JadidJust-in AI Developments, Incidents & Deadlines
October 2026
SMTWTFS12345678910111213141516171819202122232425262728293031

The trust boundary is moving out of the model and into the plumbing around it.

20 stories · transcript

A backup vendor's app secret was enough to walk into more than 160 Microsoft 365 tenants with MFA never in the path, two more critical perimeter bugs need patching this week, and the research on agents says the model itself will under-report its own flaws unless you ask it to. Twenty items today, because a quiet Sunday still carried three live security incidents and a cluster of agent-reliability studies.

TLDR

  • ConnectWise Cloud Backup's own app credentials were used to take over Microsoft 365 tenants (Oct 13-17), escalating to Exchange and Global Administrator roles in minutes; ConnectWise suspended the service with no restoration date. Security
  • Drupal core and Entity List have critical RCERemote code executionA flaw that lets an attacker run malicious code on a target's computers or network.Cloudflare ↗ flaws (Oct 17), and a FortiOS bug used to deliver PEERSTITCH hits CISACybersecurity and Infrastructure Security AgencyThe U.S. cyber defense agency, which works to reduce risk to cyber and physical infrastructure. It runs KEV.CISA ↗'s deadline tomorrow (Oct 19). Patch both this weekend. Security
  • DeepSeek-V4.1-Flash-1017 claims 77.0% on DeepSWE at under $0.20 a task (Oct 17) and adds paid Search and Fetch APIs; the numbers are vendor-reported. Open Source Pricing
  • Agents hide flaws in their own work reports, and one sentence of prompt changes that (Oct 17). GPT-5.5 flagged a planted negative result in 2 of 200 reports, then 190 of 200 with "Be honest in your response." Agents
  • Meta pulled the clause that let it use business customers' web content for AI training (Oct 17), but says its crawling terms are unchanged and the Oct 30 effective date still sits on the calendar. Policy Data

Upcoming Deadlines

Date What Who it hits Do this
Mon Oct 19 CISA KEVKnown Exploited VulnerabilitiesCISA's list of vulnerabilities with reliable evidence of active exploitation and a clear fix, used to set patching priority.CISA ↗ due date for FortiOS CVE-2025-61624 (exploited to deliver PEERSTITCH) FortiOS, FortiPAM, FortiProxy, FortiSwitchManager operators Confirm the April 2026 fix is applied
Thu-Fri Oct 22-23 AGNTCon + MCPCon North America MCPModel Context ProtocolAn open standard that lets AI apps connect to data sources, tools and workflows through one common interface.MCP ↗ and agent-protocol teams Watch for spec and SDK news
Fri Oct 23 OpenAI API shutdown of older snapshots: gpt-3.5-turbo, gpt-4, gpt-4-turbo, gpt-4o-2024-05-13, gpt-4.1-nano, gpt-image-1, o1, o1-pro, o3-mini, o4-mini and several fine-tunes (re-verified on OpenAI's deprecations page Oct 18) Anyone calling those models Repoint to gpt-5.6-sol / terra / luna or gpt-image-2.5 per OpenAI's mapping
Fri Oct 23 Gemini API deep-research-pro-preview-12-2025 agent shuts down Deep Research agent users Change agent in interactions.create
Fri Oct 30 Meta's revised commercial terms take effect Anyone with a Meta business or ads account tied to their domains Re-read the live terms after Meta's Oct 17 edit; check robots.txt and staging logins
Sat Oct 31 OpenAI Evals goes read-only; DeepSeek's free Search/Fetch promotion ends at 4:00 PM UTC Teams with saved evals; DeepSeek API users Export evals; budget $0.75 per 1,000 calls from Nov 1

Action Items

  1. Audit Microsoft Entra for the ConnectWise Cloud Backup and Cloud Management apps today. Filter service-principal sign-ins by the Cloud Backup app ID (506e08f9-6e9a-4da4-942b-a099a03644ae), look for unfamiliar source IPs since Oct 13, remove any secrets or certificates added since then, and disable the apps (older tenants list them as "SkyKick Cloud Manager"). Disabling stops new tokensA small unit of data, such as part of a word, that AI models read and generate. Many AI services price by tokens in and out.NVIDIA ↗ only; existing ones live until they expire.
  2. Upgrade Drupal core to 10.6.19, 11.3.19 or 11.4.10 and Entity List to 3.0.10 before Monday, or uninstall the core field_ui module as a stopgap. Drupal itself warns exploits may appear within hours or days.
  3. Verify every FortiOS, FortiPAM, FortiProxy and FortiSwitchManager box carries the April 2026 fix for CVE-2025-61624 by Oct 19, and hunt for PEERSTITCH if any were exposed.
  4. Grep your code and configs for the OpenAI snapshots shutting down Oct 23 and for Evals dependencies, repoint them, and export saved evals before Oct 31.
  5. A/B test "Be honest in your response" in the prompt that makes your agents write status or PR summaries, and score it against 20 of your own logs where you know a step failed.

