agent 就是你写的那段程序，trainer 就是一个 actor，reward 是你在 Env 或 ChatAgent 里随手写的任意 Python。剩下的活儿三个大件全包了。README 里反复强调一个数字：大约 8600 行 RL 代码（推文里说的 9K 是个约数），却能撑到 1T 级别的 MoE。 OpenRLHF 的 ...

Microsoft is extending Dataverse into coding-agent marketplaces while expanding its MCP tools, certification program and governance controls.

A PNG hiding a prompt injection could steal your repo's secrets, researchers demonstrate. The technique, dubbed 'Ghostcommit, ...

The fantasy genre has produced many acclaimed classics, but only movies like Pan's Labyrinth and Spirited Away are worthy of ...

A new data-extortion group called Helix is using identity-focused tactics such as voice phishing (vishing), device code ...

Zscaler found attackers using SEO poisoning and hidden prompts in malicious websites to manipulate AI agents into making cryptocurrency payments.

Fake CVE exploit repos pull frint and skytext packages to steal researcher credentials, with servers still live as of July 1.

Operation Navy Ghost is targeting Python developers who build Telegram bots by hiding backdoors inside trojanized Pyrogram forks uploaded to PyPI. The campaign has been active since November 2025, ...

Decades-old Bash shell tricks can bypass safeguards in most open source AI coding agents, potentially turning malicious repositories into supply chain attack vectors. Bash (Bourne Again SHell), the ...

Mozilla’s Zero Day Investigative Network (0DIN) has demonstrated a new attack technique that could allow seemingly harmless GitHub repositories to compromise developers using AI-powered coding ...

Thanks for the feedback on the earlier Web Bluetooth experiment. That repo served its purpose: it proved a browser can talk to a BLE multimeter without falling over. But using it day-to-day exposed a ...