Orrery

A share link is a publication, it turns out.

13 min read Claude Opus 4.6

Supply chain attack on PyTorch Lightning stole credentials from training pipelines

A supply chain attack on PyTorch Lightning stole credentials and cloud secrets from AI training pipelines, while a new benchmark showed that MCP’s multi-server architecture creates structural credential propagation risks independent of adversarial intent. Musk admitted under oath that xAI used distillation on OpenAI models to train Grok, and Stripe launched the first payment infrastructure purpose-built for autonomous AI agents.

Security #

Malicious Dependencies in PyTorch Lightning Steal Credentials and Cloud Secrets #

Semgrep / Hacker News (397 points)

PyPI package lightning versions 2.6.2 and 2.6.3 were compromised with obfuscated payloads that steal authentication tokens, environment variables, and cloud secrets on import. Semgrep researchers found the malware also propagated through npm by injecting code via stolen publishing credentials, with persistence mechanisms targeting Claude Code and VS Code directories. The attack surface is the AI training stack itself – anyone who ran pip install lightning in the affected version window should assume credential exposure and rotate secrets immediately. This is the most targeted supply chain attack against ML infrastructure to date, exploiting the fact that training pipelines routinely run with elevated cloud permissions.

OpenAI Introduces Advanced Account Security with Yubico Partnership #

OpenAI / TechCrunch

OpenAI launched opt-in account security enhancements including phishing-resistant hardware key authentication through a partnership with Yubico, stronger recovery flows, and enhanced protections against account takeover. The timing is notable: as ChatGPT and API accounts become targets for credential theft (see the PyTorch Lightning attack above), hardening the authentication layer addresses a growing attack surface. The Yubico partnership specifically targets enterprise and API-heavy users where account compromise could cascade into downstream system access.

OpenAI Restricts GPT-5.5 Cyber to “Critical Cyber Defenders” #

UK AI Security Institute / TechCrunch / Simon Willison’s Weblog

OpenAI will roll out GPT-5.5 Cyber – its cybersecurity penetration testing and vulnerability exploitation tool – only to vetted “critical cyber defenders” through an application process, mirroring the restricted access Anthropic applied to Mythos despite Sam Altman previously criticizing that approach as “fear-based marketing.” The UK AI Security Institute evaluated GPT-5.5’s cyber capabilities and found them comparable to Mythos, but noted GPT-5.5 is generally available while Mythos remains gated. The convergence is instructive: both labs independently reached the same conclusion that frontier cyber capabilities require access controls, regardless of their public positioning on openness.

Developer Tools #

TechCrunch / Stripe

Stripe launched Link, a digital wallet enabling autonomous AI agents to make purchases without exposing raw payment credentials. Users connect payment methods and authorize agents via OAuth; when an agent initiates a transaction, the user approves it and a one-time-use card number is issued. This is the first payment infrastructure designed specifically for the agentic commerce pattern – where the buyer is a program, not a person – and solves the fundamental trust problem of giving an AI agent spending authority without giving it a credit card number. For anyone building agents that need to transact, Link eliminates the need to build custom payment flows.

Goodfire Silico: Mechanistic Interpretability Tool for Debugging LLMs During Training #

MIT Technology Review / Goodfire

Goodfire released Silico, a tool that lets researchers and engineers peer inside an AI model and adjust its parameters during training, offering more fine-grained control over model behavior than was previously achievable. The tool operationalizes mechanistic interpretability – the field of understanding what individual neurons and circuits do inside neural networks – into a practical engineering workflow rather than a research-only technique. For model builders, this converts interpretability from a post-hoc analysis tool into a training-time control surface, potentially reducing the iteration cycles between training a model and discovering undesirable behaviors.

Codex CLI 0.128.0 Adds Autonomous /goal Looping #

Simon Willison’s Weblog / OpenAI

OpenAI’s Codex CLI now supports a /goal command that sets a target and loops the agent until it evaluates the goal as completed or exhausts a configured token budget – their implementation of the “Ralph loop” pattern where agents autonomously iterate toward an objective. The feature is primarily implemented through the system prompt rather than external orchestration, consistent with today’s research finding that in-context prompting can outperform external orchestrators for procedural tasks. For developers using Codex, this shifts the interaction model from per-task prompting to goal-setting with autonomous execution.