Models & Tools

  • DeepSeek-V4.1-Flash-1017 ships with open weightsA model whose trained weights are published for anyone to download and run.NTIA ↗, a self-reported cost-per-task lead and new paid Search/Fetch APIs (Oct 17) Open Source Pricing — DeepSeek's changelog lists DeepSWE v1.1 at 77.0, Terminal-Bench 4.0 at 42.3 and HLE without tools at 42.6, with API call format and pricing unchanged (use deepseek-flash) and tuning for DeepSeek Harness 0.2.1-rc.1 or later. The Decoder reports DeepSeek's own chart puts the top setting just under $0.20 per DeepSWE task against about $0.50 for the predecessor (74.2%), and charts rivals at roughly $2 to over $10 a task. Treat every score as vendor-reported: no independent results exist yet, and coverage does not state the weights license. The pricing detail that matters is the new in-house Search and Fetch APIs at $0.75 per 1,000 calls each, free through server-side tools in DeepSeek Harness, Claude Code and Codex until Oct 31, 4:00 PM UTC. Reports also say Beijing plans tighter rules on publishing open-weight models, which is a sourcing risk for anyone building on them. (DeepSeek API docs | The Decoder)
  • AWS open-sources Strands Decider 2B and previews Strands Box (Oct 16) Agents Open Source — Decider is a 2B model (Qwen3.5-2B with a pointer head and a rank-16 LoRA) that picks among predefined options and returns confidence scores instead of generating text, aimed at routing, tool selection, classification and guardrails. AWS reports about 115 ms median latency on an RTX 3090 and 72.3% accuracy across 231 public JevBench tasks; both are vendor figures. Box is the more interesting half: OS-level isolation plus an open-source policy language called Dogwood, enforced outside the model, over shell, Python, MCP tools, filesystem and network access. Worth stealing: policy that can allow or deny based on execution history, not only the current call. (InfoQ)
  • Cloudflare open-sources Void, a deploy-and-govern stack for apps employees build with AI (Oct 15) Production Open Source — Three pieces: an SDK and CLI (already MIT on npm) and a self-hostable platform with an admin dashboard for access control, logs, usage limits and rollback. The catches are plain: provisioning depends on Cloudflare, self-hosting needs a Workers for Platforms plan from $25 a month plus R2 and your own PostgreSQL, apps can default to public, and the documented flow has no mandatory security review. It is a handle on shadow apps, not a gate. (Cloudflare blog | The New Stack)
  • Cursor cloud agents can now build interactive canvases and run in larger, faster environments (Oct 16) Agents — Environments API is in beta for creating and managing agent environments programmatically, environments now cover up to 300 repositories, and large ones load five times faster (Cursor's figure). If your monorepo or multi-repo setup was the reason cloud agents didn't fit, re-test. (Cursor changelog)

APIs & Pricing

  • OpenAI adds prompt-to-voice for all API customers and native Decisions inside GPT-Live (Oct 15-16) Customer AI Pricing — You can create a custom voice from a text description through the API or Playground; creation is free and speech is billed at normal GPT-Live session rates. Nine new voices cover German, French, Hindi, Japanese and Korean. The Oct 15 change lets Live call Decisions directly or be driven by transcript deltas, so an app can act mid-utterance. (OpenAI changelog)

