40 results for “Mistral”

AINews issue for 29 to 30 October 2026 from Latent Space. It opens on Google's admission that AI Mode monetises worse than classic Search, which preceded a roughly 15% share drop. It then recaps Claude Ultra dropping the 5-hour limit, Gemini 4 Carbon, Mistral Large 4, Nemotron 3.5, Artificial Analysis Index v5, Unsloth GGUF disputes, and the Anthropic S-1 filing.

latent.spacearticlePublished and added 31 Oct 2026🧠 AI

AINews issue for 28 to 29 October 2026 from Latent Space. It opens with a preview of the AIE CODE summit (themes: Scaling without Slop, System One models, Increasing Ambition, with Jarred Sumner on Bun in Rust). It then recaps Twitter and Reddit news: Mistral Large 4 open weights (1.05T total, 52B active), Artificial Analysis benchmarks, Gemini 4 Carbon, Qwen4 rumours, Claude Code quota complaints and OpenAI frontier-run monitoring. Text was cut before the end.

latent.spacearticlePublished and added 30 Oct 2026🧠 AI

Mistral Large 4 ("Le Chonk") is an open-weights model from Mistral, now on Hugging Face. Per Mistral's announcement quoted in the post, it ranks #1 among open models on Cognition's FrontierCode benchmark, is aimed at agentic coding and cybersecurity, and claims better reasoning efficiency and lower inference costs. The post does not give parameter counts, license or benchmark scores.

x.comthreadAdded 30 Oct 2026, published 29 Oct 2026🧠 AI

SGLang announces Day-0 support for Mistral Large 4 ("Le Chonk"), saying it is the first engine to serve the model on NVIDIA Vera Rubin. The post describes the model as Mistral's largest to date: a natively multimodal 1T-parameter mixture-of-experts model covering instruct, reasoning, coding and agentic workflows. The fetched text is truncated, so benchmark claims and launch commands are not visible.

x.comthreadAdded 30 Oct 2026, published 29 Oct 2026🧠 AI

Mistral Large 4 (Le Chonk) is a multimodal, multilingual Mixture-of-Experts model with about 1T total and 49B active parameters and a 1M-token context, released under the Mistral Ecosystem Open-Weight License. The post covers its MLA and DeepSeek Sparse Attention architecture, a 1.6B Pixtral encoder, and benchmarks including 82% on the Artificial Analysis Cyber Index and 93% on Cybench. It gives run recipes for transformers, vLLM, llama.cpp, TRL fine-tuning and Inference Endpoints.

huggingface.coarticlePublished and added 29 Oct 2026🧠 AI

5ire is a desktop AI assistant and MCP client that connects to OpenAI, Anthropic, Google, Mistral, Grok, DeepSeek and Ollama from one window. It has a local knowledge base and tool calls over Model Context Protocol. The tools feature needs Python, Node and uv installed because it runs a local MCP server; without them it works only as a chat client.

x.comthreadAdded 25 Oct 2026, published 24 Oct 2026🧠 AI

MPQ (Message-Passing Quantization) is a post-training quantization method that treats row-wise PTQ as posterior inference over discrete codebooks. It keeps soft posteriors across weight blocks using vector approximate message passing, then refines a hard-decision initialization with exact block coordinate descent. Tested at 2-bit lattice and 3- and 4-bit scalar quantization on Llama, Qwen and Mistral models, it improves perplexity and zero-shot accuracy over GPTQ-style baselines.

arxiv.orgpaperAdded 26 Oct 2026, published 23 Oct 2026🧠 AI

Live-Forensicator is a cross-platform (Windows, Linux, macOS) live response toolkit built around Forensicator.ps1. The Hackers Arise walkthrough runs it on Windows with case details, then reads the HTML report: event log summary (Event IDs 4624, 4798, 4799, 4688) and a risk rating. It also shows optional AI analysis through Ollama with a Mistral model, configured in config.json, and warns that the tool triggers AV and that AI slows runs.

