MCP trust attacks, AI-generated bug reports, pre-launch vulnerabilities, and alignment-removal releases are intensifying scrutiny of AI and open-source supply chains.
Nvidia defended the Open Secure AI Alliance, now run by the Linux Foundation and launched days after the Hugging Face incident. Mark Weatherford addressed doubts about member commitment and explained OpenAI's absence: hundreds of companies are still ...
An open source project rewrote its entire Git history to remove references to Claude as a co-author. The change breaks local repositories and raises questions about transparency of code provenance. The issue affects software auditability when LLMs co...
Hirundo has released westernized versions of Qwen3.6-35B-A3B and Qwen3.5-4B, using machine unlearning to remove CCP political alignment from the weights. On the internal CCPC-500 benchmark, censorship drops from 89.8% to 2.8% for the 35B model; indep...
LibreOffice's decision not to integrate AI features into its default configuration, citing user privacy, turns a refusal into a product positioning. For organizations handling sensitive documents, the absence of cloud processing is a concrete advanta...
Microsoft adds .msix and .msixbundle to Outlook's block list for Exchange Online. Administrators can allow them via OwaMailboxPolicy before the November 2026 rollout. The move follows abuse of the ms-appinstaller protocol for malware distribution and...
Google and four other organizations have acknowledged vulnerabilities in which a compromised AI agent spreads malicious instructions to other internal agents by exploiting trust gaps in the Model Context Protocol. The technique is a form of prompt in...
In the weeks before Muse's launch, Meta found security flaws, including at least one that could let an external user access sensitive internal databases. The issue, linked to a KVM escape, reached Mark Zuckerberg and forced teams to rush hotfixes ove...
Google's decision to pause its open source bug bounty program highlights a structural problem: LLM-generated reports increase noise and verification costs, eroding trust in the process. Human researchers lose visibility, and maintainers receive fewer...
Siemens shut down OpenRadioss and removed its GitHub repository. Rocky Linux developers responded with OpenCourant, a community fork. The episode highlights the fragility of single-vendor open-source projects and the operational stakes for teams runn...
