The Stack — October 26, 2026

Daily IT Briefing

Today's theme is claims versus verification. A wafer-scale vendor publishes its own inference math. A payments company demos a voice model nobody outside the company can test yet. Firmware sleuths make allegations about smart TVs that Samsung has not answered. An economist finds no AI payoff in the aggregate data. Meanwhile, the PHP2Shell aftermath keeps showing what happens when old infrastructure meets fast exploitation.

---

AI Infrastructure Cerebras details how it serves ~3T-parameter models across 59 wafers

Cerebras published a technical explainer on serving multi-trillion-parameter models at a claimed 1,000–2,000+ tokens/sec. The memory math is worth walking through even if you discount the marketing.

The setup

• Model: Kimi K3, described as an open-weight model with ~3T parameters.
• 93 layers in total: 69 linear-attention and 24 dense.
• Assumptions: 4-bit weights, 8-bit KV cache, and an average request of 256k tokens.
• Hardware: Each wafer has 44 GB of on-chip SRAM.

How the model maps onto wafers

• ~1.5 TB of weights across 93 layers comes to about 16 GB per layer.
• Linear-attention layers fit two per wafer. They keep only a small fixed-size state per request, so they need almost no KV cache. That gives 69 ÷ 2, or 35 wafers.
• Each dense layer gets its own wafer. The leftover ~28 GB is used as KV cache. That gives 24 wafers.
• Total: 59 wafers.

How the pipeline runs

• Weights never leave the chip. Only activations move between wafers, over RDMA over Ethernet at ~2 µs per hop.
• Each stage works on a different request or micro-batch, so the pipeline stays full. It is not effectively running at batch size 1.
• Production deployments use much finer-grained stages than the one-layer-per-stage example in the post.

The binding constraint

• KV cache on the dense-layer wafers limits concurrency. This is the real cost of the hybrid architecture: the linear-attention layers are cheap to host, and the 24 dense layers decide how many 256k-context requests can be in flight at once.
• Smaller micro-batches lower per-request latency, while larger ones raise throughput.
• Cerebras argues the right comparison metric is tokens/sec per megawatt at equal output speed. That framing naturally favors its own design.

Caveats

• This is vendor content that ends in sales calls to action.
• The benchmark figures it cites are not independently verified: 88.3% on Terminal-Bench 2.1 and 91.2% on BrowseComp, compared against "GPT-5.6 Sol."
• Several intermediate numbers, including concurrent-request totals, are missing from the text. You cannot fully check the economics from the post alone.

---

AI Models & Research Block previews Dessa, a full-duplex voice model that runs locally

Block's research lab announced Dessa, a voice model that listens and speaks at the same time. It is a research preview with no public access.

Architecture claims

• End-to-end speech. There is no speech-to-text step and no separate LLM behind it. Its knowledge comes from its conversational training data, which is an important limit on what it can know or reason about.
• Training scale: Block says it was trained entirely on human speech using a single NVIDIA GPU rack, which is a modest compute budget.
• Local inference on consumer hardware, starting at a MacBook M4 Max.
• Expressive output such as laughter, pauses and crying.

The emotion claim

• Block says emotion is native to the model. It contrasts this with ElevenLabs v4 and Fish Audio Drama 3, which use explicit voice tags.
• This has not been independently verified. It is also unclear whether some hidden tagging steers emotion behind the scenes.

Why it matters

• An on-device model cuts per-interaction inference costs. That could help Block expand voice features for merchants and consumers. Square already uses voice AI for ordering.
• Safety researchers have been invited to test it. Expect impersonation and deception to be the main concerns, since realistic emotional voice cloning is exactly the risk area.
• All demos so far are company-curated.

---

Cybersecurity & Privacy PHP2Shell: new angles on attribution, disclosure conduct and permanent site loss

Follow-up. The CVEs, patched versions and pre-disclosure exploitation timeline were covered Oct 22–25.

Who found the bug is now framed differently

• Today's reporting credits human researchers in the OpenAI/Wiz "Hack the Planet" initiative with the discovery. AI was used only to develop the exploit.
• It explicitly calls early "AI found the bug" reports wrong.
• This differs from earlier accounts, which said the bugs were first found in 2024, deemed unexploitable, and later proven exploitable by Calif. The two versions may describe different stages of the same history, but the attribution chain is still muddy.
• Either way, the defensible claim is narrower than the headlines: AI sped up weaponization, not discovery.

Disclosure criticism

• Parts of the security community are pushing back on OpenAI's handling of the disclosure. Critics specifically object to what they call self-promotional messaging around a critical vulnerability.

Scale of attempts

• Cloudflare CEO Matthew Prince now puts attempted exploits in the millions. That fits the exponential growth reported earlier.
• Amazon's honeypot network again confirms that activity came before the public announcement, and reports say the embargo broke early.

New concern: permanent site loss

• Government and popular sites went offline temporarily to patch.
• The new worry is smaller operators shutting sites down permanently rather than patching. That would accelerate link rot and lose content from the long tail of PHP-backed sites such as WordPress and Drupal.

Industry angle

• The incident strengthens the argument that AI-assisted exploit development will hit aging open-source infrastructure hardest.
• It may also open the market further for security startups focused on legacy-stack hardening.

Samsung TVs allegedly run on-device ML on screen content (unverified)

Two independent reverse-engineering claims, both shared on social media, allege Samsung TVs run on-device ML on what users watch and hear.

Claim 1: Screen-content classifier

• A user reports finding `alex.tflite` on the TVs. They describe it as an INT8-quantized AlexNet analyzing 960×540 screen captures every few seconds.
• Its apparent purpose is to identify which game is being played, using nearest-neighbor matching against a database.
• The poster says:
• It fails "99% of the time" and wastes CPU.
• It runs before the consent gate, though its results appear to be discarded at that point.
• Model graphs and captures were shared as evidence.

Claim 2: Audio and sensor telemetry

• A separate post alleges the TVs scan for Bluetooth microphones and classify household audio, such as dogs barking or babies crying.
• It also says telemetry paths include event counters, sensor preferences, camera streaming duration, and app and YouTube activity.
• The author used an "abliterated" (safety-filter-removed) DeepSeek model to help analyze the firmware. That adds interpretive risk.

How to read this

• The first claim comes with concrete artifacts, so it is the stronger of the two.
• Telemetry fields existing in code does not prove the data is collected or transmitted without consent.
• Samsung has not responded in available reporting.
• Both claims fit long-documented concerns about smart-TV automatic content recognition (ACR) but need independent confirmation.

---

Industry & Economy Apollo's chief economist: "zero financial payoff" from AI outside Big Tech

Torsten Slok looked at the "S&P 493," the S&P 500 excluding Alphabet, Amazon, Apple, Meta, Microsoft, Nvidia and Tesla.

Findings

• Profit margins and revenue per worker are flat, with no measurable AI-driven productivity gains.
• Slok doubts this is just adoption lag. He argues business value depends on judgment, accountability, trust and ethics, which AI doesn't handle.

Context

• This is one economist's read of aggregate data, not a firm-level study. Aggregate margins can hide gains in specific functions or companies.
• It is consistent with several recent studies finding limited AI productivity gains so far.

The tension with today's other stories

• Vendors are making ever-larger infrastructure and capability claims, such as 59-wafer pipelines and local full-duplex voice.
• Meanwhile, the clearest measurable AI impact this week was on the attack side: faster exploit development against PHP.