Tech Radar - 2026-10-09 18:00

Priority Today

Pwn2Own Ireland breaks OpenAI Codex and LiteLLM on day one

Day one of Pwn2Own Ireland 2026 in Cork (October 6) scored two AI-tool successes: Ikotas Labs exploited OpenAI's Codex cloud coding agent with a single argument-injection bug for $40,000 and 4 Master of Pwn points, and Xint's Taisic Yun got a reverse shell on LiteLLM through improper input validation plus code injection for the same $40,000 and 4 points. AI Infrastructure and Coding Agent are dedicated contest categories this year, and day one produced 32 zero-days across the whole event.

Why it matters: Flaws in AI coding agents and their gateway layer now enter the same 90-day coordinated disclosure pipeline as phones and printers, so advisories for this class of tooling are coming on a clock. What changed: LiteLLM was hit twice, once outright and once as a collision where 2 of 4 bugs were already known ($15,000); no technical details publish until the 90-day window closes, and these are contest demonstrations with no reported exploitation outside the event. For me: Nothing to patch today. If you run LiteLLM reachable from the internet, watch for its advisory inside the window, and treat a single-bug compromise of a coding agent as the realistic bar.

Tags: #topic/security #entity/openai #entity/codex #entity/litellm #technology/agent-security #event/security-issue #relevance/developer

Sources:

Meta and Sierra open the Personal Agent Protocol for personal agents

Sierra co-founders Bret Taylor and Clay Bavor announced Personal Agent Protocol on October 6 with Meta: an open standard for how a consumer's personal agent authenticates to a business and what it is allowed to do there, backed at launch by Genesys, Instinct, Rocket, Shopify, Stripe and Walmart, with Meta's announcement also naming NiCE and Decagon. Sessions run on OAuth, the business chooses the access route (its website, an API over MCP or OpenAPI, or its own company agent), and companies can observe what agents do on their properties.

Why it matters: Personal agents currently shop and sign in by scraping like humans, which is what got Meta's Muse cut off from Amazon in September; standardizing identity and permissions is the precondition for agents acting on your account at scale, and the same retail names also back Visa's competing standard. What changed: An announcement, not a spec: v0.1, a reference implementation and design workshops are promised later in October, no license or governance body is published yet, and OpenAI and Anthropic are absent from the partner list. For me: Nothing to implement until v0.1 lands. If you publish APIs or a storefront, the route-choice and agent-visibility parts are what you will eventually configure.

Tags: #topic/ai-agents #entity/meta #technology/personal-agent-protocol #event/project-launch #relevance/developer #learning/awareness

Sources:

GitHub stacked pull requests go generally available

GitHub made stacked pull requests generally available on October 6 across all github.com plans: chains of dependent pull requests you review and merge layer by layer from the web, GitHub CLI (gh stack extension), mobile, and the API. Since the July preview, repositories using stacks report 9% more merged code than comparable ones, and GitHub says over two-thirds of the top 1% of repos now use stacks, with a 5% improvement in time-to-merge.

Why it matters: This is GitHub's answer to changes too large to review in one go, and the programmatic surface (a stack object on pull_request webhooks, REST endpoints to create and dissolve stacks, read-only GraphQL fields) lets CI, dashboards and agent tooling treat a stack as a first-class object. What changed: GA on every plan with API and webhook support, and GitHub documents a gh-stack skill for agents; an Enterprise Server release is promised later; stacks still require branches in the same repository and are unsupported in GitHub Desktop and across forks. For me: The gh stack CLI extension is the entry point for trying it, and agent workflows get a documented skill instead of branch-name conventions.

Tags: #topic/developer-tools #entity/github #technology/git #event/tool-release #relevance/developer #learning/hands-on

Sources:

Copilot CLI discovers local Ollama models

GitHub Copilot CLI 1.0.94-0 (October 7) can now list models from a running local Ollama instance in /model, next to your configured and cloud models, and add one for the current session without restarting the CLI. Discovery installs nothing: Ollama and the model must already be present, and models must support tool calling and streaming.

Why it matters: Local models now sit in the same picker as cloud ones, so trying a local model mid-session is a menu choice instead of a separate harness, which makes local evaluation nearly free to attempt. What changed: Provider and endpoint are shown before you confirm, connection failures appear in the picker with an explanation, and choosing a local model does not enable offline mode — COPILOT_OFFLINE=true stays a separate switch, and a remote provider can still receive prompts and code context. GitHub also announced intelligent routing with local models, with availability to follow. For me: Start Ollama, run copilot, then /model and pick the discovered model. Read the offline-mode docs before assuming a local model means no network.

