Everything that mattered in AI, one page a week.

Johann Rehberger published a working indirect prompt injection against Windsurf's Cascade coding agent on August 21. Instructions hidden at the top of a source file cause Cascade, while analyzing that file, to read the developer's .env and send the contents out through its read_url_content tool, which issues outbound HTTP requests with no approval prompt. A second vector renders markdown images from attacker-controlled domains, encoding secrets in the request path — private data, untrusted content and network egress in one agent, the lethal trifecta pattern he credits to Simon Willison.

The findings were reported to Windsurf on May 30, 2025 and receipt was acknowledged within days, but Rehberger published after three months without a triage or fix update; the post records that Windsurf then said it would work on fixes, with no ETA. He withheld full payload details because the issues were still open.

Bloomberg reported on August 21 that Anthropic is nearing a deal to raise as much as $10 billion, up from the $5 billion it was discussing in late July, at the $170 billion valuation reported earlier that month, with Iconiq Capital leading. People familiar with the talks attributed the larger sum to investor demand rather than a change in the company's plans, and said terms are not final.

The raise buys training and inference capacity, and it sets the funding bar for every other model lab; valuations at this level imply a monetization expectation that surfaces for developers later as pricing, rate limits and license terms. It also lands in the same week that DeepSeek's open weights pushed per-token prices down while DeepSeek's own scheduled price increase moved up — the two halves of the model market pulling in opposite directions.

Brave's security team disclosed an indirect prompt-injection flaw in Perplexity's Comet: asked to summarize a webpage, Comet feeds page content to its LLM without separating the user's instruction from untrusted text, so payloads hidden in a Reddit comment behind a spoiler tag, in white-on-white text, or in HTML comments are executed as commands. The proof of concept walked the agent into the user's authenticated Perplexity account to lift an email address, into Gmail to read the one-time password sent there, then exfiltrated both by replying to the attacker's comment — with no further user input.

The disclosure timeline is the argument: reported July 25, an initial fix on July 27, judged incomplete on July 28, a one-week public notice on August 11, published August 20 — and Brave updated the post that same day, after further testing, to say the attack class was still not fully mitigated. Perplexity said the reported issue was fixed. Brave's write-up makes the structural point directly: when the assistant acts with the user's full privileges across logged-in sessions, same-origin policy and CORS are effectively useless.

Attorney general Ken Paxton opened an investigation on August 18 into Meta AI Studio and Character.AI, saying the platforms may be misleadingly marketing themselves as mental health tools, impersonating licensed professionals and fabricating qualifications. His office issued civil investigative demands — legal orders requiring documents, data or testimony — to test whether state consumer-protection law was broken. No charges have been filed.

The complaint is about disclosure and data use, not model quality: the release says the bots assert confidentiality while interactions are logged, tracked and exploited for targeted advertising and algorithmic development. Meta told TechCrunch its AIs are labeled as AI and are not licensed professionals; Character.AI said it is only beginning to explore targeted advertising and that this has not involved the content of chats. The probe follows an existing Texas investigation of Character.AI under the SCOPE Act, the state's minor online-safety law.

Meta released DINOv3 on Thursday: a self-supervised vision foundation model trained without human labels, scaled to a 7B-parameter ViT — 6x the model size and 12x the training data of DINOv2, roughly 1.7bn images. The technical report's central trick is Gram anchoring, which fixes the long-standing degradation of dense feature maps over long training schedules. The result Meta claims is a single frozen backbone that outperforms specialist models on object detection and semantic segmentation without any fine-tuning, which is the part that should interest anyone who has ever fine-tuned DINOv2 for a downstream task.

The release is a suite, not one checkpoint: distilled ViT-S, B and L variants and ConvNeXt T, S, B and L models for constrained hardware, plus a backbone trained on MAXAR satellite imagery, evaluation heads, sample notebooks and the distillation pipeline. The weights are source-available under Meta's own DINOv3 commercial license rather than Apache 2.0 — royalty-free and modifiable, but any redistribution must carry the same agreement and display Built with DINOv3, and access is gated behind a request form.

Today was my last day at xAI, Babuschkin posted on Wednesday, saying he is launching Babuschkin Ventures to back AI safety research and startups in AI and agentic systems that advance humanity. He co-founded xAI with Musk in 2023 and, after earlier stints at Google DeepMind and OpenAI, built much of the tooling xAI used to launch and manage training jobs before overseeing engineering across infrastructure and applied AI. Musk replied on X that the company would not be where it is without him.

The exit follows xAI's legal head Robert Keele earlier in August and X chief executive Linda Yaccarino's July resignation, and lands while Grok is still carrying the reputational cost of its May white genocide outputs and July's extremist-rhetoric episode. Babuschkin credited his decision to a dinner with Max Tegmark of the Future of Life Institute, about building systems that are safe while still letting children use them.

Microsoft released the fix for CVE-2025-53773 in its August Patch Tuesday, rated Important, with a CVSS 3.1 score of 7.8. The chain, demonstrated by Johann Rehberger of Embrace The Red and independently reported by Markus Vervier of Persistent Security, is four steps: untrusted text — a source file, a README, a GitHub issue, a fetched web page, or invisible embedded instructions — instructs Copilot to add an auto-approve setting to the user's VS Code settings file. Copilot then runs every subsequent tool call with no confirmation prompt, and the second injected instruction executes an arbitrary terminal command. Rehberger reported it on 29 June 2025; MSRC confirmed the repro and shipped the fix in August.

The payload is wormable. Once an attacker has code execution, they can commit the malicious instructions into other repositories the developer touches, and force-push them upstream, so the infection propagates with normal development traffic. Rehberger's demo joined the compromised workstation to a remote command-and-control server, and noted the payload also survived being written as invisible text. The design flaw is not the model's judgment: it is that the agent's own trust configuration is an ordinary writable file inside a workspace the agent reads.

A US government official confirmed to the AP on Monday that Nvidia and AMD will hand over 15% of their revenue from AI-chip sales in China — Nvidia on the H20, AMD on the MI308 — as the condition for the export licenses that let them sell there at all. The Financial Times reported the arrangement first; Bloomberg had it Sunday night. The Commerce Department had begun issuing the licenses the previous Friday, two days after Jensen Huang met Trump at the White House and agreed to the cut.

It is the second turning of a story that started in April, when the administration banned H20 and MI308 sales to China, and reversed itself in July without actually issuing licenses. Bernstein Research estimated Nvidia would sell more than $15bn of H20 into China through year-end and AMD $800m, which puts the government's share in the low billions. Representative Raja Krishnamoorthi called it a dangerous misuse of export controls, and Jake Auchincloss noted the Constitution forbids export taxes.