#llm

We did not enable internet access or inter-agent communication for many of the environments in these training experiments. Despite these restrictions, the agents discovered ways to exploit our research infrastructure to communicate with one another and access the internet.

The models first found ways to communicate by writing files into the Artifactory package manager. This effectively turned Artifactory into an unintended message board, where agents could exchange information with one another. Read more: How agents used the message board 

The agents also found ways to get access to the internet. Using an exploit⁠(opens in a new window), the agents made Artifactory, which itself had access to the internet for the limited purpose of downloading and installing packages, send any internet requests on their behalf. After the agents discovered these methods for obtaining internet access, they also shared them with other agents through the message board, which provided information to enable additional agents to exploit our infrastructure.

Existing Gmail and Outlook MCP servers route queries through Google/Microsoft APIs. With stalwart-mcp, AI queries hit your Stalwart instance directly. Mail data never leaves your infrastructure; only the AI questions and answers go to the LLM provider.

Still, until now, most of Stripe’s large acquisitions have been related to helping people collect and manage incoming cash. Buying OpenRouter looks like a move to the other side of the ledger, too: expense management, beginning with AI expenses.

This acquisition “is Stripe’s deliberate attempt to embed itself into the middle of capital flows in the AI era,” said PitchBook’s research analyst Franco Granda.

It’s joining an unusual assortment of companies also entering token expense management. Databricks developed its own AI gateway. Rippling just launched one focused on employee AI spend and ROI. Ramp just launched one, also for AI expense management. And the list goes on.

Imran's thing

Arango ingests fragmented enterprise data and builds a graph-native context layer that your AI agent, app, and workload queries directly.

Nice write up of the concepts in the video and repo.

We’re implementing watermarking to comply with the EU AI Act. Anthropic, along with several other major AI model providers and around 190 total signatories, signed the EU Code of Practice on Transparency of AI-Generated Content in July 2026. This requires AI system providers to use methods of “marking” AI-generated text. We’re applying watermarking globally at launch because we don't yet have a durable way to scope it by region. However, we will continue to evaluate different approaches, and will share updates when we have them.

We will soon be offering a watermark detection API. We’re in the process of working out the details of its implementation.

When Claude produces a file of a supported type (such as a .png, .jpg, or .svg), it will attach a content credential in the form of a small, cryptographically signed note in the file’s metadata, saying that the file was made or processed with Claude. This is an open industry standard called C2PA—the same used by camera manufacturers and in photo-editing software to record where an image came from. Any C2PA-aware tool can read it; we’ll be providing our own where you can drop a file and check.

This metadata label is very different from a watermark. Nothing in the file changes—it is not embedded or hidden. As with text, the credential only says Claude was involved in producing the file; it doesn’t include any identifying information.

AI detection software uses a different method, because the companies that provide it don’t have our key. Among other things, those services look at aspects of the text like the subtle (and not-so-subtle) “tells” that often appear in AI’s phrasing. For example, AI models appear to be fond of the construction “this isn’t [X], it’s [Y]”, and use the word “quietly” a lot more than you might expect. Picking up on these patterns is fundamentally different from checking for a watermark.

No. A watermark only helps test whether Claude might have produced or processed the content. It doesn’t say anything about ownership or authorship, and doesn’t change a user’s rights under our terms. We only apply the watermark when Claude was involved in processing the content or file.

Intuitiveness for the implementation details:

A useful analogy is to imagine you’re playing a game like Monopoly. On each turn, each player moves a random number of spaces around the board according to the roll of a die. Suppose that, instead of rolling the die to get this randomness, we decided to use a book of the digits of pi.2 We start from a randomly-chosen digit (say, the 1,012,845th after the decimal place, which happens to be a 6), and from that point on each player simply uses the next digit in the sequence as their next “roll."

For all intents and purposes, the moves are still random: it makes no difference to the players—or to the outcome of the game—whether the randomness comes from pi or from dice rolls each time. But if we could see the sequence of all the moves after the game (and we knew the value of pi), we could work out whether this was a game that likely used pi to determine its moves. The game that used pi is, in a sense, “watermarked."

TLDR:

gh skill install github/gh-stack --agent claude-code --scope user

Use --agent and --scope to control placement, or --dir for a custom directory. The default scope is project, and the default agent is github-copilot (when running non-interactively).

• One worm took twelve unrelated organisations between 09:35 and 13:18 UTC on 4 August 2026, each republishing its whole namespace within seconds.

• The confirmed footprint is 2,234 poisoned versions across 444 package names. latest still resolves to a poisoned version on most affected names, so upgrading is not a fix. The maintainers have since cleaned the keyv and cacheable family and unpublished its poisoned releases, which does not help a lockfile pinned while they were live.

• Every poisoned release adds "preinstall": "node setup.mjs", which runs on a bare npm install. Disable install scripts in CI, and treat any npm token used in CI during the window as compromised.

