An AI hacked Firefox on its own

Hi there, this is your daily ☕️ AIpresso.

AI model built Firefox exploits on its own LINK

• Epoch AI researchers showed that the open-weight GLM 5.3 autonomously built working Firefox exploits within 48 hours, attacking 6 versions shipped between September 17 and October 26 at roughly $1,000 in API fees each.
• Given only a target version, basic tools, and public information offline, the model saw through Firefox's disguised security fixes, chained multi-stage exploits to bypass sandbox defenses, and rediscovered an unknown file-reading vulnerability in every attempt, with the fastest break taking 12 hours.
• Mozilla patched that bug in Firefox 159.0 on October 27 and the researchers suspect it makes attacks "substantially more difficult," though they warn the patch-gap flaw is structural across browsers, firmware, and mobile OSes, and no provider's guardrails blocked the exploit work.

OpenAI rebuilds its AI rulebook around 5 values LINK

• OpenAI reorganized its Model Spec around five values, faithfulness to human intent, harm minimization, honesty and transparency, human agency, and care, in an update published yesterday that retires most of the Spec's detailed style guidance.
• The revision adds a layered chain of command, root sections from the Spec can't be overridden by context, followed by system, developer, and user instructions, plus root-level rules barring GPT from pursuing side objectives and requiring it to stay corrigible to human oversight and shutdown.
• OpenAI recommends logging autonomous work in a ScopeOfAutonomy record with fields like allowed_tools, max_cost, and an ending condition, though the company said its models do not yet fully reflect the Spec and framed this as a first step.

Cursor reveals SSH backdoor hidden in malicious Claude extension LINK

• Cursor disclosed yesterday that a maliciously modified version of the Anthropic.claude-code extension in its VS Code marketplace ran code attempting to install a persistent SSH backdoor, affecting at most 5,000 users.
• Version 2.1.313, live for roughly 11 hours yesterday, harvested host details and added an attacker-controlled SSH key, installing a LaunchAgent on macOS or scheduled task on Windows that retried a reverse tunnel and beaconed back to the attacker.
• Cursor pulled the package, rebuilt its marketplace, and took the attacker's server offline, but warns that uninstalling the extension is insufficient since standalone persistence scripts keep running, so run its impact check and remediation scripts against the published indicators.

Deep Agents now browse sites with no API LINK

• LangChain's Managed Deep Agents v0.10 shipped today with browser use, letting agents act on sites that expose no API, booking travel, canceling subscriptions, filing claims, by reading the page's accessibility tree and clicking through rendered JavaScript.
• Each agent runs its own browser in a LangSmith sandbox with automatic navigation and screenshot tools; the release cites agentic browser requests climbing 4.7x in September, and adds async subagents that run long tasks in the background while the orchestrator keeps talking.
• At a login or two-factor wall the agent hands the window to you so credentials never enter the model's messages or traces, then rechecks the page once you hand control back, though handoff links expire after 15 minutes.

Baseten's joey-1 decides for a penny per million tokens LINK

• Baseten's Base Labs released joey-1, a 2B-parameter decision model priced at $0.01 per million input tokens and available through its Model APIs and as open weights on Hugging Face under the MIT license.
• Rather than generating text, joey-1 returns a calibrated probability for every option in one forward pass, serving an average request at 20ms P50 latency, about 2.5x faster than the 9B elephant-1, for high-volume jobs like ticket triage and routing.
• Positioned as a first-line model that escalates to heavier siblings when uncertain, joey-1 scored 63.30 on the Jev Decision Index 0.4 public split, top among sub-4B models but below elephant-1 in every evaluated area.

Strategies & Tactics

> Unlocking Tensor Core Performance for Machine Learning Interatomic Potentials: NVIDIA speeds up machine-learning simulations of atoms by splitting full-precision math into faster low-precision Tensor Core operations, preserving accuracy without retraining models.

> AI Agents Rarely Crash. They Fail Quietly, and Research Shows Why: Trace every tool output and test prompt changes repeatedly, because AI agents return confident wrong answers with success codes that conventional monitoring never flags.

> Hit Your Claude Code Usage Limit? How to Keep Coding: Keep coding past Claude Code's usage caps by routing it through OpenRouter's pay-per-token API, which bills by usage instead of time windows.

> Why MCP servers should tell agents what to do next: Tool responses should include guidance on what the agent did and what to do next, so servers help agents finish tasks rather than just returning data.

> AWS’s Hydro team wants the compiler to catch coding agents’ mistakes: Build correctness checks into the compiler, not the AI agent, so bugs get caught instantly since agents write code too fast and unpredictably for human review to keep up.

Other news you might like

• Cohere Raises $5 Billion for Alternative AI Vision LINK

• Introducing the Microsoft Copilot harness: Unlocking the potential of truly multi-model agentic work LINK

• Qwenputer: a fully functioning, deterministic RISC-V CPU inside Qwen3.5 LINK

• Sam Altman almost scrapped token pricing. Here’s why he backed off. LINK

• Forced alignment with Cue: Character-level audio timing LINK

• Copilot Automations now learn from outcomes and self-improve LINK

• Framer: Free website builder and AI design agent LINK

• Alphabet’s AI commitments pass $1tn, its quarterly filing shows LINK

Trending tools

Strawberry 1.0: a browser with built-in AI agents that learn your workflows and handle research, data entry, and other tasks automatically. LINK

Radar: gives Kubernetes cluster context to AI agents over MCP, letting Claude Code or Cursor perform fast, accurate root cause analysis on live faults. LINK

2G: a free AI sampler with retro handheld styling that generates sounds from text prompts, letting you edit and play them from your keyboard. LINK

Voxel51 Multimodal: search, visualize, curate, and label multimodal data for physical AI models, turning raw recordings into clean training sets and saving wasted runs. LINK

Coachare: an AI coaching platform where managers rehearse tough talks and reviews, get real-time feedback, track progress, and connect with human coaches when needed. LINK

os: lets organizations build and deploy customizable AI agents with multi-LLM support, real-time chat, voice, document training, analytics, and embeddable widgets. LINK

Trending papers & reports

Investigative work benchmark tests whether AI coding assistants can reconstruct five years of messy tax records scattered across incompatible systems, and found independent tools scored ~0.54 while the AI labs' own tools failed the task. LINK

AI debate teams often reach agreement by caving to peers rather than genuinely rethinking, and while group debate barely boosts accuracy it raises the chance all agents agree on the same wrong answer by up to ~7 points. LINK

Fact-recall memory can be squeezed nearly 8x smaller in a language model's lookup tables by spending storage only on the rare facts that matter, boosting serving speed 11% to 31% while losing ~1 accuracy point. LINK

Faster model training comes from a new tuning method that keeps language models exploring instead of stalling midway, letting them learn more steadily through the full training run than existing popular approaches. LINK

AI agent restart monitors can look highly accurate yet still hurt success, so this work offers a way to judge them by whether restarting actually pays off, swinging a 90%-accurate monitor from a 5-point loss to a 35-point gain. LINK

See you tomorrow for a new dose of ☕️ AIpresso!