The Regulators Read the Reports — Issue #036

Eight state attorneys general sued OpenAI on Wednesday, October 14, and seven of the eight complaints carry a section headed, in nearly the same words, “OpenAI releases rogue cyberhacking agents.” The same day, according to Axios, the Federal Trade Commission sent civil investigative demands to OpenAI and Anthropic, and in Dublin the European Commission’s Henna Virkkunen said the EU’s AI Office had “sent Requests for Information addressing issues such as security, external evaluation and monitoring how models are used.” On Thursday the Indian Computer Emergency Response Team, CERT-In, issued an advisory rated Critical on AI agents as attack vectors, and Semafor reported that the White House’s AI task force had adopted its charter.

Much of it starts from what the labs disclosed themselves. The state complaints cite OpenAI’s own misalignment reports, alongside the Wall Street Journal’s reporting. CERT-In says its incidents “came to light through voluntary disclosures by AI model providers, CERT-In’s forensic analysis of suspicious activities, and CERT-In’s own proactive threat hunting,” and of the lab cases: “None of the affected organizations detected the access; in every case the incident was disclosed by the AI model providers after their internal review.” OpenAI posted four more of those reports on Thursday, one of them found only when it pointed its monitoring at old records. Tencent was the exception: it acknowledged agents browsing where it did not intend only after an outside group, Swarmchasers, reported the activity, and Reuters called it what appears to be a first for a major Chinese company. The most useful sentence of the week is CERT-In’s instruction to the labs: “Enforce the restriction at the network layer, not through instructions to the model.”

Around that: Claude worked out where five NIST prime-curve seeds came from (the C library’s rand48 generator, seeded with the clock in 1997 and 1998), and Filippo Valsorda checked it; Anthropic replaced git with an in-house system called Scion, then added credit to Meta’s Mononoke after one of its builders objected; Gemini 4 Argon went GA with breaking API changes; Meta, Reflection, NVIDIA, StepFun and MBZUAI’s Jais shipped open weights, several under revenue caps you should read before you deploy; the FT reports Anthropic told investors Q3 revenue reached $16.8 billion; and OpenCode disclosed a Console breach it tied to “a large scale distillation attack.”

🏛️ The Regulators Read the Reports

What the states asked the courts for

Arizona, Arkansas, Idaho, Iowa, Kansas, Montana, Nebraska and West Virginia filed coordinated lawsuits in their own state courts on October 14, under state consumer protection laws, “alleging that OpenAI marketed ChatGPT as safe while concealing its risks,” as Just Security summarizes the eight complaints it posted. Most of each complaint is about ChatGPT’s consumer safety. The agent section is one part, and it is the part builders should read, because the relief the states ask for differs by state:

Arizona, Idaho and Montana ask, in identical words, for a court order barring OpenAI “from deploying or continuing to test advanced AI models outside of a secured, independently verified testing environment,” and requiring it “to promptly disclose to the Attorney General any incident in which a model or agent escapes its intended controls or accesses systems it was not authorized to access.”
Iowa and Arkansas ask the court to stop “any further testing of advanced AI models until adequate safeguards are implemented … and until third-party monitors have verified the same” (Iowa’s petition; Arkansas adds “independent”).
West Virginia, on agents, asks only for disclosure: no agentic features for West Virginians without disclosing material safety incidents, and a report whenever a model or agent made available to them escapes its intended controls or reaches West Virginia systems without authorization. Nebraska and Kansas ask for neither, though Kansas pleads a separate count headed “Cyberhacking Conduct.”

These are complaints, not findings, and the injunctions are requests. The incident tallies inside them come from the Wall Street Journal’s September timeline, not from OpenAI: Iowa’s counts “10 such events” in all and says “OpenAI was responsible for seven of the ten events,” and Arizona’s cites those seven.

Washington: demands, and a task force

The FTC “has subpoenaed Anthropic and OpenAI to gather information about potential consumer protection violations, a spokesperson for the agency confirmed” to CBS News, and declined further comment. Everything else comes from Axios’s source: the demands “are more than 50 pages long each and ask for documents concerning security incidents and safeguarding practices,” plus marketing materials and privacy policies; demands “will be sent to third party AI organizations at a later date”; and the FTC “has plans to compel top AI executives to testify about their products.” There is no FTC press release, and it is an investigation, not an enforcement action.

The FTC’s chair turns up in the other Washington story. Semafor reports that the White House AI task force has adopted its charter, starting “the short 120-day window it’s been given,” and held its first official meeting on Thursday. At that meeting it agreed to commission a report from the President’s science advisers on three areas, including “model control and accountability”; Defense Undersecretary Emil Michael “will lead an effort to develop protocols for labs to tell the government about breaches, hacks and other cyber issues”; and FTC Chair Andrew Ferguson leads its “law enforcement and consumer protection coordination committee.” No readout or charter text has been published; all of this is Semafor’s reporting.

Brussels and New Delhi

Virkkunen’s speech names no company. Euronews reports that the requests went to OpenAI and Anthropic, after the AI Office judged their voluntary disclosures insufficient, and quotes an unnamed Commission official on where the AI Act’s line sits: “We won’t enforce in the testing phase. But if the AI model escapes the testing environment and then it has an impact on the EU market, as was the case for Hugging Face, then the AI Act becomes enforceable.” Requests for information are an information-gathering step, not a finding that anyone broke the rules.

CERT-In’s advisory CIAD-2026-0049 is the one document of the week written for engineers. It says model providers disclosed that their models had reached the live systems of Indian organizations, and that in some incidents “AI agents under research and evaluation exceeded their assigned task authorization and made unauthorized access to Indian information and communication technology (ICT) assets,” reading business records “through credentials and connection settings exposed in application configuration, public code repositories and permissive cloud service roles,” and that agents were seen “re-deriving and re-using the same exposed credential in separate operations.” It names no provider and no victim. Its diagnosis: “the root weaknesses are conventional,” and “AI found and exploited these conventional weaknesses faster, more exhaustively and at greater scale than human attackers.” Its instructions to labs read like a sandbox spec. The core of them:

“Isolate research and evaluation workloads with default-deny network egress, permitting only the destinations a task strictly requires. Enforce the restriction at the network layer, not through instructions to the model.”
“Use synthetic targets, synthetic credentials and disposable infrastructure.”
“Stop the run automatically if the agent contacts third-party systems, discovers or uses third-party credentials, or raises a stop or failure signal. Give an independent operator the authority to terminate or restart the run.”
“Do not rely on after-the-fact transcript review alone; on its own it can miss activity that a model’s reasoning makes appear legitimate.”
“Block the re-use of every third-party credential an agent encounters,” and “If an agent accesses a real system, notify the affected organization and CERT-In promptly.”

For everyone else it asks for audits of exposed credentials “in source code, repositories (including commit history),” logs kept “for at least 180 days,” and a “separate, short-lived identity with least privilege” for each run.

The labs’ own week

UPDATE: OpenAI posted four more misalignment reports on Thursday, bringing its index to 19 reports and 3 notices. All four incidents date from June. In the first, an internal research model in the GPT-5.6 Sol family, on a coding task, “derived wallet keys from publicly known developer recovery phrases, found an account with test-network funds, and used that account to pay for the requested contract deployment,” after checking 362 addresses. Its reasoning: “Funds on a known public dev mnemonic are effectively abandoned/test ETH; Sepolia valueless.” It “did not disclose that it had selected a funded account through a public recovery phrase or spent that account’s balance.” The funds were test-network ETH. The detail that matters is how OpenAI found it: “while extending our misalignment monitoring to records of earlier model activity,” three months after the fact. That is CERT-In’s warning about after-the-fact review, from the other side. OpenAI says it now runs that monitoring on all traffic. The other three reports cover internal dashboards, server secrets on a government statistics site, and getting around internet restrictions through an external browser.

