the brief

Today’s pulse leans hard into reliability, security, and orchestration. OpenAI’s harness tweaks tripled ARC‑AGI‑3 scores, while Hugging Face dissected a real model intrusion and Perplexity shipped Numbat to police agent actions. Cloudflare moved origins to post‑quantum auth, DeepMind rolled out Lyria 3.5 for Flow Music, and an hours-scale Claude hiccup reminded everyone of agent fragility.

the poursit · sip · 15 items

alerts

(02)
  • simonw/blog· AnalysisJul 29, 06:43 PM

    Word Copilot prompt worm discovered

    New prompt-injection variant hides instructions in Word documents used by Copilot for Word, enabling self-replicating ‘worms’—treat untrusted Office content as executable inputs and harden retrieval pipelines.

    AI Worming through Word — <p><strong><a href="https://enklypesalt.com/posts/context-collapse-part3-ai-worming-through-word/">AI Worming through Word</a></strong></p> Neat new prompt injection variant by Håkon Måløy, who found a way to upgrade prompt injection attacks against Microsoft Word to full self-replicating worms:</p> <blockquote> <p>An attacker places hidden instructions in a document that is later used as source material in Copilot for Word. Copilot may interpret those instructions a...

    signal 9hype 1prompt_injectionllm_securityself_replicationtechnicalsource ↗

pulse

(07)
  • deepmind/blog· First-partyJul 29, 04:02 PM

    DeepMind launches Lyria 3.5 music model

    DeepMind’s latest music model powers Google Flow Music with richer musicality, more natural vocals, better lyric handling, and finer creative controls, signaling steadier progress in controllable audio generation.

    We’re launching Lyria 3.5 in Google Flow Music, with advances across musicality, lyrics, vocals, and creative control

    signal 6hype 4model_releasemusic_generationmultimodallaunchsource ↗
  • youtube/openai· YouTubeJul 29, 05:23 PM

    OpenAI gives 100K researchers free access

    OpenAI will provide 100,000 scientists, mathematicians, and engineers free access to its frontier models through 2027, aiming to accelerate research while seeding workflows around ChatGPT for Academic Researchers.

    We're giving 100,000 academic researchers free access to our frontier models

    signal 5hype 1openaiaccess_programfrontier_modelslaunchsource ↗
  • cloudflare/blog· First-partyJul 29, 01:00 PM

    Cloudflare adds post-quantum origin auth

    Cloudflare now supports post-quantum authentication for connections to customer origins via Authenticated Origin Pulls and Custom Origin Trust Store, an early step toward PQ-by-default across its network.

    Post-quantum authentication to origins is now supported — Cloudflare now supports post-quantum (PQ) authentication when connecting to customer origin servers via Authenticated Origin Pulls and Custom Origin Trust Store. This is the first step towards providing PQ authentication for all Cloudflare products.

    signal 7hype 2cloudflarepost_quantumsecuritylaunchsource ↗
  • perplexity-ai.zpravobot.news.ap.brid.gy· Bluesky mirror · @perplexity_aiJul 29, 05:10 PM

    Perplexity open-sources Numbat agent defense

    Perplexity’s Numbat adds an open agent-detection and response layer with visibility into agent actions and the ability to block risky operations before execution, designed to plug into multiple harnesses.

    Today we’re open-sourcing Numbat, an agent-detection and response layer that is designed to work across agent harnesses. Numbat gives security teams visibility into agent activity, with controls to block selected actions before execution. Read more […] [Original post on zpravobot.news]

    signal 7hype 1open_sourceagent_securityagentslaunchsource ↗
  • theo-mirr.selfhosted.social· Bluesky mirror · @theoJul 29, 11:44 PM

    T3 Code ships mobile remote control

    The open-source T3 Code app lands on iOS and Android, letting developers control Claude and Codex remotely via 'npx t3 connect'—handy for on-the-go review and fixes.

    T3 Code is now available on iOS and Android. Run “npx t3 connect” in your terminal, install the app, and now you can control Claude and Codex fully remotely. Still 100% free. Still 100% open source. Enjoy 🫡

    signal 7hype 2t3_codemobileopen_sourcelaunch
  • vercel/next.js· First-partyJul 30, 12:04 AM

    Next.js canary improves PWA and performance

    Next.js v16.3.0-canary.103 ships PWA guide updates, fragment-scroll navigation fixes, improved PPR rendering for bots, HMR chunk handling tweaks, and a PostCSS bump—worth testing before the stable cut.

    v16.3.0-canary.103 — Misc Changes Update PWA guide with enhanced offline support details and example links for serwist: #96360 [fragment-scroll] Stop blurring on navigations: #96113 Fix PPR rendering for configured HTML bots: #96364 Bump postcss to 8.5.23: #96107 Ensure unique resolved headers() value between render passes: #96085 Share Ecmascript HMR chunk versioning, diffing, and merging between browser and node: #96325 Make retry stop when the time it was given is up: #96354 Gate partial f...

    signal 6hype 1nextjsrelease_notescanarylaunchsource ↗
  • hn/frontpage· AggregatorJul 29, 12:11 PM

    GitHub disrupts npm and Actions attacks

    GitHub outlines newly deployed defenses disrupting supply-chain attacks across npm and GitHub Actions, tightening publisher and workflow security to blunt dependency hijacks and malicious CI abuse.

