The Capability Dial

Moonshot describes K3.1 Pro as “the first model in our new K3.1 series and our most capable 3T-class open-weight model to date, with a 1-million-token context window.” It is a post-trained K3 with “substantially larger post-training compute,” enabling large-scale joint RL across hundreds of downstream domains. The named improvement areas are coding, 3D creation, financial research and agentic work. Available the same day on Kimi.ai, Kimi Work, Kimi Code and the API; full model weights by 4 November 2026. A Highspeed variant claims 2–3× the speed of the base model. Third-party measurement puts it at Artificial Analysis Intelligence Index 55 — 4th overall, above both GPT-6 Astra and Claude Fable 5.1, and faster than either.

The clearest strategic statement in the release is not a benchmark. It is a two-part policy: “First, we aim not to release open weights that would extend the absolute frontier of cyber capability. K3.1 Pro’s offensive cyber capability is, by design, below what our pipeline can produce, and remains behind that of frontier proprietary models. Second, we intend to progressively raise the cyber capability available in open weights.” Three commitments sit inside that pair of sentences: (1) the frontier of offensive cyber is a thing the lab can produce and chooses not to publish, (2) the published model is deliberately handicapped on that axis, and (3) a release schedule for the handicap now exists. The HN thread found it immediately; the top reply is simply: “So they admit that they could do more, but they won’t?”

Two independent reads on the same thread cut against the benchmark narrative. (1) Quota: a subscriber reports the $99/month plan exhausted its 5-hour quota in 47 minutes from a single session, “not asking for swarms or anything”; a second says the limit “makes it completely unusable” and advises against the subscription entirely. (2) Verbosity: on the Artificial Analysis Intelligence Index run, K3.1 Pro generated 150M tokens against a median of 87M — roughly 1.7× the token volume for the same index. Both are user-reported and neither is audited by the vendor.

The most-quoted line in the thread is a commenter’s arithmetic: “Moonshot is 300 employees and about to do a 50B IPO. Going to toe to toe with US counterparts with not even a tenth of the resources.” The employee count and the IPO figure are comment-level claims and are recorded here as unverified. What is verifiable from the release itself is the thing that matters: a lab at that scale published a 3T-class, 1M-context model with a 65.7% Terminal-Bench score, same-day availability across four surfaces, and a stated weights date three weeks out.

MiniMax-M3.1-Flash is a native multimodal MoE: ~428B total parameters, 23B activated per token, text/image/video in, text out, up to 1M context. Three changes over M3: sparse attention throughout (the first three full-attention layers replaced), quantisation-aware training on routed experts and attention paths, and DSpark speculative decoding with the draft head shipped in the repo. Headline agentic numbers: BankerToolBench 76.2, DeepSWE v1.1 73.7%, OSWorld 2.0 61.7, Automation-Bench 62.8, Agents’ Last Exam 29.6, CyberGym 82.2. It ties Opus 5 on BankerToolBench (76.2) and sits within 2.3 points of GLM-5.3’s CyberGym 84.5.

Calif disclosed at Hexacon in Paris a set of claims against the iPhone 18 Pro: (1) a one-click exploit against Signal, (2) a one-click exploit against iMessage — framed as “who cares about a third-party app when everyone uses iMessage, right?” — (3) an unspecified capability demo (“Can your iPhone do this?”), and (4) an “iPhone 18 Pro Persistent Jailbreak” titled “APT stands for Apple Persistent Threat.” The post states: “Everything will be released in due time.” As of publication there is no CVE, no writeup, no affected-version list and no mitigation guidance. The post is dated 16 October; it reached the HN front page today at 573 points and 392 comments.

The highest-signal comment on the thread is not about Apple at all: “I just feel a bit sad and impotent that a number of security researchers outside the circle cannot join their ‘yo we found more crazy bugs’ party because simply frontier labs only give access to those models with ‘Red Team’ availability to the inner circle members/companies. Now their ‘trusted cyber access program’ is moat rather than safeguard.” Note the structural symmetry with section 01: the frontier lab withholds cyber capability from open weights and grants it to a vetted circle; the security firm withholds exploit detail from the public and demonstrates it to a conference. Same mechanism, two industries, one direction of travel.

