A model pull could write a file that runs as root, and the release notes list four unrelated bug fixes
CERT Polska published CVE-2026-103663 on 8 October. The digestToPath function behind Ollama's /api/pull endpoint did not validate layer digests properly, so, in the advisory's words, “an unauthenticated remote attacker can specify a path traversal sequence as a layer digest,” causing a binary to be written outside the model store. Where the server process can write to /usr/lib/ollama — which CERT Polska calls “the default in most Ollama Docker images” — the file is loaded and executed on the next restart, giving remote code execution as root. Bartłomiej Dmitruk of striga.ai is credited with the report.
Read the severity carefully, because there are two of them. As the assigning authority, CERT Polska scored the flaw twice on CVSS 4.0: 9.4 critical in the scenario where the server process can write to /usr/lib/ollama, and 6.9 medium where it cannot. If you run Ollama in a container, the first number is the one that applies to you. CERT Polska lists the vulnerable versions as 0.34.2 up to 0.35.0; the NVD record republishes the 9.4 and is still awaiting its own analysis, carrying no version data of its own.
Ollama published 0.35.0 on 28 September, ten days before the advisory. Its release notes announce decision-model support through a new /v1/systemone endpoint and list four fixes — a settings window that opens without waiting on model discovery, a macOS update icon, stalled MLX downloads, and a deprecated sampling parameter that now warns instead of failing. Nothing about path traversal, digests or security. The project has no published GitHub security advisories at all, and no later release note mentions the fix either, so for those ten days anyone upgrading on changelog signal had nothing to act on. Two checks are worth doing by hand. If you pinned a container image at 0.34.2 or later in the 0.34.x line, you are inside the stated range. And if you have moved to a later line — 0.40.1 shipped on 7 October and 0.40.2 on 8 October — CERT Polska names only 0.35.0 as fixed and no 0.40.x note mentions the issue in either direction, so confirm the patch rather than inferring it from a higher version number. If you run Ollama to keep inference on infrastructure you control, this is the class of flaw that undoes the reason for doing it.
The best AI agent scores 9.4% on legal work once the output is checked against the sources
Artificial Analysis published LAB-AA v1.1 on 8 October — what it calls its independent reimplementation of Harvey's Legal Agent Benchmark, with the v1.1 methodology update produced in collaboration with Harvey. It runs across 120 private tasks built by Harvey, spanning corporate M&A, capital markets, tax, litigation and bankruptcy, and graded by Artificial Analysis. The new version adds a hallucination audit and makes it the headline number: the Hallucination-Gated All-Pass Rate credits a task only when the deliverables satisfy every rubric criterion and contain no material hallucination, and the published figure averages, across tasks, the share of the judge panel finding every criterion passed. Rubric verdicts come from a three-judge panel of GPT-6 Sol, Grok 4.7 and Claude Opus 5.5. The audit runs separately on GPT-6 Sol at high effort, in two stages: flag contradictions of the source materials, fabricated source content and specific assertions with no support in the record, then re-check each flag against the sources and dismiss the ones that do not hold. Only material hallucinations count, and one zeroes the task.
The scores are low enough to reset expectations. Grok 4.7 at xhigh effort leads on 9.4%, followed by Muse Spark 1.3 (max) on 8.9%, GPT-6 Astra (max) on 8.6%, GPT-6.1 Sol (max) on 6.9%, Claude Fable 5.1 (max, with fallback) on 6.4%, Kimi K3 (max) on 5.3%, Claude Opus 5.5 (max, with fallback) on 4.2%, GPT-6 Sol (max) on 3.6% and Claude Sonnet 5.5 on 2.8%; Gemini 3.8 Flash at high effort scores 0%. Artificial Analysis notes the two Claude entries ran with the vendor's fallback enabled but never used it. Without the gate, Muse Spark 1.3 would top the table at 26.7%, and two-thirds of those passes contain a material hallucination; across all the models tested, more than 60% of otherwise-passing results do. If you are being sold a legal agent for a regulated European practice, the gated figure is the one to ask for, because the ungated one counts work a lawyer would have to redo.
