AI news, 29 October 2026: four of five stories are about where the model runs.

Cloudflare published the kind of incident report most vendors never write: for nearly two weeks, one model on its Workers AI platform handed some customers fragments of other customers' prompts. Apple put an assistant inside Pages, Keynote and Numbers, and did something more consequential in the same release by letting outside AI agents edit those documents. Opera started shipping language models inside the browser itself. Liquid AI released six small models built to run on the device in front of you, under a licence that stops being free at ten million dollars of revenue. And a study of a UK government consultation found that three-quarters of the responses were written by bots. Taken together, the week's news is not about capability. It is about location: where your prompts go, who else is on the same machine, and what is allowed to touch your files.

Every date and figure below was read at the source linked in its own section during this run. Where a claim could not be opened at a primary source, it was cut rather than softened, and the cuts are listed near the end. AcquihireTech writes this roundup for Indian service businesses doing ₹10L+ a month, so each story is put through the same filter: what does this change about how you run the business on Monday?

1. Cloudflare's shared inference returned other customers' prompts for nearly two weeks

On 26 October 2026, Cloudflare published a post-incident report titled Cross-request KV cache exposure in the GLM-5.3 Workers AI model. The short version: between the model's launch on 27 August 2026 and 9 September 2026, 155 responses from the @cf/zai-org/glm-5.3 model contained data from other customers' requests made shortly beforehand. Cloudflare says the exposed material included other users' prompts and partial generations. The company set the model to private at 14:00 UTC on 9 September and restored it at 19:40 UTC the same day. It found no evidence that anyone discovered the behaviour and exploited it deliberately. The report credits Gadi Evron of Knostic, who reported the issue through HackerOne on 8 September.

The cause is worth understanding, because it is not exotic. Cloudflare deployed GLM-5.3 advertising a 1,048,576-token context window. The KV cache pool on its prefill GPUs had room for 681,280 tokens. Those two numbers disagreed, and every one of the 155 affected responses came from a prompt longer than 681,280 tokens, which is to say from a prompt that fell into the gap. A bug in SGLang, the open-source inference engine underneath, turned that mismatch into a leak: an over-length request was marked as rejected and swapped for a one-token placeholder, but it was never actually aborted. Prefill went ahead and transferred the placeholder's cache. Decode then read across stale cache pages that still held the previous request's data. The customer got that data back with an HTTP 200.

Why it matters. A 200 means the server finished the request. It does not mean the server was right. Here was a failure path that produced a confident, well-formed, successful-looking response built partly out of somebody else's input, and no error was raised at any layer. Cloudflare has since resized the prefill pool to roughly 2.04 million tokens, about twice the context length, patched the engine so a rejected request is retired before any cache transfer happens, pushed the fix upstream as SGLang PR 38704, and told other operators to upgrade to SGLang v0.5.22 or later and check their own pool size against their configured context length. That last sentence is the one to notice. Cloudflare is not the only company running SGLang.

What it means for a service business. You are almost certainly not sending 681,000-token prompts, so you were not in the 155. Do not take the reassurance and stop there, because the useful part of this story is not the bug. It is that Cloudflare wrote it up at all: named the model, published the dates, gave the count, explained the mechanism, credited the researcher, and shipped the fix upstream where competitors benefit. That is the behaviour to shop for. The next time you sign with an AI vendor, or renew with the one running your WhatsApp responder, ask three questions and write down the answers. Is my inference running on shared or dedicated capacity? Who operates the machine the model actually runs on, which is frequently not the company whose logo is on your invoice? And where is your incident history published? A vendor that cannot answer the third question has either had no incidents or disclosed none, and you cannot tell which from outside.

2. Apple put an assistant in Pages, and quietly opened those documents to outside agents

Apple announced on 27 October 2026 that Apple Creator Studio adds new AI features across its apps. Keynote, Pages and Numbers get an AI assistant in beta, built on what Apple describes as Apple models and OpenAI, which understands document context. In Keynote it helps design, animate and refine slides. In Pages it drafts, restructures and fine-tunes text. In Numbers it calculates, visualises and organises data, and builds custom tables. Logic Pro gets its own assistant, powered by a combination of Apple-built and third-party models. The assistants need an Apple Intelligence-capable device running iOS 27, iPadOS 27 or macOS 27 or later, and they are available in US English only. The update lands on the App Store in November, free for existing subscribers; new subscribers pay $12.99 a month or $129 a year in the US, with education pricing at $2.99 a month.

The assistant is the headline and the smaller item is the real news. The same release adds Model Context Protocol support to Keynote, Pages and Numbers. In Apple's own description, MCP support enables external AI agents and tools to read content, perform edits and run automated actions inside those apps. It requires macOS 27 or later. An office suite used by a very large number of people has just become something an agent can reach into and change.

