Leaked Keys, Lingering Trust, Open Giants · Morning Gist
Saturday, October 315 stories · 16 min
Leaked Keys, Lingering Trust, Open Giants
Broken certificates that clients still accept, a rethink on leaked cyber-models, Mistral's trillion-parameter open model, and two practical infrastructure lessons from Stripe and Cloudflare.
Picked from 31 new articles across 23 sources · arrow keys for other days
Today in 30 seconds
30s left
A week after eMudhra's keys leaked and forged certificates appeared, over half of Cloudflare's probes from large networks still trust them. story 1 ↓
After "Black October" bugs, Nathan Lambert mostly stands by leaked cyber-models being "fine" but admits the transition is costly. story 2 ↓
Mistral Large 4, an open 1T-parameter model, matches a rival's agent-coding score on half the tokens but trails top Chinese models. story 3 ↓
Stripe moved $1B of its own vendor payments onto Payouts; most failures came from bad recipient data, now checked upfront. story 4 ↓
Cloudflare's new private_routing DNS flag lets its proxy reach private-IP-only servers over customers' existing private links. story 5 ↓
1/5Cloudflare· Maxime Guerreiro· Oct 30
Many clients still trust eMudhra's crackable keys, Cloudflare's 50 million probes show
The certificate authority eMudhra signed certificates with eight trivially guessable private keys. Cloudflare patched its own systems within hours. Its probes of visitors show that bots, old browsers and in-app browsers still widely trust the bad keys.
Why it matters · It shows how slowly trust in a broken certificate leaves real software, and how a static list of trusted authorities cannot be fixed quickly when one fails.
Know this first
Context from the editor, not the article · 45 sec
1 · Certificates and authorities
HTTPS works because a certificate authority (CA) signs a certificate saying "this public key belongs to example.com". Browsers and operating systems carry a trust store, a built-in list of CAs they believe. Usually a root CA signs intermediate certificates, and those intermediate keys sign the certificates websites use. If you hold a trusted intermediate's private key, you can sign a certificate for any domain.
2 · Why tiny keys break
A signing key's secret part is a huge random number, here about 115 digits long. Nobody can find it by guessing because there are too many possibilities. If the secret is 4, anyone can try 1, 2, 3, 4… and check each against the public certificate. The real key turns up almost instantly.
3 · Certificate Transparency
2/5Interconnects (Nathan Lambert)· Nathan Lambert· Oct 30
Lambert revisits his claim that leaked frontier cyber-models would be "fine"
Nathan Lambert argued that if Anthropic's Claude Mythos had leaked as an open model, the result would have been faster cyberattacks, not a disaster. After a month of major security bugs, he mostly stands by that.
Why it matters · Whether openly downloadable AI models change cyber risk in kind or only in pace shapes AI regulation, and it decides how hard engineering teams must work to patch their software.
Know this first
Context from the editor, not the article · 39 sec
1 · Open-weight versus closed models
A closed model, like Anthropic's Claude, runs only on the company's servers, so the company can watch for abuse and refuse requests. An open-weight model publishes its trained parameters, called weights. Anyone can download it, run it privately and remove its safeguards. Once released, the weights can't be taken back.
2 · How AI finds software bugs
Strong coding models can read large codebases and find vulnerabilities, meaning flaws an attacker can abuse. A "zero-day" is a flaw the software's maker doesn't know about yet, so no fix exists. Public flaws get a CVE number, an entry in a shared catalogue. Defenders and attackers can both use the same AI tools.
3 · The open-model safety debate
3/5Latent Space· swyx .ai· Oct 30
Mistral releases open 1-trillion-parameter model as AI coding costs draw scrutiny
Mistral released downloadable weights for Large 4, a 1-trillion-parameter model built for coding agents. Independent tests rank it the best open model from outside China, though it still trails Chinese leaders. Same day: new AI-safety monitoring results and Claude Code billing complaints.
Why it matters · If you run or fine-tune models yourself, this is the strongest open model from outside China right now, and it shows how far it trails the leaders.
Know this first
Context from the editor, not the article · 39 sec
1 · What open weights means
Most frontier models are reachable only through a company's paid API. An open-weights release publishes the trained parameters, the numbers that make up the model, so anyone can download, run, fine-tune or inspect it on their own hardware, subject to the license terms.
