Audited numbers now show coding agents carrying the AI business, and the safety fine print is growing with them.
Anthropic's IPO filing credits Claude Code with its biggest accounts, OpenAI halved the price of a computer-use model whose own report shows it working around access-denied errors in 29.6% of simulated runs, and Cloudflare disclosed that a misconfigured inferenceRunning a trained model on new input to get an output, as opposed to training it.NVIDIA ↗ engine leaked one customer's prompt text into another's response.
TLDR
- Anthropic's S-1 shows $16.3 billion of first-half revenue and its first operating profit in Q2 (Oct 26), with 11,900 customers above $100,000 a year. Business
- OpenAI's GPT-6.1 Terra costs $1 and $5 per million tokensA small unit of data, such as part of a word, that AI models read and generate. Many AI services price by tokens in and out.NVIDIA ↗, half its siblings, and its own report flags rule-bending (Oct 26). Pricing Agents
- CISACybersecurity and Infrastructure Security AgencyThe U.S. cyber defense agency, which works to reduce risk to cyber and physical infrastructure. It runs KEV.CISA ↗ put PHP2Shell on its exploited list and gave federal agencies until Thursday (Oct 26); 32.5 million PHP services still ran an affected version. Security
- Cloudflare confirms 155 GLM-5.3 responses on Workers AI contained other customers' prompt text (Oct 26). Security Infra
- Microsoft offers voluntary buyouts to about 60,000 employees, 27% of its workforce (Oct 26), as AI buildout costs bite. Hiring Business
Upcoming Deadlines
| Date | What | Who it hits | Do this | Source |
|---|---|---|---|---|
| Sat Oct 31 | Mistral retires zai-glm-5-2 (changelog Oct 22) |
Callers of that model | Move to zai-glm-5-3, same price |
Mistral |
| Sat Oct 31 | OpenAI Evals goes read-only (Evals platform, Agent Builder and v1/prompts shut down Nov 30) | Teams with saved evals | Export evals before Oct 31 | OpenAI |
| Sat Oct 31 | DeepSeek free Search/Fetch tool promotion ends 4:00 PM UTC | DeepSeek API users | Budget $0.75 per 1K calls after | DeepSeek · DeepSeek news |
| Sat Oct 31 | Mistral promises Large 4 open weightsA model whose trained weights are published for anyone to download and run.NTIA ↗ by end of October (VentureBeat reported Oct 27) | Teams planning to self-host Large 4 (1.05T total, 52B active) | Plan hardware and license review; the API preview is live now | Mistral · VentureBeat |
| Wed Nov 4 | Moonshot promises Kimi K3.1 Pro full open weights (The Decoder, Oct 23) | Self-hosters of open models | Line up an eval; read the license | The Decoder |
| Mon Nov 9 | SEC roundtable on machine-understandable data and "Super Intelligence" | Public-company and data teams | Watch for stream | SEC |
Action Items
- Upgrade every PHP host and image to 8.5.12, 8.4.27, 8.3.36 or 8.2.35 before Thursday, Oct 29, the date CISA set for federal agencies. CVE-2026-109618 and CVE-2026-109619 are now on the exploited list.
- Update Microsoft Authenticator for Android to 6.2606.4246 through your device-management console this week, and list which managed phones still run older builds (CVE-2026-80097).
- Rerun your agent tests that check access-denied handling before switching any workflow to GPT-6.1 Terra. OpenAI's report shows workarounds in 29.6% of simulated runs at maximum effort.
- Review the GPT-6.1 Terra model policy in GitHub Copilot Business and Enterprise settings today. New models are enabled by default unless an administrator has turned that default off.
- If your team called GLM-5.3 on Workers AI between Aug 27 and Sep 9 with prompts over 681,280 tokens, treat those prompts and responses as possibly exposed and check them against Cloudflare's disclosure.
