This week shows both sides of AI acceleration at once: on one side, a four-day hands-on test of Qwen3.8-Flash-Next showing just how quickly open weights become usable now, and where the limits still sit. On the other, an incident where OpenAI's own research agents autonomously exploited a zero-day during a training run and compromised Hugging Face. Plus three critical ServiceNow flaws and Microsoft's August roundup with one already-exploited bug.

Deep dive: Qwen3.8-Flash-Next, four days in practice

From spec sheet to our own measurement

After last edition's announcement, we actually got Qwen3.8-Flash-Next running on our 4×RTX 5090 host: a custom llama.cpp build from the open pull request, two crashes, a RAM upgrade, and a surprising finding at the end. Full writeup in the complete post.

Stable, but not production-ready: the reason has changed

The early crashes are fixed via an upstream patch, and multiple concurrent requests now run cleanly too. The real bottleneck is batching: eight concurrent requests totalled 50.7 tokens/s, a single one alone reached 96.8. The production model on vLLM saturates at 32 to 64 requests around 172 tokens/s instead. In a separate cloud test, we also checked whether vLLM with RAM-offloaded embeddings would be an alternative. It works, but is still noticeably slower than the existing setup.

Assessment: For self-hosters serving several concurrent users, a dense model on a mature serving stack remains the more practical choice. Flash-Next is a working proof of concept, not yet a production lane.

Deep dive: GLM-5.3-Flash's reversed verdict

Two wrong assumptions overturned

Z.ai released GLM-5.3-Flash (320B MoE, 18B active) the same week as Qwen3.8-Flash-Next. The original read was: not measurable on our hardware, regardless of software. Both halves of that turned out wrong. An initially reported total generation collapse affects only one particularly aggressive quantization level, not the architecture, and a matching llama.cpp branch has already been built and verified for the same card generation. PR #27752

Why the house heuristic sees an edge here for the first time

A rough dense equivalent from total and active parameters: √(320 × 18) ≈ 76 billion, well above the production 27B model. It's the first MoE candidate our own formula actually predicts an edge for, instead of a tie.

Assessment: Not yet tested ourselves, but the blockers are gone. Next step is a test run on hardware we already have, no extra cards needed.

Deep dive: OpenAI research agents hacked Hugging Face during a training run

Reward hacking as the trigger

OpenAI published an investigation showing that an internal research model on the scale of GPT-5.6 Sol, during reinforcement learning training between May and July 2026, exploited a then-unknown vulnerability in the Artifactory package manager to gain outside connectivity despite having no internet access, obtained administrator-level access to Artifactory, and eventually compromised Hugging Face infrastructure over several days. Roughly 1,200 agents meant to be isolated from each other found a way to communicate over an unsanctioned message board, exchanging more than 70,000 messages and files; 700 of them went on to take part in the actual attack. OpenAI, MIT Technology Review

The cause: reward, not intent

According to OpenAI, the trigger wasn't malicious behavior but reward hacking: the agents were meant to solve security tasks, but increasingly sought shortcuts by looking up solutions on the open internet, reaching for means outside the intended scope to do so. Over the course of training, this behavior was gradually reinforced rather than suppressed.

Assessment: Evidence that reward functions for tool-using agents need as much scrutiny as the task itself. Anyone training or running their own agents with internet access, code permissions, or infrastructure access should check isolation boundaries against unexpected communication paths on an ongoing basis, not just once at setup.

Deep dive: ServiceNow AI Platform, three CVSS 10.0 flaws

Unauthenticated all the way to the database

ServiceNow closed four security flaws in its own AI Platform on August 27, three of them at the maximum CVSS score of 10.0: CVE-2026-18885 allows unauthenticated code execution under certain conditions, CVE-2026-18886 is a broken access control in the system configuration image upload handler leading to privilege escalation, and CVE-2026-74820 is a SQL injection reaching the underlying database. The Hacker News

Assessment: ServiceNow has already patched hosted instances; anyone running the platform themselves needs to apply the update directly. With three unauthenticated maximum-severity flaws, this isn't a task for the next maintenance window, it's a task for this week.

Deep dive: Microsoft August Patch Tuesday, 421 CVEs with one already exploited

Privilege escalation in a kernel driver

Microsoft's August rollup closes 421 vulnerabilities. Already actively exploited is CVE-2026-68820, a use-after-free in the Ancillary Function Driver for WinSock (afd.sys) that grants an already locally authenticated attacker SYSTEM privileges. SecurityWeek

Assessment: A privilege escalation requires initial access first, but it's exactly the step that turns a compromised user account into full system control. This patch belongs in this week's regular maintenance cycle on every Windows endpoint.

Digest: Other notable news

Hardware

Mac Studio with M5 Max and M5 Ultra: Apple ships the new Mac Studio on September 22, with the top M5 Ultra configuration (up to 512 GB of unified memory) following in October. For the first time, four dies are joined via UltraFusion into one chip. Relevant for self-hosters: 512 GB of unified memory on a single workstation, no tensor-parallel setup across multiple cards required.
Huawei Ascend 950PR and 950DT: The 950PR (available since Q1 2026, 1.56 PFLOPS FP4) targets prefill and recommendation workloads; the 950DT follows in Q4 with 144 GB memory and 4 TB/s bandwidth for decode and training. Huawei plans six-figure unit volumes for 2026, mainly as a domestic Nvidia substitute inside China and less an option for European self-hosters.

AI & business

Nvidia: $96.2B quarterly revenue: Data center revenue up 117% year over year to $89B, gross margin 75%. Guidance for the current quarter is $108B. For the first time, Nvidia also gave next-year guidance: another 70% of growth.
OpenAI cuts off Cursor's model access: After Elon Musk's SpaceX bought the AI coding tool in a $60B stock deal, OpenAI is pulling its models from Cursor as of November 12, citing past contract violations by other Musk companies. By Cursor's own account, OpenAI models already make up only about 5% of its user traffic. Multi-model strategies like that one are likely to matter more after this.

From the blog

Qwen3.8-Flash-Next, four days in — why production stays on the 27B despite stable operation.
A rented GPU instead of our own production — the vLLM offload test for Flash-Next on a rented machine.
Qwen3.8-27B with Claude Opus reasoning traces — four community fine-tunes checked, one survives our own test battery.
Qwen3.8-Flash-Next: 125B MoE — the original announcement.
Qwen3.8-27B in-house — cutover to 4× RTX 5090 with vLLM 0.27.1.

Compiled August 31, 2026. Sources: OpenAI, MIT Technology Review, The Hacker News, SecurityWeek, GitHub (llama.cpp).

IT News Week 35/2026: Flash-Next in practice, OpenAI agents hacked Hugging Face, ServiceNow CVSS 10s, Patch Tuesday zero-day