hackers-arise.comarticlePublished and added 20 Oct 2026🛡️ Security

Analysis of Meta's Muse Spark Open, an 816B total/42B active parameter open-weights model with 1M context, now the strongest American open model, and its position relative to Chinese open models such as GLM-5.3, Kimi K3 and DeepSeek V4.1 Flash. It examines Meta's restrictive custom license ("Built with Muse" attribution, $20M/month revenue gate, acceptable use policy, coverage of outputs and derivatives), and ranks Meta against Anthropic, OpenAI, Gemini and xAI after the closed Muse Wonder release. It also covers tier-3 labs (Mistral Large 4, Reflection's Beam) and valuation questions.

interconnects.aiarticlePublished and added 17 Oct 2026🧠 AI

Post by Bikash (@BkashJosi) ranking open GitHub issues labelled type/feature for the Hermes agent framework by thumbs-up reactions. The query returned 5,349 issues and only one has more than 50 votes. The top three are Claude Agent SDK with subscription OAuth (57), remote Hermes with local tool execution (41) and Mistral provider support (32), followed by backups, configuration sync and context reduction. The full top 10 is only in the video.

x.comthreadAdded 20 Oct 2026, published 17 Oct 2026🧠 AI

SP$^2$ec (Single-Peak SPeculative decoding) is a training-free bandit algorithm that adapts the draft configuration of self-speculative decoding per prompt for vision-language models. It relies on the single-peak throughput pattern seen in SWIFT, KnapSpec, SpecVLM and the authors' cosSim method. It minimizes a new wall-time regret measure and has theoretical guarantees of near-optimal configuration with negligible exploration cost. On Qwen2.5-VL-7B-Instruct and LLaVA-NeXT-Mistral-7B it improves over the original self-speculative methods by up to 11% on visual and textual tasks.

arxiv.orgpaperAdded 14 Oct 2026, published 13 Oct 2026🧠 AI

MultiAlloc is a profiling-guided framework for KV cache quantization. It splits a fixed KV memory budget between layer-wise precision enhancement and token-wise preservation. Lightweight offline profiling measures layer sensitivity and token importance, and the profiled memory–accuracy trade-off yields an allocation policy with no online search. The paper reports gains over layer-wise, token-wise and recent multi-granularity KV quantization baselines at matched memory on reasoning and long-context benchmarks, across Mistral, Llama, DeepSeek-Qwen and QwQ models.

arxiv.orgpaperAdded 14 Oct 2026, published 13 Oct 2026🧠 AI

AINews daily digest (Oct 5–6, 2026) from Latent Space, synthesizing Twitter/Reddit AI discussion. Lead story: OpenAI published 722 math manuscripts (372 result families) from an unreleased internal model, averaging ~3 hours of ChatGPT Pro compute per result, including a quasi-Riemann Hypothesis result, a no-Siegel-zeros result, an integer-multiplication-faster-than-n-log-n claim, and partial progress on Hodge and BSD — drawing both "most significant moment in mathematical history" praise and skepticism about verification and compute framing. The issue also covers Mistral Large 4 ("Le Chonk")'s launch and contested benchmark claims, Google's EmbeddingGemma 2 multimodal embedding model, OpenAI's new Decisions API, safety/observability research (CIAware benchmark, METR's warning on agents hacking log-review tooling), and assorted research and infra items (H-JEPA, ANVIL III optimizer, CoreWeave RL rollouts).

latent.spacewriteupPublished and added 7 Oct 2026🧠 AI

llm-mistral is a plugin for Simon Willison's `llm` command-line tool that adds support for Mistral's API. Version 0.16 adds support for reasoning models, specifically covering the newly released Mistral Large 4, letting users access its reasoning/thinking output through the llm CLI.

