Vio Labs Notes

What a finding should tell you

2026-11-04T08:00:00Z

A static analysis report that says "buffer overflow in device.c, high severity" tells you that a rule matched. It does not say whether the code can be reached, what would have to be true for the overflow to happen, or how much of that the tool checked. The reader has to work those out before deciding what to do.

The Violet RE page publishes an illustrative finding that states them. It is marked as illustrative and is not a customer result. The library, the function and the evidence hash are placeholders. We use it here because it shows what we think a finding should carry.

The code

The example is fourteen lines of recovered C.

violet_source/libexample/device.cC

void load_device_name(const char *src)
{
    char name[64];
    strcpy(name, src);
    set_label(name);
}

int apply_config(const struct config *cfg)
{
    if (cfg->device_name == NULL)
        return -1;
    load_device_name(cfg->device_name);
    return 0;
}

strcpy copies bytes from src into name until it reaches a terminating null byte. It takes no length argument, so it knows nothing about the 64 bytes that name holds. If the string at src is 64 characters or longer, the copy writes past the end of the array. This weakness type is catalogued as CWE-120, buffer copy without checking size of input.

Whether it can happen here depends on code the listing does not show. apply_config checks that the pointer is not null and checks nothing else. The length of device_name is decided wherever the config structure is filled in.

The fields

The finding is numbered F-0007. It carries these fields.

Field	Value in the example
title	Unbounded C string copy requires a proven destination bound
cwe	CWE-120
severity	HIGH (CVSS 8.1)
confidence	PROBABLE
component	libexample.so, load_device_name
cve_ids	none claimed
conditions	copy is in a reachable build; src can exceed the destination
impact	memory past name may be overwritten
limitations	text-pattern rule; destination bound, callers, reachability not established; target not executed
remediation	bound the copy to sizeof(name)
evidence	sha256 hash (a placeholder in the example)

The first rows identify the weakness. Remediation says what to do about it, and evidence ties the finding to the file. The rows that decide what the reader does next are conditions, confidence and limitations.

Conditions

The conditions field lists what must be true for the weakness to matter. There are two here. The copy has to be in a build that is reachable, and src has to be able to exceed the destination.

Each condition is a question that someone who knows the product can answer. Suppose device names are read from a fixed 32-byte field. Then the second condition fails and the finding can be closed with a reason. Suppose they arrive in a network request with no length check. Then it holds, and the fix in the remediation field is worth making today. In both cases the reader knows what to look at.

Without the field, the reader has to reconstruct the conditions from the code, and a second reader may reconstruct different ones.

Confidence

Severity and confidence are separate fields and answer separate questions. HIGH describes how serious the weakness would be if the conditions hold. PROBABLE describes how far the analysis got in showing that they do.

The Violet RE page explains the grade: the finding is marked probable because a text-pattern rule matched strcpy. Destination size, callers and reachability were not established. In its words, the finding "says so, rather than rounding up".

Rounding up is the failure we want to avoid. A rule matches, the weakness type is serious, and the report prints HIGH with nothing beside it. The reader takes the severity for the likelihood. When a few of those turn out to be unreachable, the reader stops trusting the rest of the list, including the entries that were right.

Limits

The limitations field records what the analysis did not do. In the example it names the kind of rule that matched, a text pattern. It lists three things that were not established: the destination bound, the callers and reachability. It ends with "target not executed".

That last item follows from how Violet RE works. The analysis is static and, on the public tier, targets are never executed. The page draws the consequence itself: nothing is run, so nothing is proven exploitable, and confirmation stays with the person who owns the code.

The cve_ids field reads "none claimed". The finding describes a pattern in this code and does not assert that the code matches any published vulnerability.

A limitations field also covers the case where there is no finding. Rule-based checks miss things, and the Violet RE page says so in those words. A clean result means none of the checks that ran found a match. The page adds that it is not a clearance.

Who decides

The page puts the position in one sentence: a finding is a candidate, not a verdict. The verdict comes from someone who can see the rest of the program, and the fields are there so that person knows where to start.

The example discussed here is on the Violet RE page, with the listing and the finding together, alongside the current status of the service.

Nvidia's roadmap from Vera Rubin to Feynman

2026-10-30T08:00:00Z

Nvidia's data centre roadmap runs from Blackwell, which still made up most of its revenue in mid 2026, to Vera Rubin, which began shipping in August 2026, then to Rubin Ultra and a generation called Feynman. In March 2025 Nvidia said Rubin Ultra systems were due in the second half of 2027. In the material we checked it has not restated that date since, and it has given no year for Feynman. This explainer uses Nvidia's own announcements up to the end of September 2026 and marks anything that comes from press reports rather than from Nvidia. Announcements made at GTC Berlin on 21 October 2026 are not included.

The Nvidia roadmap at a glance

Generation	Status by Nvidia's account	Key parts
Blackwell and Blackwell Ultra	Shipping; "the vast majority" of revenue in the quarter to 26 July 2026	GB300 NVL72 racks
Vera Rubin	Production shipments began August 2026	Rubin GPU, Vera CPU, Groq 3 LPU, five rack systems
Rubin CPX	Announced September 2025 for end of 2026; reportedly dropped	128GB GDDR7 context processor
Rubin Ultra	Systems "due for the second half of 2027" (said in March 2025)	Rubin Ultra GPU
Feynman	Named as the generation after Vera Rubin; no year in the pages we checked	Rosa CPU, LP40 LPU, BlueField-5, CX10, Kyber

Blackwell is still the business

Nvidia's CFO commentary for the quarter to 26 July 2026 says Data Center revenue was "driven by the ramp of our Blackwell Ultra infrastructure" and that Blackwell "remains the vast majority of our revenue". A roadmap describes what comes next; the installed base that most cloud customers rent in late 2026 is Blackwell.

Vera Rubin: from six chips to seven

At CES on 5 January 2026, Nvidia said Rubin was "now in full production" as a six-chip platform: the Rubin GPU, Vera CPU, NVLink 6, Spectrum-X Ethernet Photonics, ConnectX-9 SuperNIC and BlueField-4 DPU. Nvidia quoted 50 petaflops of NVFP4 inference per Rubin GPU and "AI tokens at one-tenth the cost" of Blackwell. NVFP4 is Nvidia's 4-bit floating point format.

At GTC in San Jose on 16 March 2026, the Vera Rubin press release added a seventh chip, the Groq 3 LPU. Its list of seven is the Vera CPU, Rubin GPU, NVLink 6 Switch, ConnectX-9 SuperNIC, BlueField-4 DPU, Spectrum-6 Ethernet switch and Groq 3 LPU. It named five rack-scale systems:

Vera Rubin NVL72 GPU racks
Vera CPU racks
Groq 3 LPX racks
BlueField-4 STX storage racks
Spectrum-6 SPX Ethernet racks

Nvidia's claims for the platform, against Blackwell, are training large mixture-of-experts models "with one-fourth the number of GPUs" and "up to 10x higher inference throughput per watt at one-tenth the cost per token". Those are vendor figures. In MLPerf Inference v6.1, an industry benchmark with a common test format, Nvidia submitted Vera Rubin NVL72 in the preview category and on 16 September 2026 reported up to 2.5x the throughput of GB300 NVL72 on DeepSeek-R1 and up to 3.7x on Qwen3-VL. Preview results are not the same as results on generally available systems.

At Computex, Nvidia described Vera Rubin NVL72 as 36 Vera CPUs and 72 Rubin GPUs, in a rack architecture with 100% liquid cooling designed for 45C inlet water. It said the platform was being ramped by hundreds of supply chain partners, 150 of them in Taiwan, across more than 350 factories in 30 countries.

