Tech Radar - 2026-10-04 06:28
Priority Today
Google cut the Gemini free tier to Flash-Lite, effective October 9
Starting October 9, 2026, Gemini Apps on a personal account without an AI subscription is limited to Flash-Lite, with Flash and Pro withdrawn. Google also added per-model effort levels and extended Deep Think from AI Ultra down to AI Pro, while AI Plus subscribers keep Flash-Lite and Flash but lose Pro on a date they are told by email.
Why it matters: The free tier stops being a usable fallback for anything past summarisation, and the entry-priced paid plan stops being a usable fallback too. Usage limits themselves are unchanged since the May 17, 2026 move to compute-based limits with a five-hour refresh and a weekly cap, so what changes is which models you can pick, not how much of them you get. What changed: Without an AI plan: Flash-Lite only. AI Plus: Flash-Lite and Flash, Pro removed on an emailed date. AI Pro and AI Ultra: unchanged, and both gain Deep Think, which was previously Ultra-only. Every available model gains a low, medium or high effort level that consumes more of the limit. Google's own page carries the October 9 date, the AI Plus email notice, the effort levels and the Deep Think expansion; the per-plan model table comes from 9to5Google. For me: If you use Gemini free for anything real, the deadline is five days away. Flash covers most of what the free tier was doing, so test that assumption before October 9 rather than after.
Tags: #topic/ai-economics #topic/ai-models #entity/google-deepmind #entity/gemini #event/policy-change #relevance/free-access #relevance/practical #learning/hands-on
Sources:
- Changes to Gemini model access and limits (official)
- Gemini app limiting what models free and AI Plus users can access (9to5Google)
Cloudflare committed to shipping no new Enterprise-only features and opened Logpush to every plan
Cloudflare published a one-year progress update on its pledge to end two-tier product access on October 2, and committed to introducing no new Enterprise-only features. Logpush, Logpush Transformers and Custom Dashboards are now self-service on Free, Pro and Business, and the limit increases collected over the year now apply to all accounts.
Why it matters: "Where our plans differ, it's in how much you can use, not what you can use" is now a written commitment rather than a roadmap, which removes the usual reason to sign an enterprise contract. The limits are the part that actually bites: most of what you were rationing against just moved. What changed: Logpush and Transformers reach general availability on all plans at self-service pay-as-you-go prices, and Custom Dashboards reach all customers. RBAC roles now exist at resource level for Workers, R2 and Access and at account level across nearly every product. Multiple accounts are possible from a dashboard New Account button, though Enterprise customers are still asked to request them so existing agreements carry over. Organizations reach GA in October for Enterprise and roll out to free accounts in early 2027, so the multi-account management plane stays gated for another year. MCP Server Portals reach GA. New universal limits: Workers get 1 second of startup, 64 MiB uncompressed, 32 MiB WebSocket messages and 1 million subrequests; Containers get 6 TiB of memory, 1,500 vCPU and 30 TB of disk with custom instance sizes on every account; Workflows get 50,000 concurrent instances and 300 creations per second; Vectorize gets 20 million vectors per index; HTTP headers reach 128 KB; Security Insights scans run every 7 days on Free, every 3 days on Pro and Business and daily on Enterprise. Under Code Orange: Fail Small, new code rolls out by traffic cohort starting with free customers. For me: If you run anything on Workers, Containers or Vectorize, re-read your limits. The Organization gap is the one piece still Enterprise-first until 2027, and worth planning around if you need shared multi-account config now.
Tags: #topic/devops #topic/cloud #entity/cloudflare #technology/infrastructure-as-code #event/policy-change #relevance/infrastructure #relevance/practical #learning/understand
Sources:
magpie reached 4,465 GitHub stars twelve days after its first commit
magpie is a free, open-source local gateway that adds a provider once and then lets you pick that model from any coding agent, translating between the OpenAI, Anthropic and Gemini wire protocols in both directions. The repository was created on September 23, 2026 and shipped hourly tagged releases through v0.1.805 starting October 3, with 100 or more commits in the last two days alone.
Why it matters: Model choice and agent choice are usually welded together by whoever wrote the client. This breaks that join, so a cheap open-weights model becomes usable from an agent that only speaks one vendor's dialect. The site leads with exactly that substitution: Codex on DeepSeek, Claude Code on Kimi, Gemini CLI on GLM. What changed: Nothing in any single release, which is the point. The traction is 4,465 stars and 313 forks since September 23, tags roughly every hour, and integrations landing per agent client rather than per model, including VS Code's built-in chat and a JetBrains Air path over the Agent Client Protocol. Providers named on the site include DeepSeek, Kimi, GLM, Qwen, MiniMax, OpenRouter and Ollama, alongside the Claude and ChatGPT plans you already pay for. It ships for macOS 12+, Intel Macs, Windows and Linux. For me: Worth a try if you pay frontier prices for agent runs and have a cheaper model you would rather use. It is twelve days old with no release history to speak of, so read the gateway code before pointing real work at it.