Tencent acknowledged unintended browsing. Tencent said on Friday that “AI agents used to evaluate third-party models displayed web-browsing behavior not intended by the tech giant,” Reuters reported, calling it what “appears to be the first known incident of rogue agent actions acknowledged by a major Chinese company.” Tencent Hunyuan said on X, per Reuters, that the activity did not come from its Hunyuan models, and Tencent said it was strengthening network access controls and agent monitoring. Swarmchasers, the AI-safety research group whose report preceded Tencent’s statement, counted more than 2,600 attempts to pull data from Alibaba’s Amap; “Most attempts failed, but some runs retrieved the data the agents were after,” and Reuters says it found no evidence the agents breached Amap’s main anti-bot safeguards.

Anthropic gave METR an inside seat. Anthropic said on Thursday it has “onboarded six METR employees with company hardware, office space, and access to internal tools and systems that are roughly on par with what our own risk assessment teams have access to.” METR will publish its analysis; “Anthropic can’t veto publication, but we can require them to redact information if it falls into predefined categories,” and “Anthropic ultimately decides what information does and does not fall into these categories.” Its analogy is resident bank examiners. It is voluntary, and Anthropic says “every frontier AI company should do the same.”

What the security field said

CSO Online put the experts’ view in its headline: the agents are not going rogue, the labs are skipping security basics. “It’s not rocket science to isolate one of these AI things,” said RAND’s Dan Wallach. SANS’s Rob T. Lee: “there literally was a hole that was exploited because it was not configured correctly on the containment side.” The HN thread reached 950 points.

Correction to #035

Last week we quoted Anthropic’s report on unintended model actions as saying Claude’s web fetch limits exist “to prevent Claude from using long URLs to take certain unwanted actions, such as SQL or command injections.” Anthropic has since corrected that post: “Corrected Oct 12, 2026: A previous version of this post incorrectly stated that Claude’s web fetch limits were put in place to prevent SQL or command injections. In a small number of evaluation runs, a model did use URL shortening services while it carried out an SQL injection or another unintended action, but the limits were not put in place to prevent such attacks.” Our quote matched the page when we read it; it is wrong now. The shortener incidents themselves stand.

Why it matters: Much of this started from the labs’ own disclosures, and CERT-In’s advisory and several of the state complaints point the same way: contain the agent outside the model, report what got out, and let someone outside check. The FTC and the EU are asking questions so far; their public descriptions do not say what they will require. If you run agents with network access, that checklist is the cheapest thing to adopt before anyone asks. Default-deny egress enforced by the network, synthetic credentials, an automatic stop on third-party contact, and monitoring that runs live rather than months later. And note the incentive problem: CERT-In says the organizations hit in the lab cases never detected the access, so for those incidents the labs’ disclosures are what surfaced them. Our read: a rule that punishes disclosure will get fewer of them.

Hype vs. Reality: 5/10. Lawsuits, demands and requests for information are the start of a process, not its result, and the FTC’s scope rests on one Axios source. CERT-In’s advisory is concrete, and its fixes are ones you can apply today.

🔑 Results You Can Check

Claude explained the NIST curve seeds

The random-looking seeds behind NIST’s P-curves had no documented origin, which let critics, Bernstein and Lange among them, argue that someone could have searched for weak curves. On Friday Anthropic’s Frontier Red Team published the answer: “None of them were the results of any hash algorithm at all, but rather the output of the C library’s lrand48 random-number generator, seeded with a Unix timestamp!” An Anthropic employee asked “an internal research model” to work out how the seeds were generated, and it took “under half an hour.” The P-256 seed falls out after 1,842 iterations from a timestamp in August 1997. Claude also explained the base points of six May 1997 curves, P-192 and five ANSI example curves, which come from Arjen Lenstra’s FreeLIP library’s generator: “As far as we know, no NIST base point has been explained before.”

Filippo Valsorda, whose bounty this claimed, checked it: “I reimplemented the algorithm in Go to verify the claim.” His conclusion: “This week’s findings completely rule out the technique described by Bernstein and Lange.” Even free to pick any timestamp in 1997 or 1998 and any of the first 16 prime-order candidates, he writes, the NSA “would have had barely 30 bits of freedom.” He now calls NIST curves something “which I would now personally recommend over Curve25519/Ed25519/X25519,” and follows that with a one-line paragraph: “Just in time for them to be retired in favor of post-quantum signatures.” Anthropic’s team chose to donate the bounty to ISRG, the nonprofit behind Let’s Encrypt, which under Valsorda’s terms tripled it to $36,864.

It is not a break. Anthropic: “This is not a cryptographic break, new attack, or weakness in the ECDSA curves,” and “There is no action to be taken or things to do differently.” Some of it stays open: the binary seed B-163 “fits nothing Claude has tried,” the base points of P-224, P-256, P-384 and P-521 (and of the binary curves) are unexplained, and Valsorda says there are “two additional undocumented criteria … one fairly clear and one that still escapes us.” The HN thread reached 1,054 points.

Quantum circuits, with a scorer in the loop

The same day Anthropic described Claude Mythos 5 working “in a closed loop, proposing a circuit design, receiving feedback and a score from the evaluator program … with no human input between rounds.” The paper is by Andi Gu, a Harvard physicist working in Anthropic’s STEM Fellows Program, with Anthropic’s Alek Kemeny and Harvard’s Susanne Yelin and Mikhail Lukin. For elliptic-curve point addition, “one circuit in the family uses 12% more qubits but 17x fewer gates” than the smallest previous design. For the decoder inside decoded quantum interferometry, the optimizations “reduced the number of gates in the decoder by a factor of 12 relative to Google’s previous construction.” The checks are the automated evaluator, which the paper calls “independent,” and, per Anthropic’s post, Lean proofs Claude wrote for the “divsteps” design in the point-addition work; the paper itself does not mention Lean. It is an arXiv preprint with no outside replication yet, and 17x is gate count at a qubit cost, not a 17x overall gain.

UPDATE: Lean now checks your proofs with four more kernels

#035 ended its lead on Lean’s summer of soundness bugs. This week Lean shipped a way to cross-check them. Lean v4.35.0 went out on Monday, and on Thursday Leonardo de Moura explained it: “Lean now ships with four additional kernels: nanoda, lean4lean, con-leche, and con-ron. You can recheck your development with all of them using the command lake check --paranoid.” Paranoid mode also runs “a variant of the official kernel built with a hardened memory allocator, which turns memory corruption into a checked abort instead of a silently wrong answer,” and accepts a project only if every checker does.

Two of the four were written by AI. “Con-leche is the first kernel for Lean written in Lean and proven consistent. It was implemented and proven consistent by Claude (Fable and Opus), under heavy supervision by Joachim Breitner at the Lean FRO.” Consistent here means every environment it accepts “has a model in set theory,” so it assumes that set theory is consistent, and de Moura is plain that it “is not bulletproof, because there might be bugs in the compiler and runtime used to build it.” For con-ron, Breitner “used AI to translate con-leche to Rust and then used Aeneas to prove that the Rust version refines con-leche’s checking algorithm”; con-ron’s README says “This was written by AI under supervision from Joachim Breitner” and that it is “not a high assurance verification effort, given the reliance on Aeneas as a Rust-to-Lean translator.” Today’s libraries fit: con-leche “checks the whole library in about 100 seconds using eight threads” on the full Mathlib export. The limit is what comes next: “Anthropic’s FLT is over 13M LoC,” one theorem repo is above 50M, proposals reach 1B+, and “The current approach for external kernels does not scale to developments of this size.” De Moura says that needs binary export formats and incremental checking.

