Every story across the Writeble desks, newest first.
Nine vLLM CVEs published on October 5, 2026 cover engine crashes, resource exhaustion, and cross-tenant cache leaks in the open-source inference server. Most are fixed in 0.30.0, six credit an AI-assisted audit, and vLLM 0.31.0, released the same day, tightens several of the same request paths.
Google Research says its new federated learning system runs training inside attested server-side TEEs, publishes the allowed workloads to a public transparency log, and has already trained Gboard English and Japanese models with a privacy budget about three times smaller.
CVE-2026-105135, published October 4, 2026, rates a code-injection flaw in InternLM's open-source MindSearch 0.1.0 as Critical. The vendor has not answered the disclosure and no fixed version exists, so operators have to close the exposure through how they deploy it.
Cactus Compute released Whistle on October 2, 2026. The Apache-2.0 speech-to-text model fits in one 16.9 MB file, runs on CPUs alongside its Needle tool-calling model, and transcribes seven languages with word timestamps on phones, wearables, and microcontrollers.
Obelisk 0.42, released October 4, 2026, splits its AGPL-3.0 workflow engine's policy across platform, app, and deployment files so coding agents can redeploy code without widening their own access. The release also adds native V8 replay, experimental Linux VM activities, and a durable workflow-agent prototype.
On October 1, 2026, Earendil shipped MIT-licensed Pi 1.0 alongside experimental Pi Durable—a TypeScript harness with SQLite/JSONL storage, task checkpoints, forkable conversations, and crash resume—aimed at long-running agents beyond a single terminal session.
On October 3, 2026, Aleph Alpha released Apache-2.0 Kolibri-1—a 78.1B-parameter English–German MoE with 3.46B active, up to 1M-token context, reasoning modes, and tool calling—on Hugging Face with a vLLM plugin.
On October 3, 2026, Microsoft and Hugging Face published ThinkingBox—an MIT-licensed agent sandbox and CDLA-Permissive-2.0 bench of 507 stateful workflows that score terminal backend effects, not just fluent tool traces, with OpenEnv adapters on Hugging Face.
On October 1–2, 2026, CVE-2026-103764 / GHSA-mp8g-r7h2-5x36 detailed a Critical untrusted-pointer issue in Mooncake transfer engine before 0.3.13. Unauthenticated peers who can reach the TCP data port can read or write process memory until operators move to 0.3.13 or later.
On October 2, 2026, ServiceNow CoreAI detailed AutoSynthData on Hugging Face—an open pipeline that mines target-model failures in EnterpriseOps Gym, generates teacher-validated tasks with verifiers, and lifts Gemma Pass@1 by 7.2 points on Hybrid after synthetic SFT.
On October 2, 2026, Ai2 open-sourced Apache-2.0 AstaBrief 8B—the Fast-mode report model in Asta—with training data, a local PDF workflow, and SFT+DPO recipe details grounded in real scientific queries.
On October 2, 2026, GitLab published critical AI Gateway patches 19.2.4, 19.3.2, and 19.4.1 for CVE-2026-90970—a CVSS 9.9 template-sandbox escape that could let authenticated Duo Agent Platform users run arbitrary commands on self-hosted gateways.
On October 2, 2026, the llama.cpp project added /v1/systemone support so open decision models—Julia-1 through OpenJev—can score choice, score, and noul questions from text, JSON, or images without generating chat tokens.
On October 2, 2026, Meta open-sourced Apache-2.0 Muse Gadget SDKs for ESP32 and Linux so builders can wire Muse to displays, sensors, and local HTTP APIs—plus a limited Muse Home Link hardware batch for U.S. subscribers.
On October 2, 2026, Reka released Apache-2.0 RIDM—compact flow and pixel inverse-dynamics models that predict W/A/S/D/Shift, yaw, and pitch from video so interactive world models can train on unlabeled real footage.
On October 1, 2026, Ai2 released Olmo-core 3—an Apache-2.0 MoE training stack redesigned around DDP expert residency, parallelism, and MXFP8—benchmarked above one trillion total parameters for the next Olmo generation.
On October 1, 2026, Cloudflare released Apache-2.0 Clef and Clef-flash decision models on Workers AI and Hugging Face—Jev-API compatible, multimodal, and tuned for typed workflow choices rather than free-form text.
On October 1, 2026, DIVD published further detail on DIVD-2026-00014/00015—an agentic AI-powered breach via CVE-2026-102489 and CVE-2026-102490 in Zammad, urging upgrades to version 7 after volunteer data exposure.
Magnitude, an Apache-2.0 local inference engine for AI agents, compiles and autotunes kernels on Apple Silicon, NVIDIA, and AMD—claiming up to 2× faster decode than llama.cpp with one-click hooks into Pi, Hermes, Codex, and more.
On October 1, 2026, AWS Strands Labs released Apache-2.0 Strands Decider 2B—a ~2B Qwen-based decision model with open weights, training data, and scripts for local agent routing, tool checks, and guardrails.
On September 30, 2026, Bilibili’s Index LLM Team released Index-Translate under Apache-2.0—text models at 2B, 9B, and a 35B-A3B preview spanning 150 languages, plus Echo speech, Homura syllable control, and NativeLong document checkpoints.
