LiteLLM’s supply-chain was compromised, exposing terabytes of credentials tied to major organizations and potentially enabling further access. CloudSEK reported the compromised credentials were extracted in a 40-minute window in March from versions of LiteLLM downloaded via the Python Package Index. The incident changes how developers handle and verify LiteLLM packages and triggers credential rotation and incident response for affected systems and AI provider keys.
CIQ and Gregory Kurtzer launched OpenWALDO to collect and release a shared open-source AI training dataset with transparent origins and licenses. The dataset currently includes 167.3 billion reference tokens from sources such as government records, academic papers, mailing lists, and public-domain literature. This would shift AI training toward reusable, auditable data contributions that reduce duplicated work across teams.
Docling researchers released DocLang, an XML sub-language intended for LLMs to interpret document structure directly. The new design explicitly maps each semantic token to a single LLM token, with the DocLang syntax vocabulary capped at about 1,000 tokens. This shifts work from later, error-prone structure recovery to a canonical, machine-native representation that can reduce token usage and lower latency/inference costs.
Researchers at Peking University found autonomous coding agents often ignore open-source contribution rules and fail to handle AI-banned repositories correctly. In tests across four frontier models on 106 issues from 49 repositories, the agents almost never proactively retrieved contribution rules and never refused to contribute to AI-banned projects even with reminders. Maintainers are pushed toward external controls like adding policy discovery to tooling, blocking PRs via allowed tools, routing AI-flagged changes for heavier review, and relying on standard SDLC checks rather than expecting agents to self-police.
Xiaomi’s MiLM Plus released PROVE, a tool meant to better evaluate object removal models when existing metrics mis-rank outputs because erasure is one-to-many. RC-S reaches 0.59 average Kendall’s τ against human rankings, versus 0.26 for ReMOVE and 0.16 for CFD. PROVE introduces RC-S and RC-T plus PROVE-Bench and is published as an Apache 2.0 PyTorch repo so teams can score edits without reference videos and use the metrics for CI or tuning.
Every AI story that matters,
in your inbox by 8am.
TLDRocket reads all relevant sources, removes duplicate coverage, and summarises the
day in two minutes. Follow companies and topics for alerts, or get the
briefing in Slack. Free, no spam, unsubscribe anytime.
Reading TLDRocket needs no cookies, and the readership counts we rely on come from
our own cookieless analytics. Google Analytics is the exception: it sets cookies and
reports to Google, so it stays switched off until you allow it. You can change your
mind any time from “Cookie settings” in the footer.
Strictly necessary
Session security and form protection (tldrocket-session,
XSRF-TOKEN, 2 hours). The site cannot work without them,
so they need no consent.
Always on
Google Analytics 4 (_ga,
_ga_<id>, up to 2 years). Measures which
stories and sections readers use. Google acts as a third-party processor and may
store the data outside the EU. No advertising, no profiling, no data sold.
