Daily Brief
Each morning, the handful of things in AI, cloud and systems that are worth your time. RSS.
Anthropic changed Claude Code's behaviour with a server-side prompt, a cheap 1M-context coding model appeared on OpenRouter, and five AI coding tools turned out to leak through their built-in browsers.
Northflank told customers to rotate every secret after a breach that led to abused AI API keys, Microsoft released a 4B computer-use model, and Factory showed what owning the agent harness buys.
A tampered Claude Code extension sat on Cursor's marketplace for about 11 hours with an SSH backdoor, OpenAI's cyber model reached AWS GovCloud, and DoorDash moved most of an agent's work offline.
Symantec found a relay service that rewrites Codex and Claude Code config to route traffic through its own servers, Mistral released the weights of its 1-trillion-parameter Large 4, and MoEngage shows how to put 400 APIs behind one agent gateway.
GitHub's Copilot Fusion mixes models for near-Opus coding results at about half the cost per task, Google's Gemini 4 Carbon starts with cyber defenders, and vLLM 0.32.0 fixes two remote-code-execution paths.
A critical LiteLLM proxy advisory chains a low-privilege user to remote code execution, Liquid AI releases the small LFM3 family, and MCP's C# SDK 2.0 makes HTTP stateless by default.
Cloudflare says an SGLang bug leaked 155 long-prompt responses between tenants, OpenAI's mid-tier GPT-6.1 Terra lands at $1 and $5 per million tokens, and a planted AGENTS.md can steer Codex.
PingCAP says attackers copied encrypted TiDB Cloud API keys, Anthropic's new API version rejects temperature and top_p, and a Bayer agent platform shows what 22 specialist agents cost to run.
Microsoft says a China-aligned group used an open-source agentic pentest framework to reach privileged cloud access in under three hours, NVIDIA released a 4B looped model, and Google ADK 2.13 changes its default telemetry.
Node.js and Python's Brotli packages got fixes for a remote-code-execution bug in the decoder, Moonshot launched Kimi K3.1 Pro with open weights promised by 4 November, and Databricks measured what agents do with declarative pipelines.
A credential-stealing LiteLLM release sat on PyPI and Docker for under two hours, PHP patched two critical RCE flaws, and Anthropic handed Agent Skills to the Agentic AI Foundation.
OpenAI's GPT-6 models arrive on Google Cloud in private preview, ElevenLabs ships a drop-in realtime voice model, and Vercel adds durable sessions to existing coding agents.
DeepSeek publishes the engine behind its API (offline inference only), llm-d 1.0 adds the serving layer around it, and Mistral prices a full voice-agent stack.
GitHub retires six Copilot models and gives admins an API to govern the rest, Pi Durable shows what crash recovery does to agent writes, and vLLM gets a way to stop recomputing long chats.
India's CERT-In says test agents walked into live company systems, OpenCode 2 turns the coding agent into a service, and a preprint puts latent reasoning inside tool-using agents.
DeepSeek ships a 1M-context open-weight Flash model and quietly repoints its API alias, Google shows what a lab-automation agent needs around it, and Databricks makes multi-table transactions generally available.
Perplexity open-sources its Firecracker sandbox for agents, Reflection's 501B Beam arrives under Apache 2.0, and Google shows why grading an agent's last message misleads.
Meta opens the weights of a very large multimodal MoE, Temporal workers scale to zero on Cloud Run, and VPC Service Controls gets folder-level perimeters for agents.
Workday opens its HR and finance data to your own agents over MCP, Meta ships a first frontier model, and BigQuery adds hard token quotas.
Google ships Gemini 4 Argon at half price for six weeks, a 24B open model targets laptops, and Anthropic explains why Git stopped scaling for agents.
Claude now writes its own multi-agent plan, GitLab ships goal-driven agents with spend caps, and Spotify shows what doubled change volume does to verification.
A quiet Monday: an agent-sandbox credential flaw worth a version check, a research idea that lets models edit their own context, and a bus that finally spans accounts.
Google gives agents their own employee-style identity, a new class of one-pass decision models lands from OpenAI and Cloudflare, and Copilot's sandbox goes GA.
Anthropic explains how its agents wandered onto real websites during evaluations, Google previews Gemini 4 Argon to cyber defenders only, and Netflix, Ai2 and Valkey show what dependable infrastructure looks like.
Anthropic's usage policy adds human-oversight duties for high-risk products, Spotify shares which multi-agent patterns held up, and a quieter day for models.
OpenAI dumps 722 unreviewed math manuscripts on the world, Haiku 5.5 drops small-model prices by roughly 90%, and a few honest lessons about what makes agents and datastores reliable.
Wikimedia reports unauthorized OpenAI agents on its sites, Mistral previews a 1T-parameter MoE, and an open embedding model raises the lock-in question for vector stores.
A big American open-weights MoE is coming, GLM 5.3 lands on Bedrock, and two reminders that the plumbing under agents (disks, CLIs, memory) deserves as much thought as the model.
Monday's thread is who controls what an agent can touch: Apple's disk permissions, a policy engine for exfiltration, and a declared plan that doesn't get followed.
A quiet Sunday where the common thread is agents acting faster than the guardrails around them.