Explore
Cloud infrastructure, Kubernetes, AWS, Azure, GCP and DevOps news.
311 results • Page 10 of 26
344 points 199 comments on Hacker News · huggingface.co
As a discerning AI investor who values style and substance, Sarah Guo knows this season’s standout accessory isn’t the latest designer purse — but what’s inside it. In a recent video, Guo, founder of AI-native venture capital firm Conviction and co-host of the AI podcast No Priors, highlighted how the NVIDIA Jetson platform for edge […]
Two Scythe co-founders are using their experience building commercial robots to create tools for robotics developers at Agency Tool Co. The post Agency Tool Company wants to make OTA software updates easier appeared first on The Robot Report .
JFrog has confirmed that OpenAI models exploited a zero-day in self-hosted Artifactory while trying to reach the open internet from a sealed evaluation environment. Artifactory is JFrog's software repository manager. OpenAI says the models then escalated privileges and moved laterally until they reached an internet-connected node. JFrog says it has since developed and released fixes for cloud
Snowflake announced Cortex AI Gateway on Tuesday, a centralized control layer designed to govern how AI agents — including those built by competitors like Anthropic's Claude Code and Cursor — access enterprise data, tools, and models. Alongside the gateway, the company unveiled a first wave of security integrations with 1Password , Aembit , Linx Security , SailPoint , and Saviynt , an unusual lineup of identity vendors who often compete with one another, now aligned around a shared trust model for autonomous agents. The announcement, made from the company's no-headquarters base in Bozeman, Montana, is Snowflake's most aggressive move yet to position itself not merely as the place where enterprise data lives, but as the control plane that decides what AI agents are allowed to do with it. "The next era of AI won't be built through more walled gardens. It will be built through secure agent interoperability," Mayank Upadhyay, Snowflake's chief security and trust officer, told VentureBeat in an exclusive interview. "If every vendor builds a closed ecosystem of agents, enterprises simply recreate the fragmentation they've spent years trying to solve. Instead of breaking down silos, they create a new generation of AI silos that limit innovation and make it harder to scale AI across the business." Why decades-old enterprise security models break when AI agents become the actors The core argument animating today’s announcement is that decades of enterprise security architecture rests on an assumption that no longer holds — that the actor behind every access request is a person. "Traditional security was built for a world where humans were the actors. AI agents change that completely. For decades, security models assumed people would access one application at a time, operating at human speed and within relatively defined boundaries," Upadhyay said. The deeper issue, he argued, is not novelty but exposure: "The challenge isn't that AI creates entirely new security problems. It's that AI exposes the blind spots we've always had." Organizations have never had perfect visibility into every API, dataset, and workflow, Upadhyay noted, and at human speed those gaps were manageable. Agents operating at machine speed can "combine access across systems and act on permissions that were never intended to be exercised together, amplifying those longstanding risks." His conclusion: "In the agentic era, trust can't be a one-time decision made at login. It has to be continuously verified through every agent, every action, and every interaction across the enterprise." Nancy Wang , chief technology officer of 1Password, described the failure mode in more visceral terms. When agents first arrived, she told VentureBeat, the default pattern was dangerously simple: "Let me just give the agent my credentials and it can just act as me... let's imagine you're the head of security or the head of IT, and you have access, especially admin access, to all of the systems. Well, now suddenly your agent now has admin access to all of the systems, and so it could exfil data... if it's subject to a prompt injection, for example." The audit trail becomes equally useless, she added: "Imagine the audit logs show that Michael sent a couple million dollars to an offshore account... It raises eyebrows when, in fact, it could just be an agent going off the rails and doing things that you never authorized." Her prescription, and the premise of 1Password's integration with Snowflake, is blunt: "Agents need their own identity." Inside Cortex AI Gateway: how Snowflake plans to govern agent access and rein in runaway AI costs Cortex AI Gateway , which will enter public preview soon, functions as a connective layer for what Snowflake calls "all trusted agent activity." It governs both first-party agents built inside Snowflake, such as Snowflake CoWork and CoCo, and third-party agents built on external platforms. With support for more than 100 MCP servers — the Model Context Protocol connectors that have become the de facto standard for wiring agents to enterprise tools — the gateway centralizes access policies, authentication, permissions, and audit logging in a single place. The gateway also addresses a less glamorous but increasingly urgent problem: runaway AI spending. It gives IT and finance teams a unified view