Today's digest · Thursday, June 18

The 18 things in AI/dev today.

LiveNext issue at 7:00 CET
#1 / TODAY
Simon Willison·1 min·2d agoFREE+1 mirror

GLM-5.2 is probably the most powerful text-only open weights LLM

Chinese AI lab Z.ai released GLM-5.2, a 753B parameter text-only open weights LLM under MIT license. It leads the Artificial Analysis Intelligence Index among open models and ranks 2nd on Code Arena WebDev. The model has a 1 million token context window but uses more output tokens per task than peers.

GLM-5.2 offers a powerful open weights alternative for text-only tasks, leading benchmarks and rivaling proprietary models.

glmopen-weightsllmai-benchmarks
simonwillison.net
GLM-5.2 is probably the most powerful text-only open weights LLM
144 Mastra npm Packages Compromised via Hijacked Contributor Account
#2 / TOP STORY
The Hacker NewsFREE

144 Mastra npm Packages Compromised via Hijacked Contributor Account

A contributor account for the Mastra npm package ecosystem was hijacked, leading to the compromise of 144 packages. The attacker published malicious versions that could exfiltrate sensitive data. Users who installed the affected packages may have exposed credentials and environment variables.

AI agents are a confused deputy with the keys to your kingdom​​​​‌‍​‍​‍‌‍‌​‍‌‍‍‌‌‍‌‌‍‍‌‌‍‍​‍​‍​‍‍​‍​‍‌​‌‍​‌‌‍‍‌‍‍‌‌‌​‌‍‌​‍‍‌‍‍‌‌‍​‍​‍​‍​​‍​‍‌‍‍​‌​‍‌‍‌‌‌‍‌‍​‍​‍​‍‍​‍​‍‌‍‍​‌‌​‌‌​‌​​‌​​‍‍​‍​‍‌‍​‌‍‌‌​​‍‍‌​‌‌​‌‍​‌‌‍​‌‍‍‌‍‌‌‍‌‍‌‌‌​‍‌‍‌‍‌‍​‌‍‌‌​‍‍‌‍​‌‍​‍‌‍‍‌‌‍‍‌‌​‌‍‌‌‌‍‍‌‌​​‍‌‍‌‌‌‍‌​‌‍‍‌‌‌​​‍‌‍‌‌‍‌‍‌​‌‍‌‌​‌‌​​‌​‍‌‍‌‌‌​‌‍‌‌‌‍‍‌‌​‌‍​‌‌‌​‌‍‍‌‌‍‌‍‍​‍‌‍‍‌‌‍‌​​‌​‌‍​​‍‌‍​‌‌‍​‌‌‍​‍​​‌​‌‌‌‍​‌​‍‌​​​​​‌​‌‌‌‍​‌​‍‌​‌​‌‍​‍‌‍‌‍​​‍​‍‌​‍​‌‍​‍​​‌‍‌‌​‍‌‌‍​‍​‍‌​‌​‌‍​‌‍​​​​‌‌​‌‍​‍‌​‌​‌​​​​‍‌‌​‌‍‌‌​​‌‍‌‌​‌‌‍​‍‌‍​‌‍‌‍‌‌‌​​‌‍‌​‌‌​​‍‌​​‌‍​‌‌‌​‌‍‍​​‌‌‌​‌‍‍‌‌‌​‌‍​‌‍‌‌​‌‍​‍‌‍​‌‌​‌‍‌‌‌‌‌‌‌​‍‌‍​​‌‌‍‍​‌‌​‌‌​‌​​‌​​‍‌‌​​‌​​‌​‍‌‌​​‍‌​‌‍​‍‌‌​​‍‌​‌‍‌‍​‌‍‌‌​​‍‍‌​‌‌​‌‍​‌‌‍​‌‍‍‌‍‌‌‍‌‍‌‌‌​‍‌‍‌‍‌‍​‌‍‌‌​‍‍‌‍​‌‍​‍‌‍‌‍‍‌‌‍‌​​‌​‌‍​​‍‌‍​‌‌‍​‌‌‍​‍​​‌​‌‌‌‍​‌​‍‌​​​​​‌​‌‌‌‍​‌​‍‌​‌​‌‍​‍‌‍‌‍​​‍​‍‌​‍​‌‍​‍​​‌‍‌‌​‍‌‌‍​‍​‍‌​‌​‌‍​‌‍​​​​‌‌​‌‍​‍‌​‌​‌​​​​‍‌‍‌‌​‌‍‌‌​​‌‍‌‌​‌‌‍​‍‌‍​‌‍‌‍‌‌‌​​‌‍‌​‌‌​​‍‌‍‌​​‌‍​‌‌‌​‌‍‍​​‌‌‌​‌‍‍‌‌‌​‌‍​‌‍‌‌​‍‌‍‌​​‌‍‌‌‌​‍‌​‌​​‌‍‌‌‌‍​‌‌​‌‍‍‌‌‌‍‌‍‌‌​‌‌​​‌‌‌‌‍​‍‌‍​‌‍‍‌‌​‌‍‍​‌‍‌‌‌‍‌​​‍​‍‌‌
#3 / TOP STORY
Stack Overflow BlogFREE

