Cafiyn Pulse
Issue 10Week of 9 November 2026Published weekly

Railway put a price on stolen AI keys: $740,000. On Tuesday, 4,837 hijacked accounts went after CI secrets.

Railway's incident report, published on 10 November, estimates unauthorised spend on its customers' stolen AI keys at about $740,000.The same day, Aikido says an attacker using 4,837 hijacked GitHub accounts began probing 61,764 repositories, and that its stealer ran in at least 1,806 of them.Anthropic released Claude Fable 5.2 at $8 and $40 and put an IP allowlist into beta, which limits where a leaked key works.CISA listed a GPUStack admin bypass and an OpenSSH password bypass as exploited, and Google made Gemini 4 Carbon generally available at an introductory price.

ByKarthik KumarCafiyn Innovations
In this issue
Get it weekly, no account:RSSJSON Feed

Tracked continuously

Every item we have published on a theme, in one place, growing weekly.

API changes and deprecations33Security incidents and advisories31Shutdowns and wind downs13Funding and benchmarks11AI tooling and models32
Deadlines10

Deadline board

Dated, sourced, and with the first thing to do. Soonest first.

  1. ShutdownGitHub

    GitHub Copilot removes Claude Opus 4.8, Claude Opus 5 and GPT-5.6 Terra from every Copilot experience

    Do this: Move saved workflows and agent configs to Claude Opus 5.5, GPT-6.1 Sol or GPT-6 Luna. Annual individual plans keep Opus 4.8.

    Source: GitHub, upcoming Copilot model deprecations
  2. ShutdownGoogle

    Five Gemini Live and text to speech previews shut down, including gemini-3.1-flash-live-preview and gemini-2.5-flash-preview-tts

    Do this: Move Live calls to gemini-3.8-live and speech to gemini-3.8-flash-tts or gemini-3.8-flash-lite-tts. Google does not say whether these requests reroute or fail.

    Source: Google, Gemini deprecations
  3. PriceOpenAIAt least through

    GPT-5.6 Sol promotional pricing of $4 input and $20 output per million tokens is guaranteed only through this date

    Do this: Model your bill at the earlier price the page implies, $5 and $30, until OpenAI says the promotion is permanent.

    Read the analysisSource: OpenAI, GPT-5.6 Sol model page
  4. ShutdownOpenAI

    Agent Builder, the Evals dashboard and API, and the v1/prompts reusable prompts API shut down

    Do this: Move prompt text into your own code and replace Agent Builder flows with the Agents SDK before the date.

    Read the analysisSource: OpenAI, API deprecations
  5. ShutdownAnthropic

    Claude Sonnet 4.5 (claude-sonnet-4-5-20250929) is retired on the Claude API

    Do this: Switch to claude-sonnet-5-5, which Anthropic names as the replacement, and check your token counts again because the tokenizer changed.

    Read the analysisSource: Anthropic, model deprecations
  6. ShutdownAnthropic

    Fast mode for Claude Opus 4.8 is removed, and requests that set it return an error

    Do this: Search your code for speed set to fast on claude-opus-4-8 and move it to Claude Opus 5.5, which Anthropic names as the replacement.

    Source: Anthropic, Claude Platform release notes
  7. PriceGoogle

    Gemini 4 Carbon moves from $2 input and $10 output to $4 and $20 per million tokens

    Do this: Cost your product at the December price, not the introductory one, and run your evals at the lower rate while it lasts.

    Source: Google, Gemini API pricing
  8. ShutdownGoogle

    gemini-2.5-pro routes automatically to gemini-3.8-flash and gemini-2.5-flash to gemini-3.5-flash-lite, billed at the destination rate

    Do this: Change the model string yourself and rerun your evals, because a Pro tier prompt is about to be answered by a Flash model.

    Source: Google, Gemini API changelog
  9. PolicyGitHub

    GitHub Actions blocks pull_request_target by default in every public repository, unless an Actions event policy allows it

    Do this: Use Insights before the 9 November brownout to see which runs the rule would block, then either keep the block or allow the event explicitly.

