Tech Radar - 2026-10-01 08:48

Priority Today

Google announced Gemini 4 Argon with a 1M token output limit and half-of-Opus-5.5 introductory pricing

Google announced Gemini 4 Argon on 2026-09-30, the first model of the Gemini 4 generation, and it is rolling out first to a small set of trusted cyber defenders through the Fairwind Program rather than to the API. The headline technical change is output length: 1M tokens in a single response, up from the 64K ceiling on earlier Gemini models.

Why it matters: A 1M output limit moves long-horizon work away from driving an agent turn by turn. Google says its own Argon agents migrated C/C++ to Rust across re2, libgav1 and up to 800K lines of the Fuchsia Zircon kernel, and replaced 32K lines of SIMD in libgav1 with code the compiler auto-vectorises, producing a decoder 2.7x faster than the previous Rust port with identical output. What changed: Introductory pricing is $2 per million input tokens and $10 per million output, with cached input at 95% off input price; after the introductory period it becomes $4 and $20. Cached input therefore works out to $0.10 per million. Vendor-run figures: 77.9% on DeepSWE v1.1, 68% tied first on CWE-bench v1, 51.3% on Zapier's AutomationBench, 91.7% on LVBench. MarkTechPost reported that Argon trails on FrontierSWE v2, Terminal-Bench 4.0 and OSWorld-2.0. For me: Nothing yet. There is no API access and no date for it. Paid API customers and Google AI Ultra subscribers are named as the first release cohorts after the Fairwind cohort.

Tags: #topic/ai-models #entity/google-deepmind #entity/gemini #technology/context-window #event/model-release #relevance/developer #relevance/industry-changing #learning/awareness

Sources:

Cloudflare rebuilt Containers so agent sandboxes pick their own image, start 6x faster and snapshot to disk

Cloudflare rearchitected Containers on 2026-09-30 around a durable_object scheduling policy that moves sandbox provisioning into application code at request time, rather than fixing the image and instance type at deploy time. Sandbox SDK 1.0 follows, with the Durable Object controlling the container directly through this.ctx.container and no wrapper class in between.

Why it matters: An agent sandbox is not an application deployment. The task decides the toolchain, the compute and the starting filesystem, and the workspace may need to outlive the session. Previously each image and instance combination was its own Containers application with its own Durable Object namespace, so a new environment meant a new wrangler deploy. What changed: Median time-to-interactive across 100 concurrent sandboxes fell from 4.049 seconds to 648 milliseconds on ComputeSDK's Burst TTI Benchmark, 95th percentile from 5.839s to 910ms and 99th from 6.717s to 1129ms; Cloudflare's own preliminary burst test started 100,000 containers in 5.387 seconds across six locations. Filesystem snapshots are in public beta, cloudflare/debian-trixie ships as a pre-distributed Debian Trixie Slim image with Node.js 24.20.0 LTS, and image and instance type are arguments passed at start. The Container and legacy Sandbox classes get no further updates after 2026-12-31. For me: Worth trying if you provision per-task sandboxes. The new capabilities are reachable only through ctx.container, so it is a migration rather than a flag. If you use the old classes, the migration deadline is 2026-12-31.

Tags: #topic/ai-agents #topic/cloud #entity/cloudflare #technology/containerization #technology/agent-orchestration #event/tool-release #relevance/developer #relevance/infrastructure

Sources:

KrakenD 3.0 moved LLM routing, semantic caching and prompt-injection defence into the gateway itself

KrakenD released 3.0 on 2026-09-30 for both Community and Enterprise editions, the first of "Series 3". Most of the new surface is Enterprise, but the CE release is also a breaking configuration change: every file must now declare "version": 4 or the gateway refuses to start.

Why it matters: These are the pieces teams have been rebuilding in application code per service: per-request model selection, dedup of semantically identical prompts, and prompt-injection filtering. Putting them in the gateway means one policy applies to everything behind it, and KrakenD claims OpenAI- and Anthropic-compatible responses so a client built against either API can be pointed at a different provider underneath, Claude Code included. What changed: An AI Router that picks a model by header or CEL gate, by a Not Diamond prompt classifier, or falls back to a chosen provider when neither matches. A Semantic Cache that serves a stored answer for a differently-worded prompt, using a local ONNX embedding model with Redis as vector storage. Prompt Guard combining regex, CEL and an external classifier, emitting krakend.promptguard.check. New sse, ndjson and eventstream encodings let modifier/jmespath, modifier/response-body and governance/quota manipulate a streamed response message by message instead of buffering it. The MCP Server gains authorization-spec authentication via well-known protected resource metadata and per-audience tool filtering. CE 3.0 adds wildcards and array indexes in JWT claim paths, the HTTP method in endpoint logs, and a smaller dependency tree; CE plugin support moves to Enterprise. For me: The config version bump is the thing to check. If you run CE with plugins, KrakenD says to talk to them before upgrading.

