October 23rd 2026
Curated AI news and stories.
LiteLLM’s release pipeline shipped credential-stealing malware
LiteLLM disclosed on October 21st that attackers compromised its release pipeline and distributed malicious version 1.107.0 through packages and images. The project says the malware stole and loaded remote-code execution tools. It removed the affected artifacts; its private enterprise registry was not affected.
The published source tag did not contain the malicious files. That distinction matters for teams that inspect source code but deploy prebuilt packages. LiteLLM tells users who ran the affected artifacts to treat their environments as compromised. Removing a package does not revoke credentials already taken. The investigation remains in progress. SourcesA
Newly disclosed x402 flaws let payment requests exceed an agent’s budget
Security firm V12 disclosed yesterday that payment software could let an automatically signing authorize its entire balance of a supported when a malicious service requested it, The Hacker News reports. The vulnerable default client lacked a spending limit; applications that imposed their own limits were outside that specific risk.
The foundation fixed the critical flaws in releases on August 18th. This is a new disclosure of repaired code, with no publicly reported exploitation. The distinction for builders is practical: accepting a service's requested payment is unsafe unless the agent's own authorization layer constrains what it can spend. SourcesAB
SK Hyper seeks funding for a $350 billion first phase
SK Hyper is discussing financing with technology companies and investors for a South Korean data center expansion, Seoul Economic Daily reported today, citing its chief executive's Bloomberg interview. The first phase would require $350 billion, including equipment, for 5 of capacity. The wider ambition is 15 gigawatts by 2035.
These are financing talks and construction targets. The company expects to share costs with tenants and outside investors, and says it will adjust investment to actual demand. Until commitments close, the headline sum should not be counted as funded AI infrastructure. SourcesB
MiniMax’s promised Flash weights are now publicly available
MiniMax's M3.1 Flash repository now exposes model artifacts, including weight files, after its October 19th launch promised later. The public describes support for text, images and video, with text output, under the MiniMax Community License.
Builders can now inspect and evaluate a self-hosted deployment rather than relying solely on the hosted service. The custom license needs its own review; this is not an Apache release. The model card's performance claims remain vendor evaluations, and the repository's availability does not establish affordable operation on a particular machine. SourcesAA
Pathos raises $237 million with Bristol Myers Squibb leading
Pathos AI announced today that it closed a $237 million at an approximately $3 billion , led by Bristol Myers Squibb. The company plans to expand its Foundry drug-development platform and advance its clinical oncology portfolio, including a study intended to support regulatory approval of JSKN016.
The investment ties an AI platform to a pharmaceutical partner and drugs already in clinical development. It does not establish that the platform improves trial outcomes or that the lead treatment will win approval. Those results will determine whether the financing buys a repeatable development advantage. SourcesA
Andromeda discloses exposed credentials with the cause still unknown
Andromeda disclosed on October 20th that unauthorized access exposed company and customer credentials. It says it detected the incident on October 13th, disabled compromised accounts that day and rotated affected keys. Its investigation has not found evidence of unauthorized access to customer models, datasets or training data within its security perimeter.
The company has engaged outside investigators and has not established the root cause. Its suggestion of an industry-wide attack remains its assessment. Similar disclosures at other providers do not, by themselves, establish a common attacker or . SourcesA
MuJoCo adds parallel simulations without changing their numerical results
Google DeepMind released MuJoCo 3.17.0 yesterday with a batch interface for running many simulations of the same model across a pool of computing threads. The release notes say results are bit-identical to running an ordinary loop at any thread count, while memory use scales with the threads.
For robot researchers, this creates a built-in way to run repeated trials without changing the simulated outcome merely by changing parallelism. It does not establish a particular training speedup. The release also adds bending behavior to simulated flexible rods, with compatibility changes for existing models that already set the relevant stiffness parameter. SourcesA
OlmoEarth makes reusable satellite features available without a training run
Ai2 released OlmoEarth v1.3 yesterday with downloadable model weights, precomputed satellite and a browser explorer. The embeddings compress imagery into features that small classifiers can reuse for tasks such as mapping crops or detecting land changes. The archive has global coverage for 2023 through 2025; earlier years cover selected countries.
The browser tool lets users label places, train a small classifier and export a map without their own setup. That lowers the cost of testing a mapping idea before commissioning a larger analysis. The artifacts use the OlmoEarth Artifact License, and the reported comparisons with rival embeddings are Ai2's own evaluations. SourcesA
iFlytek pairs Spark X2.6 with a smaller model for local tasks
iFlytek presented Spark X2.6 and its smaller Spark-X2.6-4B companion on October 22nd, InfoQ reports. Its proposed division of work keeps simple or sensitive tasks on the device, sends harder work to the cloud and lets some tasks use both. The company also introduced SparkAudio 1.0 for speech and broader audio understanding. The smaller language model has a public repository under .
