Aleph Alpha releases Kolibri, an Apache-licensed German-English model
Aleph Alpha's Kolibri is a free open-weight German-English model, 78B parameters with about 3.5B active, a 1M-token context and Apache 2.0 weights on Hugging Face, built for on-premises use in Europe. Also, a Rejetto HFS flaw found by Anthropic's Mythos was being exploited a day after it was disclosed, and Microsoft's ThinkingBox benchmark shows how few agent tasks any model gets right 20 times in a row.
A quiet Saturday with three stories about what models are now good enough to do, and how to tell. Aleph Alpha released Kolibri, an open-weight model for European governments and industry. It is small enough to run on-premises and is released under Apache 2.0. And a bug that Anthropic’s Mythos found by reasoning its way through a random number generator was being exploited in the wild within a day of its write-up. And Microsoft released a benchmark that grades agents on the database state they leave behind, run 20 times per task, and finds that even the best models are dependable on fewer than half of its workflows.
Europe’s sovereign pitch gets an open-weight model
What shipped. Aleph Alpha released Kolibri on the Day of German Unity. It is an English-German mixture-of-experts model with 78B total parameters and about 3.5B active per token, a context window of up to 1M tokens, and full weights on Hugging Face under Apache 2.0. Reasoning has four effort levels (none, low, medium and high). Aleph Alpha says 21.3% of the 20T pre-training tokens are German, with only 6% of the data translated, and that the model was built in Germany and trained on infrastructure in Germany and Finland. A tech report covers the details.
In Aleph Alpha’s own benchmarks, Kolibri scores 96.9 on AIME 2025, 84.3 on GPQA Diamond and 85.9 on LiveCodeBench v6, against 84.6, 83.4 and 82.5 for Qwen3.6-35B-A3B. It isn’t ahead everywhere: Qwen leads on τ²-bench telecom (99.1 to 94.7), BFCL v4 (67.2 to 61.4), LongBench Pro and Artificial Analysis’s hallucination index, where Kolibri scores -32.8 to Qwen’s -15.3. Aleph Alpha says Kolibri is on the quality-versus-serving-cost frontier in both English and German, and matches models with up to four times its active parameters, such as NVIDIA’s Nemotron 3 Super. It was trained to say “I don’t know” when the answer isn’t in the supplied context. These are all vendor numbers.
What you can build with it. With about 3.5B active parameters, Kolibri is cheap to serve for its size. It suits on-premises document question answering and agents for German-language public administration, industry or automotive work, where the data can’t leave the building and an English-first model’s German isn’t good enough. Apache 2.0 means you can fine-tune it and ship it in a commercial product without a custom licence.
Open weights are now part of the sovereignty pitch. Aleph Alpha has agreed to merge with Cohere, which sells to the same regulated buyers, and Kolibri gives the combined company an open model to put directly against Mistral for European government and industrial buyers. Both now have small open models that run on-premises and a story about who controls the training data. Whether Kolibri stays open once it is a Cohere product is the thing to watch, along with whether independent benchmarks back up the vendor numbers. Our full guide to Kolibri covers benchmarks, hardware and how to run it.
A bug Mythos found was exploited the next day
What happened. On September 30, Horizon3 researcher Zach Hanley disclosed CVE-2026-61500, a critical authentication bypass in Rejetto HFS, an open-source web file server. It leads to admin access and remote code execution. Horizon3 found it with Anthropic’s Mythos, which it has used since joining Project Glasswing in July. When COOKIE_SIGN_KEYS isn’t set, HFS signs session cookies with a key built from Math.random(). V8’s xorshift128+ generator is invertible, and an unauthenticated endpoint leaked raw Math.random() outputs. Mythos linked the two, used the Z3 solver to recover the generator’s state from a dozen samples, stepped it back to the signing key and forged an admin session. Hanley published a video of the exploit steps.
According to The Register, VulnCheck’s Patrick Garrity saw exploitation start the next evening, from a China-hosted IP address targeting hosts in the US and Japan, followed by four more hits on Friday from what looked like a US proxy. Garrity’s tracker credits Mythos and Glasswing with 286 CVEs. This is the second known to have been exploited in the wild.
