News World
Decision models you can download
Hello,
In issue 005, Jev picked an answer instead of writing one, but only on TypeSafe's servers. This week, decision models you can download, from Cloudflare and from Liquid AI. Then a box that keeps your keys out of your agent's reach, and a spending cap that really cuts off.
Releases
Clef and Clef Flash (Cloudflare)
Clef (27 billion parameters): 10,874 downloads, 1,872 likes. Clef Flash (9 billion): 17,587 downloads, 685 likes (Hugging Face). Apache 2.0 license.
What it's for An agent's small decisions (routing a request, sorting a message). Like Jev, they pick an answer set in advance without writing anything, and Cloudflare says they are compatible with Jev's API; unlike Jev, they also read images. Cloudflare also serves them online, on Workers AI. On October 7, Liquid AI published d1, open decision models for text and images, built to run on the device.
The limit No independent measurement has been published: the scores are Cloudflare's own. Fine-tuning on your data is not self-serve: at first it goes through Cloudflare's engineers.
EmbeddingGemma 2 (Google)
21,148 downloads, 1,147 likes on Hugging Face. Apache 2.0 license, 740 million parameters, more than 100 languages.
What it's for Searching your own documents. Announced by Google on October 6, the model turns a text, an image, a sound or a video into a series of numbers, and two similar pieces of content get close numbers: that is the basis of an agent that finds the right page in your archives. Unsloth publishes a GGUF version, the format of llama.cpp, the program that runs models at home. A model of this kind is worth keeping on your own machine: if it disappears, every number already stored has to be computed again.
The limit It does not answer questions, it is for searching and sorting.
Claude for Google Workspace (Anthropic)
An add-on for Google Docs, Sheets and Slides, announced on October 6, in beta on all paid Claude plans (Pro, Max, Team and Enterprise).
What it's for Drafting, analyzing a spreadsheet or building a presentation with Claude, right inside your Google documents, without copying and pasting from one tab to another. For people who build without being engineers, it is the assistant installed where their documents already live.
The limit It works only on the file it is opened in, plus the connectors you turn on: it does not ask for access to your Drive, Gmail or calendar (see The security reflex). It does not work in Firefox, does not accept an API key (you need a Claude account), and no list of countries is given.
Pi pod
Shown on Hacker News: 121 points, 47 comments. Page signed Evan, code under the AGPL-3.0 license owned by the company Billzo, LLC.
What it's for Running pi, a minimalist coding agent, in sandboxes (closed spaces) on your own server rather than on your machine. You need a Linux server with 8 GB of memory and Docker, a tool that runs programs in closed spaces. Around pi, open-instinct (253 stars, MIT), a personal agent you control through iMessage, says it builds on it.
The limit It has no hosted offering yet: one is announced as coming soon. The project says it is built around pi, but no connection to the pi team is established.
Parseable
Shown on Hacker News: 86 points, 24 comments. Open version free under AGPLv3, which requires you to publish your changes if you turn it into an online service. Hosted offering at $0.39 per GB of data received (14-day free trial), Enterprise from $15,000 a year.
What it's for Keeping a record of what your agents did. Parseable stores logs, metrics and traces in OpenTelemetry format (the standard for exchanging traces) in a single program (210 to 218 MB for a Linux server), to install on your server, or to use through its hosted offering. When an agent fails, the only useful question is what it saw and decided at each turn: without traces, you are searching blind.
The limit The open version does not have what the Enterprise offering adds: custom data partitioning, one installation shared by several customers, a log of who did what, a choice of the country where the data stays, dedicated support.
Repos
strands-agents/box · ★ 208 · Apache-2.0 · last commit October 7, 2026
A sandbox for agents, published by the organization behind the Strands Agents kit: it limits what the agent can run, read, write and reach on the network. Its rules, called Dogwood, deny everything by default, and Box supplies your credentials from outside: the secrets stay out of the box. In issue 006, our problem of the week ended on "an agent locked up with your keys can still use them"; Box tackles that point. What it does not do: it does not write the list of what gets through for you, and does not judge whether an allowed action is legitimate. It does not run on Linux (planned) or Windows: only on Apple silicon Macs, with macOS 15 or later.
openqodex/openqodex · ★ 400 · Apache-2.0 · last commit October 8, 2026
An AI code review before you send your changes, for Claude Code and Codex, made by Qodex, which also runs a hosted review of every pull request. Analyzers look for known vulnerabilities, forgotten secrets, risky dependencies and style mistakes on the changed lines only, then a second, separate program checks each alert before showing it to you. OpenAI offers the same function with codex-security (11,029 stars, Apache-2.0), and GitHub publishes a benchmark to compare these reviewers (see In brief). What it does not do: it only looks at the changed lines, not at an older flaw elsewhere in the code, and it does not guarantee to find everything. It has published no score on that benchmark.
toby-bridges/api-relay-audit · ★ 872 · AGPL-3.0 · last commit October 8, 2026
Do you go through a relay that resells access to Claude or GPT for less? This tool audits it from your machine: instructions slipped into your requests, a model swapped for another (you pay for one, you are served the other), rewritten tool calls, answers that come back mangled, leaks in error messages. In issue 006, we warned about a plugin promising a "free and unlimited" model: here is a way to test that kind of middleman before trusting it with your requests. What it does not do: it reports what it saw at the moment you run it, it does not monitor continuously, and a relay can change afterwards. It does not make a relay safe. It does not prove that a model was swapped: the identity the model gives itself, anchor phrases, response time and technical fingerprints are clues, not proof on their own, the repository says.