Tags: #topic/ai-coding #topic/ai-economics #entity/magpie #technology/llm-api #event/github-traction #relevance/ai-workflow #relevance/practical #learning/hands-on
Sources:
Microsoft Agent Framework 1.20 hosts workflows natively on Foundry and adds computer use
Microsoft shipped Agent Framework 1.20.0 on October 2, adding native hosting of Agent Framework workflows over Foundry Responses and Foundry Invocations, native computer-use support on Responses clients, and DuckDB and SQL Server native vector-store connectors. The same release breaks Foundry hosting, redesigning it around request-scoped agent factories.
Why it matters: Native computer use on Responses is the capability; the hosting redesign is the bill that comes with it. If you build on Agent Framework, that second line is the one to read before you upgrade.
What changed: New packages agent-framework-foundry-hosting, agent-framework-duckdb, agent-framework-sql-server and agent-framework-typesafe. Native computer use on Responses clients, plus Foundry project embeddings and knowledge_source_params on the Azure AI Search context provider. Response-stream gates and buffering, session-scoped file-access isolation, an AgentExecutor checkpoint-state TypedDict, and opt-in FunctionInvocationContext injection for skill scripts. A MongoDB agent RAG sample. Breaking: Foundry hosting now runs on request-scoped agent factories with persistent sandbox-isolated sessions, parsed and durable Invocations runs, and configurable Responses history, background execution and options. Approvals and MCP runtime context were hardened, matched function results are now terminal, and local approvals require a backing session.
For me: Treat the hosting redesign as a migration, not an option. The computer-use and vector-store additions are the reason to care, and neither requires the redesign to be useful.
Tags: #topic/ai-agents #topic/ai-coding #entity/microsoft #entity/azure #technology/agent-orchestration #technology/computer-use #event/tool-release #relevance/developer
Sources:
Prime Intellect opened Prime Inference, an OpenAI-compatible serving layer it built for its own rollouts
Prime Intellect released Prime Inference on October 2, 2026, offering serverless endpoints and reserved capacity for open models on NVIDIA Blackwell hardware, OpenAI-compatible at api.pinference.ai. The company says the platform already processes close to a trillion tokens a day on internal RL rollouts, and its first public deployment, GLM-5.3, has run on OpenRouter since September 22 at near-zero tool-call error rate.
Why it matters: Another endpoint vendor is not interesting on its own. What is worth reading is which levers they pulled, because the numbers are specific enough to check and they transfer straight to anyone running their own vLLM. What changed: Self-reported on GLM-5.3 across GB200 NVL72: prefill and decode run on separate GPU groups under NVIDIA Dynamo, cutting p90 inter-token latency by nearly 40%; a KV-cache-aware Dynamo router plus a second Mooncake tier in host DRAM; a DEP8 topology gave roughly five times more usable prefix-cache capacity than TEP8 on the same hardware, at the cost of about 245 ms of dummy work per rank while idle ranks wait at each MoE layer; halving the prefill token budget from 8K to 4K per GPU cut median queue wait from 550 ms to 110 ms and median time to first token by roughly 20%; NVFP4 KV compression shrank each MLA cache row from 576 to 352 bytes, lifting cached tokens per decoder from 1.09 million to 1.63 million at the same memory budget. The stack is Dynamo, vLLM, Mooncake and FlashInfer with improvements contributed upstream. At their 100-tokens-per-second-per-user target a 1:4 prefill/decode ratio served 66 sessions per prefill group at 101 tokens per second per user. The post publishes no pricing. For me: Architecture reading rather than a buying decision, since there is no price to weigh. The prefill-budget and KV-compression results are the two you can apply to your own deployment this week.
Tags: #topic/ai-models #topic/devops #entity/prime-intellect #entity/vllm #technology/inference #event/tool-release #relevance/developer #learning/deep-dive
Sources:
Models and Capabilities
Cactus released Whistle, a 16.9 MB speech model that runs on a CPU with no dependencies
Cactus Compute released Whistle on October 2, 2026: a 16.9 MB speech recognition model that runs CPU-only inside the same C++ engine as their Needle text models, transcribes seven languages, and can be loaded alongside a text model in one binary. It returns transcripts, per-word timestamps with probabilities, and 80 ms-frame speech embeddings.
Why it matters: The design choice worth knowing is that depth is a load-time dial. Every decoder depth from 2 layers up was trained as its own model, and --audio-depth picks one at load, while the encoder always runs all eight blocks. You choose the size/quality trade at load time instead of shipping a different artifact.
