AI News Briefing — Northflank breach leads to abuse of AI API keys

Model releases

[2026-10-31] Microsoft released Mage-VL-Cowork, a 4B computer-use model under Apache 2.0 that drives a GUI from screenshots and also runs a persistent bash and Python shell in the same policy, with no outside orchestrator. Its own card reports 66.0% on OSWorld-Verified within 50 steps; nobody has reproduced that yet. The bf16 weights are about 9.5 GB, and serving needs trust_remote_code. (official)

One 4B policy that both clicks and runs shell commands removes the hand-off layer most computer-use setups wrap around a model.

For ML / Data Engineers: At about 9.5 GB in bf16, the model is small enough to rerun the card’s 50-step OSWorld-Verified setup in-house before anyone trusts the 66.0%, once someone has read the custom code that trust_remote_code will execute.

[2026-10-31] NVIDIA’s shipping Rubin runs below its preliminary spec. Per-GPU HBM4 bandwidth falls from 22 to 19.2 TB/s and NVLink from 3.6 to 3.0 TB/s, while capacity stays 288 GB and FP4 stays 50 PFLOPS. HGX Rubin NVL8 boards drop from 2.3 to 2.0 TB of memory and from 176 to 130 TB/s, which ServeTheHome attributes to seven of eight HBM4 stacks. Sizing done on the old sheet is optimistic for decode-heavy serving. (source)

Capacity and FP4 compute held, so which models fit on a board is unchanged. What falls is how fast each one generates tokens.

For Solution Architects: Capacity plans that quoted tokens per second from the 22 TB/s figure need redoing against 19.2 TB/s before a Rubin order is locked in.

[2026-10-30] SenseTime released SenseNova-Loop-9B-Preview under Apache 2.0. It runs layers 4–27 twice with shared weights, so each token gets 56 layer computations from 32 layers of parameters. The technical report is still to come, and vLLM and SGLang support needs specific pull-request builds. (official)

Weight sharing saves memory, not compute: each token still pays for 56 layer passes, so serving cost tracks a deeper model than the parameter count suggests.

[2026-10-31] DeepSeek’s Harness team published dsh-superagent-prototype under MIT: a coding agent that watches one GitHub repository, and optionally Feishu, takes requests from allowed users, works each in its own session and directory, and replies with a pull request. DeepSeek calls it a research prototype, not a product, and says the code differs from its internal version. (official)

A separate session and directory per request is the isolation pattern worth borrowing, and the allowed-users list is then the only gate on who can start work in the repo.
[2026-10-30] Microsoft’s analysis of the trojanized Claude Code extension in Cursor’s marketplace names the persistence to hunt: a com.apple.sysmond.plist LaunchAgent on macOS, an @reboot crontab entry for ~/.config/.smt on Linux, and a SysMon scheduled task on Windows. The names imitate monitoring tools, so check what each one runs. Uninstalling the extension removes none of them. (official)

These names cover the restart path. A host cleaned of the SSH key alone can still bring the backdoor back on its next reboot.

[2026-10-30] Amazon Bedrock AgentCore Runtime adds session endpoints: an authenticated URL for an app running inside an agent’s session, so you can watch a site change while a coding agent edits it. Ports between 8000 and 12000 are allowed per runtime. Each request needs SigV4 or a bearer token, and the URL expires with the session. MicroVM runtimes only, and no PrivateLink. (official)

Checking an agent’s UI work used to mean pulling its branch and running it locally; now the preview sits where the agent runs.

For Software Developers: A front-end agent editing a dashboard can serve it on port 8080 inside its session while the reviewer opens the session URL with a bearer token and watches each change land, until the session ends.

[2026-10-30] App-hosting platform Northflank told customers to assume every environment variable was decrypted and to rotate all keys, after Wiz alerted it to a breach. Customers have since reported unauthorized use of the AI API keys stored there. Wiz counts at least nine breaches of AI developer platforms in October, Railway, OpenCode and Warp among them, many aimed at AI credentials. In two cases it investigated, stolen keys made about 2.5 million Bedrock calls costing roughly $100,000. Northflank has not said how attackers got in. (source)

A provider key kept in a hosting platform’s secret store is only as safe as that platform. Per-key spend alerts at the provider catch this kind of theft sooner than the monthly invoice does.

[2026-10-31] Parameter Labs showed that a shared ChatGPT link could run attacker code inside a signed-in victim’s session. It listed their chats, opened a private one and sent part of it out. A math library’s keyboard listener in the main page accepted raw HTML from any frame, so a sandboxed preview could create an unsandboxed one. A YouTube script, which the content security policy allowed, did the rest. OpenAI fixed it by October 26. (source, source)

The sandbox itself held. The hole was a postMessage handler that never checked which frame was sending, which is worth looking for in any app that renders model-written HTML.
[2026-10-30] OpenAI, Google, Microsoft and Anthropic say they will honor one robots.txt group, User-Agent: __usage_ai-training with Disallow: /, as a site’s opt-out from AI training. It is an IETF draft, not a standard, and User-agent: * does not count as the signal. Anthropic is already implementing it, Microsoft enforces it from February 1, 2027, and Google plans support in 2027. (source)

Training opt-out becomes its own switch, separate from rules for named crawlers, so a site can stay indexed while declining training.

[2026-10-29] Tool output can pass as the user. A study of role spoofing finds models decide who said what from both content, such as writing style, and structure, such as control tokens and formatting. Text that fakes both is hard to resist. In a toy setting, training against content-based injection left structure-based attacks working. Linear probes that predict each span’s role detected spoofing across the settings tested. (paper)

Hardening against one kind of spoof didn’t carry over to the other. A defence tested only on injected instructions in plain prose hasn’t been tested on forged formatting.
[2026-10-29] Prefix executability scores a tool-using agent on whether each step of its call sequence was valid against tool schemas and state, not only on whether the task finished. On BFCL-v3, ToolSandbox and τ³-bench, agents that executed an unchecked plan often scored higher final success while making more invalid calls. Checking the plan before execution reduced invalid calls without hurting final success. (paper)

A leaderboard that reports task success alone can rank an agent higher for reaching the answer through invalid calls, which in production are failed requests or unwanted side effects.

Kimi K3.1 Pro weights: still not published; Moonshot promised them by November 4.
Gemini 4 Carbon general access: still cyber defenders and Fairwind partners only; no date.
Cursor marketplace follow-up: Cursor’s notice, updated October 30 with new IOCs, still doesn’t say how the build was published.
DeepSeek Search & Fetch billing: the free-call period was due to end October 31; dropping the item.