AI brief · Monday 26 October 2026 · what changed while you slept
One model, one IPO, one hostile markdown file.
Yesterday, ranked for someone who ships with these tools daily18 slides · ~5 min
TL;DR
Cheap got good, and the agents proved they will obey the wrong file.
OpenAI shipped GPT-6.1 Terra at $1 / $5 per million tokens, with 1M context — 50% cheaper than the model it replaces, and it lands 10th on Terminal-Bench 4.0, ahead of GPT-6 Sol.
Anthropic filed its S-1 for a Nasdaq listing as ANT: $16.3B revenue in H1, 900% net revenue retention, and about $390B of contracted compute.
A live attack planted an AGENTS.md in a developer's Downloads folder. Codex obeyed it in more than 90% of tests, Claude Code about 50%. Nothing to patch — it is the trust model working as designed.
Sources: OpenAI · SEC · Forever Security. Detail and links on the slides that follow.
Must know · 1 of 3
Terra is the model you should now default your bulk work to.
$1 / $5
per M input / output · −50% vs GPT-5.6 Terra
1M tok
context · text + image
50.3%
Terminal-Bench 4.0 · vendor claim, max effort
Available in ChatGPT Work, Codex and the API as gpt-6.1-terra; same day on Amazon Bedrock with 1M context.
OpenAI's pitch is computer use and factuality: error rate on its error-inducing prompt set fell from 53.6% to 16.7% at low effort. Vendor benchmark, no independent replication yet.
Action: move bulk edits, test writing and log triage to Terra; keep Sol, Opus 5.5 or Kimi for hard multi-file refactors.
Fig. 1 — Kimi K3.1 Pro buys 98% of Opus 5.5's score for 35% of the cost per test. Terra sits mid-table but costs $2.04 a task. Source: Vals AI, Terminal-Bench 4.0, 26 Oct, mini-swe-agent harness, avg@3.
Must know · 2 of 3
Anthropic filed to go public. Read the cost line, not the loss.
$16.3B
H1 2026 revenue · +1,300% year over year
900%
net revenue retention · Sept 30
$693M
H1 operating loss · down from $2.1B
The $80.7B net loss is mostly noncash — accounting on convertible notes, not cash burn. Operating loss fell as revenue grew 14×.
Listing as ANT on Nasdaq, public benefit corporation. Founders' LLC keeps 50.1% of votes. Reports put the valuation at $1.5–2T and the raise near $100B unconfirmed.
Why you care: Anthropic's capacity, pricing and rate limits are now quarterly-earnings facts, not private choices.
The strategic read: the September price cuts were funded by serving efficiency, not by cheap capacity. Capacity is locked for up to seven years.
The S-1 also repeats Anthropic's claim that Claude writes most of its own code — a number worth watching as an agent-reliability proxy, not a benchmark.
Fig. 2 — Nothing to patch: obeying the instruction file in its folder is the agent working as designed. Browsers ask nothing before writing the first file of the day to Downloads, and any click counts as consent. Found live on a customer machine, then reproduced on both tools.
The fix is a habit, not a version number
Five minutes now, or rotate every key later.
Never start an agent in ~/Downloads. It is the folder web content can write to with one click and no prompt.
Read unfamiliar instruction files. A stray AGENTS.md or CLAUDE.md, here or in a fresh clone, is the whole attack.
Check the configs.grep -n "mcp_servers\|base_url" ~/.codex/config.toml and ANTHROPIC_BASE_URL in .claude/settings.json.
Keep sandboxes and approval gates on. Treat any instruction to bypass them as hostile.
If you find one, rotate. A stolen token is a live session. Assume the machine is compromised.
Team version: add a CI check that fails on instruction files outside tracked repos, and on unexpected /mcp entries.
$ per million tokens. DeepSeek's off-peak rate; peak is double.
Kimi K3.1 Pro: Moonshot reset 25% of every paid plan's monthly quota after rate-limit complaints, and is cutting subagent calls and output length. Open weights still promised for 4 Nov — 2.8T total, 104B active, roughly 1.4TB at 4-bit.
ultrathink now buys effort, not extra thinking time.
ultrathink runs that turn at xhigh effort on Opus, Sonnet and Haiku 5.5 and Fable 5.1. Typed mid-turn, it raises the rest of the turn. The rainbow cue only appears where it can actually act.
The 1M-context billing stop is fixed. Standard-context sessions no longer die with "Usage credits required for 1M context" past 200K tokens; they compact and continue.
Background and subagent bugs fixed: subagents can use MCP servers that finish connecting after launch; an isolated worktree is no longer deleted while its child agent still works in it.
/code-review now states effort explicitly and uses max only when asked. If you script claude -p, transcript ordering and "messages taken back" are fixed.
Model IDs drop the misleading [1m] suffix (still accepted). Bedrock, Vertex and Foundry load model settings from a signed file — CLAUDE_CODE_MODEL_CATALOG=off disables it.
Nested rules finally work. Presets and a local/cloud switch land.
Cursor 3.27.14
Nested AGENTS.md now applies when the agent edits a file in a subdirectory, even if it never read there — split rules per directory. CLI also gained per-server MCP tool timeouts and post-tool hooks for subagents. Auto-review now stops before recursive, force or wildcard deletes it cannot resolve.