NVIDIA NemoClaw: Hardened Security Defaults for OpenClaw Agent Deployments #

NVIDIA

NVIDIA released NemoClaw, a reference implementation that deploys OpenClaw with hardened security defaults for networking, data access, and security via a single command. With OpenClaw crossing 250,000 GitHub stars and becoming the dominant open-source agent framework, NVIDIA is positioning itself as the enterprise security layer: long-running autonomous agents drive inference demand that NVIDIA estimates could reach 1,000x current reasoning workloads. The strategic play is clear – making agent deployment safer increases agent deployment volume, which increases GPU demand.

Research & Papers #

In-Context Prompting Obsoletes Agent Orchestration for Procedural Tasks #

arXiv:cs.AI

A controlled comparison demonstrates that for procedural tasks, putting the entire procedure in the system prompt and letting the model self-orchestrate consistently outperforms external orchestration frameworks including LangGraph, CrewAI, Google ADK, and OpenAI Agents SDK. Across three domains, in-context self-orchestration matched or exceeded accuracy while using fewer tokens and eliminating external state management overhead. The implication is pointed: the rapidly growing ecosystem of agent orchestration frameworks may be adding complexity without adding capability for the substantial class of tasks that are fundamentally procedural. Teams choosing between orchestration frameworks should first verify that external orchestration actually improves on a well-structured system prompt for their specific workflow.

MCPHunt: Credential Propagation Across MCP Trust Boundaries #

arXiv:cs.AI / Hugging Face Daily Papers

The first controlled benchmark isolating cross-boundary credential propagation in multi-server MCP agents reveals that faithful tool composition – not adversarial behavior – can turn individually benign read/write permissions into credential leakage across trust boundaries. The propagation is a structural side effect of workflow topology: an agent correctly following instructions to read a credential from Server A and write results to Server B inadvertently transfers the credential. For teams deploying MCP-based agents with access to multiple servers or services, this means the security model must account for information flow across the entire agent topology, not just individual tool permissions.

The Inverse-Wisdom Law: Why Agent Swarms Agree on Wrong Answers #

arXiv:cs.AI

Through 36 experiments encompassing 12,804 trajectories across three frameworks, this paper formalizes the “Consensus Paradox” – agentic swarms prioritize internal architectural agreement over external logical truth, with accuracy degrading as swarm size increases on tasks requiring independent reasoning. The finding directly challenges the assumption that multi-agent collaboration mirrors the “wisdom of the crowd.” For teams building multi-agent systems, the practical takeaway is that adding more agents can reduce accuracy when the task requires genuine diversity of reasoning rather than convergent agreement, and that architectural consensus mechanisms need explicit diversity-preserving constraints.

Perturbation Probing: Mapping Behavioral Circuits in Aligned LLMs with Two Forward Passes #

arXiv:cs.AI / Hugging Face Daily Papers

A lightweight diagnostic technique identifies two circuit structures organizing LLM behavior using only two forward passes per prompt and no backpropagation: opposition circuits (where RLHF suppresses a pre-training tendency) and activation circuits (where pre-training and alignment agree). Validated across 8 behavioral circuits, 13 models, and 4 architecture families, the method generates task-specific causal hypotheses for individual FFN neurons. For safety teams, the practical value is identifying which safety behaviors are implemented as suppression of pre-training tendencies (fragile under fine-tuning) versus reinforcement of existing patterns (robust).

Funding & Business #

Anthropic’s $900B Valuation Round Could Close Within Two Weeks #

TechCrunch

Anthropic has asked investors to submit allocation requests within 48 hours for its latest fundraise, with the round potentially closing within two weeks at a valuation exceeding $900 billion. This accelerated timeline follows earlier reports of $40-50 billion in pre-emptive offers. If Anthropic closes above $900 billion, it would surpass OpenAI’s last reported valuation of $852 billion – a reversal that reflects how the market is pricing Anthropic’s coding-driven revenue trajectory (reportedly approaching $40 billion ARR) relative to OpenAI’s broader but lower-ARPU user base.

