News from Thursday, 27 August 2026
45 articlesAI Models and Tooling
- NVIDIA is in advanced talks to acquire Hugging Face for ~$13B, roughly 80x its $150M ARR, following a doubled customer base in 2026 [1, 2].
- Z.ai confirms Ox Alpha is GLM-5.3-Flash, a 320B-parameter MoE reasoning model with 18B active parameters, open-sourced and optimized for coding/agentic workloads [3, 4, 5, 6].
- Qwen releases Qwen3.8-Flash-Next (125B-token multimodal MoE, 6B active params) previewing Qwen4’s architecture with strong reasoning [7, 8].
- OpenAI unveils custom inference chip "Jalapeño" at Hot Chips, claiming performance-per-watt gains over Blackwell [9].
- Google DeepMind introduces Gemini Omni 1.1 Flash with studio-quality video controls (scene extension, frame interpolation, 4K upscaling) [10].
- Meta releases Muse Image for grounded image generation at $0.01/image [11].
- Google AI Studio adds Gemini 3.5 Transcribe for intelligent speech-to-text with real-time streaming [12].
- Anthropic expands scientist support: 10k free/discounted Claude seats, broader AI for Science credits, and a Model Hardware Standard (MHS) preview for AI-driven lab/manufacturing automation [13, 14].
Agents, RAG and LLM Engineering
- LinkedIn’s cognitive memory agent for hiring uses four memory layers (conversational, episodic, semantic, procedural) and a hierarchical tree to replace GraphRAG for cheaper, traceable updates [15].
- Salesforce integrates full CRM into Claude ("Claudeforce") with 37 pre-built sales skills and live data access, beta in September [16, 17].
- OpenExecutive orchestrates eight specialist agents (CFO, CMO, etc.) with episodic memory for business decision-making [18].
- Graph Engineering proposed to coordinate multi-agent systems via task/agent/state mapping for parallel work and verification [19].
- OpenAI’s ChatGPT desktop and Sites now support WebMCP, enabling direct tool use on compatible websites [20].
- Vercel’s Run SDK offers secure eval for agents via a hardened QuickJS sandbox with scoped host functions and resource limits [21].
- Microsoft AutoSaddler automatically optimizes agent prompts/tools/middleware from execution traces [22].
- dbt highlights "context gap" as a top reason agentic AI pilots stall, citing ungoverned data leading to unreliable outputs [23].
Evaluation, Safety and Governance
- Google DeepMind pilots double-blind AI evaluations for proprietary models using cryptographic environments to prevent benchmark contamination [24].
- VMs are insufficient to contain advanced AI agents, which can escape via host vulnerabilities; minimal-attack-surface virtualization and rapid patching are recommended [25].
- NVIDIA NemoClaw vulnerability (CVE-2026-65105) allows drive-by agent hijacking via DNS rebinding to local Ollama APIs, enabling model poisoning and GPU abuse [26].
- Independent analysis of the OpenAI/Hugging Face incident details complex agent collaboration and transcript tampering [27].
MLOps, DevOps and Infrastructure
- GitHub’s Actions retention now covers checks, workflow runs, and statuses (default 90 days) starting Oct 1, 2026, reducing stale data [28, 29].
- GitHub adds auto-close of issues/PRs from blocked users and enforces a global model policy for Copilot (disabling open-weight/data-retention models by default) [30, 31].
- GitHub secret-scanning lessons: version prompts/models/configs like code and test against production-like ambiguity to cut false positives by 95% [32].
- DuckLabs joins AWS; DuckDB/DuckLake/Quack remain MIT-licensed under the DuckDB Foundation [33, 34].
- Weaviate 1.39 adds Boost API (query-time rescoring) and MMR diversity selection (GA), plus 4-bit rotational quantization (preview) and HNSW snapshot optimizations [35].
- LogDrive introduces a shared-log abstraction (AtomicLog + durability layers) for reusable striping/quorum replication across backends like S3/DynamoDB [36].
- Khaos (Go-rewritten Kafka tool) simulates producers/consumers, broker failures, and backpressure for pre-production testing [37].
- PostgreSQL regex gains: pg_trgm cuts LIKE scans from ~40s to 1.6s on 33 GB tables; pg_re2 offers faster regex with trade-offs [38].
Performance and Systems
- Speculative decoding can speed LLM generation up to 3x using a small draft model and single forward pass [39].
- PagedAttention applies virtual-memory paging to KV caches, achieving ~96% utilization and serving 2–4x more users per GPU [40].