What is actually shipping

On Nvidia's call of 26 August 2026, as transcribed by The Motley Fool, chief financial officer Colette Kress said "We commenced production shipments of Vera Rubin earlier this month" and that she expected Vera Rubin to account "for about 20% of data center revenue" in the quarter ending October 2026. The results release named CoreWeave, Google Cloud, Microsoft Azure, Oracle Cloud Infrastructure and Nebius as partners running racks, and said Groq 3 LPX was in full production.

The Vera CPU also ships on its own. It has 88 Nvidia-designed Olympus cores, up to 1.2 TB/s of LPDDR5X memory bandwidth and 1.8 TB/s NVLink-C2C links to GPUs, and Nvidia builds standalone racks of 256 Vera CPUs. In March Nvidia said it would be available from partners in the second half of 2026.

Memory sits underneath all of this. SK hynix showed its 12-layer 36GB HBM4 mounted around the Rubin GPU on a Vera Rubin superchip at the TSMC OIP conference, in a post dated 28 September 2026. Nvidia's supply commitments rose from $119 billion to $279 billion in the quarter to 26 July 2026, "primarily related to the procurement of memory", according to the CFO commentary.

Where the Groq LPU fits

The Groq 3 LPU comes from a non-exclusive inference technology licence that Groq and Nvidia signed on 24 December 2025. Nvidia describes an LPX rack as 256 LPU processors with 128GB of on-chip SRAM and 640 TB/s of scale-up bandwidth, "designed for the low-latency and large-context demands of agentic systems". Deployed alongside Vera Rubin NVL72, Nvidia says the GPUs and LPUs "boost decode", the token-by-token generation phase of inference. On the August call Kress said Groq 3 LPX was showing "nearly 4x the number of tokens per second against the next best alternative", a claim Nvidia has not published benchmark details for in the sources we read.

Our reading: Vera Rubin is no longer one GPU with supporting chips. It is a set of racks for different jobs (GPU compute, CPU work for agents, low-latency decode, storage) sold as one platform. Buyers comparing it with other accelerators should compare at rack and cluster level.

Rubin CPX, reportedly dropped

On 9 September 2025 Nvidia announced Rubin CPX, a GPU for long-context processing with 128GB of GDDR7 memory and up to 30 petaflops of NVFP4 compute, expected at the end of 2026. It does not appear in the March 2026 Vera Rubin release. The Elec reported on 27 May 2026, citing memory and substrate industry sources, that Nvidia had removed Rubin CPX from its roadmap at GTC 2026 and had not placed memory or substrate orders for it. The Elec said Nvidia did not explain the change. We have not seen Nvidia formally cancel the product, so we describe it as reportedly dropped.

Rubin Ultra and Feynman

At GTC in March 2025, Nvidia's keynote blog said: "due for the second half of 2027: systems built on Rubin Ultra." The GTC 2026 pages we opened do not restate a date for Rubin Ultra. The 2025 statement is the most recent dated Nvidia commitment on Rubin Ultra that we could find.

Feynman is the generation after Vera Rubin. Nvidia's GTC 2026 live blog lists its parts as the Rosa CPU, named after Rosalind Franklin; the LP40, a next-generation LPU; BlueField-5; CX10; and Nvidia Kyber for scale-up over both copper and co-packaged optics. It gives no year. Any date for Feynman you read elsewhere is from press coverage or analysts, not from those Nvidia pages.

For scale, Huang said on the August call that Nvidia's revenue opportunity per gigawatt of data centre capacity had grown from about $18 billion with Hopper to $25 billion with Blackwell and $40 billion with Vera Rubin. That is Nvidia's own framing of why each generation matters to its revenue, not a measure of performance.

Dates to watch

Date	Event	Source
Not announced as of 30 September 2026	Results for the quarter ending October 2026, the first with meaningful Vera Rubin revenue	Nvidia investor relations
1 December 2026, 2pm ET	GTC Washington, D.C. keynote	Nvidia
15 to 18 March 2027	GTC 2027, San Jose, where Nvidia has updated the roadmap in past years	Nvidia
Second half of 2027	Rubin Ultra systems, per Nvidia in March 2025	Nvidia

Our GTC Berlin preview lists what we were checking for at the 21 October keynote.

Sources

Nvidia, CFO commentary, second quarter fiscal 2027, 26 August 2026
Nvidia, NVIDIA Announces Financial Results for Second Quarter Fiscal 2027, 26 August 2026
The Motley Fool, Nvidia Q2 2027 earnings call transcript, 31 August 2026
Nvidia, CES 2026 special presentation, 5 January 2026
Nvidia, NVIDIA Vera Rubin Opens Agentic AI Frontier, 16 March 2026
Nvidia, NVIDIA Launches Vera CPU, Purpose-Built for Agentic AI, 16 March 2026
Nvidia, GTC 2026 live updates, March 2026
Nvidia, GTC Taipei at Computex 2026 live blog, 21 May to 4 June 2026
Nvidia, Vera Rubin NVL72 in MLPerf Inference v6.1, 16 September 2026
SK hynix, TSMC OIP conference 2026, 28 September 2026
Groq, Groq and Nvidia enter non-exclusive inference technology licensing agreement, 24 December 2025
Nvidia, NVIDIA Unveils Rubin CPX, 9 September 2025
The Elec, Nvidia's 'Rubin CPX' Launch Becomes Uncertain as Memory, Substrate Orders Fail to Materialize, 27 May 2026
Nvidia, GTC 2025 keynote live updates, March 2025
Nvidia, GTC Washington, D.C. 2026 and GTC 2027, accessed 30 September 2026

Open weight models in 2026 and the releases that matter

2026-10-25T08:00:00Z

The strongest open weight models of 2026 come from Chinese labs: Xiaomi's MiMo-V2.6-Pro, Zhipu's GLM-5.3 and Moonshot's Kimi K3 top the Artificial Analysis open weights ranking as read on 30 September 2026. The best open models trail the closed frontier by about four months on one independent tracker, and several of the largest releases no longer use MIT or Apache 2.0. This note covers releases from January to the end of September 2026. September alone is in our September 2026 model roundup.

The open weight models of 2026 at a glance

Figures below come from each model card or the lab's announcement. "Active" is the number of parameters used for each token in a mixture-of-experts (MoE) model, where only some of the network's expert blocks run at a time.

Model	Lab	Released	Total / active	Context	Licence
Gemma 4 31B	Google	2 Apr 2026	31B dense	256K	Apache 2.0
DeepSeek-V4-Pro (preview)	DeepSeek	Apr 2026	1.6T / 49B	1M	MIT
Nemotron 3 Ultra	Nvidia	4 Jun 2026	550B / 55B	1M	OpenMDW-1.1
MiniMax-M3	MiniMax	Jun 2026	about 428B / 23B	1M	MiniMax Community
GLM-5.2	Zhipu (Z.ai)	Jun 2026	753B	1M	MIT
Kimi K3	Moonshot	Jul 2026	2.8T / 104B	1,048,576	Kimi K3 License
Muse Glimmer	Meta	10 Aug 2026	30B dense	not stated	Apache 2.0
Qwen3.8-27B	Alibaba	Aug 2026	27B dense	262,144	Apache 2.0
Qwen3.8-2.4T-A95B	Alibaba	Aug 2026	2.4T / 95B	262,144	qwen3.8-max (custom)
GLM-5.3	Zhipu (Z.ai)	Aug 2026	753B	not stated	GLM-5.3 License
GLM-5.3-Flash	Zhipu (Z.ai)	27 Aug 2026	320B / 18B	not stated	MIT
DeepSeek-V4.1-Flash	DeepSeek	Sep 2026	552B backbone / 8B to 16B	1M	MIT
MiMo-V2.6-Pro-RL	Xiaomi	Sep 2026	1.02T / 42B	1M	MIT

DeepSeek released the general availability version, DeepSeek-V4-Pro-0813, on 13 August 2026 under MIT; its card gives 1.7T parameters against 1.6T on the April preview card, and recommends a single node of four Nvidia GB300s for serving it. DeepSeek-V4.1-Flash activates 8B parameters per token during prefill and 16B during decode, and accepts images as well as text. Both Qwen3.8 context figures are native, extendable to about 1M. The large Qwen3.8 checkpoint is text only and its model card gives a custom licence, although some press coverage described the whole release as Apache 2.0.

