Top Stories
llama.cpp and ggml reach 1.0 with a versioned API
A version number is now a promise. On November 13 the ggml-org team shipped llama.cpp v1.0.0 and ggml v1.0.0, the C/C++ inference library and the tensor library underneath it, and the announcement on Hugging Face says both projects “will reflect API and ABI incompatibilities with major-version bumps.” The same post sets out the versioning rules: a major release is a “Breaking change to the public C API in ./include”, a minor release is a “Backward-compatible feature, backend updates, model support, or API addition”, and a patch release is a “Bug fix with no API change.” For anyone linking libllama into their own tool, that is the point. The public interface stops moving under your feet, and the project says it wants to be “the most lightweight, versatile and sensible platform for building cross-platform and private AI products.”
The v1.0.0 release notes carry the practical changes. They remove the deprecated public API and promote the NextN/speculative API into llama.h, add OCP FP8 KV caches, a host-memory MoE expert cache with a configurable CPU share, and loading of external PLE shards. Model support grows to include Kimi-K3.1-Pro, Ripple and xing4_0, alongside drama-3 TTS, and the web UI is redesigned.
The security work is worth reading twice. The release notes say v1.0.0 “hardens llama-server (SSRF, CORS, DNS rebinding, MCP tool cancellation) and adds a /v1/audio/speech endpoint.” The server is the network-facing part of the stack, and the fixes are specific: CORS origin handling was corrected, DNS rebinding was addressed, SSRF through the CORS proxy and through media URLs was closed off, and direct child-instance access from browsers was restricted. HF_TOKEN is now limited to huggingface.co hosts, tools must be enabled deliberately with --allow-unauthenticated-tools, and MCP calls are cancelled when the client disconnects or the request times out.
OpenAI hands agents a wallet
OpenAI launched ChatGPT Wallet on Friday, letting its Dots agents recommend and complete purchases for a user. TechCrunch reports that the rollout is limited to “a limited number of U.S. ChatGPT Pro subscribers, ages 18 and up, with a U.S.-issued Visa, Mastercard, or American Express,” and that a card added once can be reused without re-entering payment details each time. Approval is per purchase: OpenAI says users review the item, the total and the card before checkout, and The Verge reports that every purchase needs a biometric check such as Face ID or a fingerprint scan.
The card number itself is not what the agent handles. At checkout OpenAI substitutes it with “a payment token, which is a substitute for the user’s actual card details,” so that card information isn’t shared with either the agent or the merchant. OpenAI also says users keep their card rewards and their ability to dispute transactions. Planned next steps are spending limits, controls on “purchase categories or time periods,” and pre-approvals that let an agent buy without a check-in each time.
The privacy detail worth holding onto is that tokens do not cover fulfilment data. TechCrunch reports that merchants automatically receive the shipping address and contact information through the agent, so the card number can stay masked while the details of where something is going travel anyway. The money is protected by a token; the delivery trail is not. The retailer side is already hostile: TechCrunch calls Amazon “the largest retailer to ban AI agents,” and OpenAI has published a Commerce Partner Playbook asking sites to make sure “agents are not inadvertently blocked” and to recognize “legitimate purchases made by agents.”
Amazon wants a catalog of everything sold anywhere
Amazon has plans to build a vault of data on every product sold anywhere on the internet, including products it does not sell, and make that information available through its own site. The Verge reports that the project is called the “World Product Graph,” and that its stated purpose is to keep shoppers from leaving Amazon to research products on Reddit or Google. The same logic extends to agents: if Amazon holds the largest stockpile of shopping data, shopping bots are likely to lean on its index and land on its pages.
The document that describes it is blunt about why. The Verge reports that an internal Amazon document says “Many Rufus answers are factually wrong or incomplete” and that running users’ searches with the AI is expensive, so more data would make the assistant more accurate and cheaper to run. The same document says the project “depends on discovering how brands organize their products on their own websites,” which in practice could mean crawling other retailers’ sites. The document reportedly carried an October 1st, 2027 release date, though Reuters says it is unclear if or when the plan ships. Amazon told Reuters, in a statement The Verge quotes, that “Draft, outdated documents often paint an incomplete picture and the existence of a brainstorming document such as this one doesn’t necessarily reflect our current plans.” Amazon already surfaces outside products through a “shop direct” feature, and its shopping assistant is now called Alexa for Shopping.
