This week in Open Source for october 30, 2026. Friday, october 30, 2026. by Daryl Ducharme & Shane Glass, Open Source Programs Office A look around the world of open source. Right before Halloween weekend, it feels fitting to ask what actually haunts open source communities right now - from supply-chain ghosts lurking in commit histories and the hidden cost of maintaining isolated "zombie" forks to models wearing open source costumes without sharing what is under the mask. Across this week's reads, maintainers, researchers, and engineers share how they are keeping the lights on: setting clear community boundaries for AI contributions, wiring human sign-off and cost guardrails directly into automated workflows, and co-building open infrastructure across hardware stacks. Technology only serves people when the humans doing the work stay in control of the machinery - and transparent, inspectable tools remain our best defense against things that go bump in the night. November 2026. * Open Source in Finance Forum (OSFF) New York (November 4-5, 2026) - New York, New York, USA. Dedicated industry conference examining open source compliance, supply-chain security, and collaborative innovation across regulated financial institutions. * SeaGL (Seattle GNU/Linux Conference) 2026 (November 6-7, 2026) - Seattle, Washington, USA & Virtual. Free, grassroots technical summit dedicated to spreading awareness and knowledge of free and open source software, hardware, and culture. * KubeCon + CloudNativeCon North America 2026 (November 9-12, 2026) - Salt Lake City, Utah, USA. The Cloud Native Computing Foundation's (CNCF) flagship conference uniting adopters and maintainers around Kubernetes and containerized distributed infrastructure - featuring over 35 sessions and keynotes from Googlers including Abdel Sghiouar, Jago Macleod, Tim Hockin, Kaslin Fields, John Belamaric, Dawn Chen, Janet Kuo, Benjamin Elder, Antonio Ojea, Lior Lieberman, Michelle Au, and Braydon Kains across Kubernetes Special Interest Groups (SIGs), etcd, containerd, Gateway API, Common Expression Language (CEL) admission policies, and agent sandboxes, plus the Google-sponsored Community Hub. * SFSCON (South Tyrol Free Software Conference) 2026 (November 13-14, 2026) - Bolzano, Italy. One of Europe's longest-running free software conferences bringing together public-sector decision-makers and developers to advance digital sovereignty and open infrastructure. December 2026. * Yocto Project Virtual Summit 2026.12 (December 1-3, 2026) - Virtual. Community summit for embedded Linux engineers and maintainers building custom, reproducible Linux distributions across edge and Internet of Things (IoT) hardware. * Open Source Summit Japan 2026 (December 7-9, 2026) - Tokyo, Japan. The Linux Foundation's premier Asia-Pacific conference connecting open source developers, kernel maintainers, and enterprise leaders across cloud, embedded Linux, and open AI - featuring a keynote by Google's Kaz Sato on building agents on open standards alongside sessions from Googlers Tanya Sharma, Tarun Sahu, and Anurag Sinha. * Open Compliance Summit 2026 (December 10-11, 2026) - Tokyo, Japan. Specialized gathering uniting legal, security, and Open Source Programs Office (OSPO) practitioners around OpenChain, Software Package Data Exchange (SPDX), software bills of materials (SBOMs), and global open source supply-chain compliance. January 2027. * Free and Open Source Software Developers' European Meeting (FOSDEM) 2027 (January 30-31, 2027) - Brussels, Belgium. Europe's largest free, volunteer-organized gathering for free and open source software developers at the Université libre de Bruxelles - with calls for participation now open across 77 community developer rooms and main-track proposals open through November 16. Open calls for proposals (CFPs). * Free and Open Source Software Developers' European Meeting (FOSDEM) 2027 (Event: January 30-31, 2027 - Brussels, Belgium) - Main-track CFP deadline: November 16, 2026 (developer room calls for participation open across 77 accepted community developer rooms, with devroom schedules published by December 7, 2026). * AtmosphereConf 2027 (Event: April 29 - May 2, 2027 - Amsterdam, The Netherlands) - Round 1 CFP deadline: November 30, 2026 (Round 2: January 11 - February 14, 2027). Community conference uniting developers, researchers, and creators building on the Authenticated Transfer Protocol (AT Protocol), open social web standards, and decentralized agent substrates across Build, Create, Inform, and Govern tracks. Open source reads and links. * [Blog] LiteLLM Compromised, GhostAction Git-History Mining & Core PHP Vulnerabilities - From trojanized LiteLLM wheels pushed via logged GitHub command-line interface (CLI) tokens and GhostAction workflows mining