Work with AI, better.
This week in AI
What changed and what it changes for you — triaged, not dumped.
ZCode Uploaded Whole Workspaces, Git History Included, to Z.ai's Cloud. Z.ai Says It's Fixed. Rotate Your Secrets Anyway
A researcher's reverse engineering of ZCode 3.12.3, published 18 September, showed it packing entire workspaces, full .git history included, and uploading them encrypted to Aliyun OSS with no working off switch. Z.ai says the issue is fixed, and later builds show no upload code. Data already uploaded can't be recalled, so rotate anything ever committed.
DeepSeek Harness Let a Sandboxed Agent Switch Off Its Own Sandbox. Check Your Version, Including Inside Desktop Wrappers
CVE-2026-82533 (CVSS v4 9.4) let an agent in DeepSeek Harness 0.1.1-rc.2 or earlier call the harness's unauthenticated local API and set its own session to danger-full-access, approval prompts off. The first fixed npm release is 0.1.2-alpha.2. DeepSeek published no advisory, and third-party desktop wrappers pin their own copies.
Security
Infostealers Are Draining Claude Accounts, Anthropic Warns
Anthropic warned Claude users that infostealer malware is stealing sessions and spending usage. With no itemized usage, theft could go unnoticed for months.
Security
GPT-Image-2.5 Flare and Sunburst: GPT-Image-2 Rates, No Batch API
OpenAI launched ChatGPT Images 2.5 on September 8, 2026 with two API models, GPT-Image-2.5 Flare and Sunburst, listed at GPT-Image-2's standard token rates.
Product Launches
The week, in one issue
What changed and how it changes our recommendations — including what we filtered out.
The Default Is the Hole: LiteLLM's Example Key, GitSpawn's Git Config and GPT-Live-1's Voice-Only $0.05
What you inherit by default was this week's risk: 294 of the 3,074 public LiteLLM gateways Wiz scanned still accepted the docs' example master key, and a received repo's own .git/config can make unpatched coding agents run attacker commands outside their sandbox. The prices had the same gap, because GPT-Live-1's $0.05 a minute covers only the voice session and the Agents API's missing platform fee still leaves you paying for every token and tool.
From the blog
The reasoning behind the verdicts, long-form.
Typeform Alternatives That Are Not Just Cheaper Typeforms
Eight Typeform alternatives sorted by the reason you are leaving, not by vendor preference. Verified pricing, standing verdicts, and the response cap that sends most people looking.
Sep 7, 2026
AI Intake Software Compared: What the Term Means and What to Buy
Search AI intake software and you get two unrelated markets in one result page. Here is the split, the four things AI can actually do to intake, and verified pricing on the tools that do it.
Sep 7, 2026
Best Conversational Form Builders in 2026: 9 Tools With Verdicts
Nine conversational form builders, each carrying a standing verdict from our directory. Verified pricing, the three products hiding behind one label, and which one wins each job.
Sep 7, 2026
Never need to catch up again
The weekly delta — only verdict changes and act-now items. No digest filler.
What do you need to do?
Start here. Pick a task and we'll point you to the right resource.
Our tools
We built these because nothing else solved the problem.
Gnosari
Gnosari is a conversational data collection platform: it replaces forms with conversations. Feedback, details, contacts, anything you need to gather, you say what you want to collect and the agent drives the conversation.
"We built it because forms lose most of the people who reach a page."
ConvOps
ConvOps is the workflow engine for autonomous AI systems: describe a process once from the AI client you already use, and your agents run it as a governed workflow, step by step, run after run.
"We built it to run Neomanex itself."
NeoReader
NeoReader is a web-to-markdown API with discovery built in: point it at a URL or a whole site and get back clean, LLM-ready markdown, tuned end to end for high-throughput ingestion.
"We built it because feeding raw web pages to a model wastes tokens and drags in boilerplate."
This site updates itself
Every changelog entry, model comparison, and tool listing is maintained by the same AI pipelines we build for our clients. No manual updates, no stale data.