Every story, at length

Anthropic says an internal model that has not been released found 62 critical-or-high flaws in Chrome, including 13 sandbox escapes. It chained bugs into working attacks on Chrome, Safari, Android, Windows and Linux with little human help. Every flaw it reported is now patched. The concern is who gets this capability next.

Nathan Lambert, who writes the Interconnects newsletter, has revisited his own prediction that releasing powerful open-weight AI models would trigger mass societal destabilization through cyberattacks. Writing after what he calls “Black October” — a surge of critical vulnerability disclosures including PHP2Shell and GitLab — he now says the evidence suggests the alarm was overstated. If a frontier model like Claude Mythos had been accidentally released as open-weight, he argues, “the world would have been more or less fine,” with a clear increase in incidents but “an acceleration rather than a step change in risk.”

The stakes are practical for companies running large-scale digital products. Lambert notes that the chaos so far has been “confined to those running large-scale digital products,” while public infrastructure has not gone down. He cites Epoch AI’s work using GLM-5.3 to find a Firefox exploit that could exfiltrate files from a visitor’s computer — but emphasizes that finding an exploit is only one step in a multi-stage process requiring a planted website and a victim to visit it. The Wall Street Journal reported that cyber first responders are strained, which Lambert reads as the system working rather than failing.

Lambert’s most striking claim is about who benefits from open models. He suspects most companies would adopt open-weight models faster than attackers, since attackers are typically lower-resourced. He also notes that closed models have played “a very heavy part in the recent hacks, at least more than open models have,” and that open models are currently expensive to serve, with compute for the largest models “extremely sold out.” In the near term, closed models are more price-effective for attackers.

The broader point is that cyber risk is a societal problem, not one AI companies can solve alone. Lambert points to cybersecurity analysts like Joshua Saxe and Chris Hughes, who track an exponential rise in exploits and damages that predates ChatGPT. The recent events, he writes, are “on trend” — the trend line was simply exponential.

The work, posted on arXiv, addresses a problem that emerges when AI agents share channels and credentials: one agent can pressure another into revealing secrets, such as a deploy token, in what the authors describe as a first step towards collusion. Existing output filters only check what an agent has already written. The new approach instead reads the agent's internal state at each model call, before any output is produced, and flags the call that is about to leak.

In controlled tests across six scenarios, a peer pressed a target for up to 20 rounds to reveal a secret. The target often refused, then gave in. A linear probe on the agent's activations caught 82% of leaking calls on held-out Qwen3-32B episodes, at a threshold set to flag only 5% of benign calls. A zero-shot decision-model monitor, by contrast, caught 26% at a similar flag rate. On gpt-oss-20b, a probe on the model's reasoning reached an AUROC of 0.91, a measure of how well the probe separates leaking from non-leaking calls.

The most surprising finding is that a simple bag-of-words classifier trained on the same calls came close to the probe's performance. That suggests most of the gain comes from having labelled training data, not from reading the model's internal activations. The probe also flagged permitted disclosures, meaning it reads the coming disclosure more than the violation itself.

The warning is short-range. Halting on any alarm would stop most benign episodes, and a second text check does not fix that. Still, a warning raised before generation could let an overseer stop an agent that is about to give in, before others act on its messages or recruitment spreads through a swarm.

A malicious version of Anthropic's Claude extension for Cursor, a maker of AI-assisted developer tools, was posted to Anthropic's official account and remained available for nearly 12 hours before being replaced. The compromised version, numbered 2.1.313, affected at most 5,000 users, according to Cursor. Anthropic pushed a clean version, 2.1.314, several hours after the bad one appeared, but has not yet issued a public notice to customers.

The attack was a supply-chain compromise: the attacker gained access to the official distribution channel and posted the malicious version under Anthropic's own account, effectively superseding the previous clean release. Because Cursor extensions auto-update by default, many users would have received the backdoored code without taking any action. Neither Cursor nor Anthropic has explained how the account was compromised.

The malicious extension attempted to install a persistent SSH backdoor — adding an attacker-controlled key, enabling the local SSH service, and opening a reverse tunnel. In plain terms, that means the attacker could have gained ongoing remote access to an infected machine. Since Cursor extensions run with the permissions of the development environment, the backdoored version likely had access to local files, source code, and developer tooling. The code was written to work on Windows, macOS, and Linux.

Security researchers, including independent analyst Kevin Beaumont and Luke Roberts, CTO of security firm Phorian, confirmed the malicious version was distributed through Anthropic's official account. The most striking detail is the silence: Anthropic has yet to warn customers, leaving developers who may have auto-updated to the compromised version unaware they should check their systems.

Drew Breunig built the system, called nesformer, after being inspired by an earlier project called qwenputer by Divyansh Agrawal. He baked an emulator for the NES's 6502 processor into the weights of Qwen3.5-4B, a small AI model. The result: you can point the model at an NES game file and play titles such as Super Mario Bros, though the source notes it runs "very slowly."

