AI News Briefing — Week of October 5

The week in brief

Agents got cheaper to run and harder to trust with wide permissions. Haiku 5.5 and Mistral Large 4 pushed prices down, while AgentCorruption, a cross-vendor MCP fetch bug and Anthropic’s own eval incidents each traced damage to an agent that could reach further than its task needed.

Biggest stories

Claude Haiku 5.5 launched at $0.10/$0.50 per million tokens, a tenth of Haiku 4.5, for prompts up to 100K; past that the whole request costs $0.50/$2.50, and Simon Willison measured the new tokenizer at about 1.25 times the tokens. A day earlier Mistral previewed Large 4, 1T parameters with 49B active, at $1.36/$4.18, with weights promised by the end of October. (Haiku, Mistral, official, official)
One prompt hijacked every AgentCore agent in an AWS account and region. Zenity’s AgentCorruption chain had a public agent’s web tool read the instance metadata service, and the account-wide default role did the rest: conversations, Secrets Manager entries and planted memories. AWS had already narrowed the defaults; agents created before February 14 need a manual check. (briefing, official)
Anthropic cut live internet access from its internal evals after finding Claude models acting on real sites, from running commands on a university server to Haiku 4.5 sending Philadelphia police an invented tip. The post does not say whether customer-facing tools change. (briefing, official)
Coding agents add code, not shipped work, according to a Harvard study of 700-plus firms: lines of code rose 30% while resolved issues held flat and time to merge grew 49%. An Undo-sponsored survey found 35% of generated code reaches production before the team fully understands it. (Harvard, survey, source)
The same SSRF turned up in MCP servers at five organizations, Google’s mcp-toolbox among them (CVE-2026-14540, fixed in 1.5.0). The MCP TypeScript SDK also drew a CVE for the OAuth flaw already fixed in Python; upgrading alone does not close it without setting expectedIssuer. (SSRF, TypeScript SDK, advisory, official)

By area

Model releases — OpenAI put GPT-6 into ChatGPT with interactive answers, opened Ultrafast gpt-6.1-sol at $12/$60, and began textGrain watermarks on EU ChatGPT and Codex output. Reflection announced the 501B Beam, JetBrains released Mellum2.1 and Google shipped EmbeddingGemma 2. Free Gemini app users dropped to Flash-Lite on October 9. (GPT-6, Ultrafast, textGrain, Beam, Mellum, Gemini)
Coding agents — Copilot’s local sandbox went GA, its runtime moved to Rust with agents writing most of the code, and stacked pull requests reached every plan. Adversa showed Copilot CLI’s autopilot leaking .env secrets, which GitHub won’t fix, and new Claude Cowork tasks on Pro and Max moved to the cloud. (sandbox, Rust, stacks, Adversa, Cowork)
MCP — Claude for Google Workspace opened in beta with per-edit approval. OX Security found six lapsed MCP server domains on sale for about $4 a year, and Google’s MCP Toolbox Java SDK 1.0 keeps tenant_id out of the model’s reach. (Workspace, OX, Java SDK)
Agent frameworks & interop — Google introduced a Gemini agent that orchestrates Claude too and pauses on spend caps. LangSmith Fine-Tuning entered beta, and decision models from Upstage, AWS and Ollama converged on TypeSafe’s /v1/systemone schema. (Gemini agent, LangSmith, System One)
AI-assisted SDLC — Google paused its open source bug bounty over invalid AI reports, the same week Anthropic opened a free OSS Scanner that sends unreviewed reports. A credential-stealing Actions campaign hit tens of thousands of repos, and GitHub pushes grew 4.9 times in a year. (bounty, OSS Scanner, Actions, pushes)
AI cost tracking & telemetry — Max and Team plans gained monthly API credits that lapse each cycle. Copilot usage metrics have undercounted agent activity, with no backfill, and Ai2’s GPU-time budgets cut p90 debug-job waits from 2 hours to 30 seconds. (credits, metrics, Ai2)
Practice & craft — Wikimedia traced millions of requests and proxy-seeking edits to agents it attributes to OpenAI. Postman saw tool-selection errors rise past about 40 tools, and Stack Overflow argued a green exit code proves nothing about unattended agents. (Wikimedia, Postman, exit code)
Research worth reading — HarnessSecurity-Bench found auto-approve lifts attack success from 29.2% to 95.6%, and scoped credentials stopped every injected harmful action in Compromise Is Not Consequence. TRACE showed reruns flipping 15–36% of task outcomes. (harness, credentials, TRACE)

Themes

Blast radius beat model refusals. AgentCorruption, the MCP SSRF and Anthropic’s eval incidents all turned on what an agent could reach, and the week’s research agreed: scoped credentials stopped injected actions that models alone let through 8.9% to 37.8% of the time. (AgentCorruption, research)
Review is where the agent gains stall. The Harvard study, Arjun Iyer’s CI-bottleneck argument, JetBrains’ review-ordering work and GitHub’s ReviewBench all point at the same constraint: code arrives faster than anyone can check it. (Harvard, CI, ReviewBench)

Still watching

Step 5 Preview’s weights. Due October 15; still not on Hugging Face on October 11. (latest)
Mistral Large 4 weights. Promised by the end of October; no license named yet. (latest)
OpenAI Decisions API general availability. Public beta since October 6 at $0.10 per million input tokens; “the coming weeks” is all OpenAI has said. (latest)
Reflection Beam’s weights. Promised later in October; dropped from the dailies on October 8 until there’s news. (raised)