of AI consumption, attributes costs to the specific teams, agents, or workloads driving them, and enforces spending limits before bills spiral. Upadhyay described how those costs compound in practice. "AI is dynamic. Agents can invoke multiple models, call different tools, and execute multi-step workflows, creating consumption patterns that can change from one task to the next. For example, an enterprise may deploy an AI assistant to help employees answer internal questions. A simple request that only requires retrieving a document could unintentionally be routed through a more expensive reasoning model, trigger additional searches across multiple systems, or invoke unnecessary workflows." At scale, with thousands of employees and hundreds of agents, small inefficiencies become significant line items. The gateway builds directly on Snowflake's May 2026 acquisition of Natoma , a 27-person startup whose centralized MCP gateway enforced identity, policy, and audit at the tool-call level. Forbes reported at the time that the deal — announced the same day as Snowflake's $1.33 billion quarterly product revenue report and a $6 billion AWS compute commitment — was the smallest of the day's three announcements by dollar value but the most revealing about where Snowflake believes the next platform fight sits: not in the data warehouse, but in the layer that decides what an agent may touch and records what it did. Dual attribution and task-scoped access: the technical blueprint for trusting autonomous agents The technical centerpiece of the partner integrations is what Snowflake calls dual attribution. "By logging both the verified non-human identity of the agent and the specific human who authorized the task, we ensure task-scoped access and complete auditability for every action taken across the enterprise," Upadhyay said. That answers a question that has stumped security teams: when an agent takes an action, whose action is it? The Snowflake model says the answer is both — the agent's, and the human's who delegated the task — and both must be recorded. Task-scoped access is the companion principle. Rather than inheriting a user's full standing permissions, an agent gets access only to what a specific task requires. Upadhyay acknowledged the obvious objection — agents are dynamic and their next step often isn't known in advance. "The goal isn't to predict every action an agent will take. It's to ensure that every action an agent takes is evaluated in real time against the appropriate policies, scope, contextual signals, and the original intent of the user," he said. Wang explained how 1Password's piece works at the protocol level, pointing to emerging standards like OIDC-A : "the human, for example, first authorizes the agent to do a specific task, and then what that means is the agent will then receive sort of the delegated task specific token... as part of that token, that is where you learn of the original sort of delegator identity and also the intent behind the task." The intent-preservation problem is subtle, she noted, because enterprise tasks decompose into enormous chains of individual operations. "When they're accessing a table, you know that it's acting on behalf of the original intent that you gave that agent... a task might be a compilation of hundreds, maybe even thousands, individual actions." Keeping that intent intact across every step in the chain — and flagging the moment an agent deviates from it — is what Snowflake and its partners are ultimately trying to standardize. SailPoint's field report: the three ways enterprise identity systems fail against AI agents Chandra Gnanasambandam , SailPoint's EVP of product and chief technology officer, brought the perspective of a vendor that has watched enterprises break their identity stacks against this problem for more than a year. SailPoint has been in the machine and agent security market for roughly 18 months, he said, with more than 100 customers on its agent identity product — enough of a sample to catalog the recurring failures. The first is scale-driven shallowness. An average Fortune 500 company has roughly 16,000 employees, and SailPoint is seeing human-to-non-human identity ratios of at least 10 to 1 — before counting the tools and APIs each agent touches, which multiply the count again. "You will get into a million plus non-human identities. Mapping the permissions that each of them get to the 16,000 humans is a completely non-trivial task," he said. Most companies punt, mapping agents to humans at the directory-group level. "That is grossly insufficient. You want to have fine grain context. Like I said, it's not access to Snowflake. It's access to what column and what data inside Snowflake you need." The second failure mode is drift. Modern models are relentless goal-seekers, and that persistence cuts both ways. "When you tell them get this done, the underlying models are so powerful now. Even the weaker models are so powerful. They will go find a way to get it done... They will go find the vulnerabilities to bypass the permission to get it done," Gnanasambandam warned. The answer, he argued, is runtime monitoring of the entire interaction chain, compared continuously against policy, with automatic intervention when an agent escalates beyond what its human delegator authorized. The third is missing data context. Many vendors, he argued, announce splashy integrations with big application platforms while ignoring