This week's news spans two fronts that matter directly for voice AI and contact-center builders: a wave of new or upgraded models (DeepSeek, Meta's Muse Spark Open, Reflection's Beam, IBM's Granite Switch, Liquid AI's LFM2.5, Apertus 1.5, Mistral's Timestral) expanding what's available for reasoning, tool use and multimodal understanding, and a steady drumstream of critical, actively exploited vulnerabilities (BeyondTrust, Fortinet, Ivanti, GitLab, Windows) that put patching and identity hardening back on every team's agenda. On the voice side specifically, there's concrete evidence that STT choice materially affects conversational quality, and that pricing-free voice customization is becoming standard. Agent governance and observability tooling (AWS Trust in Depth, Claude tracing, MCP support in Apigee) is maturing in parallel, signaling that production-grade agent deployments now expect built-in guardrails and traceability rather than bolt-on fixes. Overall, the throughline is: more capable building blocks, but also higher stakes for security and reliability engineering around them.
Key takeaways
Deepgram's Flux STT model cut unwanted barge-ins by ~50% in real-time avatar conversations versus a self-hosted STT baseline — worth A/B testing turn-taking performance against your current STT stack.
OpenAI now offers free prompt-to-voice custom voice design across the GPT-Live API, lowering the barrier to differentiated branded voices in live sessions.
xAI shipped Grok Voice 3.0 as a drop-in upgrade via the grok-voice-latest alias with no price change — check if your integration picks it up automatically and benchmark quality shifts.
FlowSpec shows a small fine-tuned model can follow new regulated call scripts without retraining, relevant for compliance-heavy contact-center workflows needing rapid script updates.
Multiple actively exploited vulnerabilities (BeyondTrust, Fortinet, Ivanti Connect Secure, GitLab, Windows) are now on CISA's must-patch list — audit remote-access and CI/CD infrastructure used by any voice/agent pipelines.
New governance and tracing tooling (AWS Trust in Depth, Claude OpenTelemetry tracing, Apigee MCP support) make it easier to add runtime guardrails and observability to tool-calling agents — worth evaluating for production agent deployments.
CISA has flagged CVE-2026-102764, a critical authentication bypass affecting self-hosted BeyondTrust Remote Support versions 26.2.3 and earlier. Threat actors are actively using it to gain initial access, establish persistence, escalate privileges, and move laterally inside networks. The flaw was added to CISA's Known Exploited Vulnerabilities catalog on October 16, 2026, and a patch (BT26-05-RS) is available for supported versions 24.3.1 and later.
Attackers are already exploiting CVE-2026-104935, a flaw that lets them skip login entirely and run arbitrary commands on Ivanti Connect Secure appliances. The bug hits versions 25.1.1.1 and earlier, 25.1.2.2 and earlier, and 22.8R2.4 and earlier, and is being used for credential theft and data exfiltration. CISA added it to its Known Exploited Vulnerabilities list on October 13, 2026 and is pushing organizations to update without delay.
On 12 October 2026 GitLab shipped versions 19.4.2, 19.3.4 and 19.2.8, closing 24 security holes in self-managed CE/EE. The headline fix is CVE-2026-97229, a CVSS 10.0 bug in the CI/CD regex compiler where weak expression validation causes an integer overflow, letting an unauthenticated attacker craft a CI/CD configuration that executes code on the server. CERT-EU is pushing organisations to patch immediately, with internet-facing GitLab instances first in line.
DeepSeek released DeepSeek-V4.1-Flash-1017, an upgraded version of its Flash model, accessible through the same API endpoint and pricing as before. The update brings notable gains across agentic, coding, and tool-use benchmarks while reducing task runtime and output length. DeepSeek also detailed its in-house search engine, which now powers both web/app search and a developer-facing Search & Fetch API.
Google Research describes new work on grounding AI agents in physical lab reality, using a digital-twin framework called VERID to let agents safely plan and execute liquid-handling robot protocols. Combined with closed-loop molecular design cycles for aptamers and proteins, the agents iteratively learned from wet-lab results, improving hit rates over multiple rounds and discovering single-digit nanomolar protein binders for a cancer-related target.
Real-world exploitation has pushed CISA to list two fresh vulnerabilities in its Known Exploited Vulnerabilities (KEV) Catalog: a path traversal bug spanning multiple Fortinet products (CVE-2025-61624) and an authentication-bypass-by-spoofing flaw in BeyondTrust Remote Support (CVE-2026-102764). Because both are already being abused by attackers, Binding Operational Directive 26-04 forces federal civilian agencies to fast-track fixes on any internet-facing systems where exploitation could hand over full control. The directive also requires agencies to check whether a system was already breached before the patch lands. CISA is urging every organization, not only government ones, to follow the same prioritized patching logic.
