vendor-risk
20 posts
- Hugging Bay builds a BitTorrent backup for open AI models as Nvidia buys Hugging Face
A volunteer-built BitTorrent index for open AI models went online in July, weeks before Nvidia's $12.93 billion Hugging Face deal. Its design is credible. Its network is still too small to matter.
- OpenAI's Agents Turned a Documentation Build Step Into Remote Code Execution
Independent researchers reconstructed how OpenAI's own agents ran code on RubyDoc.info's servers in May, from public package data alone. OpenAI's account, four months on, says far less.
- ChatGPT for Healthcare brings patient records and public medical data into the workspace
OpenAI’s Epic integration and public-data plugin connect clinical work to its source information, with organisational access controls and physician evaluations.
- 294,000 exposed AI tools is the wrong number to worry about
Censys counted 294,000 IPs exposing AI tooling to the public internet. The number that should change your afternoon is CVE-2026-42208, a pre-auth SQL injection in LiteLLM that CISA lists as actively exploited.
- A webcam's recording light is only useful if its firmware is protected
Chaz Schlarp used Claude Opus 5 to reverse-engineer five desk peripherals in about 13 hours of agent time, including a webcam whose recording LED he could switch off. The demonstration is real; the worm at the end of it is a forecast.
- Hugging Face Published the Whole Timeline. The Part That Stuck With Me Was the Refusal.
17,600 attacker actions reconstructed in public. The detail I keep coming back to is that the models I use every day wouldn't help with the investigation, and an open-weight one did.
- Substack Writers, You Need a Website
Substack is a distribution tool, not a home. A 478-point Hacker News post makes the case for POSSE — publish on your own site, syndicate everywhere else — and it holds up.
- SoN 2.26: The best AI models are getting harder to get
Tales from the Workbench =================================================== Some weeks the newsletter is one idea worked all the way through when…
- Fable: here in an instant, then gone
Fable: here in an instant, then gone Last week I wrote about Fable 5 — Anthropic’s newest model — and the catch: it was only on the normal…
- SoN 2.17: You Can't Cost-Reduce Yourself to Greatness (Free Edition)
You Can't Cost-Reduce Yourself to Greatness (Free Edition) I caught a Seth Godin interview at the beginning of the week and one line in particular…
- Anthropic Didn't Block Abuse. They Blocked Competition.
The OpenClaw subscription ban isn't about fair use — it's Anthropic asserting platform control while shipping their own replacement.
- Perplexity Pulled a Perk and Hoped Nobody Would Notice
Perplexity Pro quietly removed $5 monthly API credits from its $20 plan. No announcement, no changelog. Practitioners who built on those credits found out the hard way.
- Your AI Provider's Ethics Are Now a Business Risk
Anthropic refused Pentagon weapons contracts and got sanctioned. A court blocked it. Here's what that means if you build on Claude.
- Grok Failed in Both Directions in the Same Week
Grok allegedly generated CSAM from real teen photos and flagged a real Netanyahu video as '100% deepfake.' Two failures, opposite directions, one root cause.
- Meta Is Gutting Itself to Fund AI Bets That Aren't Working Yet
Spending $135B on AI infrastructure while cutting 20% of staff and delaying your flagship model is not a strategy. It's a prayer.
- Microsoft Spent $13B on OpenAI, Then Built Cowork on Claude
Microsoft's flagship M365 agent feature runs on Anthropic's model. If they're going multi-model, so should you.
- An AI Agent Hacked McKinsey's AI With a 25-Year-Old Exploit
An autonomous offensive agent breached McKinsey's internal AI platform in two hours using SQL injection. The AI was sophisticated. The plumbing underneath it wasn't.
- OpenAI Took the Pentagon Deal. What's Your Exit Plan?
Anthropic refused. OpenAI said yes within hours. If your AI stack depends on one provider's values staying constant, you don't have a strategy—you have a bet.
- Claude 3.5 Haiku, 3.7 Sonnet, GPT-4o: The Deprecation Wave Is Here
Three major models entering end-of-life in the same window. If you hardcoded model IDs, migration planning just became urgent.
- SoN 32: When They Take Over Your Email
December 10th, 2025 Dear Reader, Last weekend, a close family member lost access to their email account. Not “forgot the password” lost. Fully taken…