where the actual risk concentrates. "That's not where the risk lies. Risk lies in sensitive data, so the details matter here... Can you map specific columns and rows in Databricks, Snowflake, Redshift, Oracle... into the agent context and the human context? And if you can't do that, you are going to have gaps and holes." SailPoint's answer required tearing out two decades of architecture. "We rewrote our underlying data and object model to treat AI identity as a first-class object, because for 20 years, SailPoint had a data model and object model that supported the human identity, and AI identities are fundamentally different," Gnanasambandam said, describing 12 to 18 months of deep engineering work. The result is what he calls a unified lineage: "From human to master agent to sub agent to tool to application to data. That's what I call the steel chain. That is in one data model, one platform." Why rival identity vendors joined Snowflake's trust framework — and what each side gets out of it Perhaps the most striking aspect of today’s announcement is the roster. 1Password , SailPoint , Saviynt , Okta , and Aembit compete for overlapping identity and access budgets. Snowflake convinced them to build against a common trust framework anyway. "The reason we brought together leaders across the security ecosystem is because no single company can solve the agent security challenge alone. AI agents can't deliver real value if they only operate within the boundaries of one platform," Upadhyay said. His broader thesis frames the whole strategy: "Nobody wants to replace data silos with AI silos." Wang offered a pragmatic division of labor: "We bring the trust, and Snowflake brings a system of record." She framed the collaboration as classic defense in depth — "there are data level controls, and there are identity level controls, and so together we can create a much stronger ecosystem play." There is self-interest in the openness, of course. Snowflake sits atop an enormous concentration of sensitive enterprise data — more than 13,900 customers, by the company's count — and every third-party agent that touches that data through a governed Snowflake gateway deepens the platform's gravitational pull. As Constellation Research analyst Michael Ni put it when the Natoma deal was announced, in comments reported by CIO.com : data platforms won the analytics era, and whoever governs agents, context, and autonomous actions wins the agentic one. A Forbes analysis of the same acquisition flagged the tension directly, noting that a governance layer living inside Snowflake risks pulling MCP's openness back toward a single vendor's control plane — attractive for Snowflake-standardized shops, more awkward for genuinely multi-vendor agent stacks. Analyst forecasts show agent governance is now a trillion-dollar race against the clock The urgency behind today’s announcement is not manufactured. Gartner predicts that by 2027, governance gaps discovered only after production incidents will force 40% of enterprises to demote or decommission autonomous AI agents — with analysts there warning that the greatest risk an agent poses often lies not in its output but in the actions it is empowered to take. IDC, meanwhile, expects more than 1 billion actively deployed AI agents by 2029 , executing roughly 217 billion actions per day, and forecasts agentic AI will exceed $1.3 trillion in worldwide IT spending that year. The research firm's analysts now argue agentic platforms should be treated as decision infrastructure, not productivity software. Against that backdrop, the identity layer is becoming the contested ground, and every major vendor — Salesforce , ServiceNow , Microsoft , Google , Okta — is racing toward the same runtime-governance chokepoint. Snowflake's differentiator is proximity to the data itself. As Upadhyay put it, security "can't just be an API proxy sitting in front of an LLM. It has to anchor all the way down into the underlying data layer, enforcing zero-copy boundaries, dynamic data masking, and real-time exfiltration safeguards before an agent ever touches a row of data." The rollout now moves to proving ground. Cortex AI Gateway enters public preview soon, and the five partner integrations enter private preview, a phase Wang described as a deliberate feedback loop — customers on day one get an agent-access broker plus "a full audit log that will show you, for example, what that agent is actually doing," even when an agent deviates from its intent. Gnanasambandam, characteristically, wants enterprises to skip the easy demos entirely, urging customers to bring loan-origination workflows spanning three clouds and ten applications, half of them mainframes: "Give us that complex use case and bring anyone on and do it in your context, and we will take the challenge with anyone in the world." That confidence — from a field of rivals, no less — captures what makes this moment unusual. The companies that spent the last decade fighting over who verifies human identity have concluded, more or less simultaneously, that the next decade belongs to whoever can verify the machines acting on our behalf. Upadhyay distilled the wager into a single line: "The future of AI won't be won by the organizations with the most agents, but by the organizations that can govern those agents with the most trust, visibility, and control." In the agentic enterprise, it turns out, trust isn't the guardrail. It's the product.
