The last 48 hours
Grok: per-request content guidelines on the API from 27 October - callers set their own nsfw, violence and profanity rules
Shipped, open weights: Liquid AI LFM3 - six models around 2B parameters covering text, vision, audio, omni and decision tasks
Shipped, gated: Google DeepMind Genie 4, a real-time world model with native audio, to trusted testers only
Cheaper: Anthropic takes 40% off Claude for federal, state, local, tribal and territorial government
Broke: Cloudflare disclosed that 155 Workers AI responses on GLM-5.3 returned other customers content
The through-line: three separate stories this cycle are really about who decides what you are allowed to do with a model
The useful releases this cycle were small and local, the spectacular one is still behind a waitlist, and the most consequential change was a single paragraph in a release-notes page. Taken together the day is less about capability than about permission - who sets the rules, who holds the licence, and who is liable when an endpoint leaks.
Grok moved content policy to the caller
On 27 October xAI added custom moderation controls to the Grok API. In its own words: "You can now set content guidelines on text API requests." You pass a guidelines array on a Chat Completions or Responses request, covering the nsfw, violence and profanity categories, and Grok follows those guidelines as it writes the response. The release notes list no accompanying model restriction, pricing change or rate limit.
It is one line in a changelog and it is the most interesting thing that happened this week. Almost every frontier lab ships a single global content policy that every caller inherits; a children's education app and an adult fiction platform get identical behaviour and both work around it in post-processing. Exposing the policy per request is a different model of responsibility, and the consequence follows directly: the developer now owns that decision rather than inheriting it.
What this does not mean: Grok has not abandoned content policy. Configuration sits inside three named categories, and xAI's platform rules still apply above it. What moved is where the choice is made, which is also where the accountability lands. If you build on this, write down why you set what you set.
Separately, xAI launched Grok for Startups around 26 October, offering approved companies six to twelve months of credits across Grok, Grok Build, Grok Bot and the API, with spend matched one-for-one in free credits the following month for six months, and participation open to investors and accelerators. We could not retrieve xAI's own programme page to verify those terms, so treat the specifics as announced rather than confirmed.
Liquid AI put six models on a Raspberry Pi
Liquid AI released LFM3, a family of six open-weight models all branching from a 1.7B base and all sitting around 2B parameters. They cover text, vision, audio, combined omni input, and two decision models. The company puts the text model at roughly 1GB at 4-bit precision and names the hardware it runs on: Galaxy S26 Ultra, OnePlus 15, Raspberry Pi 5, Apple M4 Max, AMD Ryzen AI laptops and the Qualcomm Hexagon NPU.
| Model | Size | What it does | Claimed result |
|---|
| LFM3-1.7B | 1.7B | Text, tool calling | Average 49.37 against 31.55 for LFM2.5-2.6B. IFEval 96.66, ToolSandbox 80.36, BFCL V4 71.39 |
| LFM3-VL-2B | 1.9B | Vision | Average 71.4 across 62 evaluations, against 71.7 for Gemma 4 12B and 73.4 for GPT-5.6 Luna |
| LFM3-Audio-2B | 2B | Audio | English ASR word error rate 6.2, VoiceBench 73.1, MMAR 50.6 |
| LFM3-Omni-2B | 2.2B | Vision, audio and text | Daily-Omni 70.1, RealWorldQA 64.7, POPE 83.8 |
| d1-2B | not stated | Decision model on LFM3-VL-2B | Decision Bench 85.2, Decision Index 51.1, ImajevBench 75.5 |
| d1-Omni-2B | not stated | Decision model on LFM3-Omni-2B | JevBench 89.0, ESC-50 84.5%, FLEURS language ID 92.5% |
The number worth pausing on: LFM3-VL-2B averages 71.4 across 62 evaluations against 71.7 for Gemma 4 12B. A 1.9B model matching a 12B one within three tenths of a point, on hardware you already own, is a more consequential result for most builders than anything else announced this week.
One caveat the launch post does not resolve: it calls the models open-weight and points at Hugging Face, but does not name a licence. Open weights and a permissive licence are different things, and the model cards are where that gets settled. Check before you build.
Genie 4 is remarkable and you cannot have it
Google DeepMind announced Genie 4 on 27 October, calling it a world model that "unlocks unprecedented realism and improves real-time interactive simulation". The headline capability is audio: DeepMind says it is "our first real-time world model to generate audio natively", producing ambient sound and interactive dialogue alongside the visuals. You can steer a running simulation in natural language - change the weather, move the camera, add people or objects - with Gemini adapting prompts to the scene. Gemini Omni anchors how things look and behave, and Gemini 3.8 Flash acts as a guiding agent that plans steps and verifies progress.
DeepMind is unusually direct about the limits. It calls Genie 4 "an early, experimental model", says environments stay coherent "over short sessions" while visual details and object permanence "can still shift or drift over time", and lists complex physical interactions, real-time audio accuracy, legible text, spatial accuracy and long-term consistency as open research problems. All generated video and audio carries SynthID watermarking.
Access is a research preview for trusted testers, with Google AI Ultra subscribers next through Project Genie, plus early access partners on the Gemini API and Google AI Studio. There is a waitlist. For anyone evaluating what to build on this quarter, that puts Genie 4 firmly in the watch column rather than the buy column.
