Light news day.
Most of the day's coverage was follow-on to stories already in the last few digests (Copilot outages, OpenAI Partner Network, prompt-injection-as-architectural-flaw, the programmatic-billing split). Below are the genuinely new developments, kept short rather than padded with repeats.
TLDR
- Hugging Face open-sourced Serge, a GitHub-native AI code reviewer (Jun 12) — reviews PRs with any OpenAI-compatible model, follows repo-owned rules, posts through GitHub's normal review UI Open Source
- Moonshot shipped a "HighSpeed" mode for Kimi K2.7-Code (Jun 15) — ~6x faster decoding, but still zero independent benchmark submissions; all numbers remain vendor-reported Open Source
- Anthropic met Commerce/White House officials over the Fable 5 / Mythos 5 export-control block (Jun 15–16) — talks on safety protocols and international access frameworks; no outcome announced yet Policy
Action Items
Things your engineering team should look at or do this week.
- If you use Cursor's Auto-Run/Allowlist mode, confirm you're on v2.3 or later. CVE-2026-22708 (disclosed earlier this week) lets shell built-ins like
export/declarepoison the environment and turn allowlisted commands (git,python3) into RCERemote code executionA flaw that lets an attacker run malicious code on a target's computers or network.Cloudflare ↗ — even with an empty allowlist. The fix shipped in 2.3. (Researcher writeup | SentinelOne) - Pilot Serge on one repo before committing to a paid AI reviewer. It's MIT-style open source and model-agnostic, so you can point it at your own inferenceRunning a trained model on new input to get an output, as opposed to training it.NVIDIA ↗ endpoint and measure signal-to-noise on real PRs without a vendor contract. (GitHub repo)
Models & Tools
-
Hugging Face Serge — open-source, GitHub-native AI code review (Jun 12) Open Source — A PR reviewer built to fit existing workflows rather than replace human review: it runs on any OpenAI-compatible model, honors repository-owned review rules, and publishes comments through GitHub's standard PR review experience. Positioned for catching issues early and helping maintainers keep up with PR volume. (HF blog | GitHub)
-
Kimi K2.7-Code adds "HighSpeed" mode — but still no independent benchmarks (Jun 15) Open Source — Update to the Jun 13–14 K2.7-Code coverage. Moonshot rolled a HighSpeed variant into Kimi Code Beta, claiming ~180 tok/s on median coding inputs (up to ~260 tok/s short-context), roughly 6x the standard release. The caveat stands: every published score is a Moonshot proprietary benchmark — nothing on SWE-benchA benchmark that tests whether a model can resolve real GitHub issues by editing code in popular Python repositories.Jimenez et al. 2023 ↗ Verified, SWE-bench Pro, Terminal-Bench, LiveCodeBench or GPQA Diamond. Treat as vendor-reported and directional until third-party numbers land. (TechTimes)
Policy & Safety
- Anthropic in talks with Commerce / White House over the Fable 5 & Mythos 5 export-control block (Jun 15–16) Policy — Update to the Jun 14 export-control item. Days after disabling Fable 5 and Mythos 5 access to comply with a government directive restricting access for foreign nationals, Anthropic staff went to DC for meetings (continuing Jun 15–16) reportedly covering three things: safety protocols that could satisfy national-security concerns, frameworks for how its models are distributed internationally, and terms for federal agencies to resume or expand use. Neither side has commented on outcomes. Worth watching if your access to frontier models could be affected by national-security-driven export rules. (CNBC | UPI)