Claude Code's source code has been leaked via a map file in their NPM registry

The source code for Claude Code has reportedly been leaked via a source map file in the npm registry. This exposure allows for the inspection of the tool's internal logic and implementation details.

Read more

Axios compromised on NPM – Malicious versions drop remote access trojan

A sophisticated supply chain attack compromised the axios npm package (versions 1.14.1 and 0.30.4) via a hijacked maintainer account to distribute a cross-platform RAT. The malware utilized a "phantom dependency" and postinstall scripts to execute a multi-stage payload while employing anti-forensic techniques like manifest swapping to hide its presence. StepSecurity’s AI Package Analyst and Harden-Runner detected the breach by identifying anomalous C2 traffic and suspicious metadata patterns, highlighting the role of AI-driven behavioral analysis in securing critical software dependencies.

Read more

OpenAI closes funding round at an $852B valuation

OpenAI has closed a record $122 billion funding round, reaching a post-money valuation of $852 billion. The round included significant capital from SoftBank, Nvidia, and Amazon, while notably raising $3 billion from individual investors through bank channels for the first time. Despite generating $2 billion in monthly revenue and supporting 900 million weekly active users, the company remains unprofitable and is reining in costs on projects like Sora to prepare for a potential IPO.

Read more

Slop is not necessarily the future

While AI coding agents currently contribute to "slop" and increased system brittleness, economic incentives will eventually drive models toward generating high-quality, maintainable code. Good code is inherently more token-efficient, requiring less context and compute for future modifications compared to complex, bloated abstractions. As the market matures, competition will favor models that minimize technical debt to reduce long-term operational costs.

Read more

The Claude Code Source Leak: fake tools, frustration regexes, undercover mode

Anthropic accidentally leaked the Claude Code source code via an npm package source map, revealing internal anti-distillation measures like fake tool injection and server-side text summarization. The leak exposes "KAIROS," an unreleased autonomous agent mode featuring background workers and nightly memory distillation. Technical implementations include Zig-level HTTP client attestation for API DRM, regex-based sentiment analysis, and sophisticated prompt cache management to optimize token usage.

Read more

"An Endless Stream of AI Slop"

A qualitative study of developer discussions characterizes "AI slop" as a tragedy of the commons where individual productivity gains externalize costs onto reviewers and maintainers. The research identifies three primary impacts: increased review friction and trust erosion, degradation of codebases and developer competence, and systemic forces driving workforce disruption. These findings highlight the need for mitigation strategies to address the negative externalities of low-quality AI-generated content in software development.

ArXiv

Precision Proactivity: Measuring Cognitive Load in Real-World AI-Assisted Work

Researchers analyzed the impact of cognitive load on GPT-4o-assisted financial valuation using a framework based on task decomposition and knowledge graphs. The study found that extraneous load, particularly from model-initiated task switching, negatively impacts performance three times more than intrinsic load. While AI-generated content improves output quality, expertise moderates these effects, with less experienced users seeing higher marginal gains but facing steeper penalties from cognitive load.

ArXiv

Rethinking Language Model Scaling Under Transferable Hypersphere Optimization

HyperP is a hypersphere parameterization framework that enables stable hyperparameter transfer across width, depth, and MoE granularity using the Muon optimizer. By constraining weights to a Frobenius sphere, it maintains bounded stability indicators and achieves 1.58x compute efficiency over standard Muon baselines. The framework also introduces SqrtGate for MoE scaling and demonstrates that optimal learning rates follow the 0.32 power law previously observed in AdamW.

ArXiv

The Last Fingerprint: How Markdown Training Shapes LLM Prose

Researchers propose that LLM em dash overuse is a form of "markdown leakage" resulting from structural patterns internalized during training on markdown-saturated corpora. Experiments across twelve models show that while markdown suppression eliminates overt formatting, em dashes persist as a signature of specific fine-tuning methodologies. The study demonstrates that this latent tendency exists in base models and serves as a diagnostic for post-training alignment rather than a mere stylistic quirk.

ArXiv

An Alternative Trajectory for Generative AI

The sustainability of monolithic LLM scaling is threatened by escalating inference costs and physical resource constraints. The authors propose Domain-Specific Superintelligence (DSS) leveraging symbolic abstractions—such as knowledge graphs and formal logic—to train SLMs via synthetic curricula. This paradigm shifts toward "societies of DSS models" orchestrated by agents, enabling high-reasoning capabilities to migrate from data centers to efficient, on-device deployment.

ArXiv

Postgres extension for BM25 relevance-ranked full-text search

pg_textsearch is a production-ready Postgres extension for BM25 ranked text search, optimized for top-k queries via Block-Max WAND. It supports parallel index builds, partitioned tables, and standard Postgres text configurations. The extension uses a memtable architecture with LSM-style segments and provides a simple <@> operator for scoring.

Repo

Pardus Browser- a browser for AI agents without Chromium

Pardus-browser is a lightweight, Rust-based headless browser that provides AI agents with structured semantic state instead of pixel-based screenshots. It parses HTML into a semantic tree featuring ARIA roles, navigation graphs, and action annotations in under 200ms without Chromium or Docker dependencies. The tool supports Markdown, JSON, and tree-based outputs, allowing LLMs to efficiently identify and interact with page elements like forms, links, and buttons.

Repo

CargoWall – eBPF Firewall for GitHub Actions

CargoWall is an eBPF-based network firewall for GitHub Actions that provides kernel-level egress filtering to prevent supply chain attacks and data exfiltration. It utilizes a DNS proxy for JIT rule updates and supports hostname/CIDR filtering, Docker integration, and sudo lockdown to ensure policy enforcement. The action operates in audit or enforcement modes on Linux runners with kernel 5.x+ and can be managed via YAML or the CodeCargo platform.

Repo

Free AI API gateway that auto-fails over Gemini, Groq, Mistral, etc.

RelayFreeLLM is an open-source gateway that aggregates multiple free-tier LLM providers, including Gemini, Groq, and Mistral, into a single OpenAI-compatible API. It features automatic failover, circuit breakers, and quota-aware routing to maximize throughput and eliminate 429 errors. The system supports intent-based model selection and allows users to mix cloud providers with local Ollama instances without changing their existing codebase.

Repo

Claude Code fork that works with any OpenAI-compatible LLM

Claude Code Any is a CLI-based AI coding agent that extends Anthropic's Claude Code to support any LLM backend, including OpenAI, DeepSeek, and local providers like Ollama. It provides a full agent toolchain for file editing, bash execution, and multi-file planning, featuring smart routing to optimize model selection based on task complexity and cost. The tool utilizes an OpenAI-compatible adapter to bridge Anthropic's SDK with various providers and includes native integration with OpenClaw and ACP.

Repo