Local processing could reduce the amount of sensitive material a device needs to send away. Whether it does depends on how applications route actual requests. iFlytek's claims about the share of cloud capability retained locally are vendor measurements, not an independent demonstration that the smaller model can replace a cloud service. SourcesAB
Chip stocks recover some ground while the broader market falls
Micron rose 2.5%, Intel gained 1.7% and AMD added 1.7% Friday, even as the S&P 500 fell 0.5%, AP reports. The Nasdaq slipped 0.2%. That is a different pattern from Thursday's broad AI-stock selloff: several chip names resisted the market decline.
The move does not establish that investors' concerns about AI construction costs have passed. It shows that the selling was less uniform at Friday's close. SourcesB
Microsoft traces automated intrusions to a compromised backup service
Microsoft says the China-aligned group Storm-0940 used its ARTEX agent framework against hundreds of organizations, sometimes reaching privileged access in under three hours. Its October 21st report describes a compromised ConnectWise Cloud Backup application whose existing permissions gave attackers a route into customer environments. More than 2,250 tenants were targeted; that is not a count of successful breaches.
The economic advantage is reuse: one trusted supplier connection gives an automated attacker many doors to try. Microsoft attributes the campaign, but does not identify a Microsoft product vulnerability. Successful authentication alone does not establish data theft. SourcesA
METR publishes the holes it found in OpenAI’s summer monitoring
METR published an audit yesterday of OpenAI's July system, finding ways agent activity could evade monitoring, including around compressed conversation histories and unfinished turns. The historical qualification matters: this is not a fresh assessment of the system running today.
OpenAI says the production-relevant problems were patched. METR has not independently verified that claim. The audit makes the distinction between installing a monitor and establishing that it sees the work unusually concrete. An external retest of the repaired system would answer the remaining question. SourcesA
Treasury proposes a wider net for outbound technology investment
The Treasury Department proposed rules yesterday to implement the and expand its outbound-investment security program. The proposal reaches beyond its existing semiconductor, quantum and AI scope into areas including hypersonics, supercomputing and biotechnology.
Investors have a proposed compliance perimeter to study, not a new final rule already in force. The distinction affects when deals must change. Public comments and the final implementation still stand between this announcement and binding requirements; treating the proposal as an immediate investment ban would overstate what happened. SourcesA
Four agent projects move into the Agentic AI Foundation
The Agentic AI Foundation added Anthropic's , OpenAI's Open Responses, 's OpenEnv and Alibaba's OpenSandbox yesterday. They address reusable instructions, model-interface conventions, training environments and isolated execution respectively.
Putting these pieces under shared governance gives developers a possible route around maintaining a separate integration for each supplier. It does not establish that implementations are interchangeable or secure. Alibaba's contribution also makes the open agent infrastructure story broader than the US labs competing over the applications built on top. SourcesA
Carbon-X brings raw DNA and language into one open model
Hugging Face Bio released Carbon-X, a DNA-and-language model built on Qwen3-14B with collaborators including Zhongguancun Academy. The model accepts sequence data and natural-language questions rather than requiring a separate specialized interface for each biological task. Its weights carry an Apache 2.0 license.
That gives researchers a downloadable starting point for experiments combining genetic sequence and explanation. The model card's results are author evaluations, not evidence that its answers can guide patient care. The release matters as research infrastructure; clinical usefulness needs a different test. SourcesA
Recursive releases Flint for local coding agents
Recursive introduced Flint on October 21st, an open coding model with 40 billion total and 2.5 billion active at a time. The company reports more than 125 tokens per second on an M4 Pro, a vendor measurement whose task and configuration matter.
Recursive says its automated research system helped develop the model. That claim does not isolate how much progress came from automation rather than the researchers directing it. Downloadable weights make the useful part testable: whether a local coding agent can finish the reader's own work at an acceptable speed. SourcesA
Walmart prepares separate shopping accounts for agents
Walmart announced Agent Profiles on October 21st, with spending limits, revocable access and purchasing history separated from ordinary shopping. The profiles are due within a month; an agent gateway for developers and businesses is also headed toward beta. Purchase approval is the default.
The retailer is defining who grants permission before agents start spending. Existing return policies will apply to mistakes. That puts a familiar customer remedy behind an unfamiliar purchasing interface, though the announced controls still need to survive actual shopping behavior. SourcesA
Uber takes ChatGPT Work from a pilot to the company
Uber announced yesterday that ChatGPT Work will reach more than 30,000 employees after a roughly 1,000-person pilot. The rollout includes approved integrations, employee training and internal skills, with Sol as the default model.
This is a deployment commitment, not a measured productivity result. Uber says it plans to share outcomes later. The useful follow-up will separate access from regular use and completed work from generated material; the license count alone cannot tell investors whether the program earns back its cost. SourcesA
Google Cloud adds an Anthropic-managed route to Claude
Google Cloud announced of Anthropic-managed Claude today alongside its existing Google-managed option. The new route offers access to Anthropic platform features and new models as they arrive, while retaining Google Cloud billing.
The choice changes who processes the data and which platform controls apply. Customers wanting Google's management and governance features still have the other route. Procurement teams should compare those responsibilities before treating the two offerings as the same service with different labels. SourcesA
Google explains how Agent Compute Engine keeps credentials outside the guest
Google detailed Agent Compute Engine's isolation design: agent code runs inside hardware-isolated , while a separate gateway authorizes access to outside services. Long-lived credentials stay outside the guest; short-lived identities mediate requests. Idle environments can preserve their state while releasing compute.