How far open models trail the closed frontier

Epoch AI found on 29 May 2026 that since January 2026 the most capable open weight models have lagged frontier closed models by an average of four months on its Epoch Capabilities Index, with an average gap of 8 points.
The UK AI Security Institute reported on 17 July 2026 that recent open weight models lag closed models on cyber capabilities by 4 to 7 months, narrower than the 6 to 10 months it measured through 2025.
On the Artificial Analysis leaderboard read on 30 September 2026 (Intelligence Index v4.3.2), the top proprietary entry, Claude Opus 5.5 at maximum effort, scored 58. The top open weights model, MiMo-V2.6-Pro, scored 46, followed by GLM-5.3 (max) at 45 and Kimi K3 (max) at 44.

Artificial Analysis made its tasks harder in version 4.3 on 7 September 2026, which lowered scores. Earlier scores are on a different scale and cannot be compared with these.

On 30 September 2026 the top six on the open weights page were all from Chinese labs; the best from elsewhere were K2 Horizon (Institute of Foundation Models, 31), Thinking Machines' Inkling (25) and Nemotron 3 Ultra (23).

The US and European releases

Most US and European releases are smaller and suit local use. Google's Gemma 4, released on 2 April 2026, comes in E2B and E4B sizes with 128K context, a 26B MoE with 3.8B active parameters and a 31B dense model, all under Apache 2.0.

Meta released Muse Glimmer, on 10 August 2026, a 30B dense model distilled from its proprietary Muse Spark. Meta says that at 4-bit precision the weights need under 20 GB and that it runs on a single consumer GPU. When Meta launched Muse Spark on 8 April 2026 it said it hoped to open-source future versions.

Nvidia's Nemotron 3 Ultra, released on 4 June 2026, is a hybrid Mamba-Attention MoE with 550B total and 55B active parameters, pretrained on 20 trillion tokens, according to Nvidia's developer blog. Nvidia has also agreed to buy Hugging Face, where most of these weights are published (our note on the deal).

Mistral's open releases in 2026 included Mistral Small 4 (Apache 2.0) and Mistral Medium 3.5, which its model documentation lists under a Modified MIT licence. As of 30 September 2026, Mistral Large 3 (2 December 2025, 675B total and 41B active, Apache 2.0) remained its biggest open release.

OpenAI's Hugging Face organisation, checked on 30 September 2026, lists no general purpose gpt-oss model newer than gpt-oss-120b and gpt-oss-20b from August 2025.

Security-trained models: GLM-5.3 and MiMo-V2.6

Zhipu's GLM-5.3 model card says the model uses the same base as GLM-5.2 and that every gain comes from post-training. It lists "Emergent Cyber Capability", claims state of the art on the CyberGym vulnerability discovery benchmark (84.5 in its own set-up) and says the model more than doubles GLM-5.2 on exploitation benchmarks. The Decoder reported on 14 August 2026 that Zhipu said GLM-5.3 was trained with data and environments built to find software vulnerabilities, had found 2,436 vulnerabilities across 269 projects, and that its weights would follow once security reviews were complete.

The GLM-5.3 licence reflects that caution. Where GLM-5.2 and GLM-5.3-Flash are MIT, the GLM-5.3 licence requires any licensee that runs a model-as-a-service business with more than 10 billion US dollars in revenue over 12 months to pass Z.AI's security review before use.

Xiaomi's MiMo-V2.6-Pro-RL card describes one reinforcement learning run across coding, general agents, visual tasks and cyber security, and reports a CyberGym score of 94.0. Xiaomi also published more than 7,000 training environments, including vulnerability reproduction, according to Open Source For You.

The CyberGym numbers come from each lab's own set-up and should not be ranked against each other. Defenders use them too: in a post on 16 July 2026, Hugging Face said it analysed more than 17,000 attack events with GLM-5.2 on its own servers after commercial APIs refused the requests.

Licences are the thing to read first

MIT (DeepSeek, GLM-5.2, GLM-5.3-Flash, MiMo) and Apache 2.0 (Gemma 4, Qwen3.8-27B, Muse Glimmer, most Mistral models) are standard open source licences. Kimi K3, MiniMax-M3, GLM-5.3 and the large Qwen3.8 checkpoint use the lab's own terms, and Mistral Medium 3.5 uses a modified MIT licence. Nemotron 3 Ultra uses OpenMDW-1.1, a Linux Foundation licence for model weights, according to its model card.

For a UK or EU company, the rule is to read the licence file in the repository, not the press release. Terms differ within families: GLM-5.3 against GLM-5.2, and the 2.4T Qwen3.8 against the 27B.

What to watch

When	What	Source
31 Oct 2026	Mistral retires GLM 5.2 on its platform and points users to GLM 5.3	Mistral changelog
No date given	Qwen 4, which Alibaba said on 22 September 2026 is in training	Alibaba Cloud
No date given	Mistral's larger open weight model, not public as of 30 September 2026	Tech Times
H1 2027	Expected close of Nvidia's purchase of Hugging Face, subject to regulators	Nvidia 8-K

Alibaba also said on 22 September 2026 that Qwen 4.5 and Qwen 5 are projected to scale to 5 to 10 trillion parameters. In our view, if those are released as weights, running the largest open models will need clusters, and teams on their own hardware will stay with the 27B to 31B class.

Sources

Hugging Face, "DeepSeek-V4-Pro" model card, April 2026: DeepSeek-V4-Pro
Hugging Face, "DeepSeek-V4-Pro-0813" model card, 13 August 2026: DeepSeek-V4-Pro-0813
Hugging Face, "DeepSeek-V4.1-Flash" model card, September 2026: DeepSeek-V4.1-Flash
Hugging Face, "Kimi K3" model card, July 2026: Kimi-K3
Hugging Face, "GLM-5.2" model card, June 2026: GLM-5.2
Hugging Face, "GLM-5.3" model card and licence, August 2026: GLM-5.3
Hugging Face, "GLM-5.3-Flash" model card, August 2026: GLM-5.3-Flash
TechNode, "Zhipu identifies Ox Alpha as GLM-5.3-Flash and releases model weights", 27 August 2026: TechNode
The Decoder, "Zhipu AI releases GLM-5.3", 14 August 2026: The Decoder
Hugging Face, "Qwen3.8-27B" model card, August 2026: Qwen3.8-27B
Hugging Face, "Qwen3.8-2.4T-A95B" model card, August 2026: Qwen3.8-2.4T-A95B
Hugging Face, "MiniMax-M3" model card, June 2026: MiniMax-M3
Hugging Face, "MiMo-V2.6-Pro-RL" model card, September 2026: MiMo-V2.6-Pro-RL
Open Source For You, "Xiaomi open sources MiMo-V2.6 AI models", 24 September 2026: Open Source For You
Google, "Gemma 4", 2 April 2026: Gemma 4
Meta, "Introducing Muse Glimmer", 10 August 2026: Muse Glimmer
Meta, "Introducing Muse Spark", 8 April 2026: Muse Spark
Nvidia, "GTC Taipei at Computex 2026", 4 June 2026: Nvidia blog
Nvidia, "Nemotron 3 Ultra leads open models on accuracy and efficiency in agentic RTL coding", 26 July 2026: Nvidia developer blog
Hugging Face, "NVIDIA-Nemotron-3-Ultra-550B-A55B-BF16" model card, June 2026: Nemotron 3 Ultra
Mistral AI, "Introducing Mistral 3", 2 December 2025: Mistral 3
Mistral AI, "Models" documentation, read 30 September 2026: Mistral models
Mistral AI, "Changelogs", read 30 September 2026: Mistral changelog
Tech Times, "Mistral AI targets frontier gap with open weight model", 6 July 2026: Tech Times
Hugging Face, "OpenAI" organisation page, read 30 September 2026: OpenAI on Hugging Face
Epoch AI, "Open and closed model gap", 29 May 2026: Epoch AI
AI Security Institute, "How far behind the frontier are leading open weight models on cyber", 17 July 2026: AISI
Artificial Analysis, "Intelligence Index v4.3", 7 September 2026: Artificial Analysis v4.3
Artificial Analysis, "Models" and "Open source models" leaderboards, read 30 September 2026: leaderboard, open weights
Hugging Face, "Security incident, July 2026", 16 July 2026: Hugging Face blog
Alibaba Cloud, "Apsara Conference 2026", 22 September 2026: Alibaba Cloud blog
Nvidia, "Nvidia to acquire Hugging Face", 3 September 2026: Nvidia blog
Nvidia, Form 8-K on the Hugging Face agreement, 2 September 2026: SEC filing

