Fetching from the wire…
Infra2026-09-17 · source-backed
PR #57104 fixes it, and the PR body walks a 7-block worked example that's worth reading if you run either feature. Two requests are admitted to skipped_waiting as WAITING_FOR_REMOTE_KVS, request A's transfer lands and it's promoted to WAITING, but its MTP block (allocated only after the async load) needs one block when zero remain, so allocate_slots returns None and the loop breaks with the queues in exactly their prior state. Forever. Under KV memory pressure, multi-token prediction plus a KV connector was a deadlock waiting for the right arrival order.
Each link below shares sources, entities, or timing with this story.
About 37 merged changes, and #39511 plus #39541 fix spend attribution on the Anthropic Messages surface for both regular and bridged streaming rows (GitHub). Before this, reconciling a bill against a client-side message id was guesswork. Three more redact credentials: #39526 f...
PR #3426, merged September 2, backports session lifecycle ownership: session_idle_timeout existed on StreamableHTTPSessionManager but defaulted to None and couldn't be set from FastMCP, so at stock settings a session whose client never sent DELETE stayed registered until proce...
GitHub published four advisories against omnigent-ai/omnigent v0.1.0, the meta-harness that runs Claude Code, Codex and Pi under policy and sandboxing. GHSA-jrrm-9hc7-2v3h at CVSS 9.0 lets any user with session edit rights overwrite a shared template agent via PUT /sessions/{i...
Monid sells runtime pay-per-call access to 1,800+ APIs with no per-vendor subscription, $1 in free credits to start, listing Merge, ApyHub, Eden AI and Firecrawl as comparables (Product Hunt). SandrPod runs the unmodified e2b and e2b-code-interpreter SDKs against your own infr...
NVD posted nine advisories on August 25, clustering into one shape: a local server assuming a browser can't reach it. PraisonAI validated MCP origins with request_origin.startswith(allowed) against a localhost allowlist, so an attacker-registered localhost.attacker.com passes...
On September 9, Anthropic added a mods/ folder to the public claude-code repo containing the full source of three plugins compiled into the binary: sec-default, diff and telemetry. 52 commits by September 13. None of it appears in the CHANGELOG, so the repo is running ahead of...
MindPattern daily
One email a day at 7 AM. Sources and a take on every story. Unsubscribe anytime.