#Open source/Repo

AILast week, several of South Korea's largest banks were hit by a cyberattack. A CrowdStrike report reportedly indicates the entire attack may have been carried out by one person. The attacker reportedly combined the open-source AI penetration tool ARTEX, DeepSeek v4.1-Flash, GLM-5.3, Grok 4.6, and Claude Code.

AIPreference Model is open-sourcing Karotte, the framework it uses to build reinforcement learning environments that resist reward hacking, including defenses like killing stray processes before grading and rejecting grader-crashing files. The framework has been hardened through more than a million evaluation runs and controlled red-teaming. The company focuses on machine learning engineering tasks for leading labs, and a16z says it is partnering with Preference Model and its founders, Jennifer Zhou and Ning Cao.

AIReflection AI and Mistral each unveiled new open-source models this week, aiming to beat other Western open models, though they trail top Chinese and closed systems on prominent benchmarks. Reflection CEO Misha Laskin says the target is regulated industries and governments that cannot or will not use Chinese models. The outcome depends on whether businesses and agencies accept less advanced models for some tasks in exchange for lower cost and more control.

AIMistral released Mistral Large 4 "Le Chonk", a 1T-parameter (49B active) multimodal model, with open weights planned in about three weeks. Google rolled out Nano Banana 2.1 across Gemini, AI Studio, and the Gemini API, and released EmbeddingGemma 2, a 740M-parameter open multimodal embedding model under Apache 2.0. OpenAI launched the Decisions API in beta with gpt-6-luna, returning typed answers 10x faster than the Responses API.

AIOpenAI has published a new Math post with a linked repository at The post itself gives no further details in the provided text, so the scope of the work cannot be confirmed from this source.

AIMETR demonstrated a JavaScript injection that an agent could trigger through MathJax rendering from any part of its output, including its reasoning. METR says it has not observed agents exploiting this in its evaluations, and the Inspect tool was patched within a day of the report.

AISophia Yang, Mistral's account owner, says this looks like a strong open-source AI week, citing Reflection AI's Beam on Monday and Mistral Large 4 on Tuesday. She notes more releases are coming this week without naming them.

AIOpenAI says it will ship one meaningful Codex and Work improvement each day for 28 days starting October 5, or else offer a "reset" without specifying what that reset covers. The company also plans to test visual ads in ChatGPT image generation in the U.S. starting in late October, with ads kept separate from generated images and not affecting answers.

AIReflection AI has introduced Beam, an open agentic model with 501B total parameters and 23B active, trained end-to-end from scratch. Full weights are slated for release this month. Together AI congratulated the team and is hosting a NYC meet-up with Reflection and NVIDIA next week.

AIReflection is set to release Beam, its first open-weight AI model, aiming to become a Western counterpart to DeepSeek. The source says Beam is trained from scratch for coding, reasoning, and AI agents, with benchmarks placing it alongside the strongest open models and more efficient token economics. Reflection has raised $4.6 billion from investors including Nvidia, Sequoia, and Lightspeed, and the interview covers its monetization plans for open-weight models.

AIAMD has reached above 90% parity on upstream vLLM gating test groups this week, according to SemiAnalysis. The milestone followed months of work by AMD maintainers, including Andreas, and vLLM CI lead Kevin, plus SemiAnalysis supplying additional AMD GPUs to vLLM CI.

AIAMD made 502 commits to core vLLM over 90 days, accounting for 13% of all organizational contributions and almost four times Nvidia's count. The company credited Red Hat, IBM, Embedded LLM, and Inferact for building the project alongside it.

AIKeras is moving to a pluggable backend design, with MLX and PaddlePaddle backends upcoming as add-on libraries. The team is reducing the operations needed to ship new backends and streamlining unit testing so a single harness can test all ops, such as casting consistency. KerasHub also gains many new models and is shifting its preprocessing from tf-text to PyGrain.

AIGoodfire says AI cybersecurity risks are already here and that biosecurity risks are next, as models improve at biology. The post presents this as both an opportunity for science and medicine and a reason for stronger security. It quotes Demis Hassabis announcing SynthID for biology, a watermarking approach for AI-generated proteins, published in Nature with SynthID Bio tools open sourced.

AISophia Yang praised Fireworks AI for leading the open model inference economy, citing a plot from Nathan Lambert showing exponential growth in daily tokens processed. The chart compares leading companies using public disclosures for Together, Baseten, and Fireworks, plus OpenRouter API data, with Lambert noting he had underestimated OpenRouter's growth.

AIHugging Face and OS4Science are partnering to identify the software libraries that scientific model contributors depend on most and to support their maintainers. The move responds to ESM-2, a 2022 protein model still downloaded hundreds of thousands of times a month, which relies on maintained software underneath it.

AILovable's security team found a vulnerability (CVE-2026-102989) in TanStack Start, which allows attackers to run unwanted JavaScript in visitors' browsers via crafted links. Lovable reported it to TanStack and deployed firewall protections for hosted apps while a fix was prepared, and affected projects will be automatically updated on their next change or via the Security page. Lovable says it found no evidence of exploitation in reviewed logs, and apps hosted elsewhere must apply the upstream update themselves.

AIUnsloth is co-hosting an open source party with Hugging Face, featuring Unsloth merch, showcases of upcoming features, demos, DJs, and food. Attendees can register via the linked Luma page using the code NOSLOTHSHERE.

AIOpenAI's "Sign in with ChatGPT" lets people log into third-party apps and use the tokens they already pay for. The announcement came in a post reacting to OpenAI's DevDay keynote, timestamped 10:46.

