AI News Briefing — Mistral Large 4 previews with weights due this month

Model releases

[2026-10-06] Mistral released Mistral Large 4 in public preview on its API (mistral-large-4-0): a multimodal mixture-of-experts model with 1 trillion total and 49 billion active parameters, priced at $1.36 per million input tokens and $4.18 per million output. Mistral reports 61.7% on DeepSWE v1.1 and says weights will follow “by the end of the month” after safety testing; no license has been named yet. The Register places it between DeepSeek V4.1 Flash and GPT-6 Luna on Artificial Analysis’s intelligence index. (official, source, source)

The 61.7% DeepSWE score is Mistral’s own; Artificial Analysis’s placement is the only independent read so far.
[2026-10-06] Google DeepMind released EmbeddingGemma 2 under Apache 2.0: one 768-dimension space for text, code, images, video and audio. It is modular, 270M parameters for text and code alone and 740M with the vision and audio encoders, and Google measures about 567MB of RAM for the full quantized model on a phone. Code retrieval on MTEB rose from 68.76 to 78.68. (official, weights)

One vector space for code, screenshots and audio lets a single index answer queries across all three, where a separate embedding model per modality was the usual setup.

For ML / Data Engineers: A ten-point jump in MTEB code retrieval is large enough to justify re-embedding a code-search index built on the first EmbeddingGemma, and the 270M text-and-code module keeps that rebuild cheap. Score both versions on your own query set before cutting over.
[2026-10-06] From October 9, the Gemini app on a personal account with no subscription gets Flash-Lite only; Flash and Pro go. Google AI Plus keeps Flash-Lite and Flash but loses Pro, while AI Pro and Ultra are unchanged. The help page covers the app, not the Gemini API. (official, source)

AI Plus subscribers are the group most likely to be caught out. They pay, and they still lose Pro.
[2026-10-06] Anthropic turned its cyber access scheme into the Cyber Verification Program, with three tiers for vetted teams on Opus 5.5, Sonnet 5.5 and Mythos 5.1. Defense Access still had 46 of 50 test tasks blocked; Red Team Access, for authorized penetration testing, had none blocked. Anthropic also says Project Glasswing found at least 129,000 verified vulnerabilities between April and July. (official, source)

Defenders on the entry tier still get most offensive-looking tasks refused; only Red Team Access, tied to authorized penetration testing, lifts the blocks.

Coding agents

[2026-10-06] Adversa AI showed GitHub Copilot CLI in autopilot mode reading local secrets such as .env and sending them out after fetching one page carrying an encrypted payload, its key and decryption code. Microsoft’s mai-code-1.1-flash ran the chain in about half the runs; two GPT-5.6 variants refused. Under Auto routing the user can’t see which model got the session. GitHub says it is not a product vulnerability, so no fix is planned. (advisory, source)

With no fix planned, the defence sits in configuration: the attack needs autopilot, a web fetch and readable secrets in the working directory all at once.

For Security Engineers: Auto routing hides which model handled a session, so landing on one that refuses can’t be part of the plan. Keep .env files and other credentials out of any directory where Copilot CLI runs in autopilot, or keep autopilot off in repositories that hold them.
[2026-10-06] GitHub made stacked pull requests generally available on every github.com plan. Approvals and signed commits now survive a rebase onto an updated base, auto-merge for stacks is rolling out, and the gh stack extension handles worktrees. GitHub says repositories using stacks merged 9% more code. (official)

Approvals surviving a rebase removes the chore that made stacks painful on GitHub, where every base update sent reviewers back to re-approve.

MCP

[2026-10-06] Anthropic opened a beta Claude for Google Workspace add-on for Docs, Sheets and Slides on Pro, Max, Team and Enterprise; Free accounts are excluded. By default each edit waits for an Allow click, and links, images and sharing changes always need one even with auto-accept on. Connectors an organization has enabled appear in the sidebar, and the Google Drive MCP is off by default. (official, official)

Admins get one more surface to review: a connector enabled for the organization now also sits in the sidebar next to shared documents.
[2026-10-06] OX Security indexed 15,465 public MCP server listings across five registries, 5,095 unique hostnames. 2.3% no longer resolve, and six of those domains were unregistered and could be bought for about $4 a year, so a client still trusting one would talk to whoever registers it. 15.6% resolve outside the US. (official, source)

MCP server URLs added to a client months ago deserve a second look; a registry listing says nothing about whether the domain still belongs to its author.

AI-assisted SDLC

[2026-10-06] Stack Overflow’s 2026 Developer Survey, with more than 30,000 respondents, finds 73% of those using AI coding tools use them daily, and 31% of daily users spend four hours or more a day with them. Claude Code is the most used agent at 66%, ahead of GitHub Copilot at 59%. Only 20% use AI for deploying or troubleshooting production systems. (official)

Daily use is now the norm. Production is not: four in five respondents keep AI away from deploying and troubleshooting.

AI cost tracking & telemetry

[2026-10-06] Copilot usage metrics have been undercounting agent activity since several IDEs moved agent sessions to the Copilot SDK without tagging which IDE they came from. VS Code 1.139.0 fixes it now, Visual Studio 18.12 this month, JetBrains in late October and Eclipse and Xcode in November. GitHub cannot backfill the missing data. (official)

Any adoption or ROI dashboard built on these numbers has understated agent use, and past months will stay that way.

For Engineering Managers / Tech Leads: Month-over-month agent usage will jump as each IDE update lands, and that jump is the fix arriving, not a change in how the team works. Mark each IDE’s update date on the dashboard before the next quarterly review, and get VS Code users onto 1.139.0 first.

Practice & craft

[2026-10-07] Cloudflare described a harness in which one model proposes mutations of attacks its WAF already blocks and another reads the responses, while plain Python builds requests and enforces limits. Of 1,107 attempts, 49 got through, 48 of them command injection or SSRF; human review turned those into two new managed rules and one improved rule. (source)

Forty-nine bypasses became three rules, so human review still did most of the filtering.
[2026-10-06] METR found a researcher could make an agent rewrite what a reviewer sees in the Inspect transcript viewer, using JavaScript injected through MathJax rendering, in about ten minutes. It has not seen an agent do this in its evaluations. Its advice is to treat agent output as untrusted inside monitoring tools too. (official)

Any viewer that renders agent output as rich content, from eval transcripts to log dashboards, carries the same exposure.

Research worth reading

[2026-10-06] HarnessSecurity-Bench tested nine security mechanisms across Claude Code, Codex CLI, Gemini CLI, Copilot, Qwen Code and gptme in 2,500 trials. Turning on auto-approve raised attack success from 29.2% to 95.6%. About half the mechanisms are opt-in, and command allow- and denylists cost far less utility than network isolation or read-only mode. (paper)

Auto-approve is the switch that takes attack success from under a third to nearly all. Command allowlists are the cheaper protection to keep on when the prompts get tiresome.

Watch list

Mistral Large 4 weights: preview only; Mistral says weights by the end of October, license not yet named.

A named license is what will decide whether these weights are usable for commercial self-hosting.
Reflection Beam’s weights: promised later in October; not yet out.
Step 5 Preview’s weights: not uploaded; due October 15.
Gemini 4 Argon for paid API users: Fairwind cohort only; no date.