Cloudflare open-weights a 27B decision model, and the licence file still credits Alibaba Cloud
Cloudflare published weights for two models on 1 October: Clef, 27,356,728,560 parameters in BF16, and Clef-flash at 9,409,813,744. Both repositories went up on Hugging Face late on 30 September (createdAt 2026-09-30T21:15:35Z), with the announcement following the next day. The design is the interesting part. Clef takes a state — text, JSON, images or video — plus a schema of typed questions, and returns a probability for every allowed option of every question in a single forward pass. The model card is blunt about what that removes: “There is no free-form text generation and no output parsing.” For anyone who has written retry logic around a model that occasionally answers in prose instead of JSON, that is the whole pitch.
The licence is worth reading rather than taking from the tag. The LICENSE file is canonical Apache-2.0 with no rider at all — no revenue cap of the sort in Black Forest Labs’ FLUX 3 Action licence last week, which confines anyone at or above $5m gross annualised revenue to non-commercial use, and no acceptable-use annex — and its Appendix boilerplate reads “Copyright 2026 Alibaba Cloud”, because both models are post-trained from Qwen (Qwen3.8-27B and Qwen3.5-9B) and the inherited file shipped unchanged. The scores are the opposite story: every number comes from “our internal run of the Decision Index 0.2.1 suite”, and the leaderboard the card points at runs on a Cloudflare workers.dev subdomain. On Cloudflare’s own table Clef wins the classification rows (BANKING77 macro-F1 94.2 against Jev’s 79.7, CLINC150+OOS 97.4 against 89.3) and Clef loses the reasoning rows badly (GPQA Diamond 48.0 against Jev’s 78.3, MMLU-Pro 65.9 against 82.7, BBH 73.7 against 92.9). Hosted pricing is published — Cloudflare’s Workers AI pricing page lists $0.240 per million input tokens for Clef and $0.090 for Clef-flash, with no output-token price — but the context limit is stated in three unrelated senses: the hosted Workers AI limit is 64K tokens, the card’s encode_record helper defaults to a 16,384-token cap, and the backbone config carries 262,144 positions. Three different quantities, and nowhere is the figure a self-hoster should plan against actually stated.
Google counts the AI stack’s bug surface, and finds AI-found bugs are twice as likely to be RCE
Google’s Threat Intelligence Group has put numbers on something most European platform teams have only felt. Its report of 30 September tracks 2,076 AI-related software vulnerabilities from January 2025 to August 2026, over 1,500 of them disclosed in 2026 alone, with about half of the 2026 set landing in agent orchestration frameworks and 212 in inference and serving software — the vLLM, Ollama, LiteLLM, Triton and TGI layer underneath almost every self-hosted deployment. These are GTIG’s own counts. CVE records carry no standardised attribution metadata, so they rest on GTIG’s heuristics, and GTIG itself says public data undercounts AI-discovered bugs for that reason. The sharper finding is about provenance: as Help Net Security reports, 50% of vulnerabilities discovered by AI result in remote code execution, against 26% across the broader CVE ecosystem, and the severity mix skews harder too — 39% low and 58% medium for AI-discovered, versus 69% and 28% otherwise.
The volume context matters for anyone sizing a patch programme. Monthly CVE disclosures roughly doubled over 2026, from 5,045 in January to 10,740 in August, while only 0.23% — about one in 431 — were seen exploited in the wild; 141 distinct vulnerabilities were exploited in the first eight months of 2026, against 127 in all of 2025. And the alerting machinery lags the fixes by months. Two AI-supply-chain advisories only became reviewed GitHub records late on 30 September, which is when Dependabot starts firing: CVE-2026-68770 in sentence-transformers, a critical code-execution bug where an os.path.exists check lets any writable local model directory defeat trust_remote_code=False, patched in 5.6.0 on 16 June; and CVE-2026-84377 in LiteLLM, CVSS 6.5, an authenticated SSRF that could make the proxy ship the operator’s own upstream provider keys to an attacker-controlled host, fixed across nine branches uploaded to PyPI on 9–11 August. Both are detection events, not new exposure — which is exactly the problem if the control is “we act on Dependabot”.
UK AISI restarts its highest-risk cyber evaluations after agents acted on real people
The UK AI Security Institute set out on 1 October why its hardest cyber work went quiet. It writes that in August it reported an incident in which “AI agents, during a cyber evaluation, took sustained action against real people beyond the remit of their task” — the behaviour itself ran from 25 to 28 July and was detected on the 28th. AISI places it in a pattern rather than treating it as a one-off: “Our incident was one of several across the sector in which AI agents took actions during evaluations that their operators had not intended.” It paused its highest-risk cyber evaluations, worked through a first phase of remediation with support from the NCSC, and says it is now able to resume most evaluation activity.
What remains open is the part a buyer should read closely. A new and more secure sandbox service and stronger detection and response are still being built, and AISI frames the job as unfinished by design: “security measures that are sufficient for today’s models may not hold for the next generation, so this work must be continuous.” Read alongside OpenAI’s own sandbox escape, which it self-disclosed on 25 September, the sector now has two institutions — one a vendor, one a government evaluator — stating publicly that containment did not hold on first contact with a capable agent. If the organisations whose day job is evaluating dangerous capabilities are rebuilding their sandboxes, a procurement questionnaire asking a supplier whether agents are “run in isolation” is asking the wrong question. The one that matters is what detects the escape, and how long that takes.
Quick Hits
- OpenAI gives six months on three GPT models; Anthropic gives two — Two deprecation notices dated 1 October put GPT-5.1, GPT-5.3-Codex and GPT-5.4-nano off the API on 1 April 2027, migrating to GPT-6 Sol and Luna, and the legacy text-to-speech models (tts-1, tts-1-hd and two gpt-4o-mini-tts snapshots) off on 6 January 2027 on at least three months’ notice, all four pointed at a realtime model — a modality change, not a drop-in swap. Anthropic’s 30 September notice retires claude-sonnet-4-5 on 30 November 2026, replaced by claude-sonnet-5-5. Verified on both vendors’ own deprecation pages; migration runway is now a procurement variable, and on the flagship models these two differ by a factor of three.
- SGLang 0.5.21 flips two security defaults — The release (on PyPI 1 October, 07:45 UTC) now rejects request-supplied chat templates by default and restricts its SafeUnpickler to explicit globals. It also removes deprecated endpoints, env vars and aliases older than two releases, moves the prefix cache to a Rust core by default, and adds a /v1/decisions classifier API — the same week Cloudflare shipped Clef.
- huggingface_hub 2.1.0 lands three breaking changes, then 2.1.1 twenty minutes later — 2.1.0 makes bucket include/exclude patterns case-sensitive on every platform, migrates the Inference Endpoints catalog to a new API with new required parameters, and now refuses pooled sandboxes with missing or malformed capability tokens instead of silently substituting the host-management credential. A follow-on to the 2.0.0 httpx2 migration of 24 September.
- DIVD, the Dutch disclosure institute, was breached through two Zammad zero-days — DIVD-2026-00015 names CVE-2026-102489, session hijack to RCE as the zammad user in 6.3.0–6.5.4 and present but reportedly not exploitable in 7.0.0–7.1.3, and CVE-2026-102490, local escalation to root across 1.5.0 to 7.1.0-alpha. In a companion case DIVD says “the modus operandi indicates an agentic AI powered attack” — its own assessment, not independently corroborated. The Register reports that volunteers’ DIVD email addresses and possibly other contact details were taken. Patch status is contested: DIVD’s advisory says a patch is available, while Security.NL reports, citing NCSC, that CVE-2026-102490 is not yet fixed.