<h2>Must know</h2>
<ul>
<li><strong>AI-generated malware: the VoidLink case</strong>: Check Point Research identified VoidLink as the first fully AI-generated advanced malware, developed by a single, unidentified individual in less than a week using TRAE IDE and AI agents. This 88,000-line codebase includes eBPF rootkits and cloud enumeration modules, demonstrating a significant leap in the speed and complexity of cyber threat development via AI automation. This marks a shift from theoretical AI threats to actualized incidents, according to Check Point Research. <a href="https://app.daily.dev/posts/nLTC7GTyu" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Anthropic Git MCP server vulnerabilities expose AI agents to prompt injection</strong>: Anthropic’s mcp-server-git versions prior to 2025.12.18 contain critical vulnerabilities (CVE-2025-68143, CVE-2025-68144, CVE-2025-68145) that enable prompt injection, unauthorized code execution, and LLM tampering. These flaws, including path validation bypass and argument injection, can be chained to compromise AI agent systems. Immediate updates to version 2025.12.18 or later are crucial, along with monitoring for unexpected .git directories, as reported by security advisories. <a href="https://app.daily.dev/feed-by-ids?id=U6A8HrCeq&amp;id=rKbuKp9sI" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Chainlit AI framework critical vulnerabilities</strong>: Chainlit, a popular open-source Python framework for AI chatbots, was found to have critical vulnerabilities (CVE-2026-22218, CVE-2026-22219) allowing arbitrary file reads and server-side request forgery. These flaws expose API keys, credentials, and cloud tokens, enabling data theft and lateral movement within enterprise infrastructure. Patched in version 2.9.4, immediate updates are urged to prevent compromise of sensitive AI systems. <a href="https://app.daily.dev/posts/I9vckVFsM" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Good to know</h2>
<ul>
<li><strong>Kubernetes becomes core AI infrastructure</strong>: Kubernetes production usage is up to 82%, with 66% of organizations using it for AI inference workloads, solidifying its role as the standard infrastructure layer for AI, according to the 2025 CNCF Annual Cloud Native Survey. <a href="https://app.daily.dev/feed-by-ids?id=Lwsgn3lZ5&amp;id=zVJaiO8vu" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>GLM-4.7 Flash sets new local AI coding benchmark</strong>: The new GLM-4.7 Flash model, a 30B parameter AI coding model with a mixture-of-experts architecture, claims superior benchmark results over Qwen 3-30B-A3B on SWBench and Tau Squared Bench, offering efficient self-hosted coding and agentic workloads. <a href="https://app.daily.dev/posts/eWdzokgG0" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Google Gemini prompt injection vulnerability via calendar events</strong>: Security researchers discovered a vulnerability in Google Gemini where malicious calendar invitations could embed instructions, manipulating Gemini’s behavior and potentially exfiltrating private meeting information when users queried their schedules. <a href="https://app.daily.dev/feed-by-ids?id=dHjNBMkFO&amp;id=j6bBmLvCW" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Local consumer hardware powers advanced real-time AI models</strong>: Overworld Labs launched Waypoint One, a 2-billion parameter world model capable of real-time (60 fps) rendering on consumer GPUs, and a cluster of four Mac Studios demonstrated running trillion-parameter language models, showcasing the feasibility of high-performance AI on local hardware. <a href="https://app.daily.dev/feed-by-ids?id=6WMnchWXn&amp;id=ldj4BJlKy" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>AI-generated code raises security concerns for 2026</strong>: Security experts warn that AI-generated code in production, especially for critical systems, poses severe risks due to potential vulnerabilities inherited from training data and insufficient human review, recommending the use of battle-tested libraries and strongly typed languages like Rust. <a href="https://app.daily.dev/posts/rlAZMkOYu" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>GitHub adds code-to-cloud traceability and SLSA Build L3 security</strong>: GitHub released artifact metadata APIs for code-to-cloud traceability, enabling security teams to prioritize vulnerabilities based on deployment context and supporting SLSA Build Level 3 security with cryptographic attestations for build artifacts. <a href="https://app.daily.dev/posts/9XGazeUyY" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Unreal Fest Chicago 2026 announced</strong>: Epic Games announced Unreal Fest Chicago 2026, featuring keynotes, technical sessions, and hands-on demos for Unreal Engine, UEFN, Fab, and MetaHuman Creator, targeting developers and industry professionals. <a href="https://app.daily.dev/posts/gc3AbrVid" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Bullshit police</h2>
<ul>
<li><strong>AI will make you a 100x developer, just ignore the security flaws</strong>: Apparently, AI coding tools like <a href="http://Pythagora.ai" target="_blank" rel="noopener nofollow">Pythagora.ai</a> can generate full-stack apps from prompts in hours, and new books promise to teach beginners game development with AI, no coding required. It’s almost as if the industry wants us to believe that deep technical expertise is now optional. Just don’t ask about the 322% increase in security vulnerabilities or the declining code stability that comes with this ‘progress,’ as some reports conveniently gloss over. <a href="https://app.daily.dev/posts/zWcZCkr3l" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>AI-powered customer onboarding: because humans are so last year</strong>: Remote is now using LangChain and LangGraph to automate customer onboarding, claiming to reduce data migration times from days to hours. Meanwhile, Clarm, a Y Combinator-backed startup, boasts ‘zero-hallucination AI responses’ for lead generation. It’s truly inspiring how these companies are solving complex problems with AI, as long as you don’t question what ‘zero-hallucination’ actually means or how much human oversight is still required to prevent a complete data apocalypse. <a href="https://app.daily.dev/feed-by-ids?id=5joRPhN74&amp;id=HWjGJHh6I&amp;id=U5DB6Li1&amp;id=dHKZJUL6N&amp;id=jHrHB1kVi" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Wikipedia needs a ‘Bullshit Police’ for AI-generated content</strong>: Wikipedia has launched ‘WikiProject AI Cleanup’ to combat AI-generated inaccuracies, while a police chief retired after Microsoft Copilot fabricated a report that led to banning Israeli fans from a football match. It seems AI is so good at generating plausible-sounding nonsense that even official institutions need dedicated teams to fact-check it. Perhaps we should just let the AI write all the news, and then have another AI verify it. What could possibly go wrong? <a href="https://app.daily.dev/posts/5NpQUB2lE" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