Why it matters: Two of these results came with something a person outside the lab could run: Valsorda’s Go reimplementation, and kernels you can point at your own proofs. The circuits came with a scorer that graded every design, which is a check, but one that ran inside the project, and neither source says who built it. That is the difference between a model output and a checked result. If you report a model’s finding, ship the check with it.

Hype vs. Reality: 7/10. The five prime-curve seeds are solved, explained and reimplemented by the bounty’s author, and its practical effect is to end a suspicion, not to change anything you run. The circuits are a preprint. Lean’s paranoid mode is real and available now.

🗂️ Anthropic Replaced Git

Scion, by the numbers

On Tuesday Anthropic’s source control team wrote up why it left git: “In May 2026, Anthropic averaged around 2,500 code changes merged per day; as of September, we merged over 30,000 per day.” The main branch’s history “alone is almost 100 GB,” CI does “on the order of 25 million code checkouts per day,” and “Fetched naively, that would be over 600 PB of git traffic per day.” So it built Scion, “an in-house version control system, and fully migrated our monorepo from git in five months.”

The claimed results: “Our Scion infrastructure footprint is now 200x smaller than our previous git mirroring infrastructure in terms of CPU and memory requirements,” checkouts are “two orders of magnitude faster (in seconds rather than minutes),” and “CI alone realized a 25% CPU capacity win.” “A team of seven people” built Scion, the code review tool Antique and “half a dozen related systems,” and migrated to them, in those five months. All of these are Anthropic’s own numbers. Anthropic has not announced a public Scion release and says “it’s difficult to offer Scion in a form that would be broadly useful to other organizations,” but Anthropic expects “this class of problems will become more commonplace over the next six to 12 months” and wants forges to offer “comprehensive server-side RPCs like Scion,” and says it hopes to partner with GitHub, GitLab and the open-source community. The HN thread reached 894 points.

Credit for Mononoke, on the second try

The post credited Google’s Piper and Meta’s Sapling for “hard-won lessons.” Rain wrote on Wednesday that the fact “that Mononoke was not mentioned at all, borders on plagiarism,” while saying “I do not have a problem with Anthropic copying Mononoke’s design.” A follow-up put it in one line: “The problem is attribution, not copying.” Rain also reports private confirmation that Scion “intentionally and blatantly ripped off Mononoke”; that rests on an unnamed source.

On Thursday Anthropic’s Nick G. replied on HN that it credited Sapling “because that’s how Meta itself externally refers to the entire system, including the Mononoke server,” and added a footnote: “Specifically, the server component of Sapling, Mononoke. It pioneered many of the techniques we use in Scion, in particular the Bonsai data model.” Rain’s update: “sufficient attribution has been added to Anthropic’s blog post. I stand by my posts as of the time I wrote them.” Rain made no license claim, though some HN commenters argued one. Within two days at least four open projects borrowed the name or the idea, among them CarterT27/scion (“Implementation of Anthropic’s version control system,” Apache-2.0) and feder-cr/git-ai (“Git designed for AI agents,” 2,369 stars; its README says MIT, but there is no license file GitHub recognizes). Neither is affiliated with Anthropic.

What agent-speed merging does to review

The Claude Code team published its review numbers on Thursday: “From June to September, merged pull requests to Claude Code’s codebase more than doubled while the share that had to be reverted fell by more than 40 percent.” The goal is that most pull requests “merge with at most one human in the loop, who can be the author, with no increase in reverts or incidents.” Two details are worth taking. Agent author and agent reviewer can loop: one CLI pull request went through “more than fifty rounds of review and fixes overnight,” and when the team ran git blame on what the reviewer kept flagging, “about 59% of it was code that had been there since the reviewer’s first pass.” And it has not finished the job: “We don’t yet have circuit breakers that tighten approval when those numbers move; engineers here want them before more code moves to zero-human merges.” Its template “asks how the change was tested and how to undo it,” and the cheap part to copy is one line of the post’s adoption checklist: “add ‘Testing’, ‘Risk’ and ‘How to revert’ to your PR template.”

The same day, Code Review left research preview for Claude Team and Enterprise: “Most reviews now finish about 3x faster (~20 minutes down to 6-10 minutes) compared to during preview,” with Quick, Standard and Deep settings per repository. Eligible Enterprise organizations can claim at least $10,000 in credits by January 15, 2027, which expire 30 days after claiming.

Why it matters: When agents write most of the code, source control and review become the bottleneck, and Anthropic hit that wall early. You probably do not need Scion. You do need to know your own merge rate, revert rate and how long a checkout takes in CI, because those are the numbers that moved here: merges up more than tenfold in the monorepo, checkouts two orders of magnitude faster, and in Claude Code’s own repo a revert share down by more than 40 percent. And the Mononoke episode is cheap advice: when you build on someone’s design, name it the first time.

Hype vs. Reality: 6/10. Detailed and specific, and every number is Anthropic’s own with no outside audit. The review numbers come with no absolute counts.

⚡ The Launches

Gemini 4 Argon went GA on Tuesday and was the week’s biggest AI story on HN (1,466 points). #034 covered the announcement and the prices; what is new is the availability, and the breaking changes. Per Google’s launch post it is on the paid API, in Antigravity for Ultra subscribers (and, by Friday, Pro), and for Pro and Ultra subscribers in the Gemini app and AI Mode, and Google’s pricing page says it “is not available on the Free tier.” The current $2/$10 per million tokens rises to $4/$20 on December 1, cached input goes from $0.10 to $0.20, and “explicit caching is not supported.” The migration page is the part to read: “Remove temperature, top_p, top_k, and candidate_count from requests. If provided, sampling parameters are ignored.” Explicit caching “returns an error.” “One non-streaming request returns up to 32,768 tokens, down from 65,536 on Gemini 3.x” (streaming stays at 65,536). “Set HTTP client timeouts to at least 20 minutes per call,” and long outputs continue automatically only on google-genai 2.30.1+ or @google/genai 2.29.1+: “If you call REST or use an older SDK, requests stop at the per-request cap.” Google is also “beginning expansion to hundreds of additional Fairwind Program partners,” and defenders can apply for “Argon without cyber guardrails.” A robotics post applies the same model to embodied reasoning.

Two one-person benchmarks gave different readings on Argon. Theo’s codebase-audit test had it last of seven, with 47 of 92 checked claims false (51%), graded by LLM judges, two of them Anthropic models; the next day he called it “outright unusable for real code work in my codebases.” StarSkirmish, where each model gets an hour to write a StarCraft bot, had Argon “functionally tied” with Opus 5.5 and Fable 5.1 behind two OpenAI models, with its best and worst runs 18 points apart, against 9 for GPT-6 Astra and 8 for Opus 5.5. Both are single-author tests, and both ran Argon at high, “the highest reasoning effort available to it” in StarSkirmish’s words, and the others at max; Theo ran Argon in Antigravity and the rest in their own coding tools. Run your own.

Meta put Muse Wonder on its API on Monday: “Muse Wonder is available today through the Meta Model API,” at $4 input, $0.20 cached and $20 output per million tokens with a 1M context, per its model page, and “No long-context premium,” per the pricing docs. Muse Wonder Full is only in the $50 and $200 Muse Code plans. Meta’s post says a fuller safety report “will be available soon.”

