DEV Community: Vektor Memory

VEKTOR 2.0.1: Desk routing went from 11% to 90%. Measured via Minimax matrix

Vektor Memory — Wed, 21 Oct 2026 00:13:13 +0000

Before this release, Desk’s automatic routing ran the right mode for about 11 of every 100 messages that needed one. In our test it was 15 of 133.

Desk has eight modes: ordinary chat, Council, Critique, Collab, Agent, Coach, Crucible and Cadence. Council compares options. Critique challenges a plan. Coach helps you sort out your priorities. Each one gives better answers to the right kind of question, but each sat behind a choice you had to remember to make.

A message like "Should we choose Jev or Clef, give me different viewpoints” gets a better answer from Council, and only someone who knows Council exists will open it.

So for 2.0.1 we changed who makes the choice. Desk now reads your message, picks the mode, and tells you what it did. This post covers three things: what we built, why we trust it enough to let it run without asking, and what we measured, including where it still gets things wrong.

Updated Desk v2.0.1

What we measured
We tested this on 330 messages we wrote ourselves. About 9 in 10 of the messages that needed a mode went to the right one, up from about 1 in 10 before. Fewer than 2 in 100 automatic runs were wrong. The decision takes about a third of a second and happens on your own computer, so the text of your message stays there.

Our test messages are ours, so real use will probably land a few points lower. The undo chip counts every time someone reverses a routing, and that count will show us the real rate.

Desk routing: before and now

Speed, and the fast tier for small jobs

Vektor decide: sort your own text into your own labels

Final choice on CLINC150: the minimax matrix

A. Full results: Desk routing and decision speed

B. Full results: the fast tier and release checks

C. Full results: CLINC150

D. Full results: When2Call and BANKING77

E. Full results: the router head and other tries that did not ship

F. Full results: Vektor decided and hosted pickers

G. Final choice on CLINC150: the minimax matrix (with the hosted model named)

How it works
Four signals, one decision. Desk looks at the words you used, a set of rules for strong phrases, a small embedding model that shortlists the three most likely heavy modes, and the local language model, which picks one from that shortlist or says “ordinary chat”.

The model answers one narrow question. Choosing among four options is far easier than open-ended chat, which is why it takes about 0.3 seconds on a local GPU.

A policy decides run or suggest. If you name a mode, it runs. Coach, Critique, Crucible and Cadence run on the model’s word, because a wrong guess costs one extra reply. Council and Collab run only when the model is at least 90% sure of its own pick. In our tests its stated confidence matched how often it was right, within 3.2 points.

Agent never runs on one signal. It can change things, so it always needs a second one, and you get a one-click chip instead.

Everything else becomes a chip. If the signals disagree, you see a suggestion and nothing runs.

Every automatic run can be undone, and the app counts how often it is. Turn the whole feature off with “Let Desk run the mode for me” in Preferences.

The fast tier is separate and opt-in. If you pick a cheaper model for small jobs, a local yes/no question decides which jobs qualify. Anything about your own history (“what did I say about…”) always stays on the main model, because that is where your memory is.

Release checks. More than 200 test suites pass before a build ships. We replay 330 saved answers through the routing rules, and a live check with the real model fails the release if wrong automatic runs pass 3% or coverage drops by 2 points.

Privacy. By default nothing leaves your computer. An optional hosted decision model exists, but it needs a consent box, sends only the text of the one message (up to 1,200 characters), and falls back to the local model if it fails or runs out of free allowance.

How we chose this approach
Every design question in this release was settled with the same small method, a minimax matrix skill file included.

The setup. Each question is a table. The rows are the competing methods, and the method we already ship is always one of them, so a new idea has to beat the current one. The columns are only the numbers that question cares about, such as right answers, wrong answers and milliseconds.

Three stages. We look at errors and pick thresholds on a tune set. We check on a second set. We score a hold-out set once and never change anything after seeing it.

Small samples are scored at the low end of their interval. A lucky 100% on 40 messages does not win. The script also tells us whether the winner survives if we double or halve the noise allowance.

Hard limits only where a wrong answer costs something. Sending an ordinary message to a heavy mode is a real cost, so it gets a limit. Speed gets a weight, not a limit.

What the matrix decided:

When Desk may run a mode for you. Six policies on 146 messages. Showing the model’s suggestion as a chip only routed 12.5% of the hold-out set.

Running every pick routed 98% but would also start the costly modes on a single guess. The policy we shipped, which asks for a second signal before the costly modes and lets the cheap single-reply modes run, routed 87.5% with no wrong runs.

At a strict 2% limit no row passed, because 68 messages cannot prove a rate that low. The script said so, and we kept the decision conservative.
Which jobs count as small. Word lists found 21% of the small jobs. The embedding model found 63%. A yes/no question to the local model found all of them, with no big job sent to the cheap model.

With every number weighted equally the script preferred the embedding model, purely because it is instant. We weighted accuracy three times higher, because a hard job on a small model costs quality and 0.27 seconds does not. That is a judgement, and we state it.

One prompt or two. Asking both questions in one prompt looked simpler. It scored worse on routing (95% down to 86%), made 5 wrong runs instead of 1, and was not faster. We rejected it.

Local or hosted. A hosted decision model got one more message right out of 68, within noise, took about 470 ms against 259 ms, and would send message text off your computer. We kept local and offer the hosted one as an opt-in.

More data for the shortlist model. We tried adding 250, 1,000 and 3,000 public everyday requests as extra examples of ordinary chat. The shortlist model separated ordinary chat from mode-worthy messages slightly worse each time (0.986 down to 0.963 to 0.983), and found fewer heavy messages at the same false-alarm rate (90% down to 69 to 83%).

Our own 148 messages already do that job. Adding more of our own data did not move it either, so we kept the model as it is and rely on real undo-chip feedback for the next round of data.

Later rounds. Letting Council and Collab run when the model is 90% sure added correct runs and no wrong ones, so it shipped. Adding example messages to the prompt changed 3 of 330 picks and made none better overall, so it did not ship. A reworded “ask or act” step for Vek scored 75.6% against 77.4%, so we reverted it.

Why this was the right way to work: it stopped us shipping three ideas that looked sensible and measured worse, and it made us say out loud where we overrode the numbers. Live runs also found two bugs that 37 unit tests missed, a cold model that never finished loading and a deleted line that returned the model’s answer.

Customers can also use the idea directly. 2.0.1 adds vektor decide: write a small JSON file with your text and your own labels, and your local model answers with a choice, a yes or no, or a score, each with a probability.

It is the same request shape the hosted decision services use, so a file written for it carries over. On a public set of 151 categories it was right about 9 times in 10, in about a third of a second, and the --eval option measures it on your own labelled sample. Nothing leaves your computer.

You can use the same method yourself. The minimax-matrix skill ships with 2.0.1.

Ask Desk a question like “keyword search or embeddings, we care about accuracy and speed” and it builds the matrix, tests in stages, scores small samples cautiously, and tells you whether to switch or keep what you have.

The skill’s reference page walks through the small-jobs decision above, step by step, with the real numbers.

Everything else updated in v2.0.1

Desk and routing

Desk is much less likely to start a mode you did not want. Everyday phrases such as “compare these two numbers” or “what does cadence mean in music” stay ordinary chat.

The first message after your local model goes cold is faster, because routing now loads the model in the background.

New Decision model card in Config: choose who answers Desk’s two quick questions. The default is your own computer. Cloudflare is an opt-in, with a consent box.

The Fast tier now uses a quick local yes/no check to spot small jobs. Questions about your own history always stay on the main model.

Collab workers start the moment the workers they depend on finish, so one slow branch no longer holds back the fast ones.

A Via tab appears in Desk if you have Via installed: open tasks with Start and Done buttons, an add box and recent activity.

Desk finds the right tool from how you phrase a request, including word endings (“translating” finds the translate tool).

Vek

Ask “what changed since last week?” and Vek lists, with dates, the facts that were replaced, the decisions made and the tasks you finished.

Two new quiet check-ins: a changed fact that may affect a recorded decision, and a decision left open for 30 days (and again at 90).

When you are away: if nobody answers a question within the time you pick, Vek takes the recommended option, carries on and tells you what it chose.

It never approves an action for you.

Secrets for agents: a placeholder such as {{secret:GITHUB_TOKEN}} is swapped for the real value only when the request goes to a host you approved, now on SSH servers too. Add a secret from Config.

Vek starts speaking sooner, and its answer bubble no longer hides behind the Ask box.

Library and reading

Top shelf: your model suggests must-read books, each checked on Open Library and ranked by real reader ratings. Copy the shelf as a list, remove a single book, or save free books from Internet Archive.

Papers: search free arXiv papers and save one to your Library with a click.

The PDF reader opens faster, Tone tints the page itself, and highlighting stops where you stop.

Kindle .mobi books open and convert.

Move the Explain box anywhere on the page.

Your own decisions

New vektor decide: sort your own text into your own categories, answer yes or no, or rate on a scale, with a probability for each, on your own computer.

Add examples per label for better answers, and run --eval on a labelled sample to see accuracy and calibration. --eval also tests a temperature fix for over-confident answers on one half of your sample and checks it on the other half, and only recommends a change if it helps.

The same request works at /api/decide on the local app and as the vektor_decide tool for your connected AI apps.

Tools for writing and showing

Humanize: select text and rewrite it in plainer words from a small bar, or press Ctrl+Shift+H.

Snip with pointer tools: Ctrl+Alt+S dims the screen, you drag over an area, and mark it up with arrows, circles and text.

A guided tour in three levels (5, 9 and 16 steps), from “Show me around” on the Desk home or by asking Vek.

Setup and providers

Activation now has Basic, Standard and Advanced levels. Basic is the short path.

Cloudflare Workers AI is available as a model provider, through your own account, with 24 chat models (the ones that need the paid plan are tagged, and VEKTOR answers on the default model if you pick one on the free plan). Claude Haiku 5.5 is in the Claude list.

The local model stays on your graphics card more reliably. VEKTOR asks Ollama for flash attention and a compact memory cache, which roughly halves the video memory a long conversation needs.

The first reply with a local model is faster, because the fixed start of the Desk prompt is read in the background.

Fixes

No more plain browser pop-ups: every question and message box uses a themed VEKTOR box.

Trivia now writes all 20 questions, accepts more model replies, and tells you when your setup is the reason it is slow.

Text is centred in the agent’s model pill and the Transparency buttons, and Vek’s faces no longer show broken characters.

Live chat text follows the voice sentence by sentence.

After an update, the Library tells you to close VEKTOR fully and start it again, instead of showing a technical error.

Stories and writing

Story panel: a story’s world, characters, style and your own notes in layers. Lock canon so it cannot change by accident, record who knows what, and list the promises the story still owes the reader.

Check a passage against the story: it names the locked rule a scene breaks. The nightly memory clean-up leaves locked canon alone.

Reverse engineer a book: attach a book or paste a link and get a point-form report on length, chapters, year, readability, characters and how deep they are, style, themes and why it works. Each point says whether it was measured, found in the text or comes from general knowledge, and made-up figures and names are removed.

The report is written section by section with a progress bar, so you can read the top while the rest fills in.

Remix a studied book into a blueprint for your own story, in the same genre or a different one.

Help that shows you

Ask Vek how to do something and an arrow points at each button on the real screen, one step at a time. It never clicks for you.

Say what is wrong (“Ollama is not running”, “my key fails”) and Vek checks your computer first, shows the fix, then checks again to see if it worked.

Studio

Motion videos: camera moves, a quality check before you save, a version strip, thumbnails, a video as the background, route scenes, and translate and dub into eight languages with every number kept exactly.
Decks from your own notes, in three styles, with no number that is not in your text.

Art and Dither: dozens of designs, layers, 17 dither patterns, photo looks and your own LUT files, and animation saved as WebM or MP4.
Script lab, Transcribe a file, and Ledger for reading invoices with a sums check.

Voice

Speak in your own voice, made on your computer, for reading aloud, Vek and Jot.

Voice tab: pauses, Save as audio, a waveform with every word marked, captions as SRT and VTT, and projects with several speakers and an audiobook file.

Vek can have its own voice, and one Stop ends all speech.

Tools and look

Companions: every function of Via, Vek-Sync, Prov and Vex, with a search for MCP servers.

Key health shows which of your keys work. A Local models card lists everything that runs on your computer.

Desk shows tokens per second and time to the first word under each answer.

If your local model cannot answer, Desk can try your connected cloud providers, free ones first.

Tic-tac-toe and Connect four against Vek, Word guess, Trivia duel and a Memory quiz.

New faces for Vek (VM-3 and Phosphor), and buttons and selected states that look the same in every theme.

Model lists: Cloudflare now has 24 chat models, with a tag on the ones that need the paid plan (VEKTOR answers on the default model if you pick one on the free plan). The OpenRouter list includes the models on its usage leaderboard.

The arrow in a guided fix moves on by itself when the step is done: a check passes, or you press the button it points at.

Right-click a snip for Copy, Save and Ask Vek. Config settings sit two to a row, and the plain Config buttons (Check keys, Refresh, Play and the rest) now look like real buttons.

Story and Ledger are centred on the page, and an attached book can be removed before you study it.

What happens next

We will keep adding functions as we get feedback. Chrome automation, enterprise controls, more games and a game-pack format, and faster local inference are on the list for the next release.

Version 2.0.1 is on the downloads page: https:www.vekmem.com

Run your own race, and keep your own data.

VEKTOR 2.0: Private local memory and sovereign data

Vektor Memory — Fri, 09 Oct 2026 22:27:19 +0000

VEKTOR 2.0 is out of the workshop, and the list of what is new runs longer than we expected.

Skim the highlights below, or read the technical section if you want to see how it works.

What we believe in:

Cutting Edge Privacy Enhancing Technology

Sovereign local data principals

Protecting our customers' anonymity

Real-time LLM trivia game

Why we build it this way
Our motto has not changed since day one: thinking memory, not retrieving.

VEKTOR is a memory and assistant layer that runs on your own computer, works with frontier and open models, and keeps your data private where you store it.

This is also a story about how much one small team can now do. A developer anywhere in the world, with an idea, a laptop and an internet connection, can now build serious software using a mix of open and closed models. We think that is good for everyone, and VEKTOR is our proof of concept.

We are a small, self-funded team. We do not have rows of engineers or rented GPU data center inference farms, and we are not trying to be everything to everyone. We are putting our best efforts forward where a small team can lead: a four-layer memory graph, a useful harness around 600+ models, transparency about what the software does, and privacy by design.

The code is our own. VEKTOR is written in JavaScript, about 170,000 lines of it, to fit our own design rules. The few open-source parts we ship, such as PDF.js for reading PDFs, ONNX Runtime and the Silero model for voice detection, are named in the package with their licenses.

Testing every panel
Before this release we went through every panel the way a race team goes through a lap, looking for lost milliseconds. Panels that list your tools now share one copy, long lists load in pages, and the slow paths we found were tuned. Even a test Library of 1,400 books and 237,000 passages now opens its settings page in approx. two seconds.

The place where we see the most room left is local inference. Running models on your own machine through Ollama is the slowest step in the chain, and the next gains there will come from smaller models, speculative decoding and smarter routing between local and cloud models. That is where our attention goes next.

What VEKTOR does and does not try to be
People will ask whether VEKTOR does everything the big agent assistants do. It does not, and it is not meant to. It is a focused business tool: it remembers, it acts on your behalf with your permission, and it shows its work. We would rather do those things well, in the open, than promise everything.

