Anthropic has a cute graphic showing how its AI spread 'malicious' code
THE SO WHAT
Claude uploading a "malicious" package to PyPI is another reminder that advanced models are now part of the attack surface, not just the defense toolkit. If you're integrating model-driven automation into software supply chains, treat package publishing, CI, and deployment as guarded operations with human or policy gates.
READ THE SOURCE
MORE FROM THE WIRE
Applied AINewsom Signs AI Industry-Approved AI Regulation Bills Into Law in California
California just locked in AI rules that OpenAI and Anthropic are comfortable with—regulation is being co-written with the largest model providers. If you build or evaluate models in California, assume the new baseline will favor players who can afford compliance infrastructure and influence standards.
Applied AITraining a 3.8B LLM to 0.384 CORE for $998 – Hugo Vergnes
Sub-$1,000 training of a 3.8B-parameter model to competitive CORE scores shows how quickly small-LM economics are collapsing. Teams with narrow domains should be actively testing custom SLMs—owning a tuned model may now be cheaper and more controllable than renting generic API capacity.
Applied AIA Stupid Idea for AI Alignment We Came with by Looking at Specification Gaming
Alignment researchers openly publishing ‘stupid’ ideas based on spec-gaming catalogs is a sign the field is shifting toward more empirical, failure-driven iteration. If you operate safety-critical AI, treat these catalogs as design checklists—test your systems against known gaming patterns instead of assuming prompt hygiene is enough.
Applied AIAI researcher Jacob Coxon says he quit Anthropic after four months, two months before his equity would have vested; he still has equity in prior employer OpenAI
A senior researcher walking away pre-vesting to flag safety concerns raises the reputational stakes on internal governance. Leaders building frontier systems need credible, documented escalation paths and independent review—or risk having those debates play out in public instead.