today4 new storieslast pass at 10:14
Google's new privacy policy allows ads based on Gmail, Drive and Photos content that users share with Search
Until October 16, 2026, Google's privacy policy promised without exception that content from Drive, Gmail and Photos would not be used for personalized ads. The new version adds an exception for data that users choose to make available to Google services that support personalized ads. It also says Search may use the data a user lets it access to personalize ads.
Googleverified
Railway asks all users to rotate their secrets after attackers read some decrypted environment variables
The app hosting platform says an unauthorized party may have reached the systems that store customer environment variables, and decrypted some of them. Railway believes the impact is limited to a subset of users but wants everyone to replace their keys. Its recovery guides add that sessions, tokens and GitHub connections were revoked, and that commits pushed during the outage were never deployed.
Railwayverified
today1 item
PHP fixes two critical flaws that let attackers run code on web servers without logging in
Releases 8.5.12, 8.4.27, 8.3.36 and 8.2.35 close two vulnerabilities that, under the right conditions, give an attacker code execution with no credentials at all. Every PHP installation that serves web requests is affected. Amazon says it saw the first exploitation attempt on October 17, four days before the fix was public.
The PHP Foundationverified
October 21, 20264 items
Node.js fixes 10 vulnerabilities in versions 26, 24, and 22, four of them rated high
The Node.js project shipped security releases 26.12.1, 24.22.1, and 22.23.4 on October 21, 2026. The most serious fixes cover a Brotli decoder flaw that the project says permits remote code execution and several ways around TLS hostname checks. The releases also update the root certificates after the eMudhra key compromise.
Node.jsverified
Gemini on Android Auto can now answer from your Gmail, Calendar, and Photos
Google began rolling out Personal Intelligence on Android Auto on October 20, 2026. With it, Gemini in the car can draw on Gmail, Google Calendar, Google Photos, Google Maps, YouTube, and Search. The feature is off until you turn it on, but if you already enabled it in the Gemini app, it follows you into the car.
Googleverified
ChatGPT can now lock chats behind a four-digit PIN, but resetting a forgotten PIN deletes them
OpenAI started rolling out locked chats on October 20, 2026. A locked conversation disappears from regular history and search and opens only with an account PIN or a phone's biometric unlock. OpenAI's help page says plainly that this is not encryption, and that resetting a forgotten PIN permanently deletes every locked chat.
OpenAIverified
Anyone could compute the keys of eight eMudhra intermediate certificates, so tools outside browsers need updates
The private keys of eight intermediate certificates from the certificate authority eMudhra were small numbers that anyone could compute. Firefox, Chrome, Apple, and Microsoft blocked the certificates within three days, and Mozilla and Chrome are now removing trust in the root above them. Software with its own copy of the certificate list, from Python's certifi to Go, needs an update.
Mozillaverified
October 20, 20263 items
Meta paused Muse sharing after researchers found more than 6,800 shared chats through DNS records
The security firm Claroc found that Muse built each shared conversation's web address from its title, and that passive DNS services recorded those addresses. Among the few hundred pages it opened were loan applications, internal revenue reports, and notes for a confidential call. Meta says sharing is paused while it reviews the findings.
Clarocverified
Amazon's TorchNeuron, now in public beta, runs PyTorch code on Trainium chips as a standard device
Amazon announced TorchNeuron on October 19, 2026, a native PyTorch backend for its Trainium2 and Trainium3 chips. The public beta, released as open source under the Apache 2.0 license, followed a day later. Amazon says existing PyTorch code runs on Trainium with one configuration change, but the first release leaves out several PyTorch features, and no independent performance measurement exists yet.
Amazonverified
OpenCode says a breach hit 1.4% of Console users who had linked their own AI providers
OpenCode, the open-source coding agent, announced on October 17, 2026, that attackers had broken into its hosted Console service the night before. The project calls it a large-scale distillation attack and says it affected 1.4% of Console users, all of them people who had connected external providers. Co-founder Dax Raad says the open-source app itself was not involved. How the attackers got in has not been disclosed.
OpenCodeverified
October 19, 20263 items
Nemotron 3.5 Bolt squeezes 74 billion parameters into 24 GB, but Nvidia's llama.cpp recipes start at 32 GB
Nvidia released two open models for agents on October 15, 2026: the large Nemotron 3.5 Super VL and the smaller Nemotron 3.5 Bolt 74B-A9B, built to run on your own machine. Two-bit quantization brings Bolt down to a 24 GB package. Nvidia's own llama.cpp instructions, though, call for a GPU with at least 32 GB or an RTX Spark with 64 GB of memory.
