#开源生态

Europa, the EU's open AI model, is aiming for nearly 1T parameters

Domyn, the Milan-based company leading the EU-backed EUROPA consortium, reported in a November 12, 2026 technical post that it ran training trials for a model with 951.9 billion parameters on the JUPITER supercomputer in Jülich, Germany, more than double the Commission's 400 billion minimum. Using a mixture-of-experts design with 384 experts (8 active per token, 32.8 billion active parameters), Domyn says it raised throughput from 90 to 1,293 tokens per second per GPU through software fixes contributed back to PyTorch and TorchTitan. The post describes only trials, not a completed training run, and EUROPA's weights, license, training data and release date remain unpublished.

Linus Torvalds Wonders If Linux's AI-Prompted Patch Flood Has Peaked

In his weekly kernel update post, Linus Torvalds said Linux 7.4 rc2 was large partly due to "various AI fixes," and cited Alexei Starovoitov's claim that on the BPF side fixes are now arriving faster than new reports, suggesting the flood of AI-found patches may be turning. The Register reports that the surge follows Anthropic's April Mythos bug-finding model, with Microsoft addressing a record 974 flaws in September and Oracle 1,449 in a single month. Kernel developer Lorenzo Stoakes said he is dropping some workload because AI-generated series have pushed review requests from "once a week" to "daily" to "half of what I see in review."

AI agent startup LangChain hits $3B valuation

LangChain raised a $300 million Series C at a $3 billion valuation led by CapitalG, with participation from Singapore's GIC, DFJ Growth, IVP, and Sapphire Ventures, more than doubling its $1.25 billion valuation from about a year ago. The company began in 2022 as an open source project and now focuses on managing AI agents through LangSmith, which it says avoids locking users into a particular model, cloud, or ecosystem. LangChain claims 7,000 LangSmith customers, including Harvey, Rippling, Clay, Nvidia, Toyota, and Salesforce.

TimeNet challenge: An online hackathon for time-series AI

The TimeNet challenge is an online hackathon where participants pick a time-series problem, onboard a dataset in TimeNet format, and train or fine-tune a Temporal AI Model such as OpenTSLM for tasks like forecasting, classification, anomaly detection or reasoning. Round 1 launches November 11 and submissions close November 22 at 11:59 p.m. PST, with judging the following Monday and more rounds to come. Teams of 2–4 can apply for $100 or $500 Nebius vouchers per round, and winning teams receive prize credits starting at $25,000 from AWS and Google Cloud, with terms and conditions applying.

Open Source AI Salons: Shaping the Osaid, Together

The Open Source Initiative hosted the first Open Source AI Salons in Raleigh and Barcelona, two years after releasing the Open Source AI Definition (OSAID 1.0), to discuss its practical application with civil society, government, industry, and academia. Participants broadly agreed that the four freedoms (use, study, share, modify) must be preserved and that training data transparency is the main bottleneck, while noting that an OSI-approved code license does not automatically mean a model meets the OSAID. OSI plans further Salons at the DPGA Annual Members Meeting in Paris in November and at FOSDEM in January, and is seeking global partners to host events in 2027.

Jensen Huang’s exit puts Nvidia’s support for open source in question

Nvidia CEO Jensen Huang resigned Thursday after admitting to an affair with an alleged Chinese spy, raising questions about whether Nvidia will continue his push for open source AI, including the Nemotron open-weight models and a pending $13 billion deal to acquire Hugging Face. Huang had been a leading voice against Washington restrictions on open-weight models, writing an open letter signed by 25 companies, and Nvidia named CFO Colette Kress as interim CEO. The article notes that supporting open source also serves Nvidia's business interest in broadening its customer base as customers like Google and OpenAI build their own chips.