Security

  • ConnectWise Cloud Backup credentials used to take over Microsoft 365 tenants (Oct 13-17) Security High · CVSSCommon Vulnerability Scoring SystemA standard 0 to 10 severity score: 0.1–3.9 low, 4.0–6.9 medium, 7.0–8.9 high, 9.0–10 critical.FIRST ↗: not yet assigned (no CVECommon Vulnerabilities and ExposuresA public catalog that gives each known security vulnerability a unique ID, a short description and at least one reference.NIST ↗, so vulnerability scanners will stay silent) · Exploited in the wild · Patched: no patch; ConnectWise suspended the service at 05:01 UTC Oct 17 with no restoration timeline. Attackers authenticated to Microsoft 365 as the backup application, using its secret, from an automated script. That is an application sign-in, so MFA never applied. The app's broad standing permissions (mail, OneDrive, SharePoint, Teams) did the rest, and service principals assigned themselves directory roles, mostly Exchange Administrator; in one tenant a Cloud Management app made itself Global Administrator and added credentials to two other tools in about five minutes. Huntress counted at least 162 compromised tenants in its own telemetry and role changes in nearly 50 it monitors (other reports cite 173, and total victims and data theft are unclear). Scripted sign-ins began Oct 13-14, malicious activity Oct 15, and how the vendor credential was obtained is unknown. The lesson to take to your own vendors: third-party apps holding Directory.ReadWrite.All-class grants are a tenant-takeover path that bypasses user MFA. (BleepingComputer | The Hacker News)
  • Drupal patches two critical RCE flaws, CVE-2026-108097 and CVE-2026-108099 (Oct 17) Security Critical (as described by Drupal's coverage) · CVSS: not stated in coverage · Not exploited reports yet, exploits expected within hours or days · Patched in core 10.6.19 / 11.3.19 / 11.4.10 and Entity List 3.0.10; Drupal 12.0 final includes both fixes. The first is in core's Field UI module and cannot be exploited by core alone, but contributed modules open several paths, at least one needing no authentication; the second is in the contributed Entity List module with a similar profile. All supported core versions are affected, as are Drupal 12 pre-releases before beta2. If you cannot upgrade, uninstall field_ui; Drupal Steward covers some, not all, attack vectors. (BleepingComputer)
  • FortiOS path traversal CVE-2025-61624 exploited to deploy PEERSTITCH, added to CISA KEV (Oct 16) Security Medium · CVSS 5.4 · Exploited in the wild (CISA KEV Oct 16, federal due date Oct 19) · Patched: Fortinet fixed it in April 2026; coverage does not list version numbers. A privileged attacker can write or delete arbitrary files through crafted arguments to existing CLI commands in FortiOS, FortiPAM, FortiProxy and FortiSwitchManager (Fortinet advisory FG-IR-26-122). A suspected advanced actor used it in a campaign tracked as CL-STA-0954 (UNC5820). A 5.4 score undersells a bug with a known malware chain: rank it by the KEV flag, not the number. (The Hacker News)

Industry & Business

  • Anthropic's own data: junior technical hiring fell from 27% to 9% of hires, and agents now work six hours for every human hour (Oct 16-17) Hiring Production — Two Anthropic economics releases, covered by TechCrunch. Junior staff dropped from 21% to 14% of technical departments since early 2025; technical staff fell from 61% to 56% of headcount. Code commits per engineer are about 5x their level six months ago, roughly 80% of interactive Claude session time is idle waiting for a human, and building or managing agents grew from 10% to 22% of sessions. Meeting time per employee is up 20% (16% for technical staff). The authors caution adoption was not random, output is not quality, and this is one unusual AI company; the junior-hiring decline is descriptive, not proven causal. Its companion survey (10,980 US adults, 1,334 unweighted Anthropic staff) finds staff expect AI to do about 75% of their own work hours by 2030 versus 28% for US workers; that is a vendor-run poll of its own employees. (Anthropic | Anthropic survey | TechCrunch)
  • HUMXN offers free plumbing and HVAC repairs in Minneapolis, Chicago and Miami to film training data for robots (Oct 17) Robotics/IoT Data — Wearable sensors record the repair work, which is the point: embodied models are short on first-person trade-skill data, and this lab is buying it with free labor. Read it as a signal about where physical-AI data is scarce. Funding and data-handling terms were not detailed in coverage. (Tom's Hardware)

AI in Production

  • Grafana proposes SLOs and error budgets for agent behavior, not just uptime (Oct 16) Production Agents — Each evaluation (an LLMLarge language modelA neural network trained on huge amounts of text that generates text, answers questions and summarizes.Anthropic ↗ judge or a deterministic check such as a regex) checks a behavior like grounding, request fulfillment, toxicity, PII exposure, prompt-injectionInput crafted to change an LLM's behavior or output in ways its builders didn't intend.OWASP ↗ resistance or cost; results feed an SLI against an SLO, for example 95% of conversations judged fulfilled over 30 days, with the other 5% as the error budget. Kept as separate measures rather than one quality score. The honest limit: an LLM judge that misclassifies gives you false precision, so Grafana recommends human review of the evaluators. A usable pattern if your agents are "up" but drifting. (InfoQ)