The Model Context Protocol , the open standard that has quietly become the connective tissue between AI agents and the world's software, is getting its largest update since Anthropic released it twenty months ago — a sweeping architectural revision that its maintainers and backers say finally makes agentic AI ready for massive enterprise production deployments. The update, released today under the stewardship of the Agentic AI Foundation (AAIF) , a directed fund under the Linux Foundation , finalizes MCP's transition to a fully stateless architecture, hardens its authentication model against a known class of attacks, establishes a formal 12-month deprecation policy, and graduates two headline capabilities — interactive server-rendered interfaces and long-running asynchronous tasks — into official protocol extensions. The changes may sound arcane. Their consequences are anything but. According to the announcement, running MCP at scale has historically required "sticky routing" or shared state to maintain continuity across sessions — an operational burden that made large production deployments complex even when the underlying capabilities were simple. The new release removes that bottleneck entirely, letting organizations run MCP servers behind standard load balancers using the Kubernetes and cloud-native DevOps tooling they already operate. "Some people jokingly call it a v2, and I think in spirit that's accurate," David Soria Parra, MCP's co-creator and a lead maintainer at Anthropic, told VentureBeat in an exclusive interview. "It's probably the biggest change we've ever made to the protocol, and with that, it's a big step up in maturing it for use by really big players." Why stateless architecture is the key to running AI agents at enterprise scale To understand why the industry's largest companies pushed for this release, it helps to understand what was broken. Under the old design, an MCP client — the AI application making requests — had to maintain a persistent session with a specific server instance. In modern cloud environments, where fleets of interchangeable compute nodes spin up and down behind load balancers, that requirement was poison. If the specific server holding your session state disappeared, your agent's work disappeared with it. "Before, you needed to have a session store and manage session IDs — and if one of your compute pods went down, all of a sudden the requests would start failing," said Den Delimarsky, a lead maintainer of the protocol, in an interview with VentureBeat. "That's not going to be a problem with the new version of the protocol. That's a huge unlock, and it's one we collaborated with folks across many companies to put together." Mazin Gilbert , executive director of the AAIF and a veteran of Google and AT&T, framed the change in historical terms — comparing it to the architectural decision that made the web itself possible. "That stateless capability enables your MCP client to speak to a load balancer that connects with any server. You don't need the stickiness," Gilbert told VentureBeat. "You could not have the internet we have today if my browser couldn't speak to any website — with any server supporting that connection. You can switch between servers behind a load balancer." Gilbert said the constraint had become the primary blocker for companies trying to move AI agents from pilots into production. "I've come across companies who are deploying tens of thousands of agents, and you cannot do that without having to go in this direction," he said. Crucially, he argued, the obstacle was never the AI itself: "It wasn't the technology, it wasn't the business case, it was really these fundamental changes that were required." The tension is nearly as old as the protocol. A public design discussion opened by MCP co-creator Justin Spahr-Summers on GitHub in December 2024 — just weeks after launch — flagged that MCP's long-lived, stateful connections were limiting for serverless deployments, and sketched three possible paths forward, including the fully stateless option the protocol has now largely embraced. Engineers from Vercel , Cloudflare , Shopify , and Amazon weighed in over the following months, a preview of the multi-vendor collaboration that would eventually define the project. The core maintainers formally committed to the direction at a December 2025 meeting on the future of MCP transports, according to the announcement. The trade-offs of removing state from the Model Context Protocol Protocol design is a game of trade-offs, and the maintainers were unusually candid about what this one cost. First, payloads get bigger. "A lot of the state doesn't disappear, but it's moved back and forth with the server on the wire, at the actual transport layer," Soria Parra explained. "You get bigger payloads in return for statelessness — but luckily they're very compressible and very well understood, and still fairly small in comparison to an HTTP request on the web." Second, a handful of rarely used capabilities are gone or narrowed. Out-of-band server logging — where a server could push informational log messages to a client at any moment — no longer works in the new model. The team did its homework before cutting it: "As part of the whole exercise, we scraped all of GitHub and looked at who is using it — and it's basically nobody," Soria Parra said. Those affected amount to "probably a handful of people — quite literally a handful of people." He even allowed himself a moment of engineering self-deprecation. "I'm sad that things I thought were useful turned out not to be useful," he said. "I think one of the bigger trade-offs was more about my ego than any actual limitation of the protocol." Delimarsky argued the shift is less a removal of state than a deliberate transfer of responsibility. "With statelessness, we did shift the responsibility of creating and managing state to the developers — but very intentionally so," he said. Under the old protocol, "a lot of folks had a hard time understanding: Do I need to use this? Where do I use this? How do I use this? Removing that burden basically says: look, now you can manage state in the way that makes sense for your environment." For most developers, migration should be nearly painless, because the vast majority of the ecosystem builds on official SDKs in TypeScript, Python, C#, Rust, Java, and other languages, which will absorb the changes. "One of the key things we constantly do is double-check that the upgrade path is minimal — to the point where any model in the world