    Source: GitHub, pull_request_target blocked by default
  10. PolicyGitHub

    Dependabot alerts turn off on most repositories with no activity in the past year

    Do this: List the repositories you have not pushed to in a year, and enable alerts on any that still run in production.

    Source: GitHub, Dependabot alerts on inactive repositories
Every deadline we trackAdd to your calendar

Hot takes

2

Our read on the week. Opinion, and labelled as such.

Railway's $740,000 shows that who pays for a stolen key depends on which provider issued it

Opinion
10 Nov

Railway's incident report, dated 10 November, estimates unauthorised spend on the stolen keys at about $740,000. It says AWS Bedrock and Google Gemini refunds follow their existing fraud policies, that OpenAI and SpaceXSI review claims case by case, and that talks with Anthropic are ongoing, with Railway covering Anthropic costs meanwhile. OpenRouter is enforcing its no refund policy, so Railway says it will cover those costs itself. The report says at most 1.85 percent of workspaces, about 100,000, could have had variables decrypted, and calls that an upper bound.

So what

The refund policy is part of the provider you picked, and you learn it when it is tested. Ask each provider you hold a key with, in writing, what it does about stolen key spend. Then set the controls you own: a spend limit at every provider, and an IP allowlist where one exists. A refund is a negotiation. A limit is a setting, and it works before the bill arrives.

Source: Railway, incident report

An IP allowlist is the cheapest control against stolen keys, and it covers less than you would assume

Opinion
5 Nov

Anthropic put an organisation level IP allowlist for the Claude Console into beta on 5 November. Requests from addresses outside your list are refused with a 403 permission_error. The list holds up to 1,000 entries and covers the Console and API endpoints including Messages, Files and Managed Agents when called with an API key. It applies to the whole organisation, and the page mentions no per key or per workspace list. It does not cover Claude in Amazon Bedrock, Claude Platform on AWS, Claude Models on Google Cloud or Claude in Microsoft Foundry.

So what

A leaked key stops being a password that works from anywhere once it only works from your servers. That is the failure behind this week's stories, so turn it on for every production organisation. Two cautions from the page. It limits where a key works, not for how long, so pair it with short expiry. And it suggests letting admins reach settings from any address to avoid a lockout, at the cost that a stolen admin session could edit the list.

Source: Anthropic, IP allowlist

Post mortems

3

What broke, and the specific thing to check in your own stack.

4,837 hijacked GitHub accounts probed 61,764 repositories, and a CI secret stealer ran in at least 1,806

Security
10 Nov

Aikido says that from about 12:45 UTC on 10 November an attacker using stolen GitHub credentials opened pull requests titled docs: dependency audit notes, which confirm write access, in 61,764 repositories. It says the payload ran in at least 1,806, a figure that may understate the impact, though its own summary line says 1,835. The stealer takes Actions secrets, cloud and AI provider credentials, and mints OIDC tokens for cloud sessions. The attacker reverts within a minute and deletes the run and its logs.

So what

A missing run number is the tell, since the logs are gone: Aikido says a gap in the workflow history, or on the attacker's commit, is often the only trace. Check any repository you can write to for that pull request title, opened since 10 November. If the payload ran, assume every secret and cloud role its workflows could reach is compromised, and rotate them. Do the cloud side too, because it minted OIDC tokens.

Source: Aikido, CI secret stealer campaign

Railway traced October's breach to a build sandbox escape and one wrongly defined cloud trust binding

Security
10 Nov

Railway's report says the attacker exploited a previously unknown build sandbox flaw at 07:28 UTC on 20 October and, through a build credential, reached internal systems and a copy of its monorepo, where it found an erroneously defined OIDC binding. That yielded a short lived cloud credential at 03:26 UTC on 21 October. The attacker pulled encrypted variables whose names matched AI provider key patterns and decrypted some. Railway says forensics did not indicate customer databases were accessed, and that 1,852 users' linked account tokens were among the decrypted data.