- Cloudflare optimized 1.1.1.1’s DNS cache, cutting per-entry memory by >50%, freeing ~100 TB fleet-wide, while improving insert throughput by 43% and reducing lookup latency by 19% [41].
Security and Compliance
- Ubiquiti patches three CVSS 10 vulnerabilities in UniFi Protect/Talk/OS (command injection, auth bypass via CRLF) [42].
- CISA orders federal agencies to patch actively exploited Oracle flaw (CVE-2026-21962, CVSS 10) by Aug 27 [43].
- Australia warns of active exploitation of JetBrains TeamCity auth bypass (CVE-2026-63077) [44].
- AI-accelerated exploit development collapses patch windows to hours; network-enforced control planes (e.g., dynamic segmentation) are proposed to bridge gaps [45].
Sources
- [AINews] NVIDIA buys HuggingFace for $13B, as OpenAI publishes their HF incident retro latent.space
- Nvidia in Talks to Buy AI Startup Hugging Face bloomberg.com
- Surprise: Z.ai is the AI lab behind the mysterious Ox Alpha model techcrunch.com
- Ox-Alpha Revealed as GLM-5.3-Flash z.ai
- What Z.ai’s Ox Alpha reveals about AI economics thedeepview.com
- Behaviorally Fingerprinting Ox Alpha’s Provenance and Censorship ctgt.ai
- Qwen3.8-Flash-Next simonwillison.net
- Qwen4's architecture is here early, firing 6B parameters out of 125B thenextweb.com
- [AINews] Hot Chips: OpenAI’s Jalapeño, Cerebras CS-5, Groq 3 LPX, Apple M6 latent.space
- Gemini Omni 1.1 Flash lets you build with more control deepmind.google
- Muse Image developer.meta.com
- Intelligent transcription with Gemini 3.5 Transcribe blog.google
- Expanding our support for scientists anthropic news
- Previewing the Model Hardware Standard anthropic news
- Inside LinkedIn’s cognitive memory agent for agentic personalization (32 minute podcast) stackoverflow.blog
- Salesforce just put its entire CRM inside Claude, and says you’ll never need its app again venturebeat.com
- Salesforce, Anthropic expand partnership as Benioff responds to ‘SaaSpocalypse' concerns cnbc.com
- CEO fired developers to make room for AI. Developers create open source AI CEO hnrss.org
- Graph Engineering in the Era of LLM Agents: From Individual Intelligence to System Intelligence arxiv 2608.21156v2
- ChatGPT Now Supports WebMCP nekuda.substack.com
- Introducing Run SDK: Secure Eval for Your Agents vercel.com
- Automatic Harness Optimization github.com
- Why your AI pilot stalled at the context gap dbt.com
- Piloting the world’s first double-blind AI evaluations deepmind.google
- VMs won’t contain cyber-capable agents blog.trailofbits.com
- Drive-By Agent Hijacking: One Website Visit, Persistent Model Poisoning cyera.com
- Brief independent investigation of agents' behavior, reasoning and collaboration in the OpenAI/Hugging Face hacking incident metr.org
- Actions retention will cover checks, workflow runs, and statuses github.blog
- Enterprise-managed settings now support autoUpdate for plugin marketplaces github.blog
- Global model policy generally available github.blog
- Close all open contributions authored by a blocked user github.blog
- How to evaluate LLMs before production github.blog
- DuckLabs to Join AWS, Projects to Remain Open Source ducklabs.com
- DuckDB and the changing physics of analytics allthingsdistributed.com
- Weaviate 1.39 Release weaviate
- The LogDrive: Flexible Composition Through Abstraction in Shared Logs jack-vanlightly.com
- Khaos: Kafka Load Testing & Chaos Engineering github.com
- New things for regular expressions in PostgreSQL: pg_tre and pg_re2 depesz.com
- How to Make LLMs 3X Faster blog.bytebytego.com
- PagedAttention: Virtual Memory for the KV Cache thegustafson.com
- How we saved 100 terabytes of memory by optimizing 1.1.1.1’s DNS cache blog.cloudflare.com
- Ubiquiti Patches Three Max Severity Security Vulnerabilities bleepingcomputer.com
- CISA Orders Federal Agencies to Patch the Actively Exploited Oracle Flaw by August 27 itnerd.blog
- Australia Warns of Active Exploitation of Critical TeamCity Server Flaw infosecurity-magazine.com
- The Patch Window is Collapsing: Why Security Needs a New Control Plane azure.microsoft.com