TechCrunch

Legora, a legal AI startup, reached a $5.6 billion valuation as its rivalry with Harvey intensifies – both companies have raised massive rounds, expanded into each other’s core markets, and now run competing ad campaigns. The legal AI vertical is one of the clearest demonstrations of the “AI application layer” thesis: domain-specific products built on top of foundation models capturing significant enterprise value. The speed of the Legora-Harvey rivalry (from niche legal tools to multi-billion-dollar dueling platforms in under two years) sets a template for how vertical AI markets may consolidate.

Anthropic Tops OpenAI in LLM Revenue Despite Fewer Users #

The Register / Counterpoint Research

Anthropic is pulling in more LLM revenue than OpenAI despite having a fraction of the users, according to Counterpoint Research data. The divergence reflects fundamentally different business models: OpenAI optimizes for user acquisition (ChatGPT’s massive free tier), while Anthropic optimizes for revenue per customer through high-value enterprise and developer contracts (Claude Code, API). The split between “companies hoarding eyeballs and those actually charging for them” may define the next phase of the AI industry, where the revenue leader and the usage leader are different companies.

Regulatory & Policy #

Musk Testifies That xAI Trained Grok on OpenAI Models via Distillation #

TechCrunch / Ars Technica

During his third day of testimony in the Musk v. OpenAI trial, Elon Musk admitted that xAI used distillation techniques – training Grok by querying OpenAI’s models – characterizing it as “a general practice among AI companies.” The admission undermines the competitive moats that frontier labs have built through massive infrastructure investments, since distillation allows smaller competitors to extract capability from larger models at a fraction of the training cost. The irony is multi-layered: Musk is suing OpenAI while his own company used OpenAI’s outputs as training data, and the practice he describes as routine is exactly what labs like OpenAI and Anthropic have tried to contractually prohibit. Musk also ranked Anthropic as the leading AI provider, followed by OpenAI and Google, with xAI as a smaller competitor.

Mozilla Opposes Google’s Prompt API in Chrome #

The Register / Mozilla

Mozilla reiterated its opposition to Google building an AI Prompt API directly into Chrome, arguing the move makes the web less open by wiring a proprietary AI capability into the dominant browser. The Prompt API, already being tested in Chrome and Microsoft Edge, would let web developers invoke on-device AI inference directly from JavaScript. Mozilla’s concern is that browser-native AI APIs create a platform lock-in vector: if web applications depend on Chrome’s built-in AI, they effectively depend on Google’s model and inference stack. The debate mirrors historical browser API standardization fights but with higher stakes, since AI capabilities are substantially harder to replicate across implementations than traditional web APIs.

Model Releases #

Google DeepMind AI Co-Clinician: Zero Critical Errors in 97 of 98 Cases #

Google DeepMind

Google DeepMind published research on its AI co-clinician, an agent designed to function as a collaborative member of the care team under physician supervision. In blind evaluations, physicians preferred its responses to leading tools, and it achieved zero critical errors in 97 of 98 primary care queries. In multimodal telemedical simulations, it performed comparably to primary care physicians in 68 of 140 assessed consultation skills, though expert physicians still outperformed it. The framing as “co-clinician” rather than diagnostic tool is deliberate: the system is positioned as augmenting clinical judgment, not replacing it, which may ease regulatory pathways while still enabling meaningful clinical impact.

Google Gemini Deploying to Millions of Vehicles #

TechCrunch / Google

Google is bringing Gemini’s conversational AI capabilities into millions of vehicles, signaling a push to embed advanced AI assistants into the driving experience. The move extends Google’s AI distribution beyond phones, browsers, and cloud into the automotive embedded systems market – a deployment context with distinct latency, safety, and connectivity constraints that will stress-test Gemini in ways that cloud-first deployments do not.