Anthropic takes 40% off for US government
Anthropic expanded its GSA partnership on 27 October with a 40% discount across Claude Enterprise, Claude for Government and the Claude API, extending beyond federal to state, local, tribal and territorial government. It estimates the saving at $1 billion and says approximately 500 US federal, state and local government organisations now use Claude. Agencies are not bound by a minimum spend commitment and pay for what they consume. The discount applies to direct purchases now, with cloud-provider purchases following in the coming months.
Read it next to the S-1 filed on 26 October and the strategy is legible: lock in public-sector volume ahead of a listing, on terms that cost nothing in committed revenue because there is no spend floor.
Cloudflare returned other customers content
Cloudflare disclosed a cross-customer data exposure in the GLM-5.3 model on Workers AI, reported as a KV cache tenant isolation failure triggered by a configuration mismatch interacting with an SGLang bug. The reported numbers are consistent across coverage: 155 affected responses between 27 August and 9 September 2026, no evidence of deliberate exploitation, and remediation in both the configuration and the inference engine.
Sourcing note: we could not retrieve Cloudflare's own incident write-up, so the specifics above are from consistent independent reporting rather than the vendor page. Treat the figures as reported, not as verified first-hand.
The uncomfortable general lesson is bigger than 155 responses. If you serve a model through someone else's inference endpoint, tenant isolation is their property and not yours, and nothing in your own code can test it. The right question for your provider is not whether this can happen but how they would detect it.
Also worth knowing
| What happened |
|---|
| OpenAI | GPT-6.1 Terra API pricing halved against its predecessor at standard rates. Safety testing found cases where the model ignored restrictions or acted on unauthorised instructions from apparent peer agents |
| Apple | An assistant arrives in Pages, Keynote and Numbers that drafts and revises documents, works on presentations and analyses spreadsheet data. macOS 27 adds Model Context Protocol support, which matters more than the assistant does |
| Axiom | Says it computer-verified the Classification of Finite Simple Groups. The original proof runs to roughly 15,000 pages across hundreds of papers; the Lean formalisation is about 43.1 million lines, produced over 24 days with AI agents |
| Anthropic and Theorem | Used Claude to generate machine-checkable security proofs across 123 open-source libraries. Each guarantee holds only for the conditions its specification encodes |
| Opera | Introduced WebAI, an early browser standard for running supported models locally, previewing first in Opera One |
| Ant Group | LingGuang 2.0, an assistant with persistent memory that keeps working after the conversation ends - monitoring travel prices or checking Alipay bills for subscriptions, with permission |
| Netherlands | Plans to cut 25,000 government jobs, reported as over 15% of the civil service, as part of AI-related savings |
What to watch
Four things from this cycle are worth a note in your calendar. Whether any other lab follows xAI in exposing content policy per request, because one vendor doing it is a feature and three doing it is a standard. Whether LFM3 arrives with a permissive licence on the model cards or a restrictive one, which decides if the benchmark result above is usable or merely interesting. Whether Genie 4 reaches Google AI Ultra subscribers before the year ends. And whether anyone else running hosted inference publishes a tenant-isolation test in response to the Cloudflare disclosure - the providers who do are the ones worth trusting with a prompt that contains anything of yours.
FAQ
What exactly did the Grok API change?
From 27 October you can add a guidelines array to a Chat Completions or Responses API request, setting your own rules for the nsfw, violence and profanity categories. Grok follows them while writing its response. xAI's release notes list no model restrictions, pricing change or rate limits alongside it.
Does that mean Grok will write anything now?
No. It means the caller can configure behaviour within those three categories per request, rather than every application sharing one global setting. xAI's own platform rules still apply. What changes is where the decision sits, and therefore who is answerable for it.
Can I use Genie 4 today?
Not unless you are a trusted tester. It is a research preview. DeepMind says it is coming to Google AI Ultra subscribers through Project Genie, and to early access partners of the Gemini API and Google AI Studio, with a waitlist open in the meantime.
Are the LFM3 models actually free to use commercially?
The weights are open and on Hugging Face, but Liquid AI does not name a licence in the launch post. Check the model cards before building on them - open weights and a permissive licence are not the same thing, and this is exactly the distinction that catches people out.
How small is small enough to run on a phone?
Liquid AI puts the text model at roughly 1GB at 4-bit precision and names the Galaxy S26 Ultra, OnePlus 15, Raspberry Pi 5, Apple M4 Max and AMD Ryzen AI laptops, plus the Qualcomm Hexagon NPU.
Does the Cloudflare bug affect me?
Only if you called the GLM-5.3 model on Workers AI between 27 August and 9 September 2026, and then only across the 155 responses Cloudflare identified. The wider point is that tenant isolation on a hosted inference endpoint is your provider's property, not yours, and it is worth asking how yours tests it.
Is the Anthropic discount open to any government body?
The 40% covers federal, state, local, tribal and territorial government, across Claude Enterprise, Claude for Government and the Claude API. Anthropic says there is no minimum spend commitment and puts the estimated saving at $1 billion.
Sources
xAI release notes, 27 Oct 2026 ·
Google DeepMind on Genie 4, 27 Oct 2026 ·
Liquid AI on LFM3, 27 Oct 2026 ·
Anthropic on the expanded GSA partnership, 27 Oct 2026 ·
The Neuron daily digest, 28 Oct 2026 ·
Reporting on the Cloudflare Workers AI disclosure