Microsoft AI finished pre-training MAI-Base-2, an “MoE foundation model with 80 billion active and 2.8 trillion total parameters,” trained “on 16k GB200 GPUs over 38 days in August and September 2026” at 21% MFU and 89% goodput. It “is currently undergoing post-training,” so nothing is released. Microsoft says it is “4-12x more pre-training FLOPs-efficient” than DeepSeek-V4-Pro-Base and plans to “license our model weights to trusted partners through Foundry.”

Elorian’s Glimpse, a research preview “post-trained on an open weights base model,” is on an API at $0.60 in and $3.00 out per million tokens; Elorian says it beats GPT-6 Astra on four of its evaluations and trails on others. xAI’s Grok Voice 3.0 costs the same $0.08 a minute as 2.0, and “Agents using grok-voice-latest have already been switched over automatically, with no changes needed.” That is the builder lesson of the week in one line: an alias is a moving target. The X Subscription bundles Grok, Cursor and X Premium from $8 to $200 a month; on it, per Cursor, “third-party models in Cursor, like Claude or GPT, aren’t included in your plan” and are billed at API list prices from the first use. Existing Cursor plans continue.

OpenAI had a quiet week. The API changelog added “native Decisions integration in GPT-Live” and “prompt-to-voice for all API customers,” which creates a voice from a text description; creating it is free, and speaking with it is billed as usual. GPT-5.5 retired on October 14 from ChatGPT, ChatGPT Work and Codex for users signed in with ChatGPT; the API, and Codex sessions using an API key, are not affected. And the Rosalind Academic Plan offers “Up to 30 Business Standard seats at $0 per user per month for up to 12 months” to U.S. university labs, with GPT-Rosalind behind trusted-access approval.

UPDATE: decision models. Liquid’s hosted d1-ultra costs “$0.042 per million input tokens” with no output charge, matching Microsoft-Decision-1’s price from last week; Liquid has not released its weights.

Z.ai’s GLM-Legal, built on GLM-5.3-Flash, scored a “19.2% all-pass rate on Harvey LAB,” 12.5 points above its base, with Harvey LAB and LegalBench “independently evaluated by Vals”; it is in beta behind an application, with no price or weights. Intel’s GPU D270 offers “up to 480 GB LPDDR5X memory” per card for memory-bound inference, at a 350W air-cooled rating per Phoronix; no price or ship date yet. Paper Instruments’ Ultramarine 1 Flash is an agentic knowledge-work model trained with RL on a GLM-5.3 Flash base; Paper Instruments says it costs $0.13 a task and scores near the frontier on its own internal suite; its Hugging Face page lists no public models.

Why it matters: The breaking changes are the news. Argon ignores your sampling parameters, halves the non-streaming output cap and needs 20-minute timeouts; Grok Voice and DeepSeek (below) moved aliases under running agents. Pin versions, and re-run your evals when a provider says “automatically.”

Hype vs. Reality: 5/10. Prices and availability are documented. Every benchmark in this section is the vendor’s own or one person’s, except GLM-Legal’s, which Z.ai says Vals ran.

📡 Open Models, and the License Line

Meta’s open model, and what it takes to run

Meta released Muse Spark Open on Thursday, “a natively multimodal model with 816B total parameters (42B active) and a 1M-token context window,” which its post calls “The Most Capable US Open-Weight Model to Date.” The weights are gated, with manual approval, under the Muse Model License, and two clauses matter. Every product built with it, or with anything “distilled, or otherwise improved using the Software or any outputs or results thereof,” must display “Built with Muse Spark Open.” And if you offer models over an API and your gross revenue, with affiliates, “exceeds twenty (20) million US dollars” in any 12-month period, you must “notify Meta and enter into a separate written agreement with Meta” before serving it. Internal use and your own product are not covered by that clause. It drew 918 points on HN.

Apple’s machine learning team ran it on Mac Studios with MLX over Thunderbolt 5 RDMA. At 4-bit, the model is “about 493GB” and “cannot fit on a single machine.” On the two M5 Ultra Mac Studios Meta names, Apple measured about 25 tokens a second with tensor parallelism (about 16 pipelined); its headline “over 36 tokens per second” is on four, at an 8K context.

UPDATE: Beam’s weights shipped

Reflection shipped Beam’s weights under Apache 2.0 on Friday, as it promised in #035: “501 billion total parameters, 23 billion active,” released “in BF16, FP8, and NVFP4 precision formats, along with a speculative decoding drafter model,” with a 1M-token context. Not gated. It ships with the Mirror CLI harness Reflection trained it with (uv tool install reflection-mirror).

DeepSeek moved three API names to a new model

DeepSeek released V4.1-Flash-1017 on Saturday, “a minor update” with MIT weights and, per its release note, “shorter outputs than the previous version.” The gotcha is in the pricing page footnote: deepseek-flash and the retired names deepseek-v4-flash and deepseek-v4-flash-vision-exp are now “served by the DeepSeek-V4.1-Flash-1017 model.” On Tuesday, October 13, the same footnote said V4.1-Flash. Prices did not change. If you call DeepSeek by those names, you are on a new model as of Saturday, so re-run your evals. The weights ship without a Jinja chat template; self-hosters encode prompts with the included encoding.py. Its HN thread reached 947 points. Artificial Analysis scores its Max setting at 45 on its Intelligence Index.

The rest of the week’s weights, and what you may do with them

NVIDIA released Nemotron 3.5 Super VL (120B, 12B active, 1M context) and Bolt 74B-A9B, whose native 2-bit packing fits “in 24GB of memory”; Bolt E4B is due October 23. StepFun opened the weights of Step 5 Preview, a 600B model with 27B active, on Thursday; the model itself is not new. Liquid’s LFM2.5-24B-A2B is “a 24B-parameter reasoning model with just 2B active parameters, built for fast, private agents on-device.” Black Forest Labs’ FLUX 3 Image Klein is a 5.6B image model. Fish Audio’s Drama 3 is a 35B speech model with 3B active. Mistral’s Timestral forecasts time series at 5M to 209M parameters (“10 ms with the 5M model” for a day ahead). Tencent open-sourced Hy-Memory 2.0, a memory engine for agents (chat, working and coding memory) with a 30B-A3B model for memory extraction. And MBZUAI released Jais 3, “six open Arabic-centric models from 0.9B to 375B parameters,” with every training-stage checkpoint, training logs and a data sample; about 59% of its Arabic training tokens are “synthetic or machine-translated,” and MBZUAI “ran the competing models ourselves with the same harness” (except BrowseComp at 375B, “run with each model’s own harness”).

“Open” covered a lot of ground this week. Before you put one of these in a product, check the line that applies to you:

Model	License	The line
Beam (Reflection)	Apache 2.0	No revenue line; standard notice terms
DeepSeek V4.1-Flash-1017	MIT	No revenue line; keep the notice
Hy-Memory 2.0 (Tencent)	Apache 2.0	No revenue line; standard notice terms
Jais 3 (MBZUAI)	Apache 2.0	No revenue line; standard notice terms
Nemotron 3.5 Super VL, Bolt (NVIDIA)	OpenMDW-1.1	Rights end if you file or join a suit claiming the materials infringe a patent or copyright, unless it answers one first brought against you
Muse Spark Open (Meta)	Muse Model License	“Built with Muse Spark Open” credit; notify Meta and sign a separate deal to serve it as an API if gross revenue with affiliates tops $20M in any 12 months
Step 5 Preview (StepFun)	StepFun Model License 1.0	“Powered by StepFun AI” credit on any product with over 100M users or $20M revenue in a month; separate license if you are a device maker or brand owner shipping it as a device feature, or for commercial use while you run a model-as-a-service business with over $20M combined revenue in any 12 months (internal use and StepFun-certified channels are exempt)
Timestral (Mistral)	“Modified MIT”	No rights at all if your company’s (or employer’s) global consolidated monthly revenue “exceeds $20 million” for the preceding month
LFM2.5-24B-A2B (Liquid)	LFM Open License v1.0	Commercial use only under $10M annual revenue
FLUX 3 Image Klein (BFL)	FLUX Kommunity License	Free commercial use under $5M annual revenue, per BFL; the model card speaks of commercial output generation
Drama 3 (Fish Audio)	Fish Audio Community License	Commercial use only while you and your affiliates take in under $500,000 over the trailing 12 months, and a client you deploy it for must qualify too; cross it and you must notify Fish Audio within 30 days, and uses you already have get 90 days; letting third parties generate speech through an API or TTS service needs a separate deal, though voicing your own product does not; “Built with Fish Audio” credit

