AI & Tech Brief — October 24, 2026

TL;DR

• Moonshot shipped Kimi K3.1 Pro, a 3T-class open-weight model with a 1M-token context — scores 65.7% on Terminal-Bench 4.0, ahead of GPT-6 Astra (58.2%) and a hair behind Claude Opus 5.5 (66.4%). 927 points on HN, with commenters noting it sometimes identifies as ChatGPT in reasoning traces.
• Calif demoed an iPhone exploit chain at Hexacon — 1-click RCE via Signal and iMessage PDFs, plus a persistence implant they’re calling “APT: Apple Persistent Threat.” 901 points on HN; Lockdown Mode blocks the PDF vector but is “so restrictive it doesn’t really make sense.”
• Node2Shell (CVE-2026-111497) escalated to HTTP2Shell — the Brotli decoder OOB write is now confirmed in Python packages, curl/libcurl, Bun, Envoy, and Istio, not just Node.js. CVSS 9.2. OpenAI says it found the bug in February but didn’t realize it was a security issue at the time.
• Block unveiled Dessa, a full-duplex speech model trained only on audio — no text, no pretrained weights. It laughs mid-sentence and gets louder when asked. HN is split between “most natural voice AI ever” and “no one is really there.”

Key Stories

• Kimi K3.1 Pro and K3.1 Pro Highspeed Moonshot’s first K3.1-series model is a 3T-parameter open-weight release with a 1M-token context window, available today on Kimi.ai, Kimi Work, Kimi Code, and the API. On Terminal-Bench 4.0 it scores 65.7% — ahead of GPT-6 Astra (58.2%) and narrowly behind Claude Opus 5.5 (66.4%). The Highspeed variant delivers 2-3× the throughput. The blog post leans hard into agentic coding: K3.1 Pro built a human walking dynamics simulator on top of the human-atlas anatomical model (296 skeletal components, 402 muscles) across 167 missions and 420 independent reviews, iterating until the simulated human walked continuously for 11.2 seconds. Why it matters: the open-weight frontier is now within a point of the best proprietary model on a realistic terminal-agent benchmark, and the “which AI are you?” identity confusion in reasoning traces is a live example of training-data contamination across labs. Source: https://www.kimi.ai/blog/kimi-k3-1-pro

• Calif demos iPhone exploit chain at Hexacon The Calif team (known for iOS security research) revealed a series of demos in Paris: a 1-click Signal RCE, an iMessage PDF exploit, and a persistence mechanism they call “APT: Apple Persistent Threat.” The HN thread (589 comments) quickly zeroed in on Lockdown Mode: it blocks auto-loading PDFs in iMessage but not in Signal, and even then only blocks auto-loading — clicking the PDF still triggers the exploit. The consensus: Lockdown Mode helps but is too restrictive for most people. Why it matters: this is the first public demo of a working iPhone exploit chain in 2026, and it’s a reminder that the “1-click” bar is still the practical threshold for most users — Lockdown Mode remains the only real defense, and it’s still a niche product. Source: https://blog.calif.io/p/iphone

• Node2Shell evolves to HTTP2Shell: Brotli CVE-2026-111497 hits Python, curl, Bun, Envoy, Istio Aikido’s updated advisory: the out-of-bounds write in Google’s Brotli decoder (versions 1.0.3–1.2.0) is now confirmed across the HTTP stack. Node.js, Python packages (brotli, brotlicffi), curl/libcurl, Bun, Envoy, and Istio are all affected. CVSS v4.0 score of 9.2 (Critical). A remote unauthenticated attacker can send a crafted Brotli-compressed stream to corrupt memory, leak sensitive data, crash the process, or potentially execute arbitrary code. OpenAI disclosed that it discovered the root cause in February but didn’t recognize it as a security vulnerability at the time. Patches are available for libbrotli 1.2.1, Node.js 22.23.4/24.22.1/26.12.1, Bun 1.4.4, Envoy 1.40.0/1.39.3/1.38.6/1.37.8, and Istio 1.29.9/1.30.6/1.31.2. Apache and Nginx do not decode Brotli by default. Why it matters: this is the second major supply-chain CVE in a week (after LiteLLM) where a compression library became the attack surface — and the blast radius is still expanding. If you run anything that decodes Brotli, patch now. Source: https://www.aikido.dev/blog/python-packages-vulnerable-node2shell-brotli-cve-2026-111497

• Block unveils Dessa, a full-duplex speech model trained only on audio Dessa is a conversation model trained from scratch on nothing but human speech — no text, no pretrained weights. It laughs mid-sentence when something is funny, gets louder when asked, and picks its own voice and personality. Block claims it’s the world’s first AI you can have a realistic live conversation with that was trained only from human speech. The HN thread (145 comments) is split: some hear “the most natural voice AI ever,” others hear “a teenager’s stream of consciousness” and “no one is really there” after 15-20 seconds. Why it matters: full-duplex speech-to-speech without a text intermediate is a real architectural bet — it preserves paralinguistic information (emotion, cadence, pauses) that text throws away, but the tradeoff is that the model has no explicit symbolic reasoning layer. The demos are impressive; the substance is still an open question. Source: https://block.xyz/dessa

