Issue 3Week of 14 September 2026

Leaked keys are being harvested at scale. OpenAI now offers to hold your agent state.

Anthropic's 10 September threat report describes an operator who decompiled 1.8 million Android apps looking for hardcoded secrets, and Brevo says a flaw in its SAML SSO let an attacker into 138 customer accounts. The federal deadline to patch exploited LiteLLM and Starlette bugs passed on 16 September. Meanwhile OpenAI put a managed Agents API into public beta fifteen days after it shut down the Assistants API, and Mistral and Cognition raised €3B and $2B between them in a single day.

Hot takes

Our read on the week. Opinion, and labelled as such.

OpenAI shipped a managed Agents API 15 days after shutting down the Assistants API. Keep your own state.

Opinion

10 Sep

On 10 September OpenAI released the Agents API in public beta: a managed harness in which OpenAI runs session orchestration, context compaction and recovery, and sessions persist across turns. OpenAI's documentation says it currently offers data residency only in the US and does not support Zero Data Retention. The Assistants API, OpenAI's previous managed layer for agent state, shut down on 26 August.

So what

A managed harness is a real shortcut, and this is the second time OpenAI has offered to hold your agent's state. The first one was retired fifteen days before this one launched. Use it if it saves you time, but write every session item to your own database as it streams and keep agent definitions in your repo. Do not promise customers Zero Data Retention or non-US residency on top of it until the documentation says otherwise.

Read the full analysis Source: OpenAI, Agents API documentation

OpenAI now lets you expire API keys. Existing keys are unaffected, so the setting alone changes nothing.

Opinion

15 Sep

On 10 September OpenAI added expiration dates for project API keys and let administrators enforce a maximum key lifetime at organisation or project level. On 15 September it added controls to allow only service-account keys, allow only user-owned project keys, or disable new key creation. OpenAI notes that existing keys are unaffected.

So what

That last sentence is the whole point. A non-expiring key pasted into an environment variable two years ago stays exactly as dangerous after you flip the new switch. Set a maximum lifetime at organisation level, move production to service-account keys, turn off ad hoc personal key creation, and then actually rotate, because only rotation brings the old keys under the new policy.

Source: OpenAI, API changelog

Post-mortems

What broke, and the specific thing to check in your own stack.

An operator scanned 1.8 million Android apps for hardcoded secrets, Anthropic's threat report says

Security

10 Sep

Anthropic's September threat intelligence report, covering December 2025 to August 2026, describes a suspected ShinyHunters affiliate who ran a pipeline on 10 AWS EC2 workers that downloaded 1.8 million Android APKs, decompiled them and scanned them for hardcoded secrets with TruffleHog. Anthropic says that pipeline and a separate GitHub token harvester supplied the initial-access credentials for most of the confirmed breaches tied to that operator, and that it banned accounts linked to the group, which used Claude to speed up its operations.

So what

Treat anything compiled into a shipped mobile app or a browser bundle as public, because finding it is now a cheap automated job. Scan your built APK, IPA and JavaScript output, not only your repository, for Supabase service_role keys, Stripe secret keys, LLM API keys and cloud credentials. Separately, F5 Labs reported a surge in scanning of exposed Vite dev servers for .env files in August: patch Vite to 7.3.2 or 8.0.5 and never bind a dev server to a public interface.

Read the full analysis Source: Anthropic, threat intelligence report

Brevo SSO flaw let an attacker into 138 customer accounts and send phishing that passed email authentication

Security

10 Sep

Brevo's incident write-up says an attacker exploited how it handled SAML SSO to reach 138 customer accounts. Brevo identified the issue at 06:30 UTC on 10 September and at 08:30 UTC closed the route and signed out every user on the platform. It says six accounts were used to send phishing and contacts were exported from 43. Trezor, one affected customer, said about 347,000 phishing emails went to its subscribers from its own Brevo account.

So what

SPF, DKIM and DMARC all pass when the mail genuinely comes from your own hijacked sending account, so authentication records are no defence here. If you use Brevo, review team members, SSO settings, exports and sending logs for 9 and 10 September and rotate API keys. If you ship SAML SSO in your own product, test that an identity provider configuration can only ever grant access to the organisation that owns it.

Read the full analysis Source: Brevo, incident write-up

The deadline to patch exploited LiteLLM and Starlette flaws passed on 16 September

Security

16 Sep

CISA added two flaws common in AI backends to its Known Exploited Vulnerabilities catalogue on 2 September, with a federal remediation deadline of 16 September. CVE-2026-59822 lets an unauthenticated attacker open an MCP session in LiteLLM below 1.84.0 with a made-up Bearer token. CVE-2026-48710 lets a crafted Host header bypass path-based middleware checks in Starlette 1.0.0 and earlier.

So what

The deadline binds US federal agencies, but a listing in that catalogue means the flaw is being exploited in the wild, which is the part that matters to everyone else. Check every Python service and image: LiteLLM needs 1.84.0 or later and Starlette 1.0.1 or later, and FastAPI depends on Starlette, so FastAPI apps are in scope too. Then look for middleware that authorises on request.url.path.

Source: CISA, KEV alert

Wins

Rounds, launches, and benchmarks worth measuring yourself against.