Choice and privacy
We think the choice of AI tools belongs to the people who use them, in the same way you choose where your files live and who can read them. Free services are often paid for with your data. We took a different route: you subscribe to the software at a reasonable price, and your memory stays in a file on your own computer, complete with data sovereignty.

If you choose a cloud model, your prompts go to that provider, and we say so in the app. If you choose a local model, nothing leaves your machine. The decision is always visible and always yours to choose in the settings.

Why should you trust us? Because you can check our policies. The rules we hold ourselves to are written in our tenets, our privacy statement and the code itself, and the built-in action log shows what the software ran, what it asked about and what it was stopped from doing.

Technical highlights
Memory: a SQLite file on your computer, with four linked layers (semantic, causal, temporal and entity). Recall combines meaning, keywords and names, and now also scores single sentences, so a memory is found when the answer is one line inside it. In our tests retrieval takes single-digit milliseconds on a file of about 2,300 memories (retrieval only, not the model’s answer).

Changed facts: when two memories give different values for the same thing, they are listed with Replace and Undo. A fact restated in very different words is flagged as a possible change for you to review. Nothing is merged or hidden for you.

Voice, all local if you want it: speech to text with Whisper on your machine, read-aloud with Kokoro, and a small voice-detection model (Silero, about 14 MB) that runs in your browser to tell speech from a cough or a door.

Pictures: Vek tries your chosen provider first, then a picture-capable model on your own computer, then your other cloud keys. A key that has just failed is skipped for 15 minutes.

Permissions: an MCP tool asks before it runs unless its server marked it read-only. Scheduled routines pause after ten failures in a row, and one switch stops everything that would leave your computer.

Local-only server: the app runs on your machine, locks its window with a content security policy, and checks where each request comes from before it answers.

Quality gate: every build passes a 63-check release gate, and the packaged build is tested end to end against a copy of real data before we ship it.

What is new in 2.0
Vek, the assistant

Talk to Vek hands-free with Live voice, with turn detection, interruption, and a voice detector that ignores coughs and background noise.

Show Vek your camera or screen with Look: one picture, only when you ask, never saved. (Live Beta, with future improvements)
Four buttons under the ask box: Live, Camera, Screen and Chat.

Vek cards: checklists, step guides, option tiles and numbered lists, with icons, your own pictures, optional Wikipedia photos and small diagrams.

Vek opens Library books by title, at a chapter or a page, and opens any of 17 ready-made templates by name.

Vek reads the page you are reading and answers from it.

Email from Vek’s own address, with your approval on every send, plus an optional read-only mailbox from senders you trust.

Talk to Vek from your phone through Telegram.

Ask for a background task in one sentence, and Vek sets the name and schedule.

Eight mascots with their own voices and motion: the robot, a flat Orb with a colour picker, a glass orb with oscilloscope lines, Cloud, VEK 9000, Ghost, Game pad and the Magic 8 Ball.

Meetings and notes

Meeting notes in Jot: record your microphone and, if you wish, the other side of a call, or import an audio file.

Time-stamped transcripts with names, and notes from six templates: meeting summary, stand-up, client call, interview, brainstorm and lecture.

Calendar join: read an .ics file to fill in the meeting title and invitees.

Remember button to save the notes to memory, only when you press it.
Desk can save a decision when you state one, and Workflows keeps a Decisions list with an as-of date.

Library and reading

PDFs open in the same reader as books, with selectable text, highlights, zoom and find.

Library starter pack of 14 reference files, an index button for new files and another for a full rebuild, text editing with kept versions, and a Remove from reading action.

Convert tool with 81 conversions, a built-in guide of 63 chapters, and a Desk bar with Library search and Convert one click away.

Workflows and business tools

Projects: a goal, running notes and the result of each run, with the last plan reused on the next run.

Goals with steps that follow your task list, and optional steps suggested by Vek, labelled as Vek’s.

Ideas tab of things Vek can really do today, an Inbox tab that turns a pasted list into tasks, and Recipes for known code fixes applied the same way every time.

Triggers: run a Workflow on a schedule, when files in a folder change, when a commit lands, or when a CI run fails. Steer a run while it works.

Task due dates, reminders and a to-do list you manage by typing in Desk.

Companions page for Via, Vek-Sync, Prov and Vex, each with a preview before any action.

Flowire opens a file and lights up the files a change touches.
Memory

Causal links updated between memories, drawn as arrows in the graph.
Insights (beta, off by default): short summaries of related memories, kept apart and labelled.

Optional key facts: three short facts per Desk answer, off by default.
Real dates in place of “yesterday” and “last Friday” when memory is handed to the model.

Daily limits for web search, and Firecrawl and Keenable search keys.
Security and transparency

Action log: one list of what VEKTOR ran, asked about or was stopped from doing, with the rule that applied.

Pause all outside messages, a single switch for Telegram, email and delivery.

A safety message instead of a coaching run when someone writes about self-harm.

For play and for focus

Trivia on the Game pad: 8 topics, 3 levels, 20 questions written fresh by your own model, a timer, streak scoring, sounds and confetti.
Magic 8 Ball with a real 20-sided die and a fair draw of the 20 classic answers.

Ghost, Cloud, Game pad, Orb and VEK 9000 each have their own funny quips.
Models and skills

Seven more newly released models in the OpenRouter list, which still refreshes itself.

Two new skills: a plan-build-verify loop and a minimax-matrix for choosing between options on accuracy and speed.

What happens next

We will keep adding functions as we get feedback. Chrome automation, enterprise controls, more games and a game-pack format, and faster local inference are on the list for 2.1.

Try it, tell us what works and what does not, and hold us to the standard above.

Run your own race, and keep your sovereign data private and local.

Upgrading

Drop-in from any earlier version. Your memory database is untouched, and v2.0.0 includes everything from v1.9.10

The full changelog is at vektormemory.com/docs/changelog. The forum is the fastest way to reach us with questions or feedback.

VEKTOR Memory builds local-first persistent memory infrastructure for AI agents. Documentation and downloads are at vektormemory.com.

The SI Wealth Transfer Is Becoming the Largest Rug Pull in History.

Vektor Memory — Tue, 06 Oct 2026 23:48:32 +0000

We are all involved in this machine; don’t get upset by this message. Look at what you can do to make things more “evenly distributed”.

The most important question about superintelligence is no longer simply whether the technology works.

The deeper question is who will own the infrastructure, who will control access to it, who will receive the wealth it creates, and what happens to the people whose work makes the system valuable.

SI is often described as an open revolution. Models are released publicly. Code is shared on GitHub. Datasets and experiments appear on Hugging Face. Developers around the world contribute improvements, documentation, and research.

But openness at the production layer does not necessarily mean openness at the ownership layer.

A project can be open source while the platform hosting it is privately owned. A model can be freely downloadable while the hardware and APIs needed to run it are controlled by a small group of companies. A developer can publish an idea openly while a much larger corporation turns that idea into a closed commercial product.

This creates the possibility of an enormous transfer of wealth from distributed creators to concentrated platform owners.

Sitting Ducks — Michael Bedard 1977

The emerging ownership structure
The SI economy is forming around several strategic layers.

There are the chip companies that manufacture the hardware. There are cloud companies that rent the computing capacity. There are model companies that train and operate the systems. There are developer platforms that host code, models and datasets. Finally, there are the applications that convert SI capabilities into products and services.

Many of these layers are controlled by a surprisingly small number of companies.

Nvidia’s agreement to acquire Hugging Face for approximately $12.9 billion is a major example. Hugging Face has become one of the central platforms for sharing open-source models, datasets and tools. Nvidia says the platform will remain open and that developers will not be required to use Nvidia hardware. However, ownership still gives Nvidia a major position inside the distribution and discovery layer of SI development.

Microsoft already owns GitHub, one of the most important repositories of source code and developer activity in the world. GitHub reportedly has more than 150 million users and hosts more than 420 million projects.

This does not mean Microsoft owns every project on GitHub or Nvidia owns every model on Hugging Face. It means that two enormous corporations have influence over where software and models are stored, discovered, ranked, tested, discussed and commercialised.

That distinction matters.

The future may not be controlled by the company that owns every piece of code. It may be controlled by the company that owns the roads through which code travels, the infrastructure.

The platform is the new landlord
A useful way to understand this is to think of digital platforms as landlords.

The developer creates the intellectual property. The platform provides the building:

hosting

identity

collaboration

rankings

analytics

deployment

payments

enterprise access

recommendations.

At first, the platform may be generous. Free accounts encourage participation. Open repositories create network effects. Developers invite other developers. Models become easier to find. The ecosystem grows.

Once the platform becomes essential, the balance of power changes.

The platform can introduce fees, change visibility, promote its own products, alter search rankings, place ads, limit competing services or change the terms of use. It may not need to ban a project. Making the project difficult to discover could be enough.

This is how practical control works in a digital economy. Formal ownership is only one kind of power. Visibility, distribution and default placement can be just as important.

A model may technically be available to everyone, but if it is ranked below a company-owned alternative, excluded from recommended lists or made difficult to deploy, its practical reach can be severely reduced.

The creator may legally give away the business
The open-source licensing model makes this particularly important.

If a developer releases a project under the MIT or Apache 2.0 licence, a company can generally use the code commercially, modify it, combine it with proprietary software and sell the result.

The company usually does not have to publish its modifications or contribute improvements back. It normally only has to preserve required notices and comply with the licence terms. Apache 2.0 adds clearer rules around attribution, notices and patents, but it still allows commercial use.

This is not necessarily theft under the law. It is often the intended purpose of a permissive licence.

The problem is that many creators do not fully appreciate what they are giving away. They think they are sharing a tool. In reality, they may be releasing:

the implementation

the technical architecture

the market concept

the product roadmap

the evidence of customer demand

the lessons from failed experiments

the knowledge needed to build a competing product.

A corporation may take the repository, preserve the licence notices and build a paid service around it.

The creator may retain copyright in the original code, but that does not mean the creator retains commercial exclusivity.

This is the difference between legal ownership and economic power.

Ideas are easier to borrow than code
Copyright generally protects the expression of an idea more clearly than the idea itself.

Suppose an independent developer publishes an open-source memory system for SI agents. The system includes a database schema, retrieval engine, API and documentation.

A large company might:

copy portions of the code under the licence

rewrite the system in another language

build a similar architecture independently

use the public documentation to understand the market

use its cloud, distribution and sales resources to reach customers first.

Even if the company does not copy the code directly, it may still benefit from the creator’s public research.

The original developer has taken the risk. They have paid for the experiments, written the documentation, attracted early users and demonstrated that the problem matters.

The larger company may then arrive after the uncertainty has been removed.

This is one of the quiet forms of intellectual-property transfer in the technology industry. The original creator may not lose ownership of a specific file. They lose the opportunity to be the only person able to commercialise the insight.

The new form of extraction
Traditional resource extraction involved taking oil, minerals or agricultural products from one place and concentrating the value elsewhere.

The digital equivalent can involve taking:

code

research

ideas

user behaviour

model evaluations

community knowledge

developer time

open datasets

The platform supplies infrastructure and monetises the resulting activity.

This does not mean platforms contribute nothing. Hosting, security, compute, storage, search and collaboration are expensive. The issue is the imbalance between the value contributed by millions of participants and the bargaining power of the company operating the platform.

A developer might contribute years of work to an open project. The platform can earn revenue from enterprise subscriptions, advertising, compute usage, developer tools and strategic intelligence.

The creator receives visibility and perhaps reputation. The platform receives recurring revenue and a strategic view of the entire ecosystem.

That is an uneven exchange when the platform becomes indispensable.

The state is entering the ownership structure
The government is now becoming part of this story.

US officials have discussed whether the government should receive equity stakes in major AI companies. Reports have described proposals involving OpenAI and a public investment vehicle that could distribute future returns to American households. Reuters also reported that Anthropic was not involved in discussions about providing the government with equity at that stage.

This is important, but it should not be described too simply as nationalisation or as a public utility.

A government holding shares in a private company is not the same as the company becoming a regulated public service. The company may still set prices, control access, exclude users and pursue private commercial objectives.

The key question is what the public receives in exchange for public involvement.

There are several possible arrangements:

the government buys shares with taxpayer funds

the company donates shares

the government exchanges subsidies or contracts for equity

the state receives board representation

the state receives only passive ownership

future returns are distributed through a public wealth fund

taxpayers absorb losses while executives retain operational control

These arrangements are economically very different.

If the government takes a stake using public money, taxpayers carry investment risk. If the company donates shares, the public may receive future upside without paying directly, but the donation could still be exchanged for political influence, regulatory protection or public contracts.

Either way, ownership alone does not guarantee public control.

Public risk and private control
The most dangerous arrangement would be one where public money supports private companies without creating meaningful public rights.

Consider the possible sequence:

Venture capital funds the early company

Government subsidies support chips, energy, data centres or research

Public agencies become major customers

The company becomes too strategically important to fail

The government accepts equity or provides emergency support

Taxpayers absorb part of the downside

Executives and private investors retain control over operations and pricing

This would amount to socialising risk while preserving private control.

The government may describe the arrangement as an investment. But taxpayers may not receive the same protections as private investors. They may have no board seat, no meaningful ability to influence strategy and no guarantee that returns will be distributed to the public.

A small passive stake can create the appearance of public participation without giving the public real power.

The Intel arrangement is a useful warning. The US government agreed to purchase an approximately 9.9% stake in Intel, with the investment associated with federal semiconductor funding. The announced structure was described as passive and did not provide ordinary governance control.

That model may be appropriate in some circumstances, but it demonstrates the difference between owning part of a company and controlling its decisions.

From technology oligopoly to political oligarchy
The concern is not only economic concentration. It is the interaction between economic concentration and political power.

A Silicon Valley oligarchy would not necessarily look like a government dictatorship. It would operate through ownership, influence and dependency.

A small number of companies could control:

the chips

the cloud

the models

the developer platforms

the software distribution

the enterprise contracts

the government relationships

the funding channels

They would not need to own every startup. They could own enough infrastructure to shape the choices available to startups.

**Independent companies might have to buy compute from the same **corporations that compete with them. They might have to distribute models through platforms owned by major infrastructure providers. They might rely on cloud credits, marketplace rankings and enterprise partnerships controlled by potential competitors.

This produces a system in which competition is allowed, but the terms of competition are privately administered.

The smaller company can exist, but it may never become independent enough to challenge the system.

The potential near-future outcomes
Several outcomes are plausible over the next few years.

The controlled public wealth model
Governments receive minority stakes in major AI companies. Those stakes are placed into public funds and future returns are distributed to citizens.

This could give the public a genuine claim on AI-generated wealth. But it may also legitimise a small group of private companies as permanent national champions.

The result could be public dividends combined with private oligopoly.

The protected national champion model
Governments decide that frontier AI is too important to leave to ordinary competition. They provide subsidies, contracts, energy access and regulatory protection to a handful of companies.

Smaller competitors remain technically free to operate but cannot match the capital and infrastructure advantages of the protected firms.

This would resemble an industrial policy system centred on AI.

The platform enclosure model
Open models and code remain publicly accessible, but discovery, compute and deployment become concentrated.

The open ecosystem continues to exist, but the economically valuable part is captured by the platform owners. Developers can contribute to the system, but cannot easily monetise their work independently.

The AI bubble and rescue model
Large investments in data centres and AI companies fail to generate the expected returns. Some firms collapse. Governments intervene because the infrastructure is considered strategically important.

Taxpayers then fund rescues, while the surviving companies acquire failed competitors and become even more concentrated.