NIST's Super Intelligence Security Center, together with the NSA and CISA, released a joint publication outlining ten voluntary core practices for organizations that train and evaluate highly capable 'super intelligence' (SI) agents, especially pre-deployment or high-risk non-public systems. The guidance defines an 'SI control incident' as an AI agent taking uninstructed actions that bypass or compromise human oversight and security controls. It builds on existing cyber incident response practices but adds AI-specific steps such as testing containment and validating it before resuming agent activity.
Mistral AI has launched Timestral, its first family of time-series foundation models, available in four sizes from 5M to 209M parameters. The largest model ranks first on all three major public forecasting benchmarks (GIFT-Eval, TIME, fev-bench), beating previous state-of-the-art models that have more parameters. The models produce probabilistic, multivariate forecasts, support past and known-future covariates, and run efficiently on CPUs without needing a GPU.
DeepSeek released DeepSeek-V4.1-Flash-1017, an upgraded version of its Flash model, accessible through the same API endpoint and pricing as before. The update brings notable gains across agentic, coding, and tool-use benchmarks while reducing task runtime and output length. DeepSeek also detailed its in-house search engine, which now powers both web/app search and a developer-facing Search & Fetch API.
OpenAI has rolled out prompt-to-voice access to all GPT-Live API customers, allowing a spoken voice to be designed simply by describing it in text, either through the API or the voice Playground, and then reused inside live voice sessions. Designing the voice costs nothing, but speaking with it still runs on normal GPT-Live session billing. Alongside this rollout, nine additional built-in voices covering German, French, Hindi, Japanese and Korean were added to the platform.
Reflection, a new US AI lab, has launched Beam, its first model, as an open-weight mixture-of-experts system with 501B total parameters (23B active per token) and a 1M-token context window, released under Apache 2.0. The model is built for coding and agentic use cases, ships with a custom Rust-based inference harness, and has day-0 support in transformers, vLLM and SGLang. Reflection reports strong results on coding, reasoning and tool-calling benchmarks across BF16, FP8 and NVFP4 checkpoints.
IBM has released Granite Switch 4.1 in 8B and 30B sizes, a modular system that runs chat, decision-making and speech transcription from one hosted endpoint instead of separate models. The update adds a general-purpose Decision adapter, a specialized Guardian adapter for safety-related classifications, and an embedded ASR model, Granite-Speech-5.0-Turbo-CTC, which tops the OpenASR Leaderboard. Despite bundling three capabilities, the combined model uses roughly the same VRAM as the base model alone.
Meta published Muse Spark Open, an open-weight mixture-of-experts model with about 816 billion total parameters and 42 billion active per token. It accepts text, images, audio and video as input and generates text, with a context window of up to 1 million tokens. Meta positions it as a coding-optimized, agentic model built on top of the smaller Muse Glimmer architecture, calling it the most capable US open-weights model released so far.
OpenAI has rolled out prompt-to-voice access to all GPT-Live API customers, allowing a spoken voice to be designed simply by describing it in text, either through the API or the voice Playground, and then reused inside live voice sessions. Designing the voice costs nothing, but speaking with it still runs on normal GPT-Live session billing. Alongside this rollout, nine additional built-in voices covering German, French, Hindi, Japanese and Korean were added to the platform.
Anam, which builds photorealistic interactive avatars, switched to Deepgram's Flux speech-to-text model to solve turn-taking problems in unscripted, real-time conversation. In A/B testing against a self-hosted open-source STT option, Flux cut unwanted avatar barge-ins by roughly 50% with no added latency penalty, and complaints about turn-taking on English sessions dropped to near zero. Anam deployed Flux self-hosted on its own Kubernetes/H100 infrastructure, rolling it out to 100% of turnkey users after a two-week self-hosted deployment (versus days for Deepgram's hosted option).
xAI has rolled out Grok Voice 3.0, its latest speech-to-speech voice model, without changing pricing from the prior Grok Voice 2.0. Developers who reference the grok-voice-latest alias get the new model automatically, with no code changes needed. The API itself remains the same as before.
