Flint lands on the Mac first.
Recursive’s Flint, an open 40B coding model with 2.5B active, is out, and it runs on your Mac today through Ollama, llama.cpp, and MLX
Flint is a mixture-of-experts model built for coding agents: reading unfamiliar code, tracing bugs, implementing features, and writing tests, with reasoning and multi-turn tool calls. It has 39.8B parameters in total but activates only about 2.5B per token, which is why it is fast on laptop-class hardware. Recursive says a small team built it from scratch in under four months with help from its automated research system. On its own runs, Recursive reports 74.2% on SWE-bench Verified and 54.9% on Terminal-Bench 2.1 (vendor-reported).
Getting it on a Mac: Ollama 0.40.8 runs it with ollama run flint, a 23 GB download with a 256K context window. Ollama’s notes say Flint works on macOS only for now, through its MLX engine; other GPUs come later. llama.cpp builds from Wednesday evening load it too, and the llama.cpp team’s 4-bit GGUF is also about 23 GB. On the MLX side, mlx-vlm 0.7.10 adds native support and the MLX community posted a mixed 3- and 4-bit build; mlx-lm support is still an open pull request. Recursive also released rec, its own open-source Mac engine, but its README only lists M4 Pro, M5 Pro, and M5 Max machines with 48 GB or more.
Why it matters: this is the first strong open coding model whose launch day treated the Mac as a primary target rather than an afterthought. At 23 GB it fits a 32 GB machine with room for context, and on a 256 GB Studio it can run next to a much bigger planner model.
Cautions. The speed claims don’t agree: NVIDIA said Tuesday that Flint does over 220 tokens per second on a 64 GB RTX Spark, while Recursive’s own post says over 150 on that machine and over 125 on an M4 Pro MacBook Pro. The model card documents a 262,144-token context; the blog says up to 512K but recommends staying within 256K. The llama.cpp pull request says its current approach costs 10–30% speed, to be fixed in follow-ups. Recursive tuned and evaluated Flint at temperature 1.0, top-p 0.95, top-k 20, so start there.
Sources: Recursive · Model card · Ollama v0.40.8 · llama.cpp #30928 · mlx-vlm v0.7.10 · rec
Anthropic opened a waitlist research preview of Claude Duet, a proactive assistant app for iOS, Android, and claude.ai that sends a morning brief and works on tasks in the background, starting with US Pro and Max subscribers. Claude
OpenAI expanded ChatGPT ads to 26 more countries and says over 100,000 advertisers have used the platform. OpenAI
Model & runtime releases
| Item | Date | Badge |
|---|---|---|
| Recursive Flint 40B-A2.5B weights (Apache 2.0) + INT4 / NVFP4 GGUF | Oct 21 | Open |
| Ollama v0.40.8: Flint (macOS via MLX) · v0.40.9 llama.cpp update | Oct 21 | Open |
llama.cpp: Flint (b11803) · SenseNova U1 (b11801) · sampling params on /v1/messages | Oct 21 | Open |
| mlx-vlm v0.7.10: native Flint, Muse Spark Open audio/video/images | Oct 21 | Open |
| rec v0.1.0, Recursive’s Mac engine (M4 Pro / M5 Pro / M5 Max, 48 GB+) | Oct 21 | Open |
| Granite Speech 5.0 2B + Turbo CTC multilingual + 4.1 2B Plus revision | Oct 21 | Voice |
| mlx-community MLX builds: Flint mixed 3/4-bit, DeepSeek V4.1 Flash 1017 | Oct 22 | Open |
| Claude API 2026-10-21 + SDK majors (Apache 2.0) | Oct 21 | Cloud |
| OpenAI: restrict which service tiers each project can use | Oct 21 | Cloud |
| Reflection Beam on SageMaker JumpStart and Trainium | Oct 21 | Cloud |
| AWS Neuron 2.33 (native PyTorch, Neuron Observer) | Oct 21 | Cloud |
| TorchTitan update + TitanRL | Oct 21 | Open |
Security / policy / access
| Item | Date | Badge |
|---|---|---|
| php2shell (CVE-2026-109618 / 109619): PHP 5.4–8.5.11; fixed 8.5.12 / 8.4.27 / 8.3.36 / 8.2.35 | Oct 21 | Active |
| Cloudflare WAF php2shell rules on all plans, plus new full-transaction detection | Oct 21 | Active |
| EU joint statement on PHP (DG CNECT, ENISA, CERT-EU, Europol EC3, CSIRTs) | Oct 21 | Active |
| OpenAI Usage Policies: intermediary approval, wider training ban (effective Nov 20) | Oct 21 | Watch |
| Claude Security continuous scanning, API + MCP (Enterprise beta) | Oct 21 | Active |
Claude user profiles: enforcement_status and filter | Oct 21 | Active |
| OpenAI Daybreak for Frontline Defenders ($1B subsidized access, per OpenAI) | Oct 21 | Watch |
| No new vLLM advisories since the Oct 20 batch; none for llama.cpp / Ollama / MLX / SGLang | Oct 21–22 | Quiet |
Critical
Upgrade PHP everywhere it runs, including side projects, WordPress boxes, and container base images, then restart every worker. Distro packages may backport the fix without changing the version number, so check the changelog for the CVE IDs. Before you move to Anthropic’s new SDKs, check your code for sampling parameters and your proxies for the x-api-key header.
Watch
Flint support in mlx-lm (open pull request), the llama.cpp speed fix, and whether rec adds M1–M3 and Ultra chips. How OpenAI’s gateway approvals work before Nov 20. MiniMax M3.1 Flash still has no weights; Ollama’s free cloud tag ends tonight at 7:59 PM ET. Still pending: PyTorch 2.15 final, Dory runtime support, Nemotron 3.5 Bolt E4B (NVIDIA said Oct 23).
