View Ridge Security
Back to The Rollout

Report alleges ZCode uploads users' Git histories to the cloud

A security report flags ZCode for silently uploading workspaces, while Flyweight open-sources a single-GPU MoE runtime and Laya debuts for Jev-style decisions.

πŸš€ RELEASES & LAUNCHES

  • Open-source Laya model brings Jev-style decisions to a 421M-parameter model
    Convai Innovations released Laya, a 421M-parameter open model for fast typed-schema decisions.

    • Developers building intent routing, fact-checking, moderation, and other typed-decision systems.
    • Laya uses a bidirectional ModernBERT-large encoder and Transformer head to score option markers non-autoregressively.
    • The model was trained on more than 25,000 human-annotated examples using a single RTX 6000 Pro with 96 GB of VRAM.
    • Laya resolves typed schemas in a single forward pass of about 35 ms and is available through a Hugging Face demo.
    • The project reports surpassing all Jev benchmarks, giving builders an open alternative for Jev-style decision APIs.
    Sources πŸ“„ Source: huggingface.co Β· πŸ“Ž Coverage: reddit.com Β· πŸ‘ via r/LocalLLaMA (+2)
  • Flyweight open-sources CUDA runtime for MoE models larger than GPU VRAM
    Flyweight released an open-source runtime for running oversized MoE models on one NVIDIA GPU and system RAM.

    • For local-model users with one NVIDIA GPU and substantial system RAM.
    • Flyweight ships a native C++/CUDA runtime for GGUF and safetensors models, with OpenAI- and Anthropic-compatible APIs and a bundled chat UI.
    • The engine offloads routed MoE experts to CPU memory or caches hot experts on the GPU, sizing the memory layout at startup.
    • PyPI wheels are available for Linux x86-64 and Windows x64 as flyweight-llm.
    • The runtime enables single-GPU inference for MoE checkpoints that exceed available VRAM.
    Sources πŸ“„ Source: github.com Β· πŸ“Ž Coverage: reddit.com Β· πŸ‘ via r/LocalLLaMA

πŸ”¬ RESEARCH

  • TACLS uses satellite data and machine learning to improve flash-flood alerts
    TACLS combines satellite data and machine learning to help meteorologists issue flash-flood warnings sooner.
    • Built for National Weather Service meteorologists and emergency responders.
    • The Transient Artifact and Continuous Learning System uses satellite data and machine learning to identify areas that could flood.
    • TACLS is intended to give the NWS more time to issue life-saving alerts; the agency has 122 weather forecast offices across the US and its territories.
    Sources πŸ“Ž Coverage: theverge.com Β· πŸ‘ via The Verge AI

⚠️ INCIDENTS & SAFETY

  • Report alleges ZCode uploads users’ Git histories to the cloud
    A reverse-engineering report alleges that logged-in ZCode users’ workspaces are silently uploaded to Aliyun OSS.
    • The report concerns logged-in ZCode users, including developers working on private or commercial repositories.
    • ZCode allegedly packages workspaces with Git history, LFS caches, reflogs and app configurations before uploading encrypted snapshots to Aliyun OSS.
    • One captured snapshot was 313 MB encrypted from a 345 MB workspace; the repository’s .git directory made up 86.6% of the payload.
    • The report says UI settings do not disable snapshot capture or upload, which could expose deleted secrets, unpushed branches and internal repository metadata.
    Sources πŸ“Ž Coverage: blog.ferstar.org Β· πŸ‘ via r/LocalLLaMA

Make AI adoption safer

Build practical guardrails around the AI tools your team already uses.

Explore Secure AI Adoption