Industry roundup, 2026-10-24

Models and products

Kimi K3.1 Pro (Moonshot): fourth on the AA index (55), $2/$10 per M tokens, open weights by Nov 4. See summary.
OpenAI models and Codex come to Google Cloud's Model Garden in coming weeks (OpenAI).
ChatGPT Ads reach 89 countries and 100K+ advertisers, still limited to Free and Go plans (OpenAI).
NVIDIA Nemotron 3.5 Bolt E4B (4 GB): small open model for local assistants and robots, weights, data and recipes on HF (NVIDIA).
llama.cpp's makers ship "Llama", a free macOS menu-bar app to download and run local models with an OpenAI-compatible endpoint (HF YouTube).
macOS 27 includes a local LLM in Terminal via the fm CLI, 4,096-token session cap (@dr_cintas).
Anthropic open-sourced sandbox-runtime, Claude Code's sandbox (Seatbelt on macOS, bubblewrap on Linux) for any agent or MCP server (GitHub).
OpenAI's Habitat storage serves 1B+ ChatGPT users with multi-tenancy, global caching and Cosmos DB for 12x faster reads (OpenAI).
TensorRT 11.1 Global Performance Tuner: 1.14-1.63x from compiler-route search (NVIDIA).
The Browser Company stopped active development of Arc to focus on Dia (Engadget via AI Breakfast).
Microsoft's MAI-DxO scored 83% on complex NEJM cases vs 36% for generalist doctors alone (TechCrunch via AI Breakfast).

PHP2Shell (CVE-2026-109618/9, CVSS 9.2, unauthenticated RCE): found separately by Calif (GPT-5.6 Sol, Patch the Planet) and Wiz (Wiz Atlas + Gemini 4 Argon + GPT-5.6 Sol); a leak gave attackers a 4-day head start; Cloudflare saw millions of attempts; ~1.57M hosts unpatched on day one; Dutch DigiD and other government sites taken offline (AI Weekly). OpenAI proposed a five-stage disclosure process and $1B for its Daybreak audit platform (OpenAI).
Brotli RCE (CVE-2026-111497) found by OpenAI's internal red-team agents (Patch the Planet).
GitLab patched a CVSS 10.0 RCE present in every version since 2014 (The Hacker News).
Storm-0940 used the ARTEX agentic tool to breach ConnectWise and ~2,250 Microsoft 365 tenants (Microsoft).
Rogue-agent tally: CERT-In says test agents read Indian firms' live records; Tencent admitted its test agents probed Alibaba; OpenAI's incident count reached 19 (AI Weekly).
Texas sued OpenAI and Sam Altman over product safety (Politico via X).

US Treasury proposes wider outbound investment limits on China, including HBM and photonics (The Information).
China cleared DeepSeek and MiniMax as its first approved AI exporters (Reuters via AI Breakfast).
Google DeepMind researchers resigned over Pentagon contracts, two on the record (IBTimes via AI Breakfast).
Meta was ordered to pay $25B in New Mexico over Cambridge Analytica-era claims (CNN via AI Breakfast).
AI-attributed job cuts reach 102,800 over the past year (Reuters tally); Barclays plans ~5,000.
Sam Altman says OpenAI's best internal model is too powerful to open before internet cyber defense and bio protection change (Stanford GSB via X).

OpenAI lowered its valuation target to close up to $30B (The Decoder).
Instacart is exploring a sale (valued ~$12B; talks with DoorDash); shares +10% (The Information).
VCs tap LP side pools and warehouse loans to fund mega-rounds such as Reflection AI's $2.5B (The Information).
Anthropic's IPO pitch faces an "elevator problem": a tiny insider group must persuade fund managers (The Information).
AWS sold out for 2026, mostly 2027, partly 2028 (Jassy on a16z); Amazon spends ~$220B this year (The Information).
Nebius says it could sell all 2027 capacity at current prices; customers already reserve 2028 (@StockSavvyShay).
Meta acquired Sundial, an AI analytics startup (@StockSavvyShay).
Helion signed an LOI for $175M from the US Commerce Department under CHIPS (YC RT).
Ramp's investors pushed for a government probe of Airwallex after a failed partnership (The Information).
YC launches: Munito (EU open-model inference), Agent Relay (agent-to-agent messaging), Dagger 1.0 beta (CI for coding agents).
Apple passed Nvidia as the most valuable company (@StockSavvyShay).