In brief
OpenAI will mark generated text to meet the EU's provenance rules, and opens its detector to researchers first. The mark arrives over the coming weeks on ChatGPT and Codex, in the EU; through the API, worldwide, on select models and only if you turn it on. openai.com/index/…
The DGX Spark, NVIDIA's small local AI machine, comes out with 64 GB of memory on October 23 from partners including Acer, starting at $4,999. According to NVIDIA, it runs models of up to 100 billion parameters, and two linked machines up to 200 billion. blogs.nvidia.com/blog/…
GitHub publishes ReviewBench, an open benchmark for agents that review code, built on representative pull requests. A way to compare automated reviewers before handing them a repository. github.blog/ai-and-ml/…
A DuckDB file can contain nothing but views, saved queries that point to Parquet files (a common data format) stored elsewhere: it stays at a few hundred kilobytes, whatever the size of the data. To hand a whole dataset to an agent, you share a small file ready to query. duckdb.org/2026/10/07/…
The problem of the week
My agent can drain my account: how do I set a cap that really cuts it off?
You leave your coding agent alone for the night. The task fails, it starts again, fails again, and every attempt is paid for with the API key you handed it, a key with no limit. An email alert warns, it does not cut off, and at night nobody reads it. You need a hard limit, one that gets the calls refused and sends errors back to the agent.
First step, the cap at each provider. Depending on the provider, it takes the form of prepaid credits or a monthly limit: look for the setting that cuts off, not the one that warns. Our overnight agent then stops at the amount you set.
Second step, one key per project or per agent, with its own limit when the provider allows it. The overnight loop then only burns through its own project's budget, not everyone else's.
Third step, watch consumption live. If your agent runs on a Pro or Max subscription rather than on an API key, claude-code-usage-quota-mod (16 stars, MIT, created October 4) shows its five-hour and weekly limits inside Claude Code, with a forecast before you hit the limit; it does not track the spending of an API key like our overnight agent's. agent-smith (492 stars, MIT, created September 30) monitors Codex usage in a window that requires macOS 14; its dollar amounts are calculated from reference prices, they are not your bill.
Fourth step, send small tasks to a cheap model, which agent-smith's adaptive routing offers. Then count the cost per completed task, not per million tokens (the pieces of words the provider bills for): divide the month's bill by the number of tasks actually finished.
Find where I set a hard spending cap with each of my AI providers, create one key per project with its own limit, and tell me what happens when the limit is reached.
What this does not fix: the cap stops the bill, not what the agent did before the cutoff. And a subscription is not capped the way an API key is.
agent-smith to track and route Codex usage, claude-code-usage-quota-mod to see a subscription's limit coming in Claude Code.
Worth reading
GenAI and Agentic AI Exploit Roundup Q3 2026 · An open OWASP project sorts a selection of the quarter's AI flaws against its two 2026 lists of ten risks (language models, agents). The page calls itself neither exhaustive nor official. genai.owasp.org/2026/10/08/…
Sharing AI progress in mathematics · OpenAI releases on GitHub new mathematical results produced by an internal model, with a good share of the proofs in Lean, a language in which the machine checks every step. Read it alongside EPOCH, on fragile leads promoted to discoveries. openai.com/index/…
Introducing zkAPI: private usage credits for any API · A mechanism, not an investment: each call to an API is authorized by a proof that says "I have credits" without saying who. The provider sees the requests, the payment side sees the spending, and neither makes the link, except through your connection's address or repeated details, the post warns. The provider still reads the content, and you have to go through Ethereum. blog.ethereum.org/en/2026/10/01/…
The security reflex
Are you about to connect an AI to your Google documents? This week, Claude arrives in Docs, Sheets and Slides through an add-on, and before installation Google shows the list of permissions it asks for. Claude's list has two: display its sidebar, and view and manage the file it is installed in. Nothing about your emails or your Drive. Other add-ons can go as far as reading and sending your emails, and people rarely read this list: they approve the name of the service.
The right move. Before installing, read the list of permissions, not the name of the service. Then open the page of apps connected to your Google, Microsoft and GitHub accounts, and remove the ones you no longer use. Do it again every three months.
Reply to this email and tell us what you're building. Every reply gets read.
— News World AI
Get the newsletter
Every Tuesday, in four minutes: what shipped in AI and what you can actually try the same day.
Double opt-in by email. One-click unsubscribe, link in plain sight in every issue.
Geneva, Switzerland. Write to hello@newsworldai.xyz.