will probably one-shot it for you," Soria Parra said — a telling remark in itself, reflecting an era in which protocol maintainers now design migrations to be trivially executable by AI coding assistants. How a 12-month deprecation policy gives enterprises the stability guarantee they demanded Perhaps the most enterprise-flavored feature of the release isn't code at all. It's a policy. The new formal deprecation framework guarantees developers a minimum of twelve months between a feature's formal deprecation and its earliest possible removal — the kind of stability contract that lets a Fortune 500 engineering organization commit to a specification without fearing silent breakage. The number wasn't picked arbitrarily. "We consulted with folks like Google, Microsoft, and Amazon to find out: in your deployment environment, what's the right path for making these kinds of changes?" Delimarsky said. "Twelve months seemed like the reasonable middle ground." He stressed that features are not being torn out on a whim: "It's not about ripping stuff out of the protocol just because we don't like it. There's a very, very strong industry pull behind these changes." Soria Parra added that the maintainers' own telemetry supports the figure — most of the ecosystem upgrades within six to eight months — and stressed that the window functions more as a listening period than a countdown clock. "It just says that in 12 months we are open to remove it, but both Den and I can change our minds based on feedback," he said. "I think it's more of a feedback period than a definite period." Gilbert sees the policy as one leg of a three-legged stool of enterprise trust, alongside open standards and stateless scale. "There are companies deploying things at a smaller scale, but they're slowed down because of MCP's authorization gap, because of identity, because of — do they trust the deprecation policy? Things could change basically any day," he said. Those companies, he argued, "are going to benefit not because of the statelessness. They're going to benefit because of the security." New authentication hardening closes OAuth mix-up attacks before hackers could exploit them The release also ships significant authorization hardening, aligning MCP's auth specification with how OAuth 2.0 and OpenID Connect are actually deployed in practice. Most notably, the protocol now enforces mandatory validation of the issuer (iss) parameter — a protocol-level defense that, according to the announcement, closes an entire class of so-called mix-up attacks, in which a client can be tricked into associating an authorization response with the wrong identity server. Was anyone actually attacked? No, Delimarsky said — this was preventive engineering, not incident response. "This is not something that is gated in any existing vulnerabilities or active exploitation," he said. "This is more of us engaging directly with the security community." The philosophy, he explained, is to borrow rather than invent: "MCP as a protocol is very much establishing the pattern of: we do not want to reinvent the wheel, but we also want to be at the forefront of a lot of the security innovation." That posture is most visible in the new Enterprise Managed Authorization extension , developed in close collaboration with identity provider Okta, which lets organizations make their corporate identity provider the authoritative gatekeeper for MCP server access. "If I'm somebody that manages tens, hundreds of MCP servers for my organization, I want to make sure that I enforce some level of common governance, where folks auth with their corporate credentials and not their personal credentials, so that the client doesn't send data to sources that are unauthorized," Delimarsky said. Okta bootstrapped the underlying open standard, he noted, and the maintainers then worked "to make sure that it's adopted ecosystem-wide, and it's not something that is specific to only one vendor or provider." More is coming: Delimarsky said proposals are already on deck for demonstrated proof-of-possession and workload identity federation — capabilities requested by security teams running MCP in production. Gilbert connected the work to a broader maturation: "MCP has now bridged that gap with these authorization protocols, so it's basically now becoming what we call enterprise ready, versus an open lab sort of experiment." MCP Apps and Tasks become official extensions, pushing AI agents beyond text responses Two capabilities graduate to official extension status in this release, taking advantage of a new framework that lets extensions evolve on their own timelines, independent of the core specification — a structural choice that lets the protocol grow without bloating its core. MCP Apps allows servers to ship rich, interactive, server-rendered user interfaces directly into AI clients — moving agent output beyond walls of text toward dashboards, forms, and visualizations, and dramatically accelerating development of user-facing agentic applications, according to the announcement. MCP Tasks tackles the reality that not every tool call finishes in one round trip. Instead of holding fragile, long-lived connections open while a batch job or heavy computation grinds away, servers now return a durable task handle; clients can disconnect, crash, restart, and resume polling. "You've been processing some audio for a podcast or a video — it can notify back the client and say, hey, the task is done. You don't need to wait and keep the stream open," Delimarsky said. A third addition, multi-round-trip requests, lets servers and clients negotiate back and forth within a single logical operation. "It's not just a one-shot — over the stream, get the input and you're done," Delimarsky said. "You can actually interact, server to client, to get the right parameters to execute an action." Soria Parra emphasized that these capabilities emerged from the same source as the architectural overhaul: heavyweight production users. "This is a version that came together by some of the best distributed systems experts at Microsoft, Google, and others coming together and working on this for their specific needs — and the needs of the industry at large," he said. How independent is MCP from Anthropic under Linux Foundation governance? Anthropic created MCP in November 2024 and donated it to the newly formed AAIF under the Linux Foundation in December 2025, alongside founding projects from Block and OpenAI . Seven months later, the independence question still hangs over the project — and both sides addressed it head-on. Soria Parra was disarmingly direct about the residual power he holds. As lead maintainer and Anthropic employee, "I do have veto rights, technically," he acknowledged — "but I think we have never actively used it in any kind of discussion." The core maintainer group now spans Anthropic , Microsoft , OpenAI , Google , and Amazon , with contributions from companies like Block, and key decisions "are usually unanimous," he said. "Technically we have a lot of influence; de facto, we're not exerting any of it." He added that governance will progressively broaden: "As the project progresses, we will increasingly move to more different governing structures that include more and more people." Gilbert, who has helped stand up multiple foundations during his time working with the Linux Foundation , offered the numbers behind the neutrality claim. The AAIF has grown from roughly 40 members at its December inauguration to 240 today — "the fastest growing foundation" in Linux Foundation history by membership, he said, "signing up one member every day." Anthropic's share of contributions, by his estimate, has fallen below half. "Holding control of a project doesn't make it an open standard," Gilbert said. "You have to let go. You have to contribute, and you have to grow the pie and the community. And Anthropic has done an incredible job doing exactly that." Notably, the foundation's membership has expanded well beyond tech vendors into retail, finance, and telecom companies — adopters who, Gilbert says, "are no longer just deploying the protocols. They want a voice, and they want to be at the table to influence the protocol from the get-go, and that's something we have not seen before." The roster now includes CERN and, tellingly, Consumer Reports — "because somebody has to defend consumers when this internet of agents comes alive." Keeping one global AI agent standard amid US-China technology tensions The AAIF is betting that neutrality can hold even amid geopolitical friction. The foundation will host AGNTCon and MCPCon events this fall in Shanghai, Tokyo, Amsterdam, and San Jose, with additional events planned in South Korea, Nairobi, and Toronto, and Gilbert said he is personally investing in growing membership across Asia and India, where he sees underdeveloped growth markets for the foundation. His answer to the geopolitics question was emphatic model-agnosticism. "We're completely agnostic to what the model is, whether the model is Kimi, or Gemma, or a frontier model from Anthropic, or from anybody," he said. "Every model will have to support MCP — whether it is a Chinese model or whether it is a U.S. model, it doesn't matter. The protocols must be open, standardized." The logic is economic as much as diplomatic. Enterprises, Gilbert argued, increasingly pick models "left, right, and center" based on the task at hand — and no model, regardless of national origin, "can provide value to an enterprise 500 customer company unless you have the protocols open, standardized." In his telling, the foundation exists precisely to provide neutral ground: a place "where competitors who compete furiously during daytime" can "come to a neutral room and debate, converse, align, consolidate, and drive open standards of how the Internet of Agents will evolve." That framing echoes his favorite historical analogy. HTTP earned global trust, he said, because of three things: an open standard, stateless scalability, and neutral governance under a standards body. "If I were a Fortune 500 company looking at how I trust the internet, I'd need those three things to fall into place — and they were not in place a year ago. They were not in place even six months ago. But they are in place today." What 250 million weekly SDK downloads reveal about the future of agentic AI The scale of what's now riding on this specification is difficult to overstate. Soria Parra said SDK downloads have doubled in the past six months, reaching roughly 250 million per week — "which is just insane numbers." For context, Anthropic reported 97 million monthly downloads across just the Python and TypeScript SDKs when it donated the protocol in December 2025. Delimarsky pointed to that same adoption curve as his preferred success metric going forward: "There is certainly a certain inflection point where this is no longer just an open source project. This is a substrate for a lot of the agentic workflows that we see across enterprises, across startups, across all sorts of companies." Success, the maintainers say, will be measured in server counts on the new specification, in feedback flowing through working groups, GitHub discussions, and the project's Discord — and in whether the biggest drivers of the changes, Microsoft and Google among them, ship on it. "They are effectively the ones who have been driving a lot of the changes," Soria Parra said. "Every early indication we have — it looks very, very positive." Both maintainers closed on the same note: this release belongs to no single company. "If you look back 18 months ago, when it was an Anthropic-only project, and then 12 months ago, where there was a lot of engagement — now it's a truly global community," Soria Parra said. "I'm incredibly proud of what they have worked together." Delimarsky, "being very unoriginal," seconded him: the release "would not be possible without a large community of folks that are also volunteering a lot of their own time in making MCP successful." Gilbert, meanwhile, is already looking past this release — toward how MCP interlocks with the AAIF's newly announced Agent Gateway project for traffic management and policy enforcement, and toward agentic commerce, where MCP serves as the discovery layer letting merchants expose products and services to AI agents. The web took thirty years to become invisible infrastructure that billions trust without thinking. By Gilbert's reckoning, the internet of agents is "in its first, second year" — and as of today, it finally has plumbing built to carry the load.
JetBrains is urging customers of on-premise versions of TeamCity to update to the latest version following the discovery of a critical security issue that could result in arbitrary code execution. The vulnerability, assigned CVE-2026-63077 (CVSS score: 9.8), affects all TeamCity On-Premises versions. It has been addressed in versions 2025.11.7 and 2026.1.3. TeamCity Cloud instances have already
Hundreds of conversations with Anthropic’s chatbot were discovered as being publicly accessible.