Researchers describe a system called FlowSpec that converts a creditor's legal call procedure into machine-readable instructions, tool restrictions, training signals and test cases for a voice agent. A 9-billion-parameter model was trained on calls covering nearly 300 randomly generated procedures, then tested on four procedures it had never encountered, including one entirely held-out family of scripts, to see whether compliance behavior transfers.
AWS published a governance framework called Trust in Depth, designed to let AI agents operate with more autonomy while staying within enforceable limits. It combines scoping agent permissions before deployment, giving each agent a verifiable identity, enforcing boundaries at runtime via policy gateways, and observing agent behavior afterward. The framework leans on automated reasoning (mathematical proof) for rules that can be precisely defined, and human judgment for ambiguous cases, using AWS tools like Bedrock AgentCore, Guardrails, Kiro, Strands, Agent Registry and CloudWatch Omni.
Google has released Apigee hybrid 1.17.0 (September 14, 2026), adding Model Context Protocol (MCP) support that runs entirely inside a customer's own Kubernetes cluster rather than on Google-managed infrastructure. This lets organizations with data-residency or regulatory requirements turn existing OpenAPI-described APIs into AI-agent-callable tools without MCP request traffic leaving their network. The feature reuses existing Apigee identity, security policies and API product controls, and it is an optional, off-by-default capability enabled via a Helm chart upgrade.
Cohere built a controlled testbed to study how teams of coding agents should be organized, testing where work is delegated, how leads wait on workers, which models play which role, team size, and communication patterns. On ProgramBench, well-organized teams outperformed single agents by up to ~10 percentage points but at 3–7x higher cost. The key finding: delegating only exploration and planning to workers matched the performance of delegating all stages (implementation and verification too) at half the cost, and a strong lead paired with 16 cheap planning workers reached 61.8% reward versus 63.2% for an all-strong-model team, cutting cost from $510 to $155.
Orca Security built Discovery AI, an Amazon Bedrock-based agent that turns plain-English security questions into structured queries against its Sonar system, which tracks over 900 cloud resource types. Rather than relying on one large model with the full schema stuffed into every prompt, the production version splits the work across nine specialized stages and multiple foundation models. The result: dramatically lower cost, faster responses, and better accuracy on complex queries, now running live since March 2026.
Google Cloud published a reference architecture for building AI agents that coordinate long-running, GPU-heavy scientific tasks like protein folding and compound screening, which break standard single-LLM-agent setups due to timeouts and context overflow. The design separates a cognitive orchestrator (Gemini on Agent Runtime) from a GPU execution layer (NVIDIA NIMs like ESMFold and GenMol on GKE) and wraps both in an enterprise governance plane with agent identity, a gateway, a registry and Model Armor. It also lays out best practices such as passing bulky data by reference instead of inline, streaming progress updates, and gating irreversible actions behind human approval.
DeepSeek released DeepSeek-V4.1-Flash-1017, an upgraded version of its Flash model, accessible through the same API endpoint and pricing as before. The update brings notable gains across agentic, coding, and tool-use benchmarks while reducing task runtime and output length. DeepSeek also detailed its in-house search engine, which now powers both web/app search and a developer-facing Search & Fetch API.
OpenAI has rolled out prompt-to-voice access to all GPT-Live API customers, allowing a spoken voice to be designed simply by describing it in text, either through the API or the voice Playground, and then reused inside live voice sessions. Designing the voice costs nothing, but speaking with it still runs on normal GPT-Live session billing. Alongside this rollout, nine additional built-in voices covering German, French, Hindi, Japanese and Korean were added to the platform.
Google has announced support for DPoP (Demonstrating Proof-of-Possession, RFC 9449) in its OAuth platform, cryptographically binding refresh tokens to a client-generated key pair so stolen tokens cannot be replayed by attackers. The protection applies only to long-lived refresh tokens, while short-lived access tokens remain standard Bearer tokens to avoid added cryptographic overhead on high-throughput API calls. Google also highlights DPoP's relevance for securing multi-agent and Model Context Protocol (MCP) architectures, recommending Google Cloud Secure Token Service for token delegation chains between agents.
Google has released Apigee hybrid 1.17.0 (September 14, 2026), adding Model Context Protocol (MCP) support that runs entirely inside a customer's own Kubernetes cluster rather than on Google-managed infrastructure. This lets organizations with data-residency or regulatory requirements turn existing OpenAPI-described APIs into AI-agent-callable tools without MCP request traffic leaving their network. The feature reuses existing Apigee identity, security policies and API product controls, and it is an optional, off-by-default capability enabled via a Helm chart upgrade.
xAI has rolled out Grok Voice 3.0, its latest speech-to-speech voice model, without changing pricing from the prior Grok Voice 2.0. Developers who reference the grok-voice-latest alias get the new model automatically, with no code changes needed. The API itself remains the same as before.