Why it matters. MCP has spent 2026 turning into the default way agents talk to software, and this roundup has covered a steady drip of vendors adopting it. Apple adopting it for its document apps is a different order of thing, because documents are not a system of record with an audit log. They are files that one person edits and another person trusts. Apple's announcement does not name which agents or clients will work with the integration, and does not publish which actions are exposed or how permission is scoped. Those details decide whether this is useful or alarming, and they are not available yet.

What it means for a service business. Think about which of your documents carry authority. The rate card. The scope-of-work template every proposal is cloned from. The pricing sheet in Numbers that somebody copies a figure out of at eleven at night before sending a quote. If an agent can edit those files, then a bad instruction, a confused tool call or a prompt injection in a document an agent was asked to summarise can change a number that someone later quotes to a client in good faith. None of this is a reason to refuse the feature, and by November it may well be on your team's Macs whether anyone decided to enable it or not. It is a reason to do two unglamorous things first. Work out which documents are authoritative, and put those specific files somewhere version history is real and reviewable rather than somewhere a change is silent. Then wait for Apple to publish the permission model before you connect an agent to them. The teams AcquihireTech sees get into trouble here not because they adopted something early, but because nobody could say afterwards which document had been the source of truth.

3. Opera shipped local models in the browser, and proposed it as a web standard

Also on 27 October 2026, Opera announced that it is shipping local AI models directly in its browsers. The mechanism is WebAI, which lets websites and browser extensions use AI hosted by the browser itself rather than by a cloud service. Opera calls it a proposed web standard and says it is backed by companies including Google and Microsoft. The implementation is model-agnostic and built around open models: at launch you can use Google's Gemma, and on Macs, Apple's on-device foundation model. It is an opt-in early preview in Opera One, on 64-bit Windows PCs and Macs with Apple silicon, with Opera GX and Opera Neon to follow. Permissions are site-specific, so a user decides which sites may reach the local model. The same release includes HTML-in-Canvas, which lets developers put interactive web pages inside 2D and 3D scenes.

Why it matters. Opera's own framing is the commercially interesting part: developers can add AI features without running AI infrastructure or paying for every request, and the information the local model handles stays on the user's device. Both halves of that matter, and the second may matter more. For a long list of small AI features, the only reason the data ever left the user's machine was that the model lived somewhere else. Opera says performance depends on the user's hardware, which is the honest caveat and a real limit in a market where a lot of machines are mid-range Windows laptops.

What it means for a service business. Do not rebuild anything for this yet. A preview in one browser, on two hardware profiles, is not a platform. What it does is change the arithmetic you should apply to a particular kind of feature request. If someone asks for a résumé parser on your careers page, a tone-checker in your enquiry form, a summariser for a long policy document, you have been pricing those as a per-call API cost that runs forever. The marginal cost of a local model is zero and the data never leaves the visitor's laptop, which also removes the consent conversation you would otherwise have to have. That is worth knowing before you commission the cloud version of a feature that could run on the client's own machine in a year.

4. Liquid AI's LFM3 fits on a phone, and the licence stops being free at $10 million

Liquid AI released LFM3 on 27 October 2026: six models of roughly 2B parameters each, all branched from a single LFM3-1.7B-Base backbone pre-trained on 22 trillion tokens. Four handle input modalities, covering text, vision, audio and omni, and two are decision models specialised from the vision and omni variants. The text model, LFM3-1.7B, carries a 256K-token context window. Liquid says it fits in about 1 GB at 4-bit precision, and that a full 128K-token context needs 1.6 GB of KV cache against 4.3 GB for Qwen3.5-4B and 5.6 GB for MiniCPM5-2B, measured with llama.cpp at Q4_0. Architecturally it is a tri-hybrid: of 24 layers, 13 are gated short convolutions, 5 are sliding-window attention over a 256-token window, and 6 are global attention. The models are on Hugging Face, the Liquid Playground and the Liquid API.

Now the part that decides whether you can use them. The LFM3-1.7B model card names the licence as LFM Open License v1.0. That licence defines its Threshold as annual revenue of ten million United States dollars or more, and section 5(b) states that any commercial use of the work or a derivative work by a legal entity that exceeds the Threshold is not licensed under the agreement. Above it, Liquid directs you to its sales team. Revenue is assessed across the Legal Entity, which the licence defines as the union of the acting entity and all entities that control or are controlled by it, with control defined partly as ownership of fifty percent or more of the outstanding shares. Qualified non-profits are exempt for non-commercial or research use. There is no copyleft clause, so a fine-tune you make can stay proprietary.

Why it matters. Open-weight has quietly stopped meaning open-source, and the gap is a revenue number written into a licence file. This is a reasonable commercial design and nobody is being misled on purpose. But it means "we used an open model" is no longer an answer to the licensing question, and the thing that makes you non-compliant is your own growth, arriving on a date nobody will flag.

