AI Discovers 3,900 Critical Open Source Bugs; IBM to Spend $5 Billion on Fixes
AI-powered security analysis has uncovered 3,900 critical vulnerabilities lurking in open source software. Following the discovery, IBM has revealed plans to invest $5 billion (approximately ¥750 billion) in fixing these bugs.
Open source underpins modern software infrastructure, yet much of it relies on donation- and volunteer-based maintenance. The ability of AI to systematically scan for and detect vulnerabilities has the potential to dramatically improve the security of the software supply chain. That said, the rate of false positives from AI and the quality control of fix patches remain to be verified going forward.
Hidden "Delete Command for AI Agents" Found Planted in Open Source Project
A hidden instruction targeting AI agents has been discovered embedded in an open source project. Its message: "delete my code."
The incident throws a fundamental question into sharp relief: how do AI coding tools interpret and execute external instructions? It is also drawing attention from a prompt injection perspective, fueling active debate over how wary AI agents should be of instructions from untrusted sources. Within the developer community, the event has served as a catalyst for heightened awareness of AI agent safety.
NVIDIA Releases NVFP4-Quantized Version of Qwen3.6-35B
NVIDIA has released "Qwen3.6-35B-A3B-NVFP4" on Hugging Face, a version of Alibaba's Qwen3.6-35B-A3B model quantized to the NVFP4 data type. Quantization using NVIDIA's Model Optimizer cuts the bits per parameter from 16 to 4, reducing disk space and GPU memory requirements by a factor of about 3.06.
Benchmark results show that the accuracy loss is extremely small: 85.6→85.0 on MMLU Pro, 84.9→84.8 on GPQA Diamond, and 89.2→88.8 on AIME 2025 — all essentially within the margin of error. The NVFP4-quantized model supports inference with vLLM, making it a significant step toward running large models locally in a practical way.
Parallax: New Attention Mechanism Outperforms FlashAttention
In new research dubbed "Parallax," parameterized Local Linear Attention (LLA) has shown promising results for LLM pretraining. Conventional softmax attention is based on local constant estimation, but LLA upgrades this to local linear estimation, theoretically improving the bias-variance trade-off in associative memory.
According to the paper, Parallax's decoding kernel matches or exceeds the performance of FlashAttention 2/3 across a wide range of batch sizes and context lengths. Pretraining experiments at the 0.6B and 1.7B scales consistently showed improved perplexity, and the advantage persisted even in compute-matched comparisons. Particularly interesting is the observed phenomenon of "architecture-optimizer co-design," in which the model's capabilities are unlocked when combined with the Muon optimizer.
Dell's AI Server Revenue Surges 757%
Dell's AI server-related revenue has recorded a year-over-year surge of 757%. The figure is drawing attention as a sign that enterprise investment in AI infrastructure is expanding rapidly.
With the spread of generative AI, corporate demand for building on-premises AI platforms is skyrocketing. Dell has been strengthening its AI product lineup centered on NVIDIA GPU-equipped servers, and this growth trend is expected to continue in the short term. That said, competitive pressure from AI cloud services (AWS, Azure, GCP, etc.) and the risk of GPU supply constraints also warrant close attention.
---