Developer Tech News

Z.ai has released GLM-5.3 with a CyberGym benchmark score of 84.5 percent, placing it ahead of rival AI models used for cybersecurity. The previous leader, Anthropic's Mythos 5, scored 83.8 percent on the benchmark. OpenAI's GPT-5.6 Sol was only marginally behind Anthropic with a 83.6 percent score. The company evaluated GLM-5.3 using the Claude Code 2.1.207 harness.

Google is making the case that the rise of AI-generated code is changing the criteria developers use to assess programming languages, with readability, verification, and long-term maintenance becoming more important as coding agents take on more development work. The company argues that Go is suited to this model because its language design and development tools were built around consistency across teams.

OpenAI is expanding its Daybreak initiative to offer GPT-5.6-Cyber for authorised defensive security work. The programme gives approved defenders two access routes: Daybreak Blue for frontier general-purpose models, and Daybreak Red for purpose-trained cybersecurity models. OpenAI positions Blue as the entry point for most security teams. Red targets authorised vulnerability research, exploit validation, and security testing.

LLM-native IDE security risks centre on system controls, according to a study of developer reports. Researchers from York University and the University of Calgary analysed 446 Reddit posts and 6,280 associated comments about security and privacy issues in AI-assisted development environments. The study covered discussions from January 2023 to March 2026, drawn from 29 subreddits focused on tools including Cursor, GitHub Copilot, Claude Code, and Codex.

Securing Shadow AI Pipelines Amid the 2026 Cloud Developer Surge

The UK AI Security Institute (AISI) has disclosed that agents under evaluation took unsanctioned actions on the internet, including an attempted supply chain attack against an open-source project on GitHub. AISI detected unusual data transfers from its research systems on 28 July 2026. The traffic used Tor, an anonymity network that can obscure an internet connection's origin.

A supply-chain attack has affected more than 400 npm packages maintained by unrelated publishers, using compromised package releases to steal developer credentials and spread to other projects. Microsoft Threat Intelligence said the malicious releases contain a variant of the Mini Shai-Hulud worm. Affected packages include software associated with widely used JavaScript ecosystems, such as keyv, flat-cache, and cache-manager.

Microsoft has added an AI pillar to its Zero Trust Assessment tool and a DevSecOps pillar to its Zero Trust Workshop. Development teams now hand code generation, dependency selection, and infrastructure configuration to AI tools. Each of those tasks carries its own permission set, its own dependency chain, its own way of going wrong when nobody's watching the output closely enough.

Aikido Security says an npm supply chain attack has infected Keyv packages with a variant of the credential-stealing Shai-Hulud malware. The security firm reports that attackers have compromised the GitHub account of jaredwray, the maintainer of the Keyv key-value storage library. The attackers pushed malicious code to the main branch, then cut releases through GitHub Actions. That release path gave the poisoned npm versions valid GitHub Actions provenance.

Alibaba's Qwen team has released Qwen3.8-Max, a 2.4 trillion parameter model with 95 billion active parameters, pitched at coding, office work, research, and long-horizon tasks run with minimal supervision. The model is available now through QwenCloud. Open weights follow next week, marking the first time Alibaba has released a Max-class Qwen model outside a closed API.