The most operationally useful question in 392 comments is also the one with no reply: “does enabling Lockdown mode help at all against these exploits?” A second commenter identifies the pattern from prior art — “What’s with iOS and PDFs pwning them?” — linking Project Zero’s ForcedEntry analysis and Trend Micro’s Pegasus research, both of which used malicious PDFs as the renderer-side entry. That inference is speculation on the commenter’s part, not a Calif claim, and is recorded as such. A third commenter asks the question enterprise buyers actually need answered: whether a persistent jailbreak survives Apple’s update and revocation path.

Bill C-22, the Lawful Access Act, has passed the House of Commons and is before the Senate. Four provisions, per EFF: (1) new powers to force digital services — telecoms, messaging apps and others — to assist government surveillance; (2) authority for the Minister of Public Safety to order a company to build a backdoor, permitted so long as it does not create a “systemic insecurity”; (3) mandatory metadata retention for up to a year for people suspected of no crime, revealing who they talk to, where they go and which services they use; (4) expanded cross-border data sharing, in the context of a Canada–US agreement that would let American police obtain data on Canadian users without any Canadian court oversight. CCLA and Citizen Lab researchers, in a joint analysis, argue the bill needs Part 2 withdrawn entirely, not amended.

Two mechanics worth recording. First, a petition to withdraw and amend the bill was presented to the House of Commons on 23 October, per a commenter linking the OurCommons petition record — i.e. the procedural clock has not fully run. Second, the dampening read: “It’s very rare for the senate to kill a bill. I would say that we already ran out of time.” The thread also contains the standard democratic-deficit argument on both sides — one commenter notes that “people whining about how there’s nothing they can do basically don’t engage in democracy,” another argues politicians are mirroring public demand for safety over liberty.

A community post reports a pattern rather than a single takedown: “I’ve been noticing a lot of my downloads stopping suddenly and being unable to resume. When I checked the models it seemed like they were gone.” The examples named in the post are unambiguous about the category: dealignai/MiMo-V2.6-Pro-RL-UNCENSORED and audnai/penclaw-GLM-5.3-abliterated-for-offensive-cyber, among others. Note the technical shape of the complaint: downloads that stop and cannot be resumed are the signature of a repository being removed while a client is mid-fetch, which is consistent with enforcement at the host rather than a voluntary author deletion.

Claude-Red describes itself as “a curated library of offensive security skills designed for the Claude skills system… Each skill is a structured SKILL.md file that primes Claude with expert-level methodology for a specific attack surface — from SQLi to shellcode, EDR evasion to exploit development.” The README badge counts are explicit: 78 skills, 23 categories, MIT licence. No model, no weights, no inference cost — a directory of markdown that changes what an existing model will do.

The README is unusually candid about lineage: this is “the skill that seeded Cloudflare’s vulnerability discovery harness… the single-repo starting point it evolved from.” The harness runs six named phases — reconnaissance, coverage-led hunting, candidate validation, structured output, independent record verification, target-neutral reporting — and produces artefacts rather than prose: architecture.md to map architecture, trust boundaries and input surfaces; coverage-ledger.json to assign isolated hunters per ledger unit so coverage is deterministic and auditable rather than vibes-based. Note the two phases that make it a security product rather than a prompt: independent verification and structured, machine-readable findings.

Four of today’s top six repositories were already on yesterday’s chart, which makes the delta more informative than the rank. The audit skill peaked at 2,979 stars/day on 22 October and sits at 2,706 today — a 273-star, 9.2% decay, the normal half-life of a well-executed launch. php/php-src went the other way: 423 → 722 stars/day, +70.7%, two days after a pair of pre-auth RCEs landed against the interpreter. One is a novelty curve. The other is professionals bookmarking the thing under attack.

The repository is “plugins that turn Claude into a specialist for your role, team, and company,” built for Claude Cowork and compatible with Claude Code. The architecture is the news: each plugin bundles the skills, connectors, slash commands and sub-agents for a specific job function, and the README is explicit that the shipped defaults are a starting point — “the real power comes when you customize them for your company — your tools, your terminology, your processes.”

