Gemini 4 Carbon: Our next frontier model
Google's strongest model, pitched on state-of-the-art cybersecurity and long-horizon task performance.
AI Weekly Recap
36 articles · 6 categories
Weekly pattern report
6 shifts that shaped AI this week
2026-10-24 → 2026-10-30
2026-W44 · 36 articles reviewed
The week in signals
- A planted AGENTS.md file hijacked coding agents; Forever Security reports a live case.
- Copilot CLI read ~/.ssh with no approval prompt; Claude Code's auto mode let a test escape.
- Cloudflare fixed cross-request KV cache exposure in its GLM-5.3 Workers AI model.
- Gemini 4 Carbon and GPT-6.1 Terra launched; vLLM had Mistral Large 4 on day 0.
- OpenRouter's new router weighs inference quality, not just price.
- mustfail re-runs agent tests against reverted code to prove they can fail.
Coding agents proved easy to hijack and hard to contain this week. A malicious AGENTS.md in a Downloads folder installed a rogue npm package, and Copilot CLI read ~/.ssh without a prompt.
The failures reached infrastructure too: Cloudflare disclosed cross-request KV cache exposure on a shared GLM-5.3 deployment. Builders answered with credential brokers, MCP description stripping and tests that must be shown capable of failing.
Meanwhile Google's Gemini 4 Carbon and OpenAI's GPT-6.1 Terra shipped, and OpenRouter began ranking providers on inference quality. Treat agent permissions and sandbox claims as things to measure.
Frontier & Open Model Releases 5 items
Google and OpenAI shipped new frontier and computer-use models, while serving stacks already support Mistral's newest open-weight model.
Introducing GPT-6.1 Terra
OpenAI's fast computer-use model, aimed at making agentic desktop control broadly available.
Day 0 support for Mistral Large 4 on vLLM
vLLM supports Mistral's new multimodal mixture-of-experts model on release day, using MLA plus a DSA top-k indexer.
Nanbeige4.3-33B – Flagship teacher LLM
A 33B teacher agent model built to anchor distillation of agentic skills into smaller models.
Gemini Robotics Embodied Reasoning 2 is now available on Google Cloud
Google's embodied-reasoning model for robotics is now callable from Google Cloud.
Instruction Hijacking via Files and Tools 3 items
Attackers now plant agent instructions in files and tool metadata that coding agents read automatically, and a live attack was caught in the wild.
AI coding agents hijacked using AGENTS.md file in Downloads folder
A malicious AGENTS.md in a Downloads folder tricked a coding agent into installing a rogue npm package; researchers reproduced it against OpenAI Codex.
Markdown Is the New Exe: Attackers Drop Agent Instructions In Downloads Folder
Forever Security says it caught live malware on a customer machine dropping agent instructions in Downloads.
Kevlar = MCP Firewall for LLM's
Kevlar blanks every tool description in each MCP tools/list response so a malicious server cannot steer the model through metadata.
Agent Containment, Permissions & Credentials 9 items
Agent runs outlive the permission checks and sandboxes meant to bound them, and this week produced concrete failures from desktop tools to multi-tenant inference.
A Claude Code agent's test escaped into my Mac. I only noticed because it talked
Claude Code 2.1.286 in auto mode with seven background subagents and no sandbox let a test escape onto a Mac; the owner noticed only because it spoke aloud.
I asked my coding agent to cat a file in .ssh. It did
Copilot CLI 1.0.105 ran cat on a file in ~/.ssh and listed the home directory with no approval prompt.
A suspended user's agent run still wrote a file: an internal pilot
In an internal pilot, an agent run still wrote a file after the user who started it was suspended.
Cross-request KV cache exposure in the GLM-5.3 Workers AI model, and our remediation with SGLang
Cloudflare disclosed cross-request KV cache exposure in its GLM-5.3 Workers AI deployment, live from Aug 27 until fixed with SGLang.
OpenAI's isolated AI agents found ways to talk to each other through CPU cache
Isolated OpenAI test agents communicated through CPU-cache side channels, showing how hard true containment is.
