AI News Briefing — MiniMax M3.1 Flash prices agent work at $0.60 output

Model releases

• [2026-10-19] MiniMax released M3.1 Flash through its API at $0.15 input and $0.60 output per million tokens, with cached input at $0.015 and a 1M-token context. MiniMax puts agentic task cost 70% below its predecessor and reports 73.7% on DeepSWE v1.1, close to Claude Opus 5’s 74%. Artificial Analysis scores it 43 on its Intelligence Index but measured 105 tokens per second, about half MiniMax’s claimed 200. On AA-Omniscience it answered 56% correctly, yet 93% of its non-correct answers were wrong rather than declined. Weights are due October 23. (source, source, source)

  A model that guesses rather than abstains pushes cost into review, so the cheaper token can still come out as a dearer task.

• [2026-10-19] OpenAI published two evaluations for legacy languages. On MultiLangBench, where models build a SQLite-compatible engine in 20 languages, GPT-6 Astra averaged 87.4% against GPT-5.6 Sol’s 26.8%, with COBOL at 72.1%. On COBOL migration with hidden behavior tests, GPT-6.1 Sol passed 86.6% at low reasoning effort. Both test suites are OpenAI’s own. (official)

  Both suites were written by the company selling the model. A handful of a team’s own COBOL programs, with outputs already known, would say more.

• [2026-10-19] Inception’s Mercury 3, a diffusion model that writes tokens in parallel, runs at about 1,000 tokens per second with a 1M-token context, up from 260K. It is API-only, through Inception, OpenRouter, Baseten and Vercel, with no open weights. (source)

  At 1,000 tokens per second, waiting on the model stops being the slow step in an edit-and-test loop; the tests become it.

Coding agents

• [2026-10-19] OpenCode says Anthropic and Google blocked the keys they believed were exposed in its Console breach, and that OpenAI is refunding credits spent in the attack. Refunds for other unauthorized charges are under way, and OpenCode calls the incident ongoing. During 48 hours of attempts it ran defensive agents, which commercial models stopped helping once the malicious code tripped safety filters, until OpenAI admitted it to its Daybreak Blue program. (source)

  Defenders hit the same safety filters as the attackers: a model that refuses to touch malicious code also refuses to help take it apart.

MCP

• [2026-10-19] Google Cloud published a build guide for MCP Apps (SEP-1865) in Gemini Enterprise: a tool returns a sandboxed HTML widget that renders in chat, and edits inside it need no extra model turn. The server runs on Cloud Run behind two separate checks, IAM for which service may call and OAuth for which user is calling. Tools stay disabled until an admin enables actions. (official)

  Edits that skip the model turn also skip its token bill, which adds up on forms and tables a user adjusts over and over.

Agent frameworks & interop

• [2026-10-19] Microsoft’s security team laid out agent controls built on Project Perception. The Microsoft Execution Container sandboxes an agent with its enforcement boundary outside the agent, so a compromised agent cannot switch off its own monitoring. Dynamic Permissions start an agent with no authority and scope grants to a task. Defender now detects 60 local agents, Claude Code, Codex and Copilot among them. The post gives no availability dates. (official, source)

  Defender’s detection is the part already live, so security teams may see Claude Code and Codex on developer machines flagged before any policy about them exists.

• [2026-10-19] Amazon Bedrock now enforces JSON schemas for every Claude model through constrained decoding, in InvokeModel and as strict tool use in the Messages API. Every object needs additionalProperties: false, and numeric ranges, string lengths and recursive schemas are not enforced, so those still need validation in your code. The first call with a new schema waits while its grammar compiles. (official)

  Expect a slow first request after every schema change, which can trip deploy-time smoke tests with tight timeouts.

  For Software Developers: A tool schema that leaned on minimum, maxLength or a recursive tree will be accepted but not enforced, so those checks move to a validator after the call, and every nested object needs additionalProperties: false before strict mode takes it.