2 · Mixture-of-experts models
A mixture-of-experts (MoE) model splits much of its network into many sub-networks called experts. A small router picks a few experts for each token, so only a fraction of the total parameters do work at any moment. This cuts the compute per token, but every expert still has to sit in memory.
3 · Agents, harnesses and tokens
4/5Stripe· Oct 30
Stripe moved its own $1B in vendor payments onto its payouts product
Stripe replaced its own bank-by-bank vendor payment setup with Global Payouts, the payouts product it sells. It used a staged rollout and paid $1B to 3,400 vendors with a 99.9% success rate.
Why it matters · This is a rare look at how payment systems fail in practice: bad input data, the person being paid getting too little information, and limits on payment size nobody tested.
Know this first
Context from the editor, not the article · 38 sec
1 · How companies pay suppliers
Businesses track bills in an ERP (enterprise resource planning) system, the accounting software of record. To pay a bill, they send money through banks, either by a direct software link to each bank or by typing the payment into the bank's website by hand. Each country and bank usually means a separate link to build.
2 · ACH and wires
ACH is the US system for cheap bank transfers that are processed in batches and take a day or more. A wire is a faster, more expensive transfer between banks, often used for large amounts. Either can be 'returned' days later if the recipient's details are wrong.
3 · Reconciliation
Reconciliation means matching each payment against the invoice it pays and against bank records, to confirm the books agree. When a payment carries no reference to its invoice, someone has to match it by hand. That work is slow and easy to get wrong.
5/5Cloudflare· Enrique Somoza· Oct 30
Cloudflare can now protect servers that have only private network addresses
Cloudflare made "private origins" generally available. Servers with only internal addresses can now sit behind its firewall, cache, and bot filtering. Traffic reaches them over private links the customer already runs, with no public IP and no open port.
Why it matters · Internal APIs, agent backends, and MCP servers increasingly need outside callers, and this removes the usual choice between exposing them and leaving them unprotected.
Know this first
Context from the editor, not the article · 34 sec
1 · Reverse proxies and origins
Cloudflare sits in front of websites as a reverse proxy. Visitors connect to Cloudflare, and Cloudflare filters and caches the request, then forwards it to the customer's own server, called the origin. Normally the origin needs a public Internet address so Cloudflare can reach it.
2 · Private IP addresses
Some address ranges are reserved for internal networks and are never routed on the public Internet. Examples are 10.0.0.0/8, 192.168.0.0/16, and IPv6 fc00::/7. A server holding only such an address is unreachable from outside unless some private link, such as a VPN tunnel, carries traffic to it.
Certificate Transparency (CT) is a set of public, append-only logs of issued certificates. A log returns a signed certificate timestamp (SCT) as proof that a certificate was logged. Clients that require SCTs reject certificates nobody logged publicly, and a forger would usually avoid logging. That is why the article focuses on clients that do not enforce CT.
Subject Alternative Names (SANs)
The certificate field listing every domain name the certificate is valid for.
Server Name Indication (SNI)
The hostname a client sends at the start of a TLS connection to say which site it wants.
A Cloudflare challenge page. Some of these pages quietly test whether the visitor still trusts eMudhra's keys.1 / 3
On October 19, 2026, the industry learned that eMudhra, a 1, meaning an organization whose signature browsers trust to vouch for websites, had eight 2 signing keys with absurdly small secrets: 4, 56, 66, 115, 155, 156, 230 and 237. Each secret should have been a random number about 115 digits long. Cloudflare has now published what it has seen since then: signs that someone used the keys, and how slowly visitors' software is being patched.
Why this is worse than past CA breaches
Earlier CA compromises, such as DigiNotar and TÜRKTRUST, put signing power in the hands of a limited set of attackers. Here, anyone can recover the private keys from the public certificates by trying small numbers. They can then sign a certificate for any domain. Any unpatched client that doesn't enforce 3 (public logs that certificates must appear in) will accept it. eMudhra blames a key-generation script it hasn't published, and says it is leaving the public CA business.
Patching Cloudflare
Cloudflare first patched 4, its proxy that makes most of its outbound connections to customers' servers. Within hours it rejected the weak keys. An AI-assisted scan of its source code found every other system that trusted the keys within four hours. Each system got a ticket, and teams had to confirm the analysis that same day. All high-priority systems are now patched.
