Skip to content
The Voyager

Daily Brief

PingCAP's breach leaks TiDB Cloud keys; Claude's API drops temperature

PingCAP says attackers copied encrypted TiDB Cloud API keys, Anthropic's new API version rejects temperature and top_p, and a Bayer agent platform shows what 22 specialist agents cost to run.

4 min read4 stories

Two of today’s stories are about things you probably set once and forgot: a vendor’s API key and a sampling parameter. Neither is glamorous, and both can bite on a Monday.

1 · Top story

PingCAP’s breach put encrypted TiDB Cloud API keys in an attacker’s hands

PingCAP says someone used stolen service-account credentials to get into internal systems between 9 September and 7 October, and copied source code, billing records, SQL editor text and encrypted TiDB Cloud API-key values. The company says it found no evidence that data stored in TiDB was affected, and it hasn’t yet said which customers are involved. The attacker’s own claim of 10.6 TB is unverified.

If you run agent memory or a vector store on TiDB Cloud, don’t wait for the customer list. PingCAP’s guidance is to create replacement management keys, update and test what depends on them, then revoke the old ones. Your SQL editor history is also in scope, so check it for pasted secrets.

pingcap.compingcap.com · Customer actionsinfoq.com · InfoQ

2 · Models & features

Claude’s new API version returns a 400 if you send temperature

Anthropic’s API version 2026-10-21 rejects temperature, top_p and top_k with a 400 error, even at default values. It also rejects documents placed in assistant messages and citations on user text blocks. The SDKs that default to the new version send it automatically, so an upgrade can break a working service. Bedrock gets the new version only for Claude 4.7 and later.

The quiet cost is on older models such as Sonnet 4.6, where a lowered temperature was doing real work for consistency. You can pin 2023-06-01 for those calls, but that’s a stopgap: move the consistency into the prompt and an eval.

platform.claude.complatform.claude.com · Deprecations page

3 · Agents

Bayer’s agent platform runs 22 specialist agents, and most of the savings are plumbing

Bayer Crop Science describes, in an AWS post, an agentic decision engine on Bedrock AgentCore with a LangGraph supervisor routing to 22 domain-scoped agents. It resolves about 80 percent of user questions without an engineer in the loop in its first phase, and a diagnosis that took over an hour now takes under 10 minutes.

The numbers worth stealing are the dull ones. Exposing APIs through AgentCore Gateway as MCP tools cut per-API integration overhead by over 99 percent, and caching the stable prompt prefix cut input-token cost by 20 to 30 percent. It’s a vendor-published case study, and the rollout is still to a gated group of 100-odd users, so treat the 80 percent as an early figure.

aws.amazon.com

4 · Research

A ten-year-old CNN beat two frontier LLMs at reading skin lesions

A dermatologist tested GPT-6 Astra and Claude Fable 5.1 on 200 biopsy-proven lesions from the public MILK10k set. Each LLM picked the right first diagnosis for 42 percent, against 62 percent for an Inception v3 fine-tuned on 68,011 archive images. The cases, prompts, replies and scoring code are published.

The honest reading: small data (30 melanomas), each LLM run once, and the CNN at its preset threshold discharged 18 of 30 melanomas, a serious miss of its own. It’s a nudge to benchmark a small specialised model before reaching for a frontier API on a narrow task, not a verdict.

lynchlab.net

Also worth knowing

🆕 New on the radar

  • Nanbeige4.3-33B — Apache-2.0 open weights, 512K context, and self-reported Terminal-Bench 2.1 of 80.9 against 73.0 for Qwen3.8-27B, though it trails on SWE-Bench Pro (60.3 vs 61.7). Watch. Source
  • Carbon-X — a 14.8B Apache-2.0 chat model that reads raw DNA and answers in English, built on Qwen3-14B; two of its five benchmarks were built by its authors. Watch. Source

🧰 Models & tools

  • Google ML Drift — an Apache-2.0 on-device GPU engine behind LiteRT, reporting 12% lower memory than llama.cpp and MLX LM on workstations; Google is retiring the old TFLite GPU delegate. Source
  • Copilot usage metrics — the API now splits usage by client (OpenCode, Claude Code, Codex, VS Code) in a new totals_by_client field, which is best-effort rather than verified identity. Source

🏢 Platforms & enterprise

  • GitHub Apps on enterprises — enterprise installations are GA, so admins can replace classic PATs for policy, 2FA and IP-allowlist automation; GHES gets it in 3.24. Source
  • LangChain’s “company harness” — five parts (location, identity, memory, sandboxed code, scheduled runs), with identity called the hardest; memory the least explored. Source

Deadlines & deprecations

  • 2026-10-31 — DeepSeek starts billing server-side Search and Fetch calls at $0.75 per 1,000 each; budget for it if agents use them. Source
  • 2026-11-17 — Gemini API shutdown of five preview audio models, including gemini-3.1-flash-live-preview and the 2.5 TTS previews; the page lists earliest possible dates. Source
  • 2026-11-30 — claude-sonnet-4-5-20250929 retires on the Claude API; move to claude-sonnet-5-5. Source
  • 2026-11-30 — OpenAI shuts down the Evals dashboard and API, the v1/prompts API and Agent Builder; export what you need. Source
  • 2026-12-11 — OpenAI removes gpt-5, gpt-5-mini, gpt-5-nano, gpt-5-pro, o3 and o3-pro from the API. Source

One old credential is plenty for a Monday; the rest of this list can wait until tomorrow.

Middle East, India & events · 1
  • Chariot-1-ASR Realtime — Chariot launched a streaming speech-recognition model for Hindi, Marathi, Bengali, Tamil, Telugu, Kannada, Malayalam, Gujarati, Punjabi and Odia, plus Indian English, available on its own platform. The error-rate wins over Gemini, Sarvam and ElevenLabs are the company’s own tests, and no licence is stated. Source

Researched and drafted with AI, checked against the linked sources. How we use AI →

  • #security
  • #claude-api
  • #agents
  • #aws
  • #evals