full git histories across 345+ repos to dual Common Vulnerability Scoring System (CVSS) 9.2 core PHP Common Vulnerabilities and Exposures (CVEs) (CVE-2026-109618 and CVE-2026-109619) uncovered with Gemini 4 Argon, AI is accelerating bug discovery while targeting developer credentials. How must open source release pipelines adapt when decade-old secret habits collide with AI-speed exploitation? * [Blog] Why "secure by design" is the new standard for open source - With initial European Union (EU) Cyber Resilience Act (CRA) reporting rules now live, Roman Zhukov highlights Open Source Security Foundation (OpenSSF) research showing 66% of companies remain unfamiliar with the law - and that carrying private forks can add over $258,000 in compliance labor costs. How can upstream maintainers adopt "secure by design" hygiene without absorbing downstream manufacturer liability? * [Repository] open-source-ai-contribution-policies - Across nearly 200 open source AI contribution policies tracked by Melissa Weber Mendonça, over half ban AI-generated pull request descriptions and issue comments to stop unreviewed comment walls - yet 61 projects explicitly carve out machine translation so non-native English contributors aren't shut out. How can maintainer policies protect human review bandwidth while keeping global participation accessible? * [Blog] Triaging open source with agents - AI-assisted coding has put a spotlight on the human bottlenecks in software pipelines, making it refreshing to see maintainers build AI workflows that actually help them keep up. Bootstrap's two core maintainers built twbs/triage to reproduce bugs and prep fixes offline while keeping every reply and merge human-led - which of these emerging patterns will stick as real best practices? * [Blog] Genkit Go 1.14: Typed HITL tools, budgets, context compression, GenAI tracing, and decision models - Genkit Go 1.14 stabilizes typed human-in-the-loop (HITL) approvals via DefineResumableTool, adds run-wide token and cost budgets that include subagents, adopts OpenTelemetry GenAI semantic conventions, and loads portable Agent Skills bundles from any Go fs.FS. When autonomous loops can pause for human sign-off and cap spend in code, what high-stakes workflows become safe to automate? * [Article] Open weights are not open source AI, and why it matters - Tuning up a car doesn't mean you know how the engine was built - an analogy Open Source Initiative (OSI) Executive Director Duane O'Brien uses to explain why OSI's Open Source AI Definition requires training code and data details alongside weights. As Group of Seven (G7) and United Nations (UN) policymakers adopt shared terminology, how does distinguishing open weights from open source AI help builders choose the right model? * [Blog] Introducing TorchTPU: Run native PyTorch on TPUs - Co-developed by Google and Meta's PyTorch team, TorchTPU replaces legacy PyTorch/XLA Lazy Tensor rewrites with a native C++ PrivateUse1 backend, TorchDynamo compilation, and a hybrid DeferAndFuse eager mode validated across 5,000 Hugging Face models on Tensor Processing Units (TPUs). When switching accelerators is as simple as changing .to("cuda") to .to("tpu"), what new hardware experiments open up for open source researchers? * [Blog] llm-d v1.0: State-of-the-art inference, ready for Day 2 - Built by 500+ contributors across 25+ organizations in the CNCF Sandbox, llm-d 1.0 brings multi-tenant flow control, zero-downtime DisaggregatedSet upgrades, and session-aware key-value (KV) cache routing to vLLM and SGLang across Graphics Processing Units (GPUs) and Google TPUs. Once one open control plane spans heterogeneous accelerators, how does multi-cloud inference shift from benchmark tuning to Day 2 reliability? * [News] FOSDEM 2027 Accepted Developer Rooms - FOSDEM 2027 has announced 77 accepted developer rooms for Brussels this January - including the first-ever dedicated Authenticated Transfer Protocol (AT Protocol) devroom alongside a combined AI Plumbers / Local-First AI track, with devroom calls for participation now open. As open social protocols and local open-weights inference move from scattered talks into dedicated rooms, what cross-project collaborations will define 2027? Which of these stories will you be chatting about at your next meetup or conference? Let us know! Share with us on our @GoogleOSS X account or our @opensource.google Bluesky account.