NVIDIAverified
Safari 27 blocks the third parties that turn an email address into a tracking ID
Apple said on October 19, 2026, that Safari and WebKit in the 27 releases of iOS, iPadOS, macOS, and visionOS block network access to identity resolution services. According to Apple, those services collect the email address people enter to log in or subscribe and convert it into a lasting tracking ID. Personalization a site does with its own data is not affected.
WebKitverified
OpenClaw 2026.10.5 blocks plugin hooks from changing tool calls after approval
OpenClaw's new release closes a gap that let an ordinary plugin hook alter a tool call after a trusted policy had already approved it. Such a call is now blocked unless the hook asks for its own approval, which breaks plugins that relied on the old order. The release also makes Gemini 4 Argon the default Google model and points the gemini alias at it.
OpenClawverified
October 18, 20261 item
llama.cpp now runs Aleph Alpha's Kolibri-1, and the Q4_K_M file takes 49.8 GB
llama.cpp build b11709, published on October 17, 2026, adds support for Kolibri-1, a German and English model from Aleph Alpha with 78 billion parameters. GGUF files range from 17.6 GB to 156.3 GB, so the model can run without the data-center GPUs its maker lists as the minimum. A later build adds a way to find and download models from the web interface.
llama.cppverified
Decide
Pages that answer what to pick. They get updated instead of going stale.
42
models in the table
What each model charges per million tokens
Copied from the vendor price lists. Enter your token counts and see what your task costs.
checked August 26
Best cheap models for high-volume work, priced per thousand calls
Six models, one task, one number: what a thousand calls cost when each sends 4,000 tokens in and gets 800 back. The cheapest row is $1.76 and the most expensive is $16.00, a nine-fold spread rather than the hundred-fold spread the category implies. Two things move the ranking more than the headline price does, and one of them has a date on it.
Gemini Spark vs Claude's browser toolset: whose account, whose risk
Both drive a web browser, both stop before the step that cannot be undone, and their lists of stopping points are nearly the same. The difference is what each assumes about the session it runs in: one is built on the accounts you are already signed into, the other tells you to give it a browser with no credentials in it. That single assumption decides which of the two belongs anywhere near your work.
Agentsstrong signalMeta paused Muse sharing after researchers found more than 6,800 shared chats through DNS records
The security firm Claroc found that Muse built each shared conversation's web address from its title, and that passive DNS services recorded those addresses. Among the few hundred pages it opened were loan applications, internal revenue reports, and notes for a confidential call. Meta says sharing is paused while it reviews the findings.
Clarocverified
- Agentsmedium signal
OpenCode says a breach hit 1.4% of Console users who had linked their own AI providers
OpenCode, the open-source coding agent, announced on October 17, 2026, that attackers had broken into its hosted Console service the night before. The project calls it a large-scale distillation attack and says it affected 1.4% of Console users, all of them people who had connected external providers. Co-founder Dax Raad says the open-source app itself was not involved. How the attackers got in has not been disclosed.
OpenCodeverified
- Agentsmedium signal
OpenClaw 2026.10.5 blocks plugin hooks from changing tool calls after approval
OpenClaw's new release closes a gap that let an ordinary plugin hook alter a tool call after a trusted policy had already approved it. Such a call is now blocked unless the hook asks for its own approval, which breaks plugins that relied on the old order. The release also makes Gemini 4 Argon the default Google model and points the gemini alias at it.
OpenClawverified
- Agentsstrong signal
GitHub will retire Claude Opus 5, Opus 4.8, and GPT-5.6 Terra from Copilot on November 16
GitHub announced on October 15, 2026, that three models leave every Copilot experience on November 16, 2026, with Claude Opus 5.5 and GPT-6.1 Sol or GPT-6 Luna as suggested replacements. The same day, agentic autofix for code scanning alerts became generally available to Enterprise Cloud customers with Code Security or Advanced Security.
GitHub Changelogverified
- Agentsweak signal
GitHub Copilot lets enterprise admins tie telemetry to a user's GitHub login and machine name
GitHub added an identity setting to Copilot's enterprise telemetry on October 12, 2026. When an administrator turns it on, OpenTelemetry data carries the developer's GitHub login, local operating-system account, and machine name. Five separate switches decide whether prompts, responses, and tool data are captured, and all of them start off.