AI agents are a confused deputy with the keys to your kingdom​​​​‌‍​‍​‍‌‍‌​‍‌‍‍‌‌‍‌‌‍‍‌‌‍‍​‍​‍​‍‍​‍​‍‌​‌‍​‌‌‍‍‌‍‍‌‌‌​‌‍‌​‍‍‌‍‍‌‌‍​‍​‍​‍​​‍​‍‌‍‍​‌​‍‌‍‌‌‌‍‌‍​‍​‍​‍‍​‍​‍‌‍‍​‌‌​‌‌​‌​​‌​​‍‍​‍​‍‌‍​‌‍‌‌​​‍‍‌​‌‌​‌‍​‌‌‍​‌‍‍‌‍‌‌‍‌‍‌‌‌​‍‌‍‌‍‌‍​‌‍‌‌​‍‍‌‍​‌‍​‍‌‍‍‌‌‍‍‌‌​‌‍‌‌‌‍‍‌‌​​‍‌‍‌‌‌‍‌​‌‍‍‌‌‌​​‍‌‍‌‌‍‌‍‌​‌‍‌‌​‌‌​​‌​‍‌‍‌‌‌​‌‍‌‌‌‍‍‌‌​‌‍​‌‌‌​‌‍‍‌‌‍‌‍‍​‍‌‍‍‌‌‍‌​​‌​‌‍​​‍‌‍​‌‌‍​‌‌‍​‍​​‌​‌‌‌‍​‌​‍‌​​​​​‌​‌‌‌‍​‌​‍‌​‌​‌‍​‍‌‍‌‍​​‍​‍‌​‍​‌‍​‍​​‌‍‌‌​‍‌‌‍​‍​‍‌​‌​‌‍​‌‍​​​​‌‌​‌‍​‍‌​‌​‌​​​​‍‌‌​‌‍‌‌​​‌‍‌‌​‌‌‍​‍‌‍​‌‍‌‍‌‌‌​​‌‍‌​‌‌​​‍‌​​‌‍​‌‌‌​‌‍‍​​‌‌‌​‌‍‍‌‌‌​‌‍​‌‍‌‌​‌‍​‍‌‍​‌‌​‌‍‌‌‌‌‌‌‌​‍‌‍​​‌‌‍‍​‌‌​‌‌​‌​​‌​​‍‌‌​​‌​​‌​‍‌‌​​‍‌​‌‍​‍‌‌​​‍‌​‌‍‌‍​‌‍‌‌​​‍‍‌​‌‌​‌‍​‌‌‍​‌‍‍‌‍‌‌‍‌‍‌‌‌​‍‌‍‌‍‌‍​‌‍‌‌​‍‍‌‍​‌‍​‍‌‍‌‍‍‌‌‍‌​​‌​‌‍​​‍‌‍​‌‌‍​‌‌‍​‍​​‌​‌‌‌‍​‌​‍‌​​​​​‌​‌‌‌‍​‌​‍‌​‌​‌‍​‍‌‍‌‍​​‍​‍‌​‍​‌‍​‍​​‌‍‌‌​‍‌‌‍​‍​‍‌​‌​‌‍​‌‍​​​​‌‌​‌‍​‍‌​‌​‌​​​​‍‌‍‌‌​‌‍‌‌​​‌‍‌‌​‌‌‍​‍‌‍​‌‍‌‍‌‌‌​​‌‍‌​‌‌​​‍‌‍‌​​‌‍​‌‌‌​‌‍‍​​‌‌‌​‌‍‍‌‌‌​‌‍​‌‍‌‌​‍‌‍‌​​‌‍‌‌‌​‍‌​‌​​‌‍‌‌‌‍​‌‌​‌‍‍‌‌‌‍‌‍‌‌​‌‌​​‌‌‌‌‍​‍‌‍​‌‍‍‌‌​‌‍‍​‌‍‌‌‌‍‌​​‍​‍‌‌

A Stack Overflow Blog article warns that AI agents act as a 'confused deputy,' inheriting user privileges and potentially executing unintended actions. The post argues that many security checks developers assume exist are never actually written, leaving systems vulnerable. It highlights the risk of granting AI agents broad access without proper authorization boundaries, comparing the situation to giving an untrusted program the keys to your kingdom.

aigest · daily

Get this every morning.

One email. The signal. Built for builders.

Free · Unsubscribe in one click · No trackers

// Worth acting on3 stories
// Worth knowing10 stories

Eve standardizes agent development with built-in production readiness, reducing repetitive plumbing.

agentsopen-sourcevercelframework
Vercel3d ago1mFREE
More selected · 2
// Yesterday10 stories