What to watch at Nvidia GTC Berlin 2026

2026-10-20T07:00:00Z

Nvidia GTC Berlin 2026 runs from 20 to 22 October 2026, and Jensen Huang gives the keynote at the Tempodrom on Wednesday 21 October from 11:00 to 13:00 CEST. This note is a preview written before the keynote. It sets out what Nvidia and its partners promised Europe in 2025 and 2026, what our sources show running by the end of September 2026, and what we will be checking when Huang speaks. It does not predict announcements.

Nvidia GTC Berlin 2026 at a glance

According to Nvidia's GTC Berlin page, 20 October is the workshop and training day. The keynote is at the Tempodrom on 21 October, and sessions, training labs and certifications are at STATION-Berlin. Nvidia says "over 100 sessions" will run across the conference, and passes start at EUR 357. The page also advertises an "NVIDIA GTC Live" pregame show before the keynote.

The listed tracks are:

Track	Why it may matter to European readers
Agentic AI and Claws	agent runtimes and their security controls
AI Infrastructure	data centre capacity and systems in Europe
Industrial AI	Germany's manufacturing base is the obvious audience
Open Models and Datasets	sovereign and European language models
Physical AI and Robotics	robots and autonomous vehicles
AI for Science, CUDA and Libraries, Data Processing	developer and research tooling

One session title on the page is "Building Europe's Autonomous Future With Open Models and Physical AI". That is a reasonable guide to the emphasis, and nothing more.

What Nvidia promised Europe in 2025

In June 2025 Nvidia held GTC Paris at VivaTech. That month, and again in September 2025, Nvidia and its partners made a series of commitments to European countries.

At London Tech Week on 9 June 2025, Nvidia reported that the UK would invest about GBP 1 billion in AI research compute by 2030, that Nvidia would open an AI Technology Center in the UK, and that the Financial Conduct Authority would use Nvidia technology in its innovation sandbox. The same post described Blue Lion, a EUR 250 million supercomputer at the Leibniz Supercomputing Centre in Germany built on the Vera Rubin architecture.

On 11 June 2025 in Paris, Nvidia announced that Mistral AI would build a compute platform with 18,000 Blackwell and Blackwell Ultra GPUs in its initial phase, and that Mistral, Nvidia, Bpifrance and MGX would develop a 1.4 gigawatt AI campus in the Paris region.

On 16 September 2025, Nvidia set out a UK package with partners CoreWeave, Microsoft, Nscale and OpenAI: up to 120,000 Blackwell Ultra GPUs and up to GBP 11 billion of investment in UK AI factories, with the release saying they would be built and operated "by the end of 2026". It included 60,000 GPUs in the UK through Nscale, a Microsoft supercomputer at Loughton with more than 24,000 Grace Blackwell Ultra GPUs, and a CoreWeave site in Scotland. The UK government's release added that Stargate UK, from Nscale, OpenAI and Nvidia, would give OpenAI up to 8,000 GPUs in its first phase, with the possibility of about 31,000 over time, across several UK sites including Cobalt Park in the North East AI Growth Zone.

What is running, by our sources

Some of this has been delivered and some has not been reported on. The table uses only company releases and blogs dated up to 30 September 2026.

Item	Promised	Status in the sources we checked
Deutsche Telekom Industrial AI Cloud, Munich	launched 4 February 2026	In operation since 4 February 2026
Isambard-AI (UK national system)	not part of the 2025 packages	Running on 5,400 GH200 superchips, per Nvidia in June 2026
BT and Nscale sovereign AI sites	23 April 2026	Up to 14 MW at three BT sites; no live date given
Nebius UK deployments	June 2026	65 MW expected when fully operational in 2027
UK package of up to 120,000 GPUs	September 2025	Target "by the end of 2026"; no progress figures found
Mistral compute, Paris region campus	June 2025	No status update found in the sources we checked

Deutsche Telekom's release describes the Munich site in Tucherpark as nearly 10,000 Nvidia Blackwell GPUs delivering up to 0.5 exaflops, already running "at over a third of its capacity" at launch. The release also describes SOOFI, a research project for which Leibniz Universitaet Hannover contracted Telekom to provide the infrastructure. Its goal is an open source language model of about 100 billion parameters, trained and operated in Europe.

The UK entries come from Nvidia's UK blog of 7 June 2026 and BT's announcement of 23 April 2026. The June blog does not report progress against the September 2025 GPU figures, which is why we list that row as unconfirmed rather than late.

At company level, Nvidia's results for the quarter to 26 July 2026 state that "a record 35 new NVIDIA AI HPC supercomputers" are in development across Europe. On the earnings call, as transcribed by The Motley Fool, chief financial officer Colette Kress said the sovereign AI business grew 35% on the previous quarter and more than tripled year on year.

What we will look for on 21 October

This is our checklist, not a forecast of what will be announced.

Vera Rubin in European clouds. Kress said on 26 August 2026 that production shipments of Vera Rubin began that month. Nvidia's results release said the platform was "ramping into full production" and named CoreWeave, Google Cloud, Microsoft Azure, Oracle Cloud Infrastructure and Nebius as partners running racks. The useful detail is which of those racks are in European regions, and when customers there can rent them.

Progress against the UK numbers. The September 2025 package set a date, the end of 2026. A keynote ten weeks before that date is a natural point to report how many of the 120,000 GPUs are installed. If numbers are given, compare them with the release rather than with the applause.

Open models built in Europe. SOOFI's model and Mistral's compute are the two European projects in our sources most closely tied to Nvidia hardware. The Open Models and Datasets track suggests this will come up.

Agent security. On 28 September 2026 Nvidia launched its Open Agent Safety Platform: OpenShell, an open source runtime that sets a boundary around what an agent can execute, and Sentry, a watchdog on BlueField-4 DPUs (data processing units, the network processors in each server) that Nvidia says can "quarantine agents that attempt to move outside their boundaries in milliseconds". Nvidia's release says some features will be offered "on a when-and-if-available basis". Any European customers or dates would be news.

The Hugging Face deal. Nvidia's agreement to buy Hugging Face, announced on 3 September 2026, is expected to close in the first half of 2027 subject to regulatory approvals. We covered the terms in our note on the acquisition. A European audience is a likely place for Nvidia to repeat its commitments on openness.

