Tech Brief News & Insights

The 12 November launch also introduces an Orchestrator that switches between Google models mid-session depending on the task.

The 4EverAble2Shell chain chains an EOL Apache Axis flaw into root access on N-central servers with the Legacy API exposed, with 21 mining rigs confirmed in the wild.

A 0.63B fine-tuned parser and a 4 MB CPU-only OCR engine, both open-weight, were launched on 12 November and are already in commercial production.

The open-weight 27B and 4B models return probabilities instead of text and add Locate, an exact-span extraction feature, on 13 November.

The latent-MoE models derived from Qwen3.8-Flash-Next stream Q3_K weights from SSD to fit a 24 GB RTX 5090, using a scheduling engine and 1.26B MTP speculative decoding; all performance figures are vendor-reported.

The multimodal MoE model (594B total, 17B active, 1M-token context) was API-only at launch on 5 November; its Apache 2.0 checkpoints landed on Hugging Face on 12 November as promised.

The new engine pairs layout-aware parsing with a decision model that verifies and corrects only the parts that are wrong, claiming a 0.834 Parse Index and corrections 28–38% faster than full regeneration.

Enterprises can now run AI requests on infrastructure inside India, a data-residency move explicitly aimed at financial services; the pattern is being watched as a precedent for other Asian markets.

The 11 November release closes CVE-2026-119618, a heap corruption flaw affecting versions 2.4.55 through 2.4.70, credited to Anthropic's OSS Scanner vulnerability discovery program.

The 89 advisories issued on 10 November include roughly 17 critical flaws, with the vendor warning that AI has compressed the window from disclosure to exploit to days.

The US cyber agency set a 12 November remediation deadline for the CVSS 9.8 flaw in the open-source AI inference cluster manager, warning that patching alone does not evict attackers.

The Alibaba-backed Apache 2.0 checkpoint packs five document tasks into one small model, with adoption peaking this week; all benchmark figures remain vendor-reported.

A Korean fintech AI company announced a registered patent that converts LLM outputs in credit review into measurable default probabilities using token log-probabilities and a lightweight calibration layer.

Equinix inaugurated phase two of its Jakarta JK1 data center with liquid-cooled AI capacity, while Indonesia's National Data Center Task Force projected 11.7 GW of capacity needs by 2030.

The Fireworks AI breach was confirmed to have widened to billing data, model weights, and customer datasets, and Notion has paused its integration with the vendor.

IBM and Microsoft announced Imagine Enterprise, an agentic platform for industry-specific AI agents, with IBM Consulting handling delivery and forward-deployed engineering support for qualifying engagements.

Korea Deep Learning said its VLM agent cut financial document processing time by 88 percent in a proof of concept with Industrial Bank of Korea. The company is targeting APAC financial institutions after deployments in Vietnam and Taiwan.

Meituan released the full weights of LongCat-2.5, a 1.6-trillion-parameter MoE model with a one-million-token context, under an unrestricted MIT license on Hugging Face.

NEAR AI says an attacker exploited a remote code execution vulnerability in SGLang, accessing account details of about 100 users, 18 legacy agents, and in-flight requests, including confidential-mode traffic. No stored conversations or uploaded files were accessed, the company said.

Norway plans to license data centers, prioritizing defense, health, mobile networks, and financial systems, as AI-driven demand strains the power grid.

PuppyGraph raised a $10 million Series A for its graph query engine, which treats warehouse and lakehouse data as a single graph without moving it, adding new tooling for AI agents.

The analytics vendor's largest expansion treats AI agents as a first-class workload, with managed Postgres reaching GA and database branching for agents on the roadmap.

The fourth model in Meta's Muse family is priced at $0.10 per 1M input tokens and is positioned to handle the high-volume work that AI agents repeat all day.

ClickHouse unifies Managed Postgres, Observability, Security and the Langfuse AI Gateway on one platform and acquires Xata to add instant Postgres branching for AI agents.

RunSybil research shows a malicious chat template from Hugging Face can hijack Python-based serving engines such as vLLM — and the fix never reached Python 3.12.

Clients with existing entitlements can now query Fitch Ratings, CreditSights and BMI research inside Perplexity's AI workspace through the Fitch Nexus connector.

The Apache 2.0 project adds KV-cache-aware load balancing, per-tenant rate limiting and usage tracking, with vendor-claimed TTFT reductions of up to 95 percent.

Meta's new Muse Ember model targets agent execution tasks with multimodal input and a reported price of $0.10 per one million input tokens, with competitive benchmark claims flagged as vendor-side figures.

Northern Trust has launched an AI-powered client onboarding agent built with Microsoft, reporting an 83 percent reduction in data preparation time and vendor-reported first-pass F1 of 96.5 percent.

The 594B-parameter MoE model, released on Tinker on 5 November, is expected to open its weights under Apache 2.0 within days, independent trackers suggest.

An open-methods audit of 15 document-parsing benchmarks reports that only about half order parsers consistently with real error rates.

The 3.67B-parameter model outputs probability distributions over predefined answers instead of text, targeting low-latency classification and routing in agent pipelines.

Release notes dated 5 November 2026 list a managed agent runtime, hosted vector search, and natural-language workflow generation, with several features entering public preview.

Built via supervised fine-tuning on Qwen3.8-27B and released under Apache-2.0, the model is accompanied by an open evaluation set and methodology for measuring model behaviour.