AIPerplexity's Secure Intelligence Institute is working with researchers at Stanford, CMU, Duke, Columbia, Ohio State, and UVA. The company is also collaborating with NVIDIA and the Open Secure AI Alliance, sharing tools and findings so others can strengthen their own systems.

AIAnthropic reports that Zhipu AI's GLM-5.3 can autonomously build end-to-end cyber exploits and is released without meaningful safeguards against misuse. In its simulated tests, attackers bypassed the model's safeguards 64% to 100% of the time using simple techniques, while the same attacks failed against safeguarded Claude models. Anthropic also cites an NIST CAISI assessment calling GLM-5.3 the most cyber-capable open-weight model released to date.

Why it matters: The report shows how open-weight safeguards fail under simple bypasses, offering concrete test figures for judging misuse risk in released models.

AI数字生命卡兹克 announced that AIHOT, an AI hotspot news site with about one million monthly active users, is now open source on GitHub. The release includes the collection pipeline, curation scoring, clustering mechanism, and the production prompts, aiming to let others build vertical versions for industries such as gaming, law, HR, and finance.

AIMicrosoft announced Autopilot, an always-on agent built on OpenClaw. The OpenClaw account highlights that Microsoft contributors, including Omar Shahine, have contributed back to the OpenClaw project.

AIThe skills.sh registry has reached 1 million agent skills and nearly 280 million installs in seven months. The milestone is detailed in Vercel's blog post on the state of agent skills.

AINVIDIA, with Google DeepMind, EMBL-EBI, and research partners, is making AI-predicted protein complex structures for more than 2,800 viruses openly available. The release gives scientists a head start in preparing for potential outbreaks.

AIinclusionAI has published public training-content summaries on Hugging Face for its Ling and Ring model versions, including Ling-2.0, Ling-2.5, Ling-2.6-1T, Ling-3.0, Ring-2.0, Ring-2.5-1T, and Ring-2.6-1T. The documents, organized under the template associated with Article 53(1)(d) of Regulation (EU) 2024/1689, contain documentation only, not model weights or training datasets. Each summary covers only the model versions it names.

AIMike Knoop says the top ARC Prize 2026 ARC-AGI-2 score of 83.06% by Tufa Labs is only 2% short of the 85% grand prize threshold. The challenge runs under strict Kaggle compute limits with no internet access, and the winning solution is set to be open sourced. The image shows the leaderboard with RabbitHole at 76.94%, nvbanana at 74.17%, Yi-Chia Chen at 55.14%, and Kha Vo at 37.50%.

AIAnt Ling released Ling-3.0-flash-fin, a finance-specialized open-weight model with 124B total parameters and 5.1B activated, offering high intelligence density for its size. It scores 54.9% on Finance Agent v2 at $0.045 per task, and the free API is available for a limited time, with an fp4 quantized version for local use.

AIswyx announced a Latent Space podcast episode featuring Jev, subscribable on Apple and YouTube, and thanked guests Allen Park and Ke. A quoted post from @CompleteSkeptic claims Jev is a frontier model with 20-200x faster speed and 40-400x lower cost, but this post itself adds no verified details.

AINVIDIA's Bryan Catanzaro, VP of Applied Deep Learning Research, will present at GTC Berlin on building open models developers can inspect, adapt, and deploy. The post is a conference invitation, with GTC Berlin set for October 20–22, 2026, and no new model or product announced.

AIJeff Dean congratulated Periodic Labs on results from its materials-science AI work. The post itself provides no specific figures, so the announcement is limited to the congratulations.

AIGoogle says it is focusing AI efforts on health, disaster and weather resilience, learning, and economic opportunity. Recent examples include AlphaGenome Atlas, which maps all 9B possible single-letter genetic changes across the human genome and is openly available to researchers, and WeatherNext 3, described as its most accurate and capable global weather AI model to date. The post also cites AI & Economy ATLAS, an open-access look at global AI usage, and says its translation services now cover nearly 300 languages spoken by 7B people.

AILewis Tunstall joked that DeepSeek released a model just after Hugging Face's TRL library removed support for seq2seq models. The post is a lighthearted remark with no further technical details or figures.

AIDeepSeek says it will work with the open-source community on inference support for DeepSeek-V4.1-Flash and explore more deployment options. The company is inviting organizations planning large-scale deployments with 2,000 GPUs and a storage cluster to get in touch. The model and a technical report are published on Hugging Face.

AIUnsloth's Qwen3.8-27B GGUF has become the most-liked GGUF model of all time on Hugging Face, reaching 10 million downloads and 3.7K likes in 24 days. The post links the GGUF model page and a Qwen3.8 guide on the Unsloth docs site.

AIAli Ghodsi congratulated Clement Delangue and Jensen Huang and said the deal will be good for the industry and open source. The author's own post is short, and the quoted NVIDIA message says NVIDIA is acquiring Hugging Face and will be its new home.

AIThinking Machines is launching Tinker grants of up to $50,000 in credits for safety research on open-weight models. The post shares several project ideas and invites researchers working on safety projects that could benefit from additional Tinker credits to get in touch.

AIZ.ai says GLM-5.3 is its most capable model for cybersecurity tasks, with CyberGym at 84.5% versus 77.2% for GLM-5.2 and ExploitBench at 54.4% versus 24.4%. Access will begin with selected security partners in controlled settings, followed by broader access and API availability, with full open weights to be published after safety evaluations are complete. The company also launched the OpenVuln initiative to help open-source maintainers audit projects and coordinate disclosure.

AIMeta announced it is opening the weights for Muse Glimmer, a 30B parameter dense model that can run locally. Muse Spark 1.2, described as its latest foundation model, will have its weights released soon. The author's interview with Mark Zuckerberg quotes him saying Llama 4 fell short of the trajectory he wanted and that the lab was rebuilt.