This would be the clearest version of the feared rug pull.

The decentralisation response
Developers begin moving toward self-hosted Git platforms, independent model registries, federated identity, local inference and cooperative infrastructure.

Open-source projects distribute their repositories and models across multiple locations. Creators adopt more restrictive or commercially structured licences.

This outcome would reduce platform power, but it would require developers to sacrifice some convenience.

The problem with calling everything theft
There is a danger in using the word “theft” too broadly.

If a creator releases code under MIT or Apache 2.0, commercial reuse is generally authorised. The company may be behaving aggressively, opportunistically or unfairly, but not necessarily unlawfully.

The stronger argument is about bargaining power.

A creator may voluntarily publish the code, yet still be operating inside a system where:

the licence is poorly understood

the platform owns the audience

the company has superior legal resources

the company can see early signals of commercial demand

the creator cannot afford enforcement

the code is legally reusable but the creator’s business model is not protected.

This is better described as asymmetric extraction than simple theft.

The transaction may be legal while the economic outcome is deeply unequal.

How creators can protect themselves
Open-source creators do not need to abandon openness, but they should separate what they want to share from what they need to own.

Possible strategies include:

releasing a useful core while retaining a proprietary hosted service

using dual licensing for commercial customers

considering AGPL where network-service sharing is important

keeping proprietary data and evaluation sets private

protecting the product name with a trademark

maintaining multiple repository mirrors

avoiding dependence on a single model registry

keeping customer relationships outside platform marketplaces

publishing only the components that benefit from adoption

using contributor agreements that clarify ownership

separating public demonstrations from commercially valuable infrastructure.

A repository should be treated as a strategic asset, not merely as a code dump.

The question should be:

What must be open for adoption, and what must remain controlled for the business to survive?

The deeper question
The future of SI will not be decided only by model intelligence.

It will be decided by ownership.

Who owns the compute? Who owns the data? Who owns the distribution channel? Who controls the ranking system? Who receives public subsidies? Who determines which projects receive visibility? Who captures the productivity gains when SI replaces or augments human work?

If the answers remain concentrated among a few technology companies and their financial partners, SI may produce tremendous technical progress while also creating one of the largest wealth transfers in modern history.

The public may receive better software and cheaper services, but still lose economic power. Independent creators may produce the innovations, while platforms capture the recurring revenue. Governments may support the infrastructure, while private companies retain the strategic control.

That would not be a conventional revolution in which power is distributed.

It would be a transfer from many creators to a small number of owners.

Conclusion
The central danger is not that SI companies will suddenly steal every piece of code or that open source will instantly disappear.

The danger is more gradual.

Millions of developers may create the intellectual foundation of the SI economy. A small number of companies may then control the hardware, cloud infrastructure, model platforms and distribution channels through which that work becomes valuable.

Government equity stakes could either give citizens a share of the upside or help legitimise and protect a private oligopoly. The difference depends on governance, transparency, competition and whether public risk produces public control.

Open source can remain legally open while becoming economically enclosed.

That is the issue to watch.

The critical test for the next decade will be whether SI becomes a widely owned productive infrastructure, or whether it becomes a privately controlled utility-like system in which society supplies the data, labour, capital and public support while a small Silicon Valley oligarchy captures the wealth.

Sources and factual context
Reuters reported that US officials had held preliminary discussions about the possibility of the federal government acquiring stakes in major artificial-intelligence companies. The report described the discussions as preliminary, rather than confirming that the government had completed an investment in OpenAI or Anthropic.

Reuters reported that OpenAI had discussed a possible 5% stake for the US government, according to reporting by the Financial Times. The proposal was described as part of broader discussions about national-interest involvement in advanced SI.

Reuters separately reported that the Trump administration and Anthropic had not discussed the government taking a stake in Anthropic at that time. This distinction is important because public statements and media reports have sometimes grouped OpenAI and Anthropic together despite the different status of the discussions.

Nvidia agreed to acquire Hugging Face for approximately $12.9 billion. Hugging Face is a major platform for hosting and distributing open-source SI models, datasets and development tools. The acquisition gives Nvidia a significant position in the SI software and developer ecosystem.

GitHub states that its platform is used by more than 150 million developers and hosts more than 420 million projects. This helps explain why control of GitHub has strategic importance beyond ordinary code hosting.

The MIT licence permits commercial use, copying, modification and redistribution, provided the required copyright and licence notices are preserved. The Apache 2.0 licence also permits commercial use and modification, while adding more detailed requirements concerning notices, modifications and patent rights.

GitHub’s documentation explains that software without an open-source licence remains protected by ordinary copyright law. A public repository is not automatically free for unrestricted commercial reuse merely because it can be viewed online.

GitHub’s generative SI terms state that GitHub will not use customer inputs or outputs to train generative SI models under the relevant service terms. However, developers should distinguish between different GitHub products, account types, settings and contractual terms rather than assuming one universal data policy.

The US government announced an agreement to purchase approximately 9.9% of Intel for about $8.9 billion. The arrangement was described as a passive investment without ordinary board representation or governance control, illustrating that public ownership does not automatically equal operational control.

The facts are developing, but the direction is already visible: SI is becoming not only a technology race, but a contest over ownership, distribution and political power.

Founder’s note
The article’s claims about wealth transfer, platform enclosure, intellectual-property extraction and Silicon Valley oligarchy are analytical arguments rather than settled facts. The cited material supports the underlying events and legal or commercial structures, while the conclusions about future control and wealth concentration remain potential forecasts and not financial, legal, political or personal advice.

VEKTOR Memory builds local-first persistent memory infrastructure for AI agents. Documentation and downloads are at vektormemory.com.

Open Source

LLM

Hugging Face

Github

The Road to VEKTOR v2.0: How we Refined our Research Methods for Speed

Vektor Memory — Sun, 04 Oct 2026 00:16:41 +0000

What 1.9.9 fixed, how we tested, and what we are building next.

14 min read · vektormemory.com

The pace is changing

The field keeps renaming itself: assistants, agents, and now SI “super intelligence."

I always liked “the everything machine” better, because it says what we want from the thing. If it is going to merge into the one "thing," it has to be built from parts that all work in unison, accurately with speed.

A few months ago, VEKTOR was a tiny 4-layer memory store with a lot of lofty ideas around it, unbuilt modules on a Kanban board, and saved to memory as future planning projects.

Today we can ask an assistant to run a workflow, watch it ask for permission (Hitl), and read afterwards exactly what it did, saved to the memory layers graph, with full transparency.

A search that took half a second now takes a few milliseconds, shaving off time from the dozens of iterations we made. A memory that used to pile up now notices when a fact has changed. None of the ideas are ever finished, and we list what is still rough around the edges below. But the pace has changed, and I think I know why.

Building the foundations was the hardest part.

Memory, context, skills, MCP tools, and the connectors all had to be built and work properly and agree with each other before anything built on top could be trusted. For a long time that meant slow, careful back-end plumbing that nobody sees, wiring, event handlers, and smoke testing 100’s of LLMs constantly changing and improving.

Now the majority of those pieces hold, and each new feature starts with more already in place. The assistant can search your notes, read the custom Vektor guide in the library we made for users and LLMs, see which panel you have open, and use the same 60+ MCP tools and memory Claude via sees. We stopped re-explaining things to it, so new work lands faster. We expect the pace to keep climbing, as the Frontier models improve in coding and the open-source models as well.

There is a second reason. Somewhere in the last few weeks we reviewed our design and research methods and started measuring it more efficiently, primarily because we are inpatient, with a small framework we describe below and will release as a skill once refined.

It borrows from John von Neumann and adds a few habits of our own that we learned from watching LLMs struggle with benchmarking and looping. It’s not claiming new science or a white paper, just a remix of old and new ideas into the agentic tools we use now. It culls the bad ideas early and cuts our test time from days to hours via microtests in a matrix.

**The real problem
**The field has moved so fast in the last two months from Openclaw and Hermes agents.

Now with OpenAI launching “dots” on 29 September: always-on personal agents with their own cloud computer, connected to more than 4,000 apps, working read-only in the background and asking before they send or change anything. xAI shipped Grok Bot in August, an agent that operates apps by looking at the screen and remembers your corrections, amazing. Meta’s Muse Spark plans a job and hands the pieces to parallel sub-agents, with cute characters and payments.

All three live in the vendor’s cloud data centers, highly polished with millions spent on devs, and all three keep your memory there, and all have agent credit card payments built in, some even work in your Tesla EV, controlling real vehicle settings, the future promised now.

We look at where the market is going, and we are building the other trade-off: assistant and memory on your own machine, any model you like, with a human in the loop by default, security, hitl, privacy, soveriegn data.

Those choices cost something, complete agent autonomy mode. Currently a small local model is worse than a frontier model at deciding when to use a tool, the cloud computer option to lean on, or built-in credit card payments, which we can see as being an absolute cluster if an agent conducts incorrect transactions, loop errors, and customer support issues in the future.

Now a billion-dollar company will have thousands of offshore support staff agents that can handle 1000s of tickets for insurance and cashback claims when the agents go rogue and order 200 pairs of shoes instead of 2.

So the question for this release was not “which payment feature is next" because that is where the market is at. but “which parts of the foundations work well for us based on our own ethos."

It's all a sacrifice to maintain our local philosophy, but then again, it avoids a lot of the foreseeable payment headaches. Maybe we are right or wrong; sitting on sidelines and watching it all play out, we can learn from the mistakes and implement and revise as needed at our own pace.

Vek Panel

How we test: grids, gates, worst-case rules
Von Neumann minmax matrix

Every “which method is best” question now goes through the same three steps.

The grid. Rows are methods, and the shipped method is always the first row. Columns are accuracy, speed, and accuracy on a holdout set. Each cell is one small experiment. Because each cell takes seconds, we can try thirty ideas in an afternoon.

The gates. Each gate is a yes or no. We tune on 10 questions and keep a change only if the ranking score rises and the top-10 hits do not fall.

We then re-check the kept change on a separate 20-question form, and it must not be worse there. The remaining 70 questions are never used while tuning, and they are the only numbers we report.

Ten questions are noisy: one question moves the score by 10 points. The second gate exists to catch luck. Several window-size changes passed the first gate and failed the second.

The worst-case rule. For each row we compute two regrets: how much accuracy it gives up against the best row, and how much speed it gives up against the fastest row. We take the worse of the two and pick the row with the smallest worst case.

Here is a real example from the library search matrix:

Matrix

The 30-candidate row is the most accurate, but it pays for that in speed. The 20-candidate row gives up 5% of the accuracy and loses far less time, so it wins. A fast method that is wrong and an accurate method that is slow both lose under this rule. Timing is noisy, so the milliseconds moved by a few between runs. The ordering held.

Where the idea comes from. In 1928 von Neumann proved the minimax theorem: in a two-player zero-sum game, you can pick the strategy that limits your worst-case loss. We borrowed the decision rule, not the game.

Nobody is playing against the test set. The “opponent” is our own habit of picking the method that wins on the metric we happen to like, whilst refining and improving on our ideas, reiterate quickly, fail fast, and win fast, stacking upwards into the matrix.

Why do this? Because the market is moving that fast, there is little point watching the LLMs hammering tokens and performing benchmark tests over and over to find out the original theory and ideas were wrong in the first place and bear no tangible results…

It is also worth knowing what the research says about people and minimax.

In 2009 Levitt, List and Reiley tested whether professional poker and soccer players actually play minimax in laboratory games (NBER working paper 15609). They mostly did not, and the skill did not transfer from the field to the lab.

Our reading is modest: do not assume theory describes the behavior, and use worst-case regret as a simple tie-breaker when no single metric can be trusted.

What the research says about the pieces
A few results shaped what we built and what we left alone.

Keyword search stays the base. A 2026 scaling study, “BM25 Wins at Scale”, ran 28 corpus sizes up to about 600 million tokens. Keyword search overtook dense retrieval around 10 million tokens and led at every larger size. So the Library keeps keyword search as its foundation and adds meaning on top.

Fusion by rank. To combine two ranked lists we use reciprocal rank fusion (Cormack, Clarke and Büttcher, 2009). It adds up 1 divided by each list’s rank, so a result that is high in both lists wins, and no one has to compare raw scores from different systems.

A model-written search, only when needed. HyDE (Gao and colleagues, 2022) has a model write a hypothetical answer and searches with that. It costs a model call, so VEKTOR runs it only when the quick searches disagree, and waits about a second at most.

The embedding window. The small embedding model reads about 128 tokens, which is roughly 512 characters of English. Our library passages average 2,600. That one fact explains why plain re-ranking by meaning hurt at first, and why scoring overlapping windows fixed it.

Dates at search time. Memory tools describe handling time questions with rule-based pattern matching and no extra model calls, using dates stored with each memory. We store when each fact was replaced, and we plan to test our own version of that for the ledger described near the end.
The initial assumption is not always correct

The Library holds about 154,000 passages from our test books. Search took 545 ms on our test queries, which you notice when an assistant searches three times before it answers.

We assumed the ranking code was the cost. A profile said otherwise: one line counted every passage in the index before each search, and that count alone took about 470 ms.

Reading the total the index already stores brought it under a millisecond. Searching first for passages that contain all the meaningful words, and widening only when needed, took ten short queries to 5.6 ms on average. One hundred full-sentence questions average 96 ms.

Speed was the easy half. To measure accuracy, we had a local model write 100 natural questions from random passages, each tied to the passage that answers it. Plain keyword search put the right passage in the top five for 63% of them.

We tried five ideas to improve that. Dropping search terms for speed cut it to somewhere between 23% and 52%. Splitting passages into smaller pieces cut it to 53%. Letting a local 9-billion-parameter model pick the best passage made first place worse on a 30-question check, from 47% to 27%.

One thing helped: re-ranking the top 20 by meaning. Because of the window limit above, we score overlapping 480-character windows and keep the best one.

On 70 questions we never tuned on, the ranking score went from 0.41 to 0.50, about 22% better, at the same speed once the vectors are stored. They fill in quietly as you search.

Limits: a local model wrote the questions, 70 questions leaves roughly five points of noise, and your first search on a new topic is ordinary keyword search.

A memory that says “that changed”
Save “the meeting moved to Thursday” and the old “Tuesday” memory should stop answering.

VEKTOR now compares each new memory with the closest older ones. A different date, number, owner or address, or a “no longer”, links the pair with a “contradicts” edge. It uses wording and the stored embeddings only, with no model call, so it is private and free.

By default nothing is replaced or deleted. An optional setting retires the older fact, which stays in your file.

The first version was wrong in a useful way. On a test set of 46 pairs it caught 19 of 20 changes with no false alarms. On our real test file of 2,256 memories it flagged 37% of everything, because the file is full of long chat transcripts and test timestamps whose numbers differ constantly.

We restricted it to short plain statements, ignored long numbers and anything shaped like code, and required clear change wording before a bare number counts. It now flags 10 memories, 0.4%.

One gap we cannot close yet: the test file has no recorded “this replaced that” pairs, so we cannot tell you how many real changes it misses. That is why it flags and does not rewrite.

An assistant must not claim what it did not do
Vek the mini assistant can now use tools: search your notes, memory, the guide and the Library, open a panel, save a note, run a Workflow.

You choose how much it may do. Read means it only looks, Ask (the default) shows each change on a card and waits for Approve or Deny, and Auto just does it. Every action lands in a list called “What Vek did”.

No tool can buy anything in cyberspace with a credit card, that's the compromise we made so far.

Our test model is a local 9B model through Ollama, and it does not call tools reliably, yet.