• OBS Studio 33 ships with a massive CEF upgrade and plugin overhaul The biggest change is under the hood: CEF (Chromium Embedded Framework) jumps from 127/6533 (July 2024) to 150/7871 (September 2026), which should be invisible to users but fixes two years of browser-source weirdness. Plugin loading is completely overhauled — first-party plugins move to a core folder, third-party plugins get a new installation location, and legacy locations will keep working until OBS 34. Source snapping gets a visual indicator and now snaps along the entire axis. NVENC is enabled on Arm64. Why it matters: OBS is the default streaming/recording tool for a huge chunk of the internet; a two-year CEF jump is a big deal for browser-source stability, and the plugin overhaul is the kind of breaking-change prep that usually signals a bigger release coming. Source: https://github.com/obsproject/obs-studio/releases/tag/33.0.0

• Codex CLI 0.164.0: presets, inline model/permission args, image preview OpenAI’s Codex CLI adds ten numbered /presets slots for reusable prompts and slash commands, inline /model and /permissions arguments, and fullscreen image preview on terminals supporting Kitty or Sixel graphics. Enterprise MCP connections can now authenticate using eligible Codex account grants or dedicated sign-in, including OAuth clients requiring secrets. Credentials are masked during supported remote Bash commands and Zsh snapshot sessions. The Amazon Bedrock setup wizard is now enabled by default. Why it matters: the preset slots and inline args are small UX wins, but the credential masking and enterprise MCP auth are the real story — OpenAI is building the plumbing for Codex to operate inside corporate environments where secrets can’t leak into transcripts. Source: https://developers.openai.com/codex/changelog

• OpenAI Decisions API goes GA with gpt-6-luna The Decisions API is now generally available. It turns text and images into typed answers 10× faster than the Responses API, supports up to 400 questions per request (up from 200 in beta), and adds prompt-cache discounts for shared input, images in individual question instructions, and input_json for structured data. Why it matters: Decisions is OpenAI’s answer to the “structured output at scale” problem — if you’re building classification, routing, or extraction pipelines, 400 questions per request at 10× speed is a meaningful cost/latency improvement over chaining Responses calls. Source: https://developers.openai.com/api/docs/changelog

Quiet but interesting

• Apple Music 404 Not Found — a HN thread (780 points) about Apple’s 404 page, which is a playable Breakout clone. The real story is in the comments: someone found a secret game in Settings > About (hold center button for 5 seconds), and the thread devolved into iPod nostalgia and Woz/Jobs Atari lore. Not news, but a good Friday read. https://music.apple.com/this-url-doesnt-exist
• Local Wikipedia — Wikipedia, but only for things within a half-hour walk of you. 1391 points on HN. If there are fewer than 25 things nearby, it takes the closest 25 within about 6 miles. Your location stays in the browser. https://edjefferson.com/localwiki/
• EFF: Canadians are running out of time to oppose Bill C-22 — the Lawful Access Act has passed the House of Commons and is before the Senate. EFF calls it “a massive expansion of surveillance powers.” 419 points on HN. https://www.eff.org/deeplinks/2026/10/canadians-are-running-out-time-oppose-dangerous-c-22-surveillance-bill
• Twelve years of distributed SQLite — Philip O’Toole’s retrospective on rqlite, the distributed SQLite database. 216 points on HN. https://philipotoole.com/twelve-years-of-distributed-sqlite/

Skip

• Claude Code changelog (Oct 23) — active as always (Monitor tool on Bedrock/Vertex/Foundry, cloud sessions enterprise roles, 14 bug fixes), but nothing above routine maintenance. https://code.claude.com/docs/en/changelog
• Claude release notes — latest entry is Claude Duet research preview (Oct 21), already covered. https://support.claude.com/en/articles/12138966-release-notes
• Gemini CLI — last announcement remains v0.64.0 (Oct 13). Quiet. https://geminicli.com/docs/changelogs/
• darioamodei.com — no new posts.
• blog.samaltman.com — latest post is from April 2026 (the Molotov cocktail incident). Nothing new.
• superhuman.ai — homepage still shows the stale September 7 edition.
• DeepMind blog — Gemini 4 Argon series posts remain dated only “October 2026”; nothing verifiably from the last 24 hours. https://deepmind.google/blog/
• ByteByteGo — latest post is Oct 22 (“Why Distributed Systems Prefer Independence over Coordination”), outside the 24-hour window. https://blog.bytebytego.com/