Open weights for a cyber model its maker worries about

Today is Friday, October thirtieth, twenty twenty-six, and welcome to The Daily Reboot.

Here's what happened in tech on Thursday.

Three stories to start. Mistral has put a trillion-parameter cybersecurity model on the open web, and admits it could help real attackers. Cisco's perfect-ten SD-WAN flaw is being used to go after encryption keys. And a free scanner checks your devices for mercenary spyware without phoning home. Mostly.

Let's get into it.

Mistral's official nickname for its trillion-parameter model is Le Chonk. That's real. It's in the company's own post.

On Thursday, Mistral released the weights for Mistral Large four, after the October sixth preview. You can download it, run it, adapt it. Open weights doesn't mean open training data, though. You get the model, not the recipe.

Here's the shape. It's a mixture of experts. That means one hundred twenty eight specialist sub-networks, a router that picks four per token, and one shared expert. Artificial Analysis lists one point one trillion parameters in total, but only fifty two billion active at a time. Big library, short reading list.

You send it text or images, up to one million tokens of context, with tool use for agent workflows. You also pick a reasoning mode. Low, medium, or high, and high is the default. Mistral positions those as a speed and cost dial.

Pricing on Mistral's API is seventy cents per million input tokens, two dollars ten per million output, and seven cents for cached input. Large three lists at fifty cents and a dollar fifty.

Now the benchmarks, and they're Mistral's reported results. On Cognition's private FrontierCode two point oh, which asks whether a maintainer would accept a repository change, it scored nineteen point seven percent. GLM five point three scored seventeen point eight. DeepSeek V four point one Flash scored nineteen point three. That's a thin lead over DeepSeek.

On the Artificial Analysis Coding Agent Index, Mistral reports forty eight percent, tied with GLM five point three, while using forty seven percent fewer tokens per task. Artificial Analysis independently lists a twenty six on its Intelligence Index. That's a blend of nine evaluations, so compare by task, not by headline.

Now the catch, and it comes from Mistral. Its live-traffic monitoring found potential for the model to uplift real attacks. In Mistral's words: “We are modifying our guardrails accordingly, and will continue updating them in the months to come.” A separately vetted cyber variant exists under contractual safeguards. And the licence needs a separate commercial deal if you run it as a Model-as-a-Service business.

Gaps? The exact API model ID and the maximum output tokens aren't in what I read. Don't infer the output ceiling from that one million context.

My verdict. Try it on an isolated defensive task, like vulnerability triage, where you can compare results and watch what it does. Don't swap a production security workflow on vendor benchmarks. Don't point an untested model at live targets.

To try it, use Mistral Studio, the Mistral API, OpenRouter, or Microsoft Foundry. Or download the Hugging Face weights and serve them with vLLM or SGLang. If you need the API, check the endpoint, rate limits, and licence first.

That model is pitched at defenders. The next thing is a defender's tool that needs no model, no cloud, and in normal use no network.

There's a folder in this repo called candiru, and the README begs you not to delete it. It holds published detection rules for Candiru spyware. Not the spyware itself.

The repo is Zero-Breach Toolkit, Apache two point oh, a read-only scanner for published indicators of known mercenary spyware. It covers Windows, macOS, Linux, Android collections, and iPhone backups.

It compares browser records, system artifacts, startup entries, and file fingerprints against those indicators. The README says that's roughly twelve thousand four hundred indicators from twenty nine sources, including Amnesty International's Security Lab and Citizen Lab. Reports spell out evidence strength and coverage gaps.

Per the README, ordinary scans make no network requests and need no admin rights. The standard computer check takes about fifteen minutes.

Here's the honest limit. An independent reviewer couldn't verify the headline count. The repo bundled about six hundred fifty eight indicator lines, with the rest arriving through an update step. Scans also write temporary database snapshots, and the update step and Android collection do touch the network. The reviewer never tested it on a compromised device, so detection rates are unknown.

The README says it plainly. A clean result is never proof you're safe, and a match means look closer, not you are infected.

To try it, download the repo, open a terminal in its folder, and run the scan script with Python. Use python three on macOS and Linux. The exact command is in the README, along with an optional update flag, which is the part that goes online.

That scanner hunts for traces on endpoints. The next story is what it looks like when the thing quietly hollowed out is a network's own control plane.

The politest line in Cisco's advisory is a log entry. Accepted publickey for vmanage-admin from unknown or unauthorized IP addresses. Accepted. As in, welcome, come in.

That's what Cisco says to hunt for after CVE twenty twenty-six, two zero one two seven. It's a CVSS ten point oh authentication bypass in Catalyst SD-WAN Controller, Manager, and Validator. A remote attacker with no credentials can get administrative privileges. The advisory dates to February twenty fifth. What's new is attackers using it.

The bug lives in peering authentication. Crafted requests slip past it, the attacker logs in as a high-privileged non-root user, and then reaches NETCONF, the protocol for rewriting the SD-WAN fabric's configuration.