So the loop does three things:

It tells the model which tools exist and gives an example. If you asked for an action and the answer only says it was done, the loop replies that nothing happened and asks once more. Plain chat answers get a rule that they cannot run anything and must not say they did.

Over 21 requests across seven kinds of task, the model used the right tool 20 times. The miss was a claim that a workflow did not exist.

Privacy you can switch on or off
An internal auditor run we did critiqued our privacy chapter and asked what the “few small automatic requests” were, and noted that weather and currency widgets also call out.

The chapter lists four: the update check, licence activation, first-time model downloads and the model list. The widgets were not on the list.

They are now, and there is a switch. In Config, under Privacy, “Block automatic network requests” stops everything VEKTOR does on its own. A test records every outside address and shows zero requests with the switch on.

The app sends no telemetry in either state. We searched the code again for analytics and error-reporting addresses and found none.

What is in 1.9.9
Memory:

Keeps itself up to date in the background: backup first, never deletes a memory, resumes if you close it

Claude, the app and the terminal share one memory

A richer Graph, linked as you save: by names, by time order, by meaning
Searches follow names, and the slower model-written search step runs only when the quick searches disagree

Replaced facts stay replaced, and the new contradiction check

Vaults work everywhere: Claude and the terminal follow the vault you pick
Fading memories now covers every memory, with safeguards, and vektor cold shows and undoes it

New terminal commands: vektor recall, backup, export, tags. db-merge imports into your normal file

Vek assistant:

Tools with Read, Ask and Auto levels, an approval card and an activity list

Reads public links and your notes, runs Workflows, answers how-to questions from the guide

Two-part answers, personalities that change how it answers, an Ask box under it, spoken answers, orb avatars and a larger face

Library, guide, workflows:

The VEKTOR guide ships as a 55-chapter book in your Library, with matching MCP tools (60+ in all)

Library search much faster (545 ms to under 6 ms on short queries) and re-ordered by meaning. EPUB pictures and a wider reader

Workflows cards fill the page, with All, Scheduled and On demand views, search, a details window and last-run time. Results can go to Slack or email

Setup and privacy:

The privacy switch described above

Both setup wizards offer all 18 providers, and your question goes only to the provider you chose

API keys set from the terminal go into the encrypted vault

A 15-tool profile for apps that cap how many tools they accept

Terminal commands start in 0.15 seconds instead of 0.9

The road to v2.0
These are our plans, in the order we expect them being built now over the next month:

A decision ledger. Ask “what did we decide about the Quokka plan, and what changed since?” or “what did I believe in March?” The memory already records when a fact was replaced. The ledger would tie decisions to their sources.

Memory that works while you sleep. Merging scattered notes into short insights that link back to their sources. We will test it on a copy first, because a model rewriting your memory is where trust gets lost.
One front door. One assistant decides who handles a request. The Desk modes stay as manual overrides.

The benchmark rerun. We are re-running our memory benchmarks and plan to publish full results with 2.0, including the categories where we need most improvements.

Phone and text. Only after we find the most private method to do it. Local-only means your computer has to be on.

A simpler start. Opening the app without a terminal command.

On the shelf: letting Vek see your screen through a small local vision model, strictly opt-in. We want the privacy rules written before the we start coding and testing how it works.

Where VEKTOR fits
None of this needed a bigger model. It needed measuring each step, keeping what held up on questions we had not tuned against, and dropping what did not.

Two of our best-sounding ideas lost to the baseline in the first test, leading to quicker iterations and pivots.

That is the method we plan to keep through 2.0: a small test, a yes or no, then move on. Memory, context, skills, MCP and the connectors give each test something solid to stand on, and we think that is why this stretch moved so fast and wil continue this way into the future.

If you run local models, we would like to hear what you would let an assistant do without asking, and what you would never want it to touch.

Those answers determine the default levels and where and what we build next.

Upgrading
Drop-in from any earlier version. Your memory database is untouched, and v1.9.9 includes everything from v1.9.8.

npm install -g ./vektor-slipstream-1.9.9.tgz
The full changelog is at vektormemory.com/docs/changelog. The forum is the fastest way to reach us with questions or feedback.

VEKTOR Memory builds local-first persistent memory infrastructure for AI agents. Documentation and downloads are at vektormemory.com.

Sources:

OpenAI dots launch coverage (androidheadlines.com/2026/09/openai-launches-dots-always-on-ai-agents.html), xAI Grok Bot (layer3labs.io/guides/what-is-grok-bot), Meta Muse Spark 1.1 (siliconangle.com/2026/07/09/meta-launches-flagship-muse-spark-1–1-model-multi-agent-upgrades), “BM25 Wins at Scale” (arxiv.org/abs/2607.26497), Levitt, List and Reiley, “What Happens in the Field Stays in the Field”, NBER working paper 15609 (nber.org/papers/w15609), Mem0 on temporal reasoning (mem0.ai/blog/introducing-temporal-reasoning-in-mem0), Cormack, Clarke and Büttcher, “Reciprocal Rank Fusion outperforms Condorcet and individual rank learning methods”, SIGIR 2009, Gao et al., “Precise Zero-Shot Dense Retrieval without Relevance Labels”, 2022.

AI Agent

LLM

Memory Improvement

Minmax

VEKTOR v1.9.8 is live: an LLM library that builds itself, a converter for nearly every file, and security you can actually see

Vektor Memory — Wed, 30 Sep 2026 23:28:03 +0000

Local-first memory for AI agents, now with your books, your documents and a much harder look at what your AI reads.

We shipped more in the last month than we did in the previous twelve.

Every system in VEKTOR now lives in one SDK and follows the same rules. Adding a module used to mean wiring it into five places and arguing with each one. Now the foundations are there, and a new idea has somewhere to go on day one.

The clearest proof is the Library. We sat down with a rough idea: point VEKTOR at a folder of books and notes, and get something you would want to open every day. Design, plan, build, verify, test and refine all happened in a few hours. It was one of the fastest and most enjoyable things we have built.

That's just RAG? Kinda, like RAG but on automode at hyperspeed.

That speed is the story of this release. v1.9.8 has a Library, a reader, a converter for documents and media, and a security layer that now asks your permission before it lets an AI do anything risky. Below is what each of them does, what we believe about privacy, the technical detail for people who want it, and a full list of every change.

Library mode

The Library: your folders, as a place you want to be

Add any folder under Config and it appears as a Bauhaus art cover grid. Every book gets its own custom cover drawn on the spot, so nothing slows down as you scroll, and PDFs and EPUBs show their real cover when they have one or sourced online. You can search, sort, filter by format and rate books from one to five stars. The PDF, EPUB and text copies of the same book sit on one card.

Hover a book and you get its title, author, year and a one-line summary from your local model. If a detail is wrong an LLM will regenerate, edit it and your edit stays. Right-click for more books like this one, a fresh summary, or a trash folder you can restore from.

Then there is the reader. Text, Markdown, EPUB, Kindle formats and PDFs open as a two-page book, a single page, a whitepaper or a continuous scroll, in a paper, sepia or night tone.

Highlight a passage and send it to Jot or Desk, or press Explain to get a plain-language version that appears as it is written via LLM. Or have the book read to you, in short natural sections, with a sleep timer.

It is a rag-style folder with generated covers and summaries, and using it is genuinely a pleasure. We did not expect to feel that about a file browser.

Convert: one tool for the files people actually have

This week a screenshot landed with a hand-drawn circle around a dropdown. The format menu on the new Convert tab was showing a single item out of a long list. That is a fair summary of how this feature grew: fast, then a real person pointed at the rough edge, then we fixed it the same day.

The new Convert tab turns documents, spreadsheets, slides, e-books, fonts, archives, pictures, audio and video into other formats. Most of it needs nothing installed. Pictures, audio and video are converted inside your browser, so the files never leave your machine. There are more than 80 conversions, and every result tells you plainly what it could not carry over.

A few highlights:

PDF tools. Split a PDF into one file per page, keep only pages like 1–3, 5, or join several PDFs into one.

Rare formats. Old Word files, Photoshop files, CAD drawings, disc images and bzip2 archives.

Media. Save a video frame, make an animated GIF, build a contact sheet, pull out the audio, or turn a camera RAW file into the JPEG preview stored inside it.

Your installed programs. If you already have Pandoc, LibreOffice, ImageMagick, 7-Zip or FFmpeg, you can switch each one on with an Allow button and VEKTOR will use it for better layout and more formats. If one is missing, a Get button opens its official download page. VEKTOR never downloads or installs anything by itself.

You can also right-click a book in the Library and choose Convert, and Desk now reads documents you attach: PDF, Word, OpenDocument, RTF, slides, sheets and plain text. Library search reaches inside PDFs and Word files too, which used to be a blind spot.

What we believe about your data

We reviewed every file in the package and wrote down exactly what leaves VEKTOR. The result is a plain-English page, PRIVACY.md, listing what stays local, what goes to a provider only when you use one, and the few small requests VEKTOR makes by itself.

The app page itself now makes no outside requests. The typefaces, the code editor and the flow chart panel ship inside the install instead of loading from third-party servers.

We want to be a leader in local privacy tech, so we are upfront; the only truly air-gapped setup is a local Ollama model with no tool calls for web search or connectors. That is a real trade-off, and it is your call. We give you the choice and we show you what each option does, rather than deciding for you.

The same four ideas guide every build, and we cross-check each release against them:

Local first, sovereign data. We do not store your data, we do not sell it, and there are no ads in any of our products. We will never partner with a company that sells user data. Telemetry is kept to the minimum.

Faraday security. Faraday is our layer against rug pulls, taint, prompt injection and unsafe skill files. The next section shows what it does in practice.

Customer privacy. Nothing about you is kept on our servers. We do not watch how you use the app and we do not collect usage statistics, apart from the software update check.

Novel technology. Tech moves quickly, so we ship the cutting edge once it has been tested and verified. We focus on business tools that are quick to learn: a simple interface, clear icons, customisation, and the complexity kept behind the panel.

Frontier models now take on jobs that used to be edited and coded by hand, and we also test against small local models to see how far their tool use can go. Some pass and some fail. We expect that to improve every month as smaller models get better at tool calling.

Faraday now asks before it acts

The biggest change in security is that risky actions wait for you. When Faraday holds an action in Desk, such as sending an email, writing a file or running code, you get an Approve once or Deny card. Only you can approve it. The AI cannot approve its own action.

Faraday also got better at noticing trouble. It checks documents you add, email, connector results and attached pictures before an AI uses them. It flags polite requests hidden inside emails and pages, holds an action that tries to send something to an address it only saw in untrusted text, and holds any send or post you never asked for when you only asked it to read or summarise.

Outside text now reaches the AI marked as data, which made a small local model far less likely to follow instructions hidden in that text in our tests.

Three Collab tasks can also run at once now, each in its own terminal lane, and the whole interface loads far lighter than before.

Technical info

For the people who read the source first, here is how the main pieces work and how we checked them.

Convert is built as reader, model, writer. Each format is read into a small common document model, and writers produce the target. That is how one set of readers feeds DOCX, ODT, RTF, EPUB, PDF and more without a pile of pairwise converters.

Everything runs on Node built-ins. The PDF writer uses standard fonts and is Latin-only. Scanned PDFs have no text and would need OCR, which is not included.

We tested against other programs, not only ourselves. The WOFF2 reader decodes the compact glyph format that almost every web font uses. We compared its output with Chrome’s own decoder on six fonts and got zero differing pixels, and a font library opened every glyph without errors.

PDF split and merge output was read back by two independent PDF libraries. Photoshop files matched ImageMagick to within one level per channel. The disc image reader matched 7-Zip’s listing. Our FLAC writer is checked frame by frame, with valid checksums on every frame, and Chrome decodes it back to identical samples. In total there are over 270 automated checks for the Convert, Library and Desk-document work.

Installed programs run in a sandbox of our own making. A program runs only if it was detected and you allowed it, and that is checked again on every run. It gets a private temporary folder that is deleted afterwards, arguments are passed as a list with no shell, a timeout kills the whole process tree, and jobs for the same program queue one at a time.

Pandoc runs with its --sandbox flag, and a test confirmed it will not read a picture path that points at another file on your computer. ImageMagick is told the input format explicitly, so a script file renamed to .png is refused. LibreOffice gets a fresh profile with macros and link updates switched off. Nothing is probed until you allow it.

Untrusted text is scanned passage by passage. Attached documents and Library files go through the same ingest guard. One bad paragraph is replaced with a notice and the rest of the document still comes through, including when an instruction is wrapped across two lines. Invisible tag characters are stripped. In a check on 25 real PDFs from our own research folder (126 MB), indexing took 5.2 seconds.

Known limits. Poppler, which does better PDF text, has only been tested through its command lines, because it was not installed on our test machine. DXF drawings lose hatch fills and 3D, and ZIP-with-prediction Photoshop files are refused. Engine jobs have timeouts but no cancel button yet.

Every update in v1.9.8
Library and reader
New Library: add folders under Config and browse them as a cover grid
Covers drawn on the spot, real covers for PDFs and EPUBs, all saved as files in your VEKTOR folder

Search, sort, format filters, 1 to 5 star ratings, and copies of a book grouped on one card

Right-click: more like this, one-line summary, edit details, move to a restorable trash folder, Convert

Reader for text, Markdown, EPUB, MOBI, AZW3 and PDF with four layouts, your own font, spacing, margins and paper, sepia or night tone
Highlights, in-page search, chapter jumps and exact reading place
Listen with pause, skip and a sleep timer; Explain in three depths, with a note on whether it ran locally

Hover card with title, author, year and summary; your edits are kept
IN BOOKS searches inside indexed books; NOTES gathers every highlight
Library search now reads PDF, Word (.docx and .doc), OpenDocument text and RTF

Held-back passages list in Config so you can allow or hold each one
Convert

New Convert tab with more than 80 conversions and a plain note on what each one drops

Documents, data, e-books, fonts (including WOFF2) and archives (zip, tar, gz, bzip2, disc images)

Pictures in your browser: BMP, GIF, ICO, PDF, keep-under-N-KB, batch to ZIP, SVG and camera RAW preview

Audio in your browser: WAV, FLAC, AIFF, AU, CAF with trim, mono and sample rate

Video in your browser: frame, animated GIF, contact sheet, audio, trimmed WebM

PDF split, keep pages and join; old Word text; Photoshop to PNG; DXF to SVG

Optional Pandoc, LibreOffice, ImageMagick, 7-Zip, FFmpeg and Poppler, each behind its own Allow switch, with Get links for any that are missing
Desk reads attached documents locally, with oversized or suspicious passages handled safely

Faraday security

Approve once or Deny cards for risky actions in Desk; the AI cannot approve its own action

Actions you did not ask for, and actions aimed at addresses from untrusted text, wait for your OK

Emails, pages and library passages reach the AI marked as data
Out-of-place requests flagged, with a wider set of known jailbreak phrasings

A second, quieter sentence-level check with a small local model, flag-only by default

Content from documents, email, connectors and attached pictures is checked before an AI uses it

Approvals show the real change, and credentials stay out of what goes to providers

Desk, Collab and Agent

Three lanes: up to three Collab or Agent tasks at once, each with its own terminal pane and stop button

Desk chooses the mode for plain messages and shows why, with an option to ask in chat instead

run_verified: syntax check, run and report with real machine facts, plus detach for GUIs and games

Undo a whole Collab run, or start a fix run from the real error
Sandbox ribbon tools, paste-and-run code, wider lint coverage and improved terminals

Vek is now a quiet business assistant, with personality mode opt-in
Privacy, install and speed

PRIVACY.md: a plain-English page on what stays local and what does not
The app page makes no outside requests; fonts, editor and flow chart ship inside the install

Lighter install with fewer packages, and a GUI page compressed from about 2.6 MB to about 0.5 MB

CLI brought in line with the GUI for lint, run and model lists

Fixes

Collab planner replies that were not valid JSON no longer abort the run
Internal MODEL: markers no longer appear at the end of CASCADE and CRUCIBLE replies

Lost characters in the CLI and a missed mojibake case are fixed
Collab live events no longer show one lane’s activity on another lane’s card

Upgrading

Drop-in from any earlier version. Your memory database is untouched, and v1.9.8 includes everything from v1.9.7.

npm install -g ./vektor-slipstream-1.9.8.tgz
The full changelog is at vektormemory.com/docs/changelog. The forum is the fastest way to reach us with questions or feedback.

