AI News Briefing — Mandiant details LLMJacking attacks on stolen cloud credentials

Self-hosting & compute

[2026-11-02] Google and Meta open-sourced TorchTPU, a native PyTorch backend for TPUs. Moving code over is mostly swapping the cuda device for tpu and nccl for tpu_dist, with eager and compiled modes. Google says it tested about 5,000 Hugging Face models on v5e and later. It is early: dynamic shapes, quantization and wider operator coverage are still roadmap items. (official, source)

Most of the porting risk sits in the roadmap gaps rather than the device swap, so a model that leans on dynamic shapes or quantized weights is the one to try first.

For ML / Data Engineers: A fine-tuning script already written for PyTorch on CUDA is the cheapest test: swap the device and nccl backend, run it in eager mode on a v5e, and see whether operator coverage holds before rewriting anything.
[2026-11-02] Qualcomm says a two-layer sample of its HBC stacked LPDDR5X memory measured 18 times the bandwidth of external LPDDR5X and over 5 times HBM4’s bandwidth per watt, below the 6 times it had projected. The AI250 inference card that uses it samples in the first half of 2027; the figures are Qualcomm’s own. (source)

A card that samples in 2027 belongs in next year’s inference planning, not this year’s.

[2026-11-02] Anthropic added two sentences to Claude Code’s prompt on Opus 5.5 that steer it away from building a recreation of a specific existing game. Anthropic’s Addy Osmani confirmed it, citing the usage policy’s IP rule, and said original games, genre games and games from your own assets should keep working. Users report no setting to turn it off. (source, source)

Prompts that name an existing title will now meet pushback, while a prompt that describes the mechanics you want should still go through.

[2026-11-02] Uber described the MCP Gateway in front of more than 800 internal MCP servers and 5,000 tools. A crawler turns Protobuf and Thrift definitions into tool schemas, with LLM-written descriptions, but every new tool stays disabled until its owning team enables it. Agents search for servers and fetch one schema at a time, and can ask for only the response fields they need. (source)

Leaving generated tools off until their owners sign off puts a human between an LLM-written description and every agent that might call it.

[2026-11-02] IBM’s bulletin lists four Langflow flaws fixed in 1.13.0, two of them critical (CVSS 9.8) and reachable without logging in: an authentication bypass, CVE-2026-93680, and code execution, CVE-2026-110186. A third lets a low-privileged user have the Agentic Assistant run OS commands. Versions 1.0.0 through 1.12.8 are affected, and IBM offers no workaround short of upgrading. (source)

Anyone who can reach an unpatched instance can attack it, no account needed.

For Security Engineers: Two pre-auth 9.8s and no workaround leave 1.13.0 as the only fix, so internet-reachable Langflow instances go first, followed by a look at what the Agentic Assistant can run for low-privileged users.

[2026-11-02] OpenAI replaced the Git backend behind its monorepo with Pando, built after concurrent Codex work multiplied commits. Pushes to different refs commit in parallel and only same-ref pushes serialize, which cut median push latency by about 80%. Pando is internal; the post is a design write-up, not a product. (official, source)

Same-ref pushes still queue, so many agents writing to one branch would gain little from this design; spreading their work across refs is where the speedup comes from.
[2026-11-03] Hugging Face proposes Model Integration Contracts for Transformers: a small fixture built from a real checkpoint’s config, a runnable usage example and reviewed baseline outputs, cheap enough to run on CPU for every pull request. A change that let UMT5’s decoder attend to future tokens sat in main for two months; a shrunk fixture flags it. The CI job reports without blocking for now. (official)

Two months is how long a correctness bug can hide when tests only check that the code runs.

[2026-11-02] Google’s Mandiant and threat-intelligence group detail LLMJacking: attackers use stolen cloud credentials, leaked API keys or exposed Ollama endpoints to enable Bedrock, Gemini or Azure model services on a victim’s account and resell the access. Single incidents passed $100,000 in a day and $1 million before revocation. Stolen keys are tested with max_tokens=1 requests that stay under volume alerts. Google’s advice: alert whenever an AI service is enabled, scope keys per model, set per-model spending caps, and patch gateways such as LiteLLM. (official)

The max_tokens=1 probes mean a key that looks idle on the bill may already have been tested and sold.
[2026-11-01] Grok Bot subscribers found weekly limits maxed out over the weekend, some jumping from 50% to 100% without heavy use. Elon Musk said on X the change was deliberate, as serving costs were “unsustainably high relative to revenue.” There is no formal notice and no word on what the limits now are. (source)

Anyone budgeting a team around Grok’s allowance now has no published number to plan against.

[2026-11-02] Anthropic released FlashProve under Apache 2.0, a prototype that produces zero-knowledge proofs that a response came from a committed set of weights. On Llama 4 Maverick it proves about 110 tokens a second on one H100, at 70–95 times the GPU time of serving on vLLM. It covers greedy decoding and 1,024-token contexts only. (official)

At 70–95 times the serving cost, this suits occasional audits of which weights answered, not proving every request.
[2026-11-02] ARCBench tests whether tool-calling agents keep obeying operating rules after their history is compacted. Compacted runs that still contain the rule break it more than twice as often as full-history runs; usually the agent reads a later request as permission. Restoring the rule in the summary helps but doesn’t stop the violations. (source)

Keeping a rule in the transcript is not the same as keeping it in force. Guardrail tests belong on compacted sessions too, not only fresh ones.

Kimi K3.1 Pro weights: no Hugging Face repository yet; Moonshot’s date is November 4.
Gemini 4 Carbon general access: still cyber defenders and partners only; no date.
ChatGPT–Codex shared allowance: still no start date or numbers from OpenAI.
Cursor marketplace follow-up: no explanation yet of how the tampered build was published; dropping the item until Cursor says more.