Three advisories for mcp-server-git — Anthropic's official Git Model Context Protocol server — published on December 17 describe a path-validation bypass when the repository flag is set (CVE-2025-68145), an unrestricted git_init tool that would create a repository in any writable directory (CVE-2025-68143), and argument injection in git_diff and git_checkout that let an attacker overwrite arbitrary files with an empty diff (CVE-2025-68144). The fixes shipped in versions 2025.9.25 and 2025.12.18, and the git_init tool was deleted outright.

The chain matters more than the individual scores: agentic-security firm Cyata, which reported to Anthropic in June, demonstrated that git_init plus a Filesystem MCP server lets an attacker write a malicious .git/config with a clean filter and a .gitattributes file, so a later git_add call executes an attacker shell script. The entry point is indirect prompt injection — a README, a poisoned issue description, or a web page the assistant reads — and no user error is required. Cyata said it saw no indication of exploitation in the wild.

Google released Gemini 3 Flash on December 17 and immediately made it the default model in the Gemini app and in AI Mode in Search, replacing Gemini 2.5 Flash. Pricing is $0.50 per million input tokens and $3.00 per million output tokens, with a 1M-token context window and configurable thinking levels. Google reports 78% on SWE-bench Verified for agentic coding — claiming it edges out Gemini 3 Pro — plus 90.4% on GPQA Diamond and 68.7% on SimpleQA Verified, against 28.1% for the 2.5 Flash it replaces.

The distribution is the story: the model is not just an API endpoint but the default reasoning tier behind consumer search and the Gemini app, and it reaches developers through the Gemini API, AI Studio, Vertex AI, Gemini CLI, Android Studio and Antigravity simultaneously. Google says JetBrains, Figma, Cursor, Harvey and Latitude are already building on it.

Xiaomi's LLM-Core team released MiMo-V2-Flash on December 16 with full weights on GitHub and Hugging Face, plus a base model, a technical report and separately open-sourced three-layer Multi-Token Prediction weights. The architecture is a 309B-parameter MoE that activates 15B per token, interleaving sliding-window attention with global attention in a 5:1 ratio at a 128-token window, which the team says cuts KV-cache storage by nearly 6x while a learnable attention-sink bias preserves long-context quality. It was pre-trained on 27 trillion tokens and supports a 256K-token context.

On Xiaomi's own evaluations the post-trained model scores 73.4% on SWE-bench Verified and 71.7% on SWE-bench Multilingual, edging Kimi K2 Thinking at 71.3% and DeepSeek V3.2 Thinking at 73.1% at a fraction of their total parameters — DeepSeek V3.2 carries 671B total and Kimi K2 over 1T. Those are vendor-run tables, not independent testing, and none of the numbers were reproduced by a third party in the week of release.

NVIDIA announced the Nemotron 3 family on December 15 and made only the smallest member available: Nano is a 30-billion-parameter mixture-of-experts model that activates 3.2 billion parameters per forward pass, built on a hybrid Mamba-2 and transformer architecture with grouped-query attention. It supports context lengths up to 1 million tokens, and NVIDIA claims up to 4x higher token throughput than Nemotron 2 Nano with reasoning-token generation cut by up to 60%.

The release is unusually open for a vendor model: checkpoints in FP8, BF16 and base BF16, the pre-training and post-training datasets, the training recipes, and NVIDIA's NeMo Gym, NeMo RL and NeMo Evaluator tooling, all under the NVIDIA Nemotron Open Model License. Super, at roughly 100B total and 10B active, and Ultra are announced but not yet shipped, so the firm is staging the family the way it stages GPUs.