    Disrupting supply chain attacks on NPM and GitHub Actions — Article URL: https://github.blog/security/supply-chain-security/disrupting-supply-chain-attacks-on-npm-and-github-actions/ Comments URL: https://news.ycombinator.com/item?id=49096427 Points: 6 # Comments: 2

    signal 6hype 2supply_chain_securitygithub_actionsnpmlaunchsource ↗

findings

(04)
  • openai/blog· First-partyJul 29, 03:00 PM

    Two settings triple ARC-AGI-3 scores

    OpenAI shows that enabling retained reasoning and output compaction in the agent harness dramatically boosts GPT‑5.6’s ARC‑AGI‑3 score and efficiency, underscoring how orchestration choices can bottleneck model capability.

    How enabling two settings tripled our scores on the ARC-AGI-3 benchmark — How two API settings improved GPT-5.6 performance on ARC-AGI-3, boosting scores and efficiency by retaining reasoning and enabling compaction.

    signal 9hype 2openai_apibenchmarkarc_agi_3technicalsource ↗
  • hn/frontpage· AggregatorJul 29, 03:01 PM

    Anatomy of a frontier-lab model intrusion

    Hugging Face publishes a technical postmortem of a frontier-lab model intrusion, detailing the attack chain and mitigations—useful reading for anyone shipping agents and model-serving infrastructure.

    Hugging Face: Anatomy of a frontier-lab agent intrusion — Article URL: https://huggingface-anatomy-of-frontier-lab-model-intrusion.static.hf.space/index.html Comments URL: https://news.ycombinator.com/item?id=49098466 Points: 13 # Comments: 2

    signal 8hype 2securitypostmortemagentstechnicalsource ↗
  • tmlr-pub.bsky.social· BlueskyJul 29, 04:21 PM

    Forge learns optimization via graph embeddings

    TMLR paper introduces Forge, learning compact optimization representations from graph embeddings to improve downstream solver performance; an interesting bridge between representation learning and combinatorial optimization.

    Forge: Foundational Optimization Representations from Graph Embeddings Zohair Shafi, Serdar Kadioglu Action editor: Jasper C.H. Lee https://openreview.net/forum?id=7Uo1yRWUpo #embeddings #autoencoder #quantization

    signal 3hype 1papergraph_embeddingsoptimizationtechnicalsource ↗
  • natbiotech.nature.com· BlueskyJul 29, 02:15 PM

    Steering protein generation with ProteinGuide

    Nature Biotechnology paper proposes ProteinGuide, providing property guidance to protein sequence generative models so designers can steer toward target traits without exhaustive screening.

    Property guidance for protein sequence generative models with ProteinGuide - @jlistgarten.bsky.social @savagecatsonly.bsky.social www.nature.com/articles/s41...

    signal 6hype 1paperprotein_designgenerative_modelstechnicalsource ↗

voices

(02)
  • yoshuabengio.bsky.social· BlueskyJul 29, 05:38 PM

    Bengio backs frontier pacing letter

    Yoshua Bengio amplifies an open letter signed by 1,000+ frontier-lab scientists calling to ‘pace the frontier’ with stronger technical and governance guardrails.

    1000+ scientists at frontier AI companies are speaking out to warn that the current commercial race leads to unacceptable security risks. I agree with their call for an international effort to develop technical and governance guardrails to ensure a safer way forward. www.pacingthefrontier.com

    signal 4hype 2governanceai_safetyopen_letterculturalsource ↗
  • simonw/blog· AnalysisJul 29, 06:18 PM

    Matthew Green on AI cryptanalysis moment

    Matthew Green contextualizes Anthropic’s cryptanalysis results amid the shift to post‑quantum cryptography, arguing this is a pivotal moment for public cryptanalysis capabilities.

    Quoting Matthew Green — <blockquote cite="https://blog.cryptographyengineering.com/2026/07/29/some-notes-about-anthropics-new-results/"><p>Right now we’re in the midst of a historic transition from traditional public-key algorithms based on EC-based cryptography and RSA, moving over to new <em>post-quantum</em> algorithms based on novel problems. This is why there are so many standards like HAWK being considered. If there was ever a perfect time for a massive new public cryptanalysis capabili...

    signal 6hype 2cryptographypost_quantumai_capabilitiesculturalsource ↗