A developer released solvi 1.0, an open-source Python library for building auditable decision systems, on 2026-10-04 via PyPI. The library combines fast solvers such as rules and small fitted models w…
NVIDIA's IsaacTeleop framework converts XR hand tracking and motion-controller input into commands for simulated and real robots through a graph-based retargeting engine, according to a Marktechpost t…
AgentAvow built a behavioral sandbox that runs MCP servers in a fresh gVisor container with a read-only root, no capabilities, one CPU and a hard time limit, then grades them against fixed rules for u…
A developer published a four-file Docker Sandbox Kit that packages the DeepAgents agent harness into an isolated microVM-style sandbox pre-wired to a local Docker Model Runner, letting the agent run w…
Security researchers reported in September 2026 that an attacker hijacked a live AI coding assistant session at a software company, causing the assistant to recommend a malicious PyPI package whose in…
A developer building a slopsquatting detector removed three false-positive exceptions from its package-risk classifier after finding they cleared packages without real evidence. The rules treated npm …
A developer has published a release-gate approach for Python AI packages that inspects the exact registry artifact, traces a cold import, and plants harmless credentials to catch malicious behavior be…
The Cloud Security Alliance's AI Safety Initiative published a research note on April 19, 2026, finding that 440,445 of 2.23 million code samples generated across 16 code-generating models in Python a…
Pillar Security found that selecting a model in Unsloth Studio triggered the download and execution of Python code from the model repository, with researcher Ariel Fogel stating "Reading the model's c…
A developer at Microwise AI outlined MWD (Microwise Development), a methodology that enforces one Git repository per package so AI coding agents work within concrete, easily scoped boundaries. To pres…
CrowdStrike Counter Adversary Operations identified a threat actor behind PhantomRaven, an LLM-generated information stealer distributed through typosquatted npm packages that use remote dynamic depen…
A developer released AION-Torch, an open-source PyTorch library on PyPI that implements an adaptive residual layer scaling x + α·y by input/output energy instead of a fixed residual weight, based on t…
Two LiteLLM releases, 1.82.7 and 1.82.8, were published to PyPI with a credential stealer inside after attackers tracked as TeamPCP stole a PyPI publishing token via a compromised Trivy GitHub Action,…
The UK AI Security Institute and Meridian Labs released Inspect, an open-source framework for large language model evaluations that ships with over 200 pre-built evaluations and supports more than 20 …
A developer has released BOOTH, an open-source Python checkpoint layer that verifies LLM outputs against retrieved evidence before they are passed downstream. The library's check_with_evidence() funct…
Marimo's notebook sandboxes now support Pixi, letting standalone notebooks record Conda and PyPI requirements alongside their code, the marimo team announced. The integration, built with the Pixi team…
Google assigned CVE-2026-14540, a CVSS 8.0 server-side request forgery in its MCP Toolbox for Databases, where the HTTP client was initialized without a CheckRedirect policy or target IP validation, a…
Two MemTensor packages on npm and PyPI were replaced with backdoored versions carrying the sckit credential-stealing worm between 02:23 and 05:55 UTC on September 23, according to SafeDep's analysis, …
A developer built VirgoFash, an open-source, zero-dependency asynchronous Python search library that relies only on asyncio and httpx to fetch real-time web results without blocking the event loop. Th…
A developer built cmt-cli, an open-source command-line tool that analyzes staged Git changes and generates commit messages using OpenAI models, defaulting to gpt-4o-mini. The tool, installable from Py…