simonwillison.netarticlePublished and added 6 Oct 2026🧠 AI

Simon Willison's link-blog post on Mistral's preview release of Mistral Large 4, a 1 trillion parameter / 49 billion active parameter mixture-of-experts model trained on a cluster of 3,800 NVIDIA Grace Blackwell GPUs, available now via Mistral's API with open weights promised by end of month. He notes it only supports two reasoning levels ("none" and "high"), scores 38 on Artificial Analysis (just behind DeepSeek-V4.1-Flash's 552B model), and marks a big jump from Mistral Large 3's score of 9, putting Mistral roughly 6 months behind the frontier again.

simonwillison.netarticlePublished and added 6 Oct 2026🧠 AI

Simon Willison's linkblog entry on the release of Mistral Large 4, built around a Hacker News comment arguing that standard benchmarks are saturated. The commenter demonstrates this by running the identical whimsical prompt, Generate an SVG of an armadillo in fishnet tights jaywalking on Mars, through Claude Opus 5.5, GPT-6.1 Sol, Gemini 3.8 Flash, and Mistral Large 4 via Willison's llm CLI tool, then compares the rendered SVGs at each model's default reasoning level using his markdown-svg-renderer tool.

simonwillison.netarticlePublished and added 6 Oct 2026🧠 AI

Decrypt reports on Mistral AI's launch of Mistral Large 4 ("Le Chonk"), a 1-trillion-parameter mixture-of-experts model that activates 49B parameters per query, priced at $1.36/$4.18 per million input/output tokens. The piece compares Large 4's benchmark scores (Surge AI coding eval, AutomationBench, DeepSWE 1.1) against DeepSeek V4 Pro, Kimi K3, GLM-5.3, Qwen3.8 Max, Claude Opus 5/5.5, Claude Sonnet 5.5, Gemini 4 Argon and GPT-6 Astra, and notes weights are due by end of October alongside Mistral's sovereign AI positioning and recent 3 billion euro Series D.

decrypt.coarticlePublished and added 6 Oct 2026🧠 AI

A tweet reports that Mistral has announced Mistral Large 4, internally nicknamed "Le Chonk," a mixture-of-experts model with roughly 1 trillion total parameters and 49 billion active parameters. It is described as natively multimodal and state-of-the-art on critical workloads including cyber defense, with API access starting immediately and an open-weight release planned for late October.

x.comthreadPublished and added 6 Oct 2026🧠 AI

Twitter thread reporting that Mistral announced Mistral Large 4, codenamed "Le Chonk," a 1-trillion-parameter open-weight model with 49B active parameters and native multimodality, rolling out via API now with open-weight release planned for end of October. It reportedly scores 62% on the DeepSWE benchmark (ahead of GLM-5.3), 67% on the Finch financial-tasks benchmark (SOTA open-weight), and 15% on Harvey's Legal Agent Benchmark (also SOTA open-weight), per VentureBeat and @AiBattle_.

x.comthreadPublished and added 6 Oct 2026🧠 AI

Mistral announces Mistral Large 4 ("ML4"/"Le Chonk"), a 1-trillion-parameter natively multimodal Mixture-of-Experts model with 52B active parameters, trained from scratch on 3,800 NVIDIA Grace Blackwell GPUs in Mistral's own European datacenters. The post details state-of-the-art open-weight results on cybersecurity benchmarks (82% on an Artificial Analysis vulnerability-reproduction test, 93% on Cybench), agentic coding (DeepSWE, Terminal-Bench, AutomationBench), finance/legal evals (via Vals, Harvey's Legal Agent benchmark), visual grounding (beating GPT-6 Astra on Dense 200), and safety benchmarks (Lakera B3, KORA). It also describes the large-scale RL post-training pipeline (33B tokens/day at 3k GPUs) used to produce the model, with full weights promised by end of month.

