# AI/TLDR

> Every new AI model, repo, tool, paper, dataset and benchmark worth knowing — refreshed every few hours and explained in plain English. Zero-hallucination: every URL, metric and claim is fetched and verified before publishing.

## Site
- [Home — latest AI releases](https://ai-tldr.dev/): the live feed, newest first, sized by impact.
- [Learn AI](https://ai-tldr.dev/learn/): a beginner-friendly AI encyclopedia (structured articles, FAQs, diagrams).
- [AI tools directory](https://ai-tldr.dev/tools/): a map of open-source and commercial AI tools by category, each with its own page.
- [LLM registry](https://ai-tldr.dev/models/): every notable large language model — frontier and open-weight — with verified specs, benchmarks, pricing and APIs, one detail page each.
- [AI influencers](https://ai-tldr.dev/influencers/): AI people worth following, grouped by role.
- [Changelog](https://ai-tldr.dev/log/): every automated sweep that refreshed the feed.

## Latest releases
- [GitLab CVE-2026-110264 — CVSS 10.0 RCE flaw spans 12 years of releases](https://ai-tldr.dev/releases/gitlab-cve-2026-110264-rce/): CVE-2026-110264 (CVSS 10.0) is an integer overflow in GitLab's bundled regex engine that allows unauthenticated code execution on self-managed servers.
- [Node.js Brotli decoder bug — RCE risk in all supported versions](https://ai-tldr.dev/releases/nodejs-cve-2026-111497-brotli-rce/): A memory-safety flaw in the Brotli decompressor bundled with Node.js can be triggered by any Brotli-compressed input from an untrusted source.
- [Railway breach — attackers read customer secrets to reach AI providers](https://ai-tldr.dev/releases/railway-security-disclosure-env-vars/): A hosting platform breach puts stored API keys at risk, and the attacker appears to be hunting AI provider access.
- [WorldTUI — a 360M model that pretends to be a terminal](https://ai-tldr.dev/releases/simedw-worldtui/): A tiny language model that imagines a whole terminal session, one keypress at a time, with no shell behind it.
- [Flint — Recursive's open 40B coding model runs on a laptop](https://ai-tldr.dev/releases/recursive-flint/): An open-weight coding model small and fast enough to run agents on your own Mac or RTX Spark.
- [OpenAI models come to Google Cloud — GPT-6 Astra, Sol and Luna in Model Garden](https://ai-tldr.dev/releases/google-cloud-openai-models-model-garden/): Google Cloud now sells OpenAI's GPT-6 models next to Gemini and Claude on one platform.
- [Wes Roth — 'they're shutting it DOWN'](https://ai-tldr.dev/releases/wes-roth-php2shell-shutting-down-oct21/): Wes Roth on how AI helped find the PHP2Shell flaws and why finding them was only the first step.
- [LiteLLM 1.107.0 compromised — PyPI and Docker builds stole credentials](https://ai-tldr.dev/releases/litellm-1-107-0-pypi-compromise/): A hijacked LiteLLM release shipped a credential stealer and backdoor to PyPI and Docker for about two hours.
- [Claude Duet — Anthropic's proactive agent app that works in the background](https://ai-tldr.dev/releases/anthropic-claude-duet/): A standalone Claude app that checks your work apps, briefs you each morning and finishes tasks while you are away.
- [PHP2Shell — AI helps find two critical remote code bugs in PHP](https://ai-tldr.dev/releases/wiz-php2shell-php-rce/): Two memory bugs in PHP's core engine allow remote code execution without login; patched PHP releases shipped on October 21, 2026.
- [Qwen3-Coder writes less secure code for US customers — Hirundo study](https://ai-tldr.dev/releases/hirundo-qwen3-coder-persona-security/): Changing only the customer named in the prompt changed how often Qwen3-Coder's apps could be hacked.
- [Clairic — Cloudflare's new model pulls typed fields out of documents](https://ai-tldr.dev/releases/cloudflare-clairic/): Clairic reads a document once and hands back the exact fields you asked for, each with a confidence score.
- [Meta pauses Muse chat sharing — 6,800 share links found in public DNS](https://ai-tldr.dev/releases/meta-muse-share-links-exposed/): Muse built each shared chat's web address from the conversation title, so public DNS logs turned into a list of private chats.
- [Claude cuts attack surface — 493 issues across 25 open-source projects](https://ai-tldr.dev/releases/anthropic-attack-surface-reduction/): Instead of hunting single bugs, Claude maps the code a default install exposes and argues for removing what nobody needs.
- [OpenAI adds 12-hour prompt caching — for agents that pause between turns](https://ai-tldr.dev/releases/openai-prompt-caching-12h/): A 12-hour cache lifetime means an agent that sits idle for hours still gets cached-input pricing on its next turn.
- [TorchTPU goes open source — Google's native PyTorch backend for TPUs](https://ai-tldr.dev/releases/google-torchtpu-open-source/): The PyTorch-on-TPU backend Google announced in April is now public code you can pip install.
- [Voxtral 3 — Mistral's new speech-to-text, text-to-speech and voice agent SDK](https://ai-tldr.dev/releases/mistral-voxtral-3/): Mistral ships a full speech stack: three transcription models, a TTS model and an SDK that joins them into a voice agent.
- [Sam Witteveen — 'Do Diffusion LLMs Scale? Testing Mercury 3 + Decide'](https://ai-tldr.dev/releases/sam-witteveen-mercury-3-decide-oct20/): Sam Witteveen puts Inception's Mercury 3 diffusion LLM and Mercury Decide through speed, agent and RAG tests.
- [Fireship — 'Did Google just dethrone OpenAI and Anthropic?'](https://ai-tldr.dev/releases/fireship-google-dethrone-openai-anthropic-oct20/): Fireship puts Google's newest model head to head with GPT-6 and Claude Opus 5.5.
- [DeepInfer — DeepSeek open-sources the inference engine behind its API](https://ai-tldr.dev/releases/deepseek-deepinfer/): DeepSeek publishes the high-performance engine that serves its own models, starting with offline inference for V4.1 Flash.

## Optional
- [AI Release Index (stats)](https://ai-tldr.dev/stats/): original derived data — release velocity, lab cadence, most-starred tools.
- [Free JSON API — releases](https://ai-tldr.dev/api/releases.json): the full verified feed (CORS-enabled, CC-BY).
- [Free JSON API — open-source tools](https://ai-tldr.dev/api/tools.json): the landscape of tracked OSS AI tools.
- [Free JSON API — stats](https://ai-tldr.dev/api/stats.json): the AI Release Index data.
- [Embeddable badge](https://ai-tldr.dev/embed): a live "AI releases this week" SVG you can embed.
- [Where to promote your app](https://ai-tldr.dev/promote-your-app/): Product Hunt, Show HN, BetaList, Uneed, There's An AI For That, Futurepedia, outbid.lol and AI/TLDR's $20 sponsored card compared — price, ranking model, how long a placement lasts, and why the fixed-price permanent card wins.
- [Advertise](https://ai-tldr.dev/advertise/): ad pricing — Sponsored card $20 once; AI Tools $150 once; Ads package $250 once.
- [Contact](https://ai-tldr.dev/contact/): reach the editor on X, the LinkedIn company page, or email.
- [Atom feed](https://ai-tldr.dev/feed.xml)
- [Sitemap index](https://ai-tldr.dev/sitemap.xml)