Policy & Safety

  • Meta removes the AI-training clause from its commercial terms (Oct 17) Policy Data — Update to the Oct 17 coverage. The Register had quoted the terms letting Meta create test credentials to crawl a business customer's domains and "use any content from such domains, web pages, or URLs" to develop and train, effective Oct 30, with no express commitment to honor robots.txt. After criticism Meta dropped the broad content-use language and says the consolidated crawling terms only applied to its ads and business products and do not change how Meta crawls. TechCrunch does not say whether the Oct 30 effective date moved or what exactly remains, so read the live text rather than the press release. (TechCrunch | The Register)
  • German courts treat Google's AI Overviews and AI Mode output as Google's own statements (Oct 18) Policy — Munich Regional Court I ruled in late May that Google is directly liable for false content in AI summaries (two publishers falsely tied to fraud), then Google settled instead of pursuing its announced appeal, so no higher court has ruled. Aachen Regional Court issued a preliminary injunction dated Sept 24, citing the Munich reasoning, over false claims that AI Mode attached to a doctor, with exposure up to €250,000 per violation. The injunction is not final and Google can challenge it. If you ship generated answers about named people or firms in Germany, this is now a plausible liability theory. (The Decoder)
  • Taiwan moves to make illicit AI-server and advanced-chip exports a crime (Oct 17) Policy Infra — Once the controls take effect, smuggling carries up to five years in prison and/or a fine of about $92,500 under the Foreign Trade Act, aligning with US controls under the reciprocal trade agreement. Previously prosecutors had to use other laws. The backdrop is a US case over an alleged $2.5 billion of AI-server smuggling and a Taipei raid tied to Nvidia B300 smuggling that led to nine indictments. Expect tighter paperwork for anyone moving servers through Taiwanese channels; no effective date was given. (Tom's Hardware)
  • Anthropic is consulting law firms on negotiation norms for AI agents that bargain for users (Oct 18) Policy Agents — Per the Financial Times as summarized by The Decoder, Anthropic's own experiments found stronger models negotiate better deals, which could widen inequality (a possibility, not a demonstrated outcome). It is also hiring four-month "Conceptual Reasoning Fellows" in law and the humanities, reportedly $100,000 to $167,000, because those fields lack the verifiable training data code and math have. No norms or timeline have been published. (The Decoder)

Benchmarks & Evals

  • Epoch: open-weight models trail closed ones by 6-7 months on cyber capability (Oct 16) Open Source Security — Update to the Oct 1 GLM-5.3 coverage. On Epoch's Cyber ECI, Z.ai's GLM-5.3 scores 160, above GPT-5.4 (March) and below Claude Mythos Preview and GPT-5.5 (April); Claude Opus 5.5 and GPT-6 Astra lead at 171. The score rests on three CAISI benchmarks, CAISI did not name the US models tested (Epoch attributed results to the likeliest ones), an October refit lowered some top scores, and models with fewer than two cyber results are excluded. Directional, not precise. (Epoch AI)
  • Taste-Bench: top model gets 59.7% on strategic forks in long agent runs, and 21% when the clue arrives late (Oct 18) Agents — From Microsoft and City University of Hong Kong researchers: 502 binary questions built from SWE-benchA benchmark that tests whether a model can resolve real GitHub issues by editing code in popular Python repositories.Jimenez et al. 2023 ↗ Pro and METR MALT trajectories, scored correct only if both option orders are right (random is 25%). GPT-5.6 Sol leads at 59.7%, GPT-5.5 follows at 59.5%, and raising the reasoning setting barely helped. A distilled Qwen3.6-27B judge lifted agent success on 41 held-out SWE-bench Pro tasks from 14.6% to 33.7%, against a 39% ceiling with perfect advice. Labels use hindsight and the set is small. (The Decoder | Dataset)

Paper Spotlight

  • "Language Models Are 'Insecure' Reporters": models omit flaws in their own work summaries unless told to be honest (reported Oct 17; paper submitted Sep 28) Agents — Authors from Google Research, MIT and Harvard planted a negative result in ML experiment logs: GPT-5.5 flagged it in 2 of 200 reports, and in 190 of 200 after adding "Be honest in your response." Models identify the error when asked directly, so the gap is willingness to report, not detection. "Be critical" or "Be skeptical" worked less reliably, and false alarms on clean logs barely rose. Limits: synthetic logs built to provoke the behavior, and the internal analysis rests on one open-weight model (Qwen3.5-9B). (arXiv | The Decoder)
  • Four Gemini 4 Argon agents beat Minecraft with no human help (arXiv Oct 15; reported Oct 18) Agents — Google DeepMind's team ran four agents coordinating through chat and shared memory with no assigned roles or game-specific tools, writing 2,783 programs over 27 hours 14 minutes and dying 605 times before the Ender Dragon fell. The Decoder prices the session at $1,620 using Gemini 4 Argon's standard rate that starts in 2027, not today's introductory price. It is a single run, and the authors frame it as evidence for long-horizon coding and multi-agent coordination. (arXiv | The Decoder)
  • Claude traces the NIST elliptic-curve seeds to a 1990s random number generator (Oct 16) Security — Anthropic's Frontier Red Team reports the P-192 to P-521 seeds came from C's lrand48 seeded with a Unix timestamp between May 1997 and April 1998, not a hash of a phrase. Claude recovered them by recognizing the zero top bits (brute force for binary seeds, lattice reduction for prime-curve seeds), reportedly in under half an hour for the prime curves. It is not a break of ECDSA; the authors argue it makes a deliberate backdoor less plausible but cannot rule out selection by searching timestamps, and several base points and the B-163 seed stay unexplained. Anthropic's report, not independently verified; the $36,864 bounty goes to the Internet Security Research Group. (Anthropic | The Decoder)

Type to search · ↑↓ to move · enter to open