October 26 archive: Bolt E4B weights released, Dessa preview, WeCom third-party compromise · 2026-10-26
Archive backfill: evidence edition 2026-10-26, added on 2026-10-29. These are not today’s announcements.
2026-10-23 | Bolt E4B ships weights; 4GB is a workload-dependent target
Reported facts: NVIDIA released Nemotron 3.5 Bolt E4B 4GB with Q4_K_M quantized and BF16 weights. The model card permits commercial and non-commercial use. An October 15 announcement had already previewed the model; the new development is actual availability. Built through further post-training of Gemma 4 E4B, it targets conversation, multi-turn tool use and local device assistants. Its model card specifies text input and output: a voice-assistant use case does not make it a native speech model.
Editorial assessment: Local-agent teams now have enough to begin a candidate evaluation, but not to settle hardware memory requirements. NVIDIA’s roughly 4GB claim applies to particular workloads, not an entire application. Its own measurement table includes configurations exceeding 4GB.
Suggested checks, not tested by kuoo.uk: Fix the quantization format, context length and concurrency on the intended device, then measure peak memory including other application components, time to first token and multi-turn tool-call correctness. Expand the pilot only if those results fit your requirements; do not buy hardware on the strength of the “4GB” name alone.
Source S07 · Source S08 · Source S09
2026-10-23 | Dessa demonstrates full-duplex speech with restricted research access
Reported facts: Block introduced Dessa, saying it was trained from scratch solely on human conversational audio, without text or pretrained models. The company describes a full-duplex speech model that listens and speaks simultaneously and says it can run locally on a MacBook Pro with M4 Max or better. Early access is limited to a small group of AI safety researchers; the supplied material provides no public API or downloadable weights.
Editorial assessment: Voice-agent teams can follow its research into interruptions, backchannel responses and vocal expression, but public demonstrations and vendor claims about local execution do not establish a shippable dependency. Dessa and Bolt E4B’s released text weights differ in modality and access. The evidence does not support a performance ranking.
Suggested checks, not tested by kuoo.uk: Teams with near-term delivery commitments should not treat Dessa integration as a confirmed milestone. If research access is granted, evaluate simultaneous listening and speaking, user interruptions, background noise and sensitive conversations in your own scenarios. These are proposed test cases, not established capabilities or defects.
Source S03 · Source S04 · Source S07
2026-10-24 | WeCom attributes unsolicited messages to a compromised third-party service
Reported facts: Jiemian relayed a WeCom statement that a small number of accounts had sent customers suspected pornographic promotional messages. WeCom’s security team attributed the incident to a compromise of a third-party unauthorized add-on service used by those accounts. The platform forced affected accounts offline, blocked the associated links and said it would intensify enforcement against add-ons offering multi-account operation and bulk control. The confirmed scope is the third-party service, not a breach of WeCom’s core systems; the report also does not establish customer-data exfiltration.
Editorial assessment: Teams connecting agents to customer communications have a concrete reason to review their integration methods. Focus on whether a third-party service can control accounts or bypass platform safeguards. The evidence does not identify AI-agent involvement in this incident, nor does it justify treating every third-party integration as an unauthorized add-on.
Suggested checks, not tested by kuoo.uk: Users of these add-ons should follow the platform’s instruction to stop using them and inspect account security. Other teams can inventory client modifications, hosted session credentials and automated sending permissions, then check whether their integration method is permitted. Unexplained permissions or anomalous sending records should trigger a pause in the relevant automation and a security review.
Evidence and limits
This is the October 26, 2026 archive edition, covering events from October 23–24 using only the supplied archived material. We did not download or run models, reproduce the security incident or verify deployment compatibility. Dessa’s training and local-execution claims and Bolt E4B’s resource targets come from their vendors. The WeCom account comes from media reporting of the platform’s statement. All proposed checks are untested by kuoo.uk and provide no guarantee of performance, security or production readiness.
AI-assisted drafting with a separate model review. This is source-based analysis, not independent performance testing.