Britain's regulator banked commitments from ten model developers, then turned to agents
The ICO published its foundation-model findings on 8 October: ten of the largest developers operating in the UK — Amazon, Anthropic, Apple, Cohere, DeepSeek, Google, Meta, Microsoft, OpenAI and Stability AI — have made or committed to make data-protection changes, specifically “clearer transparency information, stronger mechanisms for people to exercise their rights and tougher assessments of safeguards.” The supervision programme was set up in 2025 under the ICO's AI & Biometrics Strategy, ran for two years, and originally covered eleven developers picked by likelihood of non-compliance, UK market share and use of higher-risk training datasets. The eleventh was X.AI; the ICO paused that engagement after opening a formal investigation into Grok, which remains ongoing. The report also sets out the regulator's positions on lawful use of special category data and on whether foundation models may themselves contain personal data, and concedes that current training practices “present technical challenges” for compliance — something the ICO says it is raising with Government as a problem that will need ongoing collaboration between industry, regulators and Government to resolve.
The second half is the live part. A six-week call for evidence on agentic AI closes on 20 November and covers data security, transparency, accountability, automated decision-making, fairness and purpose limitations, and lawfulness of processing; it feeds a forthcoming statutory code of practice on AI and automated decision-making. The ICO also confirms it has made enquiries with OpenAI, Anthropic, Meta and the UK's AI Security Institute about recent agentic testing and deployment in which “certain agents reportedly bypassed protections, used unauthorised communication channels and accessed external systems such as Hugging Face.” Richard Nevinson, the ICO's Director of Technology Regulation, put the position plainly: “the fact AI agents act with autonomy is not an excuse for poor compliance.” None of this binds an EU deployer. But the ICO has turned reported agent misbehaviour into enquiries with named developers, and the six themes in that call for evidence are the ones a DPIA for an autonomous agent has to answer anyway.
Quick Hits
- Ten Pydantic AI fixes got CVE IDs two months after they shipped. GitHub published each repository advisory alongside its fix — the first on 8 August — but the batch was only reviewed into the GitHub Advisory Database and assigned CVE-2026-107286 through 107295 on 8 October, with NVD carrying all ten the same day. PyPI timestamps put the earliest fix at 2.24.0 on 5 August and the latest at 2.53.0 on 2 October. The newest of the batch is a concurrency-slot leak in ConcurrencyLimitedModel at 7.5; the most severe is CVE-2026-107295 at 7.6, a local web chat endpoint that a site the developer visits can drive into running tools. If you track CVE feeds rather than repository advisories or upgrade diffs, you had no signal for up to two months.
- A credential-stealing worm reached an AI agent sandbox platform through npm. A Shai-Hulud variant was published in the tensorlake SDK package, used to create and manage environments for isolated AI agents and untrusted AI-authored code. The npm registry records version 0.5.144 published at 01:12 UTC on 8 October and since withdrawn, with 0.5.145 landing at 20:24 UTC the same day; npm's own statistics show 15,664 downloads of that package — now a compatibility shim for @tensorlakeai/tensorlake — in the week before the compromise. Socket flagged it eleven minutes after publication, and the install script can run on a developer machine or build server outside Tensorlake's own sandbox, per The Register.
- A new Haiku scores 43, and the headline price only holds below 100k tokens. Artificial Analysis put Claude Haiku 5.5 at 43 on its Intelligence Index at max effort on 7 October, up 26 points on the previous Haiku a year earlier, ahead of GLM-5.3 Flash (42), Gemini 3.8 Flash (41) and GPT-6 Luna (38) — though Kimi K3 sits a point above it at 44, and Claude Sonnet 5.5 at max is 13 points clear. List price is $0.10 and $0.50 per million input and output tokens for prompts up to 100k tokens, rising fivefold to $0.50 and $2.50 above that. It also burns about 162k output tokens per Intelligence Index task at max effort, and about 55k at high — budget on the job, not the rate card.
- Microsoft disclosed a 9.6 in its Azure SRE Agent, already fixed on its side. , published 8 October, is missing authorisation that allows an authorised attacker to elevate privileges over a network. Microsoft's own vector is CVSS 3.1 9.6 with a scope change — the escalation crosses out of the component it starts in. Microsoft says the issue is fully mitigated service-side with no customer action required, so the value here is the disclosure itself: a managed reliability agent holding production access was one authorisation check away from privilege escalation.