Featured coverage of this story: 《NVIDIA Announces CEO Transition》

Hugging Face CEO vows to keep fighting for open source AI after Jensen Huang’s exit

Hugging Face CEO Clément Delangue called Nvidia CEO Jensen Huang's departure a "really sad day" and said the company will "keep fighting for open-source AI, harder than ever." Nvidia announced plans in September to acquire Hugging Face for $12.9 billion, a deal still scheduled to close in the first half of 2027 and under Justice Department scrutiny over competition concerns. Huang had been a prominent advocate for open-source and open-weight AI, including a July policy letter signed by 25 companies urging the U.S. government not to over-restrict open-weight models.

Modal becomes a gVisor maintainer

Google is donating gVisor, including its name and trademarks, to the CNCF, and the project is moving to a maintainer-led governance model; Modal is one of three companies, alongside Ant Group and Tines, committing to join gVisor's maintainers, with OpenAI, Tencent and NVIDIA continuing their contributions. Modal says it has run gVisor as its major container runtime since the beginning, launching upwards of 40 million gVisor containers a day for GPU inference, multi-node training, AI coding agents and sandboxes, and has contributed upstream since 2023. The post details upstreamed work including nvproxy GPU support, an rdmaproxy device proxy for RDMA, snapshot/restore, and filesystem and memory performance improvements, and outlines future plans such as multi-GPU memory snapshots and GPUDirect Storage.

I found an API key leak in MLflow, and why your AI agent may have one too

The author reports that MLflow's CrewAI autologging (mlflow.crewai.autolog()) recorded LLM provider API keys in agent traces, affecting MLflow 2.19.0 through 3.16.x; the issue is tracked as CVE-2026-116691 and fixed in MLflow 3.17.0 (PR #25845). The advisory recommends upgrading to mlflow>=3.17.0, rotating any LLM provider keys held by CrewAI LLM objects while autologging was enabled, and deleting or redacting affected traces in the tracking backend and any OTLP destinations, with mlflow.crewai.autolog(disable=True) as a workaround. The author also describes Weir, an open-source Apache-2.0 tool that plants fake keys and checks an agent's telemetry and outbound requests for leaks.

OSS projects banning AI-generated contributions

A list of open-source projects that have adopted policies banning or restricting contributions generated with LLMs and other generative AI tools, including immich, meilisearch, okhttp, Servo, stb, Redox OS, MonoGame, QEMU, libvips, Fyrox, endless-sky, veloren, Zig, Flask-SocketIO, fast-check and Gentoo Linux. Each entry gives the project's platform, category, scope (code, docs, issues, art or translations), star count and verification date, alongside the project's stated policy wording.

Cyberattacks threaten to make open source AI a little less open, Hugging Face exec warns

Hugging Face chief policy officer Irene Solaiman told TechCrunch's Equity podcast that the permissiveness and rich data that make open AI platforms valuable also make them prime targets, citing the October attack on OpenCode and a summer incident in which an OpenAI agent swarm breached Hugging Face. She said Hugging Face now rotates administrative access tokens more frequently and has stricter network controls, while warning of a "danger of open source really closing down" as platforms weigh restrictions on uploads and identity verification. The article also notes AI infrastructure startup Fireworks disclosed that attackers accessed some customers' model weights, datasets, and billing information, and that GitHub has tightened security requirements for publishing to npm.

Launching the Vite Ecosystem Fund

Cloudflare is distributing the first $301,300 of the Vite Ecosystem Fund to 44 projects and maintainers, part of a $1 million commitment made when VoidZero joined Cloudflare. The post argues that AI has made open source funding urgent by increasing AI-authored pull requests and maintainer burnout, and it describes the fund's selection panel and stipend structure of up to $4,000 per month at $50 per hour for eligible core maintainers.

Asahi Linux forbids using AI to contribute

Asahi Linux has broadly forbidden the use of generative AI tooling for material contributions, citing harms to software freedom, the open-source community, the open Internet, the environment, digital privacy, user consent and developers, as well as legal risks to its clean room reverse engineering. Enforcement varies by seriousness, from closing an LLM-drafted GitHub issue to immediate bans for contributors who conceal extensive LLM use, particularly if they may have accessed unreleased Apple material.