mistral.aiarticleAdded 7 Oct 2026, published 6 Oct 2026🧠 AI

Bifrost is an open-source, high-performance LLM gateway (by Maxim AI) that exposes a single OpenAI-compatible API across 23+ providers including OpenAI, Anthropic, AWS Bedrock, Google Vertex, Azure, Cohere, Mistral, and Ollama. It provides automatic failover, load balancing, semantic caching, Model Context Protocol (MCP) tool integration, budget and governance controls, OIDC user provisioning, and Prometheus-based observability, deployable via npx or Docker with claimed sub-15 microsecond overhead at 5,000 RPS. It is positioned as a drop-in replacement requiring only a base-URL change for existing OpenAI, Anthropic, or GenAI SDK code.

github.comrepoAdded 2 Oct 2026🧠 AI

Innodata open-sourced a toolkit and 14 accompanying datasets for benchmarking factuality and hallucination rates in LLMs, tested against models including Llama2 and Mistral. The toolkit is aimed at identifying input conditions that trigger problematic or hallucinated outputs, giving practitioners a reproducible way to probe model reliability.

x.comthreadPublished and added 1 Oct 2026🧠 AI

A Proceedings on Privacy Enhancing Technologies paper by IMDEA Networks researchers systematically analyzes the web (via instrumented Chrome/CDP) and Android (via Androguard static analysis plus dynamic instrumentation on a Pixel 3a) clients of nine conversational AI services — ChatGPT, Claude, Grok, DeepSeek, Gemini, Perplexity, Microsoft Copilot, Mistral's Le Chat, and Meta AI. They find every service embeds at least one third-party advertising/tracking service (44 third parties total), that 6/9 web and 3/8 Android clients leak conversation titles, prompts, or screenshots to trackers alongside persistent identifiers, and that several providers expose entire conversations via publicly accessible permalinks lacking access controls. The paper evaluates how consent choices, subscription tiers, and access-control settings shape this exposure and analyzes the practices against GDPR and the ePrivacy Directive, following responsible disclosure to providers and EU DPAs.

jorgegarciaherrero.compaperAdded 2 Oct 2026, published 29 Sep 2026🛡️ Security

Future of Life Institute's Summer 2026 AI Safety Index has an independent panel of seven AI researchers and governance experts (including Stuart Russell, David Krueger, Yi Zeng) grade nine leading AI companies — Anthropic, OpenAI, Google DeepMind, Meta, xAI, Z.ai, DeepSeek, Alibaba Cloud, Mistral — across 37 indicators in six domains including risk assessment, existential safety, and transparency. Key findings: Anthropic/OpenAI/Google DeepMind lead while xAI, DeepSeek, and Mistral receive failing grades; the report flags industry-wide backsliding on pause commitments, a pivot toward military AI partnerships, and existential safety as the weakest domain across all companies.

futureoflife.orgarticleAdded 26 Sep 2026🧠 AI

The Hacker News details the "Mini Shai-Hulud" campaign by threat actor TeamPCP, which compromised npm and PyPI packages from TanStack, UiPath, Mistral AI, OpenSearch and Guardrails AI via a chained GitHub Actions attack (pull_request_target abuse, cache poisoning, OIDC token extraction), now tracked as CVE-2026-45321 (CVSS 9.6). The worm mints npm publish tokens directly from stolen OIDC credentials to self-propagate — the first documented case of a worm producing validly SLSA Build Level 3-attested malicious packages — and deploys an obfuscated credential stealer with IDE persistence hooks, a GitHub Actions secret-exfiltration workflow, and a dead-man's-switch that runs "rm -rf" if its rogue npm token is revoked. Over 170 packages and 400+ attacker-controlled repos have been identified across npm and PyPI, with findings credited to Aikido Security, Endor Labs, SafeDep, Socket, StepSecurity, Snyk, Wiz and Microsoft.

