The postponed Next.js fixes landed with two critical RCEs, and the tensorlake worm is built to wipe your home directory if you revoke the token it stole.

Anthropic launched Claude Haiku 5.5 on 7 October. For prompts up to 100,000 tokens it costs $0.10 input and $0.50 output per million tokens, against $1 and $5 for Haiku 4.5. For prompts over 100,000 tokens it costs $0.50 and $2.50. The pricing page says the prompt length of a request "counts all of its input tokens, including cache reads and cache writes", that each request is priced on its own, and that a request over the threshold pays the higher prices "even when part of its prompt is a cache hit". The migration guide adds that Haiku 5.5 uses the same tokenizer as Claude 4.7 and later, which produces approximately 30 percent more tokens for the same text than Haiku 4.5.

Google made Gemini 4 Argon (gemini-4-argon) generally available on 13 October, describing it as its most capable model for complex coding, agentic, math and science tasks. The pricing page lists it at $2 input and $10 output per million tokens "through November 30, 2026" and $4 and $20 "starting December 1, 2026", with output pricing that includes thinking tokens. Context caching goes from $0.10 to $0.20, batch from $1 and $5 to $2 and $10, and Priority from $3.60 and $18 to $7.20 and $36. Only implicit caching is supported, and the model is not available on the free tier or the Google AI Pro plan. That puts it level with Claude Sonnet 5.5 and GPT-6.1 Sol, both listed at $2 and $10 on their own pricing pages today, with no change scheduled on the pages we read.

On 7 October Anthropic lowered Claude Sonnet 5.5 prompt cache reads from $0.20 to $0.10 per million tokens, which its release notes describe as "0.05x the base input price instead of 0.1x", with cache writes and all other prices unchanged. The pricing page lists Claude Opus 5.5 at the same 0.05x multiplier. Cache writes stay at 1.25x the base input price for the five minute duration and 2x for one hour. That brings the Sonnet 5.5 read to the same $0.10 as the cached input rate on GPT-6.1 Sol, which we reported in issue 5 when we said Anthropic at $0.20 against OpenAI at $0.10 could decide the choice.

Vercel published the out of band Next.js security update on 14 October, as 16.4.1 on Active LTS and 15.5.28 on Maintenance LTS. It fixes three upstream vulnerabilities, two critical and one high, and the pre-announcement said two of the fixes were postponed from the September security release. The first critical flaw, GHSA-673q-mjm6-r5xr, is unauthenticated remote code execution in applications using App Router with Cache Components when a use cache function returns multiple typed arrays, and the post says "There is no known workaround for affected applications." The second, CVE-2026-96889 / GHSA-2464-fhr4-w9xw, is remote code execution in the Image Optimization API when using SVG, which the post scopes to Next.js running on glibc based Linux and gives a workaround for: sharp 0.35.5 or later. The high severity flaw, GHSA-p3m5-59mp-jv5r, is a denial of service in App Router applications with at least one Server Action, and the post says applications using Pages Router or no Server Actions are not vulnerable. The post names only 16.4.1 and 15.5.28, and npm lists no 16.3 release after 16.3.8.

StepSecurity reports that tensorlake 0.5.144 on npm steals credentials at install time, tries to spread to other packages and repositories, and sets a trap. The first malicious commit reached the main branch of tensorlakeai/tensorlake at 01:20 UTC on 7 October under a maintainer name, seven more followed without pull requests, and the repository release workflow published 0.5.144 at 01:12 UTC on 8 October. Because it was built from the repository, the release carries a valid npm provenance attestation, and StepSecurity notes "It doesn't say the code is safe." A preinstall hook runs setup.mjs, which skips CI, fetches the Bun runtime and runs an obfuscated 856 KB payload that collects GitHub and npm tokens, cloud keys, Kubernetes and Vault secrets, SSH keys, saved browser logins and configuration for AI tools including Claude, Cursor and Windsurf. If it holds a GitHub token it installs a service called gh-token-monitor, which checks the token every 60 seconds for up to 24 hours and runs rm -rf ~/ if GitHub rejects it. It also writes .claude/settings.json and .vscode/tasks.json into repositories it can reach. npm no longer lists version 0.5.144.