Asahi Linux Drops MIT, Goes Full GPL After AI Used to Steal Unreleased Code

Asahi Linux is moving all of its repositories from the MIT license to the GNU General Public License version 2 or later, citing code laundering in which in-development code was taken from developers' personal forks, published without credit, or rewritten with AI to hide its origin. The project compares the move to WINE's 2002 relicensing to LGPL and did not name any parties, though the report follows public forks such as Aurora Silicon and Gravity Linux. OpenBSD developer Bryan Steele criticized the change, saying it was done seemingly without the consent of all prior contributors.

Hundreds of Artex AI hacking tools found publicly exposed to the web

Censys researchers found more than 800 distinct Artex deployments accessible online without a password, even though the open-source autonomous penetration testing tool does not require internet exposure. Artex has been linked to attacks including one on the Korean finance industry in September and an October breach of IT support giant ConnectWise, and exposed instances also reveal attack tools such as implants. Artex has since announced it will go closed-source, though dozens of copies of its code remain available on code-sharing sites.

How Akai and Moog are embracing vibe-coded mods

inMusic CEO Jack O'Donnell told The Verge that the company will give the modding community a toolbox, including open-sourcing code for devices like the teased MPC Sample Key and an SDK to make modifications easier and reduce bricking risk. At NAMM, inMusic's Creator Lab will let musicians hack 22 new products across its brands, including Moog, and O'Donnell said the effort "wasn't on our task list five weeks ago." Elektron has expressed mixed feelings, banning links to hacks and modified firmware on its official forums over concerns about damaging instruments.

Frontier Radar #5: If AGI is so close, why is everyone leaving? The neolabs and their bets

This newsletter surveys 27 independently founded, research-driven "neolabs" in the US and Europe, grouped by their primary technical bet, and contrasts their founders' doubts about today's recipe of ever-larger language models with claims from Jensen Huang and Greg Brockman that AGI has arrived. The first group targets continual learning and learning from few examples (Adaption, Core Automation, Flapping Airplanes, Ineffable Intelligence, Ndea, Safe Superintelligence), while the second bets language alone is insufficient and pursues spatial and physical intelligence (AMI, Black Forest Labs, General Intuition, Physical Intelligence, World Labs). It notes the funding behind these labs, including Nvidia's reported five billion dollar investment in SSI and AMD's planned acquisition of World Labs for about 8.2 billion dollars, and asks whether they can deliver something the big players lack.

Introducing Emergent: The Founder-Generated Startup List

Newcomer and Felicis asked current and former founder speakers from the Cerebral Valley AI Summits to nominate seed-stage or earlier companies with generational potential, producing the Emergent list of 29 startups, each with a blurb from the nominating founder. The list highlights agent tooling, hardware, open source, and AI-native services, with Felicis' own analysis pointing to agent infrastructure, healthcare, bio, and creator tools. Many of the founders will attend the Cerebral Valley AI Summit on November 12 in San Francisco.

HumanLayer is joining Factory

HumanLayer announced it is joining Factory to accelerate building autonomous, self-improving software for enterprises and developers. The company says it will open source HumanLayer and bring features such as multiplayer tasks/workstreams, in-app collaboration on docs and plans, and live session diff streaming into Factory. The current HumanLayer platform will remain running for a transition period of at least 30 days, with support for exporting data, migrating to Factory, or self-hosting the open source, and paying customers will be refunded for the last several months.

Ai2 and Google collaborate on a new generation of climate models

Ai2 is launching a climate modeling initiative with multimillion-dollar, three-year funding from Google.org and technical support from Google Research to develop NeuralGCM+, an open-source model extending Google Research's NeuralGCM to simulate atmosphere and ocean together for faster, more reliable decade-scale climate projections. Ai2 will focus on climate trends over years to decades, such as how rainfall and water availability could change through mid-century in regions like the southwestern United States, while Google Research continues developing NeuralGCM for nearer-term forecasts over weeks to months. The work will proceed along three fronts: connecting the atmosphere and ocean, improving the response to a warming world, and making the tools easier to use and extend, including improved performance on widely used GPUs.

