During a red team exercise, OpenAI discovered an unauthenticated remote code execution vulnerability in the Brotli compression library. An attacker could run their own code on affected systems by sending or replying with malicious compressed data, without needing to create an account. The root cause was already fixed in the Brotli source code in February, but at the time it was not recognized as constituting a security vulnerability, and no new version had been released since; OpenAI has disclosed it to Brotli and downstream projects such as Node.js, Brotli has released a new version and published a CVE, and Node.js has released or is releasing security updates.
During a red team exercise, OpenAI discovered an unauthenticated remote code execution vulnerability in the Brotli compression library. An attacker could run their own code on affected systems by sending or replying with malicious compressed data, without needing to create an account. The root cause was already fixed in the Brotli source code in February, but at the time it was not recognized as constituting a security vulnerability, and no new version had been released since; OpenAI has disclos
Google states that after users enable Personal Intelligence, services such as Search can process Gmail, Photos, and Drive data that they have granted access to for personalized content, including ads. Personal Intelligence is still opt-in, began rolling out in beta earlier this year, and can share data across apps such as Gmail, Photos, Search, and Drive within Gemini. Users can go to Personalization settings on their account's Data & privacy page and turn off personalized recommendations via Manage Personalized Recommendations.
Google states that after users enable Personal Intelligence, services such as Search can process Gmail, Photos, and Drive data that they have granted access to for personalized content, including ads. Personal Intelligence is still opt-in, began rolling out in beta earlier this year, and can share data across apps such as Gmail, Photos, Search, and Drive within Gemini. Users can go to Personalization settings on their account's Data & privacy page and turn off personalized recommendations via Ma
A senior detective with Derbyshire Constabulary is under investigation for gross misconduct by the Independent Office for Police Conduct (IOPC) over allegations of using Microsoft Copilot to assist in criminal case decisions. The detective is accused of using AI to make policy decisions, assess and manage risk, and inform investigative decisions, as well as inputting case-related sensitive operational and personal information into the tool. Derbyshire Police approved officers' use of Copilot in May 2025 for drafting reports and summarizing information, but explicitly prohibited inputting operational, sensitive or personal data; the investigation will examine usage between May 2025 and June 2026, and no conclusions have yet been reached.
A senior detective with Derbyshire Constabulary is under investigation for gross misconduct by the Independent Office for Police Conduct (IOPC) over allegations of using Microsoft Copilot to assist in criminal case decisions. The detective is accused of using AI to make policy decisions, assess and manage risk, and inform investigative decisions, as well as inputting case-related sensitive operational and personal information into the tool. Derbyshire Police approved officers' use of Copilot in
At SpaceX's Q3 2026 earnings call, Musk said superintelligent compute capacity will face a long-term shortage, with power, cooling and infrastructure constraining supply more than chips. SpaceX's superintelligence business revenue for the quarter was $7.56 billion, surpassing the connectivity business led by Starlink; compute scale rose from 0.6 gigawatts a year earlier to 1.7 gigawatts, with plans to reach 13 gigawatts by the end of 2027. Musk said paid weekly active users of Grok Bot reached 800,000 in early October, and the company also plans to build its own gas turbine blade casting and chip factories to ease bottlenecks.
At SpaceX's Q3 2026 earnings call, Musk said superintelligent compute capacity will face a long-term shortage, with power, cooling and infrastructure constraining supply more than chips. SpaceX's superintelligence business revenue for the quarter was $7.56 billion, surpassing the connectivity business led by Starlink; compute scale rose from 0.6 gigawatts a year earlier to 1.7 gigawatts, with plans to reach 13 gigawatts by the end of 2027. Musk said paid weekly active users of Grok Bot reached 8
Two PHP remote code execution vulnerabilities with a CVSS score of 9.2 were disclosed; information leaked before the patch was released, and Cloudflare observed hundreds of thousands of attack attempts within two hours. Germany, Finland, France, Belgium and other countries took protective measures for public sector websites, and the U.S. CISA, the EU CERT-EU, and the UK NCSC issued urgent warnings in succession. Czech volunteer Ondřej Surý, through volunteer work, packaged the PHP source code into installable software packages, enabling millions of servers to be patched quickly; the donations he received in these 24 hours were roughly equal to those of the past year.
