// AI Briefing · October 24, 2026
AI Briefing
Today’s video is on its way
The stories are ready to read now. The video usually follows within the hour.
Rendering the short
Anthropic and verification firm Theorem used Claude to prove that 239 entry points across 123 OSS-Fuzz libraries can't crash on any input up to 64 MB, working directly on compiled RISC-V binaries. A critical remote code execution flaw in Google's Brotli compression library (CVE-2026-111497, rated 9.2), which OpenAI's Codex Security found, now affects far more than Node.js. Nvidia released OpenShell, an Apache-2.0 runtime that runs autonomous AI agents in kernel-level sandboxes, checks every network connection against a policy, and never shows agents the real credentials. OpenAI made its Decisions API model available to all customers, cutting response times from 1 to 3 seconds down to about 100 to 180 milliseconds and adding voice and image input. A Government Accountability Office report, newly reported by NPR, found that Pentagon AI projects for target recognition, surveillance and battlefield decisions don't always follow the department's own responsible-AI guidelines.
Top stories
- 01Claude Writes Formal Proofs That 123 Open-Source Libraries Can't Crash, Finding Bugs That Survived Years of TestingResearch
- 02AI-Found Brotli Flaw Turns Into 'HTTP2Shell,' Exposing Node.js, Python, curl and Git Apps to Remote TakeoverIndustry
- 03Nvidia Open-Sources OpenShell, a Sandboxed Runtime That Keeps Credentials Away From AI AgentsOpen Source
- 04OpenAI Releases Its Fast Decision Model to All Developers, Taking On Startup TypeSafe's JevProduct
- 05Watchdog Finds the Pentagon's AI Weapons Projects Don't Always Follow Its Own 'Responsible AI' RulesPolicy
The stories
Claude Writes Formal Proofs That 123 Open-Source Libraries Can't Crash, Finding Bugs That Survived Years of Testing
Anthropic and verification firm Theorem used Claude to prove that 239 entry points across 123 OSS-Fuzz libraries can't crash on any input up to 64 MB, working directly on compiled RISC-V binaries. Along the way Claude found and patched bugs that had survived trillions of fuzzing runs. Anthropic says it is the first large-scale use of AI to formally verify production software at the machine-code level, and the proofs total about 180 million lines of Rocq. Formal verification used to be too expensive for most code, and this suggests AI could make mathematical guarantees practical at scale.
AI-Found Brotli Flaw Turns Into 'HTTP2Shell,' Exposing Node.js, Python, curl and Git Apps to Remote Takeover
A critical remote code execution flaw in Google's Brotli compression library (CVE-2026-111497, rated 9.2), which OpenAI's Codex Security found, now affects far more than Node.js. Security firm Aikido renamed it HTTP2Shell after confirming that Python packages, curl and Git for Windows are also exposed. A malformed compressed request can take over a server before any login, and some builds are still unpatched. It is the second web-wide critical flaw found by AI in a week, after the PHP bugs, so defenders are dealing with AI-found vulnerabilities faster than they can patch them.
Nvidia Open-Sources OpenShell, a Sandboxed Runtime That Keeps Credentials Away From AI Agents
Nvidia released OpenShell, an Apache-2.0 runtime that runs autonomous AI agents in kernel-level sandboxes, checks every network connection against a policy, and never shows agents the real credentials. Risky policy changes, such as sending credentials to a new host, are flagged by formal verification and sent to a human for review. It arrives as companies are hit by agent-driven breaches and rogue-agent incidents, and it gives them a free, standard way to contain agents. It drew close to 500 points on Hacker News.
OpenAI Releases Its Fast Decision Model to All Developers, Taking On Startup TypeSafe's Jev
OpenAI made its Decisions API model available to all customers, cutting response times from 1 to 3 seconds down to about 100 to 180 milliseconds and adding voice and image input. Decision models act as fast, cheap classifiers that pick among options with a confidence score, and developers increasingly use them in place of full language models inside agent workflows. OpenAI is entering a crowded market: on public benchmarks its model trails TypeSafe's Jev, Liquid's D1 Ultra and Base Lab's Elephant-1.
Watchdog Finds the Pentagon's AI Weapons Projects Don't Always Follow Its Own 'Responsible AI' Rules
A Government Accountability Office report, newly reported by NPR, found that Pentagon AI projects for target recognition, surveillance and battlefield decisions don't always follow the department's own responsible-AI guidelines. The office that teaches those guidelines has filled only 3 of its 10 authorized positions. The Pentagon agreed to GAO's two fixes but had not made them as of October 22. The report comes as the Pentagon pushes for fast autonomous weapons development and as Google DeepMind staff resign over military contracts.
Previous digests
Oct 23Microsoft says a China-aligned hacking group broke into ConnectWise's cloud backup service...4 stories
Oct 22Security firms Calif and Google's Wiz used GPT-5.6 Sol, Gemini 4 Argon and Wiz's own agent...4 stories
Oct 21OpenAI posted a new misalignment report on October 20 describing two internal coding tasks...4 stories
Oct 20A Reuters exclusive reports that a Chinese-speaking hacker gave AI agents an instruction o...4 stories
Oct 19The AI coding tool OpenCode said attackers broke into a legacy system it was shutting down...4 stories