Aleph Alpha's Kolibri-1 is open weights with a narrowed grant and a pinned-back serving path
Aleph Alpha released Kolibri-1 on 3 October: a bilingual German–English mixture-of-experts reasoning model with 78,103,074,560 total parameters and 3,457,573,120 active per token, 384 routed experts per layer, six active per token, plus one shared, and a tokenizer built for German word structure. Native context is 262,144 tokens, extended to 1,048,576 by extrapolation — though the card itself recommends staying at or below the native length for latency- or throughput-sensitive deployments and for complex tasks, which is the number to plan capacity against. Pre-training ran on 768 Nvidia B200s for 21 days, 392,000 GPU-hours; mid-training added 90,000 and the long-context phase 10,000. The card gives 6.4e23 FLOPs for the run and estimates 950 MWh of energy across those three phases including datacentre overhead — a floor rather than a total, since it excludes fine-tuning, reinforcement learning and the ablation models. The weights are ungated and the LICENSE file is stock, unmodified Apache 2.0: no revenue cap, no model-as-a-service clause, no attribution rider. That is what ungated Apache 2.0 buys you, and it showed — more than two dozen third-party conversions, GGUF through MLX, NVFP4, MXFP4 and GPTQ, appeared on Hugging Face inside two days.
Two things in the fine print matter more than the benchmark table. The model card narrows the grant to "the weights and configuration files published in this repository", adds that "any other artifacts not included in the repository are excluded from the license", and says the licence "especially does not extend to underlying code, model architecture, parameter settings or any training method" — permissive weights, reserved everything else. And serving it today means the lab's own vLLM plugin, aleph-alpha-inference 1.0.0, uploaded to PyPI on 3 October, whose metadata pins vllm>=0.29.0,<0.30.0 — excluding the current stable vLLM 0.30.0 that shipped on 22 September. Every performance figure published so far is the lab's own, measured in its own harness, and its own comparison table shows Kolibri losing to smaller models on several rows; trendingtopics reports that there is no independent ranking yet.
If you run your own GitLab AI gateway, an ordinary developer could have run commands on it
GitLab patched CVE-2026-90970 in its AI Gateway, scored 9.9 on its own assessment. The company says the flaw, "under certain conditions, could have allowed an authenticated user with Duo Agent Platform access to escape the prompt template sandbox via a specially crafted flow configuration, leading to arbitrary command execution on the AI Gateway." Affected versions run from 18.1.6 before 19.2.4, 19.3 before 19.3.2 and 19.4 before 19.4.1. Read the scoping before you page anyone: GitLab has already deployed a fix to its own hosted gateways, and says customers on GitLab.com, GitLab Dedicated and self-managed instances that use a GitLab-hosted gateway "are protected and do not need to take action." The upgrade is for self-hosted AI Gateway installations, and GitLab says it contacted those customers before publishing. BleepingComputer covered it on 2 October.
For the installations that are in scope, the privilege required is the detail to take to your platform team. This is not an admin-only path: it needs a normal authenticated account with Duo access, which in most self-managed setups means any developer. The vector string GitLab publishes carries the scope-change flag, meaning the impact is not contained within the gateway's own security boundary — and the AI Gateway is the component that brokers model calls, so it holds provider credentials and sees prompts. Self-hosting that gateway is usually a sovereignty decision, taken so prompts and keys never leave your estate. It works, and it also means the patching is yours.
Italy fined IQVIA €7m for calling a million patients' coded records anonymous
The Garante announced on 2 October a €7m fine on IQVIA Solutions Italy over a health database built from the records of about a million patients of 800 general practitioners, used for studies commissioned by, among others, pharmaceutical companies. The company treated the data as anonymous. The regulator did not: a per-patient code that let each subject be followed over time, combined with a very detailed information set — birth year, sex, diagnoses, symptoms, prescriptions, tests, vaccinations and location data — made it possible to isolate individual patients and re-identify them "con mezzi ragionevoli", by reasonable means. The decision also found more than 3,300 patients held with direct identifiers, over 3,000 of them alongside health data.
Two holdings do the work. IQVIA was found to be controller from the moment the data was collected at the doctors' surgeries — not a processor receiving a cleaned extract — and the coded records were personal data throughout. Everything else follows: the decision sanctions breaches of Articles 5, 9, 13, 25, 28, 32 and 35, covering legal basis, information to patients, retention on records going back to 2001, data protection by design, the controller–processor arrangements, security and the missing impact assessment. IQVIA has 120 days to comply if it intends to continue, or the doctors can anonymise the data themselves first. For anyone holding a de-identified corpus for secondary analytics or model training, the operative question is not whether the names came out: it is whether a persistent per-subject key plus a rich attribute set gets you back to a person. That reading arrives four weeks before the EDPB's own anonymisation guidelines close for comment.
Quick Hits
- Cloudflare's Clef now runs in llama.cpp, and the licensing contrast in the support table is worth a minute. A 2 October post from the ggml team introduced the /v1/systemone endpoint, now documented in llama.cpp's own server reference with clef registered as a model architecture in master: you post a state plus typed questions — choice returns the top option plus a probability per option, score an expected level, noul the probability of yes — with no generated tokens. The table pairs two unrelated labs' 27B models on the same Qwen3.8-27B base under opposite terms: Cloudflare's Clef under Apache 2.0, English-only, and openjev's OpenJev under CC BY-NC 4.0, covering six languages. The quoted 3–43 ms latencies are the authors' own, median time to answer one question on a single RTX PRO 6000, and they cover the other five models; Clef's own latency cell is blank.
- An independent score for inclusionAI's Ling 3.1 Flash, with no weights behind it yet. Artificial Analysis puts it at 41 on its Intelligence Index against a median of 19 for open-weight models of similar size, and 210.7 output tokens per second against a 71.0 median, at $0.30 and $0.90 per million input and output tokens with a 1M-token context — all measured on inclusionAI's own endpoint, for a model it dates to 1 October. No Ling 3.1 repository has appeared in inclusionAI's Hugging Face account, whose newest repository dates from 24 September, so the open-weight comparison group is for now aspirational.
- LiteLLM's proxy now refuses to start without a master key, and the version numbers are out of order. 1.104.0 went to PyPI on 3 October at 22:42 UTC, and its release notes list as a breaking change that the proxy will "refuse to start with an unset, empty, or publicly known master key", plus breached-password detection, forced resets for compromised credentials and an end to shipping sk-1234 as an example key. Watch the ordering: 1.103.3 was published 46 minutes after 1.104.0, and 1.105.0rc1 hours after that, so anyone pinned to the 1.103.x line cannot assume the newer minor contains that patch.
- The MCP Python SDK turned a silent failure into a loud one. 2.3.0 (PyPI, 2 October 22:06 UTC) raises the httpx2 floor to 2.10.0 and makes tools with invalid x-mcp-header annotations raise at registration, naming the tool and the problem, where previously the server started and clients silently dropped the tool from their listing. Separately, published 3.4.8 and 4.0.11 two and a half minutes apart on 4 October with eleven entries under a security heading — among them passing client CLI arguments literally to Windows .cmd wrappers, and bounding schema nesting before client type conversion. A simultaneous dual-branch publish is the usual shape of a backport.