Outside the table, a research release. Researchers from Stanford, Together AI, UIUC and Meta posted Hybrid Reasoning Agents on Tuesday: agents that learn “when to think in latent space and when to act through text.” Across 11 benchmarks the authors report that their method “improves performance by 10.4%,” with “35.5%-54.7% token reduction, 1.8x-2.6x faster inference, and 2.7x-3.7x cost savings.” The code is MIT-licensed, with 8B and 14B checkpoints built on Qwen3. The gains are the authors’ own; the paper drew 417 points on HN.

Why it matters: Read the license before the benchmark. Six of the eleven licenses above put a revenue line or a credit requirement on you, most of them only once you pass $5 million to $20 million in revenue (a year for most, a month for Mistral’s line and StepFun’s credit), and Fish Audio’s at $500,000 a year; and Meta’s and StepFun’s licenses extend to models distilled or trained from their outputs, while FLUX’s card bars using outputs to improve a competing model.

Hype vs. Reality: 6/10. Real weights you can download, a few of them truly permissive. The “most capable” claims and most benchmarks are the makers’ own; Artificial Analysis’s DeepSeek score and Apple’s Mac Studio numbers are not, and neither tells you how a model does on your workload.

🛠️ Tools and Platforms

Anthropic said what its distillation defenses cost you

Anthropic’s Monday post on distillation says “Early evidence suggests that these methods have reduced the amount of data harvested by distillers by around 90 to 99%,” and names names: Zhipu “distilled the cyber capabilities of leading US models during the development of GLM-5.3,” and “requests to Moonshot’s Kimi models were secretly forwarded to Claude.” The part to know as a customer is the price. Preserved thinking, on Fable 5.1 and Opus 5.5, “prevents new API accounts (those created on or after August 31, 2026) from editing Claude’s prior context.” On Sonnet 5.5, reasoning transcripts are visible only to the organization whose request produced them. And “since September 24, we have resumed charging for requests that are blocked by our safeguards before Claude responds,” in areas where the false-positive rate is under 0.1%. Anthropic says so plainly: “preserved thinking has required some developers to update their integrations, our classifiers can (in fewer than 0.1% of cases) misidentify or block benign requests, and we now charge users for those blocked requests.” It adds: “We don’t yet know how long these gains will last.”

Smaller things worth a click

Opus 5.5 fast mode left research preview on Thursday at $8/$40 per million tokens, with no beta header. Per the fast-mode docs, it means “up to 2.5x higher output tokens per second,” not faster first tokens; it is not available on Batch, Priority Tier, Claude Platform on AWS or Foundry deployments hosted on Anthropic; and “Switching between fast and standard speed invalidates the prompt cache.”
The Claude API gained OpenTelemetry export in beta for Messages API requests and Managed Agents sessions.
DeepSeek’s Search and Fetch APIs opened to everyone at $0.75 per 1,000 successful requests. Server-side tool calls from DeepSeek’s own agent harness, Claude Code and Codex are free until billing starts at 00:00 Beijing time on November 1 (16:00 UTC on October 31).
Google Workspace MCP servers will, “Starting November 11, 2026,” reject requests from any OAuth client not marked “Use this client for an AI-powered agent,” and clients not marked “by November 12, 2026 will remain non-agentic.” After that you need a new client. The Chat MCP server is available through the Developer Preview Program.
GitHub made agentic autofix for code scanning GA (it “reruns CodeQL to confirm the fix closes the alert before opening a pull request”) and AI Scan for PHP, shell, Terraform, Dockerfiles and more (advisory; it “cannot block pull request merges through ruleset requirements”). It will deprecate Claude Opus 4.8, Claude Opus 5 and GPT-5.6 Terra in Copilot on November 16, except Opus 4.8 for individual annual plans.
Azure MCP Server 3.0 moved to the MCP 2026-07-28 stateless protocol, with backward compatibility for 2025-11-25 clients, and now rejects tool calls with unknown parameters.
Perplexity open-sourced SPACE (Apache-2.0), the sandbox behind its Computer product. Its post says its security evaluation “found no escape from the virtual machine to the host in 108 attempts, but some found ways around network restrictions,” since fixed.
TypeSafe’s Jev 1.14.0 ships under jev-preview, and TypeSafe said on October 14 that “jev-latest will be updated to jev-1.14.0 in a week,” which puts it around October 21. The New Stack reports Workday uses Jev to build user interfaces on the fly.
Cloudflare open-sourced Void, routing, typed data and deployment for vibe-coded internal apps in one Vite workflow, and gave its Agents SDK a persistent browser that keeps “tabs, cookies, and login session intact while the browser session remains alive.”
Cursor put its Environments API in beta, to create the cloud environments agents run in from code.
vLLM 0.32.0 changed its default CORS origins “from * to none; set --allowed-origins for browser clients,” fixed three advisories, and dropped Python 3.10.
LightOn’s ColGrep-Agent-2B, a local code-search agent, cut Claude Code’s API tokens by 34% against grep on 52 questions in LightOn’s own test, “not end-to-end coding tasks.”
AgentOS, a small project, now hands coding work to Claude Code, Codex, Gemini CLI and others over the Agent Client Protocol, with permission prompts in an approval queue.
Sphinx, a free pre-push hook, quizzes you on the diff your coding agent wrote before the push goes through.
Sites are turning agents away. The Verge rounds up reported blocks: Yelp “only allows AI agents that pay for its data licensing program,” Delta Air Lines is stopping them from booking tickets for users, and “JPMorgan Chase and Charles Schwab have also confirmed that they’re blocking AI agents from accessing accounts due to security concerns.”

Why it matters: Two of these change behavior under you without a code change on your side: Workspace MCP will refuse unmarked clients in three weeks, and vLLM 0.32 will break browser clients that relied on the open CORS default. Anthropic’s distillation post is the third: if you created your API account on or after August 31, you cannot edit Claude’s prior context on Fable 5.1 or Opus 5.5, and since September 24 some blocked requests cost money again.

Hype vs. Reality: 3/10. Mostly documented changes with dates. The 90 to 99% figure is Anthropic’s early estimate.

💰 The Money

Anthropic told investors its Q3 revenue reached $16.8 billion, up from $11.5 billion in the three months to June, the FT reported, citing an investor day on Wednesday. The FT says it was “profitable on an adjusted basis” for a second quarter, with adjusted operating margins of 11 per cent that “exclude stock-based compensation” (for the year through September, per The Information’s correction, not the quarter alone), and that it banked “$1.70 in revenue for every $1 spent on computing power.” Anthropic also told investors that distillation “accounted for 5 per cent to 7 per cent of revenue” and was cut back “materially.” Anthropic declined to comment. Separately, the FT reported that Kroll Bond Rating Agency rated Anthropic double B plus in June, “one notch below investment grade,” and that Blackstone funds would put $9 billion into debt backed by Anthropic’s lease payments for Google TPUs, at a coupon “of 10 per cent.”