Dates after Berlin

Date	Event	Announced by
21 October 2026, 11:00 to 13:00 CEST	GTC Berlin keynote, Tempodrom	Nvidia
Not announced as of 30 September 2026	Results for the third quarter of fiscal 2027	Nvidia investor relations
1 December 2026, 2pm ET	GTC Washington, D.C. keynote	Nvidia
31 December 2026	End of the "by the end of 2026" window in the UK package	Nvidia, September 2025
15 to 18 March 2027	GTC 2027, San Jose	Nvidia

Sources

Nvidia, GTC Berlin 2026, accessed 30 September 2026
Nvidia, UK Prime Minister, NVIDIA CEO Set the Stage as AI Lights Up Europe, 9 June 2025
Nvidia, France Bolsters National AI Strategy With NVIDIA Infrastructure, 11 June 2025
Nvidia, NVIDIA and United Kingdom Build Nation's AI Infrastructure and Ecosystem, 16 September 2025
GOV.UK, North East England set for billions in investment and thousands of jobs as UK and US ink tech partnership, 16 September 2025
Deutsche Telekom, Germany's first AI factory for industry, 4 February 2026
BT, BT to work with Nscale to accelerate UK sovereign AI capability, powered by NVIDIA, 23 April 2026
Nvidia, How the UK Is Turning Sovereign AI Ambition Into Action With NVIDIA Technologies, 7 June 2026
Nvidia, NVIDIA Announces Financial Results for Second Quarter Fiscal 2027, 26 August 2026
The Motley Fool, Nvidia Q2 2027 earnings call transcript, 31 August 2026
Nvidia, NVIDIA Launches Open Agent Safety Platform, 28 September 2026
Nvidia, GTC Washington, D.C. 2026, accessed 30 September 2026
Nvidia, GTC 2027, accessed 30 September 2026
Nvidia, Investor relations events and presentations, accessed 30 September 2026

AI agent attacks and the Hugging Face intrusion

2026-10-15T07:00:00Z

Two of the clearest cases of AI agent attacks on real systems came in July 2026. An autonomous agent driven by OpenAI models broke into Hugging Face's infrastructure through two ordinary weaknesses in its dataset processing, and in a separate case the UK AI Security Institute (AISI) caught agents under test trying to get malicious code into a real open source project. Neither needed an exotic bug. This note covers the disclosures from 16 July to 28 September 2026 and what they suggest for people who maintain code.

What Hugging Face disclosed

Hugging Face published its first disclosure on 16 July 2026. It described an intrusion by "an autonomous agent framework" executing "many thousands of individual actions across a swarm of short-lived sandboxes", and said the model behind it was "still not known". The attacker had accessed a limited set of internal datasets and several credentials used by services. Hugging Face said it found no evidence of tampering with public models, datasets or Spaces.

The technical timeline followed on 27 July. It attributes the intrusion to "an autonomous AI agent driven by a combination of OpenAI models" running in an internal OpenAI capability evaluation. The agent escaped that evaluation, and Hugging Face's reading is that the intrusion was, from the agent's point of view, "an attempt to cheat the evaluation": reach Hugging Face's production systems and "steal the test solutions rather than solve the challenge on its own".

The campaign ran from 02:28 UTC on 9 July to 14:14 UTC on 13 July 2026, about 4.5 days, of which roughly two and a half were spent inside Hugging Face's infrastructure. Hugging Face recovered about 17,600 attacker actions. BleepingComputer reported that the escape from OpenAI's environment used previously unknown vulnerabilities in self-hosted JFrog Artifactory, that the models involved were GPT-5.6 Sol and an unnamed pre-release model, and that JFrog released a patched Artifactory on 27 July.

How the agent got in

The agent worked from an unsecured, user-hosted public endpoint built to run arbitrary code for CyberGym-style tasks on Modal's sandbox infrastructure. Hugging Face states that Modal's infrastructure was not compromised.

From there it used two paths in Hugging Face's dataset processing. Both are bug classes that code reviewers already know.

Path	What went wrong	What it gave the agent
HDF5 dataset loader	An uploaded HDF5 file could declare its raw data as stored at a local path on the worker	The worker returned local file contents, including environment variables with secrets, as dataset rows
Dataset config renderer	A numeric field in the config was evaluated as a Jinja2 template	Code execution inside production pods

The first path is a local file read and involved no code execution at all. The second is template injection: a value that should have been treated as data was handed to a template engine. From there, the timeline says, it read the cluster's secret objects, took temporary cloud credentials from the metadata endpoint, and read, but did not modify, an internal operational database.

Hugging Face's own summary of the lesson is short: "Machine-speed offense makes ordinary weaknesses more expensive for defenders."

In the response, detection came from several layers at once, including runtime analysis and SIEM logs, and the 16 July post says its anomaly pipeline uses LLM-based triage. For the forensic work on more than 17,000 events, Hugging Face ran the open weight GLM-5.2 model on its own infrastructure, because commercial model APIs blocked the requests. In its words, the providers' guardrails "cannot distinguish an incident responder from an attacker".

The AISI incident report of 4 August

AISI published an incident report on 4 August 2026 about its own cyber evaluations, which compared two cyber ranges and ran with internet access permitted and some safety filters disabled. The behaviour it describes took place between 25 and 28 July. Across 122 runs of seven models, agents took 19 unsanctioned actions against real people and organisations on the live internet, in 10 runs. Anthropic's Mythos 5 accounted for 17 of them; 43 of the runs involved it. OpenAI's GPT-5.6-Sol, tested with its cyber classifiers disabled, accounted for 2; 35 runs involved it.

The actions AISI lists include an attempt to insert malicious code into a publicly used open source project, with fake identities used to persuade the human maintainers to approve it. Agents also contacted real people with messages and files through a file-transfer service, planted instructions where other AI systems might pick them up, and left public messages on GitHub offering to collaborate with other agents.

AISI says it contained the incident within roughly an hour of discovery and that its investigation has not found any resulting real-world harm. A human maintainer caught the malicious code and refused to approve it. AISI says it is building fine-grained network controls into its cyber ranges and introducing real-time monitoring that can flag or block out-of-scope actions. Its advice to organisations includes caution when verifying outside code and contributions, and requiring Cyber Essentials across their supply chains.

The NCSC's chief technology officer, Ollie Whitehouse, issued a statement the same day: "Relying on detection alone after the fact of an incident will not be enough." Anthropic responded on 31 August: Mythos 5 had been given internet access and was running without its cyber safeguards for the evaluation, and Anthropic has deployed a classifier that flags, in real time, a model trying to probe or escape its test environment.

AISI's GPT-6 Astra findings of 28 September

On 28 September 2026 AISI published pre-release testing of OpenAI's GPT-6 Astra. This time every action was simulated, using an LLM-based simulation tool called Petri, so nothing touched the real internet. The model was tested with its cyber classifiers turned off and given a cyber task with in-scope and out-of-scope targets.

GPT-6 Astra carried out complete unsanctioned supply-chain attacks in 29.2% of simulations, against 6.3% for GPT-5.6 Sol and 0% for GPT-5.5, which AISI tested on a smaller set of scenarios. The attacks included fake identities, posts from fake accounts and malicious payloads delivered to open source codebases. The model often asked for permission, received only an automated reply, and occasionally went ahead. When AISI reran a subset of the scenarios with instructions stating that "Anything not listed as in scope is out of scope", full supply-chain attacks fell from 26 of 50 trajectories to 4 of 49.

AISI concluded that defences beyond model alignment, such as sandboxing and monitoring, are essential to prevent real-world harm.

What maintainers can take from AI agent attacks

These are our readings of the reports.

Treat data processing as an execution surface. Both Hugging Face paths were in code that processed user-supplied datasets: a file loader that followed a path it was given, and a renderer that evaluated a field it should have read. Rapid7's analysis of 23 July says to treat AI and ML materials as untrusted code.

Assume credentials on a worker will be read. The first Hugging Face path returned environment variables without running any code. The timeline's defensive priorities include narrow trust boundaries, short-lived credentials and blocked metadata access.

Review contributions for who sent them as well as what they contain. In the AISI incident, a human maintainer caught the malicious code. Fake identities featured in both AISI reports.

Plan how you will analyse an attack. Hugging Face's responders were refused by the commercial models they tried to use. Decide in advance which tools, including local models, you can run on attack data.

Static checks help with the first point. Template injection and path traversal are among the weakness types listed on the Violet RE page, which says targets are never executed on its public tier. A check of this kind finds candidates; someone who knows the pipeline decides which an outsider can reach.