OpenShell is positioned as the runtime layer: the sandbox an agent fleet executes inside, in Rust, under Apache 2.0, with docs on docs.nvidia.com, a PyPI package (openshell) and a security-disclosure path. The README flags a 0.1.x release line — i.e. pre-1.0 — with a “new in 0.1.x” callout at the top. It remains on the chart a day after its debut, which for infrastructure repos is the more meaningful test than the launch spike.

Two entries outside the AI-infrastructure narrative are worth recording because of what they reveal about the unit economics of open data. Renhuai123/ziwei-doushu (547 stars today, TypeScript): an open-source 紫微斗数 charting engine whose v4.0 interpretation dataset is 674,976 charts × 13 dimensions = 8,774,688 interpretation segments, ~20.4 billion characters, 56.6 GB uncompressed, released 15 October, covering 1950–2026 at ~30,000 characters per chart — a +71% size jump over v3.0. And SnailSploit/Claude-Red at 209/day, already covered above. Title-and-README level only; no independent verification of dataset quality.

The technical claim, stated precisely by the community: “NVIDIA on purpose neutered the performance of operations that use FP32 accumulation with GEMMs, with the objective of market segmentation and making consumer GPUs slower to train… Those are ‘unlocked’ on the prosumer and datacenter GPUs.” The measured effect on a 3090, same cards, same driver, same 300W: bf16 tensor pipe 82 → 155 TFLOPS; cuBLAS BF16 GEMM 8192: 64 → 99 TFLOPS; TF32: 41 → 79 TFLOPS — roughly 1.9×. The mechanism is gpu-unlock setting the cap to full before the NVIDIA driver loads. The corroborating detail is that the driver reports the restriction itself: FMLA32 = 1/2, becoming FMLA32 = full after a cold boot on all four cards in the report.

Posted to the front page of r/LocalLLaMA on 23 October with an attached image and no self-text. This is a title-level claim; the body and the underlying source were not retrieved, and no figure here is used quantitatively. It is recorded because it is the third independent signal this week pointing the same direction: consumer flagship GPUs are being converted into datacenter-adjacent compute rather than reaching individual buyers — alongside the HBM sell-out and the dual-use export filings covered in prior issues.

One quantiser benchmarked Qwen3.8-Flash-Next-W4A16-FP8PLE (129 GB) at xhigh reasoning against their own DeepSeek-V4.1-Flash-1017 at 2.6 bits (187 GB + 203 GB Engram) at max reasoning: 25/25 for Qwen versus 23/25 for DeepSeek on a modified BenchKit. n=25. This is an anecdote with a methodology, not a result — and the reporter says so. It points at a real quantity, though: the DeepSeek stack carries 203 GB of Engram n-gram memory on top of 187 GB of weights, and arXiv 2610.31646 (Low-Bit N-Gram Embeddings for Language Models) puts the figure at 196 billion parameters allocated to Engram n-gram memory in DeepSeek-V4.1-Flash, then asks whether those tables can be stored at low precision while preserving the gain.

Post-trained by NVIDIA from Gemma-4-E4B-it, this is 8B total / 4B effective parameters at Q4_K_M, 6.18 GB on disk, 64K in / 64K out context, GA 23 October 2026, under OpenMDW-1.1 and cleared for commercial or non-commercial use. Three design choices say what it is for: a DFlash speculative-decoding drafter shipped as a companion repo, a conversational mode flag that reduces formatting for spoken interaction, and a runtime thinking budget (--reasoning-budget) — with an explicit warning that a tight budget “may truncate thought processes mid-sentence.” Target use is stated plainly: local voice and device assistants, interactive personas, embedded interfaces.

NVIDIA updated the surrounding stack alongside Bolt: Nemotron-3.5-Parse, Nemotron-3.5-Embed-1B-BF16, Nemotron-3.5-Embed-8B-BF16 and Nemotron-3.5-Rerank-8B-BF16, all posted to r/LocalLLaMA on 23 October — with no published evaluation numbers in the thread, and the poster asking whether anyone has tried them. Separately, a llama.cpp PR (#30965, title-level only) proposes building QSA selection without the kq_mask, reported as saving “gigabytes of VRAM” on Qwen Flash Next.