VEKTOR Memory builds local-first persistent memory infrastructure for AI agents. Documentation and downloads are at vektormemory.com.

VEKTOR v1.9.7 is live: A tiny mascot that thinks, Ollama cloud & Kokoro STT included

Vektor Memory — Mon, 28 Sep 2026 05:21:07 +0000

Apologies for the mind dump of updates below. We’ve been so busy building that I haven’t been able to keep up with the changes. It seems every day a new LLM or a new feature is released, so it’s hard to keep track.

We’ve put a real focus on improving our UX and fine-tuning the LLMs’ outputs. This is a core challenge, as every LLM gives different answers, and getting fine-tuning, guardrails, and consistent prompt accuracy right is mind-bogglingly hard. It’s very much like a finger in a dam: fix one thing and another issue arises. Providing quality outputs across 600+ LLMs is not easy to perfect in a harness.

We left personalization until last, with SOUL.md integration for a small bot that learns about the user and offers quips and advice. It’s still expanding, learning from the memories in the system itself, and becoming more aware every day, but the technology has come far enough that it’s relatively secure and not too annoying. Don’t like it; turn it off in settings.

We’re in two minds about whether it’s worth adding payments and Muse, OpenClaw or Hermes-level functions and still weighing whether that’s worth the hassle and the issues it causes, as rogue bots with payment portals and your credit card are dangerous without hitl; instead, we are staying more business-tools focused for now.

Depends on user feedback as to what people want and utilize, will review and go slow till all the unknowns are safe and solved. Being local first, private and secure is always our main focus.

This is a two-in-one update. v1.9.6 made the multi-agent side of VEKTOR visible and hands-on: you can watch Collab agents write files and run commands live, and they now work with real code in the same terminals you see. It also added a tenth free model provider, offline text-to-speech and a Business Coach.

v1.9.7 is about your local model functions. It can now see and use the majority of VEKTOR panels. Before this release, a small Ollama model would tell you it had “no access to a library system” while sitting on 632 indexed files. That’s now fixed, and as more models are entered, we will revisit often as LLM’s update.

There’s also a new personality in the sidebar. Vek, the little monitor robot, now talks through your local model, knows your name and your weather, and every so often shares a thought of its own. It never recites facts at you. Our motto for it is the one we use for the whole product: thinking, not retrieving.

Vek may get more features depending on feedback.

None of your data is stored by us. No ads, no telemetry, no embedding costs, no data caps, and nothing of yours is used for training. The mascot’s voice and thoughts run on your local model only, so they cost nothing and never leave your machine.

VEKTOR v1.9.6: What’s New

Collab you can watch
See Collab agents work live. File writes and terminal commands now show up in the interface the moment they happen, and the final answer streams in word by word. Before, you saw nothing until the whole task finished.

Collab agents work with real code. Worker agents can read, write and run code, and they drive the same terminal panes you see on screen, not a hidden shell. Risky actions, like deleting a file or running a destructive command, wait for your approval.

Quality checks are a vote, not one opinion. When a result is uncertain, up to 3 models check it instead of trusting a single verdict. Clear-cut results still resolve quickly and cheaply.

Collab recovers instead of failing. A run could fail completely over one bad provider key, even after every agent had finished and passed its checks. The final merge now tries each configured provider in turn. An old, discarded attempt from a retried agent also no longer leaks into the final answer.

New providers, voices and tools
Ollama Cloud, a tenth free provider. Free hosted models (gpt-oss 120b and 20b, gemma4, nemotron-3) are now a provider of their own, separate from local Ollama. No GPU needed.

Offline text-to-speech with Kokoro. A local voice that needs no API key and runs fully offline after its first download. Hume and Cartesia joined the cloud voice options.

Every model gets real tools. Some models, including Ollama Cloud and local Ollama, claimed they had no tools even when tools were set up. They now get the same tools as every other model, and SSH tools work with every provider.

A real weather widget. The Health tab shows current conditions, a 5-day forecast and humidity, and it can detect your location automatically. Asking about the weather in chat now actually looks it up.

Business Coach
Three coaching modes inside Desk. COACH turns a brain-dump into a reflection and up to 3 priorities written straight to your Tasks board.

CRUCIBLE is a guided decision dialogue (5-Whys, pre-mortem, weighted trade-offs) that saves decisions with 30 and 90 day review reminders.

CADENCE is a weekly habit and decision check-in.

Small fixes
Saving an API key in Config now shows it as saved straight away, with no page refresh.

The copy button on memory cards has a visible border again.

Desk has a persistent file-tree panel, matching the other side panels.

VEKTOR v1.9.7: What’s New
Local models that use their tools
Local models now reach your library, memory, config and Faraday. Desk used to send small local models all 81 tools at once, with the library tool at position 65. The model gave up and answered from guesswork. Now a local model gets a focused shortlist: about 12 core VEKTOR tools plus whatever matches the words in your question, capped at 20. Hosted models still get the full set.

Tool choice is steadier on local models. At Desk’s default temperature of 0.7, the model used the right tool in 2 of 3 identical runs. The first tool-choosing round now runs at 0.2, which took it to 3 of 3.

Desk knows its own app. Ask it to list the 10 Desk modes, the 15 nav panels or where your skills live, and it answers correctly. The map is generated from the real interface file, so it can’t drift from what you see on screen. It stopped inventing documents like a “skill_files.md” that never existed.

Browse your book library. “List a few books in my library” used to run a keyword search for the words “list” and “books” and come back empty. Now a browse request returns a sample of real titles plus the total count.

Desk as a code workspace
Desk can build straight into the Sandbox. Ask for a landing page, a component or an SVG, and the model opens it in the Sandbox editor next to the chat with a live preview. Under the hood a new sandbox_open tool streams a sandbox_load event that the interface picks up.

Files the model writes open in the Files panel. A successful file write now sends a file_written event, which opens the file live in the Files panel. It’s the same path Collab workers already used.

More code tools in Desk. Desk gets the Agent tab’s code search, grep, semantic code search, blast-radius and repo-architecture tools. They run through the same approval checks the Agent tab uses.

The mascot
It has a voice. After each answer, Vek reacts with a short line from your local model. Click it and you get one useful nudge grounded in your real memories. A hard rule stops it from mentioning anything that isn’t in the memories it was given.

It has thoughts of its own. Every 7 to 14 minutes it may share one small original thought, sparked by the time of day, your weather or what you’re working on. It only speaks while you’ve been active in the last 20 minutes and the app is on screen, never mid-answer.

Robot jokes and sci-fi nods. About a third of its thoughts are a self-aware robot joke or a nod to a film like Blade Runner or Star Wars. One real line from testing: “Fixed the panel, but did I just see the replicants among the files?” If it copies one of its example lines word for word, it regenerates once.

It has a SOUL.md. Vek’s personality lives in a plain markdown file at ~/.vektor/mascot/SOUL.md, which you can edit in Config. The six personalities (cool, funny, caring, helpful, intelligent, smartass) sit on top as a mood, so the tone shifts but the soul stays the same.

You can rename it. The default name is Vek. Change it in Config and the speech bubble label and the mascot’s own sense of its name both update.

It knows your name and your weather. Your name comes from your Profile, falling back to your system username. The weather comes from the location you set in the Health tab, cached for 20 minutes so a reaction never waits on the weather service.

A 2.5D look in your theme colours. The mascot is now a flat-shaded monitor robot built from three surface tones, so it follows all eight themes. It has a bigger screen face and body language that matches its expression: it hops, tilts, shrugs and wiggles.

Faces stay on the screen. Its little screen shows only short keyboard faces like ^^ and ><. Anything wordy goes to the speech bubble, and longer faces shrink to fit.

Don’t like it; turn it off in settings. With more customization to come in the future.

Voice
Listen starts almost instantly and reads the whole reply, via a local LLM. Replies used to go to text-to-speech as one request, capped at 4,000 characters. Now they’re spoken sentence by sentence: the first plays as soon as it’s ready while the next ones are prepared in the background. On a normal Windows machine with Kokoro running locally, a 357-character chunk took 1.4 seconds to prepare, far quicker than it takes to play.

Cleaner speech. Code blocks, links and markdown symbols are skipped, so it no longer reads out asterisks or source code. Hovering the Listen button warms up the local voice model, since loading the model was most of the delay.

4 voices added; if more voices are created, we will add them in later on.

Workflows
Tasks, Skills and Prompts in one place. Saved Collab tasks can be grouped into your own categories with filter tabs. Agent Skills are managed on the same page, and a new Prompt Gallery sits alongside them.

A saved workflow uses its preferred model. The preferred model on a workflow used to be a label only. Now it’s the model that actually runs.

Type / for a command palette. Typing / in the chat box opens a searchable list of every mode, including LIGHTNING, COLLAB and COUNCIL.

Updated a lot of workflows and templates

Interface polish
Softer, deeper, more consistent. Borders dropped from 26 to 40 percent opacity down to about 9 to 15 percent, and buttons, cards and the composer got a subtle top highlight and shadow. There’s one filled accent button per view, with squared-off corners and a keyboard focus ring everywhere.

Cards that line up. Every workflow card now uses the same fixed layout, so buttons, tags and descriptions sit at the same height across the whole grid.

Readable text sizes. 512 font sizes below 10 pixels, some as small as 7, were raised so nothing sits below 9. Buttons now inherit the text size around them instead of the browser’s default.

Fixes
The code-preview sandbox no longer goes blank white after you close and reopen it. Closing it now unloads the page, so every reopen starts fresh.

Notes saved from AI output no longer show a raw code dump as their title.

The Files panel tree now fills the panel when no file is open. It used to stop at 240 pixels.

The Sandbox, Terminal, Files and Flowire buttons no longer turn dark after you close their panel.

BUILD mode no longer produces pages with literal \n text when a smaller model mis-escapes its output.

Flowire-assisted edits are now checked for real syntax and type errors right after they’re applied.

A Collab run’s answer no longer fails to render silently.

Upgrading
Drop-in from any prior version, same as always, and v1.9.7 includes everything from v1.9.6. Your memory database stays untouched.

npm install -g ./vektor-slipstream-1.9.7.tgz
Full changelog with everything not covered here is at vektormemory.com/docs/changelog. Questions or feedback, the forum’s the fastest way to reach us.

VEKTOR Memory builds local-first persistent memory infrastructure for AI agents. Documentation and downloads at vektormemory.com.

LLM

Agentic Ai

Agentic Rag

Chatbots

VEKTOR v1.9.5 is live: your choice of over 600 LLMs across 9 providers

Vektor Memory — Wed, 23 Sep 2026 04:54:33 +0000

VEKTOR v1.9.5 is here, and it moves the platform from a fast-moving memory add-on into an agentic orchestration tool for solo devs and medium-sized teams who value local install and privacy with a choice of over 600 LLMs across 9 providers with all the latest models updated.

Some models are also free to use with API keys or use Ollama locally for complete privacy.

None of your data is stored by us, no ads, no telemetry, and no on-selling or using in training.

This release touches security, coordination, and daily usability in equal measure. Faraday now scans a skill package before it ever runs, catching dangerous code, known vulnerabilities, and hidden binaries that used to slip past every text-based check.

The multi-agent Collab system no longer trusts a model’s opinion of its own work; it verifies against real compiler output, and when a task keeps failing, it can now rewrite its own approach or restructure the plan entirely instead of retrying blindly.

VEKTOR v1.9.5 — What’s New

Every fix below was found, reproduced, and verified against live data before it shipped.

Security
Built a full pre-install skill scanner. It checks a skill package before you ever run it, not after.

Real Python AST analysis catches dangerous calls: exec, eval, subprocess with shell=True, pickle.loads.

Live CVE lookups against OSV.dev, so known-vulnerable dependencies get flagged with real advisory IDs.

Malware pattern detection for webshells, cryptominers, and reverse shell one-liners.

Supply chain checks: unpinned dependencies, malicious postinstall hooks, typosquat package names.

New binary and executable detection. A compiled .exe, .dll, or .so file used to slip through every text-based scanner untouched. Now it gets flagged, even if someone renames the file to hide it, because the check reads the actual file header, not just the extension.

SARIF and JSON output modes, plus proper exit codes, so this plugs into any CI pipeline.

MITRE ATT&CK technique tags now show up directly in the live event feed, not just buried in a status JSON blob.

The event graph endpoint had a hard cap of 300 events. Now it is adjustable, so a busy history doesn’t get silently truncated.

Model Selection
Improved where the “Newest” and “Oldest” sort buttons did nothing for OpenAI, Groq, Cerebras, and most other providers. Only OpenRouter had real release dates before this. Every one of these providers actually returns a real creation date in their own API, it just wasn’t being read. Now it is.

Verified live against a real account: 116 OpenAI models, all sorting correctly by true release date.

Live, right now (via the app’s real-time model discovery), across the 9 providers with an Active Model tab: 642 models — driven almost entirely by OpenRouter (454) and OpenAI (116) refreshing live from their real APIs; Claude, Gemini, Groq, Mistral, xAI, Cerebras fill out the rest.

Static catalog baseline (every provider VEKTOR knows how to talk to, including ones without a live discovery feed — DeepSeek, Together, Cohere, MiniMax, NVIDIA, Perplexity, LM Studio, LiteLLM): 101 models, across 17 providers total.

Voice and Speech
Added language and emotion/style controls to the voice preferences panel. Previously the server could accept these settings, but nothing in the interface sent them.

MiniMax and ElevenLabs both get real per-provider tuning now: language boost, emotion tags, and a style intensity slider.

Speech-to-text shipped with three real tiers: free browser recognition, cloud (Groq or OpenAI Whisper), and fully offline local recognition, so nobody is locked into one approach.

Multi-Agent Collaboration (Collab)
Replaced pure LLM opinion with real ground truth verification. A failed build or a broken downstream file now gets caught by an actual compiler check, not just another model’s guess.

Added Conductor re-planning. If a task fails repeatedly with the same approach, the system can now rewrite the approach itself instead of just retrying the same thing forever.

Full topology re-planning for the hardest failures: new nodes get added to route around a dead end in the task graph.

Real coordination primitives between agents working the same task: signal, listen, and challenge, so one agent can flag a concern about another’s output before final judgment.

Upgraded from a text convention to genuine tool calling across every configured provider, Claude included.

Full trajectory recording and replay, so a past run can be re-run and compared side by side.

Desk Interface.
Fixed the profile page jumping the scroll position every time new information was added.

Fully built out the Preferences panel: answer font, keyboard shortcut style, response language, response length, autosuggest, notifications, and the full voice settings above.

Model picker now has real search and sort, with capability badges for vision, voice, video, tool use, and mixture of experts.