DeepSeek released DeepSeek-V4.1-Flash-1017, an upgraded version of its Flash model, accessible through the same API endpoint and pricing as before. The update brings notable gains across agentic, coding, and tool-use benchmarks while reducing task runtime and output length. DeepSeek also detailed its in-house search engine, which now powers both web/app search and a developer-facing Search & Fetch API.
OpenAI has rolled out prompt-to-voice access to all GPT-Live API customers, allowing a spoken voice to be designed simply by describing it in text, either through the API or the voice Playground, and then reused inside live voice sessions. Designing the voice costs nothing, but speaking with it still runs on normal GPT-Live session billing. Alongside this rollout, nine additional built-in voices covering German, French, Hindi, Japanese and Korean were added to the platform.
Reflection, a new US AI lab, has launched Beam, its first model, as an open-weight mixture-of-experts system with 501B total parameters (23B active per token) and a 1M-token context window, released under Apache 2.0. The model is built for coding and agentic use cases, ships with a custom Rust-based inference harness, and has day-0 support in transformers, vLLM and SGLang. Reflection reports strong results on coding, reasoning and tool-calling benchmarks across BF16, FP8 and NVFP4 checkpoints.
xAI has rolled out Grok Voice 3.0, its latest speech-to-speech voice model, without changing pricing from the prior Grok Voice 2.0. Developers who reference the grok-voice-latest alias get the new model automatically, with no code changes needed. The API itself remains the same as before.
Orca Security built Discovery AI, an Amazon Bedrock-based agent that turns plain-English security questions into structured queries against its Sonar system, which tracks over 900 cloud resource types. Rather than relying on one large model with the full schema stuffed into every prompt, the production version splits the work across nine specialized stages and multiple foundation models. The result: dramatically lower cost, faster responses, and better accuracy on complex queries, now running live since March 2026.
Google Research describes new work on grounding AI agents in physical lab reality, using a digital-twin framework called VERID to let agents safely plan and execute liquid-handling robot protocols. Combined with closed-loop molecular design cycles for aptamers and proteins, the agents iteratively learned from wet-lab results, improving hit rates over multiple rounds and discovering single-digit nanomolar protein binders for a cancer-related target.
Microsoft Research released Magnetar, a zero-knowledge virtual machine (zkVM) capable of generating cryptographic proofs that a program executed correctly, without needing anyone to rerun it or trust the operator. Instead of forcing developers to rewrite applications as custom cryptographic circuits, Magnetar proves standard RISC-V machine code, so programs written in Rust, Go, or C can be compiled normally and proven as-is. Benchmarks across 15 programs show it processing 7.2 to 8.7 million instructions per second on a laptop, with proofs checkable in roughly 12 milliseconds, and its cryptographic security depends only on established hash functions like SHA-256 or SHA-3 rather than elliptic curves or lattice-based schemes.
IBM Research used a coordinated multi-agent 'agent factory' to explore hardware design optimizations for a quantum error-correction decoder, comparing proprietary and open frontier models under the same 100-hypothesis search budget. The open-model configuration, run on-premises via IBM's llm-d distributed inference framework, achieved a 52x speedup over baseline for about $26 in inference cost, versus $299 for a proprietary-model configuration that reached a higher 204x speedup. The study highlights that cache-aware routing and efficient serving (98% prefix-cache hit rate, ~$0.11 per million tokens) made the open-model approach dramatically cheaper while still finding valid, compact hardware designs.
Amazon Web Services researchers published a method called 'priming' that converts pretrained Transformer models into hybrid architectures mixing attention and state space model (SSM) layers, reusing existing weights instead of retraining from scratch. The approach cuts pretraining costs by over 99% and lets a 32-billion-parameter hybrid model match its source Transformer's quality while decoding up to twice as fast. Amazon tested three SSM types and released an open-source model zoo, training code, and serving tools under Apache 2.0.