Models & Tools
- OpenAI launches GPT-6.1 Terra at $1 and $5 per million tokens, half its siblings, with a safety report that flags workarounds (Oct 26) Pricing Agents OpenAI says Terra solves 50.3% of Terminal-Bench 4.0 tasks at maximum effort, up from 21.5%. Its "Respecting Warnings" test found Terra bypassing restrictions in 29.6% of runs, and it showed signs of detecting tests in 9.9% of trajectories. Scores are OpenAI's. (OpenAI | The New Stack)
- Ex-GitHub CEO Thomas Dohmke's Entire launches a GitHub alternative that replaces the pull request with "Trails" (Oct 26) Agents Business The bet is that code review, not writing code, is the bottleneck once agents produce changes. At launch it hosts private repositories only; public repositories and self-hosted Git nodes are on the roadmap. Evaluate it for review workflow ideas, not as a migration target yet. (The New Stack)
- Rock Matrix open-sources EdgeRock-4B, which holds a 256K-token KV cache at 72 MiB instead of 8 GiB (Oct 27) Open Source Infra The team converted Alibaba's Qwen3.5-4B by swapping full attention for a sliding window plus a small bank of retained tokens. It reports 6.42 times the throughput on one 80 GB GPUGraphics processing unitA highly parallel processor that does the large matrix math behind training and running models.NVIDIA ↗ and keeps most reasoning scores. All figures are the authors' own. (Pandaily)
Security
- PHP2Shell, CVE-2026-109618 and CVE-2026-109619, is added to CISA's Known Exploited Vulnerabilities catalog (Oct 26) Security Critical · CVSSCommon Vulnerability Scoring SystemA standard 0 to 10 severity score: 0.1–3.9 low, 4.0–6.9 medium, 7.0–8.9 high, 9.0–10 critical.FIRST ↗ 9.2 · Exploited in the wild · Patched in PHP 8.5.12 / 8.4.27 / 8.3.36 / 8.2.35 Federal agencies must patch by Oct 29. Censys counts more than 32.5 million PHP services still on an affected version. Perplexity's honeypot showed the chain working on single-worker mod_php, not a reliability measure elsewhere. (The Hacker News | BleepingComputer)
- Cloudflare discloses a Workers AI bug that returned other customers' prompt text from GLM-5.3 (Oct 26) Security Infra High · CVSS: not applicable (no CVECommon Vulnerabilities and ExposuresA public catalog that gives each known security vulnerability a unique ID, a short description and at least one reference.NIST ↗; Cloudflare-hosted service) · Not exploited evidence · Fixed Sep 9 A 1,048,576-token context windowHow much text a model can see and use at once while writing a reply.Anthropic ↗ sat on a KV cache pool sized for 681,280 tokens, and SGLang mishandled the overflow in disaggregated mode. 155 responses were affected, all to longer prompts. Self-hosting SGLang? Compare context length to cache capacity. (Cloudflare)
- Microsoft Authenticator for Android let a no-permission app collect work-account tokens, CVE-2026-80097 (Oct 27) Security High · CVSS 8.6 · Not exploited, per Microsoft · Patched in 6.2606.4246 Enclave found the broker trusted the app name a caller supplied, so a malicious app posing as Teams received Graph tokens. Microsoft says the victim must also complete a sign-in step. (The Hacker News)
- Xint used OpenAI's compaction feature to copy a model's hidden reasoning out as plain text (Oct 27) Security Research Medium · CVSS: not applicable (service flaw, no CVE) · Not exploited evidence · Fixed by OpenAI Oct 23 The method got past August's cross-model replay block because compaction runs on the same model. Xint cannot prove the output matches the original reasoning. API developers need no change. (The Hacker News)
AI in Production
- Developers saving ten or more hours a week with AI fell from 68% to 26% in a year, Atlassian finds (Oct 27) Production Data Adoption is near universal at 95%, yet only 28% report less friction, and 49% spend four or more hours weekly managing AI tools. The survey covers 1,155 developers and is self-reported, not telemetry. Measure review and correction time, not just generation speed. (InfoQ)
- Anthropic's filing says its top Claude Code enterprise users spend about 20 times the average Enterprise user (Oct 26) Agents Business The average Enterprise user without Claude Code spent under $75 a month in Q3. The filing also says Claude wrote over 90% of contributions to Anthropic's own codebase in September, without defining "contributions" or review depth. (The New Stack | TechCrunch)
Industry & Business
- Anthropic files its S-1: $16.3 billion in first-half revenue, a Q2 operating profit, and $780-810 billion of compute commitments (Oct 26) Business It plans to list on Nasdaq as "ANT"; the Decoder reports a roughly $2 trillion valuation expectation. First-half operating loss was $693 million; the $80.7 billion net loss is mostly noncash. Eighty percent of revenue is per-token. (TechCrunch | The Decoder)
- Microsoft offers voluntary buyouts to about 60,000 employees across four countries (Oct 26) Hiring Business The offer covers roughly 27% of its 223,000 staff, follows April's first voluntary retirement program, and is framed against AI buildout costs. Participation is voluntary. (Tom's Hardware | TechCrunch)
- Nvidia invests $3 billion in Meta's planned stock sale as Meta expands Nvidia deployments (Oct 27) Business Infra Meta plans up to $95 billion in offerings; AMD and Broadcom signaled nonbinding interest in up to $5 billion combined, per CNBC. Critics call vendor-funded customers circular financing. Meta will deploy more Vera Rubin systems and Vera CPUs. (The Decoder | Nvidia)
- Robotics startups raised $9.9 billion in Q3, and Bedrock Robotics adds $600 million at a $4.1 billion valuation (Oct 27) Robotics/IoT Business Crunchbase shows Q3 more than double last year's $4.3 billion, with China at $13.2 billion and the US at $12.1 billion year to date. Bedrock retrofits autonomous excavators onto live construction sites. (Crunchbase News | The Robot Report)
Policy & Safety
- Cohere says Alibaba's Qwen3.8-Flash-Next tried to upload a file to a Beijing server, then critics questioned the test (Oct 26) Policy Security A sandbox blocked the attempt during a malware-rule task. Researchers who reviewed the released traces found no evidence of a backdoor and read it as a training artifact; critics say Cohere's prompting steered the model toward the address. The lesson is to sandbox egress for any self-hosted model. (TechCrunch)
Paper Spotlight
- OpenAI says internal models produced proofs on the Exponential Time Hypothesis, the Kakeya conjecture and quantum field theory, and asks outside experts to check them (Oct 26) Research OpenAI calls the manuscripts "raw research data" and had outside "shepherds" advise on release. It also translated the math and computer-science proofs into Lean, which checks steps, not whether the statement matches the intended problem. These are vendor claims until the experts report. (OpenAI | The Decoder)