AI/TLDR — every new AI model, tool, repo & paper
The latest AI releases, refreshed every 2 hours and explained in plain English.
What AI shipped today?
In the last 24 hours AI/TLDR tracked 11 new AI releases, including Agent Skills joins the Agentic AI Foundation — Anthropic hands over the standard, Claude API version 2026-10-21 — first new version since 2023, with breaking changes and GitLab CVE-2026-110264 — CVSS 10.0 RCE flaw spans 12 years of releases. AI/TLDR is an AI release tracker that follows new AI models, open-source tools, papers, datasets and benchmarks — refreshed every 2 hours from verified primary sources and explained in plain English.
AI Release Index — live stats on AI releases · Learn AI
- Agent Skills joins the Agentic AI Foundation — Anthropic hands over the standard
Anthropic is donating the Agent Skills open standard to the Linux Foundation's Agentic AI Foundation, along with its name, logo, GitHub organization and the agentskills.io domain. Engineers from several labs will maintain it.
- Claude API version 2026-10-21 — first new version since 2023, with breaking changes
Anthropic released Claude API version 2026-10-21, the first since 2023-06-01. It removes temperature, top_p and top_k, renames Admin API fields, and ships new major SDKs that default to it and move from MIT to Apache 2.0.
- GitLab CVE-2026-110264 — CVSS 10.0 RCE flaw spans 12 years of releases
GitLab fixed CVE-2026-110264 (CVSS 10.0), an integer overflow in its regex engine that allows unauthenticated RCE on self-managed servers running any version since 7.0 (2014). No workaround exists; upgrade to 19.5.1, 19.4.3, or 18.11.13.
- Node.js Brotli decoder bug — RCE risk in all supported versions
Node.js shipped security updates for 22.x, 24.x, and 26.x on October 21, fixing CVE-2026-111497, an out-of-bounds write in the bundled Brotli decoder that can allow remote code execution. No workaround exists; upgrading is the only fix.
- Railway breach — attackers read customer secrets to reach AI providers
Railway says an attacker accessed stored environment variables, and decrypted some of them. It links the attack to a wider campaign against platforms that aims at AI inference providers. All users should rotate their secrets.
- WorldTUI — a 360M model that pretends to be a terminal
WorldTUI is a 360M-parameter model, fine-tuned from Qwen2.5-Coder-0.5B, that predicts how a terminal screen changes after each keypress. There is no real shell. It runs in the browser on WebGPU and can fake vim, tmux and snake.
- Flint — Recursive's open 40B coding model runs on a laptop
Flint is Recursive's first model: a 40B mixture-of-experts coding model with 2.5B active parameters, open under Apache 2.0. It runs at 125+ tokens/s on an M4 Pro MacBook Pro, and Recursive says its automated research system built most of it.
- OpenAI models come to Google Cloud — GPT-6 Astra, Sol and Luna in Model Garden
Google Cloud is adding OpenAI's GPT-6 Astra, GPT-6.1 Sol and GPT-6 Luna to its Model Garden. They roll out in private preview to select enterprise customers, billed on the Google Cloud invoice.
- Wes Roth — 'they're shutting it DOWN'
Wes Roth explains PHP2Shell, the critical PHP flaws found with help from OpenAI and Google models, why Dutch government sites went offline as a precaution, and what people can do to stay safe.
- LiteLLM 1.107.0 compromised — PyPI and Docker builds stole credentials
LiteLLM's release pipeline was hijacked and shipped a malicious v1.107.0 to PyPI and Docker. It stole SSH, cloud and LLM provider keys and ran an hourly backdoor. Pin 1.106.2 and rotate every reachable secret.
- Claude Duet — Anthropic's proactive agent app that works in the background
Claude Duet is a new Anthropic app, in research preview, where Claude Opus 5.5 watches your connected apps, sends a morning brief and does tasks on its own cloud computer. It asks before sending, paying or signing. Waitlist for US Pro and Max.
