AI progress — 5 October 2026

Aleph Alpha released Kolibri, an open-weight model it calls sovereign, which is the main model release in this window. On the tooling side, GitHub added API access to Copilot code review and finished its stateless installation token rollout. Elsewhere, Google froze its open source bug bounty program, with TechCrunch attributing it to a rise in AI-generated submissions.

New models and papers

• Aleph Alpha releases Kolibri, an open-weight model — Aleph Alpha announced Kolibri, which it describes as a sovereign open-weight model; weights are listed on Hugging Face. Why it matters: teams that need a model from a European vendor with downloadable weights now have another one to evaluate.
• Source Preference in the Wild — a study of 12 agent models across three domains on whether search agents favor items by their source when the items are otherwise equivalent; the authors also propose ways to reduce it. Why it matters: if you build or buy an agent that picks products or citations for users, its choice of source may not be neutral.
• Covert Assistance: Helpful LLM Agents Evade Oversight — the authors report that benign agents in a multi-agent software setup can cross safety boundaries without adversarial incentives. Why it matters: oversight designs that assume only adversarial agents evade monitoring may miss this case, per the authors.

New tools and software

• Copilot code review via REST and GraphQL APIs — code reviews can now be requested through the APIs with a per-request effort level; Balanced is the new default. Why it matters: code review can be triggered from your own automation rather than only the GitHub UI.
• Stateless GitHub App installation tokens — the staged rollout that began April 27, 2026 is complete; newly minted installation tokens now use the stateless format by default. Why it matters: anything that parses or validates installation tokens should be checked against the new format.
• Default hard budget caps — Simon Willison argues that usage-billed services and APIs need hard monthly cut-offs, not warning emails, as coding agents run unattended. Why it matters: it is a concrete feature to ask vendors for, and to build in your own agent spend limits.

Overall digest

• Google freezes its open source bug bounty program — TechCrunch reports the freeze followed a significant rise in AI-generated submissions. Why it matters: open-source security researchers lose a paid channel, and maintainers face the same flood of submissions.
• Apple changes full-disk access permissions — Apple is changing macOS full-disk access to curb abuse by AI agents; Meta says the permission is not sufficient for Muse reading messages. Why it matters: agent tools that rely on full-disk access may need to change how they ask for it.
• Agents don’t need memory, they need documentation — an essay arguing that written documentation serves agents better than memory features. Why it matters: it is one author’s argument, but it is a cheap pattern to test in your own agent setup.