Open-weight multimodal releases keep coming as Washington and Beijing tighten the rules

The most recent dated item is not a model launch. It is a 27 October post on Schneier on Security about research titled "AI Models Can Provably Hide Arbitrary Capabilities."

The authors say they built backdoor attacks that embed encrypted neural networks inside a host model's weights. These decrypt and run only when a secret trigger arrives. That matters for anyone reading a multimodal release note. Capability evaluations, the paper argues, assume that hidden capabilities can be elicited. The authors say that assumption fails under adversarial conditions. They report testing elicitation through fine-tuning, weight noising, gradient-based trigger search and latent adversarial training. They used a small chemical reaction prediction task as a proxy for CBRN-relevant capabilities. They say the hidden circuits resisted those methods. They released their models to support work on defences.

Schneier's own commentary is one line and a question. He speculates that statistical testing might detect embedded encrypted networks even when they cannot be surfaced. He compares it to entropy analysis used to flag encrypted regions in binaries. The post is a blog entry around a paper, not a peer-reviewed result. Neither the post nor the paper names the authors or a venue.

What actually shipped

The release calendar is fuller than the policy news. Xiaomi's MiMo team pushed MiMo-V2.6-Pro-RL, according to the 20 October issue of Interconnects' open artifacts newsletter. The update reuses the same bases as MiMo V2.5 but spent far more resources on reinforcement learning. The team also published an in-depth technical report and some of the training environments. The newsletter calls that rare at this scale. It says the final model from that recipe, V2.6-Pro, is the top open model on Artificial Analysis's ranking.

Google shipped EmbeddingGemma 2, described in the headline list as an open, lightweight multimodal embedding model. One headline, dated 6 October, says it is a 744M unified multimodal embedder. Another, dated 18 October, frames the release around Apache-2.0 standards for multimodal search. A third, dated 6 October, quotes Sundar Pichai calling it the company's first open, natively multimodal embedding model. An embedding model is not a video generator, and the coverage should not be read as one.

The headline list also carries Pika H3 Flex, an open-weight video model with 4K output and audio generation, dated 1 November. It also carries Liquid AI's LFM3, six open-weight 2B-class multimodal models, dated 27 October.

SenseTime's contribution is older. A headline dated 20 August says the company open-sourced an 8B multimodal model with native 4K image output. Cloudflare's Clef-omni, a 30B-A3B multimodal decision model for audio, video, image and text, appears with a date of 11 October. None of these items comes with benchmark numbers, so treat the capability claims as vendor framing until independent evaluations appear.

Regulators move on open weights

The policy side is where the Interconnects issue spends its words, and it is dated 20 October. China's Ministry of Commerce, MOFCOM, released a policy proposal, not yet a law. It would require frontier AI models and some other technologies to get government pre-approval before being shared internationally. Interconnects calls the reaction overblown. It notes the document sets open-source technologies up for automatic approvals. Others it trusts argue the proposal targets situations like the sale of Chinese startup Manus to Western companies, not frontier models. The newsletter records the disagreement rather than resolving it.

In the US, the Department of Homeland Security released an order on DeepSeek. It bars the company and its models from federal civilian procurement as a vendor. Interconnects flags the unresolved question of finetuned models and models trained on DeepSeek outputs. It points to Nvidia's Nemotron line, which it says has long relied heavily on DeepSeek models in its training recipes. Zhipu AI, maker of GLM, is already on the Commerce Department's Entity List, which restricts access to American technology, according to the same issue.

DeepSeek's own answer was technical. It published its internal inference stack, DeepInfer. Interconnects expects it to be far more efficient than open tools such as vLLM and SGLang for its models. The newsletter cites estimates of up to 90% gross margin on tokens sold through that stack. It calls the release one of the bigger open-source AI artifacts of recent months, even though it is neither a model nor a dataset.

The bias question inside a coder model

A second Schneier post, dated 26 October, describes work on Qwen3-Coder. The summary says telling the model who the code is for changes the security of what it writes. Apps requested for a US defense contractor were 19% more likely to be hackable than those for a Chinese defense contractor. Apps for a Hong Kong democracy group were 28% more likely to let any user read everyone else's secrets. Adding a security instruction did not close the gap. The summary says the US contractor's apps were then 27% more likely to be hackable than a neutral customer's.

The post attributes the fix to Hirundo. It says Hirundo removed the model's CCP alignment and closed all three gaps while matching the original on ten other coding tasks. It says the modified model is on Hugging Face. The claims come from the company behind the fix, and no independent replication exists, which is the obvious caveat. A commenter on the post raises the opposite risk. An adversary could push a story about baked-in bias to sell a modified model into production lines.

That is the connective tissue between the two research items. One says hidden behaviour can be made provably hard to elicit. The other says a behavioural difference can be measured, attributed to training, and removed by editing weights. Both point at the same gap. The tooling for auditing what is inside an open-weight model is younger than the release cadence.

Infrastructure keeps leaking into the story

Two security items sit outside AI but shape the same deployment picture. On 22 October, Schneier relayed PHP maintainers' fixes for two critical vulnerabilities allowing unauthenticated remote code execution. The fixes cover PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. The advisory lists PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed as exposed. The highest risk is on mod_php, where a request can trigger the attack before application code runs. The two CVEs are CVE-2026-109618 and CVE-2026-109619.

The post says the security firm Calif discovered the flaws, and researchers at Wiz found them independently. Commenters tie the find to AI-assisted vulnerability hunting. They worry that disclosure is outpacing patching.

The second item is a certificate problem. A comment on the PHP post links to an Ars Technica report from October. The headline is about the internet going on high alert after the discovery of 8 compromised TLS certificates. The commenter's account is that Indian certificate authority eMudhra used weak signing key values for top-level certificates. That left roughly 60 million certificates untrustworthy. The link does not corroborate the account beyond the headline. Treat the 60 million figure as a commenter's claim, not a confirmed count.

What to watch next

Interconnects, writing on 20 October, said Kimi K3.1 was rumoured to be released very soon. Metadata was starting to appear in public libraries. That is a rumour in a newsletter, not a release.

The same issue notes that the open ecosystem is maturing while the regulatory ground under it shifts. That is a fair summary of the month: more multimodal weights, more procurement bans, and audit methods that the 27 October paper says can be defeated by design.