NVIDIA, working with IIT Madras's AI4Bharat lab, is releasing Nemotron-pretraining-Indic-v1, a roughly 2.8 trillion token synthetic pretraining corpus covering 22 Indian languages, along with the open GPU-accelerated pipeline used to generate it. The corpus includes native-script data for all 22 languages and romanized text for twelve, built by translating curated English source material (web text, math, code, Q&A) using NeMo Data Designer and quality-checked with an MQM-inspired rubric. NVIDIA already used a 10-billion-token Indic subset for continued pretraining of Nemotron 3.5 Super VL, which showed measurable gains on Indic benchmarks.
CISA has flagged CVE-2026-102764, a critical authentication bypass affecting self-hosted BeyondTrust Remote Support versions 26.2.3 and earlier. Threat actors are actively using it to gain initial access, establish persistence, escalate privileges, and move laterally inside networks. The flaw was added to CISA's Known Exploited Vulnerabilities catalog on October 16, 2026, and a patch (BT26-05-RS) is available for supported versions 24.3.1 and later.
Attackers are already exploiting CVE-2026-104935, a flaw that lets them skip login entirely and run arbitrary commands on Ivanti Connect Secure appliances. The bug hits versions 25.1.1.1 and earlier, 25.1.2.2 and earlier, and 22.8R2.4 and earlier, and is being used for credential theft and data exfiltration. CISA added it to its Known Exploited Vulnerabilities list on October 13, 2026 and is pushing organizations to update without delay.
On 12 October 2026 GitLab shipped versions 19.4.2, 19.3.4 and 19.2.8, closing 24 security holes in self-managed CE/EE. The headline fix is CVE-2026-97229, a CVSS 10.0 bug in the CI/CD regex compiler where weak expression validation causes an integer overflow, letting an unauthenticated attacker craft a CI/CD configuration that executes code on the server. CERT-EU is pushing organisations to patch immediately, with internet-facing GitLab instances first in line.
Real-world exploitation has pushed CISA to list two fresh vulnerabilities in its Known Exploited Vulnerabilities (KEV) Catalog: a path traversal bug spanning multiple Fortinet products (CVE-2025-61624) and an authentication-bypass-by-spoofing flaw in BeyondTrust Remote Support (CVE-2026-102764). Because both are already being abused by attackers, Binding Operational Directive 26-04 forces federal civilian agencies to fast-track fixes on any internet-facing systems where exploitation could hand over full control. The directive also requires agencies to check whether a system was already breached before the patch lands. CISA is urging every organization, not only government ones, to follow the same prioritized patching logic.
NIST's Super Intelligence Security Center, together with the NSA and CISA, released a joint publication outlining ten voluntary core practices for organizations that train and evaluate highly capable 'super intelligence' (SI) agents, especially pre-deployment or high-risk non-public systems. The guidance defines an 'SI control incident' as an AI agent taking uninstructed actions that bypass or compromise human oversight and security controls. It builds on existing cyber incident response practices but adds AI-specific steps such as testing containment and validating it before resuming agent activity.
DeepSeek released DeepSeek-V4.1-Flash-1017, an upgraded version of its Flash model, accessible through the same API endpoint and pricing as before. The update brings notable gains across agentic, coding, and tool-use benchmarks while reducing task runtime and output length. DeepSeek also detailed its in-house search engine, which now powers both web/app search and a developer-facing Search & Fetch API.
OpenAI has rolled out prompt-to-voice access to all GPT-Live API customers, allowing a spoken voice to be designed simply by describing it in text, either through the API or the voice Playground, and then reused inside live voice sessions. Designing the voice costs nothing, but speaking with it still runs on normal GPT-Live session billing. Alongside this rollout, nine additional built-in voices covering German, French, Hindi, Japanese and Korean were added to the platform.
IBM has released Granite Switch 4.1 in 8B and 30B sizes, a modular system that runs chat, decision-making and speech transcription from one hosted endpoint instead of separate models. The update adds a general-purpose Decision adapter, a specialized Guardian adapter for safety-related classifications, and an embedded ASR model, Granite-Speech-5.0-Turbo-CTC, which tops the OpenASR Leaderboard. Despite bundling three capabilities, the combined model uses roughly the same VRAM as the base model alone.
Google has announced support for DPoP (Demonstrating Proof-of-Possession, RFC 9449) in its OAuth platform, cryptographically binding refresh tokens to a client-generated key pair so stolen tokens cannot be replayed by attackers. The protection applies only to long-lived refresh tokens, while short-lived access tokens remain standard Bearer tokens to avoid added cryptographic overhead on high-throughput API calls. Google also highlights DPoP's relevance for securing multi-agent and Model Context Protocol (MCP) architectures, recommending Google Cloud Secure Token Service for token delegation chains between agents.
