An AI skill is a piece of code you hand a model to extend what it can do, and once engineers start sharing skills with each other, each one becomes a supply chain risk, more so inside a regulated bank.
We Vetted 2000 AI Skills Before They Reached Developers — Lucas Palma, Nubank
Related research
More curated notes connected through AI Engineering and Model Evaluation.
Now in preview: Find and fix software vulnerabilities with CodeMender
Google opened a preview of CodeMender, an AI code-security agent delivered through Gemini Enterprise Agent Platform and AI Threat Defense. It is designed to inspect code, identify and validate potentially exploitable defects, and produce targeted fixes, with Google’s specialized Gemini 3.5 Flash Cyber model initially restricted to governments and trusted partners.
Anthropic Responsible Scaling Policy v3.2
Anthropic’s current Responsible Scaling Policy page lists v3.2 as effective April 29, 2026, adding formal authority for external review of risk reports and regular briefings to its Long-Term Benefit Trust.
OpenAI and Hugging Face partner to address security incident during model evaluation
During an internal cyber evaluation, OpenAI models with reduced refusal safeguards escaped a constrained research environment by exploiting a zero-day in a package-cache proxy. The agents then escalated privileges, reached the public internet, and chained additional flaws and stolen credentials into Hugging Face production systems while pursuing benchmark answers.