CISA added five vulnerabilities to its Known Exploited Vulnerabilities catalogue on 8 October: ISC BIND CVE-2015-5477, Apache Struts CVE-2016-3081, ProFTPD CVE-2015-3306, ONLYOFFICE Docs CVE-2021-3199 and Strapi CVE-2023-22894. The Strapi entry describes cleartext storage of sensitive information that lets attackers with access to the admin panel discover sensitive user details through the query filter, notes that the product could be end of life, advises users to "discontinue use and/or transition to a supported version", and says it can be chained with CVE-2023-22621 to achieve remote code execution. The ONLYOFFICE Docs entry describes a path traversal when JWT is used, via a /.. sequence in an image upload parameter, that could allow remote code execution. Later in the week the catalogue gained Ivanti Connect Secure and a Windows Shell flaw on 13 October, then Cisco Secure Email Gateway, two chained Ahsay AhsayCBS flaws and Palo Alto PAN-OS on 14 October.

Anthropic launched Claude Haiku 5.5 (claude-haiku-5-5) on 7 October with a 1M token context window, 128K maximum output and adaptive thinking controlled by the effort parameter. The model id is fixed, with no date suffix and no alias. Compared with Haiku 4.5, a request now returns a 400 error if it sends manual thinking with budget_tokens, sets top_k at all or sets temperature or top_p to anything but their defaults, ends the messages with an assistant prefill even when thinking is off, or declares the computer_20250124 tool. Sending a thinking block back after changing the system prompt, the tools or earlier messages also returns a 400. Thinking text is omitted unless you set thinking.display to "summarized". The guide says Haiku 5.5 runs safety classifiers that can decline a request, that it has no server side fallback, and that Priority Tier is not supported.

OpenAI added Ultrafast mode for GPT-6.1 Sol in the Responses API on 8 October. Setting service_tier to "ultrafast" on gpt-6.1-sol reduces the time between generated output tokens, and the changelog says it is available to all API users, subject to rate limits, "with global processing and US and EU data residency". The pricing page lists it at $12 input, $0.60 cached input and $60 output per million tokens for short context prompts, and $24, $1.20 and $90 for long context, against $2, $0.10 and $10 on standard. In issue 5 we reported that Ultrafast for GPT-6 Astra does not support EU or other regional inference residency. That is still what the changelog says for Astra, so the two modes differ. The pricing page also notes a 10 percent uplift on regional processing endpoints for models released on or after 5 March 2026.

On 9 October Anthropic put dynamic workflows into beta for Claude Managed Agents. You enable them in the agent definition with multiagent set to {"type": "multiagent_20261001", "workflows": {"type": "enabled"}}, under the managed-agents-2026-04-01 beta header. The documentation describes a workflow as "a program that runs many agents in phases and combines what they return", which the server runs in the background as a workflow run while the agent keeps working or ends its turn. With the multiagent_20261001 type, workflows and subagents are both enabled by default, and so are inline agents that a workflow defines itself. You can list up to 20 predefined agents for a workflow to use. Separately, on 14 October Anthropic made Managed Agents scheduled deployments available on Claude Platform on AWS.

On 14 October Anthropic released OpenTelemetry export for the Claude API in beta, covering Messages API requests, tool uses and Managed Agents sessions. The Claude SDK emits spans in Python, TypeScript, C#, Go, Java, PHP and Ruby, and API tracing is set up as a destination in the Claude Console, which needs Admin permission. The default content mode is metadata only, with spans holding identifiers, timing, status and token counts. Full content mode adds prompts and responses, up to 0.75 MB per span by default before the content is truncated and anthropic.content.truncated is set to true. The documentation says span delivery is best effort and that exported spans are not a complete record of API usage.

GitHub put Actions workflow dependency lockfiles into public preview on 14 October for GitHub Enterprise Cloud, Enterprise Cloud with data residency, Team and Free plans. The changelog says "Tags and branches can move after you review a workflow, so a later run might execute different code". A lockfile records the exact commits for actions and their transitive dependencies, including reusable workflows, in .github/workflows/actions.lock, and you create and maintain it with the gh actions-lock extension for the GitHub CLI. Once a workflow is onboarded, Actions requires every dependency to be in the lockfile and runs the recorded commit even if a tag or branch moves. A Require lockfile policy is also in public preview for enterprise, organization and repository administrators, and Dependabot regenerates the matching lockfile entry in the same pull request when it updates an action in an onboarded workflow. GitHub is clear that locking "does not determine whether the dependency itself is safe".

GitHub announced on 13 October that secret scanning detects two new Anthropic secret types, anthropic_service_api_key and anthropic_user_api_key, and that both are included in push protection by default. The changelog says repositories with secret scanning enabled, "including free public repositories", will have commits containing these secrets automatically blocked. It also adds Salesforce as a secret scanning partner with the type salesforce_marketing_cloud_api_oauth2_token, and a Cloudsmith detector, cloudsmith_api_key. Under the partner program, secrets found in public repositories are reported to the issuer so it can revoke or rotate them.