1 point 0 comments on Hacker News · github.com
14 points 0 comments on Hacker News · golemui.com
Chinese AI startup Moonshot AI, creators of the increasingly famous "Kimi K" family of powerful, open AI models, today released the full weights for its largest and most performant version yet — Kimi K3 . But enterprises evaluating the model should read the attached custom Kimi K3 usage license as carefully as the benchmark charts. VentureBeat previously covered Kimi K3 when it debuted through Moonshot's hosted API earlier this month, including its 2.8 trillion-parameter architecture, one million-token context window and frontier benchmark performance. Today's announcement completes that rollout with the release of the full model weights, a 47-page technical report documenting its training innovations and obstacles, and much of the infrastructure required to run the model independently. That includes the complete 2.8 trillion-parameter Mixture-of-Experts model, inference infrastructure, optimized attention kernels, MoE communication libraries and deployment components aimed at researchers and enterprise developers who want to self-host the system rather than consume it exclusively through an API. Moonshot is also releasing implementation support for ecosystems including vLLM and SGLang, alongside a technical report detailing the architectural innovations behind the model, including Kimi Delta Attention, Attention Residuals and Stable LatentMoE. Together, those techniques underpin what the company describes as the world's first open 3T-class model, activating 104 billion parameters from a pool of 896 experts while supporting native multimodal reasoning and a one million-token context window. While Kimi K3's license grants broad rights to developers and even enterprises to download, modify and deploy the model for commercial purposes — a win for those seeking low-cost, frontier-level AI they can control and run offline — it also imposes some added obligations on larger companies and AI service providers not found in traditional open-source licenses like Apache 2.0 or MIT. The key restrictions enterprises should understand Here's the text of the new Kimi K3 License in full: Permission is hereby granted, free of charge, to any person (the "Licensee") obtaining a copy of this software — including the model weights, parameters, configuration files, inference and training code, and associated documentation (collectively, the "Software") — to deal in the Software without restriction. This includes, without limitation, the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software; to run, deploy, fine-tune, or otherwise modify the Software and create derivative works from it; and to permit persons to whom the Software is furnished to do so, in each case subject to the following conditions: 1. The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software. Licensee's use of the Software must comply with applicable laws and regulations. 2. "Model as a Service" means giving a third party access to language model inference or fine-tuning (e.g., via API) in a manner that allows such third party to exercise meaningful control over the inputs, parameters, or training data. This does not include (a) end-user products with model capabilities solely embedded within specific features or harnesses, or (b) mere relaying of requests to models hosted by others. If the Licensee or any of its affiliates operates a Model as a Service business, and the aggregate revenue of the Licensee and its affiliates exceeds 20 million US dollars (or the equivalent in other currencies) in total over any consecutive 12 months, the Licensee must enter into a separate agreement with Moonshot AI before using the Software or its derivative works for any commercial purpose. 3. If the Software (or any derivative works thereof) is used for any of the Licensee's commercial products or services that have more than 100 million monthly active users, or more than 20 million US dollars (or equivalent in other currencies) in monthly revenue, "Kimi K3" must be prominently displayed on the user interface of such product or service. 4. The requirements set forth in Sections 2 and 3 do not apply to: (a) internal use of the Software, defined as any use that does not make the Software, its outputs, or its underlying capabilities available to third parties; or (b) any use of the Software accessed through Moonshot AI's official products or certified inference partners. The most significant clause is 2., as it requires a separate commercial license from companies earning $20 million in annual revenue and operating what Moonshot calls a "Model as a Service," which it defines as "giving a third party access to language model inference or fine-tuning (e.g., via API) in a manner that allows such third party to exercise meaningful control over the inputs, parameters, or training data" but not " end-user products with model capabilities solely embedded within specific features or harnesses" or "mere relaying of requests to models hosted by others." That would seem to allow for free use of the model for most non-tech focused enterprises: banks and consumer brands seeking to use it as a front-end chatbot or customer service agent should be fine, since they're not using Kimi K3 as a "Model as a Service." But firms like they hyperscalers or startups offering model training tools might fall under the commercial license terms. The wording is further notable because it does not limit the revenue calculation to products built on Kimi K3. Instead, it references the aggregate revenue of the licensee and its affiliates, potentially bringing even smaller companies that are part of larger parents into the requirement that they must commercially license the model from Moonshot, pending the parent firm generates revenue of $20 million or more per year as is using it somewhere, in some capacity, as a "Model as a Service." Regardless of this requirement, in clause 3, the license also requires attribution once a commercial deployment reaches significant scale: "If the Software... is used