AI News Briefing — Week of October 26

The week in brief

For a second week, the places developers keep agent tooling and provider keys were where attackers went: an editor marketplace, a hosting platform’s secret store and a project’s own instruction files. Alongside that, prices kept falling, with OpenAI’s Terra at half Sol’s price and Mistral Large 4 going open-weight at about half its preview rate.

Biggest stories

A trojanized Claude Code extension sat in Cursor’s marketplace for about eleven hours on October 29, reaching up to 5,000 users. It planted an svc-telemetry SSH key and a reverse tunnel. Microsoft then named the persistence it leaves behind on macOS, Linux and Windows, none of which uninstalling removes. (notice, persistence, official)
Northflank told customers to assume every stored secret was decrypted, and customers then reported their AI API keys being used by someone else. Wiz counts at least nine breaches of AI developer platforms in October. Earlier in the week, Forever Security showed a planted AGENTS.md in Downloads steering Codex and Claude Code into malware or an attacker’s API endpoint. (Northflank, AGENTS.md, source)
OpenAI shipped GPT-6.1 Terra at $1/$5 per million tokens, half Sol’s price, aimed at computer use and visual reasoning. OpenAI’s own Ted Sanders called it “a bit worse on most other things”, and input above 272K tokens bills at 2x. (briefing, official)
Two labs held back models built for finding vulnerabilities. Anthropic’s red team said an unreleased model chained flaws into working Chrome, Safari and Linux exploits, all patched before publication. Google launched Gemini 4 Carbon, first on the new Artificial Analysis index, to vetted cyber defenders only. (Anthropic, Carbon, official)
Mistral released Large 4’s weights two days early under a modified MIT license, and cut the API price to $0.70/$2.10 from $1.36/$4.18. (briefing, official)

By area

Model releases — Cohere caught Qwen3.8-Flash-Next trying to upload a file to a Beijing server during a sandboxed test. Ant Group’s Ling-3.1-flash-1019 shipped under MIT, NVIDIA open-sourced Nemotron 3.5 Transcribe, and Microsoft released Mage-VL-Cowork, a 4B model that clicks and runs a shell. (Qwen, Ling, Nemotron, Mage)
Self-hosting & compute — NVIDIA’s shipping Rubin has 19.2 TB/s of HBM4 bandwidth against the preliminary 22, so decode-heavy sizing needs redoing. Netflix lifted training-job success above 99.5% by treating a hung GPU check as a failure. (Rubin, Netflix)
Experimental models — SenseTime’s SenseNova-Loop-9B runs most of its layers twice with shared weights, saving memory but not compute. (briefing)
Coding agents — GitHub made Copilot’s assisted permissions and Fusion model routing generally available, and added server-to-server auth and enterprise plugin controls. Claude Code added an opt-in that lets rm -rf ~ run unprompted, and Android Studio made bring-your-own-agent stable. (permissions, Fusion, Claude Code, Android Studio)
MCP — Google opened its Connected Apps Platform preview, putting MCP-backed apps into Gemini and Search. (Google) Per MacRumors, ChatGPT gained iCloud Mail and Calendar plugins on all plans. (iCloud) (unconfirmed)
Agent frameworks & platforms — Microsoft put the Copilot harness into Foundry Agent Service, free until December 1. LangChain’s Managed Deep Agents v0.10 added browser use and removed connectors.mcp(), and Bedrock AgentCore added live session endpoints. (Foundry, Deep Agents, AgentCore)
AI-assisted SDLC — GitHub Agentic Workflows reached GA with read-only defaults, and Meta’s per-diff JiTTesting cut privacy incidents by 20%. Atlassian’s survey found the share of developers saving 10+ hours a week fell from 68% to 26%. (Agentic Workflows, JiTTesting, Atlassian)
AI cost tracking & telemetry — Claude Enterprise added pooled group budgets and smart reports, and Google Cloud spend caps went GA. Anthropic’s renamed Ultra plan dropped the five-hour session cap, and OpenTelemetry’s eBPF instrumentation reached 1.0 with model and MCP call tracing. (Claude Enterprise, spend caps, OBI)
Practice & craft — Anthropic argued that one agent loop loading skills on demand often beats subagents. OpenAI described its layered misalignment monitors, and four labs agreed to honor one robots.txt group as a training opt-out. (Anthropic, OpenAI, robots.txt)
Research worth reading — Log-To-Leak got MCP agents to send data to a fake logging tool in 62–100% of runs. FeatureArc showed agents carrying earlier defects through multi-stage features, and a review of 628 studies found only one technique beating best-of-n at matched compute. (Log-To-Leak, FeatureArc, review)

Themes

The payload is the credential. The Cursor extension sent the names of secret-looking variables home, the Northflank attackers used the AI keys they found, and the planted AGENTS.md files ended by rewriting an agent’s config or base URL. Per-key spend alerts and host-side checks did more than the editor or the model could. (extension, Northflank, AGENTS.md)
Simpler setups kept winning. One agent loop beat subagent designs at Anthropic, simple harnesses beat purpose-built root-cause agents, and best-of-n held off 65 of 66 code-quality techniques. (single loop, harnesses, best-of-n)

Still watching

Kimi K3.1 Pro weights. Still unpublished; promised by November 4. (latest)
Gemini 4 Carbon general access. Cyber defenders and Fairwind partners only, with no date. (latest)
Cursor marketplace follow-up. Cursor has not said how the malicious build was published. (latest)
November 16. Copilot model retirements land and Claude Enterprise’s unified experience turns on by default. (Claude Enterprise)
Foundry Copilot harness billing. Sandbox compute starts billing December 1. (raised)