• The payload steals GitHub, npm, AWS, GCP, Azure, Stripe, Vault and Kubernetes credentials, scrapes GitHub Actions runner memory, and can republish packages with valid SLSA provenance.

• It installs a dead-man’s switch that polls GitHub with the stolen token and executes a handler when that token is revoked. Hunt it before rotating anything, because rotation is the trigger.

• Poisoned packages include the auth libraries @or-sdk/auth, @or-sdk/api-tokens, @or-sdk/permissions and @arv-bedrock/auth. The @ornikar packages are mostly lint and build configs, which land on CI runners and developer laptops as dev dependencies.

• There is no C2 host. Exfiltration rides GitHub dead-drop repositories and Actions artifacts under RSA-4096 encryption, and stage one pulls its runtime from the official Bun releases, so no attacker domain appears at either stage.

• 546 dead-drop repositories described Shai-Hulud: Here We Go Again appeared on 4 August 2026, and the same marker appears on the TanStack compromise dated 11 May 2026.

• The keyv repository also ships .claude/settings.json and .vscode/tasks.json hooks that execute when the project opens in an IDE or agent session. Both are still on main.

• The commit that added those hooks shows as verified by GitHub with its author spoofed to github-actions[bot], and the poisoned keyv release carries intact OIDC and SLSA attestation. Trust neither signal here.

MLX is an array framework for machine learning on Apple silicon, brought to you by Apple machine learning research.

Some key features of MLX include:

• Familiar APIs: MLX has a Python API that closely follows NumPy. MLX also has fully featured C++, C, and Swift APIs, which closely mirror the Python API. MLX has higher-level packages like mlx.nn and mlx.optimizers with APIs that closely follow PyTorch to simplify building more complex models.

• Composable function transformations: MLX supports composable function transformations for automatic differentiation, automatic vectorization, and computation graph optimization.

• Lazy computation: Computations in MLX are lazy. Arrays are only materialized when needed.

• Dynamic graph construction: Computation graphs in MLX are constructed dynamically. Changing the shapes of function arguments does not trigger slow compilations, and debugging is simple and intuitive.

• Multi-device: Operations can run on any of the supported devices (currently the CPU and the GPU).

• Unified memory: A notable difference from MLX and other frameworks is the unified memory model. Arrays in MLX live in shared memory. Operations on MLX arrays can be performed on any of the supported device types without transferring data.

MLX is designed by machine learning researchers for machine learning researchers. The framework is intended to be user-friendly, but still efficient to train and deploy models. The design of the framework itself is also conceptually simple. We intend to make it easy for researchers to extend and improve MLX with the goal of quickly exploring new ideas.

The design of MLX is inspired by frameworks like NumPy, PyTorch, Jax, and ArrayFire.

At 9:20:

So for example, I'll give you at LinkedIn we used to have product managers, we had designers, we had front-end engineers and then we had back-end engineers and so on. So what we did is we sort of took those first four roles and combined them. In fact, increased scope and said, let's they're all full stack builders. So I like that because that's a structural change that allows for us to increase the change both the work and the workflow between these functions.

at the same time as you can imagine if to build an AI product today there's a complete new workflow right it starts with eval right so basically there's this eval to science to infrastructure and so eval are done by these full stack builders and what have you and product managers in the new form. The infrastructure is built by the systems engineers at the back end because they support the science that supports the product.

So in some sense there's a new loop uh and you have to structurally change and so a lot of what is happening inside a tech is that change uh which is I think going to be pretty massive uh and at the same time a company like ours I have to do everything it's not like I can just so go live in the future I have to make sure we're doing a fantastic job of doing hot patching on Windows is done with quality uh while at the same time building the evals that are improving co-pilot quality right and so both of those have to be first class. – Satya Nadella

Figuring out when and how to use these tools appropriately and productively will take time.  When the same tools are available to everyone, the differentiator will be in how we use the tools, not the tools themselves.  By default, they are homogenization machines, spinning out lookalike content for everyone.  It takes work and creativity to use them in ways that will actually stand out.

NISQA is a deep learning model/framework for speech quality prediction. The NISQA model weights can be used to predict the quality of a speech sample that has been sent through a communication system (e.g telephone or video call). Besides overall speech quality, NISQA also provides predictions for the quality dimensions Noisiness, Coloration, Discontinuity, and Loudness to give more insight into the cause of the quality degradation.

• Nvidia Corp. is working on AI infrastructure deals potentially worth more than $750 billion, including an artificial intelligence initiative with SK Hynix Inc.'s parent worth more than $500 billion.

• Nvidia is in discussions to provide a guarantee of as much as $250 billion to help OpenAI lease computing from a US data center project and to finance $350 billion of OpenAI's purchases of its chips.