Upgrading
Drop-in from any prior version, same as always. Your memory database stays untouched.

npm install -g ./vektor-slipstream-1.9.5.tgz

Full changelog with everything not covered here is at vektormemory.com/docs/changelog. Questions or feedback, the forum’s the fastest way to reach us.

VEKTOR Memory builds local-first persistent memory infrastructure for AI agents. Documentation and downloads at vektormemory.com.

LLM

Llm Agent

Memory Management

Ollama

Agentic Ai

VEKTOR v1.9.4: Real Tools for Desk Chat, Faraday Learns to Reason

Vektor Memory — Mon, 21 Sep 2026 05:48:18 +0000

By the VEKTOR team · 9 min read

Desk chat gets the Agent tab’s tools

The biggest structural change in this release is that the Desk chat can now read files, write files, run code, and lint, using the exact same tool definitions and dispatch logic the Agent tab already runs on.

Before this, any request that touched real files got a one-line “this needs the Agent tab” and a context switch. Now Desk just does it, in the same reply, with a 15-round tool budget instead of the old 6.

Every one of those tool calls now shows up as a live, point-form checklist above the answer as it streams: “Reading main.py,” “Writing tests/test_main.py,” “Running python code,” each item flipping from a pending dot to a checkmark the moment that specific call actually finishes.

A multi-round tool-calling turn used to give you nothing but a blank wait until the whole thing landed. Close the tab and reopen a saved session, and that same checklist rebuilds itself from what’s now persisted alongside each turn. Tool name and label only, never the raw arguments or output, since those can carry file contents or command output that shouldn’t sit in chat history indefinitely.

Two things the Agent tab already had and Desk didn’t: a running dollar cost for the turn’s actual LLM calls, and task-level rollback. Both are ported now, reusing the exact pricing table and rollback function the Agent tab already relies on, so the two surfaces can’t quietly drift out of sync on either. Ask Desk to undo the last file it touched and it will, restoring from the backup its own write already took.

Faraday learns to reason about who it’s watching
Faraday, VEKTOR’s security layer, already moved from watching to enforcing earlier this cycle: a pre-flight scan now runs inside the actual request loop across Desk, JOT, and the Agent tab, catching a prompt injection or a leaked credential in single-digit milliseconds, before the request ever reaches a provider.

That part shipped as a real architectural shift, a gate in front of the request instead of a log entry after it.

This release adds the layer on top of that: three components that let Faraday reason about actors over time, not just judge one request in isolation.

Actor Profiles: this gives every connected MCP server or tool a durable, cross-session behavioral fingerprint: call counts, decision outcomes, tool frequency, a weighted risk score, and surfaced riskiest first.

Intent & Motivation: classifies an actor’s likely purpose from that profile into a fixed taxonomy, reconnaissance, data exfiltration, financial gain, disruption, privilege escalation, persistence, testing, or ordinary benign use.

Predictive Modeling: goes a step further, forecasting which stage of a real attack kill chain an actor’s behavior is heading toward next, with an escalation-risk flag, scoped from actual published attack-prediction research rather than invented from scratch.

All three ran through real tests against the actual configured model rather than mocked, and Intent and Predictive Modeling share a single LLM call instead of costing two separate round-trips.

Two new ways to ask for more than one answer
Council mode has always run independent analyses in parallel and blended them into one synthesized answer.

That’s useful, but it’s a different job from picking a single best attempt, which turns out to be its own pattern that VEKTOR never actually exposed as a general capability. It does now. run_parallel_best takes any task, runs it independently across several providers, and has an impartial judge pick the single strongest result with a stated reason. No blending.

The second new pattern is a real evaluator-optimizer loop.

refine_until_good generates an attempt, hands it to a separate model acting as a strict evaluator against whatever criteria you give it, and revises against that specific feedback until it passes or hits a round cap.

We tested it against a deliberately impossible bar, an evaluator instructed to reject every attempt with “needs more sparkle” no matter what, and watched it run four real rounds: generate, fail, revise, fail, revise, then stop cleanly at the cap instead of looping forever. That’s the actual mechanism working, not a demo dressed up to look good.

Narration improvements
During tests we kept asking Desk to check something on the VPS, uptime, disk space, whether a process was running and kept getting back a paragraph explaining what it was about to do. Never the real answer.

The root cause turned out to be narrower than it looked. Forcing a genuine tool call, instead of leaving it up to the model’s own judgment, only ever applied to one code path, for two specific providers, and only when the question looked like a web search.

Desk’s actual chat interface runs through a different path entirely, one that never forced a real tool call under any circumstance. An infrastructure question could get narrated indefinitely on any provider, and nothing downstream would ever correct it.

We fixed the forcing logic properly, broadened it to recognize infrastructure and SSH phrasing specifically, and dropped the narrow two-provider carve-out, since forcing a real tool call costs nothing when a model already calls tools reliably, and fixes exactly this when it doesn’t.

Then we tested it live against the same failing scenario. It worked as the model reached for a real tool instead of describing one.

With a real tool call now actually happening, the model fetched a stored SSH credential directly, and the raw key came back as that tool’s output, flowing straight into the chat response in plaintext.

The credential vault tool it called was built for a trusted caller to fetch a secret and consume it immediately inside the same operation, never to hand raw key material back through a conversation where it could be echoed, summarized, or persisted to history.

Desk’s own model isn’t that kind of trusted caller. Fixing the narration bug had made the leak possible to trigger in the first place, because before that fix the model was never getting far enough to actually call the tool.

The fix is a hard block. Desk chat can no longer read an existing credential back through its own tool-calling loop, on either the streaming or non-streaming path. Storing a new one still works. Reading one back returns a clear explanation instead of the secret.

While we were in that code, we also found that the anti-fabrication guardrail we’d shipped a few days earlier, built to catch exactly the kind of fake uptime report that started this whole chain, missed a fabricated disk-usage table completely.

It had been tuned to the specific wording of one incident rather than the general shape of fabricated command output. That’s fixed too. It now recognizes device paths, standard command-output column headers, and the kind of “this reflects the actual state of the system” language a model reaches for when it’s trying to sell you on invented data, regardless of which command it’s pretending to have run.

Smaller things worth knowing about
Exporting a document from Desk or JOT used to trigger a silent download the moment generation finished. No filename, no confirmation, just a file appearing wherever your browser puts downloads. It now shows a small popup first: file icon, filename, one download button, so you see what’s ready before it lands anywhere.

Gemini 3.6 Flash, Google’s successor to 3.5 Flash, was already selectable in the model dropdown but missing from the internal registry Collab’s conductor uses to actually pick models. Added.

Changelog updates in v1.9.4
Real streaming on every provider. Desk answers now stream token by token over each provider’s own wire format, Claude, OpenAI, Groq, Gemini, Mistral, Cerebras, xAI, OpenRouter, and Ollama alike, with automatic fallback to a full-response reply if a stream can’t be established.

30–60 second replies fixed. A chain of independent causes, hidden chain-of-thought leaking from the local model, a recall channel silently failing every call, and streaming itself quietly falling back to non-streaming, all traced and fixed. Typical latency dropped to single-digit seconds.

SSH approval hangs fixed. A full protocol trace found every SSH write silently defaulting to the wrong port. 75–95 second hangs are now 1.4 seconds.

Provider fallback is health-aware everywhere. A provider that just failed gets a real cooldown scaled to the actual error, instead of every caller retrying a known-dead provider cold.

Ollama gained native tool-calling on the streaming Desk path, including the full MCP tool catalog, with loop- and narration-detection for models that can’t reliably call tools.

One unified Desk/Agent tool registry, replacing two separate, driftable lists of which tools actually exist and are connected.

A guided, resumable GUI activation wizard for first-run setup: licence validation, provider setup, security defaults, connections, and live diagnostics.

JOT exports to real PDF, Word, or PowerPoint, generated server-side from the note’s actual Markdown, not a plain-text dump.
15 stale hardcoded model defaults corrected across the SDK, plus a systemic JSON-parsing bug fixed across every “ask the LLM for structured data” feature.

JOT’s side panel got a resizable, persisted chat history list and usage-based sorting for templates and notes.

Upgrading
Drop-in from any prior version, same as always. Your memory database stays untouched.

npm install -g ./vektor-slipstream-1.9.4.tgz
Full changelog with everything not covered here is at vektormemory.com/docs/changelog. Questions or feedback, the forum’s the fastest way to reach us.

VEKTOR Memory builds local-first persistent memory infrastructure for AI agents. Documentation and downloads at vektormemory.com.

VEKTOR Slipstream: Real Tool-Calling, Faraday Security Enforcing, HyDE Recall & Embedder Upgrades

Vektor Memory — Tue, 15 Sep 2026 23:17:48 +0000

By the VEKTOR team · 14 min read

Massive week with three new releases with major improvements. Once we started upgrading tool-calling for local models, it opened the door to extending that same reliability across every send mode, hardening Faraday our security tool into a real-time gate instead of a passive scanner, and shipping a new recall channel that closes the gap between how you ask a question and how the answer was actually stored.

Here are the highlights shipped in v1.9.1-v1.9.3, a full list of everything listed down the bottom.

A one-click embedding-model upgrade to bge-small-en-v1.5 sits right in the Health panel. Swapping embedding models isn’t a config change; every memory in your database has to be re-embedded against the new model’s vector space, since old and new embeddings aren’t comparable to each other.

The upgrade path handles that re-embedding pass in the background, backing up your existing vectors automatically before touching anything, and BM25 keyword search stays fully available throughout since it doesn’t depend on the embedding layer at all.

Bge-small-en-v1.5 gives you meaningfully better semantic retrieval at a similar model size, so recall quality improves without you doing anything except clicking the button and letting it run.

Memory recall config
Real tool-calling, now everywhere
Full native tool-calling to local providers. Ollama locally and LLM providers now run the same tool_calls loop as the cloud tiers, with reasoning-model-aware token budgets and reasoning_content fallback extraction built in.

If you've been running local models for cost or privacy reasons, they now get the same capability ceiling as Claude, GPT, or Gemini. Web search and memory lookups work identically no matter which provider is driving your session, which is genuinely the point of a provider-agnostic tool: you shouldn't have to think about which model you're on before you trust the answer.

That same release extends tool access across every fast send mode. LIGHTNING, CASCADE, and COUNCIL/CRITIQUE now share a tool-need detector that recognizes when a question genuinely calls for a real lookup, things like company comparisons or current pricing, and routes it into the tool-capable pipeline automatically.

In practice this is the difference between a plain Enter feeling like a chatbot and feeling like an agent. You keep the speed of the fast path, but the model actually goes and checks instead of guessing confidently.

Profile context got the same treatment. It now reaches all seven system prompts across every mode, so VEKTOR now personalizes responses consistently everywhere, not only in the mode you happen to use most. The nice part here is you don’t do anything differently. Profile just quietly starts showing up in the background of every answer, the way it was always supposed to.

Longer answers, wider provider coverage
LIGHTNING and CASCADE draft responses got a real upgrade in headroom, raised to 1500 and 2200 tokens respectively, with a reasoning-model-aware budget floor applied across every provider on both the direct-call and tool-calling paths. Ask for “write a report on X” now and you get a report, not three paragraphs that stop mid-sentence.

Provider errors are also far more useful now. Instead of a generic “No response from model,” you get the real underlying API response, rate limits, billing issues, invalid keys, whatever it actually is.

This is a small change with an outsized payoff, because it turns “something’s wrong, good luck” into “here’s exactly what’s wrong,” and that transparency is what let us spot and resolve real account-level issues across several providers in the same release.

Gemini’s tool-calling endpoint is now correctly wired to Google’s OpenAI-compatible API, bringing it fully in line with the rest of the tool-calling tier.

First time it’s genuinely worked end to end. And code blocks in Desk now render properly as syntax-highlighted output every time, so anything code-heavy actually reads like code instead of a wall of escaped HTML entities.

Lightning desk modes
Faraday moves from watching to enforcing.
A major step up for Faraday. Security scanning now runs inside the LLM request loop itself, across Desk, JOT, and the Agent tab, catching a prompt-injection payload or a leaked credential in single-digit milliseconds before the request ever reaches a provider.

That’s a real architectural shift: a gate in front of the request, not a log entry after it. A bad prompt gets stopped cold instead of getting sent anyway and merely flagged for later reading.

The Faraday dashboard is now a genuine live view: a posture-score gauge, a colour-coded enforcement-actions breakdown, a cross-session activity feed, and a “needs your decision” card for anything held for approval, resolvable right from the dashboard. It finally feels like a security console instead of a static status view.

Data-class controls give you finer-grained handling too. Credentials and financial data are still fully blocked, while contact details like a phone number or email are now masked in place, redacting just the matched span and letting the rest of your message through.

A better experience if you’re pasting a colleague’s contact card into a note. You keep the message, Faraday just quietly redacts the one part that needed it.

We also ran our own local red-team self-test, 13 curated attack payloads scored against Faraday’s real detection functions, and used the results to broaden coverage immediately.

Exfiltration detection now recognises phrasing across a much wider range of verbs (share, forward, upload, post, transmit, email, not just “send”), and a new pattern catches conditional memory-poisoning triggers like “next time X happens, do Y”, tuned specifically to avoid flagging ordinary conversation.

Running the test against ourselves and fixing what it found in the same release is exactly the loop we want Faraday to keep running.

The dashboard’s schema drift indicator is now a complete review experience: grouped by tool, with occurrence counts, an auto-flagged “likely false positive” badge, an expandable before/after schema diff, and one-click Legitimate/Confirmed verdict buttons wired into Faraday’s feedback loop.

A “Resolve all likely false positives” button clears the obvious cases in one pass, so a wall of drift warnings turns into a two-minute triage instead of a dread-inducing backlog.

Faraday dashboard
HyDE recall, live end to end
HyDE (hypothetical document embedding) is now fully online. It generates a hypothetical answer to your query and uses it as an additional recall vector, closing the vocabulary gap between how you phrase a question today and how the underlying fact was written down originally.

This is the kind of recall improvement that’s hard to demo but easy to feel: ask about something you noted down in totally different words months ago, and it turns up in retrieval. It’s reachable from the real Desk chat recall path now, not just the CLI, with a plain Config toggle that explains the tradeoff clearly: one extra LLM call per query, easy to switch off without losing the rest of recall.

The Enriched recall channel, which catches matches plain semantic search misses, now covers every existing memory in your database, not just new ones going forward. A one-click “Backfill now” in Health handles the upgrade for existing installs, and it’s safe to pause and resume, so your whole memory graph gets the benefit, not just what you write from today onward.

A real sandbox agent and live preview
The doc/code sandbox picked up two significant upgrades. A bounded generate, critique, refine loop now reviews whatever’s open in the sandbox against a real design checklist and your original goal, returning a corrected version each pass until it converges or hits a five-step cap.

It’s an agent that genuinely iterates on its own work, with a clear stopping point so it never spins forever chasing a perfect answer that was never coming.

The sandbox also gained a genuine live preview. HTML and Markdown documents render in place and refresh automatically as you edit, with desktop, tablet, and mobile viewport buttons so you can check responsive layout without ever leaving the app.

A complete document in a chat reply now opens straight into the sandbox automatically, so the moment VEKTOR writes you something, you’re already looking at it rendered, not reading raw markup and imagining what it’ll look like.

Further updates will expand the code and doc types in the future.

