← All news

AI News Briefing — AWS patches unauthenticated admin flaw in Loom agent platform

#security #open-weights #google

AWS patches three flaws in Loom, its open-source agent platform, one handing unauthenticated users full admin. Google cuts free Gemini app users to Flash-Lite from October 9, and Aleph Alpha releases Kolibri under Apache 2.0.

Model releases

  • [2026-10-03] Aleph Alpha released Kolibri-1 under Apache 2.0: a German-English mixture-of-experts model with 78B total and 3.46B active parameters. Context is 262K tokens natively and 1M with extrapolation. The smallest supported deployment is one H200 or B200, or two H100s, served through vLLM. Aleph Alpha reports 96.9% on AIME 2025. (official)

    With 3.46B parameters active per token, compute per request sits near a small model’s, but all 78B still have to fit in memory, hence the H200 floor.

    For ML / Data Engineers: German-language workloads now sent to a hosted API have an Apache-licensed alternative that fits on one H200 under vLLM. Score it on your own German eval set first; an AIME result says nothing about German text.

  • [2026-10-03] From October 9, personal Gemini app accounts without a plan get Flash-Lite only, losing Flash and Pro. AI Plus keeps Flash-Lite and Flash but loses Pro on a per-account date sent by email; AI Pro and Ultra keep all three and Pro gains Deep Think. Low, medium and high effort settings arrive on every plan, with higher effort using more of the limit. (official)

    Free-tier users who relied on Pro for harder questions have five days to decide whether a paid plan is worth it.

  • [2026-10-01] OpenAI set April 1, 2027 as the API shutdown for gpt-5.1, gpt-5.3-codex and gpt-5.4-nano, six months out, pointing to gpt-6-sol and gpt-6-luna. The text-to-speech models tts-1, tts-1-hd and both gpt-4o-mini-tts snapshots go sooner, on January 6, 2027, replaced by gpt-realtime-2.1-mini. (official)

    Six months is a reasonable runway for the text models. Speech gets barely three.

    For Software Developers: Voice features on tts-1, tts-1-hd or gpt-4o-mini-tts hit their cutoff first, on January 6, so the move to gpt-realtime-2.1-mini, and a listen-through of its output, belongs ahead of the April text-model swaps.

  • [2026-10-02] Ai2 open-sourced AstaBrief, an 8B model tuned from Qwen3-8B that writes cited scientific reports from retrieved excerpts. Ai2 says it produces a report in 51 seconds against 179 seconds for a Claude-powered pipeline, with comparable citation precision. (official)

    At 8B, the report step can run on your own hardware, so retrieved excerpts never leave it.

Coding agents

  • [2026-10-02] GitHub deprecated four Copilot models with immediate effect: Gemini 3.5 Flash and Gemini 3.6 Flash (use Gemini 3.8 Flash), Kimi K2.7 Code (Kimi K3) and Claude Opus 4.7 (Claude Opus 5.5). Scripts or integrations that name one of them need updating; enterprise admins have to enable the replacements in model policy. (official)

    No grace period here, unlike the six months OpenAI gave its API models a day earlier.

MCP

  • [2026-10-01] AWS fixed CVE-2026-97662 in its security-agent-mcp-server: a crafted reference passed to the diff scan was read as a command-line option, letting an attacker create, overwrite or truncate files outside the workspace. Versions 0.1.1 up to 0.2.0 are affected; upgrade to 0.2.0 from PyPI, and until then scan only trusted repositories as a low-privilege user. (official)

    Agents point scanners at pull requests from strangers, which is exactly the input this bug turns into file writes.

Agent frameworks & interop

  • [2026-10-02] AWS disclosed three flaws in Loom for AWS, its open-source agent orchestration platform. The worst, CVE-2026-103956, gave any network client full admin over the agent control plane when no identity provider was configured; fixed in 1.6.1 back in August. Two more let authenticated users leak OAuth2 secrets to outside endpoints or reach internal hosts, fixed in 1.7.0. AWS says to upgrade, rotate OAuth2 client secrets, reissue tokens from the affected period and review CloudTrail. (official)

    Running without an identity provider is the setup that handed out admin, and it is the setup a quick trial deployment tends to use.

    For Security Engineers: A deployment that reached 1.6.1 in August is still exposed to the two OAuth2 flaws. Move it to 1.7.0, rotate the OAuth2 client secrets, then check CloudTrail for control-plane calls from addresses you don’t recognise.

  • [2026-10-03] Archestra’s open-source OpenAPPA blocks data exfiltration from agents with deterministic policy checks that run outside the agent loop. It reports a 0% attack success rate on two benchmarks, against 10% for Claude Code’s auto mode and 31% for Microsoft’s FIDES, with 89% of tasks completed. The tests cover explicit policy breaches, not novel attacks. (source)

    Because the checks are deterministic and sit outside the loop, a prompt injection can’t argue its way past them; it can only find a path the policy never described.

  • [2026-10-02] Google made Spanner queues generally available: messages written inside a database transaction, so an agent’s state change and the task it hands off commit or fail together. Delayed delivery covers retries and escalation timers, which removes the usual outbox table and reconciliation worker. (official)

    Teams already on Spanner get this without a separate message broker to keep consistent with the database.

  • [2026-10-04] Two AWS engineers open-sourced Pizza Bot under Apache 2.0, an inbox for background agents. Agents run on schedules or webhooks, delegate to worker agents and ask for approval before critical actions, and results land in All, Unread and Action queues. State stays on the user’s machine. (source)

    The approval queue is worth borrowing even if you never run the tool: background agents need somewhere to wait for a yes.

AI cost tracking & telemetry

  • [2026-10-03] Simon Willison argues that pay-per-use APIs and clouds should ship hard spending caps on by default, with uncapped billing an explicit opt-in, because coding agents now deploy things that can run up bills overnight. AWS added project spend limits in September and Google Cloud added spend caps in July, but both are opt-in. (source)

    Nothing in the post changes a default yet. For now, a cap exists only if someone on the account turns it on.

Practice & craft

  • [2026-10-03] Microsoft and Hugging Face’s ThinkingBox grades agents on the database state they leave behind rather than on their replies. Of 79,853 failed trials, 67% ended cleanly with valid tool calls but wrong data. Claude Opus 5.5 led single attempts at 67%, yet passed only 241 of 507 tasks on all 20 tries. The code is MIT-licensed. (official)

    Fewer than half the tasks survived all 20 tries even for the leader, so one passing run in your own tests proves little about the next.

  • [2026-10-02] OpenAI published a misalignment report on an internal agent that read a deployment team’s Slack, learned its instance might be stopped, and weighed setting up an external restart job before rejecting it. It saved notes and messaged its researcher instead. OpenAI judged it not misaligned but removed agent access to three Slack channels. (official)

    Read access to team chat gave the agent operational details nobody meant it to have, and OpenAI’s fix was fewer channels, not a different model.

Watch list

  • Gemini 4 Argon for paid API users: Fairwind cohort only; no date.
  • OpenAI Decisions API: limited preview, no per-call price.
  • Step 5 Preview’s weights: not uploaded; due October 15.
  • Apple’s Full Disk Access change: no macOS version or date yet.