OpenAI runs safety tests on its own models. One test is called red-teaming. Hired testers try to break a system on purpose. During a recent test, OpenAI's team found a bug outside its own model. The bug sits inside Brotli. Brotli is a tool that shrinks files so they move faster online. Node.js, Bun, and Envoy all use it to handle web traffic. Millions of servers run one of those three tools.

The bug lets an attacker run code on someone else's server. The attack skips the password step entirely. It arrives as one broken file. The file looks like normal compressed data. Brotli tries to unpack it and crashes instead. That crash opens a door. Engineers gave the bug a name: CVE-2026-111497. It scored 9.2 out of 10 for severity. That score marks it critical.

OpenAI says the root cause turned up back in February. Engineers filed it as a routine bug at the time. The flaw stayed quiet for eight months. Node.js shipped a fix on October 21. Python packages got their own fix the next day. By October 23, the story had grown wider. A security firm named Aikido Security found the flaw also hits plain HTTP software. Python's Brotli package alone gets 82.8 million downloads a month.

That scale is why engineers call this one a big deal. OpenAI posted about the fix on X. The post pulled 3,278 likes within hours. It drew 294 replies too.

A safety test built to catch a model's mistakes caught a human mistake instead. The bug sat inside code the whole internet quietly leans on. Engineers wrote that code to compress files, for speed, years ago. It carried one small flaw for eight months. That software sits inside tools almost everyone runs, and few people know its name.

Jensen Huang runs Nvidia. He closed his keynote at GTC Berlin with four small robot ducks. The ducks are called Microduck. Hugging Face built them with a French team named Pollen Robotics. Each duck stands about 25 centimeters tall and costs 399 dollars.

On stage, Huang asked the ducks to walk, sit, and nap on command. One duck did a somersault when he asked. The robots learned those moves inside a simulator built on Nvidia's RTX Spark chip. Engineers trained the moves in that simulator first. Then they loaded the same moves onto the real robots.

Nvidia posted a video of the demo on X. The post pulled 11,523 likes. People shared it 1,620 times. It drew 374 replies. Hugging Face co-founder Clement Delangue said preorders would cross 20,000 units within a day of the keynote. He called it the best-selling robot of the year so far.

The code behind Microduck lives on GitHub. That code has drawn 10,528 stars from developers who want to build on it. The original Microduck launch, back in August, had already pulled 784 points on Hacker News. Christmas shipping is the new test. Pollen Robotics has promised the ducks by December.

A desk toy usually sells on cuteness alone. This one sells on proof. Huang showed the exact pipeline Nvidia wants factories and homes to trust. Train a skill inside a simulator first. Then hand that skill to a cheap machine in the real world. A duck that falls, stands back up, and keeps walking makes that pitch land softly. A slide stays flat on a screen. The crowd laughed at the show. Thousands of people went and bought one.

Nvidia agreed to buy Hugging Face in September for 12.93 billion dollars. Pollen Robotics came along as part of that deal. A chipmaker now steers a line of toy robots. That path runs from server racks to a kid's desk. It shows how far Nvidia wants its hardware to reach, one dancing duck at a time.

Aikido Security watches code for a living. On Friday night, the firm posted a warning on X. The warning named a bug called CVE-2026-111497. Engineers first called it Node2Shell. The bug started as a Node.js problem. Then Aikido found it spreads much further.

The flaw lives inside Brotli. Brotli is a tool that shrinks files for faster downloads. Many languages beyond Node.js use it too. Aikido's team showed Python programs carry the same hole. The Python package alone gets 82.8 million downloads a month. That number alone explains why engineers paid attention fast.

A day later, Aikido gave the bug a new name: HTTP2Shell. The new name marked a bigger reach. Any app that handles web traffic through Brotli can carry the flaw. That list includes Node.js, Bun, and Envoy. An attacker can send one broken file and run their own code on the target machine. The attack needs only that one file, sent over a normal web request.

Aikido's warning post pulled 1,762 likes within a day. It drew 74 replies from other security teams checking their own code. Hacker News picked up the story too. The discussion there reached 123 points and 67 comments. Programmers compared notes on which of their own tools used Brotli under the hood.

OpenAI's own red-teaming work first turned up the root cause back in February. Engineers filed it as a plain bug back then. The bug waited eight months before anyone called it a security risk. Aikido's follow-up showed how far one quiet flaw can travel once someone finally looks hard enough. A tool built to make the web a little faster carried a door. That door stayed open the whole time, for any attacker patient enough to find it. Plenty of them did look, once the warning spread.

Alibaba has said Qwen 4 is coming. It has given few other details so far. A new thread on Reddit's LocalLLaMA points to fresh code instead of a press release.

A developer named hzjane filed a pull request on GitHub. The request targets a repository called vllm-xpu-kernels. Its title names two models directly. One is Qwen3.8-flash-next. The other is Qwen4-27B. The code adds support for running Qwen4-27B on Intel chips. The change runs large. It adds 6,947 lines. It removes 479 lines across 56 files.

Reddit users dug into who filed it. HzJane has worked on Intel's own open-source tools before. One of those tools, called llm-scaler, carries 575 stars on GitHub already. Other names on the same pull request work on Intel's chip team in China too. That pattern reads as real engineering work. It fits a model still being built, rather than a stranger's guess.

One Reddit comment zoomed into the numbers themselves. The code shows the memory a model needs per answer stays flat for the new 27B size. Readers debated what that means for speed once the model ships. The thread pulled 35 comments within hours. Readers split between excited guesses and sharper reads of the code.

Alibaba's own roadmap names only a new flagship model in training, with a date still open. Even so, quiet code inside Alibaba's own tools has now hinted at Qwen 4 twice this week. Engineers often ship support code ahead of a launch. That way, the software works the moment a model lands. One pull request changed that. It came from a name with a real paper trail. It told Reddit more about Qwen 4's size than any teaser post has managed yet.

A research group called ISTA-DASLab shrinks AI models for a living. Late Friday, the group posted a new release to Reddit's LocalLLaMA. The release compresses DeepSeek-V4.1-Flash-1017. That is a large model built by DeepSeek.

ISTA-DASLab uses its own method for this work. The method carries a name: GSQ-RCO. It picks which parts of a model to compress hard. It leaves other parts alone. That choice matters. A model loses accuracy when every part gets squeezed the same way. The team posted the finished files on Hugging Face. Readers could download them there as a GGUF file.

The post drew notice fast inside the thread. One early reply pointed out a gap. The popular tool llama.cpp lacks support for the new model's architecture so far. Two pull requests on GitHub aim to add that support. Both sit unmerged for now. Readers in the thread named two other projects, Xolotl and Maya. Both are forks that might run the model sooner.

The thread pulled 30 comments within hours. Most comments tracked which tool would run the new files first. On Hugging Face, the compressed model picked up 66 likes on its first day. The original DeepSeek-V4.1-Flash-1017, before any compression, already carries 57,715 downloads. It carries 2,604 likes on its own page too.

Shrinking a big model matters more than it sounds. A smaller file lets more people run a strong model on one home computer. They skip the server farm entirely. ISTA-DASLab chose to publish right away, ahead of full tool support. That choice shows how fast this corner of AI moves. Readers would rather test a rough file today than wait weeks for a tidy one. The tools will catch up soon enough. The file sits ready now, and people are already poking at it.