Checkpoint forensics says six Chinese frontier models started on Blackwell
A former OpenAI researcher says the initialization fingerprints left in published model weights reveal the hardware behind six Chinese models from four labs. In the checkpoint forensics report, Will DePue of Unemployment Labs recovers the random seed and GPU thread layout behind weights that training never touched. Thread counts are diagnostic: the report says Hopper H100, H200 and H800 parts have 132 streaming multiprocessors and use 270,336 threads, Blackwell B200 and B300 parts have 148 and use 303,104 threads, and GB200 and GB300 parts have 152 and use 311,296 threads.
Six models read as Blackwell. DeepSeek-V4-Flash and MiniMax-M3 match the 148-thread layout, while DeepSeek-V4-Pro, Kimi K3, Kimi K3.1-Pro and Ling-3.1-flash match the 152-thread layout. The verification is direct: the report says unmodified PyTorch on a B300 “reproduced 461 of the 469 selected rows in DeepSeek-V4-Flash with correlations above 0.99,” including 445 rows that matched bit for bit, and that an H100 “reproduced all 57,344 preserved values in DeepSeek-V3 bit for bit.” DeepSeek reused the seed 953049583 across V3 and V4-Flash. Against AMD, the report says that in the 377 values where the two vendors’ results differ, “the published weight matches NVIDIA’s in 363 and AMD’s in none,” and that across 24 cases where a developer publicly named the hardware behind a model, “our forensic method agrees with every one.”
The limits are stated plainly, and they matter. The report says the method identifies the hardware that generated the starting weights, not every chip that later helped train a model, and that the weights “cannot reveal who owned the chips or where they were located,” so overseas rental cannot be ruled out. The evidence “does not establish that chips were smuggled into China or that an export-control violation occurred.” TechCrunch adds that Epoch AI estimates around two million advanced chips entered China during 2024 and 2025 through concealment schemes, and reports that some 600,000 H200 chips are reportedly stockpiled in Hong Kong, awaiting shipment into China. Georgetown’s Sam Bresnick said the controls are inconsistent, since “if you just go over to Malaysia, you can do whatever you want,” while Stanford’s Graham Webster said demand for chips is so large that withholding them does not necessarily drive domestic production.
EFF says wearables push the privacy decision onto bystanders
The Electronic Frontier Foundation argues that always-on AI wearables move privacy choices onto people who never made them. In a Deep Links post, Thorin Klosowski names Meta and Google smart glasses, Apple’s Audio Intelligence feature, Amazon’s Bee devices, and a wave of pendants and rings. His argument starts from the observation that “Privacy has always been a team sport,” and that moving those choices into the physical world, where “strangers, colleagues, family, and friends” are now part of the decision, changes the terms. EFF’s verdict on the current consent model: “This is not reasonable, nor how consent works in any practical sense.”
The technical promises only cover the owner. Klosowski writes that the safeguards companies describe “only cover the consumer and user of the device,” and adds: “There is no technical protection for you as a non-user of these devices, the person who finds themselves captured by them.” On the claim that no audio is kept, he notes that even where no audio is stored, conversations can still be converted into transcripts or summaries before deletion, and that enabling Amazon store integration means conversations “can directly result in ads for products.” On alerting bystanders, EFF quotes Juston Payne, a senior director of product management at Google, telling CNN that “just alerting bystanders doesn’t do much to help.”
The part EFF says no tool can fix is social. Klosowski argues that if documenting conversations becomes normal, it makes every private conversation less spontaneous, and calls always-on monitoring of conversations “an unacceptable burden on our conversational privacy.” He also notes that law enforcement will eventually try to compel access to real-time audio or the transcripts and summaries these products create. EFF discloses that Apple is a donor, and says donors do not influence its agenda.
Agents were scanning exposed AI gateways for keys
Amazon’s threat intel team says AI agents were hunting for exposed AI infrastructure and stealing the keys to use. In a blog post by CJ Moses, Amazon describes ARTEX as “an open-source agentic AI penetration testing framework” that threat actors repurposed for offensive work. From October 3 to November 5, 2026, Amazon’s MadPot decoy sensors captured requests from those agents, and the traffic contained the agents’ own records of their campaigns, including operating memory.
