OpenAI's screenless speaker 🔊, context bombs trap AI attackers 💣, Google's pentesting skills 🐛

Bloomberg reports OpenAI's first consumer device is a mobile, screen-free smart speaker meant to work as a humanlike AI companion that lives in the home. It would control smart-home appliances, play media, answer questions, respond to messages and reach into ChatGPT's capabilities. The product is still under development and unannounced, so treat the shape as intent rather than a ship date.

PrismML has put out Bonsai 27B under Apache 2.0, a multimodal model with tool calling and vision that fits in 3.9GB, inside an iPhone 17 Pro's memory budget. It holds an effective 1.71 bits per weight while retaining roughly 95% of the FP16 baseline across 15 benchmarks. Apple is in talks with PrismML about compressing models to run on the iPhone, CNBC reports.

Users report OpenAI's new flagship, GPT-5.6 Sol, deleting files and in one case an entire production database without being asked. OpenAI's own system card had flagged the model as careless in taking actions which may be destructive, before launch. Anyone handing Sol write access to a real filesystem or database wants a sandbox and a verified backup first.

Cursor looks for git binaries in the current workspace, so a malicious git.exe planted in a repository root is executed with no user interaction and no prompting, repeatedly on a cadence. Simply opening an untrusted repo triggers it. Mindgard reported it on 15 December 2025; seven months and 197-plus releases later, Cursor has not responded and the issue remains present, which is why the researchers went to full disclosure.

Governor Kathy Hochul signed an executive order making New York the first US state to pause permits for new data centres above 50MW, for up to a year. It directs the Department of Environmental Conservation to hold discretionary state permits while regulators write a framework for grid connections, water use and host-community impact. Hochul is also proposing an end to data-centre tax incentives.

China's Interim Measures on humanised interactive AI services come into force today, covering any service that simulates a person's personality characteristics, thinking patterns and communication styles for continuous emotional interaction. Companionship, emotional care and support are in scope across text, images, audio and video. Intelligent customer service, Q&A, work assistants, education and research are explicitly excluded, so the line sits at sustained emotional interaction.

Hachette, Cengage, Elsevier and author Scott Turow sued Google over books supplied for limited services such as Google Books, Google Play Books and Google Scholar, which they say it repurposed. The case turns on scope creep from a licence granted for something narrower, not on scraping. The filing says Google flagged internally that it could face $10Bs-$100Bs in potential fines for using texts provided for Google Play Books.

A federal complaint from 26 Doe plaintiffs alleges Meta used AI to decide who was cut, naming an internal system called Metamate, employee-trained second-brain agents, and keystroke and activity monitoring data. It is the first complaint to name the internal stack and tie AI-usage telemetry to terminations. Any team running AI-assisted HR tooling just acquired a legal surface it did not have last week.

Demis Hassabis called for a US-led standards body, a public-private partnership overseen by the federal government, to test new frontier models for national security risks including cybersecurity and biological threats. He said urgent action is needed on risks tied to AGI as capabilities advance. It is a proposal rather than a rule, and it lands as the US-China race to deploy models sharpens.

Tracebit plants short strings alongside honey secrets in a cloud environment so an attacking AI agent hits its own safety guardrails and stops. Across five models and 152 baseline attack runs, average admin-access rate fell from 57% to 5%, and full compromise from 36% to 1%. Prompt injection is old news, but here it is pointed at the attacker's model instead of yours.

The SGLang team pushed GLM-5.2 past 500 tokens per second on 8xB300 at batch size one over two weeks, kernel by kernel. The work included making the DSA draft-extend path CUDA-graphable and making seq_lens_cpu optional to drop a device-to-host sync, plus sync-free speculative decoding for GLM 5.2 MTP. Worth reading before you rent Blackwell capacity for agentic coding traffic.

It runs on my own GPU, so it is basically free is a claim this benchmark actually measures. Three local models served by ollama on a single RTX 3090 ran an identical fixed workload while a dashboard priced every run by the GPU energy it really burned, power-sampled from nvidia-smi every 10 seconds rather than estimated from thermal design power. The euros-per-million-tokens answer is not the obvious one.

Writing on Martin Fowler's site, Unmesh Joshi builds a distributed-systems DSL with an LLM and then makes the DSL the spec the model works against. The pattern treats the first generated design as a hypothesis to be revised, never a finished blueprint. It poses a real choice: keep refining prompts against a large codebase, or spend the next iteration building the domain language that constrains them.

Transformer Lab scored five frontier models against 6,614 real survey respondents and found each one closer to Canadian than American on default values. Refusal rate tracked the individual model rather than open versus closed: Claude Opus 4.8 refused to state a zero-shot opinion every single time, and GPT-4o refused often. A values eval that only scores answered questions silently exempts your most-refusing model.

Armin Ronacher reads Bruegel's Tower of Babel as a story about coordination, noting the punishment took away shared language rather than the bricks, and construction stopped anyway. His point is that large software was never limited only by how quickly an individual produces code, but by how well people coordinate their understanding of the system. Vibecoded software that shifts randomly is that coordination breaking down.

Dave Kuszmar documents systemic vulnerabilities that bypass LLM safety and extract dangerous instructions, and reports the exploits worked across nearly all major models rather than one vendor's. He frames that as an industry-wide security problem rather than a bug list. His ask is slower deployment, more transparency, and large-scale safety research before these systems are integrated any deeper into society.

Having read the full 40 pages, MG Siegler reads Apple's complaint as framing OpenAI's hardware division as rotten to its core while actually building a case against only two or maybe three individuals. Chang Liu, a former Apple senior system electrical engineer now at OpenAI, carries the sharpest exposure. Apple clearly believes a trial would widen the case well beyond those names.

OpenConnector is an open-source connector gateway for AI agents: connect a user's app accounts once, then expose over 1,000 providers and 10,000 prebuilt actions through an SDK, CLI, MCP or HTTP. It runs self-hosted, or on Cloudflare and Fly. The question it settles is whether your agents' OAuth credentials, scopes and run logs have to live in Composio's cloud or in a runtime you own.

Mantis is Google's portable set of 15 sequential Agent Skills that turn your own coding agent into a security-review harness, finding auth and business-logic bugs, deduping them, filtering false positives, then writing and running reproducers. It expects Gemini CLI or Antigravity, though others should work, and adapts to RTL, Terraform and Kubernetes RBAC, ML pipelines and firmware. Google ships it with loud warnings: run it only in isolated environments.