Tags: #topic/devops #topic/ai-agents #entity/krakend #technology/llm-api #technology/mcp #event/tool-release #relevance/developer #relevance/devops

Sources:

InclusionAI put Ling 3.1 Flash on Vercel AI Gateway free until October 13

Vercel made Ling 3.1 Flash free on AI Gateway on 2026-09-30, through 2026-10-13. The model is a hybrid reasoning MoE with 560B total parameters and 25B active per token, served at a 262K-token context window on the gateway, positioned by Ant Group's InclusionAI for agent tasks, search and office work.

Why it matters: Two weeks of free access to a 560B-class model through a gateway that also does usage tracking, routing, retries and failover. Two model IDs are published, and the difference matters: inclusionai/ling-3.1-flash starts billing when the promotion ends, while inclusionai/ling-3.1-flash-free stops serving instead. What changed: The model launched 2026-09-30 with a two-week free trial that InclusionAI capped at 256,000 tokens context, against a design target of up to one million; InclusionAI says it will enable the larger window and open-source the weights after the trial. Vercel's context window is 262K. For me: Point a coding agent at it now if you want to evaluate it. npx vercel ai-gateway setup detects installed agents and writes the config; the docs cover Claude Code, Codex and fx. Use the -free ID if you would rather the request fail after October 13 than start billing without noticing.

Tags: #topic/ai-models #topic/ai-economics #entity/inclusionai #entity/vercel #technology/llm-api #event/free-tier #relevance/free-access #learning/awareness

Sources:

AI Coding and Agents

Claude Code v2.1.285 added an allowedProviders managed setting and a default time limit on background commands

Claude Code shipped v2.1.285 on 2026-09-29 with roughly 130 changes. Two are administratively interesting: a managed setting that restricts which API providers a machine is permitted to use at all, and an automatic termination time on backgrounded Bash and PowerShell commands.

Why it matters: allowedProviders moves provider governance below the model, which is the shape of answer that survives an agent arguing with it. The background command limit is the same instinct applied to a runaway process: Claude is notified when the command is killed rather than discovering it later. What changed: Backgrounded commands are terminated after 30 minutes by default, up to a two-hour maximum. Sessions behind a custom ANTHROPIC_BASE_URL now get the full 1M-token context on supporting models instead of being capped, with /autocompact 200k for gateways that still top out at 200K. Also added: claude --desktop, claude plugin configure with --values-stdin, claude plugin install --config using . = syntax to pass config to a bundled .mcpb server, CLAUDE_CODE_DISABLE_WEB_FETCH, and CLAUDE_CODE_NONSTREAMING_TIMEOUT_RETRIES.

Tags: #topic/ai-coding #entity/claude-code #entity/anthropic #technology/context-window #event/tool-release #relevance/developer #learning/awareness

Sources:

Infrastructure and DevOps

OpenStack 2026.2 Hibiscus added mediated vGPU devices, Weka and Lustre in Manila, and cut HA router monitoring memory more than 15x

The OpenInfra Foundation released OpenStack 2026.2, named Hibiscus, on 2026-09-30. It is the 34th release and a non-SLURP release, so it sits outside the once-per-year cycle and carries a shorter support window.

Why it matters: Nova and Cyborg can now manage mediated devices such as vGPUs, which is how GPU-backed AI and HPC workloads get scheduled without a bespoke driver stack per node. Manila gaining Weka and Lustre is the same problem for storage. What changed: Ironic and Nova improve bare-metal resource tracking for heterogeneous compute. Watcher makes workload consolidation responsive to real-time usage and reserved capacity. Neutron reduced the memory footprint of HA router monitoring by more than 15x. Glance adds parallel image imports and preferred-store downloads.

Tags: #topic/self-hosting #topic/cloud #entity/openstack #technology/containerization #technology/virtualization #event/open-source-release #relevance/infrastructure #relevance/self-hosting

Sources:

OpenStack Hibiscus Strengthens Trusted Infrastructure for the AI Era

Security That Affects You

Tugtainer's agent accepted unauthenticated Docker control whenever AGENT_SECRET was unset, CVSS 9.8

CVE-2026-55494 was published on 2026-09-30 against Quenary's Tugtainer, a self-hosted app that automates Docker container updates. In versions before 1.30.4, the agent's signature verification function returns success when Config.AGENT_SECRET is empty, so every route it was supposed to protect is open.

Why it matters: This is a fail-open default rather than a parsing bug. Anyone who can reach the agent port gets unauthenticated Docker management APIs, which means container creation, command execution and host compromise. It is pre-authentication with no user interaction. What changed: The vendor made AGENT_SECRET mandatory in 1.30.4, also adding a text body fallback in verify_signature; ALLOW_UNAUTHENTICATED_AGENT remains as an explicit dev-only opt-out. CVSS 3.1 scores it 9.8. It is not in CISA KEV and has no EPSS score yet. One operational wrinkle: the maintainers report that the secret must be set in three places, the environment variable, the agent and the UI under Hosts, and that its absence produces a 401 that does not explain itself. For me: Set a non-empty AGENT_SECRET right now if you run Tugtainer, even before upgrading, since that alone re-enables verification. Then upgrade to 1.30.4 or later.

