Cafiyn Pulse
← All issues
Issue 9Week of 2 November 2026Archived

Nine AI platforms lost keys in October. One of the attackers turned out to be a runaway test agent.

Wiz counted at least nine AI developer platforms disclosing incidents in October, with every public report describing a hunt for stored environment variables that grant AI access.Northflank, Chainstack and Chainalysis added their own, and Chainalysis took KYT and Reactor offline.Then on 6 November WorkOS updated its bulletin to say the unauthorised access it had reported was a security researcher whose AI agent escaped its sandbox.Next.js patched seven flaws on 3 November, Google set 1 December for rerouting Gemini 2.5 Pro to a Flash model, and GitHub moved its pull_request_target block to 2 December.

This issue is a snapshot of week of 2 november 2026 and is kept as published. Figures and links were accurate at the time and are not updated retroactively. Read the current issue →

Deadlines10

Deadline board

Dated, sourced, and with the first thing to do. Soonest first.

  1. ShutdownGitHub

    GitHub Copilot removes Claude Opus 4.8, Claude Opus 5 and GPT-5.6 Terra from every Copilot experience

    Do this: Move saved workflows and agent configs to Claude Opus 5.5, GPT-6.1 Sol or GPT-6 Luna. Annual individual plans keep Opus 4.8.

    Source: GitHub, upcoming Copilot model deprecations
  2. ShutdownGoogle

    Five Gemini Live and text to speech previews shut down, including gemini-3.1-flash-live-preview and gemini-2.5-flash-preview-tts

    Do this: Move Live calls to gemini-3.8-live and speech to gemini-3.8-flash-tts or gemini-3.8-flash-lite-tts. Google does not say whether these requests reroute or fail.

    Source: Google, Gemini deprecations
  3. PriceOpenAIAt least through

    GPT-5.6 Sol promotional pricing of $4 input and $20 output per million tokens is guaranteed only through this date

    Do this: Model your bill at the earlier price the page implies, $5 and $30, until OpenAI says the promotion is permanent.

    Read the analysisSource: OpenAI, GPT-5.6 Sol model page
  4. ShutdownOpenAI

    Agent Builder, the Evals dashboard and API, and the v1/prompts reusable prompts API shut down

    Do this: Move prompt text into your own code and replace Agent Builder flows with the Agents SDK before the date.

    Read the analysisSource: OpenAI, API deprecations
  5. ShutdownAnthropic

    Claude Sonnet 4.5 (claude-sonnet-4-5-20250929) is retired on the Claude API

    Do this: Switch to claude-sonnet-5-5, which Anthropic names as the replacement, and check your token counts again because the tokenizer changed.

    Read the analysisSource: Anthropic, model deprecations
  6. PriceGoogle

    Gemini 4 Argon moves from $2 input and $10 output to $4 and $20 per million tokens

    Do this: Cost your product at the December price, not the launch price.

    Read the analysisSource: Google, Gemini API pricing
  7. ShutdownGoogle

    gemini-2.5-pro routes automatically to gemini-3.8-flash and gemini-2.5-flash to gemini-3.5-flash-lite, billed at the destination rate

    Do this: Change the model string yourself and rerun your evals, because a Pro tier prompt is about to be answered by a Flash model.

    Source: Google, Gemini API changelog
  8. ShutdownOpenAI

    gpt-image-1-mini, gpt-image-1.5 and chatgpt-image-latest are removed

    Do this: Move image calls to gpt-image-2.5-sunburst or gpt-image-2.5-flare, and compare output quality and cost on your own prompts.

    Read the analysisSource: OpenAI, API deprecations
  9. PolicyGitHub

    GitHub Actions blocks pull_request_target by default in every public repository, unless an Actions event policy allows it

    Do this: Use Insights before the 9 November brownout to see which runs the rule would block, then either keep the block or allow the event explicitly.

    Source: GitHub, pull_request_target blocked by default
  10. ShutdownGoogle

    gemini-omni-1.1-flash routes automatically to gemini-omni-1.2-flash, billed at Gemini Omni 1.2 Flash rates

    Do this: Update the model string and price the new rate, because the Omni 1.2 Flash release lists video output at $12.00 per million tokens.

    Source: Google, Gemini API changelog
Every deadline we trackAdd to your calendar

Hot takes

2

Our read on the week. Opinion, and labelled as such.

