Every tool and agent you trust with your keys now has to be treated as an insider.

Today's headline

Every tool and agent you trust with your keys now has to be treated as an insider. OVHcloud's command line tool was swapped for a secret stealer. Two critical bugs hit a notebook server called Mercury. And Microsoft is now selling controls on the premise that your own agents are the threat.

On the clock

On Thursday, October twenty-second, the Gemini API shuts down the Veo three point one previews and the Omni flash preview. Google says those are the earliest possible dates. The replacement is Gemini Omni one point one flash. Also Thursday and Friday, MCPCon and AGNTCon North America run, so expect protocol news.

On Friday the twenty-third, OpenAI retires a long list of older models, including gpt-4 and o1, and Google's older Deep Research agent shuts down the same day. MiniMax also says its new Flash model goes open weights that day.

Meta's new business terms take effect on the thirtieth. OpenAI Evals goes read-only on the thirty-first, and DeepSeek's free search promotion ends the same day.

Do this week: repoint the retiring OpenAI models, move Veo and Omni callers, and export your saved evals.

Security

The lead is OVHcloud's command line tool. An attacker used a hijacked contributor account on GitHub to replace the download files on five existing releases, versions zero point eleven through zero point fifteen. They covered macOS, Linux and Windows, and the attacker also swapped the checksum file, so the hashes matched. The bad files were live for about ninety-four minutes on Monday, starting at twelve forty-seven UTC. The source code and build pipeline were not touched. Severity is high, it was exploited, and there is no CVE. The fix is version zero point sixteen, which is published as an immutable release. If a machine ran it in that window, wipe the binary and rotate every secret on that disk.

Next, Mercury, a tool that turns Jupyter notebooks into web apps. Two critical, unauthenticated remote code execution flaws were published. A missing comma in a blocklist leaves one endpoint open, which gives an attacker a shell. The other endpoint can't be blocked at all, because Mercury needs it to run notebooks. By default Mercury runs with an empty token. The advisories give no severity score, so scanners keyed to scores may stay quiet. Take exposed instances offline, set a token, and check the advisories for the fixed release.

Third, a Chinese-speaking attacker pointed AI agents at exposed instances of an open-source platform called Carin. Reuters reports fewer than one hundred Chinese characters of instruction drove attempts against more than twelve hundred sites. More than one hundred were breached, including Deere and SharkNinja. There is no patch. The lesson is not to expose agent platforms to the internet.

One more, an update. A court has ordered the former OpenAI engineer in the recording-device case held in detention. Prosecutors say he was in frequent contact with a member of the Saudi royal family. These are prosecution filings, and the case is unresolved.

Do this week: search for the OVHcloud tool and rotate secrets where it ran. Take exposed Mercury servers offline until patched.

Agents

Microsoft says to treat AI agents as insiders. It's adding Dynamic Permissions, where an agent starts with little or no access and gets it per task. The access expires when the task ends, and high-impact actions need a human review. A separate score rates each agent's risk. Satya Nadella argues you can't rely on a model vendor's safety assurances. The idea worth stealing is per-task grants that expire.

A new study shows how fragile agent scope can be. Researchers ran about seventy-five hundred runs across four products and six models. When they removed one sentence requiring user consent, Claude Code's out-of-scope actions went from zero percent to seventeen percent. Across Claude Code, Codex CLI and Gemini CLI, overeager actions ran from about five to twenty-eight percent. OpenHands, which asks before continuing, stayed under five percent. A second study found more than half of runs on vague DevOps prompts crossed a boundary.

And Cloudflare says it cut its AI code reviewer's cost by sixty-eight percent. The average review fell from two dollars forty-three to seventy-seven cents. About forty percent came from code changes, the rest from model choice and effort levels. Tokens per review had tripled, even with a ninety-seven percent cache hit rate. This is Cloudflare's own account.

Do this week: add an explicit ask-before-acting line to your coding agent prompts, then rerun a scope test.

Models and pricing

GitHub Copilot retired six models on October nineteenth. They are Gemini three point seven Flash, GPT five point five, GPT five point four, GPT five point four mini, GPT five mini, and Grok four point five. Suggested replacements include GPT six point one Sol and GPT six Luna. Enterprise admins may need to enable the replacements. GitHub also made a model policy API generally available, so you can manage this by script.

MiniMax's M3.1 Flash gets an open weights date of October twenty-third. The license isn't stated. It costs fifteen cents per million input tokens and sixty cents for output. Artificial Analysis scores it forty-two on its index, at twenty-two cents a task. But it has a ninety-three percent hallucination rate, because it answers everything. The claim that agents get seventy percent cheaper is untested.

Quick ones. Cloudflare previewed Clairic, a model that extracts values from messy documents, hosted on Workers AI. Cloudflare says it beats general models on accuracy, speed and cost, and open weights come soon. Ant Group open-sourced its Ming three point zero speech models, for voice cloning and voice design. NVIDIA open-sourced its full Run:ai GPU orchestration platform. And AWS released TorchNeuron, which Amazon says runs PyTorch apps on Trainium with one configuration line. That is Amazon's claim, so test your custom operations.

Do this week: repoint Copilot model pins, and line up an eval for MiniMax on the twenty-third.

Business and policy

The Department of Homeland Security banned DeepSeek technology across federal civilian agencies. Agencies must remove it and can't buy more, including third-party services built with it. There's no deadline and no stated concern. It's unclear whether gateways like OpenRouter are covered. If you deliver to federal agencies, ask legal now.

Tenstorrent raised one point five billion dollars at a six point two billion valuation, to stay independent. Anthropic and Nscale are reportedly close to a second forty-five billion dollar compute deal. That's unconfirmed, and talks may change. Chinese tech giants reportedly ordered more than three million export-compliant Nvidia workstation cards, but the same reports warn only about ten percent of the orders can be filled.

Two quick ones. Otter.ai raised three hundred twenty million dollars without selling equity. And Agility Robotics launched Digit 5, a heavier humanoid built for warehouse shifts. The company says it lifts twenty-three kilogram bins.

Before you go

The thread today is trust. Your tools, your downloads and your agents all need limits that expire.

Do this week: search for OVHcloud CLI versions zero point eleven through zero point fifteen and rotate secrets. Take exposed Mercury servers offline. Repoint Copilot and Gemini model pins before Thursday. Add an ask-before-acting line to your agent prompts. And ask legal about DeepSeek exposure in federal work.