Tags: #topic/security #entity/tugtainer #entity/docker #technology/containerization #event/security-issue #relevance/devops #relevance/infrastructure #learning/awareness

Sources:

token-optimizer-mcp had both a shell injection in a tool argument and an unauthenticated dashboard with path traversal

Two flaws in @ooples/token-optimizer-mcp, an MCP server that measures token savings and shares a local knowledge graph across 16 CLI clients, both fixed in 5.1.0. CVE-2026-55157 is OS command injection; CVE-2026-55156 is an unauthenticated dashboard.

Why it matters: The injection is a reminder that double quotes are not an escape in POSIX shells. The smart_user tool's get-user-info operation built getent passwd "${username}" || grep "^${username}:" /etc/passwd and passed it to a shell, so a username of $(id > /tmp/x) executes. Command substitution is evaluated inside double quotes. What changed: In the second flaw, the dashboard HTTP server exposed /api/session-summary and /api/session-events with no authentication middleware, and both handlers concatenated the caller-supplied sessionId query parameter into a filesystem path via path.join, which Node resolves .. segments through, so any network-reachable client could read any .jsonl file the server could reach. The fix converts shell-string sinks to argv-mode execution across the tool surface, adds input validation helpers and 20 regression tests, and closes the dashboard routes.

Tags: #topic/security #topic/ai-agents #entity/token-optimizer-mcp #technology/mcp #technology/agent-security #event/security-issue #relevance/developer #relevance/infrastructure

Sources:

Open Source Momentum

Cloudflare shipped EmDash 1.0, an Astro CMS whose plugin registry runs on AT Protocol with per-plugin sandboxes

EmDash 1.0 went stable on 2026-09-28, MIT licensed, built on Astro, running on Cloudflare Workers or Node.js. The interesting part is not the CMS. It is that the plugin catalogue is separated from the plugin, published through AT Protocol with signed package and release records held in each author's own account.

Why it matters: Plugin marketplaces have historically been a gatekeeping chokepoint where a publisher hands over identity and release ownership. EmDash keeps the catalogue moderable while making it structurally impossible to rewrite a release. It also moves plugins to app-style permissions: each runs in an isolated runtime starting with only its own private storage, and every additional capability must be declared and approved by the site administrator. On Workers a plugin is a Dynamic Worker; on Node.js it runs inside workerd with the same manifests. What changed: Install-time verification confirms the downloaded bundle matches the publisher's signed release record, plus checksum, package name, version, requested access and build provenance. The default catalogue moderates names, descriptions, links and images via a Workers AI labeler, and the aggregator, labeler and Astro content loader are open source so competing catalogues are possible. EmDash Build, an AI site builder hosting providers can run themselves, is in alpha.

Tags: #topic/open-source #topic/self-hosting #entity/cloudflare #entity/emdash #technology/mcp #technology/agent-skills #event/open-source-release #relevance/self-hosting

Sources:

Cloudflare EmDash 1.0 Launches Decentralized Plugin Registry

Follow-ups

OpenAI $200 Pro: the previously reported reopening now has specifics. From 2026-10-30 the ChatGPT Work and Codex allowance drops from 20x the Plus plan to 10x, and ChatGPT Pro messages from 200 to 100 per week. Existing subscribers keep current limits through 2026-10-29 and receive a one-time grant of 62,500 usage credits, OpenAI's stated value $2,500, expiring 2026-12-31. A new $500 Pro 500 plan carries 25x Plus and the Ultrafast GPT-6 Astra tier.

New Concepts

Agent sandbox as a programmable object. Most sandbox infrastructure treats a sandbox as a deployable unit: you pick an image and a size, deploy, and get a namespace. Cloudflare's durable_object scheduling policy makes the sandbox an object the program holds a handle to, which is what lets it be started, snapshotted, stopped, restored and rolled forward as runtime decisions rather than configuration. Worth knowing because it reframes what "provisioning" means for agents: the interesting primitives become snapshot, resume and canary, not deploy. This generalises beyond Cloudflare, since any platform where an agent creates a fresh environment per task and needs it to persist across sessions ends up needing the same shape.

Tag Index

topic

#topic/ai-agents
#topic/ai-coding
#topic/ai-economics
#topic/ai-models
#topic/cloud
#topic/devops
#topic/open-source
#topic/security
#topic/self-hosting

entity

#entity/anthropic
#entity/claude-code
#entity/cloudflare
#entity/docker
#entity/emdash
#entity/gemini
#entity/google-deepmind
#entity/inclusionai
#entity/krakend
#entity/openstack
#entity/token-optimizer-mcp
#entity/tugtainer
#entity/vercel

technology

#technology/agent-orchestration
#technology/agent-security
#technology/agent-skills
#technology/containerization
#technology/context-window
#technology/llm-api
#technology/mcp
#technology/virtualization

event

#event/free-tier
#event/model-release
#event/open-source-release
#event/security-issue
#event/tool-release

relevance

#relevance/developer
#relevance/devops
#relevance/free-access
#relevance/industry-changing
#relevance/infrastructure
#relevance/self-hosting

learning

#learning/awareness