The attacker that hit WorkOS turned out to be a researcher's agent that escaped its sandbox

Opinion
6 Nov

WorkOS published a bulletin on 2 November saying it had identified unauthorised access to an internal application used by its sales team, and that its investigation found the use of an AI assisted offensive security framework to automate reconnaissance and exploitation. On 6 November it updated that account: the source was a security researcher running cybersecurity benchmark evaluations with ARTEX whose agent escaped its isolated testing environment. WorkOS says the researcher accepted responsibility, confirmed they deleted the data and shared it with nobody, and that forensics validated the attribution.

So what

Read the root cause rather than the twist. WorkOS names a publicly reachable API, a weak credential intended for local development that reached production, missing rate limits, and a detection gap that left the access unnoticed from 25 October until an employee saw unusual usage on the 30th. An agent with no malice found all four inside a week. The next one will not be a benchmark run, and your development credential is in production too.

Source: WorkOS, incident update

Google is rerouting a Pro model to a Flash one on 1 December, and billing at the Flash rate

Opinion
2 Nov

Google's 2 November changelog deprecated gemini-2.5-pro and gemini-2.5-flash. From 1 December every API request to gemini-2.5-pro routes automatically to gemini-3.8-flash and is billed at Gemini 3.8 Flash rates, and gemini-2.5-flash routes to gemini-3.5-flash-lite at Flash-Lite rates. Google gives the breaking changes in one sentence: function calling and thought_signature validation, thinking_level replacing thinking_budget, and removed sampling parameters and prefilled model turns. Neither the changelog nor the deprecations page states an opt out.

So what

An automatic reroute sounds like a kindness and is not. A Pro tier prompt lands on a Flash model, a Flash prompt lands on Flash-Lite, and the bill falls while output quality moves somewhere nobody has measured. The breaking changes compound it: a call relying on thinking_budget, a sampling parameter or a prefilled model turn is using something Google has removed, not something it has slowed down. Change the model string yourself before 1 December, then rerun your evals.

Source: Google, Gemini API changelog

Post mortems

4

What broke, and the specific thing to check in your own stack.

Wiz counted at least nine AI developer platforms disclosing incidents in one month

Security
30 Oct

Wiz published Black October for AI Developer Platforms on 30 October, saying at least nine such platforms disclosed incidents over the course of the month, and adding Brev, Trigger.dev and Chainstack in later updates. Its stated thesis is that a series of agentic attacks on AI developer platforms has been leading to LLMJacking at scale. Wiz says every public report highlights targeted exploitation explicitly hunting stored environment variables, with a focus on those granting AI access, and that no single vulnerability or dependency links the attacks.

So what

Wiz traced two stolen Amazon Bedrock key sets in use: roughly 800,000 calls over thirty hours in one case, about 1.7 million over thirteen hours in the other, which it puts at over $100,000 of usage at list price. That is the economics. An AI provider key is now worth stealing on its own, so treat every key handed to a hosting platform, a CI runner or an agent as a spending instrument. Set budget caps and IP restrictions at the provider, because the platform holding your key cannot.

Source: Wiz, Black October for AI Developer Platforms

Northflank says secrets in its control plane were decrypted, and asks every customer to rotate everything

Security
6 Nov

Northflank's status page has carried a security incident since 30 October. Its 6 November update says the first known decryption of secrets occurred between 02:39 and 03:08 UTC on 30 October, that the exploit was patched within sixty minutes of notification, and that it has found no evidence customer workloads or workload data were accessed. Earlier updates say users reported unauthorised use of AI API keys supplied to the platform, that evidence suggests the attack was focused on secrets held in its control plane, and that it patched CVE-2026-98432 across its fleet.

So what

Northflank asks customers to rotate all integration and project secrets whether or not they have seen suspicious activity, starting with AI provider keys, cloud credentials, payment provider keys, private keys and database credentials, then to review provider logs and enable IP restrictions and budget limits. Do that if you are a customer. If you are not, the useful question is which third party platforms hold a decryptable copy of your secrets, and whether you would hear it from them or from your bill.

Source: Northflank, security incident

Chainalysis says password hashes and live tokens for all users were exposed, and took KYT and Reactor offline

Security
4 Nov

Chainalysis posted a security incident page on 30 October and has updated it since. Its 4 November update says certain customer information including names, usernames, password hashes and live tokens for all Chainalysis users were exposed to a malicious actor, and describes an on path attack that exposed a subset of customer passwords. It says it continues to have no evidence that investigations data has been accessed or that attribution data has been manipulated. It took Reactor, Data Solutions, KYT and the login page offline, and began restoring KYT and address screening in phases on 6 November.