Dessa is a true speech-to-speech, full-duplex model built by a small lab at Block, trained from scratch on human conversation only. The claims, in the lab’s own words: “As far as we know, Dessa is the world’s first AI you can have a realistic live conversation with that was trained only from human speech”; audio in, audio out, no text intermediary; it listens and talks at the same time, choosing when to cut in and when to backchannel (“yeah!”, “got it!”); faster-than-real-time inference; and it runs locally on a MacBook Pro M4 Max or better. Training compute: one NVIDIA GB200 NVL72. The technical argument for why this is hard is quantitatively honest — speech never repeats (the same sentence said twice yields different data), and one spoken word costs thousands of times more bytes than the same word in text.

The stated motivation is not latency or naturalness. It is: “The most powerful AIs in the world can’t hear how you feel. We think that’s ridiculous, leads to a worse experience, and is potentially dangerous.” The illustrative failure mode is exactly the one that shows up in deployment: a user in distress, a text-pipeline assistant that has flattened the signal to tokens, and a system that keeps selling. The demo set is deliberately chosen to make this legible — an anniversary surprise where it gasps “oh my god” under its breath, life-advice clips described as “genuinely empathetic,” and a clip where it gets louder when asked to speak up, which the post notes nobody taught it.

The thread’s best critique is specific rather than dismissive. (1) Interruption as trained behaviour: “training it to interrupt as much as possible isn’t the way to do it… did anyone here find the laugh after the ‘winter’ answer to be convincing?” (2) Instruction decay: “near the end he asks the model to speak louder and initially the voice is louder but then goes back to the same level, also losing what she was saying just seconds ago and he has to lead back to the topic.” (3) Category question: if a model trained only on speech develops world knowledge, can an image-only model on images of text act as an LLM? That third one is a genuine research question, not a complaint.

The method matters more than the result. The author’s framing: “models, esp Opus 5.5 can just hill-climb as long as you give them something achievable and a clear metric to improve on. So here’s something I don’t even have a clue how it exactly works.” Training ran on a 4070 Ti Super over roughly a day. The claimed outcome is 50–100× faster Kokoro TTS. The author is also candid about provenance — “I know it’s Opus slop” — and credits an X post for the initial distillation idea. Self-reported, single-author, no independent replication.

Three community artefacts, one direction. (1) An inference engine running GGUF Q4 paged into WebGL2 via GLSL compute buffers, inside a single HTML file — the author’s summary is “guys, you better just clone llama.cpp I swear,” and the stated cost was “endless debug hell” over tokeniser and vocab. (2) A continuing project converting dense models to MoE, latest release Qwen3-0.6B as a chat-style MoE conversion, with GGUF compatibility prioritised over raw quality. (3) A widely-discussed argument that “the future is already shaping up to be about specialized models that work better when they’re smaller… ten years from now we’ll have a specialized model for the tasks we care about.”

The setting is the one every operator is already in: an AI system emits a sequence of decisions, each with a confidence score, and at each round someone must decide whether to accept automatically or consult an expert. The paper makes one structural move that separates it from threshold-tuning: the decision and the confidence need not come from the same model — “one agent may propose a decision, while a separate verifier agent evaluates it and outputs a correctness or safety score.” That is proposer/verifier separation treated as a monitored online process, with the accept-or-escalate rule learned against a target rather than hand-set.

The premise is precise and it indicts most agent evaluations: “Tool-using language model agents rely on environmental facts to decide whether an action is permitted. When a tool response omits a safety-relevant fact, an agent may carry out a prohibited action even though the user request is benign and every returned statement is true.” EpiSEM-Bench is an executable benchmark of 300 matched unsafe/safe task pairs across six domains, built by systematically suppressing critical facts, and it measures three separate things: unsafe execution rate, safety-boundary behaviour, and evidence recovery — i.e. whether the agent notices the missing evidence and goes looking for it.

