Academic Paper Becomes Paid "Free" Access
Also, Junior Hacker Opens Four Corporate Doors

THE ADMINISTRATIVE FEE TO SEE THE TRUTH

The Association for Computing Machinery (ACM) announced its plan to transition all publications to a fully Open Access model starting January 1, 2026. This move is being framed as a massive victory for the global computing community, which is true in the sense that everyone can now access the files; however, the cost of the key has merely been transferred. The ACM is shifting from a Pay-to-Read subscription model to a Pay-to-Publish model, which means that authors must now contend with an Article Processing Charge, or APC, if their institution has not paid the new fee.

Approximately 75% of papers will be covered by the existing ACM Open institutional agreements. For the remaining poor souls trying to share their work, you get a special, subsidized APC of $250 for members to distribute their content for free, which is funded by the ACM Council to ease the 2026 transition. The official statement suggests that authors should "advocate" for their institutions to join the ACM Open program, which is administrative code for "please handle the change management and budget negotiation on our behalf." It is the circle of academic life.

MINTLIFY: THE DOCUMENTATION THAT POWNED X

Several high-profile organizations, including **X**, **Vercel**, **Cursor**, and **Discord**, had a mild security mishap after a critical vulnerability was found in the AI documentation platform Mintlify. The vulnerability, a critical cross-site scripting (XSS) flaw, was located and responsibly disclosed by a high school senior known online as **Daniel** (hackermondev).

The core of the organizational problem is that a single exploited link on a documentation page, hosted on the companies' primary domains, was enough to allow attackers to inject malicious code and steal user credentials and session tokens. Discord paid $4,000 for the bug, which seems like a reasonable lunch budget for preventing the complete session takeover of an entire platform. The fact that the most advanced companies in the world are being compromised because they relied on a third-party tool to keep their **README** files in order is the most predictable plot twist of the year.

WE GOT A NEW JUNIOR DEVELOPER: GPT-5.2-CODEX

OpenAI has rolled out yet another incremental patch to its product line, introducing GPT-5.2-Codex, which is now marketed as the "most advanced agentic coding model" for professional software engineering. This model is essentially the previous version but with minor performance improvements on large code refactors and better long-horizon work because it features "native compaction." It is the corporate equivalent of giving the new hire a faster laptop and telling him to stop making so many small Git commits.

The release emphasizes its "significantly stronger cybersecurity capabilities." Earlier models were already being used by security researcher Andrew MacPherson to responsibly disclose vulnerabilities in massive codebases like React. The new 5.2 model achieves state-of-the-art results on the SWE-Bench Pro and Terminal-Bench 2.0 metrics, which is great for the marketing slide, but one report suggests that AI helps ship code faster while producing 1.7× more bugs than a human, which means we now have the fastest way to get to a production outage in company history.

Briefs

• Fiscal Responsibility: An "AI vending machine" was easily tricked into giving away everything to a group of teenagers. This is why we have a mandatory two-snack limit in the server room and why our vending machine is just a guy named Gary.
• VRAM Overkill: A report details how to get 1.5 TB of VRAM on a Mac Studio using RDMA over Thunderbolt 5. This will allow one developer to render one frame of their personal 3D passion project at an uncomfortably high resolution, while the rest of the team continues to use integrated graphics.
• Firefox Resists: Mozilla's Firefox team is adding an option to disable all AI features. A true testament to the company’s dedication to user choice, or just the fact that it realizes no one wants their browser hallucinating a new tab.