The Brief
New briefs daily around 7 AM Eastern
Project Zero cuts bug disclosure to 90 days, falling to 30 by 2028
Under the old 90+30 policy, details waited up to 30 extra days after a fix shipped so users could patch. That soak time is gone, and Project Zero cites LLMs shrinking patch-to-exploit time, so vendors now get one fixed clock that drops to 30 days.
- 01Read
Study of 159,041 Lovable apps finds passports and 200K messages exposed
The data sat in Supabase databases that answered requests with no login, the gap row-level security exists to close. Lovable frames app security as a shared responsibility, so locking down those tables falls to the builder, not the platform that generated them.
- 02Read
Artificial Analysis index v2.1 ties Fable 5.2 and Opus 5.5 at 58
The two newest Claude models now tie after harder tasks cut scores about 5 points on average. Cost per task among top setups runs from $1.51 to $44.22, about 30x, and higher effort can score lower because each task has a time limit.
- 03Try
Five agent harnesses on one model score alike but cost very differently
With Opus 5.5 or GPT-6.1 Sol held fixed, the harnesses solved similar shares of public dev tasks, so the harness set the cost per solved task. Rules shown every turn were followed far more often than skills the prompt never mentioned.
- 04Watch
SpaceXSI reports 11,000 agent PRs in a month at a 0.5% revert rate
The Grok Bot team encodes its architecture as enforceable lint rules and spends tokens on runtime and formal verification in TLA+ and Lean. At that volume, a 0.5% revert rate still means about 55 reverted PRs a month.
- 05Try
browser-use 1.0.5 adds a per-run judge that flags injection and captchas
Each run now returns a judgement with success, failure reason, prompt-injection and captcha flags, and site gotchas, scored by a model the user picks. Agent builders who wrote their own grader get one in the library, though it was measured on only 13 runs.
- 06Read
NVIDIA's open Nemotron 3.5 Transcribe tops new diarization index at 3.3%
Artificial Analysis scored speech-to-text APIs on word-level speaker errors across 97 conversations. The open-weight model's 3.3% is under half of second-place Voxtral Small Transcribe 3 at 7.5%, so a self-hostable model leads paid APIs.
A dated brief from the vibe-coding frontier. Today’s Intel.