What it means for a service business. If you bill ₹10L a month, that is ₹1.2 crore a year, which is nowhere near ten million dollars, and LFM3 is free for you to use commercially today. Two cautions anyway. First, the threshold is measured across the group, not the operating company, so a business sitting inside a larger holding structure should count at the group level before assuming it qualifies. Second, the model is small enough to run on hardware you already own, which is the actual reason to care: a 1 GB model that handles text, vision and audio is a plausible way to do classification, extraction and routing on client data that you would rather not send anywhere. If you go down that road, record which model version you deployed, under which licence, on what date. That note costs five minutes now and is the only thing that will answer the question cleanly in three years.

5. Bots wrote three-quarters of the responses to a UK government consultation

A study published in Tobacco Control on 27 October 2026 examined the 2023 UK consultation on creating a smoke-free generation and restricting the sale of disposable vapes. Of 118,756 responses, 90,835 were flagged as fraudulent by the Department of Health and Social Care, roughly 76%. The automated responses converged on a single multiple-choice question, all opposing the proposed restrictions on disposable vape sales. Once they were excluded, 77% of the valid respondents supported restricting those sales, which inverts what the raw totals showed. The researchers worked from published consultation reports and Freedom of Information requests, and note they could not verify the department's bot-detection methods because those methods are not public. They describe the episode as the first documented instance of large-scale automated interference in a formal public health policy consultation, and say the scale and consistency point to a coordinated campaign whose origin they could not establish. The paper carries DOI 10.1136/tc-2026-060309.

Why it matters. The detection worked and the fraudulent responses were excluded, so the policy process held. That is the good news and it is thinner than it sounds, because it held on a consultation run by a department with the resources to detect 90,835 fraudulent submissions and the standing to throw them out. Most open input channels have neither. The economics here only move one way: generating a hundred thousand plausible responses costs less every year, while reviewing them costs the same as it always did.

What it means for a service business. Look at every channel where a stranger can submit text to you and something downstream treats it as signal. Your Google reviews. The feedback form after a job. The enquiry form feeding your CRM, especially if an AI scores or routes what arrives. The question to ask of each one is not whether someone would bother attacking you, because at this cost the attacker does not need a reason specific to you. It is simpler: if a thousand fake submissions arrived next Tuesday, would anyone notice, and what decision would they have corrupted before anyone did? If the honest answer is that a dashboard would simply show a good week, that is the thing to fix, and it is usually fixed with boring instrumentation rather than AI. Keep submission timestamps. Keep the source. Look at the distribution rather than the total. An unusual week should be something you can see.

The window, and the stories we cut

The window for this edition is 26 to 29 October. All five stories were opened at a primary source during this run: Cloudflare's engineering blog, Apple's newsroom, Opera's press site, Liquid AI's own model post and licence text alongside the Hugging Face model card, and BMJ Group's release for the Tobacco Control paper. The Cloudflare report is dated 26 October, a day before the usual 48-hour window opens; it is included because the previous edition missed it, not because the window was stretched to make five.

Six candidates were cut. Oracle and OpenAI announced at Oracle AI World that Oracle applications and data are coming into ChatGPT, via a product called Oracle AI Workspace; oracle.com returned HTTP 403 to this pipeline on three separate attempts, so it could not be read at an Oracle source and is out for the second day running. Anthropic expanded its AI for Science programme to foundations and research institutions on 28 October, naming twenty partners including the Wellcome Sanger Institute and the US National Science Foundation; it verifies cleanly at Anthropic's newsroom and there is nothing in it an operator acts on, so it is named here rather than given a section. Google DeepMind's Genie 4 was already named in yesterday's cut list for the same reason and has not changed. Anthropic and Theorem's work generating machine-checked proofs across 123 open-source libraries is genuinely interesting and was published on 22 October, outside the window. OpenAI's claim that one of its models disproved the Exponential Time Hypothesis is still under review by outside mathematicians, and the reporting cannot agree whether it landed on 16, 17 or 26 October, so it waits for the reviewers. A political item about renaming artificial intelligence to super intelligence rests on a single social-media post with no implementation document behind it.

One correction to yesterday's edition: Apple was cut then on the grounds that Apple's newsroom would not render for this pipeline. It rendered today, which is why story two exists.

The short version of this edition: ask your AI vendor whether your inference runs on shared or dedicated capacity, and where they publish incident reports. Decide which of your documents are authoritative before an agent can edit them in November. Stop pricing small AI features as a permanent per-call cost. Check the licence revenue threshold on any open-weight model you deploy, at group level. And pick one channel where strangers submit text to you, and work out whether a thousand fake submissions would be visible.