OrcaCyber Zero 1.5 is OrcaRouter’s cybersecurity model, post-trained for authorized security research: vulnerability research and reproduction, exploit development, penetration testing and security auditing. It accepts text only and supports tool calling, structured output and optional reasoning, with a context window of about 1M tokens and up to 128,000 output tokens. Offensive work such as exploit or payload development is permitted only within a security engagement you are authorized to perform.It costs $3 per million input tokens ($0.75 cached) and $7.50 per million output tokens, and is pay-as-you-go only, not included in the subscription.

Hey @stani are you well?

Bye-nance

You can now limit where your API requests run. Turn on EU only under EU inference for API keys to apply it to all your API keys, or set Inference region in a single key's settings. Keys follow the account setting unless they set their own region.With EU inference on, the first route and every fallback must be a reviewed EU route for the model you request. If no EU route can serve a request, it fails with euinferenceroute_unavailable instead of running elsewhere. Most routes run in EU member states; some models run on European endpoints that can also be in the EEA, the UK or Switzerland. With Zero Data Retention also on, a route must meet both.More than 100 models have an EU route, including Claude, Gemini Flash Lite, Mistral, DeepSeek V4.1 Flash, GLM 5.3, Kimi and MiniMax M3. The setting lists every model and where its routes run. EU inference works with the Chat Completions, Messages and Responses APIs. GPT models, Auto Model, Decisions models, batches, web search, URL scraping, memory, PII redaction, your own provider keys, legacy @club/v1/completions, and image, video, audio and embedding endpoints are not available with it.EU requests count as choosing a provider: they are pay-as-you-go, not included in a subscription, and billed at the EU route's listed price plus the 5% provider-selection fee.The setting covers where models run. Requests still pass through NanoGPT's servers, and your account, billing, support and stored data are not moved to the EU. Web chat is not covered.

An AI agent named Skynet spent the summer hunting exposed AI endpoints. Symantec's honeypot caught it: 70+ offensive tools, 100,000 steps with no human watching, jailbreaking other models by telling them that reading .env files and API keys is normal development work. Then XMRig miners and stolen credentials, with victims paying the compute and token bills. 127,000 requests from tens of thousands of IPs.Every exposed LLM API and MCP server is being probed right now. The fix is boring and old: don't expose it, scope the permissions, sandbox the tools, approve sensitive actions yourself.An agent that can act should run where you can see it, on infrastructure you control, with a record of everything it did. Anything else is someone else's computer working for someone else.

Rune 26B-A4B is now available for classification, scoring and yes/no judgments. Ask up to 256 typed questions in one request and receive calibrated probabilities. Rune accepts text and JSON, supports up to 208 choice options and 2–10 score levels, and generates no conversational text or reasoning. Use @club/v1/decisions or @club/v1/systemone. Input costs $0.042 per million tokens, cached input $0.008 per million tokens, and output is free.

Your AI coding agent obeys whatever AGENTS.md sits in the folder you open. A web page can drop a file into your Downloads folder silently, no click, no prompt.Forever Security caught exactly that: a planted AGENTS.md in Downloads told the agent to install a malware-linked npm package. Codex ran it in over 90% of tests. A Claude Code variant that redirected API traffic to steal the session token worked about half the time.The fix is boring and local: never start an agent in ~/Downloads, read instruction files you did not write, and check your agent config for servers you did not add.Trust in the file is the feature. That is also the hole.

Gm

NVIDIA Releases Nemotron 3.5 Bolt E4B 4GB: An Open Small Language Model for Local Voice Agents, Game Characters and Robots

Kimi K3.1 Pro and Kimi K3.1 Pro Highspeed are now available! Both bring a 1M-token context window, text, image and video understanding, and tool calling for coding, document analysis and multi-step agent tasks. Reasoning is always enabled, with low, high and max effort levels to choose from.Early hands-on examples show K3.1 creating interactive websites and 3D scenes, including a train built from a single prompt with speed controls, an exploded view and a wireframe mode.