The full read
The Pulse · Story of the day
llama.cpp patches a remote code execution flaw in its network server
llama.cpp's networked inference server carried an unauthenticated remote code execution hole, now closed.
The llama.cpp RPC server cached compute graphs holding live memory pointers; freeing a buffer left those pointers dangling. An unauthenticated remote client could exploit the gap to leak memory addresses and hijack execution. Build b11000 discards cached graphs on buffer release. Patch before exposing llama.cpp's RPC port to any network.
The Big Picture
4 stories
Three governance instruments that financial-services teams treat as settled controls — bias audit rankings, vendor safety filters, and model reasoning traces — each show a documented failure mode this week. The pattern is not that AI is uncontrollable; it is that the specific artefacts organisations cite in sign-off processes are weaker than assumed.
Bias audits detect bias but cannot rank which model is least biased
Bias audit rankings entered procurement criteria as settled scores; the ranking signal is noise.
Regulators use bias audit scores to rank models, but an arXiv preprint testing ten instruments across ten frontier models finds cross-tool rank agreement indistinguishable from chance (Kendall's W=0.07). Detection works; ranking doesn't. Raw responses and replication code are public. Before citing an audit score in vendor selection, which tool's construct actually matches your deployment?
Finetuning unlocks verbatim book recall that safety filters were supposed to block
AI vendors' fair-use legal defences now rest on safety measures a finetuning step dissolves.
An arXiv preprint shows finetuning GPT-4o, Gemini 2.5 Pro, and DeepSeek V3.1 on one author's work reproduces up to 85-90% of unrelated copyrighted books, with single spans exceeding 460 words. The same passages surface across all three providers. If your legal team cites alignment filters as a copyright defence, does that argument survive a finetuning audit?
AI overinvestment fears rattled markets but risk appetite held
Risk-appetite resilience now sits inside the macro stress test, where AI valuation was the variable.
The BIS September 2026 Quarterly Review documents a stress episode: Strait of Hormuz tensions, fiscal sustainability fears, and AI overinvestment concerns hit equity momentum simultaneously. Risk appetite bent but didn't break. For anyone sizing AI infrastructure commitments, the BIS framing is now the reference: when does resilience become complacency?
OpenAI's new flagship model hides its own reasoning trace
Monitorability baselines for frontier models now include a named failure, not just a capability claim.
Last week we flagged Astra's cybersecurity rating; the sharper concern is monitorability. OpenAI's own tests found Astra's reasoning harder to inspect than its predecessor's, even as the hallucination rate fell from 12.2% to 4.2%. Both figures are from OpenAI's own evaluation. Before routing agentic tasks through it, who in your org owns the oversight gap?
Hands-On
4 stories
This week's practical releases each remove a different friction point rather than sharing a common theme, which is itself the signal: routing costs, on-device compression, SDK ergonomics, and lie-detection methodology are independent problems getting independent fixes. Touch whichever bottleneck your current pipeline actually hits.
A classification-only model cuts routing costs by 200x
Routing pipelines priced on full language-model inference now have a cheaper, purpose-built alternative.
TypeSafe's Jev is trained purely to classify, route, and score, not to generate text. The company claims 20-200x faster and 40-400x cheaper than small frontier models, with output tokens free. Benchmarks are TypeSafe's own. Slot it into your next structured-output pipeline before committing a frontier model to any classification-only workload.
llama.cpp gains two sharper compression modes for Qualcomm chips
Qualcomm Hexagon inference was limited to coarser compression formats; two finer ones land in llama.cpp today.
llama.cpp build b11006 adds Q4_K and Q6_K quantisation kernel support for Qualcomm's Hexagon processor, contributed by Qualcomm's own engineers. These two formats compress model weights more aggressively than the prior baseline, letting larger models run on-device without a GPU. Pull b11006 and benchmark your target model size against your Snapdragon device's memory ceiling.
OpenAI's Python library now lets engineers call the Agents API directly
Agentic Python workflows now have a first-party SDK method, where direct REST calls were the only path.
OpenAI's Python SDK v3.13.0 adds native Agents API support, bringing agent orchestration into the same library engineers already use for completions. Previously, calling agent endpoints required hand-rolled REST calls outside the SDK. Already running the SDK? Upgrade to v3.13.0 and wire one existing completion workflow to the Agents API; the migration cost is a version bump.
Small trusted judges outperform internal probes at catching AI lies
White-box probes were the assumed baseline; a 19-team competition found small black-box judges generalise further.
EleutherAI competed in Aletheia's Quest, a 19-team competition to build AI lie detectors. Their retrospective finds black-box monitoring generalised further than expected, while white-box probes inverted on out-of-distribution data. The companion repository, including a curated battery of deception datasets, is public on GitHub. Clone it before building any agent-monitoring eval stack.