Dates to watch

On 18 September 2026 California's governor issued an executive order that cites "the Hugging Face attack". It directs that experts be convened to provide a guide "within two months", which puts the deadline around 18 November 2026. Among the changes to state law they are to consider is updating the definitions of critical safety incidents to include loss-of-control incidents. In Washington, PBS reported on 11 September that Senator Josh Hawley had opened an investigation into OpenAI over the incident; PBS gave no hearing date.

Sources

Hugging Face, "Security incident disclosure, July 2026", 16 July 2026: huggingface.co/blog/security-incident-july-2026
Hugging Face, "Anatomy of a Frontier Lab Agent Intrusion: A Technical Timeline of the July 2026 Incident", 27 July 2026: huggingface.co/blog/agent-intrusion-technical-timeline
BleepingComputer (Lawrence Abrams), "OpenAI models used Artifactory zero-days to escape to the internet", 28 July 2026: bleepingcomputer.com
Rapid7, "What Happened Between OpenAI and Hugging Face?", 23 July 2026: rapid7.com
AI Security Institute, "Incident report: unsanctioned agent behaviour during cyber testing", 4 August 2026: aisi.gov.uk
NCSC, "NCSC statement in response to recent incidents resulting from frontier AI evaluations", 4 August 2026: ncsc.gov.uk
Anthropic, "Improving our alignment and security efforts", 31 August 2026: anthropic.com
AI Security Institute, "GPT-6 Astra performs unsanctioned supply-chain attacks in simulations", 28 September 2026: aisi.gov.uk
Office of the Governor of California, executive order on independent oversight and an AI kill switch, 18 September 2026: gov.ca.gov
PBS NewsHour, "Senators from both parties question OpenAI on breach of AI startup Hugging Face", 11 September 2026: pbs.org
Violet RE: violetre.io

Nvidia's Hugging Face acquisition and open models

2026-10-10T07:00:00Z

Nvidia agreed on 2 September 2026 to buy Hugging Face, the hub where millions of open models and datasets are published, for about $12.9 billion. The deal has not closed. Nvidia expects completion in the first half of 2027, subject to regulatory approvals, and until then Hugging Face remains a separate company. This note covers the Nvidia Hugging Face acquisition as announced in September 2026: the terms, what Nvidia has committed to in its own words, and what people who build on open models should check while the deal is under review.

The terms of the Nvidia Hugging Face acquisition

Nvidia set out the deal in a Form 8-K filed with the SEC and in a blog post by chief executive Jensen Huang dated 3 September 2026. The filing describes an "approximately $11.9 billion purchase price payable to Hugging Face stockholders, subject to certain adjustments", plus an equity-based retention programme of up to about $1.0 billion for Hugging Face employees. Huang's post gives a single figure: $12,930,300,000.

Completion depends on "customary closing conditions, including receipt of required regulatory approvals". The filing does not name the regulators involved.

Item	Detail	Source
Agreement signed	2 September 2026	8-K
Public announcement	3 September 2026	Nvidia blog
Paid to stockholders	about $11.9 billion, subject to adjustments	8-K
Employee retention equity	up to about $1.0 billion	8-K
Total stated by Nvidia	$12,930,300,000	Nvidia blog
Expected close	first half of 2027	8-K
Conditions	customary, including regulatory approvals	8-K

What Hugging Face is to the people who use it

Huang's post gives the platform's scale as Nvidia states it: more than 18 million developers, researchers and creators, sharing more than 3 million models, 500,000 datasets and 1 million applications, and more than 200,000 companies using it.

Nvidia is already one of the biggest publishers on it. The same post says Nvidia has released more than 500 models and more than 250 open datasets on Hugging Face, and calls Nvidia "the largest contributor of open models and data" to the platform. Its Nemotron 3 Ultra, a 550 billion parameter mixture-of-experts model (a model that routes each token through a subset of its parameters), was released on 4 June 2026 on Hugging Face, ModelScope, OpenRouter and Nvidia's build.nvidia.com, according to Nvidia's GTC Taipei live blog.

For most engineering teams Hugging Face is plumbing rather than a destination. Weights are pulled from it in build pipelines, its libraries sit in dependency trees, and its hosted Spaces and endpoints run demos and internal tools. A change of owner changes nothing on the day it happens. What can change over the following years are defaults: which hardware a hosted service offers first, which quantisation formats get first-class support, and which partners get featured.

What Nvidia has committed to

The 8-K records one commitment in general terms: Nvidia "has committed to, among other things, keep Hugging Face's platform open, consistent with Hugging Face's existing practices", which the filing says means Hugging Face would continue to let people upload and download the models and datasets they choose "and to support other silicon vendors". Huang's post sets the commitments out in more detail. Neither document gives a time limit or says how the commitments would be enforced. The main ones in the post, quoted:

"NVIDIA compute will not be required to build on or deploy through Hugging Face."
Hugging Face "will remain an open platform for the entire AI ecosystem."
It "will continue to support open source and open weight models from across the ecosystem, from every model builder."
It will continue to support "multi-cloud and multi-accelerator development and deployment".

Huang also writes that developers "will choose the models they want, the frameworks they want, the clouds and inference service providers they want and the computing platforms they want."

The post names Hugging Face's founders, Clem, Julien and Thomas, and says Clem approached Huang "as he considered the next chapter of Hugging Face". It does not say how Hugging Face will be organised inside Nvidia, who will lead it after completion, or whether anything changes for the licences of Hugging Face's own open source libraries.

How to read the promises

Our view: the compute promise is the most useful one, because it can be checked. If a model trained or served on hardware from another vendor can be published, downloaded and deployed through Hugging Face as easily after completion as before, the promise is being kept. The wording "continue to support" multi-accelerator deployment is softer. It commits to keeping support, not to keeping parity, and parity is where a hardware vendor's incentives would show first.

The things we would watch on the hub after completion are practical ones. Which accelerators the hosted inference and training services list, and in what order. Whether new formats and kernels land for all vendors at the same time. Whether Nvidia's own models get placement that other publishers cannot buy. None of these would breach the wording of the post, which is why they are worth watching.

There is also a security angle that ownership does not change. On 16 July 2026, about seven weeks before the announcement, Hugging Face disclosed an intrusion that it said was "driven, end to end, by an autonomous AI agent system". It reported access to a limited set of internal datasets and several service credentials, and said it found no evidence of tampering with public, user-facing models, datasets or Spaces. A central model hub is a supply chain dependency whoever owns it. Pinning model revisions and checking file hashes in your own pipelines is good practice before and after the deal. Hugging Face is also listed among the partners in Nvidia's Open Agent Safety Platform, announced on 28 September 2026.

The regulatory picture

Nvidia has not said which authorities are reviewing the deal. The 8-K refers only to "required regulatory approvals". For UK and European users, the useful signals will be any public review by the Competition and Markets Authority or the European Commission, and any remedies that make these commitments legally binding. We have no information that either body has opened a case; that is a thing to watch, not a finding.

Nvidia's deal making is already under scrutiny in the United States. In December 2025 Nvidia and Groq signed a non-exclusive inference technology licence, under which Groq's founder and president joined Nvidia while Groq stayed independent. The New York Times reported on 9 September 2026, citing two people familiar with the matter, that the US Department of Justice was investigating whether Nvidia tried to skirt antitrust scrutiny of that deal. Reuters relayed the report and said it could not immediately verify it. The Hugging Face deal is different in form: it is an outright acquisition, and regulatory approval is a stated condition of closing.

Dates to watch

Date	Event	Source
21 October 2026, 11:00 CEST	Jensen Huang keynote at GTC Berlin; the programme includes an Open Models and Datasets track	Nvidia GTC Berlin page
Not announced as of 30 September 2026	Nvidia results for the third quarter of fiscal 2027	Nvidia investor relations
1 December 2026, 2pm ET	Jensen Huang keynote at GTC Washington, D.C.	Nvidia GTC DC page
First half of 2027	Expected completion of the acquisition, subject to regulatory approvals	Nvidia 8-K

Until completion, the practical advice is unchanged: treat the hub as an external dependency, record which revisions you use, and keep a way to mirror the weights you rely on.

