<h2>Must know</h2>
<ul>
<li><strong>Anthropic accuses Chinese labs of industrial-scale AI model theft</strong>: Anthropic has publicly accused Chinese AI labs DeepSeek, Moonshot AI, and MiniMax of conducting “industrial-scale distillation attacks” on its Claude models. They claim these labs created over 24,000 fraudulent accounts to generate more than 16 million exchanges with Claude, extracting its capabilities like agentic reasoning and tool use. Anthropic frames this as a national security threat, arguing that distilled models may lack safety guardrails and could be misused, conveniently aligning with ongoing U.S. debates on AI chip export controls. <a href="https://app.daily.dev/posts/YcZmCF704" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>AI-augmented cyberattacks compromise FortiGate firewalls</strong>: A financially motivated, Russian-speaking threat actor compromised over 600 FortiGate firewall instances across 55+ countries, leveraging generative AI tools throughout the attack. AWS detected this activity, noting the attackers used AI for reconnaissance, generating exploitation instructions, writing scripts, and creating operational notes. This demonstrates how even unsophisticated groups can scale operations with AI, though AWS emphasizes that basic security hygiene like MFA and restricted management interface exposure would have prevented most attacks. <a href="https://app.daily.dev/posts/azBzuZltn" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Ladybird browser pivots to Rust with AI assistance</strong>: The Ladybird independent web browser project is pivoting from C++ to Rust, primarily for memory safety, after a year-long detour with Swift proved problematic due to limited C++ interop. Lead developer Andreas Kling used Claude Code and Codex AI agents to assist in translating 25,000 lines of C++ to Rust in just two weeks, a task estimated to take months manually. This human-directed AI workflow resulted in byte-for-byte identical output for key components, with zero test regressions. <a href="https://app.daily.dev/posts/bavH6r0ZC" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Good to know</h2>
<ul>
<li><strong>Cohere launches Aya Tiny multilingual models</strong>: Cohere released the Aya Tiny model family, small (~3.3B parameter) multilingual language models designed to support over 70 languages, including low-resource ones, and capable of running on mobile devices. <a href="https://app.daily.dev/posts/QusoaclzE" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>OpenAI releases gpt-realtime-1.5 for real-time voice AI</strong>: OpenAI released gpt-realtime-1.5 via its Realtime API, focusing on strengthening voice workflows with improved instruction following, enhanced tool calling, and better multilingual accuracy for low-latency speech-to-speech interactions. <a href="https://app.daily.dev/posts/6I1BavGOr" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>GitHub launches Agent HQ for unified AI coding agents</strong>: GitHub introduced Agent HQ, a unified platform for coding agents like Claude, Codex, and GitHub Copilot, allowing users to run and compare multiple frontier agents simultaneously within VS Code, GitHub, and soon Copilot CLI. <a href="https://app.daily.dev/posts/CxN7d4Xat" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Uber open-sources uForwarder Kafka consumer proxy</strong>: Uber open-sourced uForwarder, a push-based Kafka consumer proxy designed to handle trillions of messages daily, centralizing offset management and simplifying consumer logic for microservices. <a href="https://app.daily.dev/posts/NOSp6Xv2e" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>ZeroDayRAT mobile spyware emerges, bypasses MFA</strong>: ZeroDayRAT, a new mobile spyware family sold openly on Telegram for $2,000, targets Android 5-16 and iOS up to 26, offering capabilities like keylogging, SMS control (for MFA bypass), screen recording, and credential theft. <a href="https://app.daily.dev/posts/Q0yMWpjwU" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Starkiller phishing kit bypasses MFA</strong>: Starkiller, a Phishing-as-a-Service (PhaaS) toolkit, bypasses MFA and traditional phishing detection by live-proxying real login pages through attacker-controlled cloud infrastructure, capturing credentials and authenticated session tokens. <a href="https://app.daily.dev/posts/9TGsm3aiu" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Krafton appoints chief AI officer for ‘AI first’ strategy</strong>: Krafton, publisher of PUBG, appointed Kangwook Lee as its first Chief AI Officer (CAIO) as part of its “AI First” strategy, focusing on enhancing gameplay, streamlining developer workflows, and long-term research, including a new robotics entity. <a href="https://app.daily.dev/posts/IUxnxAIyr" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Bullshit police</h2>
<ul>
<li><strong>Anthropic’s AI security tool causes market stir</strong>: Anthropic launched Claude Code Security, an AI-powered tool for vulnerability detection, which apparently triggered a “notable selloff” in cybersecurity stocks. Analysts called the market reaction “illogical,” and security experts are raising concerns about outsourcing security definitions to a non-deterministic model. Because, you know, an AI that finds 500 vulnerabilities without publishing false-positive rates or cost data is totally trustworthy and not just marketing fluff. <a href="https://app.daily.dev/posts/bgcFYmVK1" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Google DeepMind’s ‘embarrassingly elegant’ image generation fix</strong>: Google DeepMind reportedly “solved a significant problem in image generation” with a fix described as “embarrassingly elegant” by some random Twitter user. No actual details, no official announcement, just pure, unadulterated hype from a social media retweet. Because if it’s on Twitter, it must be true, and if it’s “embarrassingly elegant,” it’s probably just a slightly less bad way to generate another blurry cat picture. <a href="https://app.daily.dev/posts/fzJvtM3B4" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>OpenAI updates AI coding evaluation standard</strong>: OpenAI announced a change in its recommended standard for frontier coding evaluations, now pushing SWE-bench Pro because the previous benchmark, SWE-bench Verified, became “saturated due to test-design issues and contamination from public repositories.” So, after everyone spent time optimizing for the old benchmark, OpenAI just moves the goalposts. Classic. Always chasing that elusive, un-gamed benchmark, aren’t we? <a href="https://app.daily.dev/posts/oZGyDrjcX" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
