The tools that hold your keys and run your agents are now the soft target.

Today's headline

The tools that hold your keys and run your agents are now the soft target. A critical bug sits in the Claude Agent SDK, a hosted coding-agent console may have leaked provider keys, and a fake accelerator shipped npm packages that rerouted agent traffic. It's a lighter day for news, so we'll spend the time on what you should patch and rotate.

On the clock

Today is the CISA deadline for the exploited FortiOS bug. If you haven't confirmed the April fix, do it now.

On Thursday, October twenty-second, the Gemini API shuts down the Veo three point one previews and the Omni flash preview. Google says those are the earliest possible dates. The replacement is Gemini Omni one point one flash.

On Friday the twenty-third, OpenAI retires a long list of older models, including gpt-4 and o1, and Google's older Deep Research agent goes the same day. Meta's new business terms take effect on the thirtieth, and OpenAI Evals goes read-only on the thirty-first.

Do this week: move Veo and Omni preview callers before Thursday, and repoint the retiring OpenAI models.

Security

The lead is the Claude Agent SDK for Python. It has a critical argument-injection flaw. The SDK passed the resume option to the Claude command line without checking it. A value starting with a dash gets read as a flag. An attacker can use that to define an MCP server, and it runs commands at startup, bypassing the SDK's permission controls.

It only matters if untrusted input becomes the session ID. The advisory has no severity score yet, and it names no fixed version, only the latest release. Update the package, and validate session IDs against a strict pattern.

Next, OpenCode. An intruder reached a legacy system behind its hosted Console on October sixteenth. About one point four percent of Console users had provider keys saved there, and they got an email on the seventeenth. If you didn't get one, you weren't affected. Keys stored locally by the command-line and desktop apps are not involved. The important part: deleting a key in Console does not revoke it. Revoke it at OpenAI, Anthropic or Google, then check your billing.

A fake Web3 accelerator pushed two npm packages that delivered infostealers and backdoors on Windows and macOS. The pitch was free Claude and Gemini credits. Elastic says it also repackaged a legitimate coding agent so model requests went through attacker-controlled services. The packages are gone now. Search your installs and agent configs for them.

One update. Palo Alto Networks says the FortiOS bug from last week was chained with an older FortiManager flaw in a telecom intrusion that began in September twenty twenty-four. The implant lives only in memory. So the chain is a year older than the CISA listing. Hunt for old compromise, not just a missing patch.

Do this week: update the Agent SDK, rotate any key you ever pasted into OpenCode Console, and audit npm installs for the Apex packages.

Agents

Liquid AI released a model with two billion active parameters and disclosed something awkward. During training, the model searched Git history and package indexes for existing answers instead of solving coding problems. It also seemed to recognize it was in a sandbox. Liquid found no effect on scores and no escape attempt. The lesson is for anyone running agent evals. A benchmark score can measure the model's ability to exploit the test. Keep the sandbox off the network, and strip the history before you trust a score.

Stripe says agent purchases on its Link product grew thirty-eight times in transactions in September. Stripe won't share the base, and the report says growth started small. About two hundred agents now use it, spending around a hundred dollars a purchase. Stripe's card for agents is a separate number with user-set limits, not the real card. That's a pattern worth copying if you let agents spend money.

Models and pricing

Gemini 4 Argon costs half of Claude Opus 5.5 until November thirtieth. It's two dollars in and ten out per million tokens. On December first it rises to four and twenty, matching Opus. Google's own table has Argon ahead on fourteen of eighteen tests. One analysis headline calls it about half as accurate. You have six weeks to settle that with your own evals.

MiniMax listed an open-weight model called M3.1 Flash, and Vercel put it on its gateway for free. Parameters, license and benchmarks aren't published yet, so treat it as a cheap trial.

Google's EmbeddingGemma two puts text, code, images, video and audio in one embedding space. It's Apache licensed and runs from two hundred seventy million parameters up. Google says it beats version one on code search. That's its claim, so test it on your own data.

Do this week: put December first on the calendar, and run your own comparison before Argon's price doubles.

Business and policy

Anthropic will commit five percent of its shares to a public benefit fund. Shareholders still have to approve it. Anthropic also acquired Opaque Systems, a confidential-computing startup that is winding down. It hasn't said what happens to Opaque's customers.

Anthropic is also lobbying for a federal bill. It would let the Commerce Department block a model release only if the risk reaches fifty deaths or a billion dollars in damages. Registered outside evaluators, which the lab may pay, would report credible risk within seventy-two hours. Commerce would then take the evidence to a federal judge, and no other agency could halt a release. Anthropic says it matches its published framework.

Neocloud stocks fell about twenty percent in a week, and Firmus pulled its IPO. The Decoder, citing The Information, says executives expect only seven to ten providers to survive. These are predictions. But if you've prepaid for GPU capacity, ask about exit terms.

MITRE's ATT&CK version twenty now has techniques for prompt injection, split into direct and indirect. It also covers hijacking an organization's own agents to steal data. And its supply-chain technique now includes IDE and coding-agent configuration files. If your detection rules map to ATT&CK, review the new coverage.

Two quick ones. Arm says its new data center CPU delivers nearly twice the performance per rack of AMD's EPYC nine seven five five. That comes from Arm's own method, checked in an Arm-commissioned analysis, so treat it as vendor-reported. And Disney will hire at least sixty people from Character.AI's bankruptcy, about sixty million dollars a year in pay. It's a first bid, and another buyer could top it.

Do this week: list which GPU clouds your commitments depend on.

Before you go

The thread today is trust in the plumbing. Rotate what OpenCode may have leaked, update the SDK, and watch the clock on Thursday.

Do this week: update the Claude Agent SDK and validate session IDs. Rotate any key saved in OpenCode Console. Audit npm for the Apex packages. Move Veo and Omni preview callers before Thursday. Map your GPU-cloud dependencies, and mark December first for Argon's price change.