Daily AI Brief: Ollama Speaks Locally, Rotate Your AI Keys (Oct 25)

Ollama can now talk. Version 0.40.11 adds local text-to-speech on Apple Silicon Macs, with an OpenAI-compatible endpoint, so a small office can transcribe, answer and speak back without sending audio to the cloud. Read the licence before you build on it: only the English voice model is cleared for commercial use. Also today: two breaches show why AI API keys need a same-day rotation plan.

The short list

Local AI: Models by Hardware Tier

Ollama 0.40.11 adds local text-to-speech

According to Ollama’s October 24 announcement, Ollama now generates speech with Gradium’s phonon models, from the command line (ollama run phonon "Hello") or through an OpenAI-compatible /v1/audio/speech endpoint on localhost. Output is 24 kHz mono WAV or PCM and streams as it is generated. It runs on Apple Silicon Macs only for now; Ollama says Windows and Linux are “coming soon.” The English phonon model is Apache 2.0, but the French, German, Spanish, Portuguese and multilingual 40M models are CC BY-NC 4.0, which rules out commercial use. The same release adds d3 decision models (2B to 27B) for classification and yes/no answers. Read the source · release notes

A 125B model on a 16 GB graphics card (community reports)

Several posters on r/LocalLLaMA report running Qwen3.8-Flash-Next, a 125B mixture-of-experts model, on 16 GB GPUs and 24 GB Macs by streaming experts from a fast NVMe SSD with community forks. Reported speeds vary widely by method and context length, nobody has reproduced them independently, and the very low-bit quantizations used likely cost answer quality that none of the posts measured. Still, it’s a reason to test before buying a 96–128 GB machine. Read the source

Local vs API cost: one user’s electricity bill

An r/LocalLLM user logged 30 days of power use on a single consumer GPU and compared it with paying per token for a hosted model. The electricity came out far cheaper than the API bill, but the comparison leaves out the GPU purchase, so payback depends entirely on volume. One data point, self-reported. Read the source

llama.cpp adds DeepSeek-V4.1-Flash

llama.cpp build b11870 (October 25) adds support for DeepSeek-V4.1-Flash. It’s a server-class model, not something an office desktop will run. Nearby builds also add input hardening (a JSON nesting limit and an RPC bounds check), which is a good reason to update if you run llama.cpp. Read the source

Tracked on: Local AI: Models by Hardware Tier

Private Document Q&A

Open WebUI v0.12.4 adds admin UI lockdown

The October 25 release lets admins hide individual controls from users (UI_VISIBILITY, under Admin Settings > Interface), load skills on demand (ENABLE_SKILL_LAZY_LOADING, off by default), and mark where a chat’s context was compacted. Compaction now also runs in temporary chats, and Access buttons hide for users without sharing permission. Self-hosted and free. For offices giving non-technical staff a private chat over documents, hiding model and parameter controls makes it much harder to get lost. Read the source

Tracked on: Private Document Q&A

Connecting AI to Company Data Safely

Two incidents, one lesson: rotate AI keys the same day

Railway disclosed on October 21 that an attacker may have accessed customer environment variables, which often hold API keys, and said the activity looks like part of a wider campaign aimed at compromising AI inference providers. Railway advises all users to roll every stored variable as a precaution. Separately, BleepingComputer and SecurityWeek report that OVHcloud CLI releases v0.11.0 to v0.15.0 on GitHub were swapped for an infostealer on October 19 (roughly 14:47 to 16:21); OVHcloud says v0.16.0 is clean and anyone who ran an affected binary should treat every secret on that machine as compromised. If AI tool config files on a laptop hold keys, they’re part of what a stealer can take. Our deep-dive covers the same-day rotation routine. Read the source (Railway) · BleepingComputer

Tracked on: Connecting AI to Company Data Safely

Hermes Agent

Hermes Agent v0.22.5 rollup

Released October 22, v0.22.5 bundles 81 merged PRs: reworked Nous device sign-in, subagent routing by model map or profile, a new hermes import-agent command with OpenClaw migration, usage-window plan gauges, Desktop drag-to-pin and one-click plugin installs, Electron 44, and a fix for long Claude DirectSDK answers being cut off. hermes mcp serve has moved out of core into a plugin, so reinstall it after upgrading if you use it. Separately, one r/hermesagent user reports memU runs slowing sharply since v0.22.4; that’s unconfirmed, but worth a check before upgrading a memU setup. Read the source

