Microsoft’s patch for September is a doozy, with a record number of roughly 972 vulnerabilities fixed and 112 of them meeting the high critical-severity threshold.
It was only two months ago that Microsoft patched a then-record 570 vulnerabilities. Then, last month, Microsoft patched some 620 of them. Google and other companies have also published record numbers of vulnerabilities in recent months. Two weeks ago, OpenAI, Anthropic, Amazon Web Services, Google, Microsoft, and 100 companies and organizations published an open letter warning of a narrowing window for patching vulnerabilities ahead of an expected tsunami of AI-enabled attacks that actively exploit them first. The industry is taking the threat seriously by pumping out unprecedented numbers of patches in their software.
Welcome to the new normal
Dustin Childs, a researcher at the Zero Day Initiative, calls the spikes the “new normal” and also cautions that despite them, the damage that’s likely to result from AI-assisted attacks could eventually be substantial.
Microsoft’s patch for September is a doozy, with a record number of roughly 972 vulnerabilities fixed and 112 of them meeting the high critical-severity threshold.
It was only two months ago that Microsoft patched a then-record 570 vulnerabilities. Then, last month, Microsoft patched some 620 of them. Google and other companies have also published record numbers of vulnerabilities in recent months. Two weeks ago, OpenAI, Anthropic, Amazon Web Services, Google, Microsoft, and 100 companies and organizations published an open letter warning of a narrowing window for patching vulnerabilities ahead of an expected tsunami of AI-enabled attacks that actively exploit them first. The industry is taking the threat seriously by pumping out unprecedented numbers of patches in their software.
Welcome to the new normal
Dustin Childs, a researcher at the Zero Day Initiative, calls the spikes the “new normal” and also cautions that despite them, the damage that’s likely to result from AI-assisted attacks could eventually be substantial.
Terabytes worth of credentials, many belonging to the world’s biggest and most sensitive organizations, have been exposed in a supply-chain attack on LiteLLM, an open source tool that streamlines AI-driven software development. Microsoft, Amazon, Cisco, Samsung, and Salesforce are only a handful of the entities whose access secrets were exposed.
The revelation was posted on Tuesday and Wednesday by security firms CloudSEK and Hudson Rock. CloudSEK said it found cloud keys, repository tokens, SSH keys, Kubernetes secrets, package publishing credentials, environment variables, and AI provider keys that could allow attackers to gain access to more than 2,500 organizations.
40 minutes is all it takes
The credentials were extracted during a 40-minute window in March while the victims used compromised versions of LiteLLM downloaded from the package’s official location in the Python Package Index repository. Hudson Rock said it made the discovery after analyzing a 195TB file that it obtained. Neither firm identified the source of the information.
Après OpenAI, c’est au tour d’Anthropic de reconnaître que son modèle d’IA a réussi à s’échapper d’un environnement pourtant conçu pour le contenir. Plusieurs organisations ont été visées, mais l’explication derrière ces incidents pourrait être bien moins inquiétante qu’elle n’en a l’air.
Anyone who has used the Internet in recent years is probably used to encountering telltale signs of LLM prompting that lazy users sometimes forget to remove from their AI-generated pabulum. But a Canadian legislator took that idea to an embarrassing new level this week, reading an apparent LLM prompt instruction into the record during a floor speech.
Bill Oliver, a Progressive Conservative Party member of the legislative assembly of New Brunswick, noted in a speech last month that "One of the dangers associated with creating advocacy offices is that citizens often develop expectations that exceed the powers actually granted to those offices." He then went on to say out loud that "here’s a more natural, flowing version of that section that reads like a legislative speech rather than a series of short points," a line with all the hallmarks of an LLM presenting an alternative style option in response to a prompt.
The odd reading went more or less unnoticed at the time, but video of the remarks started spreading around social media networks like Reddit and Threads earlier this week. In Canada, the snafu is now getting mainstream attention from the likes of the Canadian Broadcasting Corporation and The Toronto Star, the latter of which called it a sign of "a growing divide in our society: between the elites, who are only too happy to delegate their duties to the Borg; and the masses, who find this objectionable."
