AI News — June 24, 2026

$ cat top-story.md

▸ OpenAI Launches GPT-5.5-Cyber and "Patch the Planet" to Fix Open-Source at Scale

OpenAI released GPT-5.5-Cyber — a specialized model for automated vulnerability detection and patch generation, scoring 85.6% on CyberGym (best single-model score to date). Paired with the "Patch the Planet" initiative co-led with Trail of Bits and HackerOne, it is actively remediating bugs in 30+ open-source projects including cURL, Python, Go, and Sigstore; every AI-generated finding is reviewed by a human engineer before submission to maintainers. Why it matters: This is the first large-scale, AI-driven, expert-reviewed pipeline specifically aimed at fixing open-source security debt — and it's already merged dozens of patches across 19 projects in its first week. // OpenAI / MLQ.ai

▸ Gemini 3.5 Pro Still Missing Its June Launch Window

Google's Gemini 3.5 Pro — promised at Google I/O in May with a 2M-token context window, Deep Think reasoning, and frontier multimodal capabilities — remains stuck in limited Vertex preview. Prediction markets put the odds of a public release by June 30 at just 50–55%. Why it matters: If it ships this week it would be the most capable Google model yet; if it slips further, it signals real engineering friction at DeepMind that the public I/O pitch didn't show. // Swisher Post

▸ calesthio/OpenMontage — Open-Source Agentic Video Production System (+3,592 stars today)

OpenMontage is the first open-source AI-driven video production platform that orchestrates the entire workflow — research, scripting, asset creation, editing, and composition — through 12 production pipelines and 52 integrated tools. Uniquely, it can assemble real footage from Archive.org, NASA, and Wikimedia Commons rather than relying solely on AI-generated visuals, and accepts any YouTube/TikTok URL as a reference style template. Why it matters: Unlike typical text-to-video demos, this gives you a fully auditable, budget-controlled pipeline you can run self-hosted — directly relevant if you're already running vLLM or OpenWebUI. // GitHub

▸ bytedance/deer-flow — ByteDance's Open-Source SuperAgent Harness (74k stars, +739 today)

DeerFlow is a LangGraph-based SuperAgent harness that spawns sub-agents with their own scoped context, tools, and sandboxed execution environments to handle tasks that take minutes to hours — research, code generation, slide decks, image/video creation. Sub-agents run in parallel and report structured results back to the lead orchestrator. Why it matters: It's a production-grade, MIT-licensed alternative to building your own multi-agent scaffolding from scratch, with sandbox isolation already wired up — a practical starting point for your own RAG pipeline agents. // GitHub

▸ Enterprise-Managed Authorization for MCP Goes Stable — Zero-Touch Okta SSO

Anthropic shipped Enterprise-Managed Authorization (EMA) for MCP connectors on June 18: IT admins provision any of seven supported connectors (Asana, Atlassian, Canva, Figma, Granola, Linear, Supabase) once through Okta, and employees inherit access automatically on their first login — no extra OAuth screens, no per-user setup. The JWT-based auth flow works across Claude Chat, Claude Code, and Cowork. Why it matters: This removes the last friction point in enterprise MCP adoption and makes Claude Code integrations a one-click deploy for IT — expect your org's MCP connector count to jump quickly. // Model Context Protocol Blog

▸ RAGFlow Adds Multi-Channel Integrations: Discord, Telegram, Feishu, Line

RAGFlow — the 78k-star open-source deep-document RAG engine — added native chat-channel connectors in its June 15 update, letting you surface RAG answers directly in Discord, Telegram, Feishu, and Line without any extra middleware. The same update includes lazy loading for large PDFs and RESTful API unification. DeepSeek v4 is fully supported as an inference backend. Why it matters: If your RAG pipeline runs on vLLM with a Python ingestion script, RAGFlow can act as the conversational frontend layer across messaging platforms without requiring a custom bot. // GitHub

▸ Google Research: RAG Hallucinations Caused by Insufficient Context, Not Model Limits

New research from Google shows that the primary driver of hallucinations in RAG systems is retrieved context that doesn't actually contain the answer — not the model's inherent limitations. Selective generation (having the model abstain when context is insufficient) dramatically reduces factual errors without degrading answer quality on retrievable questions. Why it matters: If your RAG pipeline is producing hallucinations, the fix is almost certainly in your retrieval quality and chunking strategy, not model choice — a concrete re-prioritization for your vLLM + Qdrant stack. // Google Research Blog

▸ "Vibe Coding Is Dead — Karpathy's New Rule for Building With AI" (June 23, 2026)

From Sequoia's AI Ascent 2026 conference, Karpathy lays out why "vibe coding" — giving an agent broad goals and hoping for the best — is being replaced by structured agentic engineering with tight feedback loops, explicit specs, and human checkpoints at each decision boundary. Why it matters: This is the clearest statement yet from Karpathy on how to think about Claude Code and agent-driven development as a repeatable practice rather than an art. // YouTube

▸ Simon Willison: Prompt Injection as Role Confusion

New research (Ye, Cui, Hadfield-Menell) shows that LLMs distinguish trusted system text from untrusted user input by its visual formatting, not its content or role tags. Simply reformatting ("destyling") injection payloads to match system-prompt typography dropped attack success rates from 61% to 10%. Why it matters: Any agent you build on top of vLLM or Claude Code is vulnerable to style-aware prompt injection; understanding this drives you toward explicit trust boundaries and input sanitization at the retrieval layer. // simonwillison.net

▸ Simon Willison: Porting a 0.2B Image Inpainting Model to the Browser with Claude Code

Willison used Claude Code as a hands-off agent to convert the Moebius inpainting model from PyTorch/CUDA to WebGPU — it autonomously handled ONNX conversion, published ~1.3 GB of weights to Hugging Face, built the web interface, and deployed to GitHub Pages, with Willison only providing direction and testing feedback. The result runs entirely client-side with no server. Why it matters: A concrete, documented case of Claude Code as a multi-step autonomous agent on a real ML engineering task — useful reference if you're considering offloading parts of your RAG pipeline build to it. // simonwillison.net