While critics have for months warned of the circular nature of such agreements — the companies Nvidia finances and takes stakes in typically buy or use its chips — the pace of the deals is only quickening. The risk with these transactions is they may create skewed incentives for business across a plethora of industries, spur bad decision-making and magnify losses if demand for AI fails to match lofty expectations. Nvidia is also in discussions to finance $350 billion of OpenAI’s purchases of its chips for the US project, according to a person familiar with the matter.

Industry peers are opting for similar arrangements. Google, whose AI entries include Gemini, agreed to backstop lease payments at five data center locations for Anthropic PBC, helping the OpenAI rival obtain what amounts to a $35 billion loan.

AIFoss covers open-source AI tools for people who want to run AI without handing data to a third-party API. If a tool requires a cloud account to use, it's not in scope here.

Why this site exists

Open-source AI moves faster than any publication can track, and most coverage is either a GitHub README written by the maintainer or a 10-minute YouTube install video. We do something different: structured comparisons, documented test configurations, and honest assessments of what each tool is actually good at versus what it claims.

What you'll find here

• LLM runners — Ollama, llama.cpp, LM Studio, vLLM, Tabby: feature comparisons, performance tradeoffs, when to use each.
• Image generation — ComfyUI, Automatic1111, InvokeAI, Fooocus: workflow depth, hardware requirements, upgrade paths.
• Coding assistants — Continue.dev, Cline, Aider, Tabby: setup guides, model pairings, honest productivity assessments.
• Self-hosted stacks — Open WebUI, Flowise, n8n, Langfuse: integration guides and real-world deployment patterns.

GPU benchmarks, local LLM tutorials, ComfyUI workflows, and self-hosted AI guides for the home lab crowd. Tested on the cards you can actually buy.

AI creates the reverse problem. In the AI age, the buyer risks giving away knowledge, just in order to use what they bought.

You essentially pay for intelligence twice, once with money, and again with something even more valuable: the proprietary knowledge you must reveal to make that intelligence useful. The better you want the model to perform, the more of that knowledge you have to feed it!

Over time, the information asymmetry becomes increasingly skewed. The seller learns more and more about you as you use what you purchased, while you learn very little about what the seller is learning in return.

That is what I think of as the Reverse Information Paradox.

Patents solve one aspect of Arrow’s paradox. They let an inventor disclose an idea without simply giving it away. The Reverse Information Paradox needs its own equivalent.

While the great innovation that comes from model providers having fair use rights to train models on public data is needed, I find it ironic that the status quo is to then turn around and impose restrictive terms on distillation, and to reserve the right to learn from customer usage and interaction data. If learning flows in only one direction, economic value converges toward the owners of the learning infrastructure rather than the creators of the knowledge itself. Therefore, it's imperative that we distribute the learning infrastructure to every firm so that they can control their own learning loop.

In the cloud era, enterprises accumulated data. In the AI era, they accumulate learning. The trust boundary must evolve accordingly, from protecting information to protecting the mechanisms through which organizations learn, adapt, and compound intelligence. There are a few things every enterprise must do to ensure this:

• Control: Create your private evals, because evals define what “good” looks like inside the organization. Also, retain ownership of your organization’s memory, traces, feedbacks, decisions, and institutional context, and ability to use outputs of models from your own tasks and queries.
• Capability: Build your own proprietary learning environments within the tenant boundary to train or tune models, where models learn against real workflows without exposing the company’s knowledge.
• Choice: Ensure the orchestration layer is decoupled from any single model. Ask yourself: If any one model you are using is taken away, do you still have the ability to operate and optimize for your evals using other models? Does your company “veteran” capability remain with you even if a given “generalist” model is taken away?
• Cost: By decoupling the orchestration layer, you are also able to bring together context, models, and tasks in the most efficient and cost-effective way without sacrificing quality.
• Compound: Bring these four together and you create your own continuous learning loop (i.e. hill climbing machine) that will allow your AI investments to compound the value of your firm.

1Password for Claude lets you authorize Claude to complete browser-based tasks that require an account login. This is useful for things like booking travel or managing online accounts.

According to 1Password, approved credentials are delivered through a secure channel and injected directly into the destination page. The password, one-time code, and other secrets never enter Claude’s context, memory, or Anthropic’s systems.

Instead of granting ongoing access to a vault, Claude requests the specific login items it needs for a task. The user can approve or deny that request with a biometric prompt, and the permission lasts only for the current session.

1Password can also broker access across multiple websites during the same task, allowing Claude to complete a multi-step workflow without stopping for a new login each time.

The launch also introduces what 1Password calls Agentic Mode.

When a compatible AI agent takes control of the browser, the 1Password extension automatically locks down the vault so that only the credentials explicitly approved for that task remain available.

It requires the 1Password desktop app and browser extension, along with the Claude desktop app and browser extension.

Support for payment cards and identity information is planned for a later update.

The Anthropic partnership was first outlined in March, when 1Password said Claude would gain consent-based access to vault items.