Every story across the Writeble desks, newest first.
CVE-2026-76066, published October 15, 2026, lets public callers of IntentKit agents run owner-only tools such as wallet transfers and posting. VulnCheck rates it CVSS 4.0 8.7 High, and no fixed release exists beyond the affected 2.6.3.
Meta released Muse Spark Open weights on October 15, 2026—an 816B-parameter multimodal MoE with 42B active parameters and a 1M-token context, shipped under a Muse Model License that requires a separate deal for large model-as-a-service providers.
NVIDIA’s Nemotron 3.5 Bolt 74B-A9B, with a model card dated October 15, 2026, is a vision-language agent model compressed from Nemotron 3.5 Super VL, quantized to fit 24GB, and released under the permissive OpenMDW-1.1 license.
On October 14, 2026, Builder.io opened Agent-Native in beta—an open-source TypeScript framework where a single typed action powers the UI, agent tools, HTTP API, CLI, MCP and A2A, with MIT-licensed @agent-native/core.
NVIDIA Personal AI Router left beta as v1.0.0 on October 13, 2026, adding managed llama.cpp, Hugging Face GGUF downloads, RTX Spark validation, and Apache-2.0 multi-machine routing for OpenAI-, Ollama- and Anthropic-compatible clients.
inclusionAI published Ling-3.1-flash on Hugging Face on October 13, 2026—a 560B-parameter hybrid-linear MoE with 25B active parameters, a 1M-token context window, and MIT license, following a trial-only API release in late September.
On October 13, 2026, Anthropic published GHSA-4p2j-qj3c-6x84 for Claude Desktop on Windows—CVE-2026-88066, CVSS 4.0 7.5 High—fixed in 1.8089.0 after the app spawned git.exe without an absolute path.
Liquid AI released LFM2.5-24B-A2B on October 13, 2026, a reasoning MoE with 24B total and 2B active parameters, 131K context, and day-one local agent harness support under the LFM Open License v1.0.
On October 13, 2026, Check Point Research published its full write-up of CVE-2026-35029 and CVE-2026-59823 in LiteLLM Proxy, both fixed by 1.83.9, showing config-update privilege gaps and user_config SSRF against provider keys.
Hugging Face and ggml-org announced Llama Windows on October 13, 2026, a MIT-licensed WinUI3 tray app that installs llama.cpp without admin rights, downloads GGUFs from the Hub, and serves an OpenAI-compatible API on localhost:9931.
Researchers from Tencent, NTU, NUS and A*STAR released GameDirector code, Apache-2.0 checkpoints and training data on October 11, 2026, decoupling rule-based gameplay logic from a Wan2.2 world-model renderer.
CVE-2026-108859 shows that mark3labs/mcp-go through 1.2.1 reads unbounded Streamable HTTP POST bodies with io.ReadAll before validation, letting unauthenticated callers OOM the server. No fixed release is named.
OpenBMB released Trident-Qwen3VL-2B on October 12, 2026, a MIT-licensed multimodal embedder fine-tuned from Qwen3-VL-2B-Instruct that ranks text-only, image-only and fused documents together while targeting modality preference.
CVE-2026-107295 let any website a developer visited trigger agent runs and tool calls through the Pydantic AI development web chat UI, even when it was bound to localhost. Fixes shipped in pydantic-ai 2.28.0 and 1.107.4.
Sperid Labs has released Iris-3B, a 3-billion-parameter text-to-image transformer that generates directly in pixel space, along with depth and restoration fine-tunes, training code and an Apache 2.0 license. The accompanying paper reports no significant downstream gain from the pixel-space prior.
The vLLM Semantic Router team has released Decision 3.0, six Apache-2.0 decision models from 0.59B to 26.09B parameters that return probabilities for typed questions instead of generating text, and now read video as well as images.
CVE-2026-108586 affects the 1MCP Agent aggregator from version 0.20.0 through 0.39.0, where negated tag-filter expressions slip past OAuth tag-scope checks. No fixed release was listed at publication, so operators should tighten token grants and network exposure until a patch ships.
Alibaba Cloud's OpenAnolis community has announced ANOLISA v1.0, an Apache 2.0 agent operating layer for Alibaba Cloud Linux that shares one terminal between users and agents, enforces Skill security at the system level, measures token savings side by side, and migrates memory between agents.
Alibaba's Qwen team released Qwen-Image-2.1-Turbo on October 9, an accelerated checkpoint of its 7B image generation and editing model that runs in eight denoising steps, alongside hosted Pro and Turbo APIs. The downloadable weights carry the non-commercial Qwen Research License.
Developer Nandakishor M has released Vega under Apache 2.0, a typed decision model that keeps a Qwen3.5-0.8B backbone frozen and trains only a small physics engine whose damped particle settles into one valley per allowed answer, returning calibrated probabilities and an abstain flag.
AgentR has released Webcmd under Apache 2.0, browser infrastructure that records what an AI agent learns about a website and compiles it into site adapters and CLI commands, cutting turns and cost on repeat runs in the company's BU Bench V1 comparison.