Mistral raised €3B at more than €21B, the largest equity round by a European tech company

Funding

8 Sep

Mistral AI announced a €3B Series D, about $3.58B, at a post-money valuation above €21B. Samsung Electronics led, with EQT's Scaleup Europe Fund and PSG Equity co-leading. Mistral plans to build 1 GW of compute capacity in Europe by 2030, and customers can choose which regions their queries are processed in.

So what

If you sell to EU enterprises or the public sector, a well-capitalised Europe-based provider with region selection is now a credible answer to data residency questions. Wire it into your model router before a customer asks, not after.

Source: TechCrunch

Cognition raised over $2B at a $48B valuation, and the Dioxus team joined two days later

Funding

8 Sep

Cognition, maker of the Devin coding agent, announced a Series E of more than $2B at a $48B valuation, led by Andreessen Horowitz and Accel with existing investors. It says run-rate revenue grew from $492M to almost $900M since May. On 10 September it said the team behind Dioxus, the open-source Rust app framework, is joining, without disclosing terms, and committed to continuing support for Dioxus.

So what

AI coding remains a multi-vendor market with several heavily funded players, so keep agent workflows portable rather than betting on one. If you build on Dioxus, it is now backed by a coding-agent company: watch its roadmap and governance, not just its release notes.

Source: Cognition, blog

Meta's new Muse agent can now buy from Stripe Link merchants, and 1M+ businesses need no integration

Launch

8 Sep

Stripe announced that Meta built Link's wallet for agents into Muse, the personal AI agent Meta launched the same day. US consumers can connect Link and let Muse buy on their behalf. Stripe says Muse can check out instantly at more than 1 million businesses that accept Link, and elsewhere Link issues Muse a single-use virtual card scoped to the approved purchase.

So what

Agent-initiated orders can now reach your checkout without you doing anything, either through Link or as an ordinary card payment. Review fraud rules, bot checks and refund policy now, so you neither block legitimate agent orders nor get surprised by agent chargebacks.

Read the full analysis Source: Stripe, newsroom

On the radar

Shifts that have not hit you yet but will.

Supabase will remove the logs.all Management API endpoint on 23 Sep, and older MCP get_logs setups will break too

Breaking change

23 Sep

Supabase will remove the analytics/endpoints/logs.all Management API endpoint on 23 September 2026. Its replacement, analytics/endpoints/logs, accepts only ClickHouse SQL over a single unified logs table. The Supabase MCP server's get_logs tool called logs.all internally, so Supabase says to update to mcp-server-supabase v0.10.0. The dashboard Logs Explorer is not affected.

So what

Search your scripts, cron jobs and agent configs for logs.all this week, rewrite those queries in ClickHouse SQL filtering on source_name, and bump mcp-server-supabase for any agent that reads logs. Put 30 October in the calendar too: from then, new public tables on existing projects need an explicit grant before the Data API can see them.

Source: Supabase, changelog

Cloudflare now blocks AI agents by default on ad pages of newly onboarded sites, and its Block setting now also stops Googlebot

Policy

15 Sep

From 15 September, new ad-supported domains on Cloudflare get a preset that allows search, disallows AI training and blocks agent-category bots on pages that show ads. The Block settings now also apply to mixed-use crawlers such as Googlebot, Applebot and Bingbot, so choosing Block stops them entirely, search included. A new Disallow AI Training option keeps search crawling allowed.

So what

If you run browsing or retrieval agents, expect more blocked requests on ad-supported sites and build fallbacks to official APIs or licensed data. If you host content on Cloudflare, use Disallow AI Training rather than Block unless you are willing to lose search traffic.

Read the full analysis Source: Cloudflare, blog

DeepSeek cut its Flash model to $0.15 per million input tokens, and old integrations got the cut automatically

Pricing

14 Sep

DeepSeek retired V4 Flash and now lists DeepSeek-V4.1-Flash, API name deepseek-flash, at $0.15 input and $0.60 output off-peak, down from $0.22 and $0.66. Requests to the legacy name deepseek-v4-flash are still accepted, served by V4.1 Flash and billed at the new price. V4 Pro is unchanged.

So what

A price cut you receive without a code change, which is unusual. It is also a reminder that a provider can swap the model behind a name you pinned, so if output consistency matters, re-run your evals whenever a pricing page changes. We caught this through our own weekly drift check and logged it in the price change log.

Source: DeepSeek, API pricing

Ramp data: token prices down 41% since March as businesses steer usage away from frontier models

Trend

9 Sep

Ramp's September AI Index, covering August, shows its measure of effective price per million tokens down 41% to $0.68 from a March peak of $1.15. Frontier models drove 45% of token share, down from a 53% peak in August, and Ramp says businesses told it they are setting company-wide defaults that steer usage toward cheaper standard models.

So what

Make a standard-tier model your default and escalate to a frontier model only where your evals show a real gain. Your customers' finance teams are already setting the same defaults, so revisit any pricing of your own that assumes per-token costs hold steady.

Source: Ramp, AI Index

Open the tool.

Most of what shows up in Post-mortems maps to one of ten categories the Stack Grader already checks.

Check your stack against these failures