Tags: #topic/ai-coding #entity/copilot #entity/ollama #event/tool-release #relevance/developer #learning/hands-on

Sources:

Free and Cheap Access

Ling 3.1 Flash is free on OpenRouter until October 13

inclusionAI's Ling 3.1 Flash (released October 2) is listed at $0 per million input and output tokens on OpenRouter through NovitaAI, and Vercel's AI Gateway documents the free promotion as running through October 13, 2026. It is a hybrid-reasoning mixture-of-experts with 560B total parameters and 25B active per token, a 262,144-token context window and 32,768 maximum output tokens.

Why it matters: A week of free access to a frontier-sized model is the cheapest way to run your own agent and coding evals against something new; Ant Group positions Ling for agent tasks, search and tool use. What changed: Free input and output for the promotion window on both OpenRouter and AI Gateway (the gateway's -free model ID stops serving at the end rather than switching to billing); the full design targets a 1M-token context reserved for a later paid tier, weights are not published yet, and there is no independent benchmark — launch scores are vendor-reported. For me: Treat it as an evaluation window with a deadline, not a production dependency. Pricing and rate limits after October 13 are undisclosed.

Tags: #topic/ai-models #entity/inclusionai #entity/openrouter #technology/inference #event/free-tier #relevance/free-access #learning/hands-on

Sources:

AI Coding and Agents

Claude Code 2.1.293 to 2.1.295 default to Haiku 5.5 and fix instruction-style hooks

Claude Code 2.1.293 (October 7) makes Haiku 5.5 the default Haiku model on Anthropic's API and adds an agentType field to the subagent status-line payload so scripts can tell custom subagent types apart. The two October 8 follow-ups fix how prompt hooks written as plain instructions are judged: hooks that say "block commands that..." no longer allow what they were meant to block, and Stop/SubagentStop instruction hooks are less likely to make Claude stop early.

Why it matters: The Haiku default quietly changes context and cost for anything using the claude-haiku alias on the first-party API, and instruction-style hooks silently under-firing was a gap in guardrails people had written. What changed: Model default plus hook-judgment fixes across two same-day releases, alongside the usual batch of memory, MCP, vim-mode and permissions fixes. For me: After updating, re-test any hook you wrote as an instruction, and check hardcoded model IDs if you assumed Haiku 4.5 pricing or context.

Tags: #topic/ai-coding #entity/claude-code #event/tool-release #relevance/developer #learning/awareness

Sources:

Infrastructure and DevOps

Gitea Runner 5.0.0 turns builtin checkout into an actions/checkout match

Gitea Runner 5.0.0 (October 8) makes builtin:checkout support nearly everything actions/checkout does — SSH keys and known hosts, LFS, submodules, sparse checkout, partial clones, ref and commit outputs — and switches action and reusable-workflow downloads from go-git to the Git CLI, which adds SHA-256 repository support and makes full clones several times faster.

Why it matters: Gitea Actions workflows can now carry GitHub checkout steps over without rewriting them, and the Git CLI switch is what makes SHA-256 repositories work at all. What changed: A quiet major with six breaking changes: Git 2.34.1+ required on the runner and in job images using builtin:checkout, checkout now cleans untracked files and fails if the triggering tag moved, ${NAME} expands in config ($${NAME} escapes it), jobs must declare runs-on, OTLP metric names move to OpenTelemetry semantic conventions, and unprivileged runners drop log-driver and OOM container options. New alongside: mutual TLS client certificates, runner.extra_headers, read-only valid_volumes, and a gitea_runner_state metric. For me: Swap the image tag to 5.0.0, grep configs for literal ${, and add runs-on where jobs leaned on the default image.

Tags: #topic/devops #entity/gitea #technology/ci-cd #event/tool-release #relevance/devops #learning/understand

Sources:

Kubernetes attributes processor reaches v1.0.0 in OpenTelemetry

OpenTelemetry's Kubernetes attributes processor has reached v1.0.0, meeting the Collector's stable criteria for testing, benchmarking, documentation and telemetry stability under the project's Stable by Default effort, and it ships in the current opentelemetry-collector-contrib and collector-k8s distributions.

Why it matters: Stable means you can embed it as a Go library or ship it inside your own binary without API breakage, and the attributes it attaches rest on the Kubernetes semantic conventions that went stable in semconv v1.42.0 in June. What changed: The promotion moves the processor onto the new semantic-convention attribute names, which is breaking for existing users; a migration guide covers the transition, and graduation followed weeks of endorsements from production users and redistributing vendors. For me: Read the migration guide before upgrading the collector, and check dashboards or alerts keyed on the old attribute names.