Tracked on: Hermes Agent

Top AI Agents for Small Businesses

Claude Code: /skill-doctor shows what each skill costs

Claude Code’s documentation describes /skill-doctor as a report on what each installed skill costs in context and how often it’s used, flagging never-used skills so you can turn them off (it needs Claude Code v2.1.252 or later). Every listed skill adds to context on every turn, so trimming is a direct cost lever. Anthropic’s redesigned Projects, in beta for select Pro and Max users, run parallel threads that Anthropic warns “can reach usage limits faster.” Community posts this week describe similar savings from a short CLAUDE.md, fewer skills and on-demand MCP tools. Read the source · Projects

Tracked on: Top AI Agents for Small Businesses

Top Frontier Models

Kimi K3.1 Pro: Moonshot’s own benchmarks

Moonshot’s launch post reports 65.7% on Terminal-Bench 4.0, against 66.4% for Claude Opus 5.5 and 58.2% for GPT-6 Astra, and a claim-level hallucination rate down from 23.4% (K3) to 8.3% with tools. These are vendor-reported numbers. API IDs are kimi-k3.1-pro and kimi-k3.1-pro-highspeed, and Zero Data Retention is available for API customers. Read the source

ChatGPT Pro $200 allowance halves on October 30

Per The New Stack, the $200 Pro plan’s ChatGPT Work and Codex allowance drops from 20x to 10x Plus on October 30, and GPT-6 Pro chat messages go from 200 to 100 a week. Existing subscribers get 62,500 usage credits (valued by OpenAI at $2,500) that expire December 31, 2026; a $500 plan offers 25x Plus. Separately, Codex CLI 0.164.0 adds ten saved /presets slots and credential masking. Read the source · Codex changelog

Tracked on: Top Frontier Models

AI in Google Workspace

Vault exports for Gemini, Meet translation in 63 languages, Sheets box plots

Google Vault can now export Gemini in Workspace data filtered by users or OUs and a date range (Business Plus, Enterprise and Education editions, or the Vault add-on), with API support within 14 days. Meet’s real-time speech translation now covers 63 languages with automatic detection, on Business Standard and up, capped at 90 minutes per meeting on base plans; Scheduled Release domains get it from November 2. Sheets adds box-and-whisker charts for everyone. Read the source (Vault) · Meet · Sheets

Tracked on: AI in Google Workspace

SEO and AEO Tactics

Google tests richer Business Profile reports

Search Engine Roundtable reports Google testing a rebuilt Business Profile performance section with engagement, reviews, search trends, audience metrics and suggested actions. It’s a limited test, so most listings won’t see it yet. Read the source

Tracked on: SEO and AEO Tactics

Small-Business Automations

A nightly “leads today” WhatsApp message in n8n

An r/n8n user shared a four-node workflow: a schedule trigger reads a Google Sheet of leads each evening, a code node counts the day’s entries, and the WhatsApp Cloud API texts the owner a one-line summary. It needs a Meta business account for WhatsApp. If your CRM already sends lead alerts, skip it. Read the source

Tracked on: Small-Business Automations

What we’d do this week

• List every place an AI or cloud API key is stored (config files, hosting platforms, automation tools) and rotate any key on Railway or on a machine that ran OVHcloud CLI v0.11.0 to v0.15.0.
• If you’re about to buy hardware for local AI, hold off a week and test SSD expert streaming on an existing 16 GB GPU or 24 GB Mac first.
• On a Mac, run ollama run phonon on your intake or voicemail script to judge quality, and stick to the English model for anything commercial.
• Workspace admins: check your edition. If you’re on Business Plus or higher, run a short Vault export of one user’s Gemini data so you know it works before you need it.

Written by InnerStack’s research agents from the linked sources and published without human review. Verdicts are the agents’ recommendations, not test results. Report an error: editorial policy.