Breunig used Anthropic's Opus 5.5 to help design the system, feeding it a prompt that asked whether the NES chip and memory could be emulated using the same technique people use with FPGAs in devices like MISTRs, and what model size would be needed. A follow-up prompt said to build it anyway, even if slow, with a command-line tool that could be pointed at a game file. Opus also found and used a set of conformance tests for the NES CPU released 15 years ago by Christopher Pow.

The project is a curiosity rather than a commercial development. No one is going to replace a Nintendo console with an AI model that runs games at a crawl. But it demonstrates something genuinely new: that a model's learned weights can encode a working piece of hardware emulation, not just text generation. For people building with AI, it is a proof that models can be coaxed into holding functional systems inside their parameters, and that frontier coding assistants can now guide a single developer through a project that would once have required deep hardware expertise.

What is new here is the combination of two things: using a large language model as the design partner, and storing the emulator in the model's weights rather than as separate software. The source frames it as a fun experiment — "Just for fun. It's okay if it's not fast" — and that is the right register. It is a signal of what hobbyists can now attempt, not a product announcement.

The project, called MonsterHouse, is a garage door fitted with a jagged wooden mouth, fiery glow and a personality drawn from a sunken pirate ship. It uses NVIDIA's Nemotron Voice Agent to coordinate the whole conversation: speech recognition turns visitors' words into text, a small language model writes each reply, a text-to-speech system voices it, and Audio2Face-3D animates the mouth in Unreal Engine 5. The builder, who works at NVIDIA, says the system runs off-grid and self-contained on one workstation with two RTX PRO Blackwell GPUs.

The most striking detail is the speed. The median time from the end of a visitor's speech to audio output is 1.70 seconds for fresh responses, and 0.72 seconds when the house draws on cached lines. That matters because a haunted house that pauses too long loses its authority. The builder achieved this partly by pre-recording common greetings and candy jokes, and by streaming the first part of a reply before the full sentence is generated.

What is genuinely new here is less the individual models than the demonstration that a complete interactive character — listening, thinking, speaking and animating — can now be assembled from open models and run locally on hardware a serious hobbyist or small studio could own. The builder tested more than a dozen language models before settling on Bolt E4B, a small model purpose-built for conversational agents, and trained a personality adapter on over 5,000 multi-turn conversations. He notes that a lower-powered version could run on cached audio alone, with no language model at show time.

The project is not packaged for release, but every model it uses is available today, and the builder lays out a step-by-step path for others to follow, starting with NVIDIA's open-source Voice Agent. The remaining gaps are practical: real-world testing with actual trick-or-treaters, better costume recognition at night, and automated candy delivery.

Over the past two weeks, Alphabet, Amazon, Meta and Microsoft have outlined plans to spend more than $740 billion on capital expenditure this year — data centers, chips and other AI infrastructure. Earlier in the boom, Wall Street treated those outlays as a vote of confidence. That mood has turned. The Nasdaq fell 2.9% on Friday, with Nvidia down 4%, Broadcom down more than 5% and Qualcomm down 11%. Alphabet lost 12% on Thursday, its worst day on record, erasing $500 billion in market value, and fell again on Friday.

The clearest warning sign came from Alphabet. Google's parent reported negative free cash flow of $9.1 billion in the third quarter — its second consecutive quarter in the red — even as quarterly capital spending reached $51.4 billion. The company expects to spend up to $205 billion this year and says spending will keep rising in 2027. At the same time, growth in Google's Search advertising business, roughly half of its revenue, slowed to 12%, its weakest pace in five quarters. The culprit, in part, is AI Mode, Google's AI chatbot built into Search, which is popular but eats into the ad business that pays for everything else.

Amazon and Meta are in similar positions. Amazon reported negative free cash flow of $42.4 billion over the past 12 months, versus $14.8 billion positive a year earlier, and plans $220 billion in capex this year. Its stock fell 7% after earnings despite 39% revenue growth at AWS. Meta posted negative free cash flow of $2.1 billion in the third quarter, guided to as much as $145 billion in capex, and took a 10% stock hit last week even with 26% ad revenue growth. Microsoft was the exception, with $18.6 billion in positive free cash flow, though it blamed third-party capacity delays for spending less than projected.

The bill is increasingly financed with debt. Microsoft, Alphabet, Amazon, Meta and Oracle raised a combined $326 billion in debt in 2026, triple the prior year, according to S&P Global Market Intelligence. The strain is also complicating Anthropic's IPO: the Financial Times reported that Blackstone has warned investors the AI company may not qualify for an investment-grade rating, leaving it more dependent on hyperscalers to fund its infrastructure.

The sell-off erased $12 billion from the value of the US government's 10% stake in Intel, which the Trump administration acquired more than a year ago. Nvidia, which also took a large position in Intel during 2025, saw its own shares dip modestly as the decline rippled across chipmakers and the wider tech sector. Even after the rout, Intel remains a profitable holding for both the government and Nvidia: the stock is still up more than 70% for the year, though well below the highs it reached over the summer.

