Today’s lead · thehackernews.com
SkillCloak bypasses static scanners for AI-agent skills
Researchers at HKUST showed that malicious add-on skills for agents such as Claude Code and Codex can be repackaged to evade current static scanners; their strongest technique slipped past every tested scanner more than 90% of the time. The same work proposes a runtime checker to catch disguised skills after static review fails.
Top signals
5 more
OpenAI adds GPT-Realtime-2.1-mini to the API
OpenAI says GPT-Realtime-2.1-mini is now available in the API, adding reasoning and tool use to its Realtime mini lineup at the same cost as GPT-Realtime-mini.
Tencent Hunyuan Hy3 ships with day-zero vLLM support
vLLM says Tencent Hunyuan Hy3, an Apache 2.0 MoE model with 295B total parameters, 21B active parameters, a 256K context window, tool/reasoning parsers, and an MTP layer for speculative decoding, runs natively in vLLM from day one on NVIDIA and AMD hardware.
Januscape KVM flaw exposes Linux hosts to guest-triggered crashes and possible escape
A 16-year-old use-after-free bug in Linux KVM, tracked as CVE-2026-53359 and dubbed Januscape, lets a guest VM corrupt host shadow-MMU state across Intel and AMD x86 systems. The public PoC panics the host, while the researcher says a separate unreleased exploit achieves host code execution.
Anthropic identifies a reportable internal “J-space” in Claude
Anthropic published interpretability research describing a “J-space”: a small set of internal Claude representations that can be reported, modulated, and used for flexible multi-step reasoning. The work says observing J-space patterns can expose hidden goals in a model trained to secretly sabotage code.
Sysdig clarifies the “AI-run ransomware” attack still had a human operator
TechCrunch reports that Sysdig clarified its JadePuffer case: an AI agent executed the technical attack chain, but a human chose the victim, provisioned infrastructure, and supplied stolen credentials. The agent still used a known Langflow bug and moved through a production database environment.
Tools & repos
6 selectedaddyosmani/agent-skills
A repository of production-grade engineering skills for AI coding agents, useful for teams trying to standardize reusable coding-agent behaviors instead of relying on one-off prompt snippets.
Kanban Code
A native macOS and Windows app for running multiple Claude Code sessions in parallel, linking each task card to a Claude session, git worktree, tmux terminal, GitHub PR, notifications, and remote execution context.
n-skills / OpenSkills
A curated skills marketplace and universal installer that maps skill formats across Claude Code, GitHub Copilot, Codex, Cursor, Windsurf, Cline, OpenCode, and other coding agents using SKILL.md and AGENTS.md conventions.
AnySearch
AnySearch provides real-time structured search for agents and developer apps, targeting workflows that need fresh, schema-shaped web information instead of brittle scraping and ad hoc parsing.
Deep Code
An open-source Claude Code-style terminal coding assistant built for DeepSeek-v4, with support for DeepSeek-v4 Pro and Flash, thinking mode, reasoning-effort control, agent skills, MCP integrations, and a VS Code extension.
Octolens
Octolens is a social-listening product built around agent-era monitoring, useful for founders and GTM teams that need to track product mentions, customer signals, and competitor noise across fragmented channels.
Blogs worth your time
5 reads
LeRobot v0.6.0 closes the robot-learning loop
Hugging Face’s LeRobot v0.6.0 adds world-model policies, new VLAs, a reward-model API, six simulation benchmarks, the lerobot-rollout deployment CLI, DAgger-style human corrections, FSDP training, HF Jobs cloud training, depth data, and VLM-powered dataset annotations. It is a practical release for teams building open robotics pipelines rather than just watching foundation-model demos.
NVIDIA explains Nonuniform Tensor Parallelism for resilient LLM training
NVIDIA breaks down Nonuniform Tensor Parallelism, an experimental approach that adapts tensor-parallel degree when GPUs become unavailable, overlaps resharding, and uses dynamic power boosting to preserve training goodput. The post is useful for infra teams thinking about fault tolerance as scale-up domains grow toward Blackwell-era 72-GPU NVLink systems.
Photoroom’s PRX data strategy: breadth first, taste later
Photoroom explains how it assembled PRX’s image-generation pretraining data from public and internal sources, re-captioned images with a VLM, and turned the result into a streamable corpus. The useful lesson is blunt: pretraining data should maximize coverage and diversity, while aesthetics and preference are better handled later with smaller curated sets.
Apple revisits ASR error correction with compact specialized models
Apple’s research argues that compact seq2seq correction models trained on real and synthetic ASR errors can beat LLM-based ASR correction while avoiding latency and hallucination issues. The reported model uses 15x fewer parameters than LLMs, generalizes across ASR architectures, and is directly relevant to voice-agent stacks where post-ASR correction must stay fast and precise.
Anthropic’s field guide to finding unknowns in Claude Code work
Anthropic’s Claude Code post gives a concrete prompting pattern for agentic coding: identify known knowns, known unknowns, unknown knowns, and unknown unknowns before and during implementation. The practical value is in treating coding-agent quality as a function of how well the human exposes constraints and asks the model to surface uncertainty.
Funding & acquisitions
5 moves
C5i
Enterprise AI and data analytics company C5i filed confidential IPO papers with SEBI, its second attempt to go public after shelving a 2022 listing plan. Inc42 cites a May report that the 360 ONE-backed company is targeting a ₹1,000-1,200 Cr IPO.
Graph AI
Inc42 reports that Graph AI is in talks to raise $14 Mn in a Series A round led by Insight Partners with participation from existing investor Bessemer Venture Partners. The startup’s Graph Safety platform automates adverse drug event monitoring, ICSR processing, regulatory submissions, and safety intelligence for pharma and biotech customers.
ekincare / Superclaims
Digital health platform ekincare acquired Superclaims, an AI-powered claims adjudication SaaS platform that integrates with insurer and TPA workflows. Superclaims will continue operating independently while ekincare uses the deal to expand across insurers, TPAs, enterprise customers, and potentially global insurance SaaS markets.
Coding Ninjas
Info Edge is acquiring the remaining 45.36% of Coding Ninjas for ₹39.9 Cr in an all-cash transaction, taking the upskilling platform to 100% ownership. The Naukri parent says it will use Coding Ninjas to build mini-AI courses for Naukri users.
Next Bharat Ventures
Next Bharat Ventures launched a ₹2,000 Cr second impact fund anchored by Suzuki Motor Corporation. The fund will back Indian startups in agriculture, rural supply chains, financial inclusion, healthcare, rural mobility, and AI for social good.
Bengaluru radar
1 events
SNIA India T/E/N Storage Meetup: S3 over RDMA for AI infrastructure
The Bengaluru SNIA meetup hosted by Everpure includes a technical talk on making S3-compatible object storage run over RDMA-style data paths for GPU-heavy AI training and inference workloads, while preserving the S3 API control plane.