What it means for you. If you run Rejetto HFS, update to 3.2.1 or later now. The wider lesson for any JavaScript codebase: never derive keys, tokens or session IDs from Math.random(). Use crypto.randomBytes or crypto.getRandomValues, and check for anything that echoes PRNG output back to clients.
The patch window is now about a day. A model found the bug, built the exploit and solved the maths. Once a detailed write-up with a video was public, someone was using it within roughly 24 hours. As Mythos-class models produce hundreds of CVEs, defenders should expect disclosure-to-exploit times measured in hours, and small open-source projects to be the softest targets.
Agents that pass once, and agents that pass every time
What shipped. Microsoft brought ThinkingBox to Hugging Face. It is an agent sandbox with a benchmark, ThinkingBox-Bench, of 507 stateful business workflows across retail, auto insurance, travel, a neobank and consulting. Each attempt gets an isolated set of MCP tool sessions and a fresh backend. At the end, deterministic checks compare the database state and side effects against the required end state, rather than grading the transcript or the tool calls. Every task runs 20 times. The harness, the dataset and an OpenEnv adapter are public, and the paper, first posted in August, has the full method.
The results. On single attempts (pass@1), Claude Opus 5.5 leads at 67.16%, then Claude Opus 5 (66.50%) and GPT-5.4 (65.36%). Kimi-K3 is the best open-weight model at 57.37% and solves the most tasks at least once (476 of 507). But it passes only 68 tasks on all 20 attempts. The two Opus models each pass 241 every time, the most of any model, and GPT-6 Astra passes 231. Most failures, about 80%, are tool handling: agents that don’t recover from tool errors, failed preconditions or empty lookups. In a 12-model subset, two-thirds of failed attempts ended cleanly with no tool error, and the checks still found wrong field values in most of them. Pricing each run at list rates, the authors work out a cost per dependable task: $6.80 for GPT-5.4, $7.45 for GPT-6 Astra, $7.80 for Opus 5.5 and $13.30 for Opus 5. These are the authors’ numbers, on their own tasks.
What you can build with it. If you ship agents that write to real records, run your candidate models through it before you pick one. The setup needs Python 3.11+, uv, Docker and model endpoints for the agent, the simulated user and the judge. The design lessons apply without the benchmark: check the end state before you report success, classify tool errors so retries target the recoverable ones, give the agent only the tools the workflow needs, and require human approval for changes you can’t cheaply undo.
Leaderboards measure the wrong column. Most model comparisons publish the pass@1 number, and on that, the top three here are within two points of each other. The 20/20 count separates them by nearly a factor of two (241 tasks for Opus 5.5 against 128 for GPT-5.4), and it is closer to what a customer-support or back-office deployment needs. Expect agent evaluations to move towards repeated runs and state checks, and model vendors to start quoting consistency once a benchmark like this gives them a reason to. Kimi-K3’s result is also a warning about open-weight models: broad capability is not the same as reliability.
Quick hits
- Trump confirmed the “Super Intelligence Force” on Sunday morning, a federal task force led by national intelligence director Jay Clayton to “ensure that America continues to lead the World in Super Intelligence”. The Wall Street Journal, which reported it on Saturday, says FTC chair Andrew Ferguson, Emil Michael from the Department of War and OPM director Scott Kupor are vice chairs, and that a report on AI’s risks and opportunities is due in 120 days. With the FTC chair at the table and a charter that, per the Journal, warns against “overregulation”, expect the report to shape federal rules more than the voluntary accord the labs signed on Tuesday.
- Google is cutting which models the free Gemini app can use: from October 9, users without a Google AI plan get only Flash-Lite, and AI Plus subscribers lose Pro. AI Pro and Ultra keep all three, and Pro subscribers gain Deep Think. Every model is also getting low, medium and high effort settings. This is the consumer app, not the Gemini API, but it’s another sign of compute rationing at the free end of the market.