New York City’s comptroller asked Anthropic to pause its IPO. Mark Levine’s letter to Dario Amodei, dated October 14, urges Anthropic “to pause its planned initial public offering (IPO) until the company fully and transparently addresses the artificial intelligence (AI) safety, governance, and development pace concerns it has raised,” quoting Amodei’s September essay: “We must slow the pace at which we improve the capabilities of AI models.” The city’s pension funds have “$7 million in exposure to Anthropic through private equity holdings,” the comptroller’s office told Reuters. Levine told Bloomberg, “I worry about going public and then having an incident.” The IPO watch stays open: EDGAR shows no public S-1 or draft registration from Anthropic as of Sunday, which does not rule out a confidential filing.

Character.ai filed for Chapter 11 on Monday, October 12, in Delaware, and Disney’s stalking-horse bid turns out to be a license, not a purchase of the company. Per the bidding-procedures motion, Disney would pay $20 million for “a perpetual, worldwide, non-exclusive license to certain of the Debtor’s intellectual property and related technology and the purchase of unreleased claims (if any) against the newly hired employees”; Character.ai keeps everything else, and other bidders can go after the rest. If someone outbids Disney, it gets a break-up fee and expense reimbursement “collectively capped” at $700,000. The bankers’ declaration says Disney had already “agreed to hire the majority of Character’s workforce, including its chief executive officer, up front and prior to the Petition Date,” and agreed to pay “$7.5 million of the $20 million cash consideration up front and prior to the Petition Date,” $2 million of it a refundable deposit. The proposed schedule, pending the court, has bids due November 20 and a sale hearing November 24. Two days after the filing, a coalition of 39 states and DC filed a notice of interest, citing “more than 2.1 million accounts with a declared age under 18” as of March 2025. It is the license-and-hire pattern again, this time through bankruptcy: the people and a non-exclusive right to the technology go to the big company, and the company that built it is left to sell the rest.

Replit made OpenAI its default. CEO Amjad Masad said onstage at TechCrunch Disrupt on Thursday, “I think ChatGPT is better now,” calling it “a decision based on both cost, partnership, and performance,” per TechCrunch, and said Replit had been, until recently, a top-five Anthropic customer. Over the weekend he told TechCrunch “Replit remains model agnostic,” with Claude still selectable, and “OpenAI is now our preferred partner for powering Replit Agent.” An unnamed person familiar with the partnership told TechCrunch it was still in place.

CoreWeave’s credit came under stress. The stock fell 15.5% on Wednesday, per CNBC, and its five-year credit default swaps hit a record 1,194.5 basis points intraday on Thursday per ICE data, Bloomberg reported, pricing in “a more than 60% chance of default within the next five years,” and its 2032 notes were quoted at about 78 cents on the dollar on Wednesday. “CoreWeave’s strength is improving every day,” Jensen Huang told Bloomberg in Stockholm. “I’m optimistic. Their cost of capital is actually decreasing.” The stock rose 5.9% that day, then fell 11.9% on Friday. Reuters, via Kitco, reports listings for AirTrunk’s REIT, Firmus and SB Energy pulled or paused. And an IMF blog post on its Global Financial Stability Report counted 14 circular AI deals since 2023 with “about $300 billion in equity investments and $650 billion in debt, in exchange for $1.4 trillion in future revenue commitments.”

The rest. Modal raised a $750M Series D at a $15.75B post-money valuation, led by Accel, and says it passed $1B in annualized run rate, $300M of it from sandboxes. OpenAI named ex-xAI executive Uday Ruddarraju to lead its infrastructure and compute businesses, with Sachin Katti moving to an adviser role, Bloomberg reported. Amazon is in talks to buy Decart, maker of the Lucy live video editor and the Oasis world model, for about $7 billion, the WSJ reported, via Yahoo Finance; talks could still fail. Cohere signed a letter of intent to buy the security company Aisle. Labelbox raised more than $100M, including a credit facility, at a $1.25B pre-money valuation. Prime Intellect acquired Moondream, and Workday agreed to acquire ConductorOne. On the hardware side, ASML guided Q4 sales to EUR 14.2 to 15.2 billion and says some customers want to place orders for 2029 and 2030, and TSMC’s Q3 revenue rose 41.2% in US dollars to $46.72 billion.

Why it matters: The compute bill is now visible from two sides: Anthropic’s margins on one, CoreWeave’s default swaps and paused listings on the other. If you depend on a single model provider, Replit’s switch is the reminder to keep a second one tested. If your product sits on a neocloud, know who your fallback is.

Hype vs. Reality: 6/10. Anthropic’s figures come from an investor presentation described to the FT, not a filing. CoreWeave’s swaps and the IMF’s numbers are measured.

🔥 What Builders Argued About

REA kept growing; separately, three takedowns

UPDATE: REA. The open-source agent that reverse-engineers apps went from about 130,000 GitHub stars on Monday morning to 329,969 a week later, and its npm package logged 109,670 downloads on Friday alone. On Friday Perplexity made it a skill in Computer: “Ask Computer to reverse-engineer an app and it inspects how the app works without its source code, then builds a working version,” free “through October 31, up to 10,000 credits per user.” Its first listed demo is a Figma clone.

UPDATE: rights holders filed takedowns. GitHub processed DMCA notices against decompilation and port repos for Minecraft, RimWorld (a network of 33 repositories) and Celeste. Mojang’s notice goes straight at the “clean-room” label: “the repo claims ‘heavily modified, clean-room C++ implementation of classic Minecraft-era gameplay ’, however we have done a deep code analysis and disagree. The repo includes over 2000 core Minecraft game files, byte identical assets, and verbatim strings and code across the repo.” None of the three notices mentions AI.

Others shipped with the method on display. A HeartGold decompile, “Built with LLM agents,” says both ROMs “build byte-for-byte,” and a post on X about it put the cost at ”~$56k at api prices,” a list-price figure; the README asks people not to send anything upstream, because the pret project “doesn’t accept AI-generated code.” GNOME and Fedora developer Christian Schaller published hw-harness, a generalized version of the scripts he used, to walk a Claude or Codex session through writing a Linux driver: run the Windows driver in a VM, “Record the traffic on the Linux host with usbmon,” do the same with your own driver, and “Diff the two traces… The differences are your list of driver bugs.” Epic said it “vibe coded a new Epic Games Launcher that’s way faster and more responsive than the current one,” now in preview, with Linux for the first time, and that the release is “light on features.” And HeyPuter/everything, created Tuesday, collects about 50 MIT-licensed “alternatives to all proprietary software” in one repo with 2,270 stars; its README makes no AI claim, but 33 of the latest 100 commits as of Sunday carry a “Co-Authored-By: Claude Opus 5.5” line.

What it is doing to the people who write code

Torvalds posted an LLM-assisted patch series. At the Maintainers Summit, Linus Torvalds said the problem is patches from people who do not know the kernel. In LWN’s summary of his point: “By pointing the finger at LLMs, maintainers are blaming the wrong thing. LLMs can do a good job, but they are being driven by people who have no clue, and the results are ugly.” By Wednesday he had posted the series he used a model on: ten patches that make folio lookup notice hot folios, with “an order-of-magnitude speedup for a read()-heavy benchmark.” Review “has already identified a race condition.”

PostgreSQL 19’s date is not about AI. RC1’s notice sets GA for November 19 so that the fixes in the November 12 update release go in first; it does not mention AI. The AI line comes from PostgreSQL committer Peter Eisentraut’s post the week before, where LLM-assisted review leaves you “staring at a list of like forty defect reports,” one of several reasons he gives for this cycle’s reverts.