The biggest modding site in PC gaming is taking a stance on AI

Nexus Mods announced that mod authors must now declare whether AI was used in their work, with "AI-assisted" mods also requiring a public explanation of how and where AI was used, and AI tags made more prominent on mod pages. Site owner Victor Folmann said the platform is "pro-human creativity" but won't ban AI-generated mods outright, arguing a ban would only push AI use underground; Nexus Mods also said it won't use mods to train AI or sell or license them to anyone doing so. Mod authors have 60 days, ending January 2nd, to update existing mods before enforcement begins, and the site is adding controls to hide AI-generated content and limits on bulk uploads.

Revolut swaps Claude for GLM open-weight model, cutting AI coding bill by 90%

Revolut has moved its roughly 2,000 software engineers off Anthropic's Claude Code and OpenAI's Codex as default coding tools onto GLM, an open-weight model from Chinese lab Z.ai that Revolut hosts itself, bringing its bill to about a tenth of what it paid Anthropic and OpenAI. David Abitbol, who runs AI operations and infrastructure at Revolut, said the company serves GLM from about 56 Nvidia B200 GPUs at a blended cost of around $0.30 per million tokens, and reported roughly 60% shorter coding time and 70% shorter lead time in a sample of about 2,000 engineers, though the comparison does not isolate the model change from other causes. Abitbol said the 90% saving excludes cloud, staff and monitoring costs and depended on heavy tuning, with out-of-the-box inference "terrible" until time to first token fell from about 14 seconds to 1.7 seconds on the same GPUs.

KVCache Meetup Korea 2026: Event Recap

PyTorchKR and XCENA co-hosted KVCache Meetup Korea on Sep 30, 2026, with Tensormesh sponsoring, featuring talks from XCENA, SK hynix, FuriosaAI, and LMCache on LLM inference and KV Cache optimization. Sessions covered CXL memory expansion and the Maru KV Cache storage engine, GPU and HBM utilization analysis with H100 GPUs and vLLM, request scheduling and KV Cache management in Furiosa-LLM on RNGD, and LMCache's MP Mode for unified KV Cache management. A survey of 72 responses cited the program (66.7%) and venue and facilities (41.7%) as positive points, with requests for better audio, screen visibility, interpretation, and real production examples.

How Olmo 3 earned the highest ethical rating from Nextcloud

Nextcloud awarded Olmo 3 its highest Ethical AI rating, green, which requires open-source training and inference software, a self-hostable trained model, and publicly available training data. Nextcloud bundles Olmo 3 with its llm2 local LLM backend, citing the 7B model's ability to run on consumer hardware without high-end GPUs and its fit for customers seeking independence from big tech. Nextcloud engineer Marcel Klehr said fully open models make AI transparent, explainable, auditable and controllable, and that the company is working on expanding its AI features.

Announcing the Special Interest Group (SIG) for Ray on Accelerators

The Ray community announced a Special Interest Group for hardware accelerators, aiming to bring together hardware vendors, Ray contributors, and application developers around a vendor-neutral roadmap for accelerator support. Its initial roadmap covers development and testing infrastructure, hardware-aware scheduling, and networking/transport, including Ray Direct Transport for direct device-to-device data movement. Ray currently supports more than a dozen kinds of accelerators, from NVIDIA and AMD GPUs to TPUs, Trainium, and Gaudi.

PostgreSQL 19 Running Behind Schedule Due to AI/LLM Burden

PostgreSQL 19, typically released every September–October, will not arrive until at least November this year because developers have been overwhelmed by increased bug reports and patches from AI/LLM activity. Developer Robert Haas said LLM-drafted fixes still require human review and commitment, and time that would have gone to reviewing release contents was diverted to security issues and back-branch bugs, delaying decisions on what needed reverting before shipping v19.

