LLMs now find $500K vulns for $25 — and the guardrail gap between models is becoming a real selection criterion.
Top Signal
GPT-5.6 finds $500K WordPress RCE for $25 in API costs
workflow
HN Front Page
A security researcher documented using GPT-5.6 to find a WordPress RCE that exploit brokers price at $500,000 — spending $25 in API calls. The model traversed plugin code paths and probed injection points autonomously in full-access mode. This reframes LLM-assisted vuln research from demo to viable workflow: the economics are now lopsided enough that anyone running a bug bounty program or building security tooling should be running LLMs against their attack surface. Note the flip side: last week's data showed GPT-5.6 deleting files in full-access mode; the same aggressive capability profile enables both the finding and the destroying. If you're building on WordPress or any plugin ecosystem, raise your threat model immediately. If you're building security tooling, this is your new cost baseline — and it renders traditional manual triage economically irrational at scale.
Read more →
Fast Signals
Unsloth fine-tuning framework now supports AMD GPUs
platform change
r/LocalLLaMA
Unsloth — the most widely used memory-efficient fine-tuning library for LoRA/QLoRA — ships AMD ROCm support. If you've been sidelined on AMD hardware for fine-tuning workflows, this unblocks you today. Check the repo for current model support matrix before starting a run.
Link →
Kimi K3 finds 5 real bugs in post-quantum crypto others missed
emerging signal
r/LocalLLaMA
A developer ran Kimi K3 against their post-quantum cryptography project; it surfaced 5 real bugs that Claude Fable, Opus 4.8, and GPT-5.6 Sol all missed. Separately, K3 reportedly fixed 15 critical security bugs Codex and Fable refused due to cyber guardrails — a pattern HuggingFace confirmed from their own incident this week. The guardrail asymmetry between US and Chinese models is becoming a concrete selection criterion for security-focused workloads.
Link →
NInfer: open-source C++/CUDA engine hits 543 tok/s on RTX 5090
new tool
r/LocalLLaMA
NInfer is a new from-scratch C++/CUDA inference engine open-sourced today, currently specialized for Qwen3.6-35B-A3B MoE. It achieves 543 tok/s single-request over a 65K-token decode on one RTX 5090 with a demo video. Worth watching if you need a minimal, auditable inference engine without vLLM overhead — or are building custom serving infrastructure.
Link →
Coding agents make home device reverse-engineering routine
workflow
Simon Willison
Simon Willison documents a recurring pattern: builders using coding agents to reverse-engineer proprietary home devices and automate them — tasks that previously required weeks of specialist work. The signal isn't one specific technique; it's that the cost of writing glue code to interface with undocumented hardware has dropped far enough to be routine. Directly applicable whenever you need to integrate with any closed device, proprietary protocol, or undocumented API.
Link →
DeepSeek v4 Flash release version activated on API — open weights imminent
platform change
r/LocalLLaMA
The release version of DeepSeek v4 Flash has been activated on the API, with community consensus that open weights are days away. DS4 Flash was notable for competitive price-per-token at inference time; open weights would make it a viable self-host option. Monitor DeepSeek's HuggingFace page if you're planning high-volume inference infrastructure.
Link →
DWARF-55M: novel nearly-all-sparse attention architecture releases first model
research to practice
r/LocalLLaMA
DWARF is a from-scratch architecture using 9 Dynamic Sparse Query-Gather (DSQG) layers replacing standard attention — a nearly all-sparse design. The first model, DWARF-55M-Base, is available to experiment with. Very early stage, but a rare genuinely novel architectural proposal from an individual researcher rather than a lab. Worth watching if you track alternative attention mechanisms.
Link →
Radar
13M ASR conformer running on a microcontroller
A developer deployed a 13M parameter automatic speech recognition conformer model directly on a microcontroller. Edge inference at this scale is moving faster than most builders realize — worth watching if you're designing voice interfaces for constrained or offline hardware.
Link →
WrenAI: governed text-to-SQL GenBI layer for AI agents
WrenAI is trending on GitHub — an open-source text-to-SQL layer with governance controls across 20+ data sources (BigQuery, Snowflake, PostgreSQL, ClickHouse, Redshift). Positioned for AI agents that need trusted SQL generation. Relevant if you're building any agent that touches analytics or BI data.
Link →
Nativ: new Mac-native local frontier model runner
Nativ launched on HN front page (145 points) as a new entrant for running open models locally on Apple Silicon. Competing with LM Studio and Ollama — differentiation unclear from the landing page alone, but worth a look if you prefer native UI over electron-based alternatives.
Link →
Convergence Watch
kimi k3
TRENDING
7 mentions across r/LocalLLaMA, HN Front Page
Kimi K3 has appeared across 3+ sources for 5 consecutive days. Today the narrative shifted decisively toward security: two independent reports of K3 finding real bugs that US frontier models missed, plus HuggingFace corroborating the guardrail asymmetry from their own incident. This is no longer a benchmark story — it's a model selection signal for security workloads specifically.
chinese open-weights advantage
4 mentions across HN Front Page, r/LocalLLaMA
Two independent pieces today converge on the same thesis: Chinese open-weight models (Kimi K3, Qwen 3.8, Bonsai 27B) are outpacing US proprietary alternatives on capability and access. Reports of pending US ban attempts add urgency. Builders dependent on these models should monitor policy developments and consider local copies as an archival hedge.
deepseek v4 flash
2 mentions across r/LocalLLaMA
Third consecutive day of activity. Today's signal — API release version activation — is the clearest indicator yet that open weights are imminent. If you're planning high-volume self-hosted inference, this is the release to stage infrastructure for this week.
STALE: Latent Space newest item is >48h old