A Brotli decoder bug reaches Node and Python, and Kimi K3.1 Pro lands
Node.js and Python's Brotli packages got fixes for a remote-code-execution bug in the decoder, Moonshot launched Kimi K3.1 Pro with open weights promised by 4 November, and Databricks measured what agents do with declarative pipelines.
Saturday’s thread is trust at the edges: the bytes your agents download, and the claims vendors make about their own models and tools.
1 · Top story
A Brotli decoder bug can give code execution through Node and Python
Node.js shipped security releases on 21 October. One of the four High fixes, CVE-2026-111497, is a Brotli update in 24.22.1 (and matching 22 and 26 releases, per Aikido). Aikido’s write-up says it is an out-of-bounds write in Google’s Brotli decoder, in versions 1.0.3 through 1.2.0, that can lead to remote code execution. Python’s Brotli and brotlicffi packages are affected up to 1.2.0 and fixed in 1.2.1 and 1.2.1.0.
Anything that fetches compressed content from servers you don’t control is in scope, and agents with web tools do exactly that all day. Upgrade where you can, and rebuild images that bundle their own runtime. Until then, Aikido’s advisory suggests rejecting inbound requests whose Content-Encoding includes br, and not requesting or decoding Brotli responses on outbound calls. The Node.js notes give no exploit details or in-the-wild reports.
2 · Models & features
Kimi K3.1 Pro: 1M context now, open weights promised by 4 November
Moonshot’s new flagship is live on its API and apps. It has a 1M-token context window and the hosted price is $2 per million input tokens and $10 per million output, according to Simon Willison. Moonshot says full weights arrive by 4 November. By Moonshot’s own numbers it scores 65.7% on Terminal-Bench 4.0 against 66.4% for Claude Opus 5.5, and cuts its hallucination rate on its own hard benchmark from 23.4% to 8.3%. Artificial Analysis gives it 55 to Opus 5.5’s 58.
So it is a credible, cheaper option for long-running agent work, with two open questions: the licence, and how it behaves outside Moonshot’s tests. A “Highspeed” tier is 2-3x faster at twice the price. Until weights ship, treat it as a hosted API with a promise, not an open model.
3 · Agents
LangChain parks big tool results in files, and lets the agent page through them
LangChain’s Deep Agents write any tool result over roughly 20,000 tokens to a file under /large_tool_results/. The agent gets the path and a short preview, then reads it 100 lines at a time. The post’s example is a weekly competitor-research agent and a 40,000-row export that would never fit in a prompt.
The design choice worth stealing is that retrieval becomes the default way to look at your own tool output. It keeps the context small and the cost flat, but every read is another model turn, so latency grows with how often the agent needs the detail. The post doesn’t say how often that happens.
4 · Research
A small verifier makes coding agents better for about 10% more money
SWE-Verifier is a 4B-parameter model, trained from Qwen3.5-4B, that scores a coding agent’s proposed actions, decides when to sample more candidates, and ranks them before anything runs. The authors report MiniMax-M2.7 going from 75.47% to 77.20% at 1.09x cost, and DeepSeek-V4-Flash from 72.60% to 74.27% at 1.13x. It checks fewer than 4% of steps. Model, code and data are released.
The gains are small and come from the authors’ own runs, so read it as a cheap pattern rather than a leap. Spending verification only where the agent is unsure is a better budget than verifying everything.
5 · People worth following
Modal’s CEO on why GPU contracts are “rectangles” and sandboxes are the new growth
On Latent Space, Erik Bernhardsson argues that fixed GPU contracts are rectangles while real demand isn’t, so Modal pools demand across customers to sell elastic capacity. Sandboxes, driven by coding agents, background agents and RL, are now roughly a third of Modal’s revenue. Fast startup, through GPU buffers, checkpointing and memory snapshots, is the core of the product.
He also flags the financial risk of locking in GPU supply at high prices. If you size capacity for agents, it’s worth asking how bursty your own load is before you sign a reservation.
6 · Architecture
Agents wrote half the code with declarative pipelines, and a bit more wrong answers
Databricks had Opus 4.8 build 528 data pipelines (22 tasks, 12 datasets, two styles). Declarative pipelines had a median of 64 lines against 131, and used 17 executor-seconds against 596. They cost more to build: about 2.3x the tokens, roughly $0.50 against $0.26 per build. Pipelines that ran cleanly but gave wrong answers were 32.2% for declarative against 27.7% for procedural.
It’s Databricks measuring its own product, and a wrong-but-green pipeline in either style is the failure that matters. The consequence for architecture is that checking results, not just completion, has to sit outside whatever the agent writes.
Also worth knowing
🆕 New on the radar
- IQuest-Q1 — a paper describing a sparse MoE for agentic command-line work, 320B total and 15B active parameters, with weights and deployment configs said to be released; the paper reports 57.5 on SWE-Bench Pro and 83.2 on Terminal-Bench 2.1. Watch. Source
- Block’s Dessa — a full-duplex speech-to-speech model trained from scratch on human conversation, said to run locally on an M4 Max Mac; it’s waitlist-only with no benchmarks or licence. Watch. Source
- Mistral Timestral-209M — an open-weight time-series forecasting model with a modified MIT licence, handling up to 32,768 past steps and forecasting 1,024; Mistral claims state-of-the-art zero-shot accuracy on GIFT-Eval. Try. Source
- Cloudflare security-audit-skill — an MIT-licensed coding-agent skill that runs a six-phase security audit with independently verified, machine-readable findings; it needs an OS-enforced sandbox. Try. Source
🧰 Models & tools
- NVIDIA Nemotron 3.5 Bolt E4B — a GA open-weight small model (8B, 4B effective) built on Gemma 4 with 64K context under the OpenMDW licence; NVIDIA reports 55.60 on MultiChallenge at Q4 versus 39.36 for the base model. Source
- Cloudflare Workers profiling — on-demand CPU and memory flamegraphs for Workers and Durable Objects, announced 9 October; Cloudflare’s own fix made one function 2.7x faster. Source
🏢 Platforms & enterprise
- AgentCore Gateway fallback — Bedrock AgentCore Gateway can now reroute InvokeModel requests down an ordered fallback chain when a model throttles or fails, with a circuit breaker. Source
- Google agent governance — Google Cloud describes an Agent Gateway, an Agent Registry and per-agent SPIFFE-based identities, with token budgets and model routing in preview this quarter. Source
- Banks blocking third-party agents — Citigroup won’t let outside AI agents log in or transact, and Bank of America says it is restricting access while liability rules for agent-authorised payments are worked out, per FStech. Source
That’s the week. The patch can go in before the weekend, and the rest can wait for Monday.
Middle East, India & events · 2
- Humain and Nvidia plan up to 84MW — Saudi Arabia’s Humain expands its Nvidia deal to about 27,000 GPUs: 14MW of Blackwell B300 from Q4 2026, then 70MW of Vera Rubin from mid-2027, still subject to final agreements. Announced at GTC Berlin. Source
- G42 units explore an AI factory in Greece — Khazna and Core42 signed exploratory agreements with the Copelouzos Group, part of 18 UAE-Greece deals worth €12.75bn; the pacts are exploratory and no timelines or capacity are given. Source
Researched and drafted with AI, checked against the linked sources. How we use AI →