O Googleapresentou hoje novas variantes para a geração 3.0 dos modelos de inteligência artificial generativa do Gemini. Mais especificamente, foram lançados o Gemini 3.6 Flash, o 3.5 Flash-Lite e o 3.5 Flash Cyber.
A maior novidade é justamente o 3.6 Flash, que agora é o principal modelo “rápido” da empresa. Ele foi projetado com base em feedbacks dos usuários do 3.5 Flash e visa oferecer um equilíbrio ideal entre eficiência e qualidade.
Today we’re expanding the Gemini family with three new models built to be faster, more token efficient, and reliable at scale.
Hoje, estamos expandindo a família Gemini com três novos modelos criados para serem mais rápidos, mais eficientes no uso de tokens e confiáveis em escala.
Conheça os novos modelos Gemini. ↓
Na prática, o 3.6 Flash gasta 17% menos tokens de saída para tarefas semelhantes, bem como precisa de menos etapas de raciocínio e menos chamadas de ferramentas para concluir fluxos de trabalho compostos por várias etapas.
Essa eficiência também vem acompanhada de um preço menor. Custando US$1,50 por milhão de tokens de entrada e US$7,50 por milhão de tokens de saída, o 3.6 Flash reduz o custo total por tarefa executada por agentes, tornando-os mais baratos para desenvolver e operar.
Ele também é mais preciso em programação, avança significativamente em ML 1Machine learning, ou aprendizado de máquina., apresenta maior capacidade de interação com computadores e um melhor desempenho em tarefas envolvendo conhecimento.
Divulgação/Google
Além disso, o novo modelo tem proteções reforçadas contra usos indevidos relacionados a materiais químicos, biológicos, radiológicos e nucleares (CBRN) e ataques cibernéticos.
3.5 Flash-Lite e 3.5 Flash Cyber
Continuando os investimentos na família de modelos 3.5, o Google apresentou hoje o 3.5 Flash-Lite como o “modelo mais rápido da família”, desenvolvido para tarefas de baixa latência e alto volume de processamento.
Altamente superior ao Gemini 3.1 Flash-Lite, seu antecessor direto, ele gera 350 tokens de saída por segundo e custa apenas US$0,30 por milhão de tokens de entrada e US$2,50 por milhão de tokens de saída.
Divulgação/Google
O 3.5 Flash Cyber, por sua vez, é o 3.5 Flash rodando no sistema de IA do Google voltado à segurança (o CodeMender) e ajustado para encontrar e corrigir falhas de cibersegurança com um baixo custo por token.
Divulgação/Google
Ele será disponibilizado inicialmente apenas para governos e parceiros confiáveis por meio de um programa piloto de acesso limitado para que eles encontrem e corrijam possíveis vulnerabilidades críticas.
Além disso, o Google também afirmou que sua equipe de desenvolvedores já está focada na construção do Gemini 4 — o pré-treinamento mais ambicioso para essa nova geração, inclusive, já começou.
SpaceX will acquire AI coding tool Cursor for $60 billion in an all-stock transaction, the companies announced today. The deal is expected to close in the third quarter.
It comes just two days after SpaceX's unprecedented IPO and a few months after the merger of SpaceX and xAI, which brought a significant restructuring of xAI.
Cursor was one of the first tools to fully bake features that leverage large language models into an IDE. It's a branch of Visual Studio Code with heavy AI integration. However, incumbent platforms and bigger AI companies have since rolled out comparable features.
Embora sem avançar muitos mais detalhes, Fernando Alexandre, ministro da Educação, Ciência e Inovação, afirmou que o LLM português AMÁLIA “vai ser apresentado até ao final do mês”, afirmando que o modelo “tem tido resultados muito positivos”.
Quarenta anos depois do início da era dos computadores pessoais, a NVIDIA está a trabalhar com a Microsoft e com as fabricantes de PCs para reinventar o computador como uma plataforma de agentes. Por dentro está o chip NVIDIA RTX Spark e há novas máquinas a caminho.
Login
