THE 60-SECOND VERSION
● CVE-2025-62593 in Ray — CVSS 9.4, actively exploited, patched in 2.52.0. The target is a developer workstation, not a server.
● The detail that stings: a botnet started exploiting it two days before the CVE was published.
● Anthropic published lab-validated protein design results at 22 to 35 percent success against a 10 to 15 percent industry baseline.
● A new benchmark found frontier models recover research paper ideas from bibliographies alone at 3 to 15 percent.
● 9 days left on Claude Sonnet 5 at 2 dollars per million input.
Patch Ray today if you have not
CISA added CVE-2025-62593 to its Known Exploited Vulnerabilities catalog on 17 August, changing its assessment from proof-of-concept to active exploitation. Federal civilian agencies had until 20 August to remediate — a three-day window, which is unusually short.
Ray is the Python-native distributed computing framework used to scale AI and ML workloads, with over 43,500 GitHub stars. Amazon, Apple and OpenAI all use it. The flaw carries a CVSS 4.0 score of 9.4 and affects every version before 2.52.0.
WHY THIS ONE IS DIFFERENT
Most critical CVEs threaten servers. This one threatens the machine you are reading this on, if it is running Ray. The attack path is a developer visiting a malicious page — or seeing a malicious advert — in Firefox or Safari while Ray runs locally.
Ray's own maintainers were blunt about the cause: a longstanding decision not to implement authentication on critical endpoints.
The timeline detail worth sitting with: Bitsight reported that the RondoDox botnet began attempting to exploit this on 24 November 2025 — two days before the CVE was published. The operators were tracking public vulnerability research rather than waiting for a formal advisory.
Full breakdown, including where to look for Ray beyond the obvious places, here.
Anthropic published protein results a lab actually verified
Anthropic released results from work validated by Adaptyv Bio and Twist Bioscience. Claude models designed protein binders that succeeded against 14 of 15 tested targets, at a 22 to 35 percent success rate against a typical industry rate of 10 to 15 percent.
Separately, Opus 5 processed raw NMR and LC-MS instrument data in 23 and 19 minutes respectively, with purity readings within 0.1 percent of the lab's own analysis.
Two things make this different from the usual capability announcement. The results were validated in a wet lab by third parties rather than scored on a benchmark. And Anthropic notes that life-science tasks remain restricted in its most capable models — publishing a strong result while keeping the capability gated is an unusual combination, and worth noting given the company raised its own misalignment rating last week.
And a benchmark that says the ceiling is lower than it looks
A new scientific-reasoning benchmark called Reconstruction, published this month, asked frontier models to recover a research paper's core ideas from its bibliography alone. Scores landed at 3 to 15 percent. A multi-agent pipeline running a Swiss-tournament selection across four models reached 42 percent.
The design is the interesting part. It strips out the full paper text, author information and any post-publication signal — everything a model could have memorised. What remains is whether it can generate the hypothesis from the same starting point a researcher had.
Read alongside the Anthropic results, these two findings are not in conflict. They measure different things, and the gap between them is the most useful thing published about AI-in-science this month. We took both apart separately.
Deadlines still running
| Date |
What happens |
| Aug 31 |
Claude Sonnet 5 moves 2 to 3 dollars per million input, plus a tokenizer change adding 10 to 35 percent tokens on code |
| Aug 31 |
kimi-k2.5 and moonshot-v1 sunset, migrate to kimi-k3 |
| Early-mid Sept |
Grok 4.7 window per Musk. No model ID at docs.x.ai yet |
| Oct 1 |
OpenAI vs Apple hearing |
| Oct 24 |
deepseek-chat and deepseek-reasoner deprecated |
What we are watching next
Whether anyone measures how many Ray installations are still unpatched a week from now. KEV deadlines bind federal agencies; everyone else patches or does not. Ray sits in CI runners, container base images and Kubernetes workloads where nobody thinks to look, and the botnet operators have had a nine-month head start.
FAQ
Am I affected by the Ray vulnerability?
If you run Ray below version 2.52.0 anywhere — laptop, CI runner, container image, Kubernetes cluster — yes. Upgrade to 2.52.0 or later. If you cannot patch immediately, do not expose Ray dashboards or APIs to untrusted networks.
Why is a developer laptop the target?
The attack works through a browser. Visiting a malicious page in Firefox or Safari while Ray runs locally can result in code execution against that local instance, via DNS rebinding. No login required.
Did Anthropic prove AI can do biology?
It published third-party wet-lab-validated results on protein binder design at 22 to 35 percent success against a 10 to 15 percent industry baseline. That is a real result in one narrow task, not a general claim about biology.
What is the Reconstruction benchmark?
A scientific-reasoning test published in August 2026 that asks models to recover a paper's ideas from its bibliography alone, with full text, author data and post-publication signals removed. Frontier models scored 3 to 15 percent; a four-model tournament pipeline reached 42 percent.
Do those two results contradict each other?
No. One measures execution on a well-defined design task with lab verification. The other measures originating a hypothesis with retrieval stripped out. Models are currently much better at the first than the second.