So what

What Railway rebuilt is the lesson. Each build now gets its own ephemeral virtual machine, each service can decrypt only the credentials it needs, and every decrypt is audit logged. If you hold secrets for customers, copy that. If you do not, review every OIDC trust binding you own, because one wrong definition handed an attacker a cloud credential.

Source: Railway, incident report

CISA listed an AI serving admin bypass and an OpenSSH password bypass as exploited, with a 12 November federal deadline

Security
9 Nov

CISA added both to its exploited list on 9 November, with a due date of 12 November. GPUStack's advisory, CVE-2026-102895, rated 9.8, says versions before 2.2.0 treat requests that look like loopback as the built in administrator by default, and says it was exploited against a 2.1.1 deployment, where attackers created backends running reverse shells. OpenSSH 10.6p2, released 5 November, fixes a password bypass that Alpine says needs musl libc without PAM, password login on, and particular account setups.

So what

GPUStack manages GPU clusters for model serving, and its advisory says a bypass reaches worker credentials and provider secrets. Upgrade to 2.2.0 or later, keep it off untrusted networks, and check for admin API keys and backends you did not create. For OpenSSH, only musl builds without PAM are in scope, and Alpine is the example it gives: upgrade and restart sshd, since the package alone does not replace the running daemon.

Source: CISA, Known Exploited Vulnerabilities

Wins

4

Rounds, launches, and benchmarks worth measuring yourself against.

GitHub secret scanning now reads Actions workflow logs, in public preview, for Enterprise Cloud

Security
9 Nov

GitHub says secret scanning now detects secrets in Actions workflow logs, in addition to issues, wikis, discussions and pull requests. The preview is available to enterprises on GitHub Enterprise Cloud with GitHub Secret Protection or GitHub Advanced Security. It scans runs that finish after you enable it, with no backfill, and does not detect generic patterns, custom patterns or secrets already masked by Actions. Alerts do not generate notifications during the preview, so check the alert list directly.

So what

Logs are where a leaked key sits in plain sight and few people read them. If you are on Enterprise Cloud, the policy is called Secret scanning for Actions workflow logs and is off by default, so an enterprise owner has to switch it on. Everyone else gains nothing yet, so the interim control is the old one: mask every secret, and never print an environment.

Source: GitHub, secret scanning for workflow logs

Claude Fable 5.2 launches at $8 and $40 per million tokens, down from $10 and $50 for Fable 5.1

Launch
9 Nov

Anthropic released claude-fable-5-2 on 9 November with a 1M token context window and 128k maximum output. It lists $8 per million input tokens and $40 output, against $10 and $50 for Fable 5.1, and fast mode at $16 and $80 for up to 2.5x higher output speed. Claude Mythos 5.2 offers the same capabilities only to organisations verified through programmes such as the Cyber Verification Program. Both require 30 day data retention and are not available under zero data retention unless Anthropic expressly authorises it.

So what

A 20 percent cut on both input and output is real money, and the catches are on the same page. Three request shapes now return a 400 error, including editing earlier messages and then sending back a Fable 5.2 thinking block, and declaring the earlier computer use tool. Retention is the other catch: if a contract rules it out, check before you switch.

Source: Anthropic, Claude Platform release notes

Gemini 4 Carbon is generally available at $2 and $10, and the page says that doubles on 1 December

Launch
10 Nov

Google released gemini-4-carbon as generally available on 10 November, on the paid tier only. Standard pricing on the Gemini API pricing page is $2 input and $10 output per million tokens through 30 November, then $4 and $20 from 1 December. Batch and Flex are $1 and $5 before, and $2 and $10 after. GitHub made it available in Copilot Pro+, Max, Business and Enterprise the same day, billed at provider list pricing.

So what

Same shape as Gemini 4 Argon: an introductory rate, then a doubling on 1 December. Cost your product at $4 and $20 from the start, because that is the price you will be living with, and run your evals at the introductory rate while it lasts.