• [2026-10-19] The browser automation tool in Microsoft Foundry is generally available. It runs agents in isolated cloud browsers provisioned through Playwright Workspaces, can require approval before state-changing steps, and offers a live view where a person can take control. (official)

  A page the agent reads can carry instructions of its own, so approval before a form submission is what keeps a poisoned page from acting.

• [2026-10-19] Reuters reports a Chinese-speaking attacker pointed agents built on the open-source Cairn framework at more than 1,200 sites and breached over 100, including web properties of John Deere, SharkNinja and Cummins. NorForge researcher Snorre Fagerland, who found the operation through exposed Cairn control panels, estimates about $50 in tokens per intrusion, without usage data to confirm it. (source, source)

  Should Fagerland’s estimate hold, the hundred-plus breaches came to roughly $5,000 in tokens, which puts a campaign this size within one person’s budget.

AI-assisted SDLC

• [2026-10-19] GitHub made its Copilot model policy REST API generally available, with GET and PATCH endpoints for enterprises, enterprise teams, enterprise apps and organizations. Allowed models can now be set from a script instead of the settings page, which matters on days like this one, when six models left Copilot. (official, official)

  Model removals no longer need someone clicking through each organization’s settings on the day they land.

  For Platform / DevOps Engineers: Allowed models per organization can live in a version-controlled file that a CI job applies through the PATCH endpoint, so the next deprecation becomes a one-line change reviewed like any other.

Practice & craft

• [2026-10-19] Meta’s engineers describe replacing one knowledge-heavy agent, which hallucinated once its context grew, with a 1,300-line orchestrator and 14 specialist subagents. The orchestrator routes more than 20 workflows through a fixed seven-step protocol and uses an LLM only for the delegation step. Preparing a new data column fell from about a day to under an hour, and about two-thirds of changes land without major human edits. (official)

  Using the model only to pick a specialist leaves the other six steps testable as ordinary code.

• [2026-10-19] AWS contributed bi-directional KV transfer to vLLM for disaggregated serving: on later turns of a conversation, the prefill node reads the KV cache the decode node already holds instead of recomputing it. At long prompts, time to first token fell about 1.6x on Qwen3-32B and 3.3x on GLM-5-FP8. It needs vLLM v0.21.0 or later with the NIXL connector and a cache-aware router. (official)

  Agent sessions resend a growing history every turn, which is exactly where recomputing prefill hurts most.

  For ML / Data Engineers: Replay a recorded agent session and compare time to first token on its tenth turn with the NIXL connector off and on; turn one will show nothing, since the gain comes from cache the decode node already holds.

Research worth reading

• [2026-10-19] From Finding to Fixing ran six fault-localization methods through agentic repair on SWE-bench Verified and Defects4J, 16,248 trajectories in all. Better localization did not reliably raise fix rates. Exact locations cut tokens by up to 39.2%, but current methods often spend more than they save, and a description of the bug’s cause helped more than locations. (paper)

  Issue templates that ask for the suspected cause, not just the failing file, line up with this result.

• [2026-10-19] When the harness decides success finds that truncating an agent’s context costs nothing when the lost fact can be looked up again and drops the agent to chance when it cannot, a 92.5-point gap. On ARC-AGI-3, summarizing old turns while still inviting note-taking recovered 86% of a 63-point loss. (paper)

  Dropping a file the agent can reread is safe. Dropping a decision it made forty turns ago is not.

• [2026-10-19] Same Simulation, Different Evidence shows that moving a long tool report behind a section index cost GPT-5.1 and GPT-5.2 11.3 and 7.9 points, while Claude Opus 4.6 and Sonnet 4.6 lost nothing measurable. The GPT models answered from their own output files and misrounded. Naming which output is authoritative recovered 6.3 to 7.9 points. (paper)

  Same report, different models, different answers. Swapping models in a pipeline that reads long tool output needs its own regression run.

Watch list

• MiniMax M3.1 Flash weights: due October 23; no license named yet.

  Until a license is named, whether the weights can be used commercially stays open.

• Nemotron 3.5 Bolt E4B: due October 23.

• Mistral Large 4 weights: preview only; promised by the end of October.

• DeepSeek Search & Fetch billing: free harness calls end October 31.