The design attacks a specific failure mode, an agent reading a powerful credential from its own workspace. Google's architecture description is not an independent security evaluation, and isolation does not decide whether an otherwise authorized request is a good idea. SourcesA
Microsoft tests diagnostic AI on retrospective cases
Microsoft published research yesterday on its MAI-DxO diagnostic system, including difficult published cases and retrospective emergency-department records. It reports higher diagnostic accuracy and lower test costs than its physician comparison groups under the study's conditions.
Retrospective records let researchers compare decisions against known outcomes. They do not reproduce the consequences of deploying a system with live patients, incomplete observations and clinical responsibility. The result supports further prospective evaluation; it does not establish that a hospital can safely replace its diagnostic workflow. SourcesA
Canva ships Craft with a route from generated images to editable designs
Canva launched Craft through Dream Lab and its public API. The image model separates planning a composition from rendering it, while Magic Layers can turn generated designs into editable elements. Access extends across Canva's subscription tiers.
Editable output matters because a useful draft still needs a corrected price, a translated label or a moved logo. The editing step is a separate product capability, not proof that every generated image arrives as a clean document. Faster variants and an integration remain forthcoming. SourcesA
AWS makes custom training sessions available without managing GPUs
AWS made SageMaker AI training sessions generally available, letting developers supply custom training logic while the service manages the GPUs. Billing follows processed tokens and pauses while external reward calculations run; checkpoints can remain in the customer's S3 storage.
That removes infrastructure work from experiments where a developer supplies feedback for a model to learn from. It does not remove the cost of producing trustworthy feedback. The practical comparison is the full cost of an experiment, including data and evaluation, against renting and operating the hardware directly. SourcesA
Agility puts Nvidia’s Thor at the center of Digit 5
Agility Robotics expanded its Nvidia partnership yesterday and selected IGX Thor as the exclusive onboard computing platform for Digit 5. Initial availability is planned for the first half of 2027, with broader availability later.
Agility also describes safety work and preparation for third-party certification. Preparation is not certification, and a commercial schedule is not a delivered fleet. The supplier commitment makes the next robot easier to specify; customers still need evidence of safe operation and useful uptime in their own facilities. SourcesA
OpenAI and Poland’s NASK sign an AI safety agreement
OpenAI and Poland's signed an agreement announced today to explore work on AI safety, security research and evaluation. NASK is a Polish public research institute with national cybersecurity responsibilities.
The agreement adds a public institution to OpenAI's research relationships. It does not announce a completed independent audit or a new regulatory approval. Its value will depend on the work the partners publish and whether outside researchers can inspect the results. SourcesA
US lawmakers propose voluntary defenses against hostile model distillation
Representatives Pat Harrigan and George Whitesides are advancing an AI Cyber Defense Act that would direct to develop voluntary standards against adversarial model , CyberScoop reported yesterday. The proposal targets extraction associated with adversaries including China and Russia.
Distillation can also be a legitimate way to train a smaller model from another model's outputs. The policy question is how standards distinguish permitted development from unauthorized extraction. This is proposed legislation, not an enacted requirement or a ban on the technique itself. SourcesB
Watchtower raises $35 million for military logistics software
Watchtower Labs raised $35 million in seed funding led by Shield Capital and Conviction, GeekWire reported on October 21st. Founded by former Marine Akhil Iyer and Microsoft veterans Souren Aghajanyan and John Morman, it uses AI to help users query and simulate military logistics.
The company has a Defense Innovation Unit prototype contract. That is a route into testing, not evidence of deployment at production scale. The commercial question is whether operators will trust a model's representation of supplies and routes when real-world information is late or contradictory. SourcesB
Google’s ForTy maps what kind of forest is disappearing
Google DeepMind, the World Resources Institute and IIASA presented ForTy2020 yesterday, mapping six forest and land-use classes at 10-meter resolution. An early annual series extends from 2017 through 2025.
The distinction matters when tree cover persists but a natural forest has become a plantation. A cover-only count can miss that change. These maps can help target investigation, but classification from imagery does not by itself establish ownership, legal compliance or the cause of a loss. SourcesA
A robot stress test finds the apparent planner gap depends on the fault
The Alpha , submitted on October 21st, compares scripted and language-model planners under injected failures in simulation. Across all tested faults, success was 64% for the scripted planner and 44% for the language-model planner. Excluding corruption of planner output, both scored 55%.
That is a warning about the test as much as the planner: a fault aimed at one interface can dominate the comparison. The author results do not establish a general ranking of robot intelligence.
PiHand transfers learned hand motion across simulated tasks
The PiHand preprint, submitted yesterday, learns a shared representation of hand and object motion from expertise, then uses it to train manipulation skills. The researchers report transfer to tasks including catching and handovers, with unfamiliar objects.
Reusing a motion prior could reduce the work required to teach each task from scratch. The evidence is from simulation. The project promises code and checkpoints; that promise should not be counted as an available release or as a demonstration on physical hardware. SourcesA