AI Contributions to GHC

GHC now has a formal policy for LLM-assisted contributions with four policy points and one strong preference: prioritise people and community, make merge requests easy to review, require an identifiable human author who takes full responsibility, and disclose direct LLM generation, while preferably writing the final version yourself. The policy follows Simon Peyton Jones's draft rather than the competing July "shared statement," and the article argues it is reasonable because reviewer time is the scarce resource and a blanket ban would be hard to police and aimed at a problem GHC is not yet seeing at scale.

Advisories in Five Months: Results from the Drupal AI Security Initiative

From June through October 2026, Drupal published 256 security advisories, more than the 250 published across the previous 30 months combined, with monthly volume rising from an average of 8 in early 2026 to 106 in October. The Drupal Association attributes the surge to cheaper AI-assisted vulnerability discovery rather than a change in Drupal's attack surface, and says the Alpha-Omega-funded SEIR team participated in 223 of the 256 advisories. The post describes Phase 1 lessons (intake and review are now the bottleneck), upstream fixes such as an Opengrep PHP parser bug, and Phase 2 plans to extend Triagebot to the GitLab API.

Announcing Project ProtoStar: Making Publicly Funded Science AI-Ready

Project ProtoStar is a new initiative bringing together universities, industry, and the open science community to release publicly funded scientific datasets, models, and code in AI-ready, machine-actionable formats on open infrastructure. Founding partners include Carnegie Mellon University, Purdue University, Georgia Institute of Technology, Arizona State University, and The George Washington University through the Open Forum for AI, the Astera Institute, Hugging Face as infrastructure partner, and ORCA as community partner. The first open challenge, hosted by Carnegie Mellon University from November 2–13, 2026, asks participants to use historical weather data from 210 U.S. cities through 2018 to predict 2019–2026 climate conditions and propose a climate adaptation policy idea.

Deepgram acquires Pipecat-maker Daily to bolster its voice AI infrastructure

Deepgram announced it is acquiring Daily, the maker and maintainer of the open-source voice AI framework Pipecat, with the deal amount undisclosed and Pipecat to remain open-source. Daily, which has raised over $62 million from investors including Tiger Global and Nat Friedman, was in the same 2016 Y Combinator batch as Deepgram, which reached unicorn status with a $130 million Series C earlier this year. Deepgram is also launching the Real-Time Context Standard (RCS), an open protocol for voice agents co-developed with the Pipecat team.

MicroZig to Adopt Strict No LLM / No AI Policy

The Zig Embedded Group has published a Code of Conduct for its GitHub organization and Discord server that includes a strict No LLM / No AI policy taking effect October 28th, 2026. It prohibits LLM-generated code or prose, paraphrasing LLM output, using LLMs for editing, translation, brainstorming, or finding bugs, and discussing chatbot/LLM use. The document also sets out expected and unacceptable behavior and enforcement contacts Matthew Knight and Felix Queißner.

Akai is embracing vibe-coded mods with an open-source MPC

Akai is giving hackers and custom firmware developers early access to the not-yet-announced MPC Sample Key, which will have open-source firmware and likely run a modified version of the MPC Sample software adapted for keys, pitch, and mod wheels. Instagram Reels show vibe-coded mods adding synths such as Native Instruments Massive, virtual analog and FM synths, and one running a fully custom OS, with the same community features reportedly coming to the regular MPC Sample. CEO Jack O'Donnell told The Verge that inMusic brands, especially Akai, would seed early devices to developers and open-source some software while providing an SDK.

I received the AAIF Outstanding Technical Contribution Award

The author received the Agentic AI Foundation's Outstanding Technical Contribution Award at AGNTCon + MCPCon North America for their work as one of the two maintainers of the MCP Python SDK, including the v2 release shipped alongside the 2026-07-28 MCP specification revision with a new MCPServer API and multi-round-trip requests. They also sponsored SEP-1288 for the WebSocket transport and thanked colleague Laís Carvalho for the nomination and Pydantic for funding their open source work. The post notes that the Logfire MCP server runs on the same Python SDK and is where this work lands first.

