Fetching from the wire…
01
02
03
04
05
06
07
08
Public story · 2026-08-24 · high
It found two new bugs in libpng and zlib, with refined CodeQL queries at 98 percent precision or better in benchmark tests.
Why now: The findings come from a paper posted to arXiv in August 2026, covering both benchmark results and two new real-world bugs.
ARQ closed a CodeQL query issue that had sat open for 27 months, per a paper on arXiv (2608.20637). It also turned up two new bugs in libpng and zlib, two libraries with long histories of security review.
The method skips labeled datasets and hand-written vulnerability templates. ARQ synthesizes test programs whose execution disagrees with what a CodeQL query reports. It feeds that disagreement to an LLM repair loop that rewrites the query. On the Juliet v1.3 and FormAI v2 benchmarks, the refined queries caught up to 119.8% more true positives than the originals. Precision stayed at 98.0% or better.
Juliet and FormAI are synthetic test suites, built to exercise known vulnerability patterns. libpng and zlib are real code that other analysis tools have already gone over for years. Bugs found in code like that carry more weight than a benchmark score. A synthetic suite can reward a query for catching exactly the patterns it was tuned on.
Each link below shares sources, entities, or timing with this story.
Released July 11, it adds static-analysis queries that flag prompt-injection vulnerabilities in JavaScript and TypeScript, plus Kotlin 2.4.0 support (GitHub). Treating untrusted-input-into-LLM flows as a first-class security defect class is the right call. If you're wiring LLM...
Allen Bargi's August 15 post hit 302 points arguing that AI collaboration rewards context-sharing, examples, and feedback over precise instruction (Hacker News). The pushback holds that the piece conflates management with leadership. mikeocool calls it "the most low effort ver...
Satya Nadella said companies routing everything through a single proprietary lab may not survive. His argument: you hand that lab your most sensitive business context, and the lab can turn it against you as a competitor. His prescription is an orchestration layer — keep the ha...
Willison launched datasette-apps (0.1a2) on June 18, hosting self-contained HTML+JS apps in a sandboxed iframe that run SQL against your data, read-only by default. He frames it as "Claude Artifacts reimagined for Datasette," artifacts backed by a JSON API to a relational data...
His conclusion is DuckDB matches or beats SQLite's safety for untrusted queries, but only with enable_external_access=false, lock_configuration=true, and a watchdog thread, since DuckDB lacks SQLite's opcode-based query timeouts. He ships a safe_duckdb.py helper and a Datasett...
CCP announced the migration covering code that has run on Stackless 2.7 since 2010. The approach is to run futurize across the codebase and then manually review roughly 20,000 places where Python 2 and 3 behavior diverges, including integer division (Simon Willison). No comple...
MindPattern daily
One email a day at 7 AM. Sources and a take on every story. Unsubscribe anytime.