Attackers now run AI agents inside victim networks, so model vendors' refusal rules are becoming a security control.

Today's headline

Attackers are now putting AI agents to work inside victim networks. That makes the refusal rules at the model vendors part of your security picture. A ransomware crew gave its agents VPN logins and let them hunt for domain admin. An infostealer switches models when one says no. And Anthropic is tightening what Claude Code will do on its newest model.

On the clock

Two dates this week. On Wednesday, Apple starts a developer beta of Apple Intelligence in mainland China, running on Alibaba's Qwen. If your app calls system AI features for users in China, test it against that beta. Apple says the wider release comes with iOS twenty-seven point three in December, so users in China will talk to a different model than everyone else.

The Brotli patch deadline for federal agencies is November tenth. Confirm every runtime and proxy that bundles that decoder, including the copies buried in dependencies.

Security

First, GitLab. Over a thousand self-managed servers are still unpatched against a maximum-severity code execution flaw. It is exploited in the wild, and it is on the federal must-patch list. The fixes shipped three weeks ago, in versions nineteen point four point two, nineteen point three point five and nineteen point two point eight. Alpine Linux was probed on October twentieth. It could not rule out a compromise, so it rebuilt its whole GitLab server. Alpine had installed a build that was not the patched one, and its logs were incomplete. That is the lesson. Check your version today, and rebuild if you cannot trust your logs.

Next, Langflow, the open-source tool for building agent workflows. Two critical flaws let someone with no account bypass login or run code. Every release up to one point twelve point eight is affected. A public Metasploit module already covers the login bypass. One of the paths to code execution runs through the tool listing that Langflow offers over MCP. Version one point thirteen also turns automatic login off by default, and that setting matters. It is not on the federal exploited list yet. The only fix is version one point thirteen. IBM offers no workaround, so upgrade, or take the server off the internet.

Now the attackers' tooling. Sophos recovered traces from Cursor showing the Aur0ra ransomware crew handing agents VPN logins and targets. The agents mapped Active Directory and, in some networks, reached domain admin. Humans still did the break-in and the ransomware step. The operators told the agents they were red teamers to get past guardrails. Kaspersky saw a separate open-source framework take education-sector victims from first look to full domain compromise. There is no CVE here, so scanners will be silent. Watch for agent tooling on hosts where it does not belong.

And a new infostealer called VOLTA, from Cisco Talos. It bundles a victim's stolen data and asks an AI model to rank it by value. It defaults to Claude, then falls back to Kimi and Gemini when a reply sounds like a refusal. Unexpected traffic from workstations to AI gateways is a useful signal. The stolen data includes browser sessions, Slack workspaces and cloud keys, so a hit means rotating more than passwords.

Agents

Anthropic confirmed it added two sentences to Claude Code's prompt on Opus five point five. They steer it away from recreating a specific existing game. Users also report refusals on reverse-engineering work starting October thirty-first. Anthropic has not confirmed that second rule. One user kept working by switching to the older Opus four point eight. If your team does compatibility or security analysis with Claude Code, test those workflows this week.

Meituan released LongCat two point five. It has one point six trillion parameters, with about forty-eight billion active per token. Meituan says it is built for long agentic coding tasks and runs four-bit inference on Chinese chips. The report gave no benchmark numbers.

Models and pricing

Google Cloud spend caps are now generally available. Caps on AI services trigger within minutes, and an API lets you attach one to every new sandbox project. Provisioned Throughput is never halted by a cap. Pay-as-you-go and committed-use requests stop at the limit, and caps now reset automatically each month. Put caps on your sandbox and agent projects this week.

Business and policy

Marvell agreed to buy the laser maker Lumentum in an all-stock deal that values Lumentum at one hundred fifteen billion dollars. The Information reports it as one of the largest chip mergers ever. Treat the terms as reported.

Saudi Aramco is taking forty-nine percent of Humain for about two point six billion dollars. Humain plans three gigawatts of data center capacity by 2030.

OpenAI signed deals in Abu Dhabi while it seeks twenty billion dollars, co-led by investors from the UAE. Sam Altman also met Samsung executives in Korea. Tom's Hardware frames that trip as a hunt for memory supply.

South Korea set aside four point seven trillion won for a sovereign AI model. The government says it will have the world's highest performance. That is a target, not a result.

OpenAI is planning a lobbying push after Tuesday's midterms. It wants binding safety rules for frontier models, which it calls speed limits, and it wants data centers renamed AI compute campuses.

Meta reportedly built a five-foot humanoid prototype with China's Fourier. There is no launch date.

Amazon's Andy Jassy told analysts he expects six to eight frontier models that are about as good as each other within two to three years. That is a seller's forecast. It still argues for a routing layer over a single-vendor build.

Two production notes. A Brazilian court fined two lawyers about sixteen thousand dollars for hiding a prompt injection in white text. Strip hidden text from documents before a model reads them. And Reddit will become a logged-in service to fight scrapers, so plan for licensed access.

Action items

Check every GitLab server for the patched versions today. Upgrade Langflow to one point thirteen. Add spend caps to your Google Cloud sandbox projects. Test your Claude Code reverse-engineering workflows on Opus five point five. Strip hidden text from third-party documents before any model review.

Before you go

Start with GitLab. The flaw is maximum severity, attackers are using it, and the fix has been out three weeks. If your server was exposed and unpatched, treat it as suspect. After that, Langflow is a one-command upgrade, and the rest can wait for the afternoon.