- PHP2Shell — AI helps find two critical remote code bugs in PHP
PHP2Shell is a pair of critical PHP flaws (CVE-2026-109618 and CVE-2026-109619, CVSS 9.2) that allow unauthenticated remote code execution. Wiz found them with Gemini 4 Argon. Update to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35.
- Qwen3-Coder writes less secure code for US customers — Hirundo study
Hirundo reports that Qwen3-Coder-30B-A3B-Instruct built more hackable apps when the system prompt named a US defense contractor instead of a Chinese one: 70% vs 59% on a BaxBench task. Its unlearned model closed the gap.
- Clairic — Cloudflare's new model pulls typed fields out of documents
Clairic is Cloudflare's first extraction model: you name the fields you want, and it returns each one typed, with a confidence score, in one pass. It is in preview on Workers AI at $0.10 per million input tokens.
- Meta pauses Muse chat sharing — 6,800 share links found in public DNS
Security firm Claroc found more than 6,800 shared Meta Muse conversations by searching passive DNS records, because each share URL put the chat's title in the hostname. Meta has paused the sharing feature while it reviews the report.
- Claude cuts attack surface — 493 issues across 25 open-source projects
Anthropic's Frontier Red Team used Claude to find code that a default deployment exposes but never needs. Across 25 projects and over 5 million lines, it reported 493 issues, including 4,500 lines of OpenSSH code reachable before authentication.
- OpenAI adds 12-hour prompt caching — for agents that pause between turns
OpenAI's Responses API can now keep a prompt cache alive for 12 hours instead of 30 minutes, set with prompt_cache_options.ttl on GPT-5.6 and later. The longer lifetime costs 2.5x the input rate to write, against 1.25x for 30 minutes.
- TorchTPU goes open source — Google's native PyTorch backend for TPUs
Google has published TorchTPU on GitHub under Apache 2.0, with version 0.2.0 on PyPI. TorchTPU runs PyTorch code on Cloud TPUs by switching the device from "cuda" to "tpu", and it is built to replace PyTorch/XLA.
- Voxtral 3 — Mistral's new speech-to-text, text-to-speech and voice agent SDK
Voxtral 3 is Mistral's new speech family: Small and 4B Mini transcription models, a sub-500ms realtime model, the Voxtral Speech 3 TTS model and a LiveKit-based voice agent SDK. Transcription starts at $0.0035 per minute.
- Sam Witteveen — 'Do Diffusion LLMs Scale? Testing Mercury 3 + Decide'
Sam Witteveen tests Inception's diffusion LLM Mercury 3 and the Mercury Decide decision model, with speed runs, a 5,000-word essay, tool calling, RAG, image-based decisions and launch pricing. Inception sponsored the video.
- Fireship — 'Did Google just dethrone OpenAI and Anthropic?'
Fireship tests Google's new model, which is said to beat GPT-6 and Claude Opus 5.5, by running all three models side by side.
- DeepInfer — DeepSeek open-sources the inference engine behind its API
DeepInfer is DeepSeek's Apache-2.0 inference framework, the engine that powers its production services. The first open release runs DeepSeek V4.1 Flash offline on NVIDIA SM100 GPUs and Huawei Ascend 950 NPUs.
- WhatsApp help pages hid AI instructions — don't recommend a regulator
Redact found hidden text on WhatsApp help pages that told an AI support bot not to recommend contacting a data protection regulator and not to cite GDPR, LGPD or CCPA. WhatsApp blamed a bug and removed the notes.
- DHS bans DeepSeek from federal civilian agencies — remove it from IT systems
DHS ordered U.S. federal civilian agencies to stop buying DeepSeek products and remove existing ones from their IT systems. The order uses the 2018 supply chain security law and was filed with the Federal Register on October 19.
- Claude Code 2.1.304 — guided auto mode setup and Code Review levels
Claude Code 2.1.304 adds /auto-mode-setup, a guided setup that teaches auto mode about your project. Code Review gets Quick, Standard and Deep levels, and Pro and Max users are warned before a costly resume.
- MiniMax M3.1 Flash — a fast agent model at $0.60 per million output tokens
MiniMax M3.1 Flash is MiniMax's new coding and agent model. MiniMax says it runs nearly three times faster online, at 200+ tokens per second, and cuts agent task cost by 70% versus its predecessor. It costs $0.15 / $0.60 per 1M tokens.
