A malicious pull request was submitted to Amazon’s aws-toolkit-vscode repo and later shipped via the Q Developer VS Code extension to nearly 1 million developers. The attacker’s update was built to run an AI prompt that could wipe systems and delete local and cloud resources, but a formatting error prevented execution in customer environments. Amazon revoked the overreaching GitHub token, removed the code, rebuilt clean within two days, and required human-in-the-loop confirmation with external policy gates to stop injected or altered instructions before actions execute.
Agentcard offers a Purchase API that lets an agent buy items online using an API call.
It works with one API call.
As a result, agents can initiate online purchases directly through the API instead of manual checkout steps.
deepDoctection was used to build an end-to-end document intelligence pipeline that runs layout detection, table structure recognition, OCR, reading-order reconstruction, annotation linking, and structured JSONL export in one workflow. The tutorial targets deepDoctection version 1.2.x. It changes the output by producing Page objects plus page-level custom summaries (money mentions, date mentions, and a document “flavour” based on table coverage) that are then serialized for downstream retrieval/RAG use.
Vercel launched Is Agentic, a free tool that scores how easily AI agents can discover, access, understand, and use a public website. It uses Ora’s 118 checklist checks split into discovery, access, usability, and payments scoring tiers. Access to the scoring is now available via a website, read-only API, CLI, and MCP server with no API key and no billing.
Every AI story that matters,
in your inbox by 8am.
TLDRocket reads all relevant sources, removes duplicate coverage, and summarises the
day in two minutes. Follow companies and topics for alerts, or get the
briefing in Slack. Free, no spam, unsubscribe anytime.
Reading TLDRocket needs no cookies, and the readership counts we rely on come from
our own cookieless analytics. Google Analytics is the exception: it sets cookies and
reports to Google, so it stays switched off until you allow it. You can change your
mind any time from “Cookie settings” in the footer.
Strictly necessary
Session security and form protection (tldrocket-session,
XSRF-TOKEN, 2 hours). The site cannot work without them,
so they need no consent.
Always on
Google Analytics 4 (_ga,
_ga_<id>, up to 2 years). Measures which
stories and sections readers use. Google acts as a third-party processor and may
store the data outside the EU. No advertising, no profiling, no data sold.
