Preview: Moonshot AI drops a 2.8T parameter model, while Ollama faces a critical CVE.
Hey — This week we saw the release of Kimi K3, a massive model that pushes the boundaries of open weights, even if running it remains a dream for most of us. It forces us to ask what scale really means for the future of local systems.
🔥 This Week's Big One
Kimi K3 (Moonshot AI)
Moonshot AI has released the open weights for Kimi K3, a 2.8-trillion-parameter Mixture-of-Experts (MoE) multimodal reasoning model featuring a 1M-token context window. While its sheer scale makes running the full model impractical on consumer hardware, it sets a new baseline for open-weight capabilities, with community-compressed versions already beginning to emerge. This release signals that open-weight models are actively contesting the frontier space previously dominated by closed API providers. [https://huggingface.co/moonshotai]
🧠 Model Releases
- K-EXAONE 2.0 (LG AI Research) — A 750-billion-parameter multilingual foundation model supporting 10 languages released under the Apache 2.0 license. It represents South Korea's largest open-weight release to date and includes quantized formats optimized for high-end local workstations. [https://huggingface.co/LGAI-EXAONE]
- Laguna-XS-2.1 (poolside) — A 33B parameter MoE coding model with a 262k context window and active reasoning capabilities. Its small activated footprint of 3B parameters per token makes it highly efficient for running long-context local coding agents. [https://huggingface.co/poolside/Laguna-XS-2.1]
🛠 LM Studio / Ollama
- Ollama CVE-2026-7482 ("Bleeding Llama") — A critical heap out-of-bounds read vulnerability (CVSS 9.1) in Ollama's GGUF loader that allows unauthenticated attackers to exfiltrate API keys and session data. If you expose Ollama beyond localhost, update to version v0.17.1+ immediately to patch this exposure. [https://nvd.nist.gov/vuln/detail/CVE-2026-7482]
- llama.cpp Native MCP stdio Support — The `llama-server` web UI now natively connects to external Model Context Protocol (MCP) servers via stdio. This enables locally run GGUF models to call filesystems, databases, and search tools without requiring third-party bridge integrations. [https://github.com/ggml-org/llama.cpp/pull/26062]
🤖 Agents & Frameworks
- OpenWorker (andrewyng/openworker) — Andrew Ng's team launched an open-source, local-first desktop coworker framework built with Tauri, React, and Python. It utilizes local models via Ollama to automate tasks like email triaging and report drafting with built-in human-in-the-loop approvals. [https://github.com/andrewyng/openworker]
- MCP Stateless Specification — A major revision to the Model Context Protocol removes session state entirely, moving metadata into per-request envelopes. This change simplifies containerization and allows remote MCP servers to scale horizontally behind standard load balancers. [https://github.com/modelcontextprotocol/specification]
📦 Tools & Repos
- Unsloth AMD GPU Support — Unsloth has released official support for local LLM training and inference on consumer AMD GPUs (Radeon 7000/9000 series, Instinct, and Ryzen AI Max). It delivers up to 2x faster speeds and 70% VRAM savings compared to baseline ROCm setups. [https://github.com/unslothai/unsloth]
- Numbat (perplexityai/numbat) — Perplexity open-sourced an agent-detection and response security suite designed to run locally on endpoints. It monitors agent activity in real-time and uses locally evaluated Common Expression Language (CEL) rules to prevent unauthorized file access. [https://github.com/perplexityai/numbat]
⚡ Quick Hits
- TurboFieldfare — An open-source Swift/Metal runtime demonstrating that a 26B Gemma 4 MoE model can run on an 8GB Mac by streaming expert weights directly from the SSD. [https://github.com/drumih/turbo-fieldfare]
- Apple Silicon vs. NVIDIA RTX 5090 Scaling — Performance benchmarks show the RTX 5090 leading in raw interactive speed (200+ t/s on 8B), while Apple Silicon's unified memory remains superior for hosting large 70B+ models locally. [https://github.com/ml-explore/mlx]
If you are testing sparse reasoning models or setting up local agent workflows this week, prioritize keeping your context window bounds well within physical memory parameters before adding agentic complexity.
— Himanshu
