Tuesday, 20 October 2026

• ✓The fix is in v1.107.8 and addresses GHSA-xv4x-g8mx-ch56, rated Medium.

  “Fixed in v2.58.0 and v1.107.8.”

  github.com

• ✓Provider-native MCP configuration could expose server URLs, authorization tokens and custom header values in OpenTelemetry request traces, even with include_content=False.

  “Provider-native MCP configuration could expose server URLs, authorization tokens and custom header values in OpenTelemetry request traces, even with include_content=False.”

  github.com

• ✓Users should restrict access to historical traces and rotate exposed credentials.

  “Restrict access to historical traces and rotate exposed credentials.”

  github.com

github.compypi.org

• ✓Some inputs could lose their original type inside prepare_inputs_for_generation in generate, leading to problems with multimodal models.

  “some inputs could loose their original type inside prepare_inputs_for_generation in generate, leading to problems with multimodal models”

  github.com

• ✓Zero expert gradients in bfloat16 with expert parallelism and ep_size < fsdp_size are fixed.

  “Fix zero expert gradients in bfloat16 with expert parallelism and ep_size < fsdp_size (#49688) by @qgallouedec”

  github.com

• ✓The input modalities of VLMs that report text only are now declared.

  “Declare the input modalities of the VLMs that report text only (#49677) by @qgallouedec”

  github.com

github.compypi.org

• ✓In 600 runs, the system achieved 89% task success with zero policy violations using a locally hosted open-weight model.

  “the system achieved 89 % task success with zero policy violations when evaluating multi-dimensional policy reasoning with a locally hosted open-weight model.”

  arxiv.org

• ✓Technical and expert requests succeed up to 98% of the time, whereas casual and under-specified requests succeed 72% of the time.

  “technical and expert requests succeed up to 98 % of the time, whereas casual and under-specified requests succeed 72 % of the time.”

  arxiv.org

• ✓In a secondary evaluation of 600 runs on hierarchical geographic access control, the framework blocks 100% of unauthorized regional requests.

  “the framework successfully blocks 100 % of unauthorized regional requests.”

  arxiv.org

• ✓The verification agent hallucinates on 1% of these requests, but logs confirm no data is extracted, and end-to-end verified delivery is 86% for eligible consumers.

  “While the verification agent hallucinates that 1% of these requests, the system logs confirm that no data is ever extracted and the framework simultaneously achieves an end-to-end verified delivery rate of 86% for eligible consumers.”

  arxiv.org

arxiv.org

• ✓In a longitudinal paper-trading study with 80 participants, no evaluated LLM reliably outperforms a recent-activity persistence baseline for predicting trade occurrence.

  “No evaluated LLM reliably outperforms a simple recent-activity persistence baseline for predicting trade occurrence”

  arxiv.org

• ✓Buy-sell structure and asset selection remain difficult to reproduce.

  “while buy–sell structure and asset selection remain difficult to reproduce”

  arxiv.org

• ✓Similar activity-level performance can yield substantially different portfolio trajectories.

  “Similar activity-level performance can also yield substantially different portfolio trajectories.”

  arxiv.org

arxiv.org

• ✓BOSS attains the highest accuracy in 22 of 24 model-task-budget cells under the common hard cap.

  “BOSS obtains the highest accuracy in 22 of 24 model–task–budget settings.”

  arxiv.org

• ✓At Llama-3.1-8B and B=4k, BOSS reaches 60.5 macro-average accuracy versus 58.6 for Adaptive-Consistency.

  “| BOSS | 60.5 |”

  arxiv.org

• ✓On identical Stage-I candidate pools, randomized A/B judging with repeated voting improves plurality from 58.4 to 60.3.

  “changing only the selector raises macro accuracy from 58.4 with plurality to 60.3 with randomized A/B repeated voting”

  arxiv.org

arxiv.org

• ✓AllPath is a personal LLM trading agent deployed against a live paper-brokerage account.

  “AllPath is a personal LLM trading agent: a deterministic rules engine watches positions, a chat agent talks to the operator”

  arxiv.org

• ✓Code gates rejected no proposal, while the human rejected two proposals that passed every code check.

  “The code gates rejected no proposal; their role was keeping revisions consistent. The human rejected two proposals that passed every code check, both over a disagreement about the market”

  arxiv.org

• ✓The human later removed 11 of the 19 rules the agent had added on its own, at a median lag of eight days.

  “Of the 19 rules the agent added on its own authority, 11 were later removed by the operator through the human-gated chat channel, at a median lag of 8 days (range 1 to 17).”

  arxiv.org

arxiv.org

• ✓AnyLanguageModel 1.0 is released alongside swift-huggingface 1.0 and swift-xet 1.0.

  “AnyLanguageModel 1.0 is out, along with swift-huggingface 1.0 and swift-xet 1.0.”

  huggingface.co

• ✓Tool calling and guided generation work with every provider.

  “Tool calling works with every provider.”

  huggingface.co

• ✓AnyLanguageModel supports OpenAI's Chat Completions and Responses APIs and Anthropic's Messages API.

  “OpenAI's Chat Completions and Responses APIs”

  huggingface.co

huggingface.co

• ✓PyTorch 2.15 adds float8_e4m3fn tensors on MPS, which take half the storage of BF16.

  “PyTorch 2.15 adds torch.float8_e4m3fn tensors on MPS: one byte per value, half the storage of FP16 or BF16.”

  huggingface.co

• ✓Mixture-of-experts models decode 5 to 6.5 times faster than in PyTorch 2.14.

  “Mixture-of-experts models decode 5–6.5× faster than in 2.14”

  huggingface.co

• ✓Qwen3.6-35B-A3B goes from 9.4 to 61.3 tokens/s on an M3 Ultra with torch.compile.

  “on an M3 Ultra with torch.compile, Qwen3.6-35B-A3B goes from 9.4 to 61.3 tokens/s”

  huggingface.co

• ✓MPS now requires macOS 15 or later.

  “MPS now requires macOS 15 or later”

  huggingface.co

huggingface.co

• ✓Bi-directional KV transfer lets a decode node return previously computed KV to a prefill node on subsequent turns, governed by a configurable recompute threshold.

  “Bi-directional KV transfer is a mechanism in which a decode node returns previously computed KV to a prefill node on subsequent turns of a conversation.”

  aws.amazon.com

• ✓Bi-directional KV transfer reduced TTFT by up to 1.6x for Qwen3-32B and up to 3.3x for zai-org/GLM-5-FP8.

  “bi-directional KV transfer reduced TTFT by up to 1.6x for Qwen3-32B and up to 3.3x for zai-org/GLM-5-FP8”

  aws.amazon.com

• ✓The feature was originally built on AWS Trainium and contributed to vLLM as an accelerator-agnostic capability.

  “We originally built and validated the feature on AWS Trainium instance clusters connected with EFA and contributed it to vLLM as an accelerator-agnostic capability.”

  aws.amazon.com

• ✓A KV-cache-aware router maps each client conversation_id to the decode node's kv_transfer_params and stores only block-location metadata, not KV tensors.

  “It maintains an in-memory mapping from the client-provided conversation_id to decode’s kv_transfer_params. The router stores only block-location metadata, not KV tensors”

  aws.amazon.com

aws.amazon.com