A newline character in the sandbox shell filter allows command chaining (CVSS 8.8); the fix ships in ag2 1.1.1.

The 2B model returns schema-directed JSON from document images, with missing fields returned as null; weights and licensing terms are not yet published.

The 2B document-AI model returns structured JSON with missing fields as null instead of hallucinated values, marking document field extraction as its own product category.

Two open-source integrations add persistent conversation memory, durable agent state, and vector search to MongoDB Atlas and self-managed deployments.

The petabyte-scale analytics platform company brings total funding to $260M, reporting revenue up more than 3x this year on demand from AI-driven workloads.

The dense 65B agentic coding model ships under Apache-2.0 with BF16 and NVFP4 checkpoints; benchmark figures remain vendor claims.

Ricursive Intelligence released Ripple-65B Preview, a dense 65B open-weight coding model that reportedly outperforms far larger models on agentic coding benchmarks.

The 594B/17B MoE model is live on Tinker; full weights are announced to follow under Apache-2.0 after external safety testing.

A bug report against Claude Code v2.1.318 alleges the signed-in user's email address is placed into the User-Agent header of requests made by the agent, with no opt-out currently available.

A missing-authentication vulnerability in AgentScope up to version 2.0.11 lets a remote attacker impersonate any user by manipulating the client-controlled X-User-ID header; a public exploit is available.

The new platform consolidates document RAG, read-only Text-to-SQL, agent memory, and semantic cache inside the operational database, with AI Retrieval entering public preview this month.

Percona's new search offering brings full-text, vector, and hybrid search with local embedding generation to self-managed MongoDB, previously tied to Atlas or the Enterprise Advanced license.

Credolab (Singapore; device metadata & behavioral analytics for credit/fraud scoring, ~200 clients in the US, Latin America, **Southeast Asia**, EMEA, GDPR/PDPA-compliant) is partnering with Begini (UK; behavioral analytics with privacy consent + psychometric scoring, opt-in). The combination lets lend…

Full checkpoint: 2.8T total / 104B active (MoE, 896 experts, 16+2 shared per token), 93 layers (69 KDA + 24 Gated DSA — replacing K3's full-attention MLA, cheaper for long context), 1,048,576-token context, multimodal (MoonViT-V2 401M). Weights are **MXFP4 with MXFP8 activations, quantization-a…

When a developer tells a coding agent to "set up a GitHub MCP," the agent has to pick a package. From real session transcripts, Glow Labs found a pattern they named MCPhantom: the agent picks a server from a repository **that has already been archived and will never receive a fix release** — in 98% of the…

OCRia-1 is a 4B VLM (Qwen3.5-4B base) for parsing document pages into Markdown — tables as HTML with full structure, charts as data-point tables, formulas as LaTeX. ParseBench claims: overall score **87.4** (12.1 points above LightOnOCR-3-4B's 75.3); tables dimension 91.5; charts dim…

The GA version of Hy4 replaces the preview (Aug 28): 770B total / 49B active (MoE), 1M-token context, and for the first time in the Hunyuan family it has **visual understanding** (images, charts, math visuals) and **computer use** (CLI + GUI, with dedicated training on Blender and CAD). Tencent claims top…

A new public beta lets clients send only new messages per turn, reporting a 35 percent drop in median time-to-first-token for very long requests.

OCC Bulletin 2026-54 gives US bank examiners a framework for assessing AI use, based on consequences rather than technology sophistication, with three key principles on scope, risk categorization and examination intensity.

A third parsing mode now interprets charts, diagrams and tables into semantic summaries and structured data, moving document AI deeper into the data warehouse.

The open-source LLM serving engine ships a major platform update with CUDA-13-only wheels, 11 new model architectures and large claimed throughput gains.

Three sizes (0.8B & 4B on the Qwen3.5-VL architecture; 1B on the older LightOnOCR-2 architecture — migrate without changing prompts), all **Apache 2.0**. Two modes: (a) **transcription** — empty prompt, outputs full-page text like the previous generation (generation 2 has been downloaded 4.5 million+ times); (b) **grounding**…

All five CVEs target `@ag-ui/client`, the TypeScript client for the AG-UI protocol (Agent-User Interaction Protocol — the standard for streaming state/tool calls/generative UI from agent backends to frontends such as CopilotKit). (1) **CVE-2026-120233** (CVSS 3.1 5.3): HttpAgent builds its fetch without…

A MoE with 1.6 trillion total parameters, ~48 billion active per token, natively multimodal (including visual coding/3D), focused on long-horizon agents (large codebases, complete software projects). Meituan's benchmark table: 88.4 Terminal Bench v2.1 vs 89.1 Claude Opus 5 and 88.8 GPT-5.6-Sol — a claimed positi…

Decider is a 2B model (rank-16 LoRA on top of Qwen3.5-2B-Base; the LM head replaced with a ~1-million-parameter pointer head) that does NOT generate text: given a "state" plus a typed question (`choice` pick 1 of N; `noul` yes/no; `score` ordinal scale), it returns calibrated probabilities per option…

Trajectory (18 people, founders from Stanford/DeepMind/Apple) has raised a $45 million Series A at a $300 million valuation, led by Sequoia and joined by NVIDIA, Bessemer, and Bain Capital Ventures. Its product: a platform that makes AI models learn from feedback and keep improving on specialist tasks without…