AI news, October 25, 2026: Kimi K3.1 Pro, Node2Shell patch urgency, Block's local voice model Dessa

Moonshot releases Kimi K3.1 Pro, with open weights promised by November 4

Moonshot AI launched Kimi K3.1 Pro and a Highspeed variant it says runs 2–3x faster, both with a 1-million-token context window and available in the Kimi apps, Kimi Code and the Kimi API today. Moonshot reports 65.7% on Terminal-Bench 4.0, just behind Claude Opus 5.5 at 66.4%, and says the full weights will be published by November 4. Artificial Analysis lists it at 2.8T total and 104B active parameters, priced at $2 input and $10 output per million tokens, and ranks it 4th on its Intelligence Index with a score of 55.

Why it matters for makers: if the weights ship as promised, a near-frontier coding model becomes something you can host or pick from cheaper third-party providers.

Sources: Kimi blog, Artificial Analysis, Bloomberg

Node2Shell: researchers show remote code execution through Node.js's Brotli decoder

Node.js fixed CVE-2026-111497 on October 21, an out-of-bounds write in its bundled Brotli decoder that can lead to crashes, memory disclosure or remote code execution when an app decompresses attacker-controlled Brotli data. The advisory credits OpenAI Codex Security researchers with the report. Imperva's red team has since demonstrated code execution against the official Node.js 24.22.0 image, both through Express 5 and body-parser 2 decoding request bodies and through built-in fetch() reading a compressed response, and Singapore's Cyber Security Agency rates it critical.

Why it matters for makers: upgrade to 22.23.4, 24.22.1 or 26.12.1 or later, including the Node binary inside Docker images and serverless runtimes; Node 20 and older get no fix.

Sources: Node.js security release, Imperva, CSA Singapore

Block shows Dessa, a full-duplex voice model that runs on a laptop

Block's research lab released Dessa, a voice model that listens and talks at the same time and adds human-like laughs, pauses and cries. Block says it was trained entirely on human speech using a single NVIDIA GPU rack and that it can run locally on a MacBook with an M4 Max chip or better. There is no public access yet; Block is asking safety researchers to test it first, which TechCrunch links to the risk of voice agents deceiving people.

Source: TechCrunch

GitHub's Copilot metrics now show which tools developers use it from

The Copilot usage metrics API adds a totals_by_client breakdown that reports requests, sessions and tokens per tool, including OpenCode, Claude Code, Codex, Zed, VS Code and JetBrains, with a further split by model. GitHub says those tools often send no editor telemetry, so their usage was missing from earlier reports. A separate update names custom skills, agents and MCP servers in the reports instead of grouping them as "other".

Sources: GitHub Changelog: usage by client, GitHub Changelog: custom skills and agents

Jassy: AWS capacity is sold out for 2026 and largely for 2027

On the a16z Show, Amazon CEO Andy Jassy said AWS has sold out its capacity for this year, 2027 is largely sold out and "a good chunk" of 2028 is already committed, with some capacity always kept for on-demand customers. He said roughly $220 billion in 2026 capital spending still leaves demand unmet and that inference remains "an order of magnitude too expensive" for enterprises to use everywhere. He also said existing customers won't be squeezed out in favor of AI labs.

Why it matters for makers: expect GPU and inference capacity to stay tight, which favors smaller models and providers you can switch between.

Source: WebProNews