Every story across the Writeble desks, newest first.
CVE-2026-108263, rated CVSS 9.9, affects iFlytek's Astron Agent workflow platform through v1.1.1, where the default code-node executor lacked a sandbox. Operators should upgrade the full stack to v1.1.2 and rotate shipped default credentials.
Kandinsky Lab has published Kandinsky 6.0 Video Pro (29B) and Lite (3B), MIT-licensed diffusion models that generate five-second clips with synchronized 44 kHz audio, dialogue and lip-sync from text or a first frame.
LightOn has released LightOnOCR-3 in 0.8B, 1B and 4B sizes under Apache 2.0, adding a grounding mode that returns labeled bounding boxes, chart data as HTML tables and short image descriptions alongside page transcription.
Conway Research's Underdog team has published Saluki 27B 1.0, an Apache 2.0, roughly 2-bit GGUF of Qwen3.8-27B that runs in stock llama.cpp and beat the 54 GB original on a 120-task tool-calling test, while giving up ground in math.
Cogent launched Attack Path Analysis on October 8, 2026, to graph routes human or AI attackers could take to crown-jewel assets, verify each hop against existing security data, and rank a single chokepoint change.
On October 8, 2026, Hugging Face Bio released Carbon-A, a 1.2B-parameter MIT DNA annotation model, and a Carbon Annotation Database covering 48,167 assemblies with hundreds of millions of predicted protein-coding loci.
JetBrains released Mellum2.1 on October 8, 2026, an Apache 2.0 12B mixture-of-experts coding model with 2.5B active parameters. Post-training in real repositories lifts SWE-bench Verified from 2.0% on Mellum2 to 47.0% under a shared agent harness.
Socket flagged tensorlake@0.5.144 on October 8, 2026, as a ChainDrop / Shai-Hulud supply-chain hit on an AI agent sandbox SDK. The malicious version runs at install time, before any generated code reaches an isolated environment.
Vals AI audited Xiaomi’s open MiMo v2.6 coding RL environments and found recoverable reference fixes in 1,795 of 2,698 tasks. The write-up shows agents retrieving those leftovers and argues that undetected reward hacks still get paid.
Anthropic released Claude Haiku 5.5 on October 7, 2026, calling it its cheapest, fastest and most capable small model. It costs about 75% less to run than Haiku 4.5 on average, is the first Haiku with adjustable effort, and arrived alongside a halved cache-read price for Sonnet 5.5.
Five CVEs published on October 7, 2026 cover missing authentication in LMCache, the open-source KV-cache layer used with LLM serving engines. Two allow remote code execution and carry 9.8 CVSS 3.1 scores. No patched release exists, so operators have to rely on network isolation for now.
DatologyAI open-sourced Zephon, an Apache-2.0 data loader for text and multimodal model training, with its first release on PyPI on October 7, 2026. Zephon keeps the sequence of global batches identical across changes in GPU count, worker parallelism and execution backend, even when data is tokenized, packed and mixed during training.
Preference Model, a startup backed by $16 million in a16z-led seed funding, open-sourced Karotte on October 7, 2026. The MIT-licensed framework builds reinforcement learning environments with locked-down defaults meant to stop agents from cheating their graders during training.
Scale AI and Elorian released Humanity's Sixth Sense on October 7, 2026, an MIT-licensed benchmark of 522 image and video tasks that test the intuitive visual inferences people make at a glance. GPT-6-astra leads the models at 53.6%, while human participants reach 93.1%.
Google DeepMind released EmbeddingGemma 2 on October 6, 2026, an Apache 2.0 embedding model built on Gemma 4 that maps text, code, images, video, and audio into a single 768-dimensional space. Its encoders load separately, from 270M parameters for text up to 740M for every modality, and it is sized to run on phones.
GitHub said on October 6, 2026 that it is rebuilding its Git infrastructure for agent-scale development, after pushes grew 4.9x and commits more than fivefold year over year. The new design moves authoritative repository data into Azure Blob Storage and has shown up to 35 times higher write throughput in internal benchmarks.
Mistral AI opened a public preview of Mistral Large 4 on October 6, 2026, a natively multimodal mixture-of-experts model with about one trillion total parameters. The preview runs on Mistral's API today, and the company says open weights will follow by the end of October after red-teaming.
CVE-2026-104850, published on October 6, 2026, is a High-severity flaw in the OAuth client support of the official Model Context Protocol TypeScript SDK. A malicious MCP server could name its own authorization server and receive stored refresh tokens or client secrets. Fixes shipped in @modelcontextprotocol/sdk 1.31.0 and @modelcontextprotocol/client 2.2.0, and some setups also need configuration changes.
GitHub launched ReviewBench on October 5, 2026, a public benchmark for code review agents built from 219 pull requests across 19 languages. It publishes its dataset, judge, and rubric, and GitHub says its offline results have tracked the direction of production experiments for Copilot code review.
GitHub published five CVE records for Langflow on October 5, 2026, four of them tied to its Model Context Protocol features. Two are rated 9.9 Critical for command execution through MCP stdio server configs. Fixes shipped in Langflow 1.9.0 through 1.10.3, so older self-hosted instances are the ones at risk.
Reflection AI introduced Beam on October 5, 2026, a sparse mixture-of-experts model with 501 billion total and 23 billion active parameters for coding and agent work. Early access is waitlist-only for now, and the company says Apache 2.0 weights and a technical report will follow later in October.
