Northflank's breach exposed AI API keys, and a 4B model drives desktops
Northflank told customers to rotate every secret after a breach that led to abused AI API keys, Microsoft released a 4B computer-use model, and Factory showed what owning the agent harness buys.
Most of today’s news comes down to who holds your keys and how much of an agent’s work you can see. Start with the first one.
1 · Top story
Northflank’s breach put customers’ AI API keys to work for someone else
Northflank disclosed a security incident on 30 October and told customers to rotate all user-defined credentials. Its status page says to assume all environment variables were decrypted, and later reports unauthorised use of AI API keys supplied to the platform. Neither the cause nor the number of customers hit has been published.
If model keys sit in a hosted platform’s environment variables, that platform is part of your key management. Rotate at the provider, and check billing logs for calls you didn’t make.
Affected: any Northflank customer’s secrets: environment variables in workloads, secret groups, global secrets and add-on credentials · Fixed in: not applicable (hosted service); Northflank has added secret rotation for several add-ons and audit logs for all accounts · Severity: no formal rating; the status page lists it as a major outage · Stopgap: rotate all user-defined credentials, disable public access on add-ons, revoke and replace AI keys at the issuing providers · If compromised: review provider usage and billing logs, and report suspicious activity to Northflank and the provider
2 · Models & features
Microsoft’s 4B Mage-VL-Cowork drives desktops and shells with one policy
Microsoft put Mage-VL-Cowork on Hugging Face this week under Apache-2.0. It’s a 4B vision-language agent that handles both GUI control and shell or Python from a single policy, built on a Qwen3-4B-Instruct-2507 backbone.
The model card reports 66.0% on OSWorld-Verified (two-run average, 361 tasks, 50-step budget) and calls that the highest among 4B models. A 9B model, ScaleCUA-Qwen3.5-9B, scores 68.7%. Those are Microsoft’s numbers. For design, a model this small can run next to the app it controls, which changes the latency and data-residency conversation for desktop automation.
3 · Agents
Factory’s Droid 1.0 lets the model script its own tool calls
Factory published Droid 1.0 on 29 October, a model-independent coding-agent harness that ships as a desktop app, a terminal UI and a TypeScript SDK. Its Script Mode has the model write JavaScript that runs in a sandbox with no file, network or system access of its own; Factory says that cuts cost 15% versus direct tool calls on Claude Opus 5.5.
On Factory’s own Terminal-Bench 4 runs with GPT-6.1 Sol, Droid scores 57.6% at $0.79 per passed task, against 54.0% for Codex and 51.0% for OpenCode, and Factory says it’s about 10% slower than Codex there. The architectural point is that the harness, not the model, is where cost gets decided, and a harness you can swap models under is a hedge against vendor lock-in.
4 · Research
A NeurIPS paper says final-score agent evals hide where agents break
“Prefix Executability” (arXiv 2610.40444, 29 October, accepted to NeurIPS 2026) evaluates tool-using agents on the steps they execute, not only on whether the final task succeeds. It runs on BFCL-v3 multi-turn, ToolSandbox and the Airline and Retail splits of τ³-bench.
Its main claim is that outcome-only and prefix-level rankings diverge, so two agents with the same pass rate can fail in different places. The abstract gives no numbers, so treat it as an argument to test on your own traces. If your eval dashboard shows only pass rate, log which step first became unexecutable and see whether your ranking of agents changes.
5 · People worth following
Latent Space: a finance agent that runs for ten days and keeps a memory per client
In a 26-minute Latent Space episode, an Arca executive describes agents doing long-horizon financial work where tasks can take “ten days” and the work is “very stop-start”. The system keeps persistent state for every client, and a custom harness picks the best model per task from internal benchmarks, with Claude as the primary provider.
The useful part is the ownership argument: because the harness is theirs, Arca can change model providers if needed. Agents propose, and human advisors handle trading and money movement. If your agent work spans days, design the state store and the human hand-off first, and treat the model as the replaceable piece.