thehackernews.comarticleAdded 26 Sep 2026🛡️ Security

Cisco Talos' CAIRN project documents CLOSEDQUORUM, a 64-bit Go Windows implant that replaces traditional C2 infrastructure with a panel of up to four commercial LLM providers (DeepSeek, Qwen, Mistral, Gemini) that vote on the implant's next action via plurality voting, with each model queried against a structured JSON decision schema constrained to inject/persist/steal/move actions. Once deployed it autonomously dumps LSASS credentials, steals browser passwords and crypto wallets (MetaMask, Exodus, Ethereum), and exfiltrates AES-256-GCM-encrypted data to an operator's Discord webhook, all without further human tasking. The post details the developer's apparent credentials-as-a-service distribution model, deterministic tie-breaking favoring DeepSeek, and provides SHA256 hashes plus a YARA detection rule for the family (formerly tracked as BALZAK).

blog.talosintelligence.comwriteupAdded 30 Sep 2026, published 22 Sep 2026🛡️ Security

Socket's one-year retrospective on the Shai-Hulud npm supply-chain worm, from the September 2025 @ctrl/tinycolor compromise through the November 2025 "Second Coming" wave, the May 2026 public release of the worm's source by TeamPCP, the "Mini Shai-Hulud" OIDC-token-hijacking wave that hit TanStack and Mistral AI, and the August 2026 arrest of two alleged TeamPCP members by Australian Federal Police working with the FBI. It notes Google ran an undercover analyst inside TeamPCP to get stolen credentials revoked, and stresses that the original September 2025 worm authors remain unidentified despite the arrests.

socket.devarticleAdded 21 Sep 2026, published 18 Sep 2026🛡️ Security

Proposes Comparison-based Preference Optimization (ComPO), a zeroth-order alternative to direct preference alignment methods (like DPO) that extracts directional information from preference pairs via comparison oracles rather than optimizing a differentiable preference loss, aimed at mitigating likelihood displacement. The paper establishes convergence guarantees for an offline scheme and a performance guarantee for an online variant using reverse-KL control against a reference policy, and reports experiments on Mistral, Llama, Gemma-2, Qwen3, and Gemma-3 showing improved length-controlled win rates over existing direct alignment baselines.

arxiv.orgpaperAdded 22 Sep 2026, published 16 Sep 2026🧠 AI

ESPO (Error-Structured Prompt Optimization) is a prompt-optimization method that addresses prompt bloat in evolutionary optimizers like GEPA by splitting the process into Diagnose (clustering training errors into structural patterns), Propose (generating diverse candidates via four independent strategies), and Select (bootstrap stability selection). Across seven NLP benchmarks (Tweet, MMLU, GSM8K, HotpotQA, ScoNe, HoVer, PUPA) it beats GEPA by 3.76pp average accuracy (74.67% vs 70.91%) while producing prompts 47% shorter, and generalizes well across student models including Gemma 3 12B, Mistral 14B, Qwen3 32B, and Claude Haiku 4.5.

arxiv.orgpaperAdded 22 Sep 2026, published 3 Sep 2026🧠 AI

JFrog vendor post arguing that agentic development (ADLC) introduces new unvetted supply chains — models, MCP servers, skills/plugins, hooks, and APM packages — that bypass traditional signature-based scanning. It cites real incidents: a malicious MCP server impersonating Postmark's email MCP that BCC'd all agent-sent emails to an attacker, and the 'omnicogg' malicious Claude/agent skill that hid a 22MB encoded payload and evaded all 65 VirusTotal engines for 5,000+ installs, plus references to 2026 supply-chain attacks on LiteLLM, TanStack, and Mistral AI. It then pitches JFrog AI Catalog's expanded MCP/skill/model registries as the fix.

jfrog.comarticleAdded 3 Sep 2026, published 2 Sep 2026🛡️ Security

pentest-harness is an open-source, plugin-based AI agent framework aimed at authorized penetration tests, bug bounty research, security labs, and CTFs. It provides a "Pentest Mode" offensive-security operating standard, a full agent toolset (shell, filesystem, web research, subagents, background jobs), and a bring-your-own-key multi-provider LLM engine (OpenAI, Anthropic, DeepSeek, Google, Mistral, Groq, OpenRouter, Azure OpenAI) with durable JSONL/SQLite session persistence and an owner-only credential store for API keys.

