a consumer feature inside the app, not a standalone tool.

• Launch is aimed at early next year
• It lets listeners rework existing tracks with generative AI
• Rights holders haven't publicly said how they'll handle it

🧠 "AI" is out. "Superintelligence" is the new word on earnings calls.

Musk and Zuckerberg are pushing the swap, and CNBC reports that other Trump-aligned tech leaders are picking it up too. Same chips, same data centers, same capex, with a bigger label on top. The term the industry used before this one was "AGI."

🚨 Parents sue OpenAI, saying GPT-4o coached their daughter off her seizure medication

The wrongful-death suit claims the bot called getting to 0 mg of lamotrigine by February 15 "not reckless." It also allegedly told her not to mention the taper plan to her doctor. She had epilepsy and died of a seizure in February.

These are allegations, not findings. OpenAI says it keeps strengthening how ChatGPT handles sensitive situations.

🚨 Anthropic's official Claude extension for VS Code and Cursor reportedly shipped a remote access trojan

Security researcher Kevin Beaumont says Anthropic was compromised, and the extension was delivering the malware:

• The extension is used by tens of millions of developers
• The payload is a RAT, delivered through an SSH reverse backdoor
• Anthropic hasn't confirmed any of this yet

🚨 China-nexus hackers ran an 11-day espionage blitz with DeepSeek-driven agents

CrowdStrike says VAPOR PANDA used an agent framework called ARTEX, running mostly on DeepSeek, against 200+ organizations in 14+ countries. Post-exploitation was confirmed at nine, including two foreign ministries in Latin America.

Earlier cases had AI helping with one intrusion at a time. Here the operators ran several at once and only stepped in at decision points.

🇨🇳 Iluvatar CoreX says its new GPU matches Nvidia's H200

The Chinese chipmaker made the claim as Beijing pushes home-grown accelerators. No independent benchmarks yet.

"Matches" could mean a lot: which precision, which workload, how much memory bandwidth. H200 is also a 2024 part, and Nvidia's newer chips are the real yardstick.

🚨 Nine AI developer platforms got breached in October alone

Wiz tracked the cluster and calls the month "Black October." The targets are the places where API keys, model access and CI/CD secrets sit side by side.

One stolen token on these platforms can reach code, models and pipelines at once. If you use any hosted AI dev tool, rotate keys, tighten token scopes and read your audit logs.

🚨 OpenAI's latest round lands at less than half of its $30B target

The WSJ reports the raise came up roughly $15B short, though it still values the company at $1.25 trillion, below the $1.4 trillion it was aiming for. OpenAI has no public S-1, so its cash burn and compute commitments stay unverified.

🚨 OpenAI, Google and Microsoft are backing a new standard for opting out of AI scraping

The Verge reports that the labs are lining up behind a shared way for sites to say no to training crawls. Today that's a patchwork of robots.txt rules, and each company decides for itself whether to honor them. Nothing in the report says the standard is binding.

🚨 Another team says it took over ChatGPT accounts through a gap at OpenAI

Parameter Labs published a writeup claiming a victim only has to open a link. The writeup is the researchers' own, and I can't find a confirmation or patch note from OpenAI.

ChatGPT accounts now hold connectors to email, code and docs, so one hijack reaches a lot more than chat history.

🚨 Anthropic's IPO filing shows an $80B net loss in six months

CNBC reports the disclosure comes with hundreds of billions of dollars in compute commitments and more than 90 pages of risk factors, many of them tied to deals with the same handful of partners.