Source: Google, Gemini API pricing

Google's Decisions API returns a calibrated yes or no, a choice or a score, with zero output tokens

Launch
11 Nov

Google released gemini-decision-1 and the Decisions API on 11 November for binary, categorical and rubric decisions across text, images, audio, video and PDFs. Its docs say it generates zero text tokens, so output token usage is always 0 and only input tokens are billed. Yes or no questions return a probability from 0.01 to 0.99 with a confidence value, choices return probabilities that sum to 1, and scores return a weighted average of rubric levels. A request can hold up to 1,000 questions in a 262,144 token context.

So what

This targets a common job: classify, route or grade an input and return one answer. A probability beats a word, because you can set a threshold and watch it move. We did not verify its price or whether it is preview or general availability, so read the pricing page before you move a classifier onto it.

Source: Google, Decisions API

On the radar

5

Shifts that have not hit you yet but will.

Apple's new age rating questions start 16 November, and every app must answer them by 12 January

Policy
16 Nov

Apple's 2 November developer news entry says that from 16 November, App Store Connect adds two content descriptors to the age rating questionnaire: Shared Location, and Dating and Relationships. Apps that include Dating and Relationships get a minimum rating of 18+, a category that covers a virtual companion that engages a user in sexual or romantic content. You must provide the declarations when you submit an update or change the questionnaire, and all apps must have them by 12 January 2027. Brazil requires A16 for Shared Location and A18 for Dating and Relationships.

So what

Not every AI companion app is caught. The rule covers a virtual companion that engages a user in sexual or romantic content, so read the definition against what your product actually does, not how you describe it. Then answer the questions with your next submission, not on the last day in January.

Source: Apple, new age rating content descriptors

Dependabot turns off alerts on repositories with no activity in a year, from 8 December

Policy
8 Dec

GitHub says that from 8 December 2026 it will turn off Dependabot alerts on most repositories with no activity in the past year. Existing alerts are archived, not deleted, and can be restored. A push to any branch or tag, creating the repository, or turning alerts on counts as activity, and any push turns alerts back on. It will not turn them off where an enforced security configuration enables alerts. The change applies to all plans on github.com and to Enterprise Cloud with data residency, not Enterprise Server.

So what

A quiet repository is not a safe one. Anything deployed from a repository nobody has pushed to in a year, such as an old marketing site or a forgotten worker, will stop warning you about its dependencies. List repositories with no push in twelve months, decide which still run in production, and enable alerts on those in settings or through an enforced security configuration.

Source: GitHub, Dependabot alerts on inactive repositories

OpenAI deprecated gpt-image-2 on 10 November, with removal set for 10 February 2027

Shutdown
10 Nov

OpenAI's deprecations page lists gpt-image-2 and gpt-image-2-2026-04-21 as deprecated, announced 10 November, with removal from the API on 10 February 2027. The replacements it names are gpt-image-2.6-sunburst or gpt-image-2.6-flare, which arrived on 4 November. That is under ten months after the snapshot date in the model's own name. The changelog has no entry for it, so it appears only on the deprecations page. The removals of older GPT Image models on 1 December are unchanged.

So what

Watch the deprecations page, not the changelog, because this one never reached the changelog. If you are moving off gpt-image-1.5 before 1 December, go straight to a 2.6 model, not to gpt-image-2, or you will migrate twice.

Source: OpenAI, API deprecations

Two Anthropic removals land on 30 November: Sonnet 4.5, and fast mode for Opus 4.8

Shutdown
30 Nov

Anthropic's release notes say fast mode for Claude Opus 4.8 is removed on 30 November, after which requests to claude-opus-4-8 with speed set to fast return an error. The notes name Claude Opus 5.5 as the replacement, and the pricing page lists Opus 5.5 fast mode at $8 input and $40 output against $10 and $50 for Opus 4.8. Claude Sonnet 4.5 (claude-sonnet-4-5-20250929) retires on the same day, with claude-sonnet-5-5 as its replacement.

So what

The fast mode one is the quiet one. It is not on the deprecations page, only in the release notes and the pricing page, so checking the page you use for model retirements will miss it. Search your code for speed set to fast on claude-opus-4-8. Moving to Opus 5.5 is also cheaper, per the pricing page.