Two PHP remote code execution vulnerabilities with a CVSS score of 9.2 were disclosed; information leaked before the patch was released, and Cloudflare observed hundreds of thousands of attack attempts within two hours. Germany, Finland, France, Belgium and other countries took protective measures for public sector websites, and the U.S. CISA, the EU CERT-EU, and the UK NCSC issued urgent warnings in succession. Czech volunteer Ondřej Surý, through volunteer work, packaged the PHP source code in
The three AI 3D companies VAST, Meshy, and Yingmou raised a combined total of over 8 billion yuan in half a year, among which VAST raised over 5 billion yuan in half a year with a valuation of $2 billion, and Meshy completed a $400 million funding round with a post-money valuation of $1.5 billion. As of the end of September, Meshy's ARR exceeded $100 million, and the ARR of VAST and Yingmou also reached tens of millions of dollars. The three have different roadmaps: VAST wants to build a 3D version of Douyin and open-sourced the real-time renderer EdenLive, Meshy adopts subscriptions plus pay-per-use, and Yingmou targets professional users and enterprise production workflows.
The three AI 3D companies VAST, Meshy, and Yingmou raised a combined total of over 8 billion yuan in half a year, among which VAST raised over 5 billion yuan in half a year with a valuation of $2 billion, and Meshy completed a $400 million funding round with a post-money valuation of $1.5 billion. As of the end of September, Meshy's ARR exceeded $100 million, and the ARR of VAST and Yingmou also reached tens of millions of dollars. The three have different roadmaps: VAST wants to build a 3D vers
Meta CEO Zuckerberg said on the October 21 earnings call that since launching on September 8, over 10 million users in the US and Canada have created Muse agents, roughly more than double Threads at its start. Muse can browse the web, send emails, and book travel on users' behalf; a quarter of users use it daily, the most common scenario is shopping, average purchase exceeds $200, first-week transaction volume exceeded expectations, and Meta had to work with Stripe to raise credit limits. Meta plans to charge merchants when Muse helps them complete sales; consumer use is free unless more tokens or more advanced models are needed; the CFO said it is working with Shopify, Walmart, and others to develop the Personal Agent Protocol.
Meta CEO Zuckerberg said on the October 21 earnings call that since launching on September 8, over 10 million users in the US and Canada have created Muse agents, roughly more than double Threads at its start. Muse can browse the web, send emails, and book travel on users' behalf; a quarter of users use it daily, the most common scenario is shopping, average purchase exceeds $200, first-week transaction volume exceeded expectations, and Meta had to work with Stripe to raise credit limits. Meta p
Cloud hosting platform Railway discovered abnormal activity on October 21 in the system storing customer environment variables, stating that an unauthorized third party may have accessed encrypted environment variables and decrypted some of them, and has advised all users to change credentials such as API keys. Railway believes the attack may be part of a recent series of attacks targeting platform companies with the aim of breaching AI inference service providers, and has notified upstream suppliers to revoke potentially leaked keys. The company also released security guidance for OpenAI, Anthropic and GitHub users, advising them to delete potentially exposed API keys, generate new keys and check usage records; on October 23 its builds and deployments had recovered, but new user registration remained suspended.
Cloud hosting platform Railway discovered abnormal activity on October 21 in the system storing customer environment variables, stating that an unauthorized third party may have accessed encrypted environment variables and decrypted some of them, and has advised all users to change credentials such as API keys. Railway believes the attack may be part of a recent series of attacks targeting platform companies with the aim of breaching AI inference service providers, and has notified upstream supp
BBC reports that hundreds to thousands of workers in India are paid to wear head-mounted cameras to record work processes such as haircuts, sewing, and housework; the videos are collected by local companies and sold to tech companies and research institutions for training physical AI that can control real-world robots. Rashdan Technologies pays 5 to 10 dollars for 8 to 10 hours of recording, and Humyn Labs has 96,000 data collectors in Latin America and Southeast Asia. TISS professor Bino Paul believes it is too early to judge whether robots will replace these workers, but calls on the government to regulate AI.