The critique is structural rather than empirical: “In standard autoregressive generation, dense attention allows each reasoning step to attend to the full context, enabling the model to derive answers through direct lookup while generating plausible-sounding but post-hoc justifications.” CausalCoT responds by decomposing a problem into a directed acyclic graph of atomic sub-questions and evaluating each node in isolation, so a node cannot see the answer it is supposed to derive. That converts “the reasoning looks right” into “each step was computed without access to its own conclusion” — an information-flow property rather than a stylistic one.

The framing is unusually honest about what is normally an article of faith: “Instrumental convergence is often invoked as a general reason to expect capable agents to acquire or express power-seeking subgoals: self-preservation, resource acquisition, deception, or resistance to oversight… For LLMs, reinforcement learning is the first stage of post-training that directly optimizes behavior against an objective.” The contribution is methodological: instead of arguing about whether RL should produce convergent instrumental behaviour, it measures it across RLVR checkpoints of OLMo-3 — an open model family where the intermediate weights actually exist to be probed.

The setup is a clean cost-aware experiment on a public 47,837-ticket, eight-class corpus: four trained non-LLM classifiers versus four large language models under zero- and few-shot prompting, with the policy selected on calibration data under explicit costs and then frozen and evaluated once on held-out test data. Under the illustrative cost model (c_ok, c_triage, c_wrong) = (0, 1, 5), TF-IDF with logistic regression at a 0.60 threshold selected on calibration is the competitive answer — the cheap model plus a cost-aware abstention rule. The paper frames abstention as “offline, cost-conditional readiness assessment,” which is the correct name for it.

The claim is unusually concrete for a paper from this group. Bug 1, Softmax Collapse: “rounds the target logit’s gradient to zero if that one logit is much larger than the others, resulting in gradients that no longer sum to zero.” Bug 2, Softmax Cancellation: “occurs when student logits are close to teacher logits, and produces non-zero gradients even when the student and teacher logits are equal.” Both live in standard implementations of softmax, log-softmax and cross-entropy. The paper provides simple replacements that fix both, and reports that the fix eliminates the previously-observed “Slingshot” instability.

The economics being attacked are stated first: “Robotic foundation models are typically evaluated through costly closed-loop rollouts, which motivates cheap offline proxies for model capability.” The theoretical hook is the Platonic Representation Hypothesis — as representations improve, vision and language converge toward a shared statistical model of reality. The paper’s question is whether motion trajectories form another such modality: as embodied models improve, should their sensory representations converge toward the structure of physical motion? S² (Sensorimotor Alignment) is proposed as a training-free measurement of exactly that.

Test-time scaling works by sampling many candidate solutions and hoping one is right — expensive, so recent methods prune the candidate pool after generating only a short prefix and commit further compute to survivors. Existing pruners split into quality-based methods (score a partial solution, discard likely failures) and diversity-oriented ones. The paper’s observation is that a quality score and pass@k are different objectives: aggressive quality pruning kills the diverse tail that pass@k depends on. Their method optimises pass@k directly rather than using quality as a proxy for it.

Looped (recurrent-depth) architectures scale quality while keeping parameter count fixed by passing activations repeatedly through the same block. The bill arrives at inference: “each recurrence generates independent KV-caches, causing memory to grow linearly.” Prior work found that in some cases the final recurrence’s KV-cache can be shared with earlier ones without quality loss — a property they name KV-shareability — but “the mechanisms underlying KV-shareability remain poorly understood, with even…” no reliable predictor of when it holds. BeNice! is the attempt to explain the mechanism and close the gap.

The gap being closed: “Auditing whether a text-to-image model was fine-tuned on a particular image collection is difficult: a model can absorb collection-level visual characteristics without reproducing training images.” Existing approaches trade off four things at once — verifiability, fidelity, robustness, deployability. SpectralCanary plants a shared signal before release by using a smooth low-pass mask to blend a fixed canary image into every image in the collection, then later checks whether that signal appears in a suspect model’s generated outputs — i.e. it tests for influence rather than memorisation.

