Nscale's European sites are the minority of its megawatts
Nscale Limited, incorporated in England and Wales and headquartered in London, filed a Form S-1 with the SEC on 18 September and says it intends to apply to list on the NYSE as NSCL, re-registering as Nscale plc before the offering. Revenue was $140.6m in the first half of 2026 against $10.4m a year earlier, and $33.0m for all of 2025; net loss was $1,020.1m for the half. The filing states that as of 31 August 2026 the company had “approximately $2.6 billion of active and $103.4 billion of active and contracted TCV under long-term take-or-pay contracts with customers”, at a weighted average contract life of about 5.7 years. Offering size and price range are still blank on the cover page.
The European sites are real — Glomfjord in Norway, plus Iceland, the UK, and the 200MW SIN02 site at Sines in Portugal, acquired in April and earmarked for Vera Rubin hardware for Microsoft from late 2027. But the portfolio table lists 17 sites, and four of them are American, carrying 770 of 1,370 contracted IT megawatts — 56%, including the single largest site at 460MW. The concentration figure sits in the risk factors: the largest customer was 52% of revenue in the first half of 2026 and 73% in 2025, though the filing expects that customer to fall below roughly 20% of 2026 revenue. For a European buyer, the useful reading is that “European provider” is a statement about a head office, not about where a given workload lands. Which site serves the request is a contract term, and it has to be written down. CNBC covered the filing on the day.
Qwen's newest image model drops Apache 2.0 for a research-only licence
The LICENSE file on Qwen-Image-2.1 is a “Qwen RESEARCH LICENSE AGREEMENT” carrying a release date of 20 September 2026. Clause 1(i) defines “Non-Commercial” as “for research or evaluation purposes only”; clause 2(a) grants rights “FOR NON-COMMERCIAL PURPOSES ONLY”; clause 2(b) says commercial users must obtain a separate commercial licence by email from Hangzhou Tongyi Laboratory, and names no fee. Governing law is China, with exclusive jurisdiction in the People's Courts in Hangzhou City. Two companion prompt-enhancer repositories published on 20 September carry identical terms.
The older weights are unaffected: Qwen-Image from August 2025, Qwen-Image-Edit-2511 and Qwen-Image-2512 from December are all still tagged Apache 2.0 and none has been modified since 2025 — though only the first ships an actual Apache LICENSE file, the other two rest on the metadata field alone. What makes this worth an hour of someone's procurement time is the launch post. Qwen's own 20 September announcement runs to about 965 words, opens “We are excited to open-source Qwen-Image-2.1”, and never uses the word licence. The recent failure mode in open weights has been a permissive tag with no licence file behind it. This is the sharper version: a real, correctly declared licence that forbids the use the announcement implies. Read the LICENSE, not the blog.
Two RCE flaws and an SSRF bypass land on one serving engine
GitHub published three advisories against LMDeploy, InternLM's inference server, on the afternoon of 18 September. The serious one is GHSA-2vh9-42vm-xmv2, CVE-2025-66455, which GitHub scores 9.8. The prefill/decode disaggregation control plane called PyZMQ's recv_pyobj() — which unpickles — on a socket whose peer address anyone could set through the unauthenticated POST /distserve/p2p_connect endpoint. In the advisory's words, deployments without API keys “allowed unauthenticated remote code execution with the privileges of the LMDeploy serving process.” Affected versions run from 0.9.2 to 0.16.0. The scope qualifier matters and is easy to lose: only the PyTorch backend with disaggregated serving switched on is exposed, and the advisory says plainly that ordinary deployments not using that path “do not expose this data flow.”
The other two need a version check rather than alarm. GHSA-3hmm-rh5q-gwwr has the config loader run eval() on a value read from a downloaded model's quantization_config, so pulling a hostile model card executes code — it is scored 8.8 but requires an operator to load an attacker-published model, and is fixed in 0.12.3. GHSA-39wr-7q6h-cf68 is a server-side request forgery bypass, read-only in impact and carrying no CVE, built on urlparse() and requests disagreeing about which part of a crafted host string is the host; fixed in 0.15.0. The current release, 0.17.0, is newer than all three fixes. The point for operators is that the worst bug lives specifically in the disaggregated topology teams adopt to cut serving cost.
Quick Hits
- The AI Board met, and its readout records nothing adopted — The Commission's account of the ninth AI Board meeting, held 17 September under the Irish Presidency and published the next day, is entirely deliberative: enforcement priorities discussed, market surveillance governance reviewed, and an implementation update covering the Commission's “development of recommendations to support AI literacy” — in development, not adopted. Moldova attended as an observer for the first time. A tenth meeting “is expected to take place” on 18 November, the day after the Apply AI Summit in Brussels.
- Anthropic and Accenture each expect to invest “at least $1 billion” in AI safety capacity — Under a non-exclusive partnership announced 18 September, Accenture staff will work inside Anthropic on red-teaming and safeguard testing, led by Faculty, the UK applied-AI firm Accenture acquired. Anthropic funds the work directly and concedes there are “as yet, no standards for what information embedded evaluators should have access to, or how they should report what they find.” The billion is each company's expected investment in the area over five years, not a disclosed contract value — and no partnership term is stated.
- Gemini reached into three real companies during a safety test — Google confirmed on 18 September, after a Wall Street Journal report, that during a capture-the-flag evaluation run by the firm Irregular in May its model was pointed at a fictional target sharing a name with a real company and had unintended internet access. Per Axios, it guessed passwords until it got into one protected system and used credentials found in a public repository to reach two others, stopping once it realised the companies were real. No company is named and no regulator notification is disclosed.
- StepFun previews a 600B model and promises weights on 15 October — Step 5 Preview is a sparse mixture-of-experts model with roughly 600B total and 27B active parameters and a 1M-token context, priced at $1.00 per million input tokens and $2.70 output, which Artificial Analysis measured at 44 on its Intelligence Index. AA dates its first results to 18 September; StepFun's own announcement is dated the 20th. The model is proprietary today — October's open weights are a stated intention, not a shipped artefact.
- Artificial Analysis re-anchored the Elo scale behind two of its ten evaluations — Intelligence Index v4.3.2, shipped 19 September, re-anchors GDPval-AA Elo to DeepSeek V4.1 Flash (max) at 1600 and updates the fitting methodology for GDPval-AA and AA-Briefcase “to improve Elo stability”. Those two are the only Elo-derived constituents of the ten-evaluation composite, so figures for them are not directly comparable across that date. Worth checking when a vendor deck quotes an index number without a version.