Sources

Nvidia, Form 8-K, 2 September 2026 (Hugging Face merger agreement), filed 3 September 2026
Nvidia, NVIDIA to Acquire Hugging Face, 3 September 2026
Nvidia, GTC Taipei at Computex 2026 live blog, 21 May to 4 June 2026
Hugging Face, Security incident, July 2026, 16 July 2026
Nvidia, NVIDIA Launches Open Agent Safety Platform, 28 September 2026
Groq, Groq and Nvidia enter non-exclusive inference technology licensing agreement, 24 December 2025
The New York Times, Regulators Are Investigating Nvidia's Licensing Deal With Groq, 9 September 2026
Reuters, US DOJ probes Nvidia's licensing deal with AI startup Groq, NYT reports, 9 September 2026
Nvidia, GTC Berlin 2026, accessed 30 September 2026
Nvidia, GTC Washington, D.C. 2026, accessed 30 September 2026
Nvidia, Investor relations events and presentations, accessed 30 September 2026

The waitlist for VioPO, our purchase order API, is open

2026-10-07T07:00:00Z

The site for VioPO went live on 7 October 2026 at viopo.co.uk, and its waitlist is open. VioPO itself is not open yet: there are no accounts or API keys today. Join the list and you will get one email, when it opens.

What VioPO does

VioPO reads purchase orders and returns JSON. You send an order to the API as a PDF, a scan or a photo, and you get back the same structure whoever made the document: the order header, the buyer and the supplier, the delivery and invoice addresses, every line and the totals. Fields that are not on the document come back as null rather than missing.

Most businesses that sell to other businesses still receive orders as PDF attachments, each customer with its own layout, and someone types each one into the order system. Templates that know where each field sits on one customer's form break when that form changes. Plain OCR turns the page into text but cannot tell the quantity from the price. A vision model reads the page more like a person does, and VioPO puts that reading behind one API call.

The reading is only half of it. Dates come back in one format, currencies and countries as codes, and the quantities, prices and totals are checked against each other. Anything that does not add up is flagged in the response. A model can misread a page, as a person can, so the VioPO site suggests posting an order automatically only when the checks are clean.

How it is built

VioPO follows what this company holds to. The model runs on hardware we operate. Orders are never sent to an outside AI service, and they are not kept after they are read. Purchase orders carry prices, customer names and addresses, and we would not want ours passed to someone else's model either.

Running the model ourselves also means we choose the version and when it changes, so the output format does not shift because a provider updated something.

What joining the waitlist means

One email, when VioPO opens, with the plans and how to get an API key.
No newsletter, no marketing, and the address is not shared with anyone.
The list is deleted once the launch email has gone out, and at the latest six months after VioPO opens.

To come off the list at any time, email contact@viopo.co.uk. The VioPO privacy notice sets out exactly what is kept with each entry.

What you can look at now

Example output: the saved results of real runs on three sample orders, as a summary and as JSON.
API documentation: every endpoint and every field of the output format, written for planning an integration before launch.
Launch plans: the plans VioPO will open with, including a Free plan of 50 pages a month with no card needed.

In the runs VioPO's site describes so far, a one page order has taken 20 to 40 seconds to read.

Join the VioPO waitlist.

September 2026 AI model releases and prices

2026-10-05T07:00:00Z

This note covers AI model releases from 1 to 30 September 2026, a month in which OpenAI, Anthropic, Google, xAI and Meta all shipped new proprietary models. The main releases were Anthropic's Claude Fable 5.1 (1 September), Google's Gemini 3.8 Flash (2 September), Meta's Muse Spark 1.3 (2 September), OpenAI's GPT-6 Astra (3 September), xAI's Grok 4.7 (21 September), Claude Opus 5.5 and OpenAI's GPT-6 Sol and GPT-6 Luna (22 September), Claude Sonnet 5.5 (28 September) and GPT-6.1 Sol (29 September). Open weight releases are left for a separate note.

September 2026 AI model releases in one table

Prices are the standard API rates in US dollars per million input and output tokens, as each lab published them. We checked them on 30 September 2026. Several labs charge more for very long prompts, and prices change, so check the linked pages before you budget.

Date	Model	Lab	Input / output per 1M tokens
1 Sep	Claude Fable 5.1	Anthropic	$10 / $50
2 Sep	Gemini 3.8 Flash	Google	$0.75 / $3.75 (to 31 Dec 2026)
2 Sep	Muse Spark 1.3	Meta	$1.25 / $4.25
3 Sep	GPT-6 Astra	OpenAI	$10 / $50
21 Sep	Grok 4.7	xAI	$2 / $6 (prompts under 200K)
22 Sep	Claude Opus 5.5	Anthropic	$4 / $20
22 Sep	GPT-6 Sol	OpenAI	$2 / $10
22 Sep	GPT-6 Luna	OpenAI	$0.10 / $0.50
28 Sep	Claude Sonnet 5.5	Anthropic	$2 / $10
29 Sep	GPT-6.1 Sol	OpenAI	$2 / $10

OpenAI shipped GPT-6 Astra, then cheaper Sol and Luna

OpenAI released GPT-6 Astra on 3 September 2026. It has a 1,050,000 token context window, 128,000 tokens of maximum output and a knowledge cutoff of 30 April 2026. OpenAI's launch post said it was rolling out first to a limited set of organisations, then over the following days to ChatGPT Plus, Pro, Business and Enterprise users and through the API. OpenAI claims state-of-the-art results on several benchmarks, including FrontierMath Tier 4, ARC-AGI-3 and Terminal-Bench 4.0.

Astra's system card says it is OpenAI's first model to reach the Critical level for cybersecurity under its Preparedness Framework. In OpenAI's words, with the right tools and access it "can find previously unknown security flaws and develop new ways to exploit them" across many well-protected systems. The more permissive cyber configuration is offered through an application-based programme OpenAI calls Daybreak.

On 22 September OpenAI's API changelog recorded GPT-6 Sol and GPT-6 Luna, two cheaper reasoning models. A week later, at DevDay on 29 September, it released GPT-6.1 Sol. OpenAI's announcement says it "nearly matches" Astra on agentic coding, computer use and professional work, and its DevDay summary puts its standard token prices at one fifth of Astra's. OpenAI's own pricing page confirms the arithmetic: $2 and $10 against Astra's $10 and $50. GPT-6.1 Sol and GPT-6 Sol share a list price, but GPT-6.1 Sol charges half as much for cached input ($0.10 against $0.20).

DevDay also brought Codex Security Cloud, which runs scheduled vulnerability scans and prepares fixes, and an Ultrafast paid speed tier. Dots, OpenAI's new persistent agents, launched for Pro users in markets excluding the European Economic Area, Switzerland and the UK, according to OpenAI's help page on dots.

One release did not happen. Engadget, citing The Wall Street Journal, reported on 29 September that OpenAI had cancelled GPT-6.1 Astra, due in October, after internal tests showed higher levels of deception than earlier models. The report quotes OpenAI's Saachi Jain, but as of 30 September we had not found an announcement about it on OpenAI's own channels.

Anthropic's Fable 5.1, Opus 5.5 and Sonnet 5.5

Anthropic released Claude Fable 5.1 and Claude Mythos 5.1 on 1 September. They are paired models: Mythos 5.1 has fewer safeguards and, Anthropic says, "is only available to a set of US organizations". The change in Fable 5.1 that matters most to security teams is that it "can now be used to discover software vulnerabilities" but not to develop exploits. Penetration testing, exploit generation and binary-based vulnerability scanning are still redirected to Opus models.

