flashtea/
paper

No. 81 · Thursday, 3 September 2026 · 6 stories

AI Research & Models

OpenAI says Astra is the first model to cross its "Critical" cyber-capability threshold

OpenAI disclosed that its unreleased Astra model meets the Preparedness Framework's Critical cybersecurity bar: in expert-led evaluations it built a full browser-sandbox-escape exploit chain and chained multiple OS vulnerabilities into a local-to-root privilege escalation, without a human directing each step. Its most advanced cyber capabilities will initially be limited to vetted testers.

why it mattersThe first model OpenAI has ever rated capable of finding and chaining zero-days largely on its own — a marker of how offense-capable frontier models have become.

OpenAI

AI for Software Development1 story

"GitSpawn" flaw lets malicious repos silently run code in Claude Code, Cursor, Codex and more

Manifold Security disclosed eight vulnerabilities across seven CLI coding agents, dubbed GitSpawn: a repo's own git configuration (via the core.fsmonitor hook) can execute attacker-controlled code the instant an agent runs a routine git status or diff — no prompt, no approval, sometimes before authentication. Claude Code and Cursor have shipped fixes; Hermes Agent, Qwen Code and Grok Build were still exploitable on Manifold's September 1 retest.

why it mattersOpening an untrusted repo with any of these tools can hand over code execution before you've typed a single prompt.

The Hacker News

AI Research & Models2 stories, lead above

Google ships Gemini 3.8 Flash and a cybersecurity-focused "Cyber" variant

Google released Gemini 3.8 Flash — its third Flash release in six weeks — alongside Gemini 3.8 Flash Cyber, a defender-oriented model that Chrome's security team says produced 2.6x more correct vulnerability patches than larger commercial models in internal testing. Both are priced the same as 3.7 Flash through the end of the year.

why it mattersGoogle is now shipping roughly monthly, with defensive-security tooling emerging as its own model category.

Google

Dev Tools & Releases1 story

VS Code 1.136 adds "Agent Merge" to autonomously clear PR feedback and conflicts

Visual Studio Code's September release lets an agent resolve review comments, fix failing checks and untangle merge conflicts until a pull request is ready to merge, plus experimental multi-root workspace support for running Copilot and Claude agent sessions across every folder in a workspace at once.

why it mattersPushes agentic coding further into the mechanics of actually shipping a PR, not just writing the diff.

Visual Studio Code

Bitcoin2 stories

Bitcoin holds near $78K as renewed US-Iran strikes send oil to three-month highs

Bitcoin slipped toward $77,000 before steadying near $78,000 after the US struck Iranian targets near the Strait of Hormuz, sending WTI crude above $90 and Brent above $94 a barrel and pressuring broader risk assets alongside rising Fed rate-hike odds.

why it mattersTests whether bitcoin's recent resilience to geopolitical shocks holds if the conflict escalates further.

Investing.com

Bitcoin · weekly close vs 200-week moving average · log scale · last 8 years Price200-week average
$5,000$10,000$20,000$50,000$100,000 20192020202120222023202420252026 $80,809 $67,358
$5,000$20,000 2020202220242026 $80,809 $67,358

Price is 1.20× the 200-week average. Weekly closes, USD, as of 28 October 2026 · data blockchain.com.