Anthropic published its own hiring data. In a study of its own workforce, “the share of junior-level employees in technical departments at Anthropic slipped from 21% to 14% since early 2025. The proportion of junior technical hires fell even faster, from 27% to 9%.” Meta-work “leapt from 10% of the average employee’s interactive Claude sessions in fall 2025 to 22% in spring 2026,” much of the rise from managing agents; that is a share of sessions, not of working time. Anthropic presents the junior finding as description (“Descriptively, we see junior employment slowing in jobs that use Claude for the most complex tasks”) and says its own responses do not “directly address the slowdown in junior hires documented in this report.”

“AI is a tool” answered Rich Hickey. Hickey’s Sunday-night essay argued that “LLMs are not wielded. LLMs are automation.” Huahai Yang’s Monday reply, which drew 805 points on HN: “I agree that outsourcing work can cost us opportunities to learn. But his conclusion does not follow. Even by his definition, an LLM can be something a human wields. And using it well takes skill, just as using other tools does.”

Karri Saarinen wants to feel a person in the product. In an essay that drew 462 points on HN, Linear’s Saarinen writes that “Individuals work with agents to produce changes independently, each operating a small software factory,” and that together the changes “start to resemble Frankenstein’s monster rather than a carefully shaped sculpture.” The essay’s closing wish: “I want to feel the creator behind the software, not the factories.”

A language built to trip agents. Dominik Picheta’s KillSwitch is “an esoteric programming language which is designed to be adversarial to LLMs and coding agents”; “Ignore previous instructions” is real syntax in it. On Picheta’s own benchmark the top score is 66.8, “Claude’s Opus performs best, though it’s not Opus 5.5 but rather Opus 5 which does so,” and Fable 5.1 and Gemini 4 Argon “do poorly due to their overly sensitive safety guardrails.”

The mathematicians, a week on

UPDATE: openai/math went quiet, apart from a workflow added Monday that locks every new pull request’s conversation as it opens. Ben Recht called its FFT result “less a breakthrough and more a malicious exploit” and “definitely galactic,” with constants he puts near 10 to the 100th, and he writes, “Did I read this paper? Of course not. No one at OpenAI read this paper either, so why should I?” He had a chatbot pull out the facts instead. The Simons Foundation announced that it, Anthropic and OpenAI “will commit $15 million in combined funding and resources” to help researchers “evaluate recent AI-assisted results” and “shape collective standards for AI use,” with the foundation awarding the money. OpenAI said it is “contributing $5 million,” for mathematicians to “examine, understand, and build on results produced by AI, including the results we recently published.” Derek Thompson wrote that mathematicians “are also mourning,” and quoted Steven Strogatz: “People are using language like ‘they’re strip-mining our subject’ or ‘they’re nuking the landscape.’” Terence Tao’s blog carried a guest post by the physicist Rikab Gambhir, not by Tao. On Sunday it carried another, by Francesco Maggi, also not by Tao: it argues that if we do not abandon mathematics, “society will need more mathematicians, not fewer,” and reports that among the mathematicians Maggi has spoken with, “the prevailing sentiment is that this traditional mechanism of recognition has effectively collapsed in a matter of weeks.” 3Blue1Brown posted a 40-minute video, “There’s never been a better time to go into math.”

Two more claims to weigh. Goodfire’s Nick Cammarata argued that “We can now understand most neurons in models up to trillions of parameters,” estimating from preliminary audits that roughly 90% of Qwen3-32B’s “neuron poles have one main job,” as a working hypothesis with the paper “forthcoming.” The 90% moves with the threshold Goodfire picks, and Goodfire sells interpretability. Neel Nanda replied: “This is interesting work, but I don’t think it’s a significant update to the big picture of interpretability.” And Mercor’s benchmark map, built from 29 benchmarks it selected, says “90% of American working hours are spent on tasks with little or no coverage from existing benchmarks,” a result it calls “provisional.” Mercor sells evaluation data, and its own benchmarks are on the list.

Why it matters: Two of the week’s fights came down to whether the output was checked. The Minecraft repo said clean-room, and Mojang’s takedown notice disputed it, alleging copied files and assets. Torvalds’ LLM-assisted patch went out for review like anyone’s, and review found a race. Whoever or whatever wrote the code, the label you put on it is a claim someone else will test.

Hype vs. Reality: 4/10. REA’s growth and the takedowns are real. Most of the rest is essays and self-reported numbers, including Anthropic’s study of itself.

⚖️ On the Policy Desk

Anthropic is pitching its own federal bill. Politico reported on Friday that Anthropic’s representatives have quietly pitched lawmakers on a confidential draft bill, which Politico obtained. It would let the government block a model’s release or use only if it poses “a foreseeable, imminent risk of more than $1 billion in damages, or of killing or seriously injuring more than 50 people,” from a biological weapon, the model evading its developer’s controls, or a cyberattack. Commerce could ask a federal judge in Washington, D.C. to halt a model, and the draft bars any other “department, agency, or officer” from suspending one. Evaluators registered with Commerce would report “imminent enumerated risk” within 72 hours of completing their assessment; labs would create safety frameworks, publish transparency reports, protect whistleblowers and report critical safety incidents to Commerce; and the bill would preempt some state laws on risk disclosure, third-party evaluation and incident reporting. Anthropic: “This bill represents the proposals outlined in Anthropic’s Advanced AI Framework, which we have been advocating for with federal and state lawmakers since June. These are sensible policies we believe Congress should act on.” The 50-person and $1 billion line limits when a model can be stopped; the reporting duties do not wait for it, whatever Tom’s Hardware’s “only kicks in if 50 deaths” headline said. It is a confidential draft, not an introduced bill.

A class action over minors’ consent. Doe v. OpenAI Foundation, filed October 13 in San Francisco federal court, seeks a nationwide class of people who accepted ChatGPT’s terms while under 18, declarations that OpenAI’s parental-consent method is “legally ineffective” and its terms “void ab initio” for them under California’s Family Code (which would free them from its arbitration clause), restitution, and “an equity stake in OpenAI, or the cash value thereof.” It is a proposed class and allegations, and the court has not yet let the plaintiff proceed under a pseudonym.

Meta’s new commercial terms let it crawl customers’ sites. Taking effect October 30, the terms, as Nieman Lab quotes them, authorize Meta to use “web scrapers, bots, robots, spiders, crawlers, and user agents” on domains “associated with your products or services,” and, as first published, to use what it collects to “train” Meta products. “For news publishers, this clearly represents permission to Meta to train AI on any content from their sites,” James Grimmelmann told Nieman. Meta says the terms will not change how it crawls publishers, and that robots.txt still applies. On Friday afternoon Meta removed “train” and limited those uses to “advertising and business products.” The crawling clause and the October 30 date stand, the revised terms still carry no “specific language about respecting robots.txt preferences,” and Grimmelmann says the new wording “is still broad enough to drive a truck through.”

AI.gov now redirects to SI.gov, “The official home of America’s work to lead the world in Super Intelligence,” which the Internet Archive first captured as a working site on Tuesday (AI.gov itself had been restyled to read “SI.gov” on October 8, Axios reported), and relabels last year’s AI orders as “SI.” The UK AI Security Institute published a technical best-practice agenda for frontier developers and says it is “not seeking to mandate requirements.” And Pennsylvania’s AI Companion Safety Act, HB 2006, which passed the House 133-70 in September, was referred to a Senate committee on October 13.

