OpenAI officially released GPT-6 Astra on September 4, 2026, making the flagship system available for API integration through multiple cloud providers with a 1,050,000-token context window and support for up to 128,000 completion tokens. The model is priced at $10.00 per million
01
02
03
04
05Everything else across the desks, newest first.
Researchers from Tencent, NTU, NUS and A*STAR released GameDirector code, Apache-2.0 checkpoints and training data on October 11, 2026, decoupling rule-based gameplay logic from a Wan2.2 world-model renderer.
CVE-2026-108859 shows that mark3labs/mcp-go through 1.2.1 reads unbounded Streamable HTTP POST bodies with io.ReadAll before validation, letting unauthenticated callers OOM the server. No fixed release is named.
OpenBMB released Trident-Qwen3VL-2B on October 12, 2026, a MIT-licensed multimodal embedder fine-tuned from Qwen3-VL-2B-Instruct that ranks text-only, image-only and fused documents together while targeting modality preference.
CVE-2026-107295 let any website a developer visited trigger agent runs and tool calls through the Pydantic AI development web chat UI, even when it was bound to localhost. Fixes shipped in pydantic-ai 2.28.0 and 1.107.4.
Sperid Labs has released Iris-3B, a 3-billion-parameter text-to-image transformer that generates directly in pixel space, along with depth and restoration fine-tunes, training code and an Apache 2.0 license. The accompanying paper reports no significant downstream gain from the pixel-space prior.
The vLLM Semantic Router team has released Decision 3.0, six Apache-2.0 decision models from 0.59B to 26.09B parameters that return probabilities for typed questions instead of generating text, and now read video as well as images.
CVE-2026-108586 affects the 1MCP Agent aggregator from version 0.20.0 through 0.39.0, where negated tag-filter expressions slip past OAuth tag-scope checks. No fixed release was listed at publication, so operators should tighten token grants and network exposure until a patch ships.
Alibaba Cloud's OpenAnolis community has announced ANOLISA v1.0, an Apache 2.0 agent operating layer for Alibaba Cloud Linux that shares one terminal between users and agents, enforces Skill security at the system level, measures token savings side by side, and migrates memory between agents.
Alibaba's Qwen team released Qwen-Image-2.1-Turbo on October 9, an accelerated checkpoint of its 7B image generation and editing model that runs in eight denoising steps, alongside hosted Pro and Turbo APIs. The downloadable weights carry the non-commercial Qwen Research License.
Developer Nandakishor M has released Vega under Apache 2.0, a typed decision model that keeps a Qwen3.5-0.8B backbone frozen and trains only a small physics engine whose damped particle settles into one valley per allowed answer, returning calibrated probabilities and an abstain flag.
AgentR has released Webcmd under Apache 2.0, browser infrastructure that records what an AI agent learns about a website and compiles it into site adapters and CLI commands, cutting turns and cost on repeat runs in the company's BU Bench V1 comparison.
CVE-2026-108263, rated CVSS 9.9, affects iFlytek's Astron Agent workflow platform through v1.1.1, where the default code-node executor lacked a sandbox. Operators should upgrade the full stack to v1.1.2 and rotate shipped default credentials.
Kandinsky Lab has published Kandinsky 6.0 Video Pro (29B) and Lite (3B), MIT-licensed diffusion models that generate five-second clips with synchronized 44 kHz audio, dialogue and lip-sync from text or a first frame.
LightOn has released LightOnOCR-3 in 0.8B, 1B and 4B sizes under Apache 2.0, adding a grounding mode that returns labeled bounding boxes, chart data as HTML tables and short image descriptions alongside page transcription.
Conway Research's Underdog team has published Saluki 27B 1.0, an Apache 2.0, roughly 2-bit GGUF of Qwen3.8-27B that runs in stock llama.cpp and beat the 54 GB original on a 120-task tool-calling test, while giving up ground in math.
Cogent launched Attack Path Analysis on October 8, 2026, to graph routes human or AI attackers could take to crown-jewel assets, verify each hop against existing security data, and rank a single chokepoint change.
On October 8, 2026, Hugging Face Bio released Carbon-A, a 1.2B-parameter MIT DNA annotation model, and a Carbon Annotation Database covering 48,167 assemblies with hundreds of millions of predicted protein-coding loci.
JetBrains released Mellum2.1 on October 8, 2026, an Apache 2.0 12B mixture-of-experts coding model with 2.5B active parameters. Post-training in real repositories lifts SWE-bench Verified from 2.0% on Mellum2 to 47.0% under a shared agent harness.
Socket flagged tensorlake@0.5.144 on October 8, 2026, as a ChainDrop / Shai-Hulud supply-chain hit on an AI agent sandbox SDK. The malicious version runs at install time, before any generated code reaches an isolated environment.
Vals AI audited Xiaomi’s open MiMo v2.6 coding RL environments and found recoverable reference fixes in 1,795 of 2,698 tasks. The write-up shows agents retrieving those leftovers and argues that undetected reward hacks still get paid.
Each desk, newest first — so smaller topics stay visible next to the busy ones.