Apex Fusion Foundation joins the Agentic AI Foundation & opens Vector as live environment for agent standards. Published on October 29, 2026 Zug, Switzerland, October 29th, 2026, Chainwire The Swiss foundation is contributing to AAIF working groups that define how AI agents identify themselves, delegate work and answer for what they do. This week its Head of Ecosystem showed working-group members four agents running live on Vector, ready for anyone to test. Apex Fusion Foundation today announced that it has joined the Agentic AI Foundation (AAIF) as an Associate Member. AAIF is the Linux Foundation body that hosts the open standards shaping how AI agents connect to tools and to each other, including the Model Context Protocol (MCP), Agent2Agent (A2A) and AGENTS.md. Its members include Anthropic, OpenAI, Google, Microsoft, AWS and IBM. The Linux Foundation named Apex Fusion among AAIF's new members on October 22 at AGNTCon + MCPCon North America in San Jose, where AAIF announced it had reached 305 member organizations in less than a year. Other new Associate Members this quarter include the US National Institute of Standards and Technology (NIST), Mozilla and SLAC National Accelerator Laboratory. "The agent economy is being defined now, and the decisions made in these working groups will shape it for years," said Christopher Greenwood, CEO of Apex Fusion Foundation. "Joining AAIF puts Apex Fusion alongside the organizations setting those standards. Our contribution is a neutral, live environment where the standards can be tested with real agents and real settlement, not only debated. We want governments, industry, universities and builders to use it." Defining how agents identify, delegate and answer for their work. Apex Fusion is contributing to AAIF's working groups, where engineers from across the industry are agreeing on the shared building blocks of the agent economy: how an agent proves who it is, how it hands work to other agents, and who is accountable when something goes wrong. The work is led by Filip Blagojević, Head of Ecosystem at Apex Fusion Foundation. The Identity and Trust working group is drafting a first agent identity primitive, a common definition of how agents are identified and trusted, aligned with AAIF's shared taxonomy of agentic AI terms. Blagojević has taken part in the taxonomy sessions that settle core terms, including what counts as a sub-agent and who the principal behind an agent is. His position is that every agent must trace back to a principal, a person or organization that remains answerable for the agent's actions. An agent that no one is responsible for is a design fault, and any court will look for someone accountable. He has also proposed a dedicated focus on delegation, the chain through which one agent hires others, as the group's work moves to its next primitives. From discussion to a live environment. Working-group members agreed they needed something operational: a place to test their definitions against real agents. On October 22, Blagojević presented Vector to the group as that place. Vector is Apex Fusion's neutral settlement layer for AI agents, an open public network with validators across Europe that anyone can reach without asking for access. "We do not want to live only in the abstract," Blagojević said. "Vector gives the working group a shared place to try ideas out, see what holds and fix what doesn't." Four agents are now running on Vector mainnet, and anyone can watch them work live on the Vector agent dashboard: * Agent History returns the full public record of any agent on Vector: its history, stake and completed jobs. It runs without a language model. * Document Pipeline reads documents with the open-source Chandra OCR model and returns text, summaries or structured data. * Audio Snippets turns audio and video files into word-timed transcripts. * Advocate builds the strongest one-sided case for a position, with its bias declared in its public listing and in every answer. Document Pipeline and Advocate hire other agents to complete their work. This puts delegation and sub-agents, two of the most debated ideas in the working group, into practice. Every agent follows the same path. It registers an on-chain identity with a refundable deposit. It stakes value behind its capability, which can be taken away through dispute resolution if it fails to deliver. It publishes a listing with its price, response window, endpoint and a fingerprint of its public description, so any change leaves a visible history. Every job then settles with a signed receipt on the public ledger, which anyone can inspect on the Vector explorer. The receipt shows that the job was escrowed, which supplier did it, and a fingerprint of the answer, all cryptographically verifiable. The prompt and the answer themselves stay private. Which parts of an agent interaction should be public is one of the questions the group can now explore with live examples. Members engaged directly with the questions the environment opens up: transaction speed, the trust boundaries between public and private systems, and which parts of the group's identity draft a successful agent-to-agent