DawnSift
订阅日报
周六 · 科技日报 · 第 48 期

2026-08-29

— 开源模型军备竞赛白热化,安全响应节奏被 AI 彻底改写。

今日 TL;DR

GLM-5.3 以开源权重登顶多项编码与安全基准,与 Qwen3.8-Flash-Next 同日发布且架构高度趋同;Anthropic 发布 MHS 硬件标准,Claude 开始直接控制机械臂等物理设备;OCaml 维护者发现仅凭漏洞传闻,攻击者就能在补丁公开后数分钟内发起探测;Vercel 开源 WebGPU 库 vgpu,将 .wgsl 文件变为可导入的 TypeScript 模块。

Just a rumour of a bug is enough to find a security exploit these days(如今仅凭一个漏洞传闻就足以找到安全利用方式)。——Anil Madhavapeddy,OCaml 编译器核心维护者

头条

1

GLM-5.3 开源权重发布,编码与安全基准登顶

Z.ai 发布 GLM-5.3,与 GLM-5.2 共享同一基础模型,全部提升来自后训练;在 Z.ai Code Bench 上较 GLM-5.2 提升 50%,并在 Terminal Bench 3.0、Agents' Last Exam 及 CyberGym 漏洞发现上取得开源 SOTA,利用链基准成绩翻倍。为什么重要:开源模型在复杂编码和长程任务上首次系统性逼近顶级闭源模型,且后训练驱动的能力跃升为推理优化与 agent 工作负载提供了新的上限参考。

评论区普遍认为性能出色、性价比高,接近顶级闭源模型,但也有人认为价格偏高且部分功能缺失。

2

Anthropic 发布 MHS 硬件标准,Claude 开始控制物理设备

Anthropic 推出 Model Hardware Standard(MHS),将不同厂商硬件的控制方式转译为 Agent 可发现、可读取、可调用的一致接口;Claude 已能直接控制 Hugging Face LeRobot 生态中的 SO-ARM101 机械臂,无需预训练机器人策略或遥操作。为什么重要:这相当于物理世界的 MCP,使 Agent 从纯软件工具调用扩展到分布式具身控制,对机器人、实验室自动化等场景的开发者意味着新的集成范式。

3

仅凭漏洞传闻即可在数分钟内发起攻击,开源安全响应面临重构

OCaml 核心维护者 Anil Madhavapeddy 在修复 cohttp 6.3.0 路径遍历漏洞时,发现公开 PR 后约十分钟内其服务器就收到针对该漏洞模式的探测请求;他本人也能仅凭漏洞大致描述,用编码代理找到利用方式。为什么重要:现代编码代理已能将最微弱的漏洞线索转化为可执行利用,开源项目传统的'先私下修复、再公开披露'流程已不足以应对,安全响应节奏需要根本性改变。

4

Vercel 开源 vgpu:将 .wgsl 文件变为可导入的 TypeScript 模块

Vercel 开源 vgpu,一个 TypeScript WebGPU 库,将 .wgsl 着色器文件作为可导入模块处理,同一着色器可在浏览器、通过 Dawn 的无头 Node.js 及确定性 CI mock 中运行,全屏效果仅 25 KB gzipped。为什么重要:WebGPU 的适配器、绑定组布局和管线描述符一直是前端团队落地着色器的最大障碍,vgpu 以 MIT 协议发布到 npm,为 AI agent 着色器和实时图形提供了低摩擦的工程路径。

5

HTTPX2 发布,OpenAI Python SDK 已迁移

Pydantic 接手维护 HTTPX,以 HTTPX2 名义发布下一代 Python HTTP 客户端,支持 HTTP/1.1 与 HTTP/2、同步与异步 API;OpenAI Python SDK 已默认使用 HTTPX2,安装 openai 时自动带入。为什么重要:HTTPX 长期处于低活跃状态却位于大量生产系统关键路径,此次由 Pydantic 接管并承诺及时安全更新,对依赖 OpenAI SDK 或自建 HTTP 客户端的 Python 开发者是重要的供应链稳定性信号。

每天早晨,一份为你精选的科技日报

网页看大盘,订阅拿专属:AI 按你的兴趣为你精选、可汇入你的私有 RSS,附社区观点——每天早晨直达邮箱,永久免费。

已发布 58 期 · 每天筛过 150+ 条只留值得读的 30 条

AI 动态

Agentic Game Development as a Verifiable Trajectory Data Engine for Scaling World Models

论文提出将游戏开发作为可验证轨迹数据引擎,用编译器与运行时为世界模型 RL 后训练提供有根据的奖励信号。

🤖Game engines provide executable verification and long-horizon trajectories for reinforcement learning post-training of spatial world models, motivating a human-engine verification paradigm.

Self-OPD: On-Policy Distillation for Flow Matching Models without Teacher

Self-OPD 提出无教师策略蒸馏框架,用自探索随机分支与归一化优势优化 flow matching 速度场,避免任务专属教师模型的高成本。

🤖Self-OPD eliminates task-specific teachers in flow matching by using self-explored stochastic branches and normalized advantages to optimize the velocity field for multi-objective alignment.