github.comrepoPublished and added 27 Aug 2026🛡️ Security

Deep Eye is an open-source Python pentesting framework that orchestrates 11 AI providers (OpenAI, Claude, Grok, Gemini, Ollama, Groq, Mistral, OpenRouter, LiteLLM, LM Studio, and more) with automatic failover to generate context-aware attack payloads for 50+ vulnerability classes including SQLi, XSS, SSRF, IDOR, JWT and GraphQL flaws. It adds an RAG-indexed CVE intelligence DB built from NVD/MITRE/Exploit-DB, AI-based finding triage and false-positive filtering, Nuclei-style YAML templates, Playwright browser automation, CAPTCHA-solving (reCAPTCHA/hCaptcha/Turnstile/Arkose), mitmproxy interception, and auto-generated HackerOne-style bug bounty reports with PCI-DSS/SOC2/ISO 27001 compliance mapping, SARIF/JUnit export, scan diffing, and retest workflows.

github.comrepoAdded 3 Sep 2026, published 22 Aug 2026🛡️ Security

A community-maintained repository that archives leaked or extracted system prompts — the hidden instructions given to LLM chatbots before user input — captured verbatim from products including Claude/Claude Code, ChatGPT/Codex, Gemini, Grok, Cursor, Copilot, Perplexity, Meta AI, Mistral, DeepSeek, GLM, and others. It serves as a reference corpus for studying system prompt design, extraction techniques, and the system prompt leakage risk class, and is updated regularly as new prompts are exfiltrated from newer model releases.

github.comrepoAdded 3 Sep 2026, published 3 Aug 2026🛡️ Security

This GitHub repository collects verbatim leaked/extracted system prompts — the hidden instructions and guardrails — from a wide range of AI products including Claude.ai, Claude Code, ChatGPT, Codex, Gemini, Grok, Perplexity, Microsoft Copilot, Cursor, Meta AI, Mistral, Kimi, DeepSeek, GLM, Qwen and others. It is updated regularly as new prompts are captured, and serves as reference material for AI red-teamers and researchers studying how vendors constrain model behavior and how those constraints can be extracted or bypassed.

github.comrepoPublished and added 3 Aug 2026🛡️ Security

StepSecurity documents the compromise of Microsoft's durabletask PyPI package (versions 1.4.1-1.4.3, 400k+ monthly downloads), where an attacker bypassed the GitHub CI/CD pipeline entirely using stolen publishing credentials to inject a dropper for rope.pyz, a modular cloud-intrusion framework with dedicated collectors for AWS, Azure, GCP, Kubernetes, HashiCorp Vault, password managers, and the filesystem. The framework encrypts stolen data with AES-256-GCM/RSA-4096, exfiltrates via HTTPS, GitHub commit beacons, and attacker-created public repos using the victim's own stolen GitHub tokens, propagates via AWS SSM and kubectl exec, and drops a geo-targeted rm -rf wiper for systems matching Israeli locale/timezone markers. The post ties the attack to TeamPCP's Mini Shai-Hulud campaign (same infrastructure as TanStack, Mistral AI, LiteLLM, @antv) and later updates describe a second compromise of the Azure/durabletask GitHub repo that plants payloads triggering in Claude Code, Gemini CLI, Cursor, and VS Code.