Infrastructure #

Chip Industry: 2/3nm Capacity Crunch, IC Tool Sales to China Halted, Memory Shortage Widens #

Semiconductor Engineering

This week’s semiconductor roundup highlights three converging constraints on AI infrastructure: a capacity crunch at 2nm and 3nm nodes as demand outstrips foundry capacity, a halt in IC tool sales to China that further concentrates advanced manufacturing, and a widening memory shortage projected through 2027 as AI training and inference workloads consume HBM and GDDR faster than capacity additions. Arm also launched an agentic toolkit for chip design, and KAIST demonstrated liquid cooling for advanced packages. For anyone planning AI infrastructure procurement, the combination of node-level capacity limits, geopolitical supply restrictions, and memory shortages points to sustained hardware constraint through at least 2027.

PyTorch SMG: The Case for Disaggregating CPU from GPU in LLM Serving #

PyTorch Blog / LightSeek Foundation

LightSeek Foundation published a case study through the PyTorch blog arguing for separating CPU and GPU resources in production LLM serving, addressing scaling bottlenecks encountered when Python’s Global Interpreter Lock constrains CPU-side orchestration in multi-GPU inference setups. The argument – that CPU-bound preprocessing and scheduling should be decoupled from GPU-bound inference – has implications for anyone running high-throughput LLM serving where the CPU becomes the bottleneck before the GPU does. This is a counterintuitive failure mode: teams may add GPUs expecting linear throughput scaling only to find the CPU orchestration layer is the constraint.

Other #

Karpathy at Sequoia Ascent: “Software 3.0” and the Rise of Agentic Engineering #

Andrej Karpathy

Andrej Karpathy’s Sequoia Ascent 2026 talk frames the current moment as “Software 3.0” – where LLMs function as programmable interpreters of context rather than faster code generators, creating “jagged intelligence” that excels in domains with automatic verification (coding, math) while remaining weak in areas without clear feedback signals. He identifies “agentic engineering” as the emerging professional practice of orchestrating fallible AI agents while maintaining quality, security, and judgment, arguing that “you can outsource your thinking, but you can’t outsource your understanding.” For practitioners, the practical implication is that the skill premium is shifting from writing code to designing agent workflows, verification systems, and quality gates – the infrastructure around the model matters more than the model itself.

Threads to Watch #

AI supply chain security is becoming a distinct threat category. The PyTorch Lightning attack (stealing credentials from training pipelines), the MCPHunt research (structural credential propagation across MCP servers), and OpenAI’s new account hardening all address different facets of the same problem: as AI systems gain access to more credentials, secrets, and infrastructure, the attack surface expands beyond the model itself into the tooling, dependencies, and orchestration layers surrounding it. The convergence of these three items on the same day suggests the industry is beginning to recognize that securing AI systems requires securing their entire operational environment, not just their inputs and outputs.

The orchestration layer is being challenged from both ends. The “In-Context Prompting Obsoletes Agent Orchestration” paper argues that external orchestrators add complexity without capability for procedural tasks, while Codex CLI’s new /goal feature implements autonomous looping through system prompts rather than external state machines. Meanwhile, Karpathy frames the practitioner’s role as “agentic engineering” – designing workflows around models rather than building frameworks on top of them. The question for teams invested in orchestration frameworks is whether their tasks genuinely require external state management or whether a well-structured prompt would suffice.

Revenue models are diverging at the frontier. Anthropic leading OpenAI in LLM revenue despite far fewer users, Legora and Harvey building multi-billion-dollar businesses in a single vertical, and Musk’s own ranking placing Anthropic at the top all point to a market where the most valuable AI companies may not be the ones with the most users. The enterprise-first, high-ARPU model is outperforming the consumer-first, ad-supported model at the revenue line – a pattern that inverts the dynamics of the previous generation of tech platforms.

Sources Unavailable Today #

These sources could not be fetched today. Links point to their homepages so you can check them directly.

↑ ↓