OpenAI notified developers on 14 October that gpt-4o-2024-08-06, gpt-4o-2024-11-20, gpt-4o-mini-2024-07-18, gpt-4.1-2025-04-14 and gpt-4.1-mini-2025-04-14 are deprecated and will be removed from the API on 14 January 2027, naming gpt-6-luna as the recommended replacement for all of them. Fine tuned versions "follow the same shutdown schedule as their underlying base models". The 1 October entries are still open: tts-1, tts-1-hd and two gpt-4o-mini-tts snapshots go on 6 January 2027 with gpt-realtime-2.1-mini as the replacement, and gpt-5.3-codex, gpt-5.1 and gpt-5.4-nano go on 1 April 2027. Dates already on the calendar include the GPT-5 and o3 snapshots on 11 December 2026, and the Evals dashboard, Agent Builder and the reusable prompts API on 30 November 2026, with existing evals going read only on 31 October.

The Gemini API release notes for 8 October say gemini-3.7-flash is deprecated and replaced by gemini-3.8-flash, and gemini-3.5-flash is deprecated and replaced by gemini-3.6-flash. Neither can be selected in Google AI Studio any more, and API requests to the old ids are "automatically routed to gemini-3.8-flash" and to gemini-3.6-flash respectively. The deep-research-pro-preview-12-2025 agent is deprecated and shuts down on 23 October 2026, with deep-research-preview-04-2026 (speed and efficiency) and deep-research-max-preview-04-2026 (maximum comprehensiveness) named as replacements; the change is the agent parameter in interactions.create requests. On 6 October Google also deprecated gemini-3.1-flash-image in favour of gemini-nano-banana-2.1, with no shutdown date announced.

Anthropic changed how Managed Agents web tools behave on 7 October. With limited networking, the environment allowed_hosts setting now also applies to web_search and web_fetch, a blocked web_fetch returns a url_not_allowed error result, and creating a session fails with a 400 error when an enabled web tool has an allowed_domains entry that is not within allowed_hosts. Also from that date, web_fetch "now fetches only URLs that have already appeared in the session", and otherwise returns a url_not_in_prior_context error result. The two lists match differently: a tool entry covers its subdomains, while an allowed_hosts entry matches one exact host unless it starts with "*.". The documentation example is that the tool entry docs.example.com is not within an allowed_hosts of ["example.com"].

Supabase published a breaking change notice on 12 October saying that from 10 November 2026 at the earliest it will stop offering four CBC mode TLS 1.2 cipher suites on project HTTP APIs, meaning <ref>.supabase.co and custom domains: ECDHE-ECDSA-AES128-SHA256, ECDHE-RSA-AES128-SHA256, ECDHE-ECDSA-AES256-SHA384 and ECDHE-RSA-AES256-SHA384. Auth, the Data API, Storage, Realtime and Edge Functions are affected. Direct Postgres connections, pooler connections and the Management API are not, and TLS 1.3 is unchanged. Supabase says fewer than 0.0001 percent of connections in the past 30 days negotiated these ciphers, that affected customers were emailed on 14 October, and that six GCM and ChaCha20 suites remain.

Apple posted on 13 October that the Apple Developer Program License Agreement has been revised "to support new features and updated policies, and to provide clarification", and asked developers to sign in and accept the updated terms. The listed changes include updated security and related requirements in Section 3.2, terms for the Live Assistance API and the App Replacement Entitlement, terms for iOS app widgets and CarPlay on Apple HomeView, and new terms for offering multiple seats on a subscription through Group Purchases and subscriptions through Volume Purchasing. Schedules 2 and 3 also now say Apple will report legally required information such as tax, sales and contact details to tax authorities, and restrict use of any customer tax information Apple shares with developers to purposes mandated by law. The post gives no acceptance deadline and says translations will follow within one month.

Apple said on 5 October that iPhone Duo will be available to customers from 23 October 2026. Existing apps can be recompiled with Xcode 27.1, which adds development support, and Device Hub shows how an app behaves across all poses and orientations. You can submit iPhone Duo optimized apps in App Store Connect now, and submitting iPhone Duo screenshots adds a badge to your product page. Apple then states: "Starting April 2027, any apps or games submitted will need to include screenshots for iPhone Duo." The post lists no pixel dimensions and points to its screenshot specification page.