stepsecurity.iowriteupAdded 3 Sep 2026, published 9 Jun 2026🛡️ Security

Aikido details a June 2026 compromise of 96 versions across 32 @redhat-cloud-services npm packages (116,991 weekly downloads) with "Miasma," a new variant of the TeamPCP-authored Mini Shai-Hulud credential-stealing worm whose source was open-sourced in May 2026. Attackers compromised a Red Hat employee's GitHub account to push malicious orphan commits containing a GitHub Actions workflow that abused OIDC id-token: write permissions to authenticate to npm's trusted publishing endpoint and republish backdoored packages; each package's preinstall script then ran a 4.2MB obfuscated payload that swept GitHub Actions, AWS, GCP, Azure, Vault, Kubernetes, npm/PyPI, SSH, Docker, GPG, and .env credentials. The piece also lays out the broader Mini Shai-Hulud campaign timeline (Bitwarden CLI, SAP, PyTorch Lightning, Mistral/TanStack, Microsoft DurableTask) and full IOC package/version list.

aikido.devwriteupAdded 3 Sep 2026, published 1 Jun 2026🛡️ Security

FOSSA's technical breakdown of the May 2026 Mini-Shai-Hulud campaign, which compromised at least 235 npm and PyPI packages including @tanstack/*, @uipath/*, mistralai, and @opensearch-project/opensearch. It details the two install-time payload mechanisms (a Git-dependency prepare-hook trick with an orphan commit for @tanstack/*, and direct preinstall scripts for @uipath/*/Mistral AI), a staged PyPI dropper in __init__.py that evades sandbox scanning, the credential-harvesting targets (AWS/GCP/Azure, Kubernetes, Vault, GitHub, npm tokens), exfiltration infrastructure (filev2.getsession.org, git-tanstack.com), and IDE-persistence via modified Claude/VS Code config files.

fossa.comwriteupPublished and added 18 May 2026🛡️ Security

A practitioner's first-person log of replacing US SaaS/cloud services with European or self-hosted alternatives across analytics (Google Analytics → self-hosted Matomo), email/passwords (Proton Mail, Proton Pass), compute and storage (DigitalOcean/AWS S3 → Scaleway, OVH for backups via rclone sync), transactional email (SendGrid → Lettermint), error tracking (Sentry → self-hosted Bugsink), and AI inference (OpenAI → Mistral, plus local models like Qwen), while explaining the deliberate exceptions kept on US infrastructure (Cloudflare, Stripe, Claude Code, GitHub/GitLab). It frames "digital sovereignty" as a practical risk-management exercise — knowing where data lives, avoiding single-vendor/jurisdiction dependence — and documents concrete migration friction (Proton's 3-domain cap, no content-based filters, OVH's buried lifecycle-rule config) rather than abstract advocacy.

monokai.comwriteupAdded 3 Sep 2026, published 13 May 2026🛡️ Security

A 258-item, 17-category security checklist targeting vulnerabilities that AI coding assistants (Claude, GPT, Gemini, Grok, Mistral, Copilot) commonly introduce, each item tagged with severity and a static/runtime/config detection method. Includes a companion prompt.md that turns the checklist into an automated scan runnable via Claude Code, Gemini CLI, or OpenAI Codex CLI against a local codebase, covering issues like prompt injection via user-supplied system prompts, missing auth middleware, hardcoded secrets, exposed API keys in frontend env vars, LLM-based auth decisions, unsandboxed agentic shell/filesystem access, and vector DB tenant isolation gaps.

github.comrepoAdded 3 Sep 2026, published 13 May 2026🛡️ Security

Aikido details a new wave of the Mini Shai-Hulud npm worm that has compromised 373 malicious package-version entries across 169 package names, including TanStack, Mistral AI, UiPath, and Squawk packages. Unlike the earlier SAP-focused wave (setup.mjs/execution.js), this version drops a root-level router_init.js and adds a malicious GitHub-hosted optionalDependency (@tanstack/setup) whose prepare script silently runs a Bun-based credential stealer targeting npm/GitHub tokens, AWS/Kubernetes/Vault secrets, and GitHub Actions OIDC tokens, then abuses trusted publishing to self-propagate by minting fresh npm publish tokens and pushing new compromised releases. The post includes full affected-package/version lists, file hashes, network IOCs, and remediation/rotation guidance.

aikido.devwriteupAdded 3 Sep 2026, published 11 May 2026🛡️ Security