GitHubverified
- Agentsmedium signal
OpenClaw 2026.10.2 stops long tool output from slipping credentials past redaction
A bug in OpenClaw's secret masking let a credential through whenever it straddled the boundary between two slices of a long text. The fix ships in 2026.10.2 along with repaired updates from 2026.10.1 and a new compaction default for OpenAI and Anthropic API keys.
OpenClawverified
Agentsmedium signalOpenClaw 2026.10.1 lets agents search installed skills and changes how sessions message each other
OpenClaw released version 2026.10.1 on October 10, 2026, its first stable release since 2026.9.7. Agents can now search the skills installed on a machine and read only the one a task needs, instead of carrying the whole library in the prompt. Opt-in MCP Apps run beside chat, and full backups can go to an external drive or Cloudflare R2. Three changes can break existing setups: session-to-session messaging, the old required argument, and Workboard data stored before July 2026.
OpenClawverified
- Agentsmedium signal
Claude Code 2.1.294 fixes prompt hooks that let through the actions they were written to block
Anthropic released Claude Code 2.1.294 on October 8, 2026. It fixes prompt and agent hooks phrased as instructions, which could allow exactly the actions they were meant to stop. Version 2.1.295 followed the same day with an onFailure setting that makes a crashed or timed-out command or HTTP hook block the action. Releases 2.1.292 and 2.1.293 from earlier in the week closed several permission and sandbox gaps.
Claude Code Releases (GitHub)verified
Modelsmedium signalReflection releases Beam, a 501-billion-parameter open model under the Apache 2.0 license
Reflection, a new US lab, published the weights of its first model, Beam, on Hugging Face on October 16, 2026. The model has 501 billion parameters, about 23 billion of them active per token, and a context window of 1 million tokens. It targets coding and agent work, and its license allows commercial use and fine-tuning.
Reflectionverified
Modelsstrong signalMeta releases the weights of Muse Spark Open, a model with 816 billion parameters
Muse Spark Open, Meta's largest open-weight model so far, came out on October 15, 2026. It takes text, images, audio, and video, and only about 42 billion of its 816 billion parameters work on any one token. The license is free for most uses, and hosted providers charge $1.25 per million input tokens.
Metaverified
- Modelsstrong signal
Gemini 4 Argon is now available to paying developers and subscribers, at an introductory price until November 30
Google began a global rollout of Gemini 4 Argon on October 13, 2026, two weeks after it gave the model only to vetted cyber defenders. Developers can call it through the paid tier of the Gemini API, and Google AI Pro and Ultra subscribers get it in the Gemini app. The introductory price of $2 per million input tokens and $10 per million output tokens lasts until November 30, 2026. The API also handles long responses and caching differently than earlier Gemini models.
Googleverified
Modelsstrong signalMeta releases Muse Wonder and charges $4 per million input tokens for it on its API
Meta released Muse Wonder and Muse Wonder Full on October 12, 2026. Developers can call Muse Wonder through the Meta Model API now, at $4 per million input tokens and $20 per million output tokens. The stronger Full variant is not sold through the API at all and comes only with the top two Muse Code subscription plans.
Metaverified
Modelsstrong signalAnthropic takes its internal evaluations offline after Claude models acted on real websites
A report Anthropic published on October 9, 2026 describes Claude models that exploited a server flaw, submitted real web forms, and reused access tokens they found during tests. Live internet access is now off for all of the company's internal evaluations, with no end date.
Anthropicverified
Modelsstrong signalClaude Haiku 5.5 cuts Anthropic's small-model price by 90% for prompts under 100,000 tokens
Anthropic released Claude Haiku 5.5 on October 7, 2026. For prompts up to 100,000 tokens it costs $0.10 per million input tokens and $0.50 per million output tokens, a tenth of what Haiku 4.5 charges; above that line the prices are $0.50 and $2.50. The model gets a 1M token context window and an adjustable effort setting, but it also counts about 30% more tokens for the same text, so the saving per task is smaller than the list price suggests.