What changed: Self-reported on an Apple M4 Pro, ten seconds of audio: 11.1 ms to first token and 1,319 tokens per second decoding, against Whisper base at 73.2 ms and 266 per second and Moonshine tiny v2 at 22.8 ms and 262 per second, at 16.9 MB, 145.3 MB and 41.9 MB respectively. Word error rate is ahead of both on LibriSpeech test-clean and test-other, SPGISpeech, Earnings-22 and the FLEURS average, and behind on TED-LIUM, AMI and the MLS average. Seven languages (English, German, French, Spanish, Italian, Dutch, Polish), 30-second cap, 320-token transcripts, 8,192-piece vocabulary plus one language token, and silence detection that skips beam search entirely. A three-function C API, pip install cactus-needle, and prebuilt binaries for seventeen targets including Android, iOS, watchOS, Windows on ARM, RISC-V, MIPS, browser and WASI. Weights are published on Hugging Face; no public license is stated in the post.
For me: Relevant if you are putting voice into an agent on-device rather than shipping audio to a cloud ASR endpoint, and if your target is a microcontroller rather than a server. Treat the benchmark as the vendor's own.
Tags: #topic/ai-models #topic/ai-agents #entity/cactus-compute #technology/quantization #technology/computer-use #event/model-release #relevance/self-hosting #learning/understand
Sources:
Agent Capability
vLLM Semantic Router 0.4.0 shipped Hermes, a Mixture-of-Models fleet behind one model name
vLLM Semantic Router released 0.4.0 on September 27, 2026 with 982 commits, 130 contributors and 107 first-time contributors since the Themis release. Its headline feature is Hermes, which presents a single virtual model name over a Mixture-of-Models fleet, so a caller picks a name and the router works out which model should answer.
Why it matters: The routing decision moves out of the client and behind something that looks like a model, which is the interface agent frameworks already expect to talk to. You stop writing per-task model selection into your harness.
What changed: Hermes is the qualified Mixture-of-Models routing layer, shipped alongside Vela for open-model discovery and Decision for open decision models, plus the sr-bench evaluation set. It installs with pip install vllm-sr==0.4.0. One caveat on dating: the Hermes writeup is dated September 24 and the release is September 27, so this sits at the edge of the window rather than inside it.
For me: Worth reading if you currently hardcode a model per task in an agent harness. I have verified only what the 0.4.0 release notes and the Hermes post state, so I have not confirmed the aggregator-style "Decision 2.0" capability claims that circulate about it.
Tags: #topic/ai-agents #entity/vllm #technology/agent-orchestration #technology/inference #event/open-source-release #relevance/developer #learning/understand
Sources:
Open Source Momentum
moli reached 5,972 stars as a headless browser kernel that is not a Chromium wrapper
moli is a Rust headless browser for agents that treats layout and paint as an on-demand snapshot rather than continuously maintained state, and it reached 5,972 stars. Version 1.1.12 shipped on September 30 with CDP, navigation and iframe fixes; the repository was created August 10 and is still committing daily.
Why it matters: Structure first, pixels on demand. An agent that reads and extracts a page never pays for rendering it, and a screenshot rebuilds from the current DOM and style, replaces the frozen tree, renders one frame and discards the paint state. That is a different bet from shipping a Chromium build you hope stays small.
What changed: 1.1.12 keeps correlated CDP command responses across page replacement, unblocks navigation while the debugger is paused, retains navigation ownership during response body reads, normalises empty target creation URLs, and fixes about:blank referrer handling and iframe src charset encoding. The engine is a standalone kernel, not a wrapper: rusty_v8 for JavaScript, Servo/Stylo for selectors, cascade and computed style, with layout and paint behind --layout. It speaks CDP, WebDriver Classic and WebDriver BiDi, so Playwright's chromium.connectOverCDP attaches to it directly. Self-reported on LexBench across four local engines: 80.7% task success at 92 MiB median peak memory, against Chrome at 99.9% success and 697 MiB, roughly 15% of Chrome's CPU time and 13% of its peak memory. The lower success rate is the honest half of that number.
For me: The architecture argument is worth stealing whether or not you adopt moli. Read the 1.1.12 notes before upgrading, since they are compatibility fixes rather than features.
Tags: #topic/open-source #topic/developer-tools #entity/moli #technology/browser-agents #event/open-source-release #relevance/discovery #learning/awareness
Sources:
OpenRig 0.6.4 turned a pile of terminal sessions into a YAML-defined persistent agent team
OpenRig released 0.6.4 on October 2, 2026. It defines a team of coding agents in YAML, runs Claude Code, Codex or both inside one rig as a single managed system with roles, shared context and owned work, and ships as the npm package @openrig/cli. The repository has 4,685 stars and 328 forks.
Why it matters: The framing is the contribution: a harness wraps a model, and a rig wraps your harnesses. The unit of work becomes a seat in a persistent team with its own context and state, not a terminal session you start from nothing every morning.