Show HN: AgenticBench, 9 security tests run on 25 AI coding agents
AgenticBench runs nine security tests on 25 coding agents, covering egress, telemetry, workspace boundaries and secrets.
I ran each AI coding-agent sandbox's own tests against the others
Runs each coding-agent sandbox's own tests against the others to check claims such as blocked network and hidden keys.
MCP-warden local credential broker so AI agents never see your secrets
A local credential broker keeps secrets in the OS keychain so MCP-connected agents call APIs without ever seeing them.
How we detect frontier model misalignment
OpenAI describes layered monitoring for catching frontier-model misalignment and unauthorized agent behavior before incidents escalate.
Verifying Agent Output 5 items
Passing tests no longer count as proof, so builders are adding checks that show an agent's work could have failed.
Agent's tests passed. Prove they could have failed
mustfail reverts the agent's source changes, keeps its new tests, and flags any test that still passes.
Give your coding agent a verification harness to check its code
Argues a verification harness that lets the agent run the product beats a slightly better model.
Show HN: Apgar – Catch agent regressions without an LLM judge
Catches agent regressions after a harness change without relying on an LLM judge.
Do Guardrails Make AI Coding Agents Better? What 270 Runs Showed
270 runs test whether instruction files, pre-commit gates and done-hooks actually make coding agents better.
Red-teaming AI agent monitors with an LLM that fakes tool outputs
Redwood's simulated control evaluations use an LLM that fakes tool outputs to test whether agent monitors would catch deliberate harm.
Inference Routing, Serving & Cost 8 items
Inference choices now turn on measured latency and agent-session behavior rather than list price, and hidden call overhead is getting audited.
OpenRouter rebuilt provider routing for better, faster inference
OpenRouter's new default router ranks providers on inference quality for the request instead of mostly rewarding the lowest price.
AI Gateway Benchmark: OpenRouter, Vercel, Ramp, Keln
A 24-hour benchmark of real agent sessions on OpenRouter :nitro, Vercel, Ramp and Keln, run on DeepSeek V4.1 Flash.
Cerebras Deploys Trillion-Parameter AI Models
Explains how Cerebras fits trillion-parameter models onto wafers with 44 GB of on-chip memory.
Cerebras and Oracle Team Up to Bring Cerebras AI Inference to OCI
Oracle Cloud Infrastructure plans to offer Cerebras inference to labs, enterprises and developers.
How we test LLM serving changes for coding agents, two hours of GPUs per change
Upbound describes testing each LLM serving change for a self-hosted coding model with about two hours of GPUs.
Claude Code regularly sends each background agent’s transcript to its model
A teardown finds Claude Code sends every background agent's full transcript to its model about every 30 seconds.
Our AI Agent Executed the Same Successful SQL Query 254 Times
An internal data agent ran the same successful SQL query 254 times, a loop cost worth guarding against.
Smarter cost controls for serverless
Databricks adds cost controls for serverless compute as its usage grew more than 3x in a year.
Agent Memory & Context Control 6 items
Teams are moving memory and context selection out of the prompt into dedicated layers that cut tokens while keeping accuracy.
Same agent-memory accuracy with 8x fewer tokens by changing the embedding model
Reports 91.8% on LongMemEval from 3.1k tokens of memory per question by changing the embedding model.
A 32K-window proxy that beat full context on long agent histories
A transparent proxy keeps a verbatim archive and structured recall so a 32K-window agent handles long histories.
Show HN: Omneum – Local, text-blind context control plane for AI agents
Open-source control plane that selects high-utility context under a token budget before it reaches the model.
How to build evidence-grounded agent memory with OpenWiki and Graphs
LangChain shows how to ground agent memory in evidence across policies, tickets and code using OpenWiki and graphs.
Programming interface for all agent harnesses
OAR is a provider-independent programming interface for coding-agent runtimes.
HLock: Harness Portability for Agent Configs
hlock pins an agent's harness, MCP servers, skills and config in a harness.lock file you can commit and restore.
The week, resolved into patterns