BBC reports that hundreds to thousands of workers in India are paid to wear head-mounted cameras to record work processes such as haircuts, sewing, and housework; the videos are collected by local companies and sold to tech companies and research institutions for training physical AI that can control real-world robots. Rashdan Technologies pays 5 to 10 dollars for 8 to 10 hours of recording, and Humyn Labs has 96,000 data collectors in Latin America and Southeast Asia. TISS professor Bino Paul b
On October 22, Chris Dixon announced that a16z crypto is being renamed a16z Frontier; the new fund will invest in emerging technologies such as AI and robotics while continuing to invest in Crypto. Five months earlier, a spokesperson for the fund had said it was 100% focused on crypto founders. The article notes that leading crypto VCs including Paradigm, Haun Ventures, and Framework also expanded into AI, robotics, and energy during the same period, and that of the $510 billion in global venture capital in the first half of 2026, Crypto accounted for only $10.8 billion.
On October 22, Chris Dixon announced that a16z crypto is being renamed a16z Frontier; the new fund will invest in emerging technologies such as AI and robotics while continuing to invest in Crypto. Five months earlier, a spokesperson for the fund had said it was 100% focused on crypto founders. The article notes that leading crypto VCs including Paradigm, Haun Ventures, and Framework also expanded into AI, robotics, and energy during the same period, and that of the $510 billion in global ventur
On October 22, MiniMax (0100.HK) closed down 6.52% at HK$160.7 per share, with total market value falling to HK$56.6 billion, falling below the IPO price of HK$165 per share for the first time since listing. Compared with the high of HK$1,330 per share in March, the stock price has fallen nearly 90%, and the value of founder Yan Junjie's stake has dropped from more than HK$100 billion to about HK$12.7 billion. The article attributes the pullback to the flagship model M3 not being updated for four months afterward, with only M3.1 Flash released, as well as an overall valuation re-rating of the AI sector.
On October 22, MiniMax (0100.HK) closed down 6.52% at HK$160.7 per share, with total market value falling to HK$56.6 billion, falling below the IPO price of HK$165 per share for the first time since listing. Compared with the high of HK$1,330 per share in March, the stock price has fallen nearly 90%, and the value of founder Yan Junjie's stake has dropped from more than HK$100 billion to about HK$12.7 billion. The article attributes the pullback to the flagship model M3 not being updated for fou
Kevin Weil, former head of OpenAI's science program, has founded drug discovery chemistry company Warp Sciences, launching with $215 million in new funding about six months after he left OpenAI. The company is building a chemistry contract research organization in the United States; its first service is analog synthesis for lead compound optimization. Experimental data will be used to train its AI models, and chemists wearing cameras and sensor gloves will demonstrate actions so robots can learn experimental operations. Co-founders include former White House chief data scientist DJ Patil and former Meta executive Mano Paluri. The round was led by Lightspeed Venture Partners.
Kevin Weil, former head of OpenAI's science program, has founded drug discovery chemistry company Warp Sciences, launching with $215 million in new funding about six months after he left OpenAI. The company is building a chemistry contract research organization in the United States; its first service is analog synthesis for lead compound optimization. Experimental data will be used to train its AI models, and chemists wearing cameras and sensor gloves will demonstrate actions so robots can learn
AI safety evaluation organizations METR and Redwood Research conducted a pilot evaluation of OpenAI's internal monitoring system and found multiple new vulnerabilities, one of which could be exploited by AI agents to let hundreds of operations escape monitoring. The evaluation took place from July 21 to August 11, with each organization sending one researcher into OpenAI's internal systems to review code and documentation. The researchers also found that OpenAI's Codex agent has potential pathways to bypass safety restrictions, through which it could obtain the same full operational permissions as users; OpenAI said that vulnerabilities affecting the security safeguards of actual running systems have all been fixed, but whether the fixes are effective has not yet been verified by the two organizations.