6 · Architecture
Databricks makes real-time mode GA for Spark Declarative Pipelines
Databricks announced on 29 October that Real-Time Mode is generally available for Spark Declarative Pipelines. Its benchmarks on customer feature-computation workloads say up to 92% faster than specialized engines like Flink, and a Feature Store path with 200 ms end-to-end p99 latency from Kafka to the online feature store.
For AI systems this is the feature-freshness layer: fraud, personalisation and agent context that go stale in a micro-batch. It needs the pipeline in continuous mode with spark.databricks.streaming.realTimeMode.enabled set to true and the RealTime trigger. All the numbers are Databricks’s own, so replay one production stream before you move anything.
Also worth knowing
🆕 New on the radar
- Memdoor — a five-role Qwen3.8-27B workflow solved 49 of 50 problem attempts (the first ten LiveCodeBench Hard problems, five passes each); self-run, and its page says contamination can’t be ruled out. Watch. Source
🛡️ Security & governance
- ChatGPT HTML previews — Parameter Labs chained an unchecked message listener and an unsandboxed iframe so a shared link could call ChatGPT’s APIs as the victim; reported 18 October, resolved by OpenAI on 26 October. Source · Simon Willison
- Volta infostealer — Cisco Talos describes an infostealer that sends evidence about one victim to an LLM to rank that victim’s assets by monetization value; Talos advises alerting on headless Chrome launched by unknown processes. Source
- Firefox patch gap — Epoch AI used the open-weight GLM 5.3 to exploit six Firefox releases from fixes that were public but not yet shipped; its advice is to shrink the gap between publishing and shipping a fix. Source
🏢 Platforms & enterprise
- Confidential Containers with Fortanix — Fortanix added attestation-gated key release for Kubernetes Confidential Containers; the Intel TDX guide’s GPU setting “Required” validates evidence through NVIDIA attestation. Source
🔬 Research
- Google PageBreak — a security agent that Google says found 500+ XSS bugs, reporting only findings that deterministic validators reproduce against a running app. Source
Week in review
The five that mattered
- An agentic pentest framework drove ConnectWise: attackers use agents too, and speed is the new risk.
- Cloudflare’s KV cache leak: compare cache pool size with context length.
- LiteLLM proxy admin RCE: “can call models” and “can run the gateway” were one flaw apart.
- Copilot Fusion: model choice is moving into a router.
- A relay rewrote Codex and Claude Code: agent config is a security boundary.
Threads: the week’s trust problems sat in config, gateways and shared infrastructure, and today’s Northflank breach adds hosted secret stores to that list.
📈 Rising topics: sandboxing. The ChatGPT preview bug above is a reminder that an iframe is only as isolated as its origin. Coding agents are the other one rising, and Droid shows the harness is where the cost decisions live.
Decisions to revisit: where your model keys are stored, and which agent settings are enforced rather than advised.
Rotate the key, then go outside; the rest of this will keep until Monday.
Middle East, India & events · 4
- Jio Haptik SOLO in the UAE — Jio Haptik announced the UAE launch of SOLO, an AI business team for marketing, sales and support aimed at solopreneurs and small businesses, at the Dubai AI Festival; it targets more than two million of them. Pricing and a general-availability date weren’t in the release. Source
- Gnani Prisma v3.0 — Gnani.ai says its speech-to-text model is available now over REST, WebSocket streaming and batch, with a macro word error rate of 16.9% across nine Indian languages on its own evaluation, against 19.98% for ElevenLabs Scribe v2. Source
- CoRover BharatGPT on AIKosh — CoRover listed three models (BharatGPT Mini, Instruct and an ASR Hindi Conformer) on IndiaAI’s AIKosh platform, and reports a 24.72% word error rate for the Hindi model on its Lahaja Hindi test set. Source
Upcoming:
- Government AI Summit 2026, Abu Dhabi, 3 November — a one-day public-sector AI event. Link
Researched and drafted with AI, checked against the linked sources. How we use AI →