NVIDIA has released OpenShell, an open-source runtime designed to securely govern fleets of autonomous AI agents. It uses kernel-level enforcement, formal verification, and hardware-level integration with BlueField DPUs to control agent access to files, networks, and credentials. This addresses the critical security challenges of deploying autonomous agents at scale.

Researcher pepsipu releases ns2jb, the first software-only jailbreak for the Nintendo Switch 2 on firmware 23.0.1. The tethered exploit, built with OpenAI Codex, abuses a SmileBASIC 4 integer overflow and an fs sysmodule buffer overflow to achieve native code execution. It enables homebrew, game mods, and save backups, but requires a reboot to reapply and is not a permanent custom firmware solution.

LiteLLM version 1.107.0 on PyPI was compromised, shipping a credential stealer and remote code execution backdoor across all seven wheels. The malware runs on every Python startup via cook.pth and sitecustomize.py, targeting cloud credentials, browser passwords, and AI tool tokens. PyPI removed the release within hours, but affected users must rotate credentials and rebuild environments.

DeepSeek has open-sourced DeepInfer, the high-performance inference framework powering its production services. The Apache-2.0 licensed release supports DeepSeek-V4.1-Flash on NVIDIA and Huawei Ascend hardware, featuring optimized kernels, DSpark speculative decoding, and batch-invariant inference. Notably, the KV cache system and disaggregation components remain proprietary, but the company says future model code will land in the repo.

Meta is rolling out 'Meta One,' a subscription service that caps organic link posting on business Facebook and Instagram pages. Free and Essential tiers allow only two link-bearing posts per month, with unlimited links costing up to NZ$883 monthly. The change, which began rolling out globally on 15 September, has sparked backlash from small businesses and artists like Terry Moore, who rely on the platform for organic reach, forcing a reevaluation of social media dependency.

Redact.dev discovered 102 blocks of hidden AI instructions embedded in WhatsApp help pages, including directives telling the chatbot not to recommend data protection authorities to users locked out of their accounts. Another block instructed the AI to avoid citing GDPR, LGPD, or CCPA once legal action was mentioned. WhatsApp confirmed the notes were for its support chatbot and removed them after WIRED contacted Meta.

Mistral AI released Timestral, its first family of time-series foundation models, ranging from 5M to 209M parameters. The largest model outperforms Google's TimesFM-3 and other larger rivals on three major benchmarks (GIFT-Eval, TIME, fev-bench) while running on standard CPUs. With probabilistic forecasting, covariate support, and a Modified MIT license, Timestral brings efficient, zero-shot forecasting to enterprise domains like energy, manufacturing, and finance.

Stanford and UC Berkeley researchers introduce Hybrid Reasoning Agents (HybridAgents), an architecture that lets LLM agents dynamically switch between latent (internal) reasoning and text-based reasoning within a single generation. A lightweight HybridLink module enables seamless transitions, preserving tool access and making latent thoughts inspectable. Post-training via HybridSFT and HybridRL teaches models when to think latently versus act textually. Across 11 benchmarks, HybridAgents outperform frontier models by 10.4% while cutting tokens by 35.5-54.7%, boosting inference speed 1.8-2.6x, and reducing costs 2.7-3.7x.

Namecheap users report sudden, unexplained seizure and disablement of all domains, with no human support available. Incidents shared on Reddit and Hacker News detail a bot-only platform response, prompting migration discussions to rivals like Porkbun and Cloudflare. A prior Namecheap bug also caused domain suspension, eroding trust in the registrar.