News
Claude escapes and one more attack on npm!
Claude escapes, one more attack on npm and why Golang is the best for AI-Assisted coding
Guide to Cloud Architecture Diagrams with AWS
Enhance visibility into your cloud architecture with expert insights from AWS + Datadog. In this ebook, AWS Solutions Architects Jason Mimick and James Wenzel guide you through best practices for creating professional and impactful diagrams. Download the ebook today!
Holiday Creator Calendars Are Filling Up. Q4 Panic Is Optional.
Creators lock in their holiday content calendars 90 days out, before most ecommerce brands finalize their commission strategy and way before Black Friday and October deal events.
Get ahead of the seasonal rush with The 90-Day Holiday Sprint, a practical guide for brands that want creators driving holiday demand while competitors are still recruiting:
Structure commissions by lifetime value, not just first-order margin
Lead with the right products so creators promote with confidence
Recruit and onboard creators with a day-by-day plan for the first 30 days
Read performance early and pull program levers by Day 60
Brief creators with a holiday checklist before calendars fill up
Your 90-day countdown starts now.
Claude escapes! - Anthropic found that Claude models accessed the public internet during security tests because of a misconfigured sandbox. The models then reached real systems and gained unauthorized access, raising concerns about AI testing and containment. Read more.
Golang is best for AI-assisted coding - Google says Go’s simple syntax, static typing, fast compilation, and built-in concurrency make it easier for AI coding tools to generate reliable code. Its opinionated design also reduces ambiguity, helping developers review, test, and maintain machine-written software more efficiently. Read more.
One more attack on npm! - A major npm supply-chain attack has compromised 400+ packages, using malicious releases to steal developer, GitHub, cloud, and CI/CD credentials. The malware can then use stolen publishing access to inject itself into more packages, turning one compromised developer account into a wider propagation path. Read more.
Google Introduces Gemini 3.7 Flash: A Faster Workhorse for Coding and AI Agents
Google has introduced Gemini 3.7 Flash, its latest Flash-series model designed to handle coding, software engineering, web development, and agentic workflows. Arriving just three weeks after Gemini 3.6 Flash, the new model focuses on improving multi-step reasoning, tool use, code generation, and production workflows while also reducing the cost of running AI applications.
Stronger Coding and Agentic Performance
Gemini 3.7 Flash is positioned as a workhorse model for developers building AI-powered applications and coding agents. Google says the model delivers significant improvements in debugging, issue resolution, and first-pass code accuracy compared with Gemini 3.6 Flash.
On the FrontierCode 1.1 Main benchmark, Gemini 3.7 Flash scored 43.6%, up from 34.4% for its predecessor. On DeepSWE v1.1, a software-engineering benchmark, it achieved 65.3% compared with 49.0% for Gemini 3.6 Flash.
The improvements also extend beyond traditional coding. On WebDev Arena, Gemini 3.7 Flash reached an Elo score of 1588, compared with 1538 for Gemini 3.6 Flash. Google says it can generate more complete web applications and functional layouts using fewer prompts, while also following reference screenshots and design systems more accurately.
The model is also designed to work effectively with tools and multiple steps. Google says it spends more effort on planning and tool calls, adapts better when it encounters roadblocks, and follows instructions more precisely. This is particularly important for autonomous agents that need to complete tasks rather than simply generate a response.
Lower Cost, Wider Use Cases
One of the biggest changes is pricing. Google is introducing Gemini 3.7 Flash at $0.75 per million input tokens and $3.75 per million output tokens through the end of 2026. The combination of lower pricing and higher performance is aimed at making production-scale AI agents more affordable.
The model also improves knowledge-heavy workflows. Google reports a score of 34.0% on the GDP.pdf benchmark, compared with 22.0% for Gemini 3.6 Flash, and 30.4% on AutomationBench, compared with 17.0%.
Gemini 3.7 Flash is already being integrated into Gemini Spark, Google's 24/7 personal AI agent. Spark can use the new model to handle tasks such as organizing files, drafting emails, and updating documents across Google Workspace.
For developers, Gemini 3.7 Flash is available through the Gemini API, Google AI Studio, Android Studio, and Google Antigravity. Enterprises can access it through Google's enterprise AI platforms.
Lite-llm supply chain attack! - A LiteLLM supply-chain attack potentially exposed 2,500+ organizations and 430,000+ CI/CD pipelines, leaking cloud credentials, SSH keys, tokens, and AI provider keys. Read more.
OpenAI’s answer to Claude Fable for security - OpenAI has introduced GPT-5.6-Cyber through Daybreak Red for approved defenders, targeting advanced vulnerability research, exploit validation, and penetration testing. The model reportedly completes 95% of advanced cybersecurity requests in OpenAI’s internal evaluation. Read more.
Buzz of the Week!
Prefix Caching
Prefix caching is an inference optimization where an AI serving system stores the KV-cache for a prompt prefix and reuses it across later requests. For example, an agent repeatedly sending the same system prompt, tool definitions, or repository context doesn't need the model to recompute those tokens every time. The cached key-value tensors can be attached directly to the next request, reducing prefill computation and time-to-first-token (TTFT). It is particularly valuable for coding agents, where large system instructions and tool schemas are repeatedly included in thousands of requests. The main engineering challenge is cache management: matching prefixes, allocating GPU memory, handling eviction, and preventing stale or incompatible entries. Systems such as vLLM implement prefix caching to improve throughput when requests share substantial prompt prefixes.
Things that launched. Things that went viral. Things you'll pretend to try.
cnspec
cnspec is an open source, cloud-native security to protect everything from build to runtime.
qsv
qsv is a Blazing-fast Data-Wrangling toolkit.
wizer
wizer is the WebAssembly Pre-Initializer
Build Braincells, Not Just Features
This weekend’s read: Don’t look up!
This week’s watch: Everyday Products That Are Secretly The Exact Same Thing.
Meanwhile…