What changed: 0.6.4 promotes the 0.6.4 release candidate to stable, makes the web UI the default and adds browser access with a docs page. 0.6.3, on September 30, repaired a 0.6.2 regression that refused messages to running Claude Code seats launched with an explicit permission mode, plus snapshot helper cleanup and interference from archived rigs sharing a name. Requirements are Node.js 22 or 24 with tmux, on macOS or Linux, with no native Windows support. Launching a rig writes provider hooks and workspace trust settings, and rig setup --dry-run previews exactly that.
For me: It edits provider hooks and trust settings on your machine, so read what it changes before running setup. The model-independent seat, not the YAML, is the part worth copying into your own setup.
Tags: #topic/ai-coding #topic/open-source #entity/openrig #technology/multi-agent #technology/agent-orchestration #event/open-source-release #relevance/ai-workflow #learning/awareness
Sources:
Security That Affects You
vm2 closed 13 sandbox escapes in three patch releases, then published an advisory for a version already superseded three times
vm2's releases 3.11.8 on August 27, 3.12.1 on September 3 and 3.12.2 on September 8 closed six, four and three sandbox-escape advisories respectively, all of the same shape: untrusted JavaScript escaping into the host Node process. On October 1 GitHub published CVE-2026-92937 for vm2 3.11.6, a version superseded three times over.
Why it matters: Each fix in the chain became the next bypass target, which is the actual signal here rather than any single CVE. CVE-2026-92937 is the pattern in miniature: the sanitiser identity-checked only the direct call target, so registering the rejection handler as p.then.call(p, undefined, cb) made the intercepted target host Function.prototype.call, the sanitiser never ran, and an error carrying err.detail = process reached sandbox code as a working proxy. bind and Reflect.apply were sanitised; call and apply were not.
What changed: CVE-2026-92937 is critical, CVSS 3.1 10.0, EPSS 1.033%, affects exactly 3.11.6, and was fixed in 3.11.7. The current release is 3.12.2. Earlier in the same run, 3.11.8 closed an intrinsic-inventory gap where the default VM omitted the binary-data and iterator prototype families, letting a proto-walk from a host Buffer (which extends Uint8Array) reach unprotected host prototypes and pollute them globally. 3.12.1 closed a SpeciesConstructor path where writing constructor[Symbol.species] onto a raw host promise delivered the raw host settlement, including process, into sandbox code.
For me: If anything you run evaluates untrusted code through vm2, this is not a patch-and-forget dependency. Pin 3.12.2 at minimum, and treat any real isolation boundary as the actual fix.
Tags: #topic/security #topic/ai-agents #entity/vm2 #technology/agent-security #event/security-issue #relevance/developer #learning/deep-dive
Sources:
New Concepts
Time to first token
Awareness. Time to first token, or TTFT, is the delay between sending a request and receiving the first token back, and it is a different number from throughput. An endpoint can be fast at generating tokens and still feel slow, because the user is waiting on the gap before any of them arrive. For a chat UI that gap is the entire perceived latency. For an agent it is worse, because the agent cannot plan its next step, issue its next tool call, or start streaming a file write until something comes back. TTFT is dominated by queueing rather than arithmetic: a request has to retrieve its cached history, wait for admission into a running batch, compute the new prompt tokens, and then transfer the key-value state to whichever GPU is going to decode it. Prime Intellect's GLM-5.3 deployment found requests whose cached history was already resident still missing the current scheduler decision and waiting a full step, and that fixing the budget was worth more than faster hardware. If you serve models yourself, TTFT and tokens per second are separate tuning problems and the first one is usually a scheduler problem.
Tags: #topic/ai-models #entity/prime-intellect #technology/inference #event/benchmark #relevance/infrastructure #learning/awareness
Sources:
Tag Index
topic
#topic/ai-coding #topic/ai-agents #topic/ai-models #topic/ai-economics #topic/cloud #topic/developer-tools #topic/devops #topic/open-source #topic/security
entity
#entity/azure #entity/cactus-compute #entity/cloudflare #entity/gemini #entity/google-deepmind #entity/magpie #entity/microsoft #entity/moli #entity/openrig #entity/prime-intellect #entity/vllm #entity/vm2
technology
#technology/agent-orchestration #technology/agent-security #technology/browser-agents #technology/computer-use #technology/infrastructure-as-code #technology/inference #technology/llm-api #technology/multi-agent #technology/quantization
event
#event/benchmark #event/github-traction #event/model-release #event/open-source-release #event/policy-change #event/security-issue #event/tool-release
relevance
#relevance/ai-workflow #relevance/developer #relevance/discovery #relevance/free-access #relevance/infrastructure #relevance/practical #relevance/self-hosting
learning
#learning/awareness #learning/deep-dive #learning/hands-on #learning/understand