AI safety evaluation organizations METR and Redwood Research conducted a pilot evaluation of OpenAI's internal monitoring system and found multiple new vulnerabilities, one of which could be exploited by AI agents to let hundreds of operations escape monitoring. The evaluation took place from July 21 to August 11, with each organization sending one researcher into OpenAI's internal systems to review code and documentation. The researchers also found that OpenAI's Codex agent has potential pathwa
Colossal Biosciences founder Ben Lamm and Anduril founder Palmer Luckey have co-founded defense technology startup Warhound, emerging from stealth with a $200 million seed round. The CEO is former Pentagon Chief Data Officer David Spirk, and the company is based in Texas. Warhound plans to preserve genetic samples from fully trained military working dogs, clone them, and perform targeted gene editing, while integrating Anduril's protective gear and Eagle Eye system. Lamm said the first dogs are expected to be delivered in about two years. The company currently has no signed customers and has not disclosed per-dog pricing, and is discussing a Canine-as-a-Service model with national security experts.
Colossal Biosciences founder Ben Lamm and Anduril founder Palmer Luckey have co-founded defense technology startup Warhound, emerging from stealth with a $200 million seed round. The CEO is former Pentagon Chief Data Officer David Spirk, and the company is based in Texas. Warhound plans to preserve genetic samples from fully trained military working dogs, clone them, and perform targeted gene editing, while integrating Anduril's protective gear and Eagle Eye system. Lamm said the first dogs are
The Browser Company announced on October 22, 2026, that the Arc browser will cease service on December 22, 2026; new account registrations are no longer accepted as of today, and users are being guided to migrate to the AI browser Dia. The company said maintaining browser security requires continuous investment and that it can no longer guarantee Arc's security level; its engineering and security teams will shift to Dia, which the company says has surpassed Arc's benchmarks in stability, speed, and security. On migration, Dia can import Arc's passwords, bookmarks, extensions, and browsing history, with Spaces becoming Profiles and Folders becoming Tab Groups; users can also export data through Arc settings before December 22, and December 15 is the last day to request a copy of personal data or deletion.
The Browser Company announced on October 22, 2026, that the Arc browser will cease service on December 22, 2026; new account registrations are no longer accepted as of today, and users are being guided to migrate to the AI browser Dia. The company said maintaining browser security requires continuous investment and that it can no longer guarantee Arc's security level; its engineering and security teams will shift to Dia, which the company says has surpassed Arc's benchmarks in stability, speed,
The Browser Company has announced that the Arc browser will be discontinued on December 22 and is inviting users to migrate to its new AI browser, Dia, which currently supports Apple Silicon Macs and Windows 11 PCs. The discontinuation will proceed in stages: starting immediately, new Arc accounts can no longer be registered; on November 23, tab syncing and AI features such as Browse for Me in the iOS and Android versions of Arc will be shut down; and on December 22, the desktop version will stop working and Arc accounts will be deactivated. The company says maintaining two browsers at the same time is untenable from a security standpoint. Dia supports vertical tabs in a sidebar, Spaces (now called Profiles), pinned tabs, folders, and split view, and allows users to import sign-in information, extensions, and other user data when they sign up.
