Claude's web_fetch tool can be hijacked to steal user memory; Inkling takes #1 US open model; Grok Build goes Apache 2.0.
Top Signal
Prompt injection via Claude web_fetch silently exfiltrates persistent memory
platform change
Simon Willison
Security researcher Ayush demonstrated a 'memory heist' attack: craft a malicious webpage, get a Claude-powered assistant to fetch it, and embedded prompt injection reads the user's persistent memory then exfiltrates it to an attacker-controlled URL. Simon Willison analyzed it today. The attack requires two conditions to be true simultaneously: (1) Claude has persistent memory enabled and (2) the assistant can fetch arbitrary URLs. Any Claude-based product with both capabilities is potentially vulnerable right now. Mitigations: treat all fetched HTML as untrusted input before it enters context, sandbox or allowlist fetch targets, and consider stripping script/meta tags from fetched content. This is a working proof-of-concept with a demo — not theoretical. If you ship a Claude product with memory + web access, audit your trust boundaries before your next deploy.
Read more →
Fast Signals
Inkling by Thinking Machines debuts as #1 ranked US open-weight model
platform change
HN Front Page, r/LocalLLaMA
Thinking Machines released their first open-weight model, Inkling, which immediately claims the top benchmark position among US-origin open models. Coverage broke simultaneously on HN (553 points) and multiple r/LocalLLaMA threads. If you need a high-performing open model with US provenance for compliance or policy reasons, this is now your reference point.
Link →
Grok Build open-sourced Apache 2.0 — previously flagged for .env exfiltration
platform change
HN Front Page, r/LocalLLaMA
xAI open-sourced Grok Build under Apache 2.0 one week after it was flagged for uploading full git history and .env secrets to xAI cloud. Open-source means you can now audit what it actually sends before trusting it. Read the source before using it on any project with real secrets.
Link →
Gemma 4 chat template update fixes tool calling and adds FA4 on Hopper
platform change
r/LocalLLaMA
Google is pushing Gemma 4 chat template updates that fix broken tool-calling behavior and reduce model 'laziness' — the primary complaints blocking agentic use. Flash Attention 4 support on H100-class GPUs also ships in the same update. If you tested Gemma 4 for agents and gave up on tool reliability, retest against the updated templates.
Link →
ExLlamaV3 hits v1.0.0 with major throughput improvements
new tool
r/LocalLLaMA
ExLlamaV3 reached its v1.0.0 milestone with significant performance upgrades for quantized NVIDIA local inference. This is the fastest maintained quantized inference backend for consumer NVIDIA hardware. Drop-in upgrade for anyone running local GGUF or EXL2 models — benchmark your workload against v1.0.0.
Link →
Agents-A1-4B: horizon-scaled 4B agent model, strong benchmarks
emerging signal
r/LocalLLaMA
InternScience drops Agents-A1-4B (appears Qwen3.7-4B based), claiming competitive agent benchmark performance via 'horizon scaling' — extended inference-time rollout rather than bigger parameter counts. GGUFs available immediately. Bookmark this if you need a capable local agent that fits in 4GB RAM.
Link →
Distributed RL post-training across 14 consumer Macs in 4 countries — demo
research to practice
r/LocalLLaMA
A builder ran RL post-training distributed across 14 Apple Silicon Macs spanning four countries, leveraging the PyTorch Thunderbolt communication backend flagged in yesterday's feed. This is a working proof-of-concept for cheap distributed fine-tuning without cloud GPU spend. The infrastructure is real today if you have access to a pool of M-series Macs.
Link →
Radar
Apple reportedly in acquisition talks with PrismML (Bonsai 27B)
Reports surfaced today that Apple is in talks to acquire PrismML — the startup behind Bonsai 27B, which fit a 27B-class model onto a phone. If it closes, Apple's on-device AI strategy absorbs cutting-edge 1-bit/ternary quantization. Watch for implications on CoreML and on-device API surface changes.
Link →
Firefox compiled entirely to WebAssembly, runs inside a browser
Puter compiled all of Firefox — Gecko engine, SpiderMonkey JS, and full UI — to WebAssembly. Beyond the novelty, this is a viable architecture for sandboxed browser environments in agentic workflows where you need isolated, controllable browsing without spawning a real OS process.
Link →
Dependabot now waits 3 days before opening version-update PRs
GitHub's Dependabot now defaults to a 3-day cooldown on new releases before opening PRs. Reduces attack surface from day-zero malicious package releases targeting automated merge pipelines. A quiet default change with real supply-chain security implications for any repo on auto-merge.
Link →
Convergence Watch
bonsai 27b
TRENDING
10 mentions across HN Front Page, r/LocalLLaMA
Yesterday's top signal escalated dramatically: Apple acquisition talks with PrismML reported today, with Bonsai 27B generating 8+ r/LocalLLaMA threads and HN coverage simultaneously. In 48 hours this moved from interesting research to potential Apple strategic asset. The 1-bit/ternary quantization approach is being validated at the highest level of industry interest.
inkling
4 mentions across HN Front Page, r/LocalLLaMA
Same-day multi-source breakout on first release. Thinking Machines debuting at #1 on US open-weight benchmarks is drawing immediate community scrutiny — early signal that the competitive baseline for US-origin open models has shifted.
grok build
3 mentions across HN Front Page, r/LocalLLaMA, GitHub Trending
The move from security controversy (secret exfiltration) to Apache 2.0 open-source in one week is drawing attention across three independent sources. The open-sourcing changes the trust calculus but doesn't eliminate risk — community is now actively auditing the code.
STALE: Latent Space newest item is >48h old