Claude Proved 239 OSS-Fuzz Entry Points Crash-Free at the RISC-V Binary Level -- Anthropic and Theorem Say Formal Verification Now Scales, and the Trusted Base Is What Needs Auditing
Anthropic's Frontier Red Team and Theorem turned existing fuzz tests into machine-checked Rocq proofs over compiled binaries for 123 open-source libraries, finding bugs fuzzers missed along the way. The proofs are enormous, the assumptions are narrow, and the cost is hundreds of millions of tokens, but the shape of the workflow is the news.
eMudhra Quits the Global TLS Certificate Business Five Days After Its Weak-Key Disclosure -- Mozilla and Chrome Pulled a Whole Root, and Go Shipped a Denylist for Systems That Never Update
The Bengaluru-based certificate authority says global TLS was about 1% of revenue and blames social-media amplification for scrutiny out of proportion to it. Chrome's root program is now asking why a key mismatch spotted in June 2025 did not expose the problem then. For engineering teams, the useful part is the Go fix and what it implies about binaries that carry their own trust decisions.
NVIDIA's Minerva Turns AI-Factory Telemetry Into a Topology Graph and Calls the Goal Yield -- a Launch With Named Adopters, Including Jio, but No Numbers Yet
NVIDIA's new AIOps platform joins GPU, network, storage, scheduler and job telemetry into one graph, groups alert storms into incidents and adds an assistant that can trigger fixes. The pitch is right about where cluster time goes. The evidence so far is a customer quote, not a measurement.
Google's ForTy Map Labels Every 10-Meter Patch of Land as Primary, Regrowing, Planted, Plantation, Tree Crop or Other -- Built for the EU Deforestation Rule, With Its Weakest Class Openly Flagged
Google DeepMind and Google Research, with WRI and IIASA, released a global six-class forest-type map for 2020 and an early 2017-2025 time series on Earth Engine. It is a clean example of a foundation-embedding product: a large satellite model compresses the data, and a smaller labelled model answers a regulatory question.
Framework Watch: Claude Code 2.1.309 Closes a Batch of Sandbox and Permission Gaps, Agent Framework 1.23 Makes AG-UI Authorization Explicit, and LangChain Core 1.7 Changes How Tool Arguments Stream
Releases from October 22 and 23: Anthropic fixes places where Claude Code commands escaped the sandbox or its deny rules, Microsoft ships three breaking changes that move risk decisions to callers, LangChain changes a streaming contract, Pydantic AI stops trusting instructions found in restored history, and NVIDIA Dynamo adds deadline-ordered routing.
Research Radar: A World Model Checks Whether a GUI Agent's Screen Should Have Appeared, Training Across Many Harnesses Beats One Complex One, and an AI Research Team Beats GDN2 at 1.3B
Three preprints listed on Hugging Face Daily Papers on October 22. One treats GUI-agent safety as a property of transitions and checks them in 17 ms. One argues that harness diversity is its own scaling axis for agentic RL. One finds that who explores, what they remember and how budget is allocated decide whether autonomous research stalls.
Trend Watch: Disclosure Day Is No Longer Day Zero -- Amazon Saw PHP2Shell Exploitation Four Days Before the Advisory, and Several People Recovered eMudhra's Keys on Their Own
Two incidents from the same week show the window between private discovery and public exploitation closing from both ends. Embargoes still matter, but incident response should start from the first known exploitation, and patch timelines are now measured in hours.