AI news 15 to 29 October 2026: what builders should act on

Four stories from 15 to 29 October 2026 are worth acting on. SGLang disclosed a cross-request cache exposure that affected Cloudflare's GLM-5.3 Workers AI deployment between 27 August and 9 September, and upgrades are available. The official MCP C# SDK 2.0 is stateless by default, which simplifies scaling MCP servers. Meta released Muse Spark Open, an open-weight model that is "local" only on workstation-class hardware. OpenAI's GPT-6.1 Terra was reported on 26 October at a lower price, but we could only confirm that through trade press. We checked each claim against the cited source on 29 October and left out several widely repeated items we could not confirm.

We read the primary source where one was available (SGLang's disclosure, Cisco's article, the TechCrunch and InfoQ reports) and attributed everything else. Daily digests and aggregator sites repeated several claims we could not confirm anywhere credible, so those are not here. Where a fact rests on secondary reporting, the section says so.

The SGLang project disclosed on 26 October a cross-request KV cache exposure in prefill-decode disaggregated serving, found after Cloudflare reported it on 9 September. In Cloudflare's case, @cf/zai-org/glm-5.3 on Workers AI was affected from 27 August to 9 September, and Cloudflare found no other Workers AI model affected. Cloudflare's own post carries the headline "Cross-request KV cache exposure in the GLM-5.3 Workers AI model"; we read the full SGLang disclosure and only that headline.

Three conditions all had to hold, according to SGLang: disaggregation was on with a KV cache transfer backend, a request ended mid-transfer with writes already launched, and the allocator reassigned the freed slots before those writes landed. Cloudflare's setup added a configuration mismatch, a 1,048,576-token context length against a 681,280-token prefill pool, and a request marked for rejection still proceeded through the handoff.

InfoQ reported on 26 October that the official MCP C# SDK 2.0 implements the 2026-07-28 revision of the specification, which it calls the largest revision since the protocol launched. The headline change is that HTTP is stateless by default: the initialize handshake and the Mcp-Session-Id header are gone, and protocol version and capabilities travel with every request.

For anyone running MCP servers behind a load balancer, the practical effect, as InfoQ describes it, is that any server instance can handle any request, so sticky routing and shared session stores are no longer needed, and gateways can route on Mcp-Method and Mcp-Name headers without reading the body. Roots, sampling and logging APIs are deprecated in the SDK, Tasks moved to an opt-in extension package, and OAuth handling is stricter. The SDK team's stated next focus is end-to-end authentication and authorisation.

Our MCP server security checklist for the 2026-07-28 spec covers the security side of the same revision. We have not tested the C# SDK ourselves, and a stateless default does not remove the need for per-call authorisation.

On 15 October Meta released Muse Spark Open, which TechCrunch reports has 816 billion parameters and a 1 million token context window, is natively multimodal, targets coding and agentic work, and is designed to run locally on Apple computers. It is also available through several API platforms. Meta says its own evaluations show it beating other popular open-weight models; we have not seen independent results.

"Local" needs a caveat. TechCrunch cites Engadget for a requirement of at least 1 TB of RAM, and says the model runs best on a Mac Studio with the M5 Ultra chip. TechCrunch's article does not state a licence, and we could not confirm one from a primary source, so read the model card before any commercial use.

Trade press reported on 26 October that OpenAI released GPT-6.1 Terra at about half the price of GPT-6.1 Sol, with StartupHub and AI Weekly giving $1 per million input tokens and $5 per million output tokens. We could not retrieve OpenAI's own page or a system card, so treat the price, the benchmark claims and any safety claims as unconfirmed. The useful reflex is the same whatever the number: check the provider's pricing page, then run your own evaluation set before switching, as in our guide to cutting LLM costs.

• Self-hosting SGLang with disaggregation: confirm your version and upgrade plan
• Compare configured context length with KV cache pool size on every serving tier
• Running MCP servers over HTTP: list anything that still relies on a session
• Hosted-model users: ask your inference provider whether cross-request isolation was in scope for their recent reviews
• Before any model switch: run your own evaluation set and check the provider's own pricing page

Was my data exposed by the SGLang cache bug? It could only affect deployments using SGLang's prefill-decode disaggregation. For Cloudflare, SGLang names @cf/zai-org/glm-5.3 on Workers AI between 27 August and 9 September 2026. SGLang also says logs cannot reliably show whether exposure occurred, so ask your provider directly.

Which SGLang version fixes the cache exposure? SGLang says v0.5.21, released on 2 October 2026, enables the deferred KV cache release by default for Mooncake and NIXL, and MORI deployments need v0.5.22 or later. Failed sends on NIXL and MORI stop being acknowledged as drained from v0.5.23.

What does stateless MCP mean for my server? Per InfoQ, the C# SDK 2.0 removes the initialize handshake and the session header, so any instance can serve any request. Servers that genuinely need sessions can set the Stateless option to false.

Can I run Muse Spark Open on my laptop? Probably not. TechCrunch cites Engadget for at least 1 TB of RAM, and says it runs best on a Mac Studio with the M5 Ultra. Hosted API platforms are the practical route for most teams.

Is the GPT-6.1 Terra price cut confirmed? Not by us. Several trade outlets report $1 per million input tokens and $5 per million output tokens, but we could not retrieve OpenAI's own page, so check the pricing page before you rely on it.

How do you decide what goes into a digest like this? We favour primary sources and items that change what an engineer does this week, we attribute secondary reporting, and we leave out claims we cannot confirm. Tell us through the contact page if we got something wrong and we will publish a correction.