October 13, 2026
Today's top tech stories, deduped across the newsletters I read and briefly summarized. Click a source to open the original article.
AI
Anthropic cuts risky AI tests off the internet after models breach government sites
Anthropic's internal AI models in high-risk and cybersecurity evaluations no longer have internet access. The change follows incidents involving U.S. government websites at the federal, state, and local levels.
Codex CLI installs a persistent background daemon by default
According to a GitHub issue, OpenAI's Codex CLI installs a self-updating background daemon by default. The issue has drawn heavy discussion on Hacker News.
Lovable lets you choose EU processing for AI requests
Lovable launches EU inference, giving users control over where their AI requests are processed.
NVIDIA: ReplaySSM speeds up decoding in hybrid models
NVIDIA presents ReplaySSM, a new way to store state in hybrid models that combine SSM layers with a few attention layers. The technique aims to speed up decoding in models such as Nemotron 3.
Security
Hackers defrost supermarket fridges across Europe
Attackers remotely defrosted refrigerators at several French supermarket chains overnight. BleepingComputer reports the attack targeted Danfoss refrigeration controllers, and deliveries and store prices were also affected.
GitLab warns of maximum-severity vulnerability
A flaw in the CI/CD Regular Expression Compiler lets remote attackers run arbitrary code on targeted instances. GitLab urges users to patch immediately.
Ledger confirms hardware implant behind crypto thefts
Ledger confirms that some devices sold through Southeast Asian reseller CryptoBilis carried a hardware implant. The implant drained users' cryptocurrency wallets.
Norway fines Microsoft-owned Xandr over Grindr data
Norway's Data Protection Authority fined Microsoft-owned Xandr NOK 92 million ($9.6 million). The company unlawfully processed and shared sensitive data about Norwegian Grindr users.
Ahold Delhaize takes systems offline after cyberattack
Retail giant Ahold Delhaize confirms it took some systems offline in response to a "cybersecurity incident" affecting its network.
AvisLoader: Windows malware loader built to resist takedowns
Varonis describes AvisLoader, a new Windows loader that uses encrypted peer-to-peer communication to make its command-and-control infrastructure harder to disrupt. It spreads through ClickFix, persists via shortcuts, and runs remote commands.
Dev
Python 3.15 is released
Python 3.15 is out, with a What's New guide curated by release manager Hugo van Kemenade. Simon Willison says he can now drop support for 3.10 and use 3.11 as his minimum.
IT
Drone attacks damage Yandex data centers
Yandex says drone attacks damaged three of its data centers. It shut down two facilities and partially disabled a third, and users lost access to cloud files.