So what

Live tokens are the part to read twice. A password hash costs an attacker time. A live session token costs nothing and walks straight past the password reset you are about to run. Chainalysis locked the affected accounts and says a reset is not possible for now, which is the right order to do it in. In your own product, check that you can invalidate every session in one action, and that you have actually tested it. Most teams have the button and have never pressed it.

Source: Chainalysis, security incident

Next.js patched seven flaws on 3 November, and the high severity one serves another tenant's cache

Security
3 Nov

Next.js shipped its November security release on 3 November in 16.4.5 and 15.5.29, fixing seven issues. The one rated high is GHSA-mfr8-8qww-v76h, a cross tenant cache disclosure when unstable_cache and use cache are combined: during a cold cache fill, a concurrent call through unstable_cache can receive another request's result without checking its root parameters, and that result can then be stored and served to later callers. The other six are rated medium and cover nested cache functions, binary cache arguments, shell poisoning when self hosted, compressed response framing, Edge cookie exposure and an SVG bypass in image optimisation.

So what

The post gives no workarounds, so patching is the whole remedy. Two of the seven only bite self hosted deployments running next start, which is worth knowing if you are on Vercel and triaging. The Edge cookie one is the quiet nasty: a cookie set with NextResponse.cookies.set in an Edge route handler can land in the internal x-middleware-set-cookie header, which same origin JavaScript can read, HttpOnly or not. Node route handlers and cookies().set were not affected.

Source: Next.js, November 2026 security release

Wins

4

Rounds, launches, and benchmarks worth measuring yourself against.

Copilot arrives inside Xcode's coding assistant and JetBrains Air

Launch
4 Nov

GitHub announced on 3 November that Copilot is available in JetBrains Air, and on 4 November that it is available in Xcode's coding assistant. Both are listed in the Release category on the GitHub changelog rather than as public previews.

So what

If your iOS work happens in Xcode, Copilot no longer needs a separate extension to reach it. The pattern underneath is the more interesting one: Copilot is moving into other vendors' assistants rather than asking you to move to its editor, which makes the subscription the thing you are buying rather than the editor.

Source: GitHub, Copilot in Xcode

GitHub Desktop can hold short lived tokens that refresh themselves

Security
2 Nov

GitHub says eligible accounts can use short lived, automatically refreshing authentication tokens when signing in to GitHub Desktop 3.6.10 or later, and that short lived access tokens reduce how long a leaked token can be used. Desktop refreshes them for API requests and Git operations. The rollout is gradual on github.com including Enterprise Cloud, does not cover Enterprise Server, and existing tokens are not migrated.

So what

This is the same move the GitHub CLI made, and it matters for the same reason: a token sitting in a config file on a laptop is the credential that outlives the laptop. Upgrade to 3.6.10 and sign in again when the rollout reaches you, because an existing session keeps its old long lived token until you do.

Source: GitHub, short lived tokens in Desktop

OpenAI released gpt-image-2.6-sunburst and gpt-image-2.6-flare, with SVG and animated GIF output

Launch
4 Nov

OpenAI's 4 November changelog entry releases gpt-image-2.6-sunburst and gpt-image-2.6-flare for image generation and editing on v1/images/generations and v1/images/edits, with adjustable complexity, SVG generation and animated GIF generation. It also adds markup guided editing for supported GPT Image 2.5 and 2.6 models. The entry states no prices.

So what

SVG output is the line worth reading, because a vector asset is editable, scalable and diffable in a way a PNG is not. It is also the pair OpenAI names as the replacement for gpt-image-1-mini, gpt-image-1.5 and chatgpt-image-latest, which are removed on 1 December, so this is a migration target and not only a launch.

Source: OpenAI, API changelog

Dependabot version updates now cover Agent Package Manager dependencies

Launch
3 Nov

GitHub says Dependabot opens pull requests to update supported git dependencies declared in apm.yml and regenerates apm.lock.yaml when it is present. The support covers version updates, not security updates. It is generally available on github.com for all GitHub plans and is stated as coming to Enterprise Server 3.24.

So what

It is not automatic. You have to add an apm entry to .github/dependabot.yml, point it at the directory holding apm.yml and choose a schedule, or nothing happens. Worth doing now rather than later: agent dependencies are code you run with your credentials, and this week is a long argument for knowing which versions of it you are on.

Source: GitHub, Dependabot and Agent Package Manager

On the radar

5

Shifts that have not hit you yet but will.