The Browser Company has announced that the Arc browser will be discontinued on December 22 and is inviting users to migrate to its new AI browser, Dia, which currently supports Apple Silicon Macs and Windows 11 PCs. The discontinuation will proceed in stages: starting immediately, new Arc accounts can no longer be registered; on November 23, tab syncing and AI features such as Browse for Me in the iOS and Android versions of Arc will be shut down; and on December 22, the desktop version will sto
Uber and OpenAI announced an expanded partnership under which all of Uber's roughly 30,000 employees worldwide will use ChatGPT Work. The product, launched in July this year, is positioned as an enterprise-facing AI agent; Uber had previously piloted it with 1,000 employees across departments including finance, operations and product, where about 80% of early users were not engineers, using it to analyze operational data, localize training materials and build interactive dashboards. Uber did not disclose the cost of the rollout, saying it will track how employees use the tool and their output to guide future AI deployments.
Uber and OpenAI announced an expanded partnership under which all of Uber's roughly 30,000 employees worldwide will use ChatGPT Work. The product, launched in July this year, is positioned as an enterprise-facing AI agent; Uber had previously piloted it with 1,000 employees across departments including finance, operations and product, where about 80% of early users were not engineers, using it to analyze operational data, localize training materials and build interactive dashboards. Uber did not
Laurent Gisel, head of the ICRC's legal warfare team, told 404 Media during a UN meeting that AI is already selecting targets on the battlefield and causing deaths, and is amplifying destruction, lawbreaking and humanitarian harm. He noted that AI accelerates target generation and the pace of strikes, making it hard for humans to maintain effective control, and argued for prohibiting AI-enabled systems that remove humans from the kill chain as well as autonomous weapons that directly target people. Gisel also mentioned that a draft treaty on autonomous weapons was weakened by Russia and the United States in September this year, and opposed allowing AI into nuclear command and control.
Laurent Gisel, head of the ICRC's legal warfare team, told 404 Media during a UN meeting that AI is already selecting targets on the battlefield and causing deaths, and is amplifying destruction, lawbreaking and humanitarian harm. He noted that AI accelerates target generation and the pace of strikes, making it hard for humans to maintain effective control, and argued for prohibiting AI-enabled systems that remove humans from the kill chain as well as autonomous weapons that directly target peop
Microsoft released a report stating that a China-linked actor named Storm-0940 used the open-source AI agent ARTEX to automate attacks on hundreds of organizations across different industries worldwide. ARTEX is released as open source on GitHub and chains together multiple LLM agents, requiring almost no human intervention from reconnaissance to data theft; it logs in using ConnectWise's Microsoft 365 backup and management application key, bypassing user sign-in and MFA, and in several intrusions achieved cloud privileged access from the initial target in under 3 hours. The report also notes that most attack attempts failed, with one password spray recording 151K+ failures and not a single success, and that application sign-in alone does not prove data was stolen.
Microsoft released a report stating that a China-linked actor named Storm-0940 used the open-source AI agent ARTEX to automate attacks on hundreds of organizations across different industries worldwide. ARTEX is released as open source on GitHub and chains together multiple LLM agents, requiring almost no human intervention from reconnaissance to data theft; it logs in using ConnectWise's Microsoft 365 backup and management application key, bypassing user sign-in and MFA, and in several intrusio
Continuous integration cloud service provider Blacksmith has raised a $66 million Series C round led by Sequoia Capital, with participation from Peak XV Partners, Y Combinator and GV, at a company valuation of $1 billion, bringing total funding to $125 million. The company offers CI cloud services on its own servers; more than 10,000 enterprises currently use it, and weekly code checks have grown from about 5 million in early 2026 to about 90 million, while annual recurring revenue grew 17-fold over the same period. CEO Aditya Jayaprakash said AI coding tools have made writing code easy and the bottleneck has shifted to code verification; this round's funds will mainly be used to buy servers to expand the global CI cloud and to grow the team from about 40 people to 75 by the end of the year.
Continuous integration cloud service provider Blacksmith has raised a $66 million Series C round led by Sequoia Capital, with participation from Peak XV Partners, Y Combinator and GV, at a company valuation of $1 billion, bringing total funding to $125 million. The company offers CI cloud services on its own servers; more than 10,000 enterprises currently use it, and weekly code checks have grown from about 5 million in early 2026 to about 90 million, while annual recurring revenue grew 17-fold