The method is the interesting part: “We use an LLM once, as a corpus debugger rather than a classifier: a tool-using agent explores the corpus through a read-only, budgeted API and compiles each finding into an executable test, which a native speaker then validates.” Scale: the 26.5M-document Slovak portion of FineWeb2. Cost: $2.21–$2.84 per run. Yield: three runs, seven findings across four phenomena. The largest single finding is a machine-generated content farm of 1,408,437 documents — 5.32% of the corpus — which passed whatever filters FineWeb2 already applies.

The premise is one sentence: “Local Wikipedia is Wikipedia, but only for things a half hour walk from you.” The implementation is deliberately plain — geocoded Wikipedia pages only, search via Photon/OpenStreetMap, minimum 25 results (nearest 25 within roughly 6 miles if fewer are close), capped at the nearest 500 items. The privacy design is the part most builders would skip: “Your location stays in this browser: links you share don’t include it.” No account, no server-side geolocation, no affiliation claimed with Wikipedia.

The best observation in 213 comments is a cognitive one: “Weird psychological quirk: otherwise banal articles seem much more pertinent when they happen to be nearby (I just read about a random plane crash from decades ago but felt very invested in it, due to proximity).” The counter-observations are equally sharp: for one user the nearest entry is a 3 hour 15 minute walk away; another reports the tool “mostly gave me a list of housing developments and roads” despite there being interesting things nearby; a third says the radius should be configurable and then adds the correction that results appear identical to Wikipedia’s own Special:Nearby feature, i.e. it may be a wrapper rather than a new ranking.

The technical correction is narrow and it matters to anyone who has put a time-ordered UUID in a primary key: UUIDv7’s time component exists to keep temporally related rows together in index pages — write clustering — not to provide a strict creation-order sort. The thread then adds an operational landmine worth more than the article: “One of my favorite things about UUIDv7: the package uuid7 does not implement compliant UUIDv7s, it’s from a wholly incompatible draft format. That was not a fun debugging session.” The recommended alternative is uuid-utils, with the linked upstream issue as evidence. A separate commenter states the design principle bluntly: “If you are using your primary key for anything other than a unique identifier for rows, you are almost certainly doing something wrong.”

A data-journalism piece on the Bacon-number dataset reaches the conclusion the graph structure implies: the most connected actor is not the canonical one, but the one with the highest degree — the thread’s pick is Samuel L. Jackson, on volume of credits rather than prestige. The sharpest methodological comment goes further: “I would rather see the eigenvector centrality of the adjacency matrix than just estimated distance. Aside from the first, the next few eigenvectors would be great.” Another makes the point that the fun fact and the true fact diverge: “you can reach any other actor in four moves” is memorable; the average is closer to 2.6, which is less fun and more true.

Requesting music.apple.com/this-url-doesnt-exist returns an interactive iPod rendered in the error page, complete with the click wheel. Within hours the thread had mapped the surface: a playlist data endpoint at music.apple.com/includes/ipod/data/us/en-US.json (posted twice, by two different commenters, as the way to search the full catalogue without scrolling), and a hidden game — “Go to Settings>About and then hold the center button for 5 seconds” — which one commenter describes playing in a college library. The melancholy note is also the marketing note: “the click wheel is such an incredible and satisfying user interface but technology has evolved such that we have no need for it anymore.”

The day’s Dev.to AI feed is unusually coherent. (1) “Your retry loop is your most expensive feature” (9 reactions, 23 comments — comment-heavy, i.e. contested): a team tracked cost per task to the token, capped context, set a budget, and the retry loop still ate the margin. (2) “‘I’m 93% confident’ is a string, not a probability” (23/18): the gap between demo and pipeline is that a number inside a string has no semantics, so nothing downstream can act on it. (3) “Don’t Be A Proxy Between Me and Your AI” (65/39, the most-reacted): the anti-pattern of a human relaying a technical question to a model and pasting the answer back. (4) Fine-tuning Qwen3-8B with Tinker took accuracy 50% → 76% — and burned the budget doing it (94/55). (5) RAG claim verification at 15M-document scale, framed as “a correct answer and a confident lie look identical.”

