DailyVOL 2026.11.03171 items

GLM 5.3 independently builds Firefox 0day exploit chains

Singapore·Tuesday, 3 November 2026·DAILY · 08:00 SGT

3 Nov 2026. Agent security dominated the day: Epoch AI tests found Z.ai's open-weight GLM 5.3 turned unreleased Firefox security patches into working exploits, chaining a second model-discovered vulnerability to steal local files and passwords, with each attack costing about $1,000. Defences look fragile too — new SecPO research cuts prompt-injection success on Qwen3.6-27B, while an AI Control study found simple features beat 20 of 24 open-source monitor models. On models, DeepSeek's V4.1 Flash 1017 topped open-weight results on ARC-AGI, scoring 78.1% on ARC-AGI-2 and 5.81% on ARC-AGI-3, and Mistral published a full technical report on ML4 training. In compute economics, Anthropic has committed $895.4B in compute and infrastructure spending, with $447.5B due before 2031, while TrendForce reports GPU lead times stretching to 45 weeks amid NVIDIA's Rubin transition and Neocloud players like Lambda and Nscale face downgraded valuations. OpenAI separately shipped Pando, a Git-compatible backend for massive Codex agent workloads.

01

Models

5 items
ModelsBuildersSelected04:05
Mistral releases technical report on ML4 training

Frontier labs rarely publish full training details, so this document gives practitioners a real reference for replication choices around data and training pipeline decisions. Builders studying how top European labs structure large-scale training can compare Mistral's approach with the more limited disclosures from US and Chinese competitors.

官方账号Guillaume Lample (Mistral)@GuillaumeLampleSource
ModelsUS vs ChinaSelected02:36
Skyfall AI releases SKY-001 world model for 3D product design

Design output that comes with a full build sequence shifts world models from visual generation toward tools engineers can actually hand to manufacturing. Teams in hardware, CAD tooling or robotics can use SKY-001 to automate part trees and assembly steps at a claimed 150x lower cost than GPT-6 Astra. The two-stage composer-plus-predictor architecture is also a template for anyone building hierarchical agent systems.

rohanpaul_ai@rohanpaul_aiSource
02

Products

5 items
ProductsBuildersSelected04:05
Anthropic Adds Message Threads to Claude Messages API

Server-side thread caching shifts state management from the client to Anthropic's infrastructure, cutting request payloads and per-turn latency for chat applications. Builders maintaining long conversations in production will find this directly useful. It parallels similar stateful-session approaches from competitors like OpenAI's Responses API, so teams comparing multi-turn efficiency across providers have a new data point.

claudedevs@claudedevsSource
ProductsBuildersSelected05:18
PyTorch 2.15 live Q&A covers NCCL, FSDP2 and Blackwell updates

Making the rewritten NCCL backend the default means distributed training setups may see different communication behaviour after upgrading, and FSDP2's finer memory controls matter for teams pushing large-model training on limited hardware. Developers running inference on NVIDIA Blackwell or Apple Silicon can test NVFP4 and FP8 decode paths directly. Anyone deploying PyTorch 2.15 can bring upgrade questions to the live session with the Meta engineers behind the release.

官方账号PyTorch@PyTorchSource
ProductsBuildersSelected00:14
DSH Super-agent: open-source team collaboration agent design explained

The admission layer being pure rules with zero model involvement is the most transferable idea here — it cuts cost and false triggers before the LLM ever runs. Builders working on team-facing or multi-agent systems can borrow the ticket-state model and write-ahead logging for their own orchestration stacks. The project is open-source and came from the Chinese community, so it can be studied and self-hosted anywhere without waiting on a commercial release.

岚叔@lufzzlizSource
03

Industry

5 items
IndustryUS vs ChinaSelected00:45
TrendForce: NVIDIA Rubin transition pushes GPU lead times to 45 weeks

The bottleneck is shifting from GPUs to passive components: substrates and capacitors running at over 3 times balanced lead times will gate Rubin availability more than NVIDIA's own supply. Enterprise buyers waiting for Rubin may face a two-tier market as hyperscalers take early allocation. Procurement teams should weigh locking in current-generation GPU servers and smaller RDIMM modules before queues lengthen further.

rohanpaul_ai@rohanpaul_aiSource
04

Papers

4 items
PapersBuildersSelected13:26
SecPO Cuts Prompt Injection Attacks on Qwen3.6-27B

The key insight is that DPO-based defences anchor to an insecure reference model, and an injection-invariant oracle can be approximated in practice — a fix that goes beyond simply training on more attacks. Teams building agentic systems can fine-tune with the released SecPO model, loss and adversarial training data rather than relying on prompt filtering. The released checkpoint is based on Qwen3.6-27B, making it directly usable for open-weight deployments.

arXiv cs.AI@Sizhe Chen et al. (5)Source
PapersBuildersSelected13:19
Training-Free MoE Expert Pruning Study Compares Replacement Operators

The paper shows that a usually implicit implementation choice — whether to renormalize survivors' gate scales — can flip which pruning method wins, so benchmark tables built on one operator may not generalize. Engineers pruning MoE checkpoints get concrete guidance: match the operator to the router's training, and validate on math and code tasks rather than multiple-choice accuracy alone. Researchers should adopt the five-item reporting checklist when publishing pruning results.

arXiv: DeepSeek@Ezza Ali et al. (4)Source
05

How-to

3 items
How-toBuildersSelected04:07
SGLang HiCache Extends KV Reuse Across Parallelism Configurations

Cache-aware serving is becoming the bottleneck as agentic pipelines resend long prefixes on every call, and HiCache's unified KV layout means cached prefixes survive changes in parallelism setup rather than being discarded on redeployment. Teams running GLM, DeepSeek or other long-context models on SGLang can pair HiCache with external stores like Alibaba Tair KVCache to cut TTFT without re-architecting their serving topology. The iFLYTEK deployment is a concrete reference point for production coding-agent workloads.

官方账号LMSYS Org (SGLang)@lmsysorgSource
How-toBuildersOfficialSelected01:28
Circle K cut DevOps incident triage to 15 minutes with Amazon Bedrock

The migration from Bedrock Flows to AgentCore shows where low-code orchestration hits its limits and when a managed agent runtime pays off — a decision many platform teams will face. DevOps and platform engineers building their own triage or on-call automation can reuse the architecture pattern and scaling lessons directly. The under-15-minute triage figure gives a concrete benchmark for setting internal targets.

官方一手AWS Machine Learning Blog@Marek KlatowiczSource
171Stories
48First-party
23New models
61Sources
AITOP · generated by the editorial system