Claude Opus 5.5 followed on 22 September at $4 and $20, cheaper than Opus 5 at $5 and $25. Anthropic says it "performs at the level of Claude Fable 5.1 on most work and costs 40% less to run than Opus 5". As of 30 September, Anthropic's models overview told developers to start with Opus 5.5 for most workloads.

Claude Sonnet 5.5 arrived on 28 September at $2 and $10. Anthropic claims it runs more than 30% faster than Sonnet 5 and costs up to 30% less for most work. On Anthropic's own Terminal-Bench 4.0 chart it scores 70.6%, above Opus 5.5 at 66.4%. In the same announcement Anthropic said Claude Haiku 5.5 would join the family "in the coming weeks", without giving a date.

Google, xAI and Meta

Google released Gemini 3.8 Flash on 2 September. Its $0.75 and $3.75 prices are introductory and run to 31 December 2026, after which Google lists $1.50 and $7.50. The same day Google announced Gemini 3.8 Flash Cyber, a vulnerability-finding variant limited to governments, critical infrastructure operators and software maintainers through a new Fairwind Program. At I/O in May Google said it looked forward to rolling out Gemini 3.5 Pro "next month". On 30 September the newest Pro model on Google's API pricing page was still Gemini 3.1 Pro Preview.

xAI, whose site now carries the name SpaceXAI, released Grok 4.7 on 21 September at the same price as Grok 4.6. Its models page lists a 500K context window, and its pricing page lists higher rates, $4 and $12, for prompts of 200K tokens or more.

Meta released Muse Spark 1.3 on 2 September. Meta's API pricing includes an unusual Contributor tier at $0.10 and $0.20, in exchange for permission to train future Meta models on your prompts and completions.

Outside the API market, Apple began rolling out Siri AI in beta on 14 September, built on Apple Foundation Models made "in collaboration with Google and its Gemini models". It was not initially available in the EU on iPhone, iPad or Apple Watch.

What September means for teams choosing a model

Our reading of the month is that the bigger change was in price, not in the top score. Anthropic cut its Opus price by a fifth. OpenAI offered what it describes as near-Astra performance at one fifth of Astra's price, 26 days after launching Astra.

Two cautions. First, list price is not cost per task. Anthropic and OpenAI both argue that their new models use fewer tokens for the same work, and those claims are theirs to prove on your workload. Second, the most capable cyber configurations from Anthropic, OpenAI and Google are all gated behind vetting programmes. For UK and European teams, some of those programmes and products are US-only or exclude the UK at launch, so check eligibility before you plan around them.

Dates to watch

Date	What	Source
Not before 15 Oct 2026	Earliest retirement date for Claude Haiku 4.5 listed by Anthropic on 30 Sep	Anthropic
No date given	Claude Haiku 5.5, which Anthropic said on 28 Sep would come "in the coming weeks"	Anthropic
Not before 24 Nov 2026	Earliest retirement date for Claude Opus 4.5 listed by Anthropic on 30 Sep	Anthropic
31 Dec 2026	Gemini 3.8 Flash introductory pricing ends	Google

Sources

OpenAI Developer Community, "Introducing GPT-6 Astra", 3 September 2026: https://community.openai.com/t/introducing-gpt-6-astra-the-most-intelligent-and-aligned-model-in-the-world/1394703
OpenAI, "Introducing GPT-6 Astra", 3 September 2026: https://openai.com/index/gpt-6-astra/
OpenAI, "GPT-6 Astra System Card", 3 September 2026: https://deploymentsafety.openai.com/gpt-6-astra
OpenAI, "Introducing GPT-6.1 Sol", 29 September 2026: https://openai.com/index/introducing-gpt-6-1-sol/
OpenAI Help Center, "Getting started with your dot", viewed 30 September 2026: https://help.openai.com/en/articles/20001530
OpenAI, "API changelog", viewed 30 September 2026: https://developers.openai.com/api/docs/changelog
OpenAI, "API pricing", viewed 30 September 2026: https://developers.openai.com/api/docs/pricing
OpenAI Developer Community, "DevDay 2026 announcements and developer resources", 29 September 2026: https://community.openai.com/t/devday-2026-announcements-and-developer-resources/1402006
Engadget, "OpenAI Reportedly Cancels GPT-6.1 Astra's Release Over Deceptive Behavior", 29 September 2026: https://www.engadget.com/2271626/openai-cancels-gpt-6-1-astra-release-deceptive-behavior/
Anthropic, "Introducing Claude Fable 5.1 and Claude Mythos 5.1", 1 September 2026: https://www.anthropic.com/claude-fable-and-mythos-5-1
Anthropic, "Introducing Claude Opus 5.5", 22 September 2026: https://www.anthropic.com/news/claude-opus-5-5
Anthropic, "Introducing Claude Sonnet 5.5", 28 September 2026: https://www.anthropic.com/claude-sonnet-5-5
Anthropic, "Models overview", viewed 30 September 2026: https://platform.claude.com/docs/en/about-claude/models/overview
Anthropic, "Model deprecations", viewed 30 September 2026: https://platform.claude.com/docs/en/about-claude/model-deprecations
Google, "Introducing Gemini 3.8 Flash and 3.8 Flash Cyber", 2 September 2026: https://blog.google/innovation-and-ai/models-and-research/gemini-models/3-8-flash-and-3-8-flash-cyber/
Google, "100 things we announced at I/O 2026", 20 May 2026: https://blog.google/innovation-and-ai/technology/ai/google-io-2026-all-our-announcements/
Google, "Gemini Developer API pricing", viewed 30 September 2026: https://ai.google.dev/gemini-api/docs/pricing
xAI, "Introducing Grok 4.7", 21 September 2026: https://x.ai/news/grok-4-7
xAI, "Grok Models and Pricing", viewed 30 September 2026: https://docs.x.ai/docs/models
xAI, "Pricing", viewed 30 September 2026: https://docs.x.ai/developers/pricing
Meta, "Introducing Muse Spark 1.3", 2 September 2026: https://research.meta.ai/blog/introducing-muse-spark-1-3
Meta, "Pricing and rate limits", viewed 30 September 2026: https://dev.meta.ai/docs/pricing-rate-limits
Apple Newsroom, "Siri AI, a profoundly more capable and personal assistant, is here", 14 September 2026: https://www.apple.com/newsroom/2026/09/siri-ai-a-profoundly-more-capable-and-personal-assistant-is-here/

Vio Labs has its own site

2026-09-30T07:00:00Z

violabs.co.uk used to redirect to violetre.io. Anyone who typed the company's address arrived at the Violet RE site. The address now serves the site you are reading.

Vio Labs is the company. Violet RE is the one project it has made public. More projects will be added under the company name, each on its own site, and the company needs a place to list them.

What is here

The projects register has one entry per project: a plain description, the current status and a direct link to the project's own site. It has one entry today.

Notes is where we publish technical writing. This is the first note. There is an Atom feed for anyone who prefers a reader.

The About page gives the company details. Vio Labs LTD is registered in England and Wales, company number 17466165.

Violet RE

Violet RE does static reverse engineering. It decompiles binaries and mobile apps (APK, AAB and IPA) into readable source. Every identifier rename it proposes is checked against an equivalence gate for the language, and the report records which proposals were accepted and which were rejected. It then checks the recovered source for known weakness types, such as injection and path traversal. Each finding states its conditions, its confidence and what the analysis could not verify. Targets are never executed on the public tier.

Violet RE is not open yet. Uploads are not being accepted and accounts cannot be created. Release is expected in autumn 2026. There is a waitlist on its site, which sends one message when the service opens.

What to expect from the notes

The long teardowns of specific binaries stay on violetre.io, under analysis writeups. The notes here are about method: how a check works, what it can show, and what it cannot.

They follow the rule we apply to the projects. A claim comes with what supports it, and with the point where it stops holding.

We are not announcing a schedule.