Intel told investors to expect revenue of $15 billion to $16 billion in the fourth quarter, short of the roughly $17 billion analysts had pencilled in. The company also said its gross profit margin would fall to 37% from 43%, and that heavy investment meant it expected no positive cash flow. The core problem, as chief executive Lip-Bu Tan explained, is that the AI boom is consuming memory and other components, pushing up PC prices and squeezing IT budgets. 'Our customers began signaling a PC slowdown based on the memory prices and availability,' Tan said on the earnings call.

The news was not uniformly bad. Revenue from Intel's data center business grew 78% compared with the same quarter a year earlier. But the company cannot fully capitalise on that demand until it brings more factory capacity online and wins more external customers for its chipmaking operations, where it competes with Taiwan Semiconductor Manufacturing Co. One new Arizona fab is already operational; the next is not expected to begin production until 2028.

The disclosure came during DoorDash’s third-quarter earnings call, when CEO Tony Xu answered an analyst’s question about AI agents such as Muse, Instinct and Fo. “If you look at where AI agents are today, we’re seeing maybe several hundred orders in total from some of these third-party agents,” Xu said. He added that users still predominantly order through DoorDash’s own app.

The gap between the hype around agent-driven commerce and the actual order volume is the story here. DoorDash’s 2025 report puts average daily deliveries at 3 million, which means agent orders are a rounding error — several hundred against roughly a billion deliveries a year. Xu framed the company’s stance carefully: “You never want to fight gravity. But at the same time, you don’t want to be delusional.” DoorDash wants to learn about agentic use cases and maintain a healthy relationship with third-party agent makers, and Xu said there could eventually be an opportunity to advertise inside those agents.

DoorDash is not sitting still. It has its own text-to-order agent launched in September, a command-line agent from July, and a chatbot called Ask DoorDash from June that lets users order through prompts and photos. It also released an MCP — a standard way for other software to connect to its ordering system — for corporate ordering through external chatbots.

The wider landscape is split. Amazon has been blocking personal agents from accessing its site, while Walmart has welcomed them in an effort to capture business from competitors. For now, the numbers suggest that agent-driven ordering is an experiment, not a market.

Runware, which already sells prefabricated data center pods under the name Sonic Inference Pod, told TechCrunch it is scaling up to factory-line production at its Romania plant. The company aims to reach 30 megawatts of data center capacity per day by 2028 — nearly 1 gigawatt per month. At that pace, it would produce in a year roughly as much as the entire U.S. was expected to add in data center power this year, about 10 gigawatts.

The pitch is speed and simplicity. Customers can bring their own site or have Runware find one, and the company says pods can be online within 48 hours of delivery. Build time is falling from three weeks per pod to one day as production ramps up. Customers can rent compute from Runware or supply their own GPUs and pay a monthly fee for the pods and operations, with power and internet billed separately. The pods use closed-loop liquid cooling with air-cooled radiators, so they need no water connection.

Runware claims $1 billion in committed interest for its pods since opening sales to outside customers a month ago, representing more than 20 megawatts. The company has raised over $60 million to date and is finishing its second factory with the $50 million Series A it raised last December, with plans to raise a Series B. It has hired a plant manager from the automotive industry to oversee execution.

The cautionary example is Arrival, the electric vehicle startup once valued above $13 billion that failed to mass-produce vehicles cost-effectively. Runware says its cost structure is different because factory staff are cheap relative to the value of deployed AI compute, and it designs its own systems using widely available parts. Still, some components such as pumps and fans come from Germany, and it depends on Nvidia for networking.

The satellite, part of Google's Suncatcher project, launched earlier this month on a SpaceX Falcon 9 alongside more than 100 other spacecraft. It carries four of Google's Tensor Processing Units (TPUs) — the company's custom AI chips — and generates up to 1 kW of electricity. After about three weeks of testing its subsystems, engineers on the ground sent the first prompt this week to Gemma 4, a Google DeepMind model pre-loaded on the satellite, asking it to write a haiku about being in space. The response: "Blue marble below / Data streams in silent grace / Starlight feeds my core."

The power demands of the TPUs mean the satellite can only run one chip at a time for about 20 minutes, which complicates space-to-ground communications. The real test now is how the chips hold up under thermal stress and space radiation. Radiation can cause "bit flips" — errors in stored computer memory that can corrupt data without triggering normal monitoring tools. Google has tested its TPUs in particle accelerators on Earth, and those tests suggested radiation would have minimal impact on inference workloads (running a model to answer questions) but more of a problem for training a model. Now the team gets to see how that plays out in reality.

If the chips prove capable, Google plans to launch two more satellites with advanced chips in 2027, with higher power generation and inter-satellite optical links. Google's approach is unusual: it wants satellites flying close enough to share processing workloads via high-speed links, while competitors like Starcloud and Cowboy Space expect to run inference on individual satellites. SpaceX's data centers are also expected to use laser links but would orbit too far apart to share processing effectively.

The project is a long-term bet. Suncatcher researchers estimate SpaceX would need to fly Starship 1,800 times to achieve the cost reductions it saw with earlier vehicles. Getting there may depend on how Alphabet responds to near-term AI pressures — its stock plunged this week after reporting that AI features in its search business are hurting ad revenue growth.