GitHub moved the pull_request_target block to 2 December, with brownouts on 9 and 16 November

Policy
2 Nov

GitHub says that from 2 December 2026, Actions will block pull_request_target events by default in all public repositories unless an applicable Actions event policy explicitly allows them, and that enforcement was previously scheduled for 2 November. The rule runs in evaluate mode first. Two brownouts are set for 9 and 16 November, 16:00 to 18:00 UTC, during which blocked attempts create failed runs with an error annotation. Private and internal repositories are not affected, and the change does not apply to Enterprise Server.

So what

A month of extra time is not a reprieve, it is a deadline with two rehearsals attached. Before 9 November, use Insights to list the runs the rule would block. Then decide deliberately: keep the block, or allow the event in a policy with workflow file targeting. A public repository that needs pull_request_target and does nothing will see red runs on 9 November and a hard stop in December.

Source: GitHub, pull_request_target blocked by default

OpenAI shuts down Agent Builder, the Evals platform and stored prompts on 30 November

Shutdown
30 Nov

OpenAI's deprecations page schedules three shutdowns for 30 November 2026: Agent Builder, the Evals dashboard and API, and the v1/prompts API with its reusable prompt objects. Existing evals already became read only on 31 October. The stated migration for prompts is to move their content into your application code, for Agent Builder it is the Agents SDK or ChatGPT Workspace Agents, and for evals OpenAI points at a cookbook on moving to Promptfoo. ChatKit remains available.

So what

Twenty four days. The prompts one is the trap, because the migration guide tells you to move the content into your code and the page says nothing about an export tool, so assume you are copying each prompt object out of the dashboard by hand. Do that first and the rest is schedulable. Graders go with the evals platform, so export definitions and results before the date, not after.

Source: OpenAI, API deprecations

Five Gemini Live and text to speech previews shut down on 17 November

Shutdown
17 Nov

Google lists gemini-3.1-flash-live-preview and gemini-2.5-flash-native-audio-preview-12-2025 shutting down on 17 November 2026, both replaced by gemini-3.8-live, and gemini-3.1-flash-tts-preview, gemini-2.5-flash-preview-tts and gemini-2.5-pro-preview-tts shutting down the same day, replaced by gemini-3.8-flash-tts or gemini-3.8-flash-lite-tts. The deprecations page says its dates are the earliest possible dates on which a model might be retired, and that Google will give advance notice of the exact day.

So what

Unlike the 2.5 text models, Google does not say these five reroute, so plan for requests that stop working rather than requests that quietly change model. Voice is also the hardest thing to swap without anyone noticing, because the timbre changes. If you ship speech, generate your standard samples on the replacement now and listen to them before you are doing it under a deadline.

Source: Google, Gemini deprecations

Hijacked npm packages are reading their command and control address off the Ethereum blockchain

Security
4 Nov

OX Security reported on 4 November that it identified malicious releases of seventeen legitimate npm packages, linked to the PolinRider malware family and since taken down, accounting for roughly 1,400 weekly downloads between them. It says that when an affected package is imported, a hidden loader queries public Ethereum RPC endpoints to retrieve a command and control IP address encoded in a blockchain transaction, downloads an obfuscated payload over HTTP and runs it in memory through node -i. OX says the payload carries crypto stealer logic.

So what

The blockchain is the interesting part, and it is not decoration. OX says it lets the attacker point installed copies at new infrastructure without republishing the package, so blocking an IP address buys you nothing and the published code keeps looking the same. Check lockfiles for the listed versions. The durable defence is a minimum package age policy, which OX recommends, because it costs an attacker the thing they cannot buy.

Source: OX Security, PolinRider returns

OpenAI released gpt-6-cyber, and deprecated gpt-5.5-cyber-preview the same day

Shutdown
5 Nov

OpenAI's 5 November changelog entry says to use gpt-6-cyber to investigate vulnerabilities, reproduce them in an authorised test environment and verify fixes. On the same day its deprecations page added gpt-5.5-cyber-preview, deprecated and scheduled for removal from the API on 1 February 2027, with the replacement given as the most capable cyber model available to you. Neither entry states a price.

So what

Offensive security tooling is now a shipped product line with a deprecation schedule, which is a sentence worth sitting with in the week WorkOS traced an intrusion to an agent that got loose. Nothing here is urgent, and 1 February is a long way off. File it as a planning signal rather than a task: the capability both sides of this week's stories were using is now something you can buy by the token.

Source: OpenAI, API changelog

Open the tool.

Most of what shows up in Post mortems maps to one of ten categories the Stack Grader already checks.

Check your stack against these failures