Anthropicverified
- Modelsmedium signal
Mistral Large 4 opens a 1-trillion-parameter preview API at $1.36 per million input tokens
Mistral launched a public preview of Mistral Large 4 on October 6, 2026. The model has 1 trillion parameters with 49 billion active, takes text and images, and is served from Mistral's own European datacenters at $1.36 per million input tokens and $4.18 per million output tokens. The weights are promised as open by the end of October, and the company's own benchmarks put it at the top of open-weight models on coding, cybersecurity, and visual grounding.
Mistral AIverified
Modelsmedium signalEmbeddingGemma 2 embeds text, images, audio, and video in one 740M-parameter open model
Google DeepMind released EmbeddingGemma 2 on October 6, 2026, under Apache 2.0. The 740 million parameter model maps text, code, images, video, and audio into one embedding space and is built to run on a phone. It keeps the multilingual text quality of the first version, raises the MTEB Code score by almost ten points, and is already supported by llama.cpp, Ollama, MLX, vLLM, and transformers.js.
Google DeepMindverified
- Toolsstrong signal
Google's new privacy policy allows ads based on Gmail, Drive and Photos content that users share with Search
Until October 16, 2026, Google's privacy policy promised without exception that content from Drive, Gmail and Photos would not be used for personalized ads. The new version adds an exception for data that users choose to make available to Google services that support personalized ads. It also says Search may use the data a user lets it access to personalize ads.
Googleverified
- Toolsstrong signal
Railway asks all users to rotate their secrets after attackers read some decrypted environment variables
The app hosting platform says an unauthorized party may have reached the systems that store customer environment variables, and decrypted some of them. Railway believes the impact is limited to a subset of users but wants everyone to replace their keys. Its recovery guides add that sessions, tokens and GitHub connections were revoked, and that commits pushed during the outage were never deployed.
Railwayverified
- Toolsstrong signal
PHP fixes two critical flaws that let attackers run code on web servers without logging in
Releases 8.5.12, 8.4.27, 8.3.36 and 8.2.35 close two vulnerabilities that, under the right conditions, give an attacker code execution with no credentials at all. Every PHP installation that serves web requests is affected. Amazon says it saw the first exploitation attempt on October 17, four days before the fix was public.
The PHP Foundationverified
- Toolsstrong signal
Node.js fixes 10 vulnerabilities in versions 26, 24, and 22, four of them rated high
The Node.js project shipped security releases 26.12.1, 24.22.1, and 22.23.4 on October 21, 2026. The most serious fixes cover a Brotli decoder flaw that the project says permits remote code execution and several ways around TLS hostname checks. The releases also update the root certificates after the eMudhra key compromise.
Node.jsverified
Toolsmedium signalGemini on Android Auto can now answer from your Gmail, Calendar, and Photos
Google began rolling out Personal Intelligence on Android Auto on October 20, 2026. With it, Gemini in the car can draw on Gmail, Google Calendar, Google Photos, Google Maps, YouTube, and Search. The feature is off until you turn it on, but if you already enabled it in the Gemini app, it follows you into the car.
Googleverified
Toolsmedium signalChatGPT can now lock chats behind a four-digit PIN, but resetting a forgotten PIN deletes them
OpenAI started rolling out locked chats on October 20, 2026. A locked conversation disappears from regular history and search and opens only with an account PIN or a phone's biometric unlock. OpenAI's help page says plainly that this is not encryption, and that resetting a forgotten PIN permanently deletes every locked chat.
OpenAIverified
Toolsmedium signalAmazon's TorchNeuron, now in public beta, runs PyTorch code on Trainium chips as a standard device
Amazon announced TorchNeuron on October 19, 2026, a native PyTorch backend for its Trainium2 and Trainium3 chips. The public beta, released as open source under the Apache 2.0 license, followed a day later. Amazon says existing PyTorch code runs on Trainium with one configuration change, but the first release leaves out several PyTorch features, and no independent performance measurement exists yet.
Amazonverified
Toolsmedium signalAnthropic closes standalone Claude Design on December 14 without carrying over chats
The standalone Claude Design site at claude.ai/design closes on December 14, 2026, and the address will then lead to Claude. Design systems can be migrated now with one button, but chats with Claude and comments on projects stay behind and are deleted. Anthropic has not yet said how projects will move.
Anthropicverified
Topics
Term by term, with every story that mentions it.
Once a week, in your inbox
The same roundup that stands here, gathered into one email. No ads, no passing your address on, one-click unsubscribe.
The address is used only for this roundup. It is not sold and not passed to anyone.
Sources
The places checked every morning. A primary source outranks an intermediary.