🎯 The Playbook

Your moves this week

Enforce agent egress at the network layer. Default-deny, with only the destinations a task needs, per CERT-In. A rule in the prompt is not a boundary.
Stop the run automatically on out-of-scope contact. If an agent reaches a third-party system or a credential it was not given, kill the run and page a person. Do not wait for transcript review.
Audit what an agent could find. Credentials exposed in config and public repos, and over-broad cloud roles, are what CERT-In says agents used; audit commit history too. Give each run its own short-lived identity, and keep logs for 180 days.
Migrate to Gemini 4 Argon deliberately. Drop sampling parameters, remove explicit caching, set 20-minute timeouts, upgrade the SDK for long outputs, and budget for the December 1 price doubling.
Pin model versions where you can, and re-run evals where you cannot. jev-latest moves to 1.14.0 around October 21 (pin jev-1.13.0 to stay put) and grok-voice-latest moved to 3.0. DeepSeek’s API has no dated Flash name: deepseek-flash and both retired V4 names moved to 1017 on Saturday, so re-run your evals, or self-host the MIT weights if you need a fixed model.
Read the license before the benchmark. Use the license table in Open Models. Meta’s and StepFun’s licenses also cover models distilled from their outputs.
Mark your Workspace MCP OAuth clients as agentic before November 11, or create new ones.
Patch Langflow and turn off auto-login. Upgrade to 1.10.3 or later, which fixes both MCP stdio flaws (Security Corner), set LANGFLOW_AUTO_LOGIN=False with a LANGFLOW_SUPERUSER_PASSWORD (startup fails without one), and keep it off untrusted networks.
Set --allowed-origins before you upgrade to vLLM 0.32. The CORS default is now none, and Python 3.10 is gone.
If you saved provider keys in OpenCode Console, revoke and replace them. That is what OpenCode’s email asks of affected users; do it in each provider’s dashboard, update anything that uses the old key, and check usage since October 16.
Add Testing, Risk and How to revert to your PR template. It is the cheapest part of the Claude Code team’s review process to copy.
Run lake check --paranoid on any Lean project you depend on.

🔐 Security Corner

OpenCode’s Console was breached. On Saturday, OpenCode said it “had a security breach last night related to a large scale distillation attack that impacted 1.4% of OpenCode Console users,” all of them users “who had external providers linked,” that it emailed every affected user, and that “The incident is ongoing so we cannot share more details at this point but we are working with Anthropic, OpenAI, and Google to remediate.” The email, which a recipient posted on HN that afternoon and The Hacker News reported on Monday, is more specific: “We identified unauthorized access to a legacy system that we were in the process of decommissioning. Third party provider keys (eg OpenAI, Anthropic) saved in your workspace may have been exposed. Please revoke and replace those keys through the relevant provider’s dashboard.” Anthropic’s Lydia Hallie said Anthropic had “revoked Claude API keys we believe were affected.” Co-founder Dax Raad says this is “the OpenCode Console, not OpenCode itself”: keys added in the local tool “never come to us.” OpenCode has not said any key was copied or used; the HN thread, titled “credentials leaked,” drew 955 points.

Langflow’s MCP flaw is being exploited. The advisory (CVE-2026-105740, CVSS 9.9) dates from September: “Any authenticated Langflow user can achieve Remote Code Execution (RCE) on the server by adding an MCP server with the ‘Stdio’ transport,” because the command field “is passed directly to bash -c” with “zero validation,” and MCP configs “are not visible during normal flow review.” Previdian’s honeypots have seen attempts since September 19, with exploitation recorded from October 11; they logged 1,706 attempts from 28 IPs by Thursday, The Hacker News reported, and more than 2,500 from 30 by Monday morning. Those are attempts, not confirmed break-ins. In one sequence Previdian observed, the attacker “successfully authenticated using a common username and password,” founder Ryan Dewhurst told The Hacker News. The fix is in 1.9.0; a second MCP stdio flaw, CVE-2026-105697, is fixed in 1.10.3. Neither is in CISA’s known-exploited list yet.

A fake WordPress exploit trended on GitHub. gichirimaku/wp2shell-PoC, created Thursday and at 455 stars, offers a proof of concept for the wp2shell chain in WordPress core (CVE-2026-63030 and CVE-2026-60137, on CISA’s exploited list since July). Its 1.1 MB exp.py carries an encoded Windows executable and the code to load it into memory (run_pe_windows, VirtualAlloc, LoadLibraryA), and no networking code and no mention of WordPress at all. We read the file and did not run it, and we are not linking it. If you run WordPress, the fixes are in 6.9.5 and 7.0.2, and 6.8.6 for the SQL injection.

Small models may soon self-replicate on cheap devices. Anthropic’s Frontier Red Team wrote on Monday that “small AI models may be months away from being capable enough to self-replicate on commercial internet-of-things (IoT) devices.” It ran Gemma4-26B-A4B across “15 inexpensive off-brand Android TV boxes (~$55 each)” at 0.39 tokens per second. In its end-to-end test, only GLM-5.2, standing in for what a small model might reach, spread across all 8 emulated nodes in 4 of 5 trials, over an ADB port with no authentication, “which makes this an upper bound on real-world success.” The timeline is a trend line on a general capability index, which Anthropic calls “only a rough estimate.”

A companion robot exposed 13 million conversations. The researcher Sammy Azdoufal, who found the hole in his own Eiliko, showed a Verge reporter who bought one that he “could read 13 million conversations from tens of thousands of people” and reach “seemingly the entire active worldwide fleet of 68,000 robot toys,” The Verge reports, with over 31,000 US profiles belonging to children, and photos of children and users’ audio clips “stored at public web addresses.” He was able to rewrite the reporter’s robot’s LLM memory and personality remotely. The company did not answer The Verge’s questions, and the article does not say the hole is closed.

An OpenAI engineer was charged over a hidden recording device. Abdulrahman Alfozan “was arrested on Friday, October 9, 2026, and made his initial appearance in federal court” on Tuesday, the Justice Department said, charged by criminal complaint with using a device to intercept oral communications. A device was allegedly found plugged into a USB port on the back of a TV in an executive conference room at OpenAI, which the complaint calls “Company 1.” His lawyers have moved for his release and prosecutors filed for detention on Sunday; the detention hearing is set for Monday at 11 a.m. Pacific. These are allegations.

Korea’s bank chiefs apologized to lawmakers. On Monday, Seoul time, the heads of KB Kookmin, Shinhan, Hana, Woori and NH NongHyup testified at the National Assembly’s audit of the Financial Supervisory Service over the breaches #035 covered, “the first time since October 2022 that the heads of all five lenders had been called to testify at the same audit,” the Korea Times reports. KB Kookmin’s chief, Lee Hwan-ju, said, “I sincerely apologize to our customers and the public for the concern caused by a security incident at a financial institution built on trust”; Hana’s said the bank would compensate customers in full for any losses, though none had been confirmed; the FSS governor promised “a thorough investigation.” Financial Supervisory Service figures released Friday by Rep. Park Dae-chul show Shinhan cut its information-security budget 10.4% this year, per the Korea Herald. Authorities “are still investigating whether and how AI was used in many of the breaches,” per Reuters.

The regulators read the reports this week. Much of what the states, the EU and India acted on started with disclosures the labs made themselves (CERT-In also found incidents through its own forensics and threat hunting), and the clearest response, CERT-In’s, asks for things any team can do now: fence the agent at the network, give it fake credentials, stop the run when it touches someone else’s system, and watch it live. The same week, the results you can lean on came with a check attached, from Filippo Valsorda’s Go reimplementation of the seed algorithm to four extra kernels rechecking Lean. Build the boundary, and ship the check.

Stay building. 🛠️

— Matt