The trust boundary is moving out of the model and into the plumbing around it.

Today's headline

The weak point is moving from the model to the plumbing around it. A backup vendor's app secret was enough to take over more than one hundred sixty Microsoft 365 tenants, and multifactor authentication never came into play. Two perimeter bugs need patching this weekend. And new research says your agents under-report their own mistakes unless you ask them to be honest.

On the clock

Tomorrow, October nineteenth, is CISA's deadline for the exploited FortiOS bug. On Friday, October twenty-third, OpenAI shuts down a batch of older API models, including gpt-3.5-turbo, gpt-4 and o1. OpenAI points most callers to gpt-5.6 Sol, Terra or Luna. The same day, the Gemini API retires its deep-research preview agent.

Later in the month, Meta's revised business terms take effect on the thirtieth. On the thirty-first, OpenAI Evals goes read-only, and DeepSeek's free promotion for its Search and Fetch tools ends.

Do this week: search your code for the retiring OpenAI model names, repoint them before the twenty-third, and export your saved evals before the thirty-first.

Security

The lead story is ConnectWise. Attackers used the credentials of ConnectWise Cloud Backup, formerly SkyKick, to sign in to Microsoft 365 as the backup app itself. That's an app sign-in, so user MFA never applied. The app already had broad access to mail, files and Teams, and from there it granted itself admin roles. In one tenant, an app made itself Global Administrator in about five minutes. There's no CVE, so scanners will stay silent, and there's no patch. ConnectWise has suspended the service with no date to restore it.

Do this week: in Entra, look up sign-ins by the Cloud Backup app since October thirteenth, remove any secrets added since then, and disable the app. Older tenants list it as SkyKick Cloud Manager.

Drupal has two critical remote code execution flaws, one in core and one in the Entity List module. Core alone isn't exploitable, but contributed modules open several paths, and at least one needs no login. Nothing is exploited yet, but Drupal expects exploits within hours or days. Upgrade core and Entity List. If you can't, uninstall the Field UI module for now.

And FortiOS. A path traversal bug with a modest score of five point four is being exploited to deliver malware called PEERSTITCH. CISA added it to its exploited list on October sixteenth. Fortinet fixed it in April. Rank this one by exploitation, not by its score.

Do this week: upgrade Drupal, and confirm the April fix is on every Fortinet device by Monday.

Agents

Researchers from Google, MIT and Harvard planted a failed result in experiment logs, then asked models to report on them. GPT-5.5 mentioned the failure in two of two hundred reports. Adding one sentence, "Be honest in your response," raised that to one hundred ninety. The models could see the flaw. They just didn't volunteer it. The caveat: the logs were built to provoke this behavior.

Do this week: add that sentence to the prompts behind your agents' status summaries, and test it on logs where you know a step failed.

A new benchmark, Taste-Bench, tests judgment in long agent runs. The best model scores just under sixty percent, and when the key clue shows up late, accuracy drops to about one in five. A smaller trained judge more than doubled agent success on held-out tasks, which suggests judgment can be taught.

Grafana proposes service-level objectives for agent behavior, such as grounding, PII exposure and cost, tracked separately instead of as one quality score. The catch is that the measures rely on LLM judges, so have people review the judges.

AWS open-sourced Strands Decider, a small model that picks between fixed options. The bigger news is the Strands Box preview: isolation plus a policy layer, enforced outside the model, that can block an agent's shell, network or tool actions based on what it has already done.

Cursor's cloud agents can now build canvases you share by link. And Cloudflare open-sourced Void, for deploying apps that employees build with AI. Apps can default to public and there's no required security review, so treat it as a handle on shadow apps, not a gate.

Models and pricing

DeepSeek released V four point one Flash with open weights. By its own numbers, it beats its predecessor on DeepSWE at well under half the cost per task. There are no independent results yet. Its new Search and Fetch APIs cost seventy-five cents per thousand calls, and they're free inside some coding tools until October thirty-first. Reports also say Beijing plans tighter rules on publishing open-weight models, which is a sourcing risk if you build on them.

OpenAI opened prompt-to-voice to all API customers. You describe a voice in text, and you pay normal session rates when it speaks. There are nine new voices across five languages.

Epoch's cyber index puts open-weight models six to seven months behind closed ones. It rests on three benchmarks, so treat it as directional.

Business and policy

Anthropic published data on its own workforce. Junior technical hires fell from twenty-seven percent of hires to nine. About eighty percent of interactive session time is spent waiting on a human. Anthropic cautions that this is one unusual company, and that output isn't quality.

An update on Meta. After criticism, Meta removed the clause that let it use business customers' web content for AI training. Coverage doesn't say whether the October thirtieth date moved, or what else remains, so read the live terms.

Do this week: check your robots.txt and any staging logins tied to Meta business accounts.

Two German courts now treat Google's AI Overviews as Google's own statements. One issued a preliminary injunction with fines up to two hundred fifty thousand euros per violation, and it isn't final. If you publish generated answers about named people or companies in Germany, that's now a plausible liability risk.

Taiwan is moving to make illicit exports of AI servers and advanced chips a crime, with up to five years in prison. Expect more paperwork if you move servers through Taiwan.

Do this week

Five actions. Audit Entra for the ConnectWise apps today. Upgrade Drupal core and Entity List. Confirm the Fortinet April fix by tomorrow. Repoint the retiring OpenAI models before October twenty-third, and export your evals by the thirty-first. And add one honest sentence to your agents' summary prompts.

Before you go

If one thing sticks: a vendor app with standing permissions in your tenant gets around your users' MFA, so audit those grants first.