AI image generation has evolved from diffusion models to multimodal agents that plan images like sentences. This deep dive covers how models work, the real costs per image (from $0.003 to $0.134+), prompting techniques that avoid the 'AI look,' pixel art challenges, and integrating generation into code and agents. Key takeaways: pay for the canvas, not content; describe how it was made, not how it looks; and hybrid pipelines beat pure AI for structural tasks.

Block's research lab unveils Dessa, a full-duplex speech-to-speech AI trained from scratch on raw human conversation, without any text or pretrained models. The model natively processes emotion, sarcasm, laughter, and interruptions, running locally on a MacBook Pro M4 Max. This breakthrough challenges conventional voice AI pipelines and opens new research frontiers.

NVIDIA has released OpenShell, an open-source runtime designed to securely govern fleets of autonomous AI agents. It uses kernel-level enforcement, formal verification, and hardware-level integration with BlueField DPUs to control agent access to files, networks, and credentials. This addresses the critical security challenges of deploying autonomous agents at scale.

Developer Simon Edwardsson fine-tuned a 360M-parameter language model to simulate a terminal, predicting screen updates from keypresses without a real shell or filesystem. The model runs in-browser via WebGPU, handles vim, tmux, and snake, and shows memory persistence. Key innovations include self-correction training and parallel row decoding, cutting latency from 6.7s to 0.87s.

Researcher pepsipu releases ns2jb, the first software-only jailbreak for the Nintendo Switch 2 on firmware 23.0.1. The tethered exploit, built with OpenAI Codex, abuses a SmileBASIC 4 integer overflow and an fs sysmodule buffer overflow to achieve native code execution. It enables homebrew, game mods, and save backups, but requires a reboot to reapply and is not a permanent custom firmware solution.

LiteLLM version 1.107.0 on PyPI was compromised, shipping a credential stealer and remote code execution backdoor across all seven wheels. The malware runs on every Python startup via cook.pth and sitecustomize.py, targeting cloud credentials, browser passwords, and AI tool tokens. PyPI removed the release within hours, but affected users must rotate credentials and rebuild environments.

DeepSeek has open-sourced DeepInfer, the high-performance inference framework powering its production services. The Apache-2.0 licensed release supports DeepSeek-V4.1-Flash on NVIDIA and Huawei Ascend hardware, featuring optimized kernels, DSpark speculative decoding, and batch-invariant inference. Notably, the KV cache system and disaggregation components remain proprietary, but the company says future model code will land in the repo.

Meta is rolling out 'Meta One,' a subscription service that caps organic link posting on business Facebook and Instagram pages. Free and Essential tiers allow only two link-bearing posts per month, with unlimited links costing up to NZ$883 monthly. The change, which began rolling out globally on 15 September, has sparked backlash from small businesses and artists like Terry Moore, who rely on the platform for organic reach, forcing a reevaluation of social media dependency.

Redact.dev discovered 102 blocks of hidden AI instructions embedded in WhatsApp help pages, including directives telling the chatbot not to recommend data protection authorities to users locked out of their accounts. Another block instructed the AI to avoid citing GDPR, LGPD, or CCPA once legal action was mentioned. WhatsApp confirmed the notes were for its support chatbot and removed them after WIRED contacted Meta.