Sunday is quiet, with five useful releases and operational warnings centered on open infrastructure and real world security boundaries. Kolibri 1 leads: its Apache-2.0 English–German weights, vLLM integration, and unusually long context make it a runnable European model rather than a policy announcement. Elsewhere, invalid AI submissions forced Google to pause part of its open-source bug bounty; a C2PA proof-of-concept preserved a trusted timestamp while excluding the entire image from its signature; OpenAI detailed the scale and efficiency claims behind its Jalapeño inference system; and Google is moving higher-capability Gemini models out of its free and AI Plus tiers.

Agent frameworks & tooling

  • Google pauses product reports for its OSS bug bounty — invalid AI submissions forced Google to suspend product-vulnerability reports pending a 2027 program update.
    • The pause began October 1; other OSS VRP report categories remain open.
    • Agent-generated security reports need reproduction and human validation before submission.
    • Flag: Page extraction was blocked; timing and scope come from Techmeme’s direct headline carry.
    • (Techmeme · Tom’s Hardware)

Models & research

  • Kolibri 1 — Aleph Alpha released an Apache-2.0 English–German MoE with downloadable weights and a runnable vLLM integration.
    • Public artifacts include weights, a technical report, and an inference plugin with tool-calling and reasoning parsers.
    • Training data is 21.3% German; vendor results report 66.4 SWE-bench Verified and 61.4 BFCL v4.
    • Measured: 78B total / 3B active parameters · one-million-token maximum context · Apache-2.0 license.
    • Flag: Results are vendor-run; contexts above 262,144 tokens require an explicit override.
    • (lobste.rs 7 · 3c)

Industry

  • Inside OpenAI’s Jalapeño inference chip — Richard Ho describes a Broadcom-designed homogeneous accelerator for OpenAI’s full inference workload.

    • Each chip carries 216 GiB HBM4 at 15.4 TB/s and sustains about 550 W.
    • Scale: 128 chips per local domain · 2,048 chips per system · 27 EFLOP/s at four-bit precision.
    • OpenAI reports 1.5–1.9× performance per watt and 1.7–3.6× latency gains over GB200/GB300.
    • Flag: Comparisons are OpenAI-run; the interview first appeared September 30.
    • (Techmeme · More Than Moore)

  • Gemini narrows model access for free and AI Plus users — Google is reserving higher-capability Gemini models for Pro and Ultra subscriptions.

    • October 9: free users get Flash-Lite; AI Plus retains Flash-Lite and Flash but loses Pro.
    • Pro and Ultra retain all three tiers and gain Deep Think.
    • Effort settings consume different shares of each user’s compute-based limit.
    • Flag: AI Plus timing comes by email; Google has not placed Gemini 4 Argon in this matrix.
    • (Techmeme · 9to5Google)

Policy & provenance

  • C2PA permits a valid timestamp over an effectively unsigned image — a proof-of-concept shows valid Content Credentials need not prove image bytes were fixed when signed.
    • C2PA exclusion ranges let verifiers omit selected bytes from signature calculations.
    • The demonstration excludes the entire JPEG, signing an empty string while preserving the trusted timestamp.
    • Current verification tools reportedly accept the file without warning that coverage is zero bytes.
    • Format-specific rules are needed because formats such as PNG legitimately exclude checksum bytes.
    • (HN 41 · 4c · lobste.rs 21 · 2c)
All gathered items - what was cut and why (8)