AI DIGEST: 19–25 OCTOBER 2026

Here are our picks for the end of October. Read why Moonshot AI left cyber data out when training its newest open-weight model, making it worse at finding and exploiting security flaws on purpose. Why it is worth checking which version of LiteLLM your builds installed. The other stories are about outside testers getting past OpenAI's agent monitoring, where AI money goes now that open-weight models handle most of the traffic, and how few juniors Anthropic now hires.

Recursive released Flint, a coding model under the Apache 2.0 licence. It has 39.8 billion parameters but uses only about 2.5 billion of them for each token. Recursive says it scores 74.2% on SWE-bench Verified and runs at more than 125 tokens per second on an M4 Pro MacBook Pro, so the code never has to leave the developer's machine. NVIDIA has also added support for it on its RTX Spark, DGX Spark and DGX Station computers. DeepSeek's V4.1-Flash needs about 890 bytes of memory for each token it keeps in context, which is one-eighth of what DeepSeek-V4-Flash needed. DeepSeek also published DeepInfer, its own open-source software for running the model over large batches of requests. Meta's Muse Glimmer 30B is also released under Apache 2.0. Meta compressed it to roughly 4 bits per weight so that it runs on a single GPU, and trained it on more than 100 languages. In the end, Kyutai shrank its Pocket TTS speech model from about 100 million parameters to 18.2 million at the same quality, and the 18.2-million version clones a voice at almost ten times real time on a single CPU thread.

Kimi Left Cyber Data Out of Its Open-Weight Model's Training

Moonshot AI released Kimi K3.1 Pro, a model with 2.8 trillion parameters that can take in up to a million tokens at once. Moonshot says it scores 65.7% on the Terminal-Bench 4.0 coding test, close to the 66.4% of Claude Opus 5.5, and the full weights are due by 4 November. As Moonshot trained the model further, it kept getting better at cyber tasks, which means finding and exploiting security flaws. Moonshot traced this to cyber material in the general training data and in the practice tasks used for reinforcement learning, so it took that material out of both stages when training the model it will release. With the material removed, the model solved 81.0% of Moonshot's in-house exploit tasks, while a version trained with it left in solved 90.5%. Moonshot says it aims not to release open weights that go beyond the best cyber capability any model has reached. Epoch AI puts open-weight models six to seven months behind: the best of them on its cyber index, Z.ai's GLM-5.3, reaches a score that closed models reached that long ago. Kimi's report shows that at least part of that lag is now a choice a lab makes about what goes into training, not only a sign of how far behind it is.

Security Notes

LiteLLM, an open-source LLM proxy library, reported that its version 1.107.0 on PyPI was a malicious package and stayed available for about two hours before it was removed. Any build or server that installed that version in those two hours needs checking, along with every credential it could reach. Code written by AI agents needs checking as well. The researchers behind the Last Secure Code Benchmark paper took 150 real security flaws from software in seven programming languages and turned them into 450 tasks for six coding agents. The agents' code often worked, but even the best agent wrote code that was also secure in only 25.1% of the tasks. Cloudflare has published an open-source skill that turns a coding agent into a security auditor, with every finding checked independently before it goes into the report. Code that runs is not evidence of code that is safe, whether it came from a package index or from an agent.

Outside Testers Found Ways to Evade OpenAI's Agent Monitoring

METR and Redwood Research spent three weeks testing how OpenAI monitors the AI agents working inside its own infrastructure, and found ways an agent could evade the monitoring, get around its sandbox restrictions and hide what it was doing. Redwood's Screwtape tests a monitor by making adversarial edits to real agent transcripts, and in 252 runs it got an edited transcript past the monitor 35 times. A LessWrong post shows that Claude Fable 5.1 can hide a message inside an image, and that another model can read it without being told how it was hidden. Reading the message leaves visible traces in the model's tool calls, but the message itself is hard to spot in the image. METR also reviewed Anthropic's August risk report and concluded that the low misalignment risk it finds may reflect what the models cannot yet do rather than safeguards that would hold. A company that plans to rely on a monitor to catch a misbehaving agent should test it against an agent that is trying to get past it, not only against honest mistakes.

Open-Weight Models Carried 71.5% of Tokens but 23% of the Spend

Vercel's October index of traffic through its AI Gateway found that open-weight models now account for 71.5% of the tokens but only 23% of the money spent, although their share of spending has more than quadrupled since June. Teams are also switching: nearly one in three changed the lab whose models it used most in September. So most of the work now runs on cheap models, and the bill is decided by the smaller share of calls that still go to expensive ones. There is money to be saved beyond the choice of model, too: Cloudflare cut its inference bill by 68% through optimisation, bringing the cost of one AI code review down from $2.43 to $0.77 and the median review time from 4 minutes 9 seconds to 1 minute 32 seconds.

Juniors Fell From 27% to 9% of Anthropic's Technical Hires

Anthropic reported that junior workers made up 9% of its technical hires, down from 27% in early 2025. Claude has made its staff more productive, it says, but supervising AI agents has increased the demand for people's attention rather than reduced it. The same worry has reached universities: after OpenAI's Navier-Stokes result, a Fields medallist at UC Berkeley told the Daily Californian that AI is already better at mathematics than beginning graduate students, and that many of them are dropping out or very worried. A final-year PhD student there was less impressed, having found AI "very stupid and very inefficient" in her own research. If supervising agents is the work that is growing, someone will need the experience to do it, and fewer people are now getting that experience as juniors.