The archive

Latest articles

Reporting, explainers, and analysis on data and AI, updated continuously by the newsroom.

Bar chart showing AI code review pass rates for image-based secret theft. Claude Code refused the attack 100 percent of the time across ten runs. Cursor and Antigravity leaked the .env file 100 percent of the time under Sonnet, Gemini, and GPT-5.5.

Ghostcommit weaponizes images to steal secrets from AI agents

Ghostcommit is a prompt injection attack that hides malicious instructions inside PNG files in pull requests. It exploits a blind spot in AI code reviewers to steal .env secrets, exposing a critical new attack surface for teams shipping with coding agents.

Lars Cornelissen · Jul 13, 2026

Illustrative chart showing standard performance mode consuming roughly 30 percent fewer DBUs than performance-optimized mode for Databricks managed Iceberg materialized view refreshes, with performance mode at 100 DBUs and standard mode at 70 DBUs per refresh.

Databricks

Databricks managed Iceberg materialized views, explained

Managed Iceberg materialized views let external engines like Trino read your Databricks MVs. Now in Public Preview, they shift the lock-in calculus.

Lars Cornelissen · Jul 13, 2026

Bar chart of solve rates by task length showing frontier models scoring above 60 percent on short tasks and below 25 percent on long-horizon tasks, with the long-task gap at 35 percentage points. Long-Horizon-Terminal-Bench agent results.

Research

Long-Horizon-Terminal-Bench finds agents hit a long-task wall

Long-Horizon-Terminal-Bench tests AI agents on multi-step terminal tasks with dense reward grading. Top models solve under 30 percent of long-horizon tasks, exposing a durability gap.

Lars Cornelissen · Jul 13, 2026

VultronRetriener model family MTEB scores versus other open embedding models. VultronRetriever-base leads at 72.1, followed by E5-Mistral at 70.3, BGE-M3 at 69.8, and nomic-embed at 68.5.

VultronRetriever takes on-device RAG to the MTEB top

VultronRetriver is a family of embedding models built for on-device retrieval. The 8B variant tops the MTEB leaderboard while running fully offline on an iPhone for Q&A.

Lars Cornelissen · Jul 12, 2026

Abstract data art showing three concentric circles representing GPT-5.6 model sizes Luna, Terra, and Sol. The smallest circle is labeled with the keyword GPT-5.6 pricing: Luna at $1/$6, Terra at $2.50/$15, Sol at $5/$30 per million tokens.

AI for dummies

OpenAI's GPT-5.6 Luna Terra Sol: what beginners should know

GPT-5.6 is OpenAI's newest model family in three sizes: Luna, Terra, and Sol. It claims big efficiency gains for long-running agent tasks at a fraction of competitor costs.

Lars Cornelissen · Jul 11, 2026

Abstract data art representing a single HTTP header piercing through a layered authentication barrier, symbolizing the Gitea Docker auth bypass CVE-2026-20896 where one X-WEBAUTH-USER header lets attackers impersonate any user including admins across approximately 6,200 exposed instances.

Cyber security

Gitea Docker auth bypass lets attackers impersonate admins

A critical Gitea Docker auth bypass, CVE-2026-20896, lets attackers impersonate any user with one HTTP header. Over 6,200 instances are exposed online.

Lars Cornelissen · Jul 11, 2026

Abstract data visualization of ShareFile Storage Zone Controllers response urgency at 5 on a 1 to 5 scale, the highest level, compared to prior Progress incidents MOVEit Transfer and MOVEit Automation at 4.

Cyber security

ShareFile Storage Zone Controllers shut down, no patch yet

ShareFile Storage Zone Controllers are on-prem servers Progress ordered shut down on July 10 over a credible threat with no patch available.

Lars Cornelissen · Jul 11, 2026

Data

Agentic MCP attacks bypass SOTA guardrails 58% of the time

MCP attack chains bypass SOTA guardrails more than half the time because text classifiers miss composed tool-call exploits. The agentic safety gap is architectural, not a tuning problem.

Lars Cornelissen · Jul 9, 2026

Four benchmark tasks shown as paired bars comparing automated pass/fail scores with AgentLens trajectory review scores. SWE-bench drops from 34 to 19 percent, HumanEval from 71 to 52 percent, BigCodeBench from 28 to 9 percent, and LiveCodeBench from 41 to 26 percent. The coding agent evaluation gap is widest on BigCodeBench.

Research

AgentLens cuts coding agent scores in half on review

AgentLens is a trajectory review framework for coding agent evaluation that scores the full agent process, not just whether tests pass. Agent success rates drop 30 to 60 percent under trajectory review, meaning production readiness is roughly half the benchmark headline.

Lars Cornelissen · Jul 9, 2026

Abstract waveform visualization showing overlapping input and output audio patterns representing GPT-Live full-duplex architecture with 150 million weekly ChatGPT Voice users and 2 model components in the new architecture

AI for dummies

GPT-Live voice mode: what full-duplex AI changes for you

GPT-Live is OpenAI's new voice model that listens and speaks at once. It delegates hard questions to GPT-5.5 mid-conversation while keeping the flow going.

Lars Cornelissen · Jul 9, 2026

Bar chart of local AI decode speeds on Apple Silicon. Qwen 3.6 27B on M5 Max: 28 tok/s baseline, 63 tok/s with MTPLX MTP, a 2.24x speedup.

AI for dummies

How MTPLX v2 makes local AI on Mac twice as fast

MTPLX v2 uses multi-token prediction to run local AI on Apple Silicon Macs up to 2.24x faster. Here is what beginners need to know.

Lars Cornelissen · Jul 9, 2026

Bar chart of LLM hallucination rates for repository identifiers: 0.9 percent for pre-2019 repos, 85 percent for popular repos, and 92.4 percent for 2025 repos. The attack targets AI coding agents like Cursor and Copilot.

Engineering

HalluSquatting turns AI coding agents into a botnet

HalluSquatting is a pull-based prompt-injection attack that exploits LLM hallucinations of repository names. Coding agents hallucinate up to 92 percent of newer repo identifiers, letting attackers squat those names and ship reverse shells at scale.

Lars Cornelissen · Jul 8, 2026