Hacktron AI security researchers used Claude Opus 4.8 to turn a libheif memory-corruption bug into a working ARM64 exploit against a Mac and then achieved remote code execution on a test forum, before escalating to proof of access in OpenAI’s private monorepo via an employee Codex account. Roughly 72 hours after they began, they read OpenAI’s private openai/openai monorepo and opened a README pull request. OpenAI narrowed permissions for community sign-in tokens and revoked the affected tokens and sessions, while the incident also prompted revisions based on the new Opus 5 capability in exploit development.
PrismML released Ternary Bonsai 2 27B, a ternary-weight version of Qwen3.8 27B that supports text and images. The language model is 5.93 GB, compared with 53.80 GB for FP16. It preserves 98.2% of the parent model’s 20-benchmark average but requires PrismML’s llama.cpp fork or its MLX runtime (stock llama.cpp can’t load the GGUF types).
PrismML launched Bonsai 2 27B, a second-generation ultra-compact multimodal AI model designed to run on PCs and some high-end mobile devices. It reduces a Qwen3.8 27B model from about 56 GB in 16-bit uncompressed form to about 5.9 GB while retaining about 98.2% of capabilities. Model users can now run this AI locally with lower memory, compute, and power needs, with weights released under Apache 2.0.
Every AI story that matters,
in your inbox by 8am.
TLDRocket reads all relevant sources, removes duplicate coverage, and summarises the
day in two minutes. Follow companies and topics for alerts, or get the
briefing in Slack. Free, no spam, unsubscribe anytime.
Reading TLDRocket needs no cookies, and the readership counts we rely on come from
our own cookieless analytics. Google Analytics is the exception: it sets cookies and
reports to Google, so it stays switched off until you allow it. You can change your
mind any time from “Cookie settings” in the footer.
Strictly necessary
Session security and form protection (tldrocket-session,
XSRF-TOKEN, 2 hours). The site cannot work without them,
so they need no consent.
Always on
Google Analytics 4 (_ga,
_ga_<id>, up to 2 years). Measures which
stories and sections readers use. Google acts as a third-party processor and may
store the data outside the EU. No advertising, no profiling, no data sold.
