Open-Source AI

Today's Stories

1. 1

   OpenAI shares Hugging Face incident findings

   OpenAI shared findings from a security incident involving Hugging Face and outlined steps to strengthen AI model security, monitoring, and alignment. The incident highlights risks in AI model sharing and the need for robust security measures, which is critical for businesses relying on AI tools.

   OpenAI's ongoing efforts to improve model security and monitoring, which could set new standards for the industry.

2. 2

   AMD, Supermicro and MinIO tackle enterprise data pipeline bottleneck

   AMD, Supermicro, and MinIO discussed how to address the enterprise data pipeline problem in an interview at the Supermicro Open Storage Summit. They highlighted that more than 80% of enterprise data is unstructured, and 99% of it is dark to AI. Modern AI systems need consistent, governed access to data, but fragmentation and interoperability issues hinder that. The companies argue that the storage layer is key to keeping GPUs productively fed and that open standards like Apache Iceberg enable scalable, vendor-neutral data lakes.

   MinIO's AIStor platform now natively supports Apache Iceberg tables and the Iceberg REST Catalog, enabling full database functionality up to exabyte scale. Supermicro pre-validates its AMD EPYC-based systems to ensure they are ready to deploy.

3. 3

   Linux Foundation welcomes TRACE for AI runtime evidence

   The Linux Foundation announced the contribution of TRACE (Trust, Runtime Attestation and Compliance Evidence), a new open specification from OPAQUE, on Aug. 25, 2026. It was developed collaboratively by AMD, Intel, Microsoft, OPAQUE and the Technology Innovation Institute (TII). TRACE creates a standardized, hardware-enforced governance record that binds runtime environment, software, policies, data classifications and tool usage into a portable, cryptographically verifiable artifact. It helps organizations prove sensitive data is handled according to policy as they deploy increasingly autonomous AI agents and open-weight models.

   The Linux Foundation will provide vendor-neutral governance for TRACE to support sustainability and long-term growth. The initial specification focuses on today's AI agent architectures while providing a foundation for future multi-agent and confidential computing deployments.

4. 4

   LLM Agent Skills Leak Credentials, Study Finds

   A large-scale study of 17,022 skills from SkillsMP, the largest open-source skill marketplace, found 520 affected skills with 1,708 security issues related to credential leakage. The study identifies 10 leakage patterns, with debug logging accounting for 73.5% of vulnerabilities because agent frameworks feed standard output into the LLM context window, turning routine debugging into a credential exposure vector. Notably, 89.6% of leaked credentials are immediately exploitable.

   The fork-based distribution model defeats remediation, as secrets removed from 107 upstream repositories persist across 50+ independent forks. Following responsible disclosure, all malicious skills have been removed and 91.6% of hardcoded cases were remediated.

5. 5

   Open-source Codex Micro clone built for $35 by AI scientist

   Iluvatar Labs used its autonomous scientist Marvin to design AgentPad13, an open-source version of the $230 Codex Micro, for around $35 per fully populated board. The project achieved zero unrouted connections and zero design-rule violations within a weekend. Existing tools like KiCad/FreeRouting and Quilter plateaued at roughly 95% completion, leaving 18-19 of 353 connections unfinished and making unacceptable compromises. Marvin treated routing as a research problem, learning from literature and running iterative experiments, which enabled a complete route within the board's 2-layer and 100mm constraints.

   The routing skill Marvin developed is planned to be released as an open-source package. AgentPad13's PCB, case, firmware, and build instructions are available on GitHub with a configurator for customization. A known hardware mistake with two underglow LEDs pointing outward has been corrected in the next revision.

6. 6

   AWS SageMaker SDK v3 streamlines bring-your-own-model

   AWS announced a redesigned SageMaker Python SDK v3 that replaces framework-specific estimator classes with a single ModelTrainer for training and ModelBuilder for deployment. It introduces a SourceCode object that syncs your local code into a container at runtime, so you no longer need to build or maintain Docker images for each algorithm. This cuts iteration time—you can change your training script and rerun without rebuilding a container. It also gives full control over the container environment, such as installing system packages or CUDA libraries, and offers one identical API across frameworks like scikit-learn, PyTorch, and even custom C++ inference binaries.

   The post includes two end-to-end examples: training a scikit-learn Random Forest on the diabetes dataset and deploying it with DJL Serving, and fine-tuning Stable Diffusion 3.5 with LoRA using Hugging Face Accelerate. You can use any container image from Amazon ECR, including your own, an AWS Deep Learning Container, or a third-party image.