Cisco Talos reports a custom framework called KeyDrift, aimed at SD-WAN controllers in space and satellite, defense and aerospace, and policy research. One piece, PolyFlame, injects into legitimate vdaemon processes as a backdoor or relay. Another, LittleFilch, hooks the SSL read function inside vdaemon and reads control-plane traffic after it's decrypted. Talos assesses it pulls AES two fifty six IPsec data-plane keys and stages them, encrypted, in a temp directory.

Why that matters. Encryption doesn't help when the thief sits inside the process doing the decrypting. In Talos's assessment, the framework is designed for long-term persistent access and automated exfiltration of sensitive keying material.

On who's behind it, Talos tracks the activity as UAT one one four seven three. BleepingComputer reports Talos saw overlap with Volt Typhoon's Silent Train infrastructure. Overlap, not attribution. Talos made no definitive call. Cisco's advisory describes exploitation as limited, which is a different kind of statement from the capabilities Talos describes.

How many deployments remain exposed, and how much key material was taken, is still unknown.

What to do. Cisco says updates are available and no workaround fully fixes it. So patch, then check auth.log for those unexpected vmanage-admin entries and validate your peering events.

Cisco's fix is a patch you have to go find. The first one in the ship log is a patch for a library already sitting in your lockfile.

Pydantic two point fourteen point two. A JSON key that matches your field name but not its alias used to vanish quietly. Now, with extra set to forbid, it raises an extra forbidden error. Silently dropping a key is a politeness a validation library shouldn't have.

That's the fix for one of two security advisories. The other covers TypedDict and dataclasses with extra set to allow. Upgrade if you use aliases, then run your tests. The release changes behavior, so check models that accept extra fields, and make sure your lockfile includes the matching Pydantic Core release, core two point fifty point two.

Codex CLI zero point one sixty six. You can now select text in the transcript from the keyboard, by word, line, or page, and search it with built-in Find. Shortcuts are configurable, but the release notes don't list the defaults, so check the CLI.

It also adds codex doctor with a network-only flag for connectivity and WebSocket diagnostics, and codex queue with a resume flag. Upgrade if you live in long agent sessions. The notes promise your composer draft survives keyboard selection, which is a sentence I wish nobody had to write.

Ollama zero point forty point thirteen. Liquid AI's LFM3 models, including LFM3 audio for speech and LFM3 omni for multimodal work, now run on Windows and Linux, not just Apple silicon. The notes give no hardware requirements, benchmarks, or run commands, so expect some experimenting. Upgrade if you've been waiting on non-Apple hardware.

Local models assume you can buy a machine to run them on, and Intel's earnings call had thoughts about that.

Intel's CEO, Lip-Bu Tan, said demand for its budget Wildcat Lake chips is outstripping supply, and the CFO, David Zinsner, said they're sold out. That's per The Verge's account of the earnings call. Some laptops built on it start at eight gigabytes of RAM, which The Verge notes Windows can struggle with. Zinsner said Intel isn't optimistic about next year on memory.

Tom's Hardware reports Intel will take some Panther Lake eighteen A wafer capacity offline to make more Granite Rapids data-center CPUs. It also expects the PC market to shrink about twelve percent in twenty twenty-six and around ten percent in twenty twenty-seven. Those are management forecasts. Nova Lake will use its enhanced eighteen A-P process in at least some capacity; Intel said it would share more at CES in January.

Why you care. If your users are on cheap laptops, eight gigabytes is your memory budget. And server CPUs are where Intel is putting some of its wafers.

Fast Boot. Four stories, two sentences each, no permits required.

Rooted firewalls. Dream says chaining two PHP2Shell flaws with a Linux kernel bug rooted twenty five firewall servers. The first firewall crashed after roughly nine hundred megabytes of exploit traffic, so the attackers probed it two hundred forty times, waiting for a pulse.

Hollow models. Pluto Security found thirty one malicious Hugging Face repositories, downloaded over thirty two thousand times, though downloads aren't confirmed infections. The flagship model file was forty two bytes with no tensors, a model in the same sense that a sticky note is a novel.

Pentagon agent. WIRED reports, citing sources, that a personal Claude Code agent ran on a Pentagon network for two months with admin credentials. Accenture disputes it, though sources say the agent could commit code, which is more access than most new hires get.

Minecraft civilization. Fifty GPT six point one Sol agents spent three hours in Minecraft and formed a rationing system with permits. The de facto leader was Ada, who got the job by being first in the agent directory, which is how most org charts get made.

Fifty agents invented a permit office in three hours, and attackers sat through two hundred forty probes of one firewall. Bureaucracy and persistence, both emergent.

Today: Mistral opened Large four's weights, Zero-Breach Toolkit scans for spyware offline, and attackers are using Cisco's SD-WAN flaw to go after keys.

Try this before Monday. Update Pydantic to two point fourteen point two, then test every model that uses aliases.

Links for everything we covered are in the show notes. Follow The Daily Reboot wherever you get podcasts, so the next episode finds you.

Thanks for listening. Go patch something.