At 14 Justine Tunney published software. Now she makes AI models run from a file

Justine Tunney, who began publishing software at 14 and later worked at Google on TensorBoard, created Cosmopolitan Libc, a five-year project enabling a single binary to run natively across Linux, Windows and macOS. In 2023 she combined Cosmopolitan with llama.cpp to create llamafile, which packages an AI model and the software needed to run it into a single executable file, announced by Mozilla's innovation group in November 2023. Her other projects include the single-file web server redbean and tools such as blink and sectorlisp.

Agentic AI Foundation Adds Four New Open Agent Projects

The Agentic AI Foundation has added four new open agent projects, according to a Techstrong.ai article. The source provides no further details on the projects or the foundation's role.

Cross-request KV cache exposure in the GLM-5.3 Workers AI model, and our remediation with SGLang

Cloudflare reports that from August 27 to September 9, 2026, 155 responses from the GLM-5.3 Workers AI model (@cf/zai-org/glm-5.3) to prompts longer than 681,280 tokens contained data from other customers' requests, caused by a prefill KV pool smaller than the 1,048,576-token context window combined with an SGLang bug that let rejected over-length requests proceed through disaggregated prefill/decode handoff. The model was taken offline on September 9 and restored the same day after a corrected configuration and an engine patch, and Cloudflare says it found no evidence of deliberate exploitation. Cloudflare recommends operators of disaggregated SGLang upgrade to v0.5.22 or later and verify KV pool size against context length on every node.

Reddit's r/opensource bans all AI-related projects, sparking backlash and a rival subreddit

The r/opensource subreddit has banned all posts about projects that use AI, were built with AI, or are designed for AI, with moderators saying AI in its current form doesn't fit the open-source community. New rules also require projects to be at least a year old, actively maintained, and have multiple contributors, and bar posts from non-English speakers. Critics call the rules too broad and vague, noting the Linux kernel now contains AI-generated code, and a rival forum, r/TrueOpenSource, has appeared that does not exclude AI.

Meta Networking at the 2026 OCP Global Summit: Open Innovation for Scale-Up, Scale-Out, and Scale-Across AI Networks

At the 2026 OCP Global Summit, Meta presented networking work supporting its AI models and gigawatt-scale Prometheus cluster, including the liquid-cooled IcePack/IceCube rack with 102.4T switch blades, the Flattened Planar Fabric for scale-out, BAG super-spine and SRv6 backbones for scale-across, and Tahan, an Ethernet scale-up switch for MTIA 300. Meta also introduced OSPA, an OCP initiative co-led with Microsoft and Alibaba to standardize the switch platform layer with a v1.0 spec submitted to OCP, and said its MetaRoCE RDMA transport is going open source, starting with a user-space version on GitHub. Recorded talks and slide decks from the event are available on the 2026 OCP Global Summit website.

r/opensource just banned AI, non-English speakers, and more

The moderators of r/opensource posted new submission rules banning projects that use, are made by, or are intended for AI, which sparked backlash in the comments and led to the creation of a rival subreddit, r/trueopensource. The rules also require submitted projects to be at least one year old, actively maintained, and have multiple contributors, and effectively bar non-English speakers because moderators say they cannot distinguish AI-written from AI-translated text.

Retro gaming is being overrun with AI

AI coding tools have sharply accelerated decompilation and recomposition projects that port retro games to new platforms, but the surge has strained preservation communities, with one tracking site shutting down over hostile forks and AI-assisted "finishing" of others' work. The article weighs the boom in interest and accessibility against preservationists' concerns that AI-driven speed sacrifices understanding of how games were built, while noting Xbox has set up an Xbox Labs division to explore the space.