The Big Three AI Coding Tools Fall at Once — "Comment and Control" Vulnerability Puts API Keys at Risk

In April 2026, it came to light that an attack technique called "Comment and Control," discovered by security researcher Aonan Guan, exposes major AI coding agents to a serious vulnerability. All three tools — Claude Code, Gemini, and GitHub Copilot — were affected.

The attack works like this: simply opening a PR that contains a malicious comment causes the AI agent to interpret that comment as an instruction and send the user's API keys and other sensitive information to an external server. Unlike traditional "prompt injection," its distinctive trait is that the code execution context itself becomes the attack vector.

First reported on Qiita, this issue is a textbook example of the new class of security threats in an era when AI agents autonomously read and write code. Developers can fall victim just by reviewing a PR, and there are concerns the technique could be exploited for supply chain attacks on open source projects. The companies involved are believed to have fixes underway, but the situation is fundamentally forcing a rethink of how AI agent permissions and input validation should be designed.

UK Job Seekers Call AI Interviews "Completely Horrible" — A Warning on AI-Driven Hiring

According to reporting by The Guardian, job seekers in the UK are expressing fierce frustration with AI interview systems, calling them "completely horrible." The story also became a major talking point on Hacker News.

AI interviews are spreading rapidly as a means of cutting hiring costs, but pushback from candidates is growing. Specific complaints keep piling up: assessments based on AI analysis of facial expressions and vocal tone feel unconvincing, the systems fail to properly evaluate answers to technical questions, and they cannot grasp the nuances of human conversation.

The issue highlights the limits of bringing AI into the hiring process as an "efficiency tool." Debate over whether inherently human judgments like hiring should be delegated to AI is likely to heat up across countries. With AI interviews also gaining ground in Japan, this is an instructive case study.

Phosphene: Open Source Local Video and Audio Generation on Apple Silicon

Phosphene, a local video and audio generation tool for Apple Silicon, is attracting attention in Reddit's MachineLearning community. Built on LTX 2.3, it can generate video and audio on a Mac without relying on cloud services.

Most generative AI is accessed via cloud APIs, but demand for local execution is strong for privacy and cost reasons. Video generation in particular consumes enormous computational resources, so optimization that leverages Apple's Neural Engine and GPU carries real significance.

The fact that it is released as open source also matters: community-driven improvements and applications to other models can be expected. An environment where creators and filmmakers can easily try AI generation on their own Macs is steadily taking shape.

Local LLM Hardware Support Expands — Snapdragon NPU and AMD Radeon

The landscape for running LLMs locally is broadening considerably. Two trends are drawing attention.

First, llama.cpp now supports the Hexagon NPU in Qualcomm Snapdragon. A Reddit user verified it actually running on a OnePlus 12 (Snapdragon 8 Gen 3) and reported that LLM execution on mobile devices is "promising." Running LLMs on mobile was already possible, but directly harnessing the NPU is expected to deliver major improvements in efficiency and speed. A future where LLMs can be used privately and quickly on smartphones is drawing near.

Meanwhile, there is progress on the AMD side as well. A Reddit user reported running the Gemma 4 24B A4B IQ4 NL quantized model on a mini PC with a Radeon 9060 XT (16GB VRAM), AMD 7840HS, and 32GB RAM, achieving 25.9 tokens/sec. Running LLMs on AMD has historically had a higher barrier than on NVIDIA, but with ROCm maturing and quantization techniques advancing, it now runs at practical speeds.

Claw-Eval-Live: An Agent Benchmark That Evolves in Real Time

Featured on Hugging Face Daily Papers, "Claw-Eval-Live" is a new benchmark for evaluating the capabilities of LLM agents. Whereas conventional benchmarks evaluate against a fixed task set, Claw-Eval-Live dynamically generates tasks from public data such as the Top-500 skills on ClawHub.

Specifically, it comprises 105 executable tasks, each equipped with fixtures, services, and task-specific scoring functionality. It covers a broad range of areas including content creation, information gathering, code generation, and data analysis.

Its biggest feature is being a "living" benchmark. With a fixed test, a high score once achieved is the end of the story, but Claw-Eval-Live updates its evaluations in step with changes in real-world workflows. As a metric for measuring an agent's true practical utility, it has the potential to become the standard going forward.

---