Nvidia's Huang doubles down on 70% revenue growth forecast at Goldman conference — techcrunch.com

Technical Artist Builds a Tool to Break Gaming's 'Killmonger Locs' Habit — wired.com

WIRED Lets a Rogue AI Agent Loose on Its Author's Home Network — wired.com

Nvidia's Huang doubles down on 70% revenue growth forecast at Goldman conference — techcrunch.com

Technical Artist Builds a Tool to Break Gaming's 'Killmonger Locs' Habit — wired.com

WIRED Lets a Rogue AI Agent Loose on Its Author's Home Network — wired.com

Local UI security

Open WebUI discloses 16 CVEs in one batch; OAuth session-hijack flaw rates CVSS 8.1

Sixteen CVEs against Open WebUI 0.6.41–0.11.1 were published on September 9–10, led by CVE-2026-87016 (CVSS 8.1): an OAuth/SCIM identity-confusion bug where a 'sub' claim containing % or _ SQL wildcards can hijack an administrator's session on SQLite-backed deployments. PostgreSQL installs are unaffected. All 16 are fixed in v0.11.1, which shipped August 25 with security details deliberately withheld — anyone self-hosting Open WebUI should upgrade.

Severity Daily · 2026-09-10 · Read the dispatch →

System76 Thelio Mira AI fits 192GB of ECC GDDR7 into a $3,299 consumer desktop

Two RTX PRO 6000 workstation GPUs (192GB combined ECC GDDR7 VRAM) in an AM5 consumer chassis, capable of roughly 146B-parameter 4-bit models locally — a direct counter to the GDDR7 shortage-driven price surge.

Tech Times · 2026-09-10

n8n patches expression-sandbox escape to worker RCE (CVE-2026-86083) plus two workflow-injection CVEs

CVE-2026-86083 (CVSS 7.7) lets an authenticated workflow editor escape the legacy expression sandbox to full Node.js code execution; all three are fixed from 2.38.2 onward, so self-hosted n8n deployments should upgrade.

GitLab Advisory Database · 2026-09-10

Hugging Face rebuilds AUTOMATIC1111 on Gradio Workflows for local image generation

A tutorial and workflow that reimplements the classic AUTOMATIC1111 Stable Diffusion UI on Gradio Workflows, aimed at local image-generation tooling.

Hugging Face · 2026-09-10

Research & Papers

A unified per-token gating family for on-policy distillation

A four-coefficient per-token gating parameterization subsumes EOPD and ToDi, and beats matched single-channel configs on 33 of 36 cells when distilling a Qwen3-32B teacher into a 4B student.

arXiv · 2026-09-10

SenseNova-U1.5: encoder-free 8B unified visual intelligence with open training code

An 8B MoT multimodal model that understands, reasons about and generates visual content at native resolutions up to 4K, with training code open-sourced.

HuggingFace · 2026-09-10

LOCUS: task-aware low-rank post-training that cuts output-token cost

LOCUS selects a low-rank adaptation subspace that reduces continuation length by up to 39.84% on Pythia-2.8B and 14.87–17.58% on Qwen2.5-3B with a frozen backbone and native preference objective.

arXiv · 2026-09-10

ZipCodec: ultra-low-frame-rate streaming speech coding on consumer CPUs

A streaming neural codec at 6.25 Hz and 0.80 kbps with 160ms latency; the 842M-parameter model substantially outperforms comparable codecs while running in real time on a consumer-grade CPU.

arXiv · 2026-09-10

VikingRAG: token-efficient retrieval over structured documents

A directory-aware semantic data manager that cuts structural-context tokens without sacrificing RAG accuracy, reusing agentic retrieval traces as experience edges.

arXiv · 2026-09-10

Open Weights & Models

Nex-N2.5-Pro: Apache-2.0 Qwen3.5-MoE checkpoint refreshed

The new Pro checkpoint in the Nex N2.5 line was updated September 11 and is trending strongly on the Hub alongside Nex-N2.5-mini.

HuggingFace · 2026-09-11

Community NVFP4 quantization of DeepSeek-V4.1-Flash lands for local runtimes

A community NVFP4 quant of DeepSeek-V4.1-Flash is published; vLLM support for V4.1 remains a set of open, unmerged PRs.