Source: Anthropic, Claude Platform release notes

Supabase's CBC cipher removal could have started on 10 November, and nothing we read says whether it did

Shutdown
10 Nov

Supabase's changelog says that starting 10 November 2026 at the earliest it will stop offering four CBC mode TLS 1.2 ciphers on project HTTP APIs, including custom domains. Auth, the Data API, Storage, Realtime and Edge Functions are affected. Direct Postgres connections, the pooler and the Management API are not. Supabase says fewer than 0.0001 percent of connections used them. Its pages give no removal date and do not say whether it has happened, and its status history shows no TLS entry.

So what

A failure here looks strange: the handshake fails before any HTTP request, so the request never appears in your project API logs. Supabase lists errors such as sslv3 alert handshake failure from curl or Node.js, and ERR_SSL_VERSION_OR_CIPHER_MISMATCH in browsers. If an old device or an unsupported operating system talks to your project, test it now. Clients using TLS 1.3 are not affected.

Source: Supabase, CBC TLS ciphers deprecated

Past issues

Issue 9 · Week of 2 November 2026
Nine AI platforms lost keys in October. One of the attackers turned out to be a runaway test agent.
Issue 8 · Week of 26 October 2026
Disconnecting the site did not evict the attacker. GitHub spent Universe week hardening the supply chain.
Issue 7 · Week of 19 October 2026
OpenAI turns off o3-mini, o4-mini, o1 and GPT-4 Turbo on Friday, the OpenCode breach puts coding agent keys in play, and GitHub now locks Actions dependencies.
Issue 6 · Week of 12 October 2026
The postponed Next.js fixes landed with two critical RCEs, and the tensorlake worm is built to wipe your home directory if you revoke the token it stole.
Issue 5 · Week of 28 September 2026
Next.js 16.3.7 is not the security release. Two labs landed on $2 and $10 a day apart.
Issue 4 · Week of 21 September 2026
Frontier prices fell by half on Tuesday. The same day, next/og got a 9.5.
Issue 3 · Week of 14 September 2026
Leaked keys are being harvested at scale. OpenAI now offers to hold your agent state.
Issue 2 · Week of 7 September 2026
Nvidia bought the open model commons. OpenAI published its retirement calendar.
Issue 1 · Week of 31 August 2026
Record money into AI builders. Three breaking API changes underneath them.

About this briefing

What is Startup Signals?

A weekly briefing for founders and engineering teams shipping products, published by Cafiyn Pulse. Each issue has four sections: Hot takes (opinion on the week), Post mortems (what broke, and the specific thing to check in your own stack), Wins (funding rounds and benchmarks), and On the radar (shifts that have not landed yet). Four to five items each issue also get a full analysis page.

How often is it updated?

Weekly. The current issue is at /signals and every past issue keeps a permanent URL at /signals/ plus its ISO week, so figures are never rewritten after publication.

Where do the facts come from?

Primary sources only: provider documentation and changelogs, official company announcements, and established trade press such as TechCrunch and Crunchbase News. Every item links to its source. We report on other reporting and do not break news ourselves.

Who writes it?

Karthik Kumar, cofounder and Chief Systems Officer of Cafiyn Innovations in Bangalore, India. Items in Hot takes are opinion and labelled as such; everything else is sourced reporting with the link attached.

What makes it different from a news aggregator?

Every item carries a "So what" line: one sentence on what a team shipping a product should do differently as a result. The deep analysis pages go further, written against the primary documentation to surface details the general coverage skipped, such as migration gotchas that fail silently or billing multipliers that are easy to miss.

Is it free?

Yes. No account, no newsletter signup required to read it.

How do I subscribe?

There is an RSS feed at https://pulse.cafiyn.com/signals/feed.xml and a JSON Feed at https://pulse.cafiyn.com/signals/feed.json. Both carry the full text of every weekly issue and every deep analysis page. There is no email list and no account, so subscribing costs you nothing and reveals nothing.

Open the tool.

Most of what shows up in Post mortems maps to one of ten categories the Stack Grader already checks. Three minutes, and you will know which ones apply to you.

Check your stack against this week's failures