10月23日AI日报：MiniMax开源M3.1 Flash，OpenAI上线Decisions API

每日AI简报 🗞 — 10月22日 突发 🔥： - PHP 8.5.12、8.4.27、8.3.36 和 8.2.35 修复了两个被命名为 php2shell 的严重未认证远程代码执行漏洞（CVE-2026-109618 和 CVE-2026-109619），这两个漏洞由 OpenAI 的 Patch the Planet 计划协助发现，OpenAI 现提供一项 Codex 技能用于检查受影响的网站。 - Microsoft Threat Intelligence 报告称，与中国政府有关联的威胁行为者 Storm-0940 使用了智能体式 AI 渗透测试框架 ARTEX，对全球数百个组织自动化发起攻击。 - Cloudflare 警告称，八张被广泛信任的 eMudhra 中间证书的私钥已遭泄露，攻击者可借此为任意域名伪造证书。 - Node.js 为其 22.x、24.x 和 26.x 系列发布了安全版本，修复了多个漏洞，其中包括高危问题。 - Cloudflare 警告称，CVE-2026-88771 可让攻击者在任何人登录之前就在 NetScaler Gateway 上执行命令。 ANTHROPIC 🔥： - Anthropic 为 Claude Duet 开放了候补名单，这是一款围绕 Claude Opus 5.5 构建的独立主动式智能体应用，还可通过 Stripe Link 和 Shop Pay 购物，面向美国的 Pro 和 Max 用户。 - Claude Security 现在会在代码变更合入时重新扫描已连接的代码仓库，目前以公开测试版形式在 Claude Enterprise 上提供。 - Anthropic 发布了 API 版本 2026-10-21，包含新的 SDK 和 ant CLI 2.0，后者现已采用 Apache 2.0 许可证。 OPENAI 🔥： - GPT-6 Astra、GPT-6.1 Sol 和 GPT-6 Luna 以及 Codex 工作流正在 Google Cloud 的 Model Garden 上以私有预览形式逐步推出。 - ChatGPT Ads 已扩展至 26 个新国家，目前该平台上的广告主已超过 100,000 家。 SPACEXSI 🔥： - Grok Bots 正在向 X Chat 推出，让你无需离开 X 应用即可像给普通联系人发消息一样与你的机器人对话。 - Grok Bot 现在可以将报告、备忘录和仪表盘构建为实时页面，你可以共同编辑，或让它保持更新。 GOOGLE 🔥： - Gemini 现已在 CarPlay 上的 Google 地图导航中可用，可通过语音处理停车、交通报告和路线变更。 META 🔥： - Meta 公布第三季度营收 646 亿美元，同比增长 26%，扎克伯格表示超过 25% 的 Muse 用户已通过该智能体购买过商品。 NVIDIA 🔥： - 在柏林 GTC 上，NVIDIA 推出了用于保护企业智能体的 OpenShell 参考架构和 DSX POD，将在已准备好的站点部署 AI 工厂的时间缩短至最快 14 天。 - NVIDIA 在 Hugging Face 上发布了 Nemotron 3.5 Embed、Rerank 和 Parse 开放检索模型。 MISTRAL 🔥： - Mistral 与 NVIDIA 在工业工程 AI 领域达成合作，涵盖更快的仿真、开放的物理 AI 基准，以及面向 CAE 和 EDA 的智能体评估。 KLING 🔥： - Kling 4.0 API 现已正式开放，该模型也已在 Runway、fal、Higgsfield 和 Adobe Firefly 上线。 COHERE 🔥： - Cohere 推出了 Rerank 5，分为 Pro 和 Fast 两个层级。 RECURSIVE 🔥： - Recursive 发布了 Flint，这是一个 40B MoE 开放权重本地编码模型，采用 Apache 2.0 许可证，据称比同类模型快至多 2 倍。 * 使用 Grok 撰写了本简报，挑选了新闻并进行了一些后期编辑。

查看原文

DAILY AI BRIEF 🗞 — Oct 22 BREAKING 🔥: - PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 fix two critical unauthenticated remote code execution flaws dubbed php2shell (CVE-2026-109618 and CVE-2026-109619), which OpenAI's Patch the Planet initiative helped uncover and now offers a Codex skill to check affected sites. - Microsoft Threat Intelligence reported that China state-aligned threat actor Storm-0940 used the agentic AI penetration testing framework ARTEX to automate attacks on hundreds of organizations worldwide. - Cloudflare warned that private keys for eight widely trusted eMudhra intermediate certificates were compromised, letting attackers forge certificates for any domain. - Node.js shipped security releases for its 22.x, 24.x and 26.x lines fixing multiple vulnerabilities, including high-severity issues. - Cloudflare warned that CVE-2026-88771 lets attackers run commands on NetScaler Gateway before anyone signs in. ANTHROPIC 🔥: - Anthropic opened a waitlist for Claude Duet, a standalone proactive agent app built around Claude Opus 5.5 that can also shop via Stripe Link and Shop Pay, for Pro and Max users in the US. - Claude Security now re-scans connected repositories as code changes land, in public beta on Claude Enterprise. - Anthropic released API version 2026-10-21 with new SDKs and ant CLI 2.0, now licensed under Apache 2.0. OPENAI 🔥: - GPT-6 Astra, GPT-6.1 Sol and GPT-6 Luna plus Codex workflows are rolling out in private preview on Google Cloud's Model Garden. - ChatGPT Ads expanded to 26 new countries, with more than 100,000 advertisers on the platform so far. SPACEXSI 🔥: - Grok Bots are rolling out to X Chat, letting you message your bots like any contact without leaving the X app. - Grok Bot can now build reports, memos and dashboards as live pages you can edit together or have it keep up to date. GOOGLE 🔥: - Gemini is now available in Google Maps navigation on CarPlay for parking, traffic reports and route changes by voice. META 🔥: - Meta reported $64.6B in Q3 revenue, up 26%, with Zuckerberg saying more than 25% of Muse users have bought items through the agent. NVIDIA 🔥: - At GTC Berlin, NVIDIA introduced the OpenShell Reference Architecture for securing enterprise agents and DSX POD, cutting AI factory deployment at prepared sites to as little as 14 days. - NVIDIA released Nemotron 3.5 Embed, Rerank and Parse open retrieval models on Hugging Face. MISTRAL 🔥: - Mistral partnered with NVIDIA on AI for industrial engineering, covering faster simulation, open physics-AI benchmarks and agentic evals for CAE and EDA. KLING 🔥: - The Kling 4.0 API is now officially open, with the model also landing on Runway, fal, Higgsfield and Adobe Firefly. COHERE 🔥: - Cohere launched Rerank 5 in Pro and Fast tiers. RECURSIVE 🔥: - Recursive released Flint, a 40B MoE open-weight local coding model under Apache 2.0 that it says is up to 2x faster than comparable models. * Used Grok to compose this brief, cherry-picking the news and doing some post-editing.