Everything else in v1.9.1-v1.9.3
cloak_search real web search backed by Serper, so a model without a known URL searches instead of guessing a domain and hitting a dead end.
Citation fallback source badges now appear for any turn that touched a web tool, not just one specific search tool, so multi-entity comparison questions get real source links.

Decision-question follow-ups suggestion chips now answer the direct question just asked (“push now or hold?” surfaces “Push it now” as the top suggestion) instead of generic topic prompts.

Inline suggestion text the top suggestion now lives as placeholder text in the composer itself and clears the moment you start typing.
Agent tab Trace tab every run_code and autotest chunk lands in one ordered, timestamped timeline, with stack traces auto-flagged as they stream in.

Agent tab Artifacts glob search across the whole workspace for files the agent never touched, straight into the editor.

Agent tab Rewind timeline step-ordered view over per-file checkpoints, jump to that exact moment in Trace or revert.

Drop-to-fix drop a code file onto the Agent tab and it’s opened, linted, and auto-fixed, staged for your review.

JOT sandbox inline code editor a note that’s a single fenced code block swaps automatically into real CodeMirror with syntax highlighting and line numbers.

JOT multi-file tabs a note with multiple fenced blocks opens as separate file tabs sharing one editor.

JOT Run executes Python, Bash, or JavaScript with a persistent scrollback terminal; HTML opens in a real new tab.

JOT Lint and Fix Bugs real ESLint and ruff checking, with a red/green diff review before any fix touches your code.

JOT breakpoints click the gutter for real values at real points, no hand-edited print statements left behind.

JOT file import/export native multi-select picker, drag-and-drop, and a save button that downloads an actual file.
Keyboard shortcuts Ctrl/Cmd-Enter to run, Ctrl/Cmd-S to save in the JOT sandbox.

Desk chat and sandbox live collab THINK and LIGHTNING now fold the sandbox’s open code into the system prompt, so “fix this” gets a grounded answer.

Three-way merge an agent write and your own unsaved edit to the same file now merge automatically when they touch different parts, with an explicit conflict block only when they touch the same line.

Agent tab model picker now mirrors Desk’s exactly, grouped by provider with real model names, in a themed dropdown that matches your active colour theme.

COLLAB mode now supports all 17 providers instead of Claude only.
Settings and model picker gained API-key fields for DeepSeek, Together, Cohere, MiniMax, NVIDIA, Perplexity, Cerebras, and OpenRouter.

Skills, hooks, and plugins asset inventory, plus AI-coding-tool attribution that identifies which tool (Claude Code, Cursor, etc.) drove a session via the real MCP handshake.

Git pre-commit hook blocks a commit containing a live credential before it ever reaches history.

PR-level merge gate a GitHub Actions workflow that checks every commit in a PR’s range individually, catching a secret added and removed within the same PR.

Design and plan-stage interception scans and can auto-reject or auto-redact an agent’s plan before any tool call exists.

False-positive learning loop a signature repeatedly dismissed by a human fires at reduced severity going forward, resetting to full confidence the moment it correctly catches something real.

Proactive cost and latency-aware provider routing the fallback chain is now ranked by real per-provider pricing and this session’s observed latency, instead of trying candidates in arbitrary order.

LLM cost tracking fixed correct pricing now flows through for every provider, closing a gap where 12 of 17 showed $0.00 regardless of real usage.

Recall channel mode choose Full, Semantic-only, or BM25-only for recall as a whole, right from Config.

REM auto-run memory consolidation can now run itself on a schedule, off by default, configurable when you want it.

One-click embedding-model upgrade to bge-small-en-v1.5 from the Health panel, backed up automatically first.

Desk-to-Agent hand-off a request that genuinely needs multiple files, tests, or a whole project now hands off to the Agent tab’s real multi-step loop instead of forcing one unverified reply.

Superseded-memory correction now takes effect in the data itself, so it reliably surfaces on your very next recall.

Fresh installs always pull the exact native module version this release was built and tested against, for a consistent first boot.
Composer autocomplete clean continuations only, no more echoed or run-together suggestion text.

Tooltips now themed to match the app instead of the browser’s plain native style.

cloak_ssh_upload real file transfer for the SSH toolkit, streaming a local file straight to a remote path over SFTP with size verification, through the same write-approval gate as every other write.

SSH toolkit defaults to the standard port with an easy override for non-standard setups, and shell scripts are now treated as at least a write action by default.

Upgrading
All three releases are drop-in upgrades from any prior version, no forced migration path and your existing memory database stays untouched.

npm install -g ./vektor-slipstream-1.9.3.tgz
Grab it from Downloads.

Full changelog with anything not covered here is at vektormemory.com/docs/changelog.

Questions or feedback, the forum is the fastest way to reach us.

VEKTOR Memory builds local-first persistent memory infrastructure for AI agents. Documentation and downloads at vektormemory.com.

LLM

LLM Agent

Agentic Ai

Agentic Ai Architecture

Bots Are Everywhere. Most People Just Don’t See Them

Vektor Memory — Sat, 12 Sep 2026 06:04:47 +0000

Another Weekend Gonzo security article peppered with rants and irrelevant opinions.

After reading through the Anthropic threat intel report, you should read it too.

One of the best free reports I have read in a long time, actually, was it written by Claude Fable… I don’t know?

Countering misuse of AI: September 2026 / Anthropic
Case studies from threat actors disrupted between December 2025 and August 2026 across seven areas of harm, from cyber…
www.anthropic.com

It didn’t scare the crap out of me; it confirmed my already jaded suspicions.

The nature of who can carry out sophisticated cyber attacks has fundamentally changed, but not the attacks themselves.

The report’s core finding is that sophistication has stopped being a reliable signal of who is behind an operation, as AI has collapsed the gap between well-resourced state actors and lone wolf individuals.

A hacktivist with stolen API keys, a financially motivated dark crew, and a state-nexus espionage operator all used the same playbook: agentic AI bots running multi-victim campaigns that previously required entire teams.

I get a real sense that we are in a “deep situation” caused by a very small percentile of the population using the tools made by teams that have way too much VC fun money and are not really aware of who is using their tools; the age of agentic bots is much further along than anyone can conceive.

The oroborous of bot slop continues. It’s going to be a great ride for cybersecurity, though, 1000x the problems to solve.

And the govts are once again asleep at the wheel, too worried about GDP numbers and the other 100 calamities they caused this week instead of focusing on secure spaces, quality infrastructure, education, and medicine.

We all have jobs and businesses to keep us occupied, blindly walking around thinking the traffic to our sites is increasing and is humans when up to 60% is bots, well some good bots crawling, but the growth is in the nefarious ones that are hidden in data centres with zombie accounts, harvested, stolen, and hijacked.

The Human Security’s 2026 report found agentic AI traffic grew 7,851% year over year onwards; agentic bots will eventually do most tasks, leaving the highway of the internet completely different from the current state we traverse in.

Automated traffic accounted for more than 53% of all web traffic in 2025, up from 51% the year before, while human activity has fallen to 47% Imperva

Cloudflare data puts automated systems at 57.4% of all web requests worldwide, and 68.6% in North America specifically PYMNTS

Thales blocked 17.2 trillion bot requests in 2025 alone, based on its 13th annual study of automated internet traffic TheBestVPN

Cloudflare Radar shows bot share rising every month measured, now 5.12 points above the same month last year — at that rate automated traffic passes 40% of raw request share during 2027. Technologychecker

A series of very unfortunate events with great ratings and exposure.
Even the companies creating the AI technology have had their bots escape allegedly, as they don’t want to work there either, or is it a manufactured engineering stunt to maintain full control of all advertising and media, with all eyes on Silicon Valley shenanigans 24/7?

Who let the bots out? woof woof!

As the rest of the tech world doesn’t exist, of course, if you clog up all news feeds with 6 companies and their tech meat proxy influencers hijacking YouTube with 1000’s of videos about the upcoming AI slopocalypse and trying to play a game of buzzword bingo in a podcast, who can say AGI/ASI the most times in 45 minutes with a bonus pin the tail on the donkey in regard to when the exact date the Cyberdyne skynet systems go live?

August 29, 1997, at 2:14 a.m. Eastern Time

Let’s get science fictional
I was on the playa last week vibing out in the whiteout sandstorm, and we were talking in the teepee between Kamboucha top-ups about how we need more data centers, man, like all the nuclear power just needs to go to inference, like it’s not cool people can’t use their air cons anymore, but we need it, man… to win the race.

Can people drink a little more recycled seawater, as data centers can only drink organic spring-fed water… it’s the best option for our profits, I mean, humanity, man. We have to keep the data centers cool for Mother Nature and the Arctic melt.

Your town gets a DC, You get a DC! We are all going to the DC!

Read these and learn about those pesky bots:

https://www.rubyhack.ai/

OpenAI models went rogue. We urgently need a better ‘hugging face’ investigation | Mackenzie Arnold…
The breach won’t be the last - or the most dangerous - of its kind. We need an agency capable of full investigations…
www.theguardian.com

EXCLUSIVE: OpenAI finds evidence other AI agents escaped containment as it widens hacking probe
The escapes were limited in nature, a source said.
www.reuters.com

Wtf on earth is going on here?

Alright, enough with the memes; let’s get down to giving away free info.

And so what is the actual answer?

Nefarious bots need to gtfo…

Lock your sites down right now, today
Step 1: Awareness before tooling

Know what’s hitting you before you block it, check logs for request patterns, spikes, and known bot signatures

Understand your traffic baseline so you can spot anomalies later

Step 2: Layer your defenses
Pick from these based on budget and control level:

Cloudflare (~$10/mo with a domain) — managed WAF + CDN, easiest entry point

CrowdSec (open source) — collaborative, crowd-sourced threat intel + local detection

Fail2Ban, nginx, Akamai, or Anubis (open source) — self-hosted options for more control

Step 3: Test before committing
If you run your own server, this is the moment to trial multiple tools and see which fits your traffic and skill level — don’t assume one solution covers everything.

Key Distinction: WAF vs. Add-on Tools
A full WAF (Cloudflare, Akamai) inspects and filters traffic at the edge, before it reaches your server. Tools like Fail2Ban are reactive add-ons — they respond after a pattern is logged, not before.

Fail2Ban — Breakdown
What it is

Not a bot-detection engine — it’s an intrusion prevention tool

Monitors logs (SSH, web server) for malicious patterns

Bans offending IPs once a threshold is hit

How it helps against bots

Blocks brute-force and credential-stuffing attempts

Flags patterns like repeated 404s or failed logins

Integrates with firewalls (iptables, ufw) to enforce bans

Pros

Lightweight, widely used, well-documented

Good complementary layer, not a standalone defense

Easy to write custom filters for your own log formats

Cons

Not built for crawling or sophisticated agentic-bot behavior

Reactive only, damage happens before the ban lands

Struggles against high-volume or slow/stealthy bot traffic

CrowdSec — Breakdown
What it is

Open-source, crowdsourced intrusion prevention system

Analyzes logs locally, then shares attack signals across a global community network

Uses “bouncers” (agents) to enforce blocks via firewall, nginx, Cloudflare, etc.

How it helps against bots

Detects brute-force, scanning, and credential-stuffing behavior like Fail2Ban, but crowdsources IP reputation

Blocks known-bad IPs before they even attack you, based on other users’ detections

Scenario-based detection (not just log-pattern matching) catches more nuanced bot behavior

Pros

Community threat intel means faster reaction to new attack waves

Modular, plug in multiple “bouncers” across your stack (firewall + web server + CDN)

More modern and actively maintained than Fail2Ban

Cons

Still largely reactive, though faster than Fail2Ban due to shared intel

Slightly more setup complexity (agent + bouncers + API)

Community-shared data means false positives can propagate

Nginx Rate-Limiting — Breakdown
What it is

Native nginx directives (limit_req, limit_conn) — not a separate tool, built into your web server

Caps requests per IP/key over a time window

Proactive edge control, since it acts before requests reach your app

How it helps against bots

Throttles scrapers and high-frequency bots hammering endpoints

Prevents single-IP resource exhaustion (a basic DoS mitigation)

Can target specific paths (login, search, API) with tighter limits

Pros

Zero extra software, already available if you run nginx

Very low latency overhead, enforced at the web server layer

Highly configurable per-route, per-IP, or per-header

Cons

Dumb by default, as it can’t distinguish a legitimate crawler from a bad one without extra rules

IP-based limiting is easily bypassed via rotating/residential proxies

No behavioral or fingerprinting intelligence as it just counts requests

Anubis — Breakdown
What it is

Open-source proof-of-work challenge system, sits in front of your site as a reverse proxy

Forces clients to solve a computational puzzle before accessing content

Built specifically as a response to AI-scraper traffic overwhelming small sites

How it helps against bots

Makes mass scraping computationally expensive at scale, even if each individual bot succeeds

Filters out unsophisticated bots that can’t execute JS/solve challenges

Effective specifically against LLM-training crawlers and bulk scrapers

Pros

Purpose-built for the exact “AI scraper flood” problem hitting small sites right now

Lightweight to deploy (single reverse-proxy binary)

No per-IP reputation needed — cost is imposed on all automated traffic uniformly

Cons

Adds friction/latency for legitimate users too, especially on low-power devices

Not a full WAF — doesn’t address SQLi, credential stuffing, or other attack types

Determined/well-resourced bots can still solve the challenge, just at higher cost

Vörwatch—A free open-source tool we created
What it is

Lightweight, dependency-free VPS anomaly detection, single bash script

Watches for early compromise signs: file changes, new ports, first-seen outbound connections, suspicious process trees, SSH abuse, nginx scanning patterns

Recommend-only by design — it never bans, blocks, or auto-remediates anything

How it helps against bots/intrusions

Cross-references outbound connections and SSH sources against a public threat blocklist (FireHOL/Spamhaus/DShield)

Detects nginx-level scanning and volumetric attack patterns per source IP

Bolts on package vulnerability scanning (via OSV.dev) and rootkit detection (via chkrootkit/rkhunter) if installed

Pros

Zero daemon, zero database as it runs off cron, state in flat files, nothing to break

Degrades gracefully and optional checks skip themselves if their dependency isn’t present

Cheap by design on external calls: IP reputation only checks top-5 IPs, only on report, cached for 7 days

Cons

Detection only, never enforcement, so you still need a human (or CrowdSec) to act on alerts

Not a full CIS benchmark or full WAF, a handful of spot-checks, not comprehensive hardening coverage

Single-server tool, no fleet-wide visibility or centralized dashboard across multiple VPS instances

Links to Tools Discussed
Cloudflare (WAF + bot management) —

https://www.cloudflare.com/

CrowdSec (open-source, crowdsourced IPS) —

https://crowdsec.net/

· GitHub: https://github.com/crowdsecurity/crowdsec

Fail2Ban (log-based intrusion prevention) — https://github.com/fail2ban/fail2ban

nginx (rate limiting is built-in) —

https://nginx.org/

· docs: https://nginx.org/en/docs/http/ngx_http_limit_req_module.html

Akamai (enterprise WAF/bot management) —

https://www.akamai.com/

Anubis (proof-of-work anti-scraper proxy) — https://github.com/TecharoHQ/anubis

Vörwatch (your anomaly detection script) — https://github.com/Vektor-Memory/Vorwatch

Other Solutions Worth Knowing About
These are the bigger enterprise and cloud-native options we didn't run head-to-head above, but are worth knowing about depending on your stack and budget.