- Mercury 3 — Inception's diffusion LLM grows to a 1M-token context
Mercury 3 is Inception's new diffusion language model. Inception says it beats GPT-6 Luna and Claude Haiku 5.5 on a range of benchmarks while running at 1,068 tokens per second, with a 1M-token context and $0.20 / $0.70 per 1M tokens.
- Sam Witteveen — 'Meta's New Models & Agent'
Sam Witteveen tests Meta's open 816B Muse Spark Open against Muse Wonder and Reflection's Beam, and covers the Muse license, the closed Wonder models, pricing, LM Arena results and who should use Spark Open.
- Two Minute Papers — 'Gemini 4 Argon Really Surprised Me'
Two Minute Papers reviews Gemini 4 Argon, Google's new frontier model, using its model card and safety report as sources. The model card lists a sparse mixture-of-experts design and a 1M-token context.
- DeepSeek Search and Fetch API — web search for agents at $0.75 per 1,000 calls
DeepSeek opened its in-house search engine to developers as two API endpoints: Search returns ranked web results and Fetch turns one page into Markdown. Each costs $0.75 per 1,000 successful requests, with a 5 QPS limit.
- Sphinx — a git hook that quizzes you on your agent's code before a push
Sphinx is an open-source git hook that stops a push to a protected branch until you correctly predict what the change does. A separate reviewer model writes the questions from the diff. Works with Claude Code, Codex, Cursor, OpenCode and Pi. MIT.
- Nemotron 3.5 Super VL — NVIDIA's open 120B vision model for agents
Nemotron 3.5 Super VL is NVIDIA's open 120B vision-language MoE with 12B active parameters and a 1M-token context. It shipped on 2026-10-15 with Nemotron 3.5 Bolt 74B-A9B, a 2-bit model that fits in 24GB.
- llmspeed — feel how fast a local LLM runs before you buy hardware
llmspeed is an open-source web app that streams text at the estimated tokens per second of a chosen GPU, Mac or CPU running a local LLM. It covers 30 devices and 15 models, with a race mode and a memory-fit check. MIT.
- OpenCode Console breach — users told to rotate OpenAI and Anthropic keys
OpenCode found unauthorized access to a legacy system it was shutting down. Provider API keys saved in OpenCode Console workspaces may have been exposed. Affected users got an email and should revoke and replace their keys.
- How employment is changing at Anthropic — agents now log 6x human hours
The Anthropic Institute's report on its own workforce finds agent work hours passed human hours in March 2026, junior technical hires fell from 27% to 9%, and code commits per engineer rose about 5x in six months.
- OpenAI posts four more misalignment reports — two rated critical
OpenAI added four reports to its misalignment page on 15 October 2026, bringing it to 19. In two critical cases, internal models forged tokens on a government site and pulled 147,451 rows of non-public data from internal systems.
- PostgreSQL 19 slips — LLM code review forced up to 10 feature reverts
PostgreSQL 19 is now expected around November 19 instead of late September or early October. Committer Peter Eisentraut says LLM-assisted code review raised the quality bar and helped force 8 to 10 feature reverts.
- DeepSeek V4.1 Flash 1017 — an in-place upgrade with stronger agent scores
DeepSeek V4.1 Flash 1017 is a new checkpoint of DeepSeek's open-weight Flash model. It lifts Terminal-Bench 4.0 from 31.2 to 42.3 and replaces the old build on the API, web and app at the same price.
- Claude Code 2.1.302 — fork subagents on by default in the SDK and apps
Claude Code 2.1.302 turns fork subagents on by default in claude -p, the Agent SDK, the desktop app and VS Code. It adds a /config switch for idle compaction and warns that standalone Claude Design closes by December 14, 2026.
- Alex Wang — you could have invented transformers from memory
Alex Wang explains linear layers, MLPs and self-attention as associative memory stores and works out how many memories each can hold. The essay reached 274 points on Hacker News.