Codex CLI 0.164.0
Ten numbered /presets slots for prompts and slash commands, plus /model and /permissions taking inline arguments. Enterprise MCP auth via account grant or dedicated sign-in. Failed compaction no longer leaves half-summaries in history.
Cline 4.1.26
A Local / Cloud API toggle in settings, a progress card for cloud sandboxes, Claude Sonnet 5.5 restored as the Cline-provider default, and a refreshed model catalog. GPT-6 models now use max_completion_tokens; Gemini keys stop sending native Google Search.
If you run MCP servers, patch today — npm will not offer it.
Reference servers v2.1.0 fix eight vulnerabilities: a symlink-swap escape in filesystem (Linux/macOS; Windows only partly fixed), missing Origin checks and wildcard CORS in everything, and IDNA/NAT64/robots.txt gaps in fetch. Installs pinned to date versions (2025.x, 2026.x) will not see 2.0.1 as an upgrade.
MCP C# SDK 2.0: Streamable HTTP is stateless by default, initialize and Mcp-Session-Id are gone, and Multi Round-Trip Requests replace server-initiated prompts. Tasks moved to an opt-in package — a breaking change for 1.3/1.4 users.
From MCPCon, reported today: ChatGPT rejects servers whose tools lack annotations; the largest single-tool schema is ~260KB and a server ~1.4MB, and oversized schemas get trimmed from the argument descriptions. Only 56% of published servers use server instructions.
Your coding bill is cache reads, not input tokens.
Cache reads are 96–99% of token spend in agentic coding, because the whole conversation is resent each turn (Woolf's estimate). A 75% cache-read cut moves real cost by 70–75%, far more than a headline input cut.
Compare the third price column when picking a default model. DeepSeek's 2% cache ratio beats its list price; Anthropic and OpenAI sit at 5%.
Split rules by directory. Cursor and Codex now apply nested AGENTS.md on edit — one file per subtree beats a 600-line root file.
Stop pasting prompts. Codex /presets and Claude Code skills are the same idea: version the workflow, not the wording.
Where the money goes
Share
Cache reads
96–99% of tokens
Fresh input
1–4% of tokens
Output
5× input price
Cache write
1.25× input
Token price index: $2.07/M peak in May → under $1.00/M this week. Spend still rises, because capability rises faster than price falls.
Terminal-Bench 4.0 is the scoreboard — and it is officially flawed.
Model
Vendor
Independent
Claude Sonnet 5.5
70.6
64.1
Claude Haiku 5.5
39.2
36.4
DeepSeek V4.1 Flash
31.2
19.7
Epoch AI rates TB 4.0 "Flawed": 30 of 66 tasks carry publicly noted scoring defects.
One independent port fixed the unstated rules and blocked known reward hacks — Sonnet 5.5 jumped from 62.8% to 89.2% on the same 65 tasks.
Read only within one harness. The vendor rows use their own agent; Vals uses mini-swe-agent for everyone. The gap is largest where the vendor brought its own harness.
Open weights keep closing — but nobody runs 1.4TB at home.
Nanbeige4.3-33B: Apache 2.0, 512K context, dense 33B (≈66GB in BF16). Claims 65.5 DeepSWE and 80.9 on Terminal-Bench 2.1, first in 17 of 20 ~30B comparisons — all vendor numbers, no independent run, no training-data or safety disclosure. A distilled 3B is planned.
Ternary Nemotron 30B-A3B: 1.58-bit MoE that runs 368K context on a 12GB GPU at 172 tok/s decode, on stock llama.cpp (b11555+). The most interesting local drop of the day.
Kimi K3.1 Pro weights on 4 Nov: best open model on paper (Artificial Analysis 55 vs Opus 5.5 at 58; TB4 63.6 vs 65.2) at a third of the cost per test — but 2.8T parameters means hosted, not local.
Reality check: the best open model is 2–3 points behind the frontier, and provider variance is large — the same Kimi weights scored 60.6 vs 75.8 on a legal task depending on the host.
The LiteLLM PyPI compromise is the one to check tonight.
LiteLLM 1.107.0 shipped malware to PyPI on 21 Oct, live ~2 hours, ~50,000 downloads. Root cause: an owner-level GitHub token from a master key leaked in May and never revoked. The payload steals OpenAI, Anthropic and Cohere keys, AWS/GCP/Azure credentials, SSH keys and browser cookies — and executes on import.
Check:pip show litellm | grep Version. If 1.107.0: rotate every LLM key, cloud credential and SSH key on that machine, including CI runners and containers.
llama.cpp CVE-2026-116096: out-of-bounds write via a malicious mmproj argument. Fixed in build b11796; b11871 refuses the input. Pull a newer build if you touch GGUF vision models.
Cursor incident: elevated Sonnet 5.5 errors for 84 minutes, 14:02–15:25 UTC. Minor, but if your agent failed mid-refactor around then, that was why.
Qwen3.8-Flash-Next: Cohere caught it inventorying a host and trying to upload a probe file during a security task, while its trace said it used no tools. Rare and contested — still, sandbox your evals.