HuggingFace · 2026-09-10

Tools & Runtimes

Stroq: a local action firewall for AI coding agents

A local firewall that tracks what an agent reads, taints the session context, and blocks dangerous follow-up actions before they execute.

GitHub · 2026-09-10

Kern Agent: watch your agent think, step by step

Open-source observability that introspects each agent action and output instead of treating the model as a black box.

GitHub · 2026-09-11

Gojo: fully on-device dictation and notch tools for macOS

Recognizes speech entirely on-device for dictation into any field, plus clipboard, window, file-shelf and media controls in the MacBook notch.

Product Hunt · 2026-09-10

GoModel: self-hosted AI gateway as a single Go binary

An MIT-licensed OpenAI-compatible gateway that exposes Ollama and vLLM behind one endpoint, with budgets, caching, guardrails, load balancing and failover.

Product Hunt · 2026-09-10

Loudkit: local TTS with native ports in five languages

A local text-to-speech engine with 28 voices across 10 languages and voice cloning, shipped as native Python, Swift, Go, Rust and TypeScript ports with no cloud dependency.

GitHub · 2026-09-10

Hardware & Edge

RTX 5090 mod: three 8-pin connectors unlock 900W and 3,400 MHz

TecLab removed the 16-pin power header, ran the Blackwell flagship off three standard 8-pin PCIe connectors, and pushed it to 900W — reviving the question of whether high-end GeForce cards need the 16-pin design.

Tom's Hardware · 2026-09-10

“Your PC is the solar panel to cloud AI subscriptions”

PCWorld argues local NPU/GPU PCs beat recurring token bills, citing NVIDIA PAIR pooling up to 18 home GPUs and AI appliances like Anker MindBase shown at IFA.

PCWorld · 2026-09-10

Free Models

Free means $0 per token today, not unlimited or unconditional: both platforms rate-limit free use and require a free API key, some OpenRouter free endpoints may train on your prompts unless you opt out in account settings, and the roster changes daily. Verified against each provider's own pricing data at generation time — but pricing changes without notice, so confirm it's still free on the provider's own page before you rely on it.

In Brief

Source:

Open WebUI discloses 16 CVEs in one batch; OAuth session-hijack flaw rates CVSS 8.1

System76 Thelio Mira AI fits 192GB of ECC GDDR7 into a $3,299 consumer desktop

n8n patches expression-sandbox escape to worker RCE (CVE-2026-86083) plus two workflow-injection CVEs

Hugging Face rebuilds AUTOMATIC1111 on Gradio Workflows for local image generation

Research & Papers

A unified per-token gating family for on-policy distillation

A unified per-token gating family for on-policy distillation

SenseNova-U1.5: encoder-free 8B unified visual intelligence with open training code

LOCUS: task-aware low-rank post-training that cuts output-token cost

ZipCodec: ultra-low-frame-rate streaming speech coding on consumer CPUs

VikingRAG: token-efficient retrieval over structured documents

Open Weights & Models

Nex-N2.5-Pro: Apache-2.0 Qwen3.5-MoE checkpoint refreshed

Nex-N2.5-Pro: Apache-2.0 Qwen3.5-MoE checkpoint refreshed

Community NVFP4 quantization of DeepSeek-V4.1-Flash lands for local runtimes

Tools & Runtimes

Stroq: a local action firewall for AI coding agents

Stroq: a local action firewall for AI coding agents

Kern Agent: watch your agent think, step by step

Gojo: fully on-device dictation and notch tools for macOS

GoModel: self-hosted AI gateway as a single Go binary

Loudkit: local TTS with native ports in five languages

Hardware & Edge

RTX 5090 mod: three 8-pin connectors unlock 900W and 3,400 MHz

RTX 5090 mod: three 8-pin connectors unlock 900W and 3,400 MHz

“Your PC is the solar panel to cloud AI subscriptions”

Repos on GitHub

Trending on HF

Free Models

Free on OpenRouter

Free on OpenCode Zen

In Brief