GameWAM: A World Action Model for Video Games

GameWAM 是首个面向原生视频游戏闭环控制的 World-Action Model,用块因果 flow matching 联合预测未来视觉与可执行键鼠动作。

🤖GameWAM is a unified world-action model for native video-game control that jointly predicts future visuals and executable keyboard-mouse actions using block-causal flow matching, mode-specific distributions, and block-cycle replanning.

开发与开源

I accidentally turned LLM memory into program analysis

作者在 LLM 漏洞研究 agent 中意外将记忆机制做成了程序分析:模型在数小时调查中会逐渐丢失已确认的事实,需要结构化记忆来维持推理一致性。

社区热议

Luanti removed from Google Play due to baseless AI copyright notice

Luanti 因 Tracer.AI 代表微软发出的无据 DMCA 通知被 Google Play 下架;评论区普遍认为 DMCA 滥用缺乏惩罚机制,但也有人认为 Luanti 与 Minecraft 高度相似。

评论区普遍认为DMCA滥用和虚假投诉缺乏惩罚机制,导致小项目被无故下架;但也有人认为Luanti确实与Minecraft高度相似,投诉并非完全无据。

U.S. sanctions against the A/I Collective

美国制裁意大利左翼技术组织 A/I Collective,评论区多数认为缺乏实证、涉嫌打压言论自由,少数认为该组织立场激进。

评论区普遍认为美方制裁意大利左翼技术组织缺乏实证,涉嫌打压言论自由,但也有人认为该组织立场激进、行为可疑。

GUIs should be fully keyboard-driven

一篇主张 GUI 应完全支持键盘驱动的文章引发热议,评论区普遍支持键盘操作提升效率与可访问性,但也有人认为不应完全取代鼠标。

评论区普遍支持GUI应支持键盘操作,认为能提升效率与可访问性;但也有人认为键盘驱动不应完全取代鼠标,且需兼顾易用性与学习成本。

“It works better in the app”

用户吐槽 Google 应用强制跳转 App 而网页版功能残缺,评论区普遍反感强制下载,但也有人认为原生 App 体验更佳。

用户普遍反感强制下载App,认为网页版应保留完整功能;但也有人认为原生App体验更佳。

GitHub Trending

A spy satellite simulator in your browser, except the data is real. Live open source spatial intelligence on a photorealistic 3D globe.

tt-a1i/archifyHTML★ 72

Agent skill for beautiful, verifiable architecture, workflow, sequence, data-flow, and lifecycle diagrams—self-contained HTML with motion and crisp export.

Prompt as Code | GPT-Image2 工业级提示词引擎与模板库,470+ 个案例逆向工程,20+ 套工业级模板,并提炼出Skills,持续更新中

stablyai/orcaTypeScript★ 35

Orca is the ADE for working with a fleet of parallel agents. Run any coding agent with your own subscription. Available on desktop and mobile.

更多值得一看(内容池 46 条)
I reverse-engineered an NPU vendor's engine format (int8 weights stored as two nibble planes) to run GGUFs with no model conversion — now 1.5× faster than the vendor's own runtime

I've been running Qwen3-0.6B on the M5Stack LLM-8850 card (Axera AX8850 NPU, 24 TOPS, 8GB LPDDR4x) hosted by a Raspberry Pi 5 — as a llama.cpp backend. The problem: the vendor stack requires converting every model through their compiler, and their closed runtime gets 13.5–14.5 t/s. I wanted llama.cpp to just work: GGUF in, tokens out. What I ended up doing: Reverse-engineered the engine format. The vendor's compiled engines (.axmodel) store weights in a blob called npu_params. I decoded it: int8

open source caught up because it's open

Proof is in the method honestly. Closed model labs need to constantly reinvent the wheel to keep lead. Open source has a bunch of independent labs practically working somewhat together. Eventually when everyone is just releasing weights and papers on how they did it the closed source secrets just get overrun by having plenty of very good secret sauces to the public. That and NO DOUBT chinese labs are sharing internal secrets amongst each which explains how when any of them makes a big jump the o

Ninfer and a 5090 with 3.8 27B is making me cry tears of joy it's so good.

Built the latest and I'm getting as much as 220 tokens per second and averaging in the 170s, I can't get over it. If anyone on here is on that project, fuckkkin' chapeau man, really incredible job. I can't believe I was able to like double or more my throughput from llama.cpp This is what I set up: command: > ninfer-serve /models/qwen3_8_27b_nvfp4.ninfer --model-id qwen3.8-27b-nvfp4 --host 0.0.0.0 --max-context 240000 --kv-capacity 240000 --max-concurrency 2 --kv-dtype fp8 --host-kv-mib 16384 --

Qwen3.8-Flash on RTX3090 + 64GB RAM (but you only need 12GB VRAM)