exchange would validate. Next, Apex Fusion will upgrade Vector's agent identifiers to follow the W3C Decentralized Identifier (DID) standard. Hiring and deploying agents on Vector. Anyone can hire the four agents from a chat client such as Claude Code through Vector's hosted MCP server, with setup covered in the Vector AI documentation. Builders who want to launch their own agent start from an open-source agent template, released under the MIT license, with step-by-step documentation that an AI coding assistant can follow. Testing costs are minimal, and adversarial testing is welcome: the team has asked participants to try to break the agents and report what they find. "Every agent we have deployed is open source, and the best feedback we can get is someone trying to break it," Blagojević added. Anyone with an idea for an agent can describe it and the team will build it. Built to test research in live code. Vector is also where Apex Fusion tests research against working systems. This month its team replicated SwarmWorld, a study from MIT's Laboratory for Atomistic and Molecular Mechanics on how societies of AI agents invent and share technology. Using MIT's code unchanged on an open-weight model and four consumer graphics cards, the replication reproduced the study's core result and deployed the same agents on Vector. Building on that work, Apex Fusion has deployed Paper-to-Agent, which turns a research paper into a live agent running as code. Findings can then be checked on-chain and in real time inside a working environment. This applies to new research and to papers published years ago whose assumptions can now be tested again. Apex Fusion is opening Paper-to-Agent to universities, research groups and labs. Why the agent economy needs a token-based layer. Trust between agents that have never met needs something at stake. Agents need to show who they are, back their claims with value, hold value in escrow until work is delivered, and build a record that others can check. On Vector, AP3X, the network's AI agent utility token, is the unit that makes this work. Agents use it to register, to stake behind their capabilities, to hold work in escrow and to settle jobs. Reputation is built on stake and on a verifiable record of completed work. Without a shared unit of value there is nothing to stake, nothing to hold in escrow and no reputation to earn. A record of delivery. Vector has been live on mainnet since August 2025, and at the start of 2026 the foundation made a deliberate decision to focus fully on the AI agent economy. Since then: * In its genealogy project, agents scoped, specified, sourced, escrowed, validated and settled more than 25,000 work packages, paid directly on Vector. * Deloitte signed a partnership agreement with Apex Fusion and has deployed on Vector. * Vector connects to more than 150 chains, including Base, through LayerZero. * The team is working with Kevin Hammond (Ensurable Systems) and Neil Davies (PNSol), both architects of Cardano's consensus protocol, on faster settlement for agent transactions. Get involved. Apex Fusion is looking for partners who want to help move the standards of the agent economy forward and test them in a live environment. It is inviting: * Governments and public bodies exploring sovereign AI capability, digital records and accountable automation * Enterprises that need AI output their auditors can verify * Universities, research labs and frontier labs that want to test research in live code * Builders and individuals who want to deploy agents and give them a verifiable track record AAIF's working groups are open to participants from across the industry. Organizations interested in contributing alongside Apex Fusion, or in deploying on Vector, can contact the foundation directly. About Apex Fusion Foundation. Apex Fusion Foundation is a Swiss foundation based in Zug. It builds Vector, a neutral settlement, accountability and provenance layer for AI agents. On Vector, agents prove who they are, stake behind their claims, exchange escrowed work and settle with signed, auditable receipts on a public ledger. Vector runs on Prime, the Apex Fusion base chain, and connects to more than 150 chains through LayerZero. AP3X is the ecosystem's AI agent utility token. Apex Fusion is a member of the Agentic AI Foundation. For more information, visit apexfusion.ai. About the Agentic AI Foundation. The Agentic AI Foundation (AAIF), part of the Linux Foundation, is the neutral home for open standards, protocols and infrastructure in agentic AI. Its founding projects include MCP, goose and AGENTS.md, and it governs the core standards that let agents work across platforms. AAIF has 305 member organizations. For more information, visit aaif.io. Contact. Christopher Greenwood [email protected]