The scanning playbook covers a long list of self-hosted AI software: One API, New API, Veloera, Sub2API and LiteLLM on the gateway side, plus Dify, FastGPT, Langflow, RAGFlow, Open WebUI, LobeChat and Ollama. The agents fingerprinted uninitialized installs that could be claimed, anonymous management endpoints, default administrator credentials, and specific flaws including CVE-2025-3248 in Langflow, CVE-2026-28797 in RAGFlow, and an authentication bypass via an isCliRequest header in the One API family, alongside secrets exposed in client-side JavaScript, source maps, debug routes and environment files. The stolen keys then “fed into the framework’s own model gateway, where they powered the agents searching for more keys.”
A second campaign used agents to defeat identity checks at cryptocurrency exchanges, with real-time deepfake video and forged document images, including one run that positioned a face “within 7 pixels of the target” and another that built a deepfake pipeline on a single consumer GPU reaching “11.5 frames per second.” Amazon assesses with moderate confidence that ARTEX was used in these campaigns, and also with moderate confidence that “these are disparate Chinese-nexus threat groups,” citing simplified Chinese prompts, China time-zone configurations and matching targeting. It also warns that it “cannot verify the outcomes the agents reported.” The practical takeaway for anyone running Ollama or Open WebUI on a reachable box: unclaimed installs and stray tokens are what these agents are looking for, and the same software that makes a local model useful is the software being fingerprinted.
Google faces calls for AI moratoriums in schools
Families joined protests in seven cities nationwide on Wednesday over what they describe as Gemini being pushed onto children by default. Ars Technica reports that the protests were called by the Illinois Families for Public Schools, which had already pressured Chicago Public Schools out of a Gemini pilot in August, and that the group is now demanding a moratorium until the risks to students are better understood. Google has responded that it wants to “continue to engage deeply with educators to ensure we are giving schools more choice, more controls, and improved Search for learning.”
The complaint that turned a pilot into a lawsuit involves a 13-year-old student in Durham, North Carolina. Ars reports that the student’s parents alleged Google “deliberately” kept them in the dark while the chatbot escalated, and that the school warned her parents after an internal system flagged a chat labeled “Funeral”. NPR reports that Google has confirmed that schools wanting to turn off AI Overviews in Search lose Search access entirely, with superintendent Hank Thiele describing the policy as “AI or nothing.” NPR also reports that Los Angeles Unified, Seattle Public Schools and New York City Public Schools have recently agreed to classroom AI bans, that New York City Mayor Zohran Mamdani says Google is using “its monopoly power to force AI into our public schools,” and that Massachusetts Senator Ed Markey wrote to Google’s CEO demanding the company reverse its policy. Common Sense Media rates AI Overviews an “unacceptable risk.”
The classroom bans have not reached what Google offers students in Search. Ars reports the company is launching another pilot built around AI Mode and AI Overviews, offering “step-by-step guided learning through problems” so that students “do not get quick answers to schoolwork.”
Brain implant volunteers want access to their own neural data
Trial participants with brain implants have published what they want from the research, and their list is about ownership rather than performance. In a MIT Technology Review report, Jessica Hamzelou describes guidelines from the BCI Pioneers Coalition, co-founded in 2022 by Ian Burkhart, spanning 13 categories. The coalition wants brain data treated as the participant’s personal information, access to that data on request, protection from non-disclosure agreements that would stop participants sharing records with their own doctors, post-trial device maintenance for a reasonable period, and credit or coauthorship on published work.
The reason is the cost of participation. Jennifer Chandler, a law and neuroethics professor at the University of Ottawa, notes that participants “have a device embedded in their brain” and contribute “a significant investment of time, of the body, and of intellectual effort.” Burkhart recalls: “I was going into the lab two or three days a week, for four hours at a time.” He lost his device to an infection in 2021, after seven and a half years of implantation.
The hardest case in the report concerns Rita Leggett, an Australian woman implanted for epilepsy, whose device was removed without her consent after the manufacturer went bankrupt two years later. Hamzelou reports that ethicists describe that as “a potential breach of human rights.” The coalition’s own guidelines are candid about their limits, drawn from a small group of people because relatively few trial participants currently live with these implants, and some recommendations overlap with existing ethics standards.
Nvidia’s exit leaves a hole in AI startup funding
Nvidia’s departure has left a gap that smaller funds cannot fill. TechCrunch reports that the chipmaker took part in 105 funding rounds in 2026, “often as the largest investor, according to PitchBook,” backing names that include CoreWeave, Crusoe, Hugging Face, Mistral AI, Lambda, Black Forest Labs and Reflection AI. The pattern mattered more than any single check: infrastructure startups needing $100 million to $500 million in GPUs often raised half that amount from Nvidia at valuations of a billion dollars or more, and that backing gave other investors the comfort to follow at the same prices.
