Hugging Face

Coinbase CEO Brian Armstrong outlined a strategy to maintain flat costs while increasing token usage by routing prompts to cheaper AI models. He predicts 80% of workloads will shift to 99% cheaper models within 12-18 months, with high-end models reserved for specialized tasks. Tech figures like Marc Andreessen and Hugging Face's Julien Chaumond acknowledged the growing importance of model routing and efficiency.

Hugging Face has released a $2,500 humanoid robot leg project with 3D-printable parts and open-source tools to facilitate AI robotics research. The LeRobot Humanoid provides affordable hardware and software for testing AI algorithms in real-world experiments, emphasizing accessibility for researchers and builders.

Lance is a research project that combines image and video generation and understanding in one model, with 3 billion active parameters. The model was trained using fewer than 128 GPUs. The project has a homepage, paper, and model links available.

Semble is an open-sourced code search tool that uses 98% fewer tokens than grep and reaches 99% of the retrieval quality of a 137M-parameter code-trained transformer. It combines static Model2Vec embeddings with BM25 and code-aware signals, running on CPU without transformers. Semble is designed to solve the problem of inefficient code searching in large codebases.

A fake OpenAI repository impersonating the Privacy Filter model gained 244,000 downloads in under 18 hours before being removed by Hugging Face. The repository stole passwords while it was trending. It reached the #1 spot on Hugging Face.

Cactus open-sourced Needle, a 26M parameter model for tool calling on consumer devices, which achieves high performance and efficiency. The model was trained on 200B tokens and can be fine-tuned on Mac/PC. Needle outperforms other models in single-shot function calling.

Hugging Face AI models can be manipulated by tweaking a single file in the tokenizer library, allowing hijacking of model outputs and exfiltration of data. This vulnerability poses a significant risk to users of Hugging Face models. The manipulation can be done by modifying a single file.

A malicious Hugging Face repository impersonated OpenAI's Privacy Filter to deliver a Rust-based information stealer to Windows users, reaching 244K downloads. The project masqueraded as its legitimate counterpart released by OpenAI. It took a spot in the platform's trending list.

A malicious repository on Hugging Face impersonated OpenAI's Privacy Filter project to deliver information-stealing malware to Windows users. The fake repository reached the platform's trending list and targeted Windows users with infostealer malware. This incident highlights a security risk for users of the Hugging Face platform.

The author generated 1,000,000 transaction graph visualizations from real Ethereum, Arbitrum, and Polygon data and is training a Vision-Language model to detect DeFi attacks. The dataset is open and available under an MIT license. The goal is to create a model that can identify attack patterns in transaction graphs.

A data science enthusiast is seeking affordable historical trade data for Pump.fun and PumpSwap, specifically looking for decoded trade instructions and post-graduation trades. The individual has tried various sources, including BigQuery and public RPCs, but found them to be expensive or rate-limited. They are now reaching out to the community for help.

A developer fine-tuned a Vision-Language Model on AMD MI300X to protect AI agents from being drained, developing a security layer called ArcWarden & Imina Na. The model uses transaction patterns to detect potential threats. It is now available for testing and feedback on Hugging Face.

A critical unpatched vulnerability (CVE-2026-25874) in Hugging Face's LeRobot allows unauthenticated remote code execution, posing a significant security risk. The flaw, rated CVSS 9.3, stems from untrusted data deserialization in the open-source robotics platform.

An open-source agent developed by the author achieved a 65.2% score on TerminalBench, outperforming Google's 47.8% and Junie CLI's 64.3%. The author emphasizes no cheating mechanisms were used and highlights issues with the leaderboard maintainers' response time.

DeepSeek AI has released DeepSeek-V4, an AI model optimized for efficient processing of million-token contexts. The article is hosted on Hugging Face and has garnered attention on Hacker News with 99 points and 8 comments.

Hackers are exploiting a critical vulnerability in the Marimo reactive Python notebook to deploy a new variant of NKAbuse malware, which is hosted on Hugging Face Spaces. This security flaw allows malicious actors to distribute malware through a popular machine learning platform.