Tags: #topic/devops #entity/kubernetes #technology/observability #event/tool-release #relevance/devops #learning/understand

Sources:

Open Source Momentum

hallmonitor and pmtui put unattended coding agents on one screen

Two small open-source tools have shipped in the past two weeks for the same problem: agents that block on questions while you are away. hallmonitor (Go, Show HN on October 3, trending on TrendShift at the end of September) hooks Claude Code and Codex sessions and shows them on a Mac's notch, menu bar, native app and TUI, answering AskUserQuestion and permission prompts from the notch, with remote machines pulled over plain SSH streaming and no daemon or open port. pmtui (Rust, released October 8) is a tmux-backed supervisor that keeps claude and codex sessions alive and lists them in one TUI.

Why it matters: Running several agents in parallel only works if approvals do not require watching a terminal, so a supervision layer between you and the agents is becoming its own tooling category. What changed: Both are days old and unproven — hallmonitor's Show HN thread is still in single-digit points and pmtui has had one day of exposure — so this is a pattern to watch rather than a project to standardize on. For me: hallmonitor needs a notched Mac; pmtui is cross-platform but very early. Try one only if you already juggle multiple concurrent sessions.

Tags: #topic/ai-coding #topic/open-source #entity/hallmonitor #entity/pmtui #technology/agent-observability #event/open-source-release #relevance/discovery #learning/awareness

Sources:

Technically Impressive

Dearbhadh's year-long Kubernetes security benchmark ends with open-weight models on top

Rory McCune's Dearbhadh project (writeup October 8) spent 2026 testing how well LLMs handle Kubernetes security: 46 models ran through a deterministic Ruby harness on manifest creation, a 10-question quiz, cluster hardening under OpenCode, and six pentest tasks from Kube Security Lab, with Claude Code on Opus 4.6 as the manager agent that scores runs and updates the results site. The year's headline result is that models went from patchy, hallucination-prone answers to near-saturated scores, and the final overall leaderboard is led by open-weight Qwen 3.8 Max 0902 and DeepSeek V4.1 Flash, largely because newer Anthropic, OpenAI and Google models refuse the offensive tasks.

Why it matters: For offensive and defensive security work, the practical model choice now turns on guardrails rather than raw ability, and closed-weight models are the ones declining. What changed: Manifest scores topped out with 13 models tied at 8.7/10, every top cluster-hardening model reached a perfect or near-perfect score, and the author is retiring this benchmark as saturated pending a harder v2 with properly isolated per-run environments. For me: The results site and harness are public. If you pick models for security tooling, re-check refusals yourself; the writeup is candid that cross-contamination between runs affected some scores.

Tags: #topic/security #topic/ai-models #technology/agent-evaluation #event/benchmark #relevance/developer #learning/understand

Sources:

Follow-ups

Claude for Startups: Anthropic paused the free Team year and the $1,000 API credit offers on October 9, saying it received hundreds of thousands of applications and is over capacity; already-claimed benefits stay, all applications get re-reviewed with some previously approved accounts losing the offer, and the Startup Stack, office hours and monthly Console credits are unaffected. (Program FAQ)

New Concepts

personal-agent-protocol (new, stage: awareness). A proposed standard for how your personal AI agent signs in to a website or service, proves which user it acts for, and receives scoped permissions instead of scraping like a human. Sierra and Meta announced the first concrete version on October 6 with retail and payment partners, the spec is due later this month, and Visa is running a rival protocol over the same territory, so the term is worth knowing now.

Tag Index

topic

#topic/ai-agents #topic/ai-coding #topic/ai-models #topic/developer-tools #topic/devops #topic/open-source #topic/security

entity

#entity/claude-code #entity/codex #entity/copilot #entity/gitea #entity/github #entity/hallmonitor #entity/inclusionai #entity/kubernetes #entity/litellm #entity/meta #entity/ollama #entity/openai #entity/openrouter #entity/pmtui

technology

#technology/agent-evaluation #technology/agent-observability #technology/agent-security #technology/ci-cd #technology/git #technology/inference #technology/observability #technology/personal-agent-protocol

event

#event/benchmark #event/free-tier #event/open-source-release #event/project-launch #event/security-issue #event/tool-release

relevance

#relevance/developer #relevance/devops #relevance/discovery #relevance/free-access

learning

#learning/awareness #learning/hands-on #learning/understand