Tuesday, October 6, 2026

TLDR

Reflection AI unveils Beam, a 501B-parameter (23B active) MoEMixture of expertsA model made of many sub-networks, called experts, where a learned router sends each input to only a few of them.Shazeer et al. 2017 ↗ coding model: API beta waitlist now, Apache 2.0 weights promised later in October (Oct 5) Open Source
GitLab patches CVSSCommon Vulnerability Scoring SystemA standard 0 to 10 severity score: 0.1–3.9 low, 4.0–6.9 medium, 7.0–8.9 high, 9.0–10 critical.FIRST ↗ 9.9 sandbox escapeBreaking out of a sandbox, the restricted environment that limits what untrusted code can reach.NIST ↗ (CVE-2026-90970) in the self-hosted AI Gateway; updating core GitLab does NOT fix it (Oct 2–5) Security
Suspected AI-assisted hacks hit seven South Korean lenders; ~66,000 individuals' records exposed (Oct 5–6) Security
Moonshot AI closes round at $50B valuation, eyes Hong Kong IPO in early 2027 (Oct 6) Trending
OpenAI to pilot visual ads in ChatGPT image generation later this month (free tier only) (Oct 5) Customer AI

Things your engineering team should look at or do this week.

If you self-host GitLab Duo / the AI Gateway: update the Gateway image itself to 19.2.4, 19.3.2 or 19.4.1 — it is versioned separately from core GitLab.
Join the Reflection Beam API waitlist if you evaluate open-weightA model whose trained weights are published for anyone to download and run.NTIA ↗ coding models; hold off on self-hosting plans until the weights and red-team results actually ship (SWE-benchA benchmark that tests whether a model can resolve real GitHub issues by editing code in popular Python repositories.Jimenez et al. 2023 ↗ figure is vendor-reported).
Review AI-assisted-attack exposure for any customer-PII systems: the Korean bank incidents are a reminder to check rate limiting, anomaly detection and vendor/API access paths against automated vulnerability-hunting tools.

Reflection Beam (501B-A23B MoE, coding/agenticDescribes AI systems where a model uses tools and decides its own steps instead of following a fixed script.Anthropic ↗) (Oct 5) Open Source — Reports 80.9 on SWE-bench Verified (vendor-reported). Available via an OpenAI-compatible beta API waitlist; pricing not announced. Apache 2.0 weights are "scheduled for later this month" and the model is in final red-teaming, so it is announced, not yet downloadable. (MarkTechPost)
Strata inferenceRunning a trained model on new input to get an output, as opposed to training it.NVIDIA ↗ engine (Oct 4) Open Source Infra — MIT-licensed engine that keeps hot MoE experts on GPUGraphics processing unitA highly parallel processor that does the large matrix math behind training and running models.NVIDIA ↗ and the rest in system RAM, claiming a 125B model at ~94 tok/s on a 12GB RTX 5070 plus 32GB RAM. All numbers are self-reported and unverified by third parties. (GitHub)

GitLab AI Gateway sandbox escape, CVE-2026-90970 (CVSS 9.9) (Oct 2–5) Agents — A crafted flow config lets an authenticated Duo Agent Platform user escape the Jinja2 template sandbox and run commands on the gateway host (server-side, before LLMLarge language modelA neural network trained on huge amounts of text that generates text, answers questions and summarizes.Anthropic ↗ invocation). Fixed in 19.2.4 / 19.3.2 / 19.4.1; no known in-the-wild exploitation as of Oct 2; GitLab.com and Dedicated already patched. (The Hacker News)
Seven South Korean financial firms breached in suspected AI-assisted attacks (Oct 5–6) — Shinhan, KB Kookmin, Hana, BNK Busan, two savings banks and Hyundai Capital lost data on roughly 66,000 individuals and 2,200 corporate records. Police suspect an AI vulnerability-scanning tool (ARTEX) but attribution is unconfirmed; 28 IPs identified and 28 investigators assigned. (Korea Herald)

Moonshot AI closes funding at $50B valuation, targets HK IPO early 2027 (Oct 6) Trending — Per Bloomberg reporting, the Kimi maker is preparing a Hong Kong listing in Q1 2027. (Bloomberg)
OpenAI to pilot visual ads during ChatGPT image generation (Oct 5) Customer AI — US rollout later in October; Plus/Pro/Enterprise stay ad-free. Reportedly backed by 14+ measurement partners, signaling a full ad business. (BleepingComputer)
Anthropic commits $100M to train 10,000+ "frontier deployed engineers" by end of 2027 (Oct 5) Hiring — 12-week residency with partners including Accenture, McKinsey, Bain and Capgemini; cohorts already running in SF, NYC and London, with organizations nominating engineers. (ITPro)

Anthropic, OpenAI, Google and Meta executives testify before the full NYC Council on AI risks (Oct 5) Policy — Hearing on catastrophic and safety risks, where an AI researcher warned "we are racing to build and grow our own adversary." Local-level signal; no binding action reported yet. (CNBC)