New malware uses AI to plan attacks

Hi there, this is your daily ☕️ AIpresso.

In today's AIpresso:

🦠 New malware uses AI to plan attacks

💰 OpenAI cuts GPT-6 API prices in half

📱 Qualcomm chip runs 30B AI on phones

🤖 Claude Opus 5.5 matches Fable's quality

⚙️ vLLM adds support for more chips

Plus: 💡 4 strategies & tactics, 🎁 7 other news you might like, 🧰 6 tools, and 📚 5 papers.

🦠 New malware uses AI to plan attacks LINK

Cisco Talos documented ClosedQuorum, a Go-based Windows implant that queries Gemini, DeepSeek, Qwen, and Mistral models to autonomously pick its next post-compromise action with no human operator in the loop.

The malware feeds reconnaissance data to a voting panel that chooses from a fixed decision set, including shellcode injection via process hollowing or Early Bird APC, then exfiltrates stolen data through a Discord webhook, making the chain fully automated after delivery.

Talos calls it the first public Windows implant delegating tactical C2 to an AI panel, tying the developer to 2025 carding forum posts, though the analyzed build lacks a lateral-movement handler and can stall on API rate limits, malformed output, or downtime.

💰 OpenAI cuts GPT-6 API prices in half LINK

OpenAI cut API prices for its new GPT-6 Sol and Luna models by 50% versus their GPT-5.6 counterparts, with Luna output tokens dropping 58% as more affordable alternatives to flagship GPT-6 Astra.

GPT-6 Sol now runs $2 per million input and $10 per million output tokens, while Luna hits $0.10 and $0.50, alongside caching upgrades that raise default cache-hit rates and preserve earlier context when reasoning effort or tool availability changes.

A new Prompt Caching Dashboard surfaces reuse metrics and flags missed caching opportunities, with GitHub reporting fresh-processing token share fell over 50% across billions of requests, though the 90% cached-input discount just matches existing GPT-5.6 pricing.

📱 Qualcomm chip runs 30B AI on phones LINK

Qualcomm's new Snapdragon 8 Elite Extreme Gen 6 chipset can run up to 30B-parameter MoE models directly on phones via its Hexagon NPU, a jump from the ~4B-parameter ceiling most on-device hardware has faced.

Unveiled Tuesday at the Snapdragon Summit alongside the Snapdragon 8 Elite Gen 6, the platform targets ambient agentic workloads through the Oryon CPU, Hexagon NPU, and an X105 5G modem, prioritizing battery efficiency and parallel GPU throughput.

Both chips will ship in 2027 flagships from Samsung, Xiaomi, Motorola, OnePlus, Oppo, Vivo, and others, with the Motorola Signature 27 named as one of the first, though Qualcomm hasn't disclosed the full device lineup at launch.

🤖 Claude Opus 5.5 matches Fable's quality LINK

Anthropic shipped Claude Opus 5.5 today, delivering Fable 5.1-level quality on most work while costing roughly 40% less to run than Opus 5, which arrived under two months ago.

Token prices drop 20% versus Opus 5, output runs 30%+ faster, and Box reports the model used a third of the tokens with answers 40% less verbose, no accuracy loss.

Deloitte says the lowest effort setting caught 72% of known bugs versus Opus 5's 56% at high effort, though safeguards reroute cybersecurity requests to Opus 4.8 and biology tasks to Opus 5.

⚙️ vLLM adds support for more chips LINK

vLLM is adding a set of hardware-agnostic layers so it can keep serving diverse models across older GPUs, prosumer cards, and out-of-tree accelerators, even as frontier "flat" model definitions break compatibility with torch.compile.

The portable layers, built entirely from native PyTorch and DSLs like Triton and Helion, land within 3.4% of native token throughput on NVIDIA H100 across three recent models, sometimes edging past CUDA-optimized FlashAttention and CUTLASS paths.

Enabled via USE_HW_AGNOSTIC=1 with the transformers backend and already validated on IBM Spyre for Gemma 4, Qwen3, and Granite 4.2, though state-of-the-art performance on Blackwell and CDNA 4 is explicitly not a goal of these definitions.

💡 Strategies & Tactics

> How Shopify built a continual learning loop with PyTorch and vLLM: Retrain a specialized model daily on real production failures to beat frontier models on quality while cutting serving costs 96%.

> Enabling Private High-Performance Production AI Inference with NVIDIA Confidential Computing: NVIDIA's hardware-encrypted computing runs sensitive AI inference on trusted GPUs while retaining over 96% of normal speed, protecting private prompts and models.

> 🔬 An Oscar, Two Asteroids, and the Algorithm in Your sklearn: John Platt on AI for Science: Google's ERA turns scientific problems into scoring tasks that an AI iteratively solves, but scientists must verify results to avoid gaming the metric.

> How OpenAI Built GPT-Live: OpenAI's GPT-Live uses a fast voice model that listens and talks simultaneously while delegating hard questions to a bigger reasoning model, so conversations stay natural without pauses.

Other news you might like

• Meta's Muse personal AI agent tops ChatGPT, Grok and Claude for post-launch downloadsLINK

• China's ByteDance gained access to over 2,000 Nvidia B200 chips through Norway data centerLINK

• Snorkel AI Raises $350 Million at $3.5 Billion Valuation in Series ELINK

• European neocloud Verda raises $189M to build the AI infrastructure of tomorrowLINK

• Text handoffs slow AI models down. C2C lets them communicate through KV caches insteadLINK

• DevDay: New Plans and new platform for building AI appsLINK

• Introducing DigitalOcean Managed Agents: One AI-native stack to power your intelligenceLINK

🧰 Trending tools

Ruby UTCP: ruby implementation of the Universal Tool Calling Protocol, letting AI agents call native APIs directly via JSON manifests without MCP wrapper overhead.LINK

Lumiko: records your screen and auto-generates cursor-tracked zoom and pan effects, with browser trimming, secret blurring, webcam bubble, and 4K local exports.LINK

Zella: records and edits screen or camera videos on-device, auto-generating captions, cutting silences, removing filler words, and adding zoom effects offline.LINK

Compute:Arena: community-sourced benchmark database for local AI models, comparing token speeds across hardware, runtimes, and quantisation levels to guide your setup choices.LINK

redcell: an AI red-team platform where autonomous LLM agents run full penetration tests in a Kali container and generate reports.LINK

BiBimba: stores searchable clipboard history and screenshots, using on-device AI to extract text from images, then translate, summarize, and rewrite locally on Mac.LINK

📚 Trending papers & reports

AI-watching-AI safety checks map the sneaky ways one AI overseer might secretly collude with the AI it's supposed to police, giving companies a clearer test for whether such oversight can actually be trusted before deployment.LINK

Risk-averse AI training shows that teaching a model to play it safe on small bets carries over to enormous ones, lifting cautious choices from 2% to ~70%, a possible safety net if AIs turn out misaligned.LINK

Nuclear escalation in AI agents persists across 13 models even when prompts explicitly warn of nuclear harm, showing that ethical judgment scoring well on isolated dilemmas often fails to steer behavior in complex, high-stakes strategy scenarios.LINK

Audio AI reasoning tends to lose track of what it actually heard as it thinks longer, but a new training method fixes this, roughly doubling perception accuracy to ~64% and boosting overall performance to ~75%.LINK

Sign-based training math pins down exactly when a popular shortcut for teaching models beats the standard method, showing it can improve faster per dollar of compute in noise-heavy settings.LINK

See you tomorrow for a new dose of ☕️ AIpresso!