Opportunity
Nobody has published Flint numbers on an M3 Ultra or M4 Max. A side-by-side of Ollama’s MLX path, llama.cpp’s GGUF, and mlx-vlm on one Studio, run on a real repository task, would be the first.
Run Flint on your Mac
Easiest: update Ollama to 0.40.8 or newer and run ollama run flint (23 GB). With llama.cpp on build b11803 or newer: llama-server -hf ggml-org/Flint-GGUF:Q4_K_M --jinja --temp 1.0 --top-p 0.95 --top-k 20, then point your coding agent at http://127.0.0.1:9931/v1. Give hard tasks a big output budget; Recursive suggests 32K tokens or more, reasoning included.
Audit before you upgrade the Anthropic SDK
In your repo, run rg -n "temperature|top_p|top_k|x-api-key|MessageParam\(" .. Every hit is a place the new version or SDK will reject or change. Check any gateway or logging proxy that reads x-api-key, since the new SDKs send Authorization: Bearer. Pin anthropic<2 (Python) until it’s clean.
Check every PHP you run for php2shell
Run php -v on each host and image, and compare against 8.5.12 / 8.4.27 / 8.3.36 / 8.2.35. For distro packages, search the changelog: apt changelog <your php package> | grep -E "CVE-2026-10961[89]", or rpm -q --changelog on RPM systems. Restart FPM, Apache, and any long-running workers afterward.
Wednesday morning through Thursday morning (Oct 21–22 ET). ASTGL / Fraser takes, sourced.
A coding model that shipped Mac-first, with an M3 asterisk
Yesterday we said wait for Flint’s weights. They showed up a couple of hours after we published, and by dinner you could run them in Ollama, llama.cpp, and MLX. That kind of launch-day runtime support is what makes a local model usable, and the Mac got it first. My take: pull it today and point it at a repo you know well, because the published speed numbers disagree with each other and the benchmarks are all Recursive’s. One asterisk for Studio owners: Recursive’s own fast engine,
rec, only lists M4 Pro and M5-class chips, so on an M3 Ultra your path is Ollama or llama.cpp until that changes. Use Recursive’s sampling settings, not your usual low temperature.Sources: Recursive · rec README · Ollama v0.40.8 · NVIDIA (Oct 21)
Everyone’s AI found the PHP bug
Two critical flaws in the PHP runtime itself, nicknamed php2shell, went public Wednesday. They can let a crafted HTTP request crash a server, leak memory, or run code, on every PHP version from 5.4 on. OpenAI says Calif found one using GPT-5.6 Sol; Google says Gemini 4 Argon made “an invaluable contribution” through Wiz, which found both. OpenAI says frontier AI found the bugs before attackers did. Cloudflare says the bugs leaked before the official release and it saw attack traffic. My take: skip the credit fight and patch. Fixed versions are 8.5.12, 8.4.27, 8.3.36, and 8.2.35. There is no upstream fix for 8.1 or older. Restart every PHP worker, because old processes keep running the vulnerable code. The bigger lesson is that when models find bugs this fast, the quiet period before disclosure gets short and leaky. Plan for patch-same-day, not patch-next-sprint.
Sources: OpenAI (Oct 21) · Google Cloud (Oct 21) · Cloudflare (Oct 21)
Anthropic cut a new API version, and the temperature knob is gone
Anthropic released API version 2026-10-21, the first change from 2023-06-01, and new major versions of every official SDK that send it by default. Under the new version, sending
temperature,top_p, ortop_kreturns an error, even at the default value. Claude 4.7 and later models already accepted only the defaults, but if you lower temperature on Sonnet 4.6 for steadier output, that effect is gone with no replacement. The new SDKs also send your key as a bearer token instead of thex-api-keyheader. My take: the sampling change is the headline, but the header change is what will break things quietly. Any gateway, proxy, or logging layer that reads or stripsx-api-keyneeds checking before you upgrade. Pin your SDK major version until you have audited both. The SDKs also move from the MIT license to Apache 2.0, so update your license inventory.Sources: Claude release notes (Oct 21) · Migration guide
OpenAI wants to approve your gateway
OpenAI’s updated Usage Policies take effect November 20. Any platform that lets third parties access OpenAI models directly, such as a model router or AI gateway, will need OpenAI’s review and approval first. Apps that just use OpenAI models to power their own features are explicitly exempt. The training clause also gets broader: you can’t use OpenAI models or outputs to create training data, rubrics, RL environments, labels, scores, or rankings for models meant to replace OpenAI’s. OpenAI is also bringing in SafetyIDs to tell end users apart in misuse investigations, a cousin of the user profiles Anthropic shipped Tuesday. My take: if you resell access to OpenAI models, start that approval conversation this week, not on November 19. If you use GPT as a grader or labeler for an open model you fine-tune, read the training section with whoever handles your contracts. “Intended as alternatives” could cover a lot. This is not legal advice.
Sources: Usage Policies (changelog Oct 21) · OpenAI (Oct 21)
Vulnerability scanning is turning into a subscription
On the same day as php2shell, Anthropic made Claude Security a continuous scanner. It watches your repositories as code changes, marks findings fixed when the fix ships, and reports through an API, webhooks, and an MCP connector. Separately, OpenAI says it has committed $1 billion in subsidized access to its Daybreak security program for under-resourced defenders. My take: the labs are now selling defenders the same capability that is finding these bugs, which is good, but it also makes patch speed the real bottleneck. If you’re on Claude Enterprise, Anthropic is offering $25,000 a month in credits for two months, which makes for a cheap trial. Tell it your threat model, or it will flag risks your environment already handles.
Sources: Claude (Oct 21) · OpenAI (Oct 21)