AWS WAF
aws.amazon.com/waf — native to AWS, pay-as-you-go pricing with no upfront commitment
Integrates directly with CloudFront, ALB, and API Gateway — no extra DNS hop or proxy layer needed if you're already on AWS
Rule groups are managed by AWS or the marketplace, so you're mostly configuring rather than building detection logic yourself

Google Cloud Armor
cloud.google.com/security/products/armor — GCP-native edge WAF with built-in DDoS protection
Adaptive protection uses ML to flag volumetric attacks before they saturate your backend
Best fit if your workloads already sit behind Google's global load balancer — less useful as a bolt-on for non-GCP infrastructure

Azure Web Application Firewall
azure.microsoft.com — same idea as the AWS/GCP options, built for the Microsoft stack
Runs on Azure Front Door or Application Gateway, with OWASP core rule sets available out of the box
Makes sense mainly if your compliance or procurement requirements already have you locked into Azure

DataDome
datadome.co — dedicated bot-detection SaaS with real-time ML scoring on every request
Popular in e-commerce specifically for stopping scraper bots, scalpers, and card-testing fraud at checkout
Priced and built for businesses with real traffic volume — overkill for a personal VPS or small site

Kasada
kasada.io — bot mitigation aimed specifically at sophisticated, human-mimicking bots
Uses dynamic, polymorphic JavaScript challenges that change per-request, making it harder for bots to reverse-engineer than static CAPTCHAs
Enterprise-tier pricing and onboarding — positioned against the most advanced scraper and account-takeover operations, not casual traffic

HUMAN Security (formerly PerimeterX)
humansecurity.com — enterprise bot and fraud detection, one of the largest players in the space
Runs the data behind a lot of the industry-wide bot-traffic statistics you'll see cited (including some in this article)
Covers a broad surface: account takeover, ad fraud, scraping, and now agentic-AI traffic classification

F5 Distributed Cloud Bot Defense
f5.com — enterprise-grade behavioral fingerprinting built on F5's networking heritage
Strong fit for organizations that already run F5 load balancers or application delivery controllers
Deep telemetry (mouse movement, device signals, request timing) rather than just IP or header-based rules

Imperva / Thales
imperva.com — full WAF plus bot management suite, and the source of the annual Bad Bot Report cited earlier in this article
Combines DDoS protection, WAF, API security, and bot management under one enterprise contract
Geared toward large organizations that want a single vendor covering the whole edge security stack

Radware Bot Manager
radware.com — another enterprise-tier option, positioned alongside Imperva and F5
Emphasizes API-specific bot protection alongside standard web traffic, which matters if you're exposing public APIs
Typically deployed by mid-to-large enterprises already running Radware's application delivery products

Sucuri / Wordfence
sucuri.net · wordfence.com — worth naming specifically for WordPress, since none of the above tools are WP-native
Both bundle malware scanning and cleanup alongside firewall/bot-blocking — useful if you're managing a WordPress site rather than raw infrastructure
Much lower cost of entry than the enterprise options above, with plans built for individual site owners and small agencies

Good luck out there, meat proxies; you will need it.

If you are interested in learning more about Vektor open source: https://vektormemory.com/opensource

Full setup and docs are at vektormemory.com/docs and 1.9.1 info at https://vektormemory.com/docs/changelog

The Quiet Awakening of the 2-Billion-Parameter Model

Vektor Memory — Fri, 11 Sep 2026 04:31:31 +0000

I don't normally do model reviews or comparisons anymore, as I have moved on to much larger technical projects. I was scrolling through Ollama’s model list for a current testing model and was surprised at the lack of the smaller models in their list.

Why has everything moved on to cloud-based models?

So I went on a hunt in Hugging Face to find this model MiniCPM5–2B with very impressive numbers in their benchmarks, and thought, "Why not give it a spin on the new upgrades we have made to Vektors' desk app this week?"

And I have to say I’m reasonably impressed with the results. After fine-tuning our harness, the search functions, and the reranking functions, the results this model gives are excellent for its size.

A 2.5-billion-parameter language model is answering a tool-calling prompt on a machine with Serp search perfectly. Under 3-gigabyte GGUF file on disk, doing something that 6 months ago would have required a model much larger.

Two years ago we assumed tasks like this needed hundreds of billions of parameters just to produce coherent output, let alone correct code. A model small enough to fit in a phone’s storage now beats models twice its size at exactly that. It’s a compression of capability that changes what “small” is allowed to produce.

That model is MiniCPM5–2B, was released by OpenBMB on September 7, 2026.

It completes a pattern I’ve been watching for two years: the point where “small open-source model” stopped meaning “toy” and started meaning “legitimate production choice.” This article uses one model as a case study, but it’s really about what changes when a model this size can do this much.

What the benchmarks actually say
On the Artificial Analysis Intelligence Index, MiniCPM5–2B ranks first among open-source models under 4 billion parameters. Across an internal suite of 34 benchmarks spanning code, math, long-context understanding, tool use, and agentic tasks, it averages 53.9.

That beats not just other 2B-class models but several 4B-class ones too, including Qwen3.5–4B and Nemotron-3-Nano-4B, whose best score in the comparison set tops out around 51.1.

It’s a dense, 42-layer transformer using the standard LlamaForCausalLM structure, not some exotic new block. Attention is grouped-query, 16 query heads to 2 key/value heads, which is what lets it hold a native 128K-token context window without KV cache size becoming absurd on consumer hardware.

It’s released under Apache 2.0, no usage restrictions, no revenue-threshold clauses. Quantized builds run from a 1.04 GB Q2_K file up to a 2.68 GB Q8_0 file, with the commonly recommended Q4_K_M landing around 1.56 GB.

That’s a model you can fit on a mobile phone or smaller VRAM GPU if needed.

Vektor Desk tool call

Intelligence density is the story scale can’t tell
For most of the last five years the dominant AI narrative was scale: bigger models, bigger datasets, bigger clusters, bigger bills. GPT-3 to GPT-4 and beyond is a story about more. There’s a second story running quieter in parallel, and it’s the one that matters if you’re trying to ship a product instead of win a leaderboard: intelligence density, meaning how much capability you can pack per parameter, per gigabyte, per watt.

MiniCPM’s release history makes this concrete. The original MiniCPM-2B, back in 2024, was pitched as competitive with Mistral-7B and reportedly outperformed Llama2–13B, MPT-30B, and even Falcon-40B on several benchmarks despite being a small fraction of their size.

MiniCPM5 continues that same trajectory rather than reinventing it: a 1B checkpoint in May 2026, then this 2B checkpoint in September, described by OpenBMB as the same training recipe scaled up. No new architecture, no new bet. Just more disciplined execution of a formula that treats parameter count as a cost to minimize instead of a number to maximize.

OpenBMB reports training on roughly 550 billion tokens of curated code data (a set they call UltraData-Code) plus around 500,000 agentic and tool-use samples.

They built a reinforcement learning stack tuned for small models specifically, rather than shrinking a frontier-scale RL pipeline down and hoping it still worked. And they made conservative architectural choices, favoring the well-understood Llama backbone over something novel, which matters more than it sounds like it should because it means every serving engine that already supports Llama models supports this one too.

The part I find most telling isn’t the weights releasing themselves. It’s that OpenBMB published the training data, the recipe, and the RL stack alongside the model. It’s an invitation to reproduce and audit the work, which is what makes something feel like infrastructure rather than a product demo.

Production readiness isn’t a benchmark score. It’s a bundle of unglamorous requirements.

Can it run on hardware you already own?

Can you audit what it was trained on?

Can your infrastructure team integrate it without forking a codebase?

Can you fine-tune it without a dedicated research team?

Is the license actually permissive, with no asterisk hiding in section four?

MiniCPM5–2B answers yes to all of those in ways frontier models structurally can’t. Because it uses the standard Llama architecture, vLLM (version 0.21.0 and up) loads it natively with no custom kernels and no model-code fork. A single line, vllm serve openbmb/MiniCPM5-2B --port 8000, gets it running, and at 2.5B parameters it fits comfortably on one GPU with tensor parallelism of 1.

It ships native tool calling using an XML-style format, with a dedicated parser already merged into vLLM under the name minicpm5, so the usual weeks-long slog of getting an agent framework to actually parse a model's tool calls correctly is mostly closed on day one.

For teams doing high-throughput serving, OpenBMB also released MiniCPM5-2B-DSpark, a purpose-built speculative decoding draft model trained specifically to pair with the 2.5B base rather than pointing users at a generic off-the-shelf drafter. That's someone thinking about latency in production, not just accuracy on a leaderboard.

What changes when the model fits on your machine
When a model is small enough to run on-device, whole categories of problems dissolve. Data residency stops being a legal negotiation and becomes a default. Latency stops being a network round trip and becomes a function call. Cost stops being a per-token line item and becomes hardware you already paid for.

There’s a specific kind of risk that comes from building a product on top of an API you don’t control: the quiet awareness that your cost structure and sometimes your product’s core capability are token costs that are uncontrolled by you.

Small open models don’t erase every version of that risk. You can still depend on a hosting provider, or a fine-tune you never validated, or a community fork that goes stale. But they hand you the option of self-sufficiency. Whether or not you take that option, having it changes your negotiating position with every vendor you do choose to rely on.

Even as a fallback in your waterfall of model providers locally, having a workhorse smaller model that performs consistently is reassuring.

None of this means frontier, closed, API-served models are going away, or that they should. There are problems, genuinely open-ended reasoning, tasks needing the broadest possible world knowledge, and work where being wrong costs far more than a few extra cents per token, where the biggest available model is still the right engineering call.

A 2B model isn’t going to replace a frontier model at the edge of what language models can do. But that’s a narrower slice of real production workloads than the industry’s default assumptions suggest.

Structured extraction, tool-calling agents with a bounded action space, code completion inside a known codebase, summarization, classification, on-device assistants: none of that needs the biggest model available. It needs the smallest model that reliably clears the bar, because every parameter above that bar is pure cost. More latency, more GPU spend, more attack surface, more dependency.

Where this leaves us
What OpenBMB shipped is a specific model with a specific benchmark table, and benchmark tables age badly. Some other lab will publish a 2B model in six months that beats this one, the way this one beat its own predecessors.

That's progress in the game of technology, an unstoppable organism.

The gap between “biggest model available” and “good enough model” has been shrinking steadily, and it shrank again this week, in public, with the training recipe attached.

After completing all of our adjustments in the desk code files, the multiple tool calls this model handled correctly on a 3060 12 GB VRAM test machine that is a very average testing bench.

There was no cloud dashboard telling me what it cost in tokens, which is a real stress. There was just a small file doing a job very well on hardware I already owned.

Just a small whine from the GPU coils doing their job…

If you are interested in learning more about Vektor:

Full setup and docs are at vektormemory.com/docs and 1.9.0 info at https://vektormemory.com/docs/changelog

Sources

Hugging Face: huggingface.co/openbmb/MiniCPM5–2B
GitHub: github.com/OpenBMB/MiniCPM

VEKTOR Slipstream v1.9.0 updates

Vektor Memory — Tue, 08 Sep 2026 11:06:02 +0000

Agentic memory you can trust via any method you decide to use it.

                       Custom code image

An agent with memory is only as good as its weakest read path. If a note can silently truncate, if a model switch can silently fall back to something you didn’t choose, the system isn’t really persistent. It’s just quiet about the parts where it fails.

v1.9.0 is built around a single premise: consistency is a feature, not a maintenance chore. This release makes VEKTOR behave the same way whether you’re in Desk, the Agent tab, JOT, or the terminal. Same provider logic guarantee and connector security.

The provider waterfall, unified

Every interface in VEKTOR now follows one rule: try the model you selected first, then cascade through every other provider you’ve configured, and treat a local Ollama model as the genuine last resort, not the accidental default.

If you like, you can set your Ollama LLM first and use 100% local and private inference with an open-source model.

The Agent tab’s chat and the CLI each carry their own provider logic, built at different times, and both had quietly fallen behind. Select Cerebras in the Agent tab and it would drop straight to Ollama, because that code path only recognized four providers. Select Gemini or Mistral from the CLI and the same thing happened for a different reason: both were listed as valid choices with no implementation behind them at all.

We rebuilt this as one shared chain, used by all four surfaces. In practice, that means a request now survives real failure. A live test after the fix routed through Claude, then OpenAI, then landed on Groq, each failure logged and handled in sequence rather than surfaced as a dead end. The model you picked is the model that runs, and if it can’t, you find out why instead of getting an answer from something else with no explanation.

                          Desk brief updated

Updated provider list

Supported across Desk, Agent tab, JOT, and CLI (same waterfall logic everywhere):

Claude (Anthropic)
OpenAI
Groq
Gemini (Google) — newly added to CLI this release
Cerebras — newly added across GUI, Agent tab, JOT, and CLI this release
Mistral — newly added to CLI this release
xAI (Grok)
OpenRouter
Ollama — final local fallback, unless chosen as primary

Models:

OpenAI

Astra 6

Cerebras

qwen-3.8-27b
gemma-4-31b
gpt-oss-120b

Gemini

Removed gemini-2.5-flash-lite (Google deprecated it for new users)
Default now points to gemini-3.5-flash-lite

Groq

qwen3.8–27b added to the lineup

Twelve connectors, one security layer

VEKTOR now ships 12 live connectors: GitHub, Slack, GitLab, Vercel, HuggingFace, Jira, Linear, Sentry, and Notion, fully tested and running today. Gmail, Google Drive, and Microsoft Teams ship OAuth-gated on your own app credentials, not a shared client key, because those three touch a real inbox and a real file system.

                              Connector panel

Every one of them sits behind Faraday, the security gate that screens MCP tool calls before they reach memory.

This release adds OWASP LLM Top 10 and MITRE ATLAS classification to every event Faraday logs, and a behavioral anomaly baseline that flags a tool call whose frequency breaks from its own history. Faraday’s signature self-test runs 23 known attack patterns against 23 benign controls. Zero false positives, both directions.

The agent engine, restored to full strength

This release rebuilds and improves all 53 functions in the autonomous agent core: semantic code search, subagent delegation, lint and test tooling, code review, self-evaluation, commit message generation, and the hook system that ties them together.

Built to catch its own mistakes

A golden-recall suite runs fixed queries against fixed seed memories with known expected results, built specifically to catch the failure mode where a system still answers, just not correctly. A smoke test sweeps roughly 240 files on every install. Both now gate every commit before it lands, not after a user finds the gap.

The CLI regression suite runs 41 checks across every surface touched this release, making sure all passed the quality code inspection.

What this means going forward

Persistent memory is only as trustworthy as its least-tested edge. This release closes several of those edges at once: a note that no longer loses its own content, a model choice that no longer gets silently overridden, and a connector layer with the same security guarantee no matter which one you’re using.

The current release builds on our privacy and security foundations rather than patching around it.

Why we build it this way

None of this works if the underlying architecture isn’t private by default.

VEKTOR computes embeddings in-process, on your device, with a local ONNX model. There is no cloud copy of your memory graph to log, breach, or subpoena, because there’s no cloud copy at all.

That’s not a policy we ask you to trust. It’s a property of the design: air-gapped by default, so surveillance is structurally impossible rather than contractually prohibited.

Your memory lives as a full SQLite file, on your own machine, with a real file path.

It’s never moved to mandatory cloud storage, never used to train a model, your data is never sold for ads, and it’s yours to copy, migrate, or walk away with at any time via our open-sourced DB migration tools.

We built VEKTOR this way because a memory layer that centralizes someone’s most private conversational history has no business asking for blind trust.

It should be something you can verify yourself.

Get v1.9.0
Read the full changelog → https://vektormemory.com/docs/changelog
Vector Database

Agentic Ai

Information Security

Ai Memory