Standard Intelligence trained a general-purpose computer action foundation model on 11 million hours of screen recordings. Instead of an LLM, FDM-1 operates directly on video and action tokens, achieving 50-100x compression efficiency over existing VLMs with a custom encoder.
Set up the CLI version of NDLOCR-Lite on Apple Silicon Mac, then tested OCR result correction with Qwen 3.5 and Swallow. Includes experiments with direct image reading and the anchoring effect.
Setup notes for running WAI-Illustrious SDXL v16 on ComfyUI with an 8GB RTX 4060 Laptop. 1024x1024 generates in ~15 seconds without --lowvram, and a LoRA still loads. CUDA 12.8 portable build and path gotchas included.
Trend Micro analyzed a new AMOS distribution method that targets AI agent workflows. A malicious SKILL.md on OpenClaw plants fake CLI install instructions and uses AI as the intermediary to manipulate people.
One engineer plus AI reimplemented Next.js on Vite for about $1,100 in token cost. The result, vinext, shipped with 4.4x faster builds and a 57% smaller bundle, and is already running in production during its first week.
Firefox 148 is the first browser to ship the Sanitizer API. With setHTML(), developers finally have a standard browser-level way to replace innerHTML safely and eliminate XSS with minimal code changes.
Tried the lightweight OCR tool NDLOCR-Lite released by the National Diet Library — installed it on Windows 11 and tested both the CLI and GUI versions.
Design and implementation of Kana Chat, a personal AI agent system that wraps official CLIs. Covers the tmux bridge, context isolation, and tool approval gate that make it safe to run in your own environment.
Anthropic accused three Chinese AI companies of distilling Claude, and on the same day OpenAI retired SWE-bench Verified. Training fraud and evaluation flaws exposed simultaneously on February 23, 2026.
A look at Anthropic’s Claude Code Security: its technical approach, false‑positive mitigations, the GitHub Action, comparisons with competing tools, and why $15B briefly vanished from cybersecurity stocks.
Socket reports an active campaign using 19 malicious npm packages. It targets AI development environments such as Claude, Cursor, and VS Code, stealing SSH keys, npm tokens, and API keys, and then propagates via a worm.
Techniques and defenses from the MINJA, InjecMEM, and ToxicSkills campaigns that poison AI agents’ memory files, and the fact that GPT-5.3-Codex achieved a 72% exploit success rate on EVMbench released by OpenAI and Paradigm. This article organizes how AI becomes both a target of attacks and a weapon for attackers.
