BadHost Vulnerability Exposes AI Agents, Evaluators, and LLM Gateways
BadHost is a high-severity authentication bypass vulnerability in the widely used Python web framework Starlette, with 325 million weekly downloads. The flaw allows attackers to use malformed HTTP Host headers to bypass path-based access controls and access sensitive AI agent infrastructure, among other systems.
Gemma 4 12B Enables On-Device, Multimodal Agentic Workflows with an Encoder-free Architecture
Google says Gemma 4 12B is “designed to bring agentic, multimodal intelligence directly to your laptop”, further noting that the new model can be combined with Google AI Edge to “build and experiment locally, on everyday machines”. This integration allows for a wide range of capabilities, from autonomous data processing to generating visual insights and even building webpages or executing tools.
Microsoft Open-Sources PostgreSQL Extension for In-Database Durable Execution
Recently open-sourced by Microsoft, pg_durable is a PostgreSQL extension that enables durable workflows to run natively inside the database, eliminating the need for external orchestration systems.
Google OpenRL is an Experimental Self-hosted API for LLM Post-Training Fine-tuning
Google’s GKE Labs has introduced OpenRL, an open-source project that provides a self-hosted API for post-training and fine-tuning Large Language Models (LLMs) on standard Kubernetes clusters.