Meta published Muse Spark Open, an open-weight mixture-of-experts model with about 816 billion total parameters and 42 billion active per token. It accepts text, images, audio and video as input and generates text, with a context window of up to 1 million tokens. Meta positions it as a coding-optimized, agentic model built on top of the smaller Muse Glimmer architecture, calling it the most capable US open-weights model released so far.
AWS published a governance framework called Trust in Depth, designed to let AI agents operate with more autonomy while staying within enforceable limits. It combines scoping agent permissions before deployment, giving each agent a verifiable identity, enforcing boundaries at runtime via policy gateways, and observing agent behavior afterward. The framework leans on automated reasoning (mathematical proof) for rules that can be precisely defined, and human judgment for ambiguous cases, using AWS tools like Bedrock AgentCore, Guardrails, Kiro, Strands, Agent Registry and CloudWatch Omni.
Swiss AI released Apertus 1.5, a continued pretraining of its open Apertus 1.0 models (8B and 70B, Apache 2.0) with native image and experimental audio understanding, a 4x larger context window of 262,144 tokens, an optional thinking mode, and improved instruction-following and tool use. The models were trained on a total of 19T (8B) and 17T (70B) tokens, with full training data, recipes and intermediate checkpoints published for reproducibility. The team also published detailed, standardized evaluation cards and announced early API access from providers like Swisscom and Infomaniak, plus a roadmap for a ~600B-parameter MoE Apertus 2.0.
Anam, which builds photorealistic interactive avatars, switched to Deepgram's Flux speech-to-text model to solve turn-taking problems in unscripted, real-time conversation. In A/B testing against a self-hosted open-source STT option, Flux cut unwanted avatar barge-ins by roughly 50% with no added latency penalty, and complaints about turn-taking on English sessions dropped to near zero. Anam deployed Flux self-hosted on its own Kubernetes/H100 infrastructure, rolling it out to 100% of turnkey users after a two-week self-hosted deployment (versus days for Deepgram's hosted option).
CISA has flagged CVE-2026-102764, a critical authentication bypass affecting self-hosted BeyondTrust Remote Support versions 26.2.3 and earlier. Threat actors are actively using it to gain initial access, establish persistence, escalate privileges, and move laterally inside networks. The flaw was added to CISA's Known Exploited Vulnerabilities catalog on October 16, 2026, and a patch (BT26-05-RS) is available for supported versions 24.3.1 and later.
Attackers are already exploiting CVE-2026-104935, a flaw that lets them skip login entirely and run arbitrary commands on Ivanti Connect Secure appliances. The bug hits versions 25.1.1.1 and earlier, 25.1.2.2 and earlier, and 22.8R2.4 and earlier, and is being used for credential theft and data exfiltration. CISA added it to its Known Exploited Vulnerabilities list on October 13, 2026 and is pushing organizations to update without delay.
On 12 October 2026 GitLab shipped versions 19.4.2, 19.3.4 and 19.2.8, closing 24 security holes in self-managed CE/EE. The headline fix is CVE-2026-97229, a CVSS 10.0 bug in the CI/CD regex compiler where weak expression validation causes an integer overflow, letting an unauthenticated attacker craft a CI/CD configuration that executes code on the server. CERT-EU is pushing organisations to patch immediately, with internet-facing GitLab instances first in line.
DeepSeek released DeepSeek-V4.1-Flash-1017, an upgraded version of its Flash model, accessible through the same API endpoint and pricing as before. The update brings notable gains across agentic, coding, and tool-use benchmarks while reducing task runtime and output length. DeepSeek also detailed its in-house search engine, which now powers both web/app search and a developer-facing Search & Fetch API.
Real-world exploitation has pushed CISA to list two fresh vulnerabilities in its Known Exploited Vulnerabilities (KEV) Catalog: a path traversal bug spanning multiple Fortinet products (CVE-2025-61624) and an authentication-bypass-by-spoofing flaw in BeyondTrust Remote Support (CVE-2026-102764). Because both are already being abused by attackers, Binding Operational Directive 26-04 forces federal civilian agencies to fast-track fixes on any internet-facing systems where exploitation could hand over full control. The directive also requires agencies to check whether a system was already breached before the patch lands. CISA is urging every organization, not only government ones, to follow the same prioritized patching logic.
·CISA Advisories
AI Weekly · 12 Oct 2026 – 19 Oct 2026 · TENESYS AI NEWS