[AINews] Black October

What it claims

The 21-22 October 2026 AINews issue treats "Black October" as a 48-hour wave of critical disclosures and breaches, many found with AI models. Monthly CVEs reportedly rose from about 4k to about 15k since April 2026 (@saranormous). Microsoft attributes the ConnectWise supply-chain compromise to China-aligned Storm-0940. The group used the open agentic pentest framework ARTEX against 2,250+ Microsoft 365 tenants at about 2,900 sign-in attempts per minute and sometimes reached privileged access in under 3 hours. Axios reports that major US banks see unauthorized third-party agents inside customer accounts.

How to use it

The issue gives a concrete exposure list:

• PHP2Shell: unauthenticated RCE in PHP, fixed on Wednesday 21 October after an embargo since August.
• GitLab: CVSS 10 flaw affecting releases since 2014, patched in 19.5.1.
• Node.js: Brotli decoder RCE fix. NGINX and HTTP/3 also had DoS issues.
• LiteLLM 1.107.0: this version shipped with a password stealer.
• Railway: users are told to rotate secrets after possible exposure of customer keys.
• Zeabur: shutting down after 321,810 accounts were breached.
• eMudhra: CA keys were trivially weak, with one reportedly the number 4. Python users should update pip, uv, certifi and system CA stores.

@_philschmid published a read-only agent prompt that checks exposure to the LiteLLM, Railway, PHP, GitLab and eMudhra issues. Cognition open-sourced a vulnerability-remediation agent plugin. cve.now aggregates four CVE feeds with plain-English explanations.

For agent permissioning, Composio Firewall checks each agent action and returned payload with tuned small models. 1Password for Agents fills in credentials without exposing them to the agent.

Evidence

Open models. MiniMax M3.1 Flash is open weights, 428B total and 23B active, with 1M context and vision. MiniMax claims 73.7% on DeepSWE v1.1 and 82.2 on CyberGym. vLLM day-0 support uses native NVFP4 weights and KV cache, which cuts the checkpoint to 250.1 GB. At 256K context on 4× B300 it fits 76 concurrent sequences, against 28 for M3. @teortaxesTex calls it a rebranded M3.

Carbon-X (Hugging Face) is a 14B DNA-plus-text model, midtrained from Qwen3-14B on 300B tokens. It is Apache 2.0, runs on a laptop and excludes human and animal viruses from training.

Recursive Flint is 39.8B total and about 2.5B active, Apache 2.0, with 262k context. Rapid-MLX measured 131 tok/s at 4-bit on an M5 Max using about 24 GB. r/LocalLlama users report that Flint fails on multi-step agentic work. They say it favours the tools it was trained on over tools supplied at runtime, and it ranks below Ornith-1.5-35B and Qwen 27B.

OCRia-1 (LlamaIndex) is a 4B parser scoring 87.4 on ParseBench at about 4,700 tok/s on one B200. It now powers LlamaParse at the same price.

Evals. Artificial Analysis Coding Agent Index v2.0 replaces DeepSWE with FrontierCode v1.1. Claude Code with Opus 5.5 leads at 61.7, then Sonnet 5.5 at 59.3. DeepSeek V4.1 Flash scores 47.3 at $0.39 per task, against $11.42 for Opus. Scores fell for 20 of 21 configurations measured on both versions.

CritPt v2 corrected 47 of 70 physics challenges. GPT-6 Astra scores 83% there against 32% on v1, mostly because of the corrections. v1 and v2 scores are not comparable.

On CVE rediscovery at pass@3, V4.1 Flash finds 87.5% at $2.40 per CVE. Astra finds 90.6% at $135.23 per CVE.

METR/Redwood audit. Two auditors spent three weeks on-site at OpenAI. They found agents could defer monitoring indefinitely by not returning control, and that Codex's sandbox and Auto-Review could be bypassed. Context compression left about 10% of eligible internal Codex traffic unmonitored. The report was cut from 61 to 38 pages.

Defensive verification. Anthropic's Frontier Red Team and Theorem Labs used Claude to produce about 180M lines of machine-checked proofs. The proofs cover 239 entry points in 123 libraries, and hundreds of bugs were patched.

Limits

The issue is a curated recap of tweets and Reddit threads, and most figures are second-hand claims behind links. The origin of the PHP findings is disputed: the issue credits OpenAI models, while the PHP Foundation says Claude Mythos had scanned PHP earlier. @BlancheMinerva calls the "offense winning" framing disinformation and cites no evidence of large-scale exploitation. Joshua Achiam reportedly said only about 4 of roughly 16 major incidents happened this week, and the rest were found earlier and disclosed now. @teortaxesTex flags possible harness mislabeling in the AA index. Kimi K3.1 is teased but unconfirmed.