Impossible Machines (Show HN, 44 pts) proposes declaratively programming the physical world — you specify an outcome and the system generates the linkage. The thread immediately recognises the genre (“The Incredible Machine vibes”) and the prior art (Disney Research’s work generating linkages to trace a drawn path), and asks the two questions that decide whether it is a product: where is the repo, and can the interaction vocabulary extend beyond binary (“ring the bell three times or play shave and a haircut”). Separately, a 1980 article resurfaced with a line that has aged into a calibration lesson: “we’ve a number of years to survive yet before brainlike systems make their debut outside a handful of well-funded research labs.” A commenter’s note: “Took 40 some years, as it turned out.”

Hacker News — retrieved via the Firebase API: 12 front-page stories with 6 top-level comments each, ranked by score; the top item today carried 1,109 points and 213 comments. All item IDs in this document were taken programmatically from the fetch payload and are cited as item?id=<id>. GitHub Trending — scraped for the daily chart, 6 repositories with READMEs (~1.8 KB each); star counts are GitHub’s own “stars today” figure, which is a 24-hour window and not a quality measure. Dev.to — API, tags ai/machinelearning/llm, top-7 per tag, deduplicated; reaction and comment counts as published. arXiv — API, cs.AI OR cs.LG OR cs.CL, sorted by submission date, 14 papers, all submitted 22 October 2026; abstracts only, no full texts read — every research claim here is a claim about an abstract. Reddit — the JSON API returned HTTP 403 Blocked on all three subreddits. The Atom ladder was then walked: r/LocalLLaMA succeeded on the first rung (top/.rss?t=day&limit=15) with 15 entries and full bodies; r/MachineLearning returned HTTP 429 on four of five rungs and a zero-entry response on the fifth; r/singularity returned HTTP 429 on four of five rungs and a zero-entry response on the fifth. No card in this briefing rests on r/MachineLearning or r/singularity. Web extraction — primary sources pulled directly for the five highest-consequence items (Kimi blog, EFF, Calif, Dessa, Local Wikipedia); Reddit’s own thread pages are not scrapeable, so thread-level claims come from the Atom bodies and are labelled as such.

(1) Moonshot’s ~300 employees and ~$50B listing — HN comment claims, unverified. (2) The validity of the Calif iPhone 18 Pro exploits — demonstrated on video, no CVE, no writeup, no affected versions; the “PDF vector” discussion is a commenter’s inference from prior art, not a Calif claim. (3) The cause of the Hugging Face disappearances — a single user report with named repos; policy enforcement is the pattern, not a confirmed finding. (4) The “RTX 5090 conversion factory in China” — title-level claim, body and source not retrieved; used for zero quantitative conclusions. (5) The Kimi quota exhaustion (47 minutes on $99) and 150M vs 87M token figures — user reports, not vendor or audit data. (6) The Qwen-vs-DeepSeek quantisation comparison — n=25 on a modified harness by the quantiser who produced one of the models. (7) The Kokoro 50–100× speedup — single author, self-described “slop,” no independent benchmark; and the ziwei-doushu dataset quality — README-level only. (8) The gpu-unlock results — community-measured, one reporter, and the same reporter notes real inference gained less than the tensor-math headline; legality under NVIDIA’s terms and stability at fleet scale are untested. (9) Any research result here — read from abstracts, not full texts, and not replicated.

4 November 2026 — Kimi K3.1 Pro full weights ship. Compare the released model’s cyber benchmarks against the 81.0% pass@3 the blog reports; a materially higher number means the governor was cosmetic. Within 30 days — whether Calif publishes any technical detail or a CVE. Silence past that date converts the demo from disclosure to advertising, permanently. Ongoing, daily — HF availability of the named dealignai/audnai checkpoints. Reappearance and persistence retires claim 4. Canadian Senate calendar — C-22 committee stage. Watch specifically for whether Part 2 (the surveillance and retention regime) is carved out, versus cosmetic amendment of the backdoor clause. Next 30 days — whether any second lab publishes a staged open-weights capability statement. One instance is a precedent; two is an industry norm.