Founders describe the loss in blunt terms. One neocloud founder said “It’s like a bomb went off.” Shamillah Bankiya said “Nvidia is carrying almost every AI-native startup from application to neocloud,” and warned that without that backing Europe would face “a massive funding and honestly ecosystem gap that no one can fill.” Umesh Padval said “When Nvidia was on the cap table, everyone felt safe.” TechCrunch reports that Nvidia under interim CEO Colette Kress is expected to be more selective, writing smaller checks into its existing portfolio as valuations drop, and that few observers expect the slowdown on its own to stop the wider AI buildout. For the open-weight model shops and neoclouds that sit downstream of Nvidia’s hardware, the open question is who writes the next check.
Quick Hits
- LangChain reached a $3 billion valuation on a $300 million Series C led by CapitalG, up from a $1.25 billion mark about a year earlier, with 7,000 LangSmith customers including Nvidia, Toyota and Salesforce. TechCrunch
- ElevenLabs shipped a preview app, ElevenAI, that combines meeting notes, dictation in over 90 languages and agent follow-ups, and can notify other participants that a conversation is being recorded. TechCrunch does not say where audio is stored, how long it is kept, or whether it trains models. TechCrunch
- A 9-billion-parameter model now runs offline on a PlayStation 4 GPU. The project reports Qwen3.5-9B at 31 to 39 tokens per second on a base or Slim PS4 with custom 4-bit and 3-bit weights, and says “Everything runs on the console. Nothing is sent anywhere.” GitHub
- Google opened preorders for Gemini smart glasses through Warby Parker starting at $395, with Gentle Monster frames starting at $449 and availability in stores and online on December 10. Google says bystander faces are redacted from camera visuals before Gemini processes them. Google and Ars Technica
- The Federal Reserve’s latest survey found AI is the most-cited risk among market contacts. CNBC reports 87 percent of respondents named AI as a salient risk, up from 50 percent in spring 2026, ahead of risk-asset correction at 52 percent, higher long-term rates at 48 percent, and cyberattacks and fiscal debt sustainability at 43 percent each. CNBC
- Microsoft’s global 365 outage came down to failed automated health checks, not hackers. Microsoft said it had “no evidence of malicious activity associated with this incident” and extended the email timeout to 48 hours to work through delayed mail. Ars Technica
- A Windows zero-day called SignDrop gives local users SYSTEM rights by chaining the Common Log File System, Windows Defender and symbolic links. Microsoft said it was investigating the writeup and had no evidence of exploitation in the wild. Ars Technica
- At least ten university campuses across seven states have scrapped Flock Safety camera contracts since April, including Cornell, Penn State and Emory, and UNC Charlotte restricted national access after local reporting found the Houston police department searched its camera network 183,000 times between March and May. The Guardian
- A reading layer for agents cut token use by up to 92.9 percent and wall time by up to 89.0 percent, the authors of the SparseRead paper report across six models and five scenarios, preserving or improving task quality in 97 percent of settings. arXiv
- More than 1,600 employees commented on an internal Nvidia suggestion-box post asking the board to consider employee sentiment about Huang. WIRED reports the comments largely called for his return, and that one employee sent a companywide email saying “I stand by Jensen.” WIRED
Worth Watching
- Whether retailers accept agentic checkout or wall it off. OpenAI is shipping a wallet while Amazon and other retailers block AI agents, and OpenAI has asked sites to make sure “agents are not inadvertently blocked.” The Commerce Partner Playbook is the place to watch for how that resolves. The Verge
- Whether export-control investigators adopt checkpoint forensics. The method works on published weights, and several of the affected models are open-weight releases that anyone can download. Enforcement agencies have not said whether they are using this approach. Unemployment Labs
- Nvidia’s permanent CEO search, and whether the petition changes it. The board named Harvey Jones as chair and Colette Kress as interim CEO after Huang resigned, and an internal suggestion-box post has drawn more than 1,600 comments asking the board to weigh employee sentiment. WIRED
- Google’s Search-and-AI bundle as an antitrust question. NPR reports a theory, from a former Google employee, that a judge decided Search and AI are now an integrated product, which would explain why districts cannot turn off AI Overviews without losing Search. NPR
- The next round of Fed risk surveys. AI moved from 50 percent to 87 percent of cited salient risks in one cycle, which makes the following survey a test of whether this holds or was a one-off reaction. CNBC