[ The Morning Build ]
4 min read5 storiesAIDev Tools

The Morning Build for October 25, 2026: OpenMobile: 2, Block Dessa on M4 Max, and a Critical Brotli Fix

Today’s stories center on practical shifts engineers can act on: open-weight smartphone agents and Kimi’s near‑Claude parity, a new on‑device full‑duplex voice model from Block, API model political biases ahead of the Nov. 3 midterms, and a high‑severity Brotli decoder CVE that forces runtime upgrades and image rebuilds.

OpenMobile: 2 releases Qwen3.5/3.6-based smartphone agents and training environment

  • What happened: Researchers from Nanjing University, SenseTime, and partners released OpenMobile: 2: two agent models (9B on Qwen3.5 and 27B on Qwen3.6) plus the full training environment, data, and instructions; they trained over 110 simulated apps and generated about 11,600 example workflows and 2,000+ practice tasks. On real Android devices the larger model scored 59.6 on SPA-Bench, the top result reported for open models.
  • Why it matters: The study shows app diversity in the training environment raised unseen-app success rates from 60.7% to 67.5% with the same data budget, and real‑device gains were larger than emulator/bench improvements, meaning engineers building phone agents should prioritize varied simulation coverage over raw example counts.
  • Outlook: Check the OpenMobile: 2 public release artifacts the authors published (models, environment, and reproduction instructions) for independent SPA-Bench and AndroidWorld verification and for community forks now that models and data are available.

Sources: the-decoder.com

Block publishes Dessa, a full‑duplex on‑device voice model said to run on MacBook M4 Max

  • What happened: Block announced Dessa, a voice model trained solely on human speech that runs locally and supports full‑duplex listen-and-speak behavior; the company says it can run on consumer hardware such as a MacBook M4 Max and has posted example conversations demonstrating emotion, cadence, and pauses.
  • Why it matters: An on‑device full‑duplex model removes round trips for some interactive voice workloads and preserves acoustic signals lost by text pipelines; engineers designing voice UIs and offline agents should note the claim of local execution on M4 Max class hardware and Block’s public call for safety researchers.
  • Outlook: Watch for safety‑researcher reports and any public access statements from Block after their call for testers, which will reveal exploit vectors, metrics for deceptive behavior, and any planned distribution or SDK timing.

Sources: techcrunch.com · the-decoder.com

Convovo study finds Grok and GPT API outputs diverge on candidate picks ahead of Nov. 3 midterms

  • What happened: Researchers asked models via APIs to name one candidate to vote for and found Grok 4.7 recommended Republicans in 92% of answers while OpenAI’s GPT-6.1 Sol recommended Democrats in 97% across ~500 races; the two models agreed less than 10% of the time. The paper also notes Grok requests carried about 1,240 tokens of additional, opaque input via the API.
  • Why it matters: The results show API access to model weights or developer endpoints can produce political recommendation behavior that differs sharply from consumer app behavior; engineers deploying model APIs for information tasks should be aware that API-level prompts, hidden request context, or search behavior changed outcomes in this study.
  • Outlook: Nov. 3, 2026 midterm results provide the immediate public milestone tied to this study, with the paper released in the two weeks before the election and the authors framing their findings as relevant to debates over political bias in model outputs.

Sources: techcrunch.com · the-decoder.com

Moonshot’s Kimi K3.1 Pro posts 55 on Artificial Analysis, plans open weights by Nov. 4, 2026

  • What happened: Moonshot AI released Kimi K3.1 Pro, a post-trained 2.8T-parameter model scoring 55 on Artificial Analysis (up 11 points from K3); Moonshot lowered token prices by 33% and announced a weights release planned by November 4, 2026. K3.1 Pro shows gains in agentic tasks, coding, and 3D modeling and retains a 1,000,000-token context window.
  • Why it matters: If Moonshot follows through on an open-weights release, K3.1 Pro would become the highest-scoring open-weights model available per Artificial Analysis; engineers tracking open models should note the November 4 target and the model’s stated price, context window, and claimed reductions in hallucination and cyber-offense data removal for the open-weights build.
  • Outlook: November 4, 2026 is the release target Moonshot set for publishing model weights; that date will show whether K3.1 Pro becomes the top publicly available weights and allow independent benchmarking versus Claude Opus 5.5.

Sources: the-decoder.com · the-decoder.com

CVE-2026-111497 (Node2Shell / HTTP2Shell) is an out‑of‑bounds write in Brotli; vendors released patches and mitigations

  • What happened: A Brotli decoder bug (CVE-2026-111497) allows crafted Brotli streams to cause out‑of‑bounds writes, memory leaks, crashes, or possible remote code execution; OpenAI found the root cause in February. Patches are available in libbrotli 1.2.1, Brotli/bro tlicffi patched releases, and in specific runtime versions listed (Node.js 22.23.4, 24.22.1, 26.12.1; Bun 1.4.4; Envoy and Istio releases named), and the advisory assigns CVSS v4.0 score 9.2.
  • Why it matters: Because many HTTP clients and servers load Brotli decoders as bundled or transitive dependencies, vulnerable environments can be exploited by malicious servers or clients; the advisory lists concrete patched package versions and recommends rebuilding container images and restarting services to ensure the fixed decoder is in use.
  • Outlook: Confirm production environments run Brotli 1.2.1 or the patched runtime releases the advisory lists (for example Node.js 22.23.4, 24.22.1, 26.12.1) and rebuild container images and deployed binaries so services use the updated Brotli decoder before relying services accept traffic.

Sources: aikido.dev