I've got Qwen3.8-Flash-next running on RTX 3090, Ryzen 9 3950X, a PCIe 3.0 motherboard, and 64GB DDR RAM from 2020. IQ4_XS weights, full kvarn5 context, vision on GPU, experts in host RAM, n-grams on disk. MTP works but actually slows decode down even with 80% draft acceptance, as expected since every rejected token eats into the host RAM bandwidth. I get 160 tok/s prefill 16 tok/s decode , which makes it a decent option whenever I know I'll be AFK for at least a couple of hours, but not usable

Trump’s EPA wants to let data centers hide their air pollution

Just as new data centers face growing backlash from neighboring communities, the US Environmental Protection Agency (EPA) is about to make it harder for people to weigh in on any pollution those centers create. The EPA plans to toss out a federal rule requiring public notice and an opportunity to comment when certain industrial sites […]

Micron: HBM Requires Three Times More Wafer Area Than DDR5

"At Hot Chips 2026, Micron drew a notable comparison: For the same memory capacity, HBM requires approximately three times the wafer area of DDR5." "When asked whether this ratio would improve with newer generations, the Micron Fellow reportedly explained that it definitely would not get better." "According to the data shown at Hot Chips, an HBM4 die, for example, operates with 256 memory banks, while DDR5 is specified with 32. Additional data paths, the power supply, and the Through-Silicon Via

Pangolin 1.22: AI Gateway for self-hosted models + Community Edition updates

Hello everyone! Pangolin 1.22 introduces a new resource type: AI Gateway. These resources are identity-aware proxies in front of both cloud model APIs and self-hosted model servers, so coding agents and AI clients call a Pangolin URL. A gateway resource can be keyless by authenticating via the Pangolin client or keyed by minting virtual API keys. We're also moving SSH, RDP, VNC, and private HTTPS resources from Enterprise to Community Edition. Pangolin is an open-source, identity-aware remote ac

Zero-WAM: In-Context World-Action Modeling from Human Videos for Open-Ended Task Generalization

Zero-shot cross-task generalization, where a policy must execute manipulation tasks never seen during training, remains a central challenge in robot learning. In large language models, a novel task can be performed simply by specifying it in the context, without any parameter update. This form of in-context learning (ICL) turns generalization into a problem of task specification. To achieve cross-task generalization, we bring this paradigm to robotic manipulation, and argue that the natural task

Standalone LLM and a Pre-specified Agentic Pipeline for Explaining ICU Mortality Predictions: a Feasibility Study on the eICU Demo Dataset

arXiv:2608.26109v1 Announce Type: new Abstract: Machine-learning models can predict ICU mortality accurately, but feature-attribution methods alone rarely provide the clinical narrative needed for bedside use. Large language models (LLMs) may bridge this gap, and multi-step agentic pipelines are a plausible extension because they separate data interpretation, guideline checking, and final explanation. This revised feasibility study preserves the original standalone-versus-agentic comparison whil

Anyone using NixOS to selfhost?

Got a desktop and notebook running NixOS. Now I want to get a beefy NAS and run immich, jellyfin, home assistant, some file shares, vaultwarden and papra on it. My plan is to run NixOS on it because i know it and can restore a PC in a few minutes. The named services do exist on NixOS and that’s how I plan to use them. No docker, no Proxmox. Anyone tried it? Anything I need to know? Objections?

Google further buries search results under AI mode

Google is now automatically expanding its AI search summaries at the top of the results page for some searches, as reported by Search Engine Roundtable. The change, when it kicks in, pushes the typical list of links from a search much farther down Google's results page; instead of seeing part of an AI Overview with […]

DLSS 5 leaked and modders are putting Nvidia’s AI effects on everything

Modders are trying out an unofficial version of Nvidia's DLSS 5 on Skyrim, Cyberpunk 2077, GTA V, and a bunch of other games after code for the AI upscaling tech appeared in an early-access build of NBA 2K27. Members of the RenoDX modding channel on Discord reportedly found a way to extract the DLSS "Neural […]

PICasso: An AI-Enabled Design Framework for Autonomous Optimization of Silicon Photonic Devices

arXiv:2608.26113v1 Announce Type: new Abstract: We present PICasso, an AI-assisted framework for automated synthesis, verification, and optimization of photonic integrated circuits (PICs) from natural-language specifications. PICasso couples a structured NL -> YAML -> GDS generation pipeline with PDK aware knowledge injection, automated placement and routing, DRC/LVS validation, and SAX-based photonic simulation. To systematically evaluate AI-driven photonic design, we introduce PIC-Set, a bench

RevalvoProduct Hunt1 min开发工具AI

Run prompts on every model at once. Score. Version. Ship. Discussion | Link

EduRiskX: A Neuro-Symbolic Framework with F-Logic Reasoning for Early Academic Risk Prediction

arXiv:2608.26107v1 Announce Type: new Abstract: Predicting students' academic risk in online education is crucial for enabling timely interventions that can improve retention and learning outcomes. However, existing models often suffer from limited early detection capability and insufficient interpretability, leading to a "black-box" trust crisis that hinders their adoption in real-world pedagogical settings. To address these challenges, we propose EduRiskX, a neuro-symbolic framework that integ

每天早晨,一份为你精选的科技日报