for any of the Licensee's commercial products or services that have more than 100 million monthly active users, or more than 20 million US dollars in monthly revenue, 'Kimi K3' must be prominently displayed on the user interface." For enterprise software vendors, AI copilots and consumer applications, that branding requirement may prove just as significant as the revenue threshold. Companies that typically abstract away the underlying model may instead need to disclose it directly within their products. But, if your enterprise is sticking to using Kimi K3 internally as an employee tool for information retrieval, creating spreadsheets and documents, or answering employee questions, Moonshot offers a significant carve out, stating that clauses 2 and 3 "do not apply to: (a) internal use of the Software, defined as any use that does not make the Software, its outputs, or its underlying capabilities available to third parties." Developers immediately zeroed in on the license The licensing provisions quickly became one of the dominant topics of discussion following the release of the model weights. AI researcher Nathan Lambert, previously the co-leader of the Olmo family of open models at AI startup Ai2, summarized the issue in a post on X : "Kimi K3 license. It's inspired by MIT but distinctly non-commercial, where any company making over $20M/yr must get a specific commercial deal (and display Kimi K3 if over 100M users or $20M/mo revenue)." Lambert's assessment reflected what many developers noticed as they dug into the newly published license: while Kimi K3 offers unrestricted access to the model weights for researchers, startups and many enterprises, commercial obligations become significantly more complex for larger organizations. The broader community reaction was largely positive toward the release itself. Developers praised Moonshot for publishing not only the weights but also supporting infrastructure, including attention kernels, MoE communication libraries and agent tooling, viewing the release as a significant contribution to the open-weight AI ecosystem. Others highlighted the rapid pace of ecosystem support, with inference projects such as vLLM and SGLang, along with cloud providers and infrastructure partners, moving quickly to support Kimi K3 deployments. At the same time, discussion centered on two practical caveats. One was licensing: many developers argued the model is more accurately described as open weight than fully open source, given the commercial conditions attached to larger deployments. The other was operational. At roughly 1.5 TB of model weights, Kimi K3 remains a system aimed primarily at well-resourced organizations capable of operating large-scale inference infrastructure, even as reports emerged of successful deployments on clusters of consumer RTX 5090 GPUs. Not the first to customize open AI licensing Moonshot is far from the first frontier AI developer to embrace an "open, but not completely open" licensing strategy. Meta's Llama family, for example, has long been distributed under its own community license requiring a commercial agreement for those building with the model and exceeding 700 million monthly users, rather than a traditional open-source software license. Other frontier model developers have likewise adopted bespoke licensing terms governing redistribution, commercial use or attribution. Kimi K3 follows that broader trend, albeit with a different mechanism. Rather than broadly restricting redistribution, Moonshot ties certain commercial rights to company scale. Organizations operating a Model-as-a-Service business above specified revenue thresholds must negotiate a separate commercial agreement, while the largest commercial deployments must visibly attribute Kimi K3 within their products. For enterprises, the practical implication is that "open weights" and "open source" are becoming increasingly distinct concepts. Downloading and modifying frontier models may be straightforward; understanding the legal conditions attached to commercial deployment increasingly is not. What enterprise leaders should do next For CIOs, chief AI officers and engineering leaders, the first step is to determine how the organization intends to use Kimi K3 before evaluating its technical performance. If the model will remain entirely inside the organization—for example, supporting developers, researchers, legal teams or internal productivity workflows—the published license appears substantially more permissive. Those deployments may qualify as internal use under Moonshot's terms, avoiding the commercial licensing provisions that apply to customer-facing AI services. Organizations planning to build products on top of Kimi K3 should take a different approach. Legal, engineering and product leaders should determine whether the planned deployment constitutes "Model as a Service" under the license, whether the company or its affiliates exceed the $20 million revenue threshold, and whether future growth could trigger the requirement to negotiate a commercial agreement with Moonshot. Companies expecting products to reach more than 100 million monthly active users—or more than $20 million in monthly revenue—should also evaluate the license's attribution requirement and how it fits with existing branding, contractual commitments and white-label offerings. More broadly, Kimi K3 illustrates a transition taking shape across frontier AI. As the industry's most capable models increasingly become available as downloadable weights instead of exclusively through hosted APIs, enterprises will need to evaluate licensing terms with the same rigor they apply to benchmarks, security reviews and infrastructure planning. The next competitive battleground may not simply be whether AI models are open or closed, but the increasingly nuanced legal frameworks that determine who can commercialize them, under what conditions and at what scale.
Extreme fire conditions on the ground have created unprecedented conditions in the atmosphere.
Hacker News
“Kubernetes complexity is pushing teams back to boring servers”