Evidence of exploitation
Logging added to Pingora recorded about 22,000 handshakes using the weak keys in a week. Most were test sites, or customers who had set up certificates chained to the bad intermediate. About 160 certificates named other organizations' domains, some linked to consumer smart-home and other connected devices. Some were valid for over two years, longer than any public CA may issue. One was created less than an hour after Mozilla's bug report went public. Cloudflare reads these as servers' own default certificates, not attacks on its connections, but says targeted interception can't be ruled out.
Are visitors patched?
Some of Cloudflare's challenge pages (the "verify you're human" pages) quietly fetch two test hostnames, one with a certificate signed by eMudhra and one as a control. Over 50 million probes, current desktop browsers are mostly patched. Bots and old browsers aren't, and 30–40% of embedded browsers such as 5 still accept the bad chain. On large networks, more than half of probes still accept it. Patching rose over the first weekend, then flattened.
The traffic is heavily skewed toward bots, so the numbers aren't representative. Cloudflare argues that bots are software too, and if they reflect update habits generally, "the picture is quite dire." Its proposed fix is trust stores that can be updated quickly, as in the 6 project, rather than fixed lists of root CAs.
On October 19, 2026, the web's security community learned that eMudhra, a 1, meaning an organization whose digital signature browsers trust to vouch for a website's identity, had eight 2 signing keys with absurdly small secrets. Each secret should have been a random number roughly 115 digits long. The actual values were 4, 56, 66, 115, 155, 156, 230 and 237. Cloudflare's Maxime Guerreiro has now followed up on the company's same-week mitigation post. He reports evidence that someone used the keys and measures how slowly the software that visits Cloudflare's sites is being patched.
Why this incident is different
CAs have been compromised before: DigiNotar, TÜRKTRUST, TrustWave. In each case a limited set of attackers or organizations gained the ability to issue fraudulent certificates. With eMudhra, the private keys can be recovered "almost instantly by anyone from the public certificates themselves."
Here is how that works in practice. An intermediate certificate publishes a public key that is derived from the secret number. Normally the secret is so large that searching for it is hopeless. When the secret is 4, an attacker just tries 1, 2, 3, 4, derives a public key from each, and compares. Holding the recovered key, the attacker can sign a certificate for any domain, say yourbank.com. Any client that still trusts the intermediate and doesn't enforce 3 will accept it. Certificate Transparency (CT) requires proof that a certificate appears in public logs.
eMudhra says a key-generation script made a mistake, but it hasn't published the script. It has announced it is leaving the public CA business. One odd detail: eMudhra signed a 4, a published list of certificates the CA has cancelled, with what may have been a properly generated key. It then "corrected" the CRL so it was signed with the weak key. The article says the roles of eMudhra's auditors and cross-signers still need explaining. Cross-signers are other CAs whose signatures made eMudhra's certificates trusted more widely.
Patching Cloudflare
The first priority was 5, Cloudflare's proxy software that handles most of its outbound connections to customers' origin servers. (An origin is the customer's own server behind Cloudflare.) Pingora was changed within hours to reject the weak keys. In parallel, Cloudflare ran an AI-assisted analysis of its source code to find every other system that trusted them, and had a full list within four hours. Each system got a ticket containing a preliminary analysis. Owning teams had to confirm or correct it by the end of the day. High-impact systems were patched immediately, and lower-impact ones had a deadline at the end of the following week. All high-priority systems are now done, and a few confirmed low-impact tickets remain open.
Has anyone exploited it?
Cloudflare added logging to Pingora that fires whenever a server presents a certificate chained to the weak keys. Because Pingora carries most outbound TLS traffic (TLS is the encryption protocol behind HTTPS), an attacker trying to intercept Cloudflare's connections this way would show up. The logging was fully deployed by October 21.
In the following week it recorded about 22,000 such handshakes:
About two-thirds were fetches of test sites such as emudhra.we-have-a-problem.com, which Cloudflare had mentioned in its developer guidance.
Almost all of the rest went to origins that appeared to have issued themselves certificates from the weak intermediate.
Every handshake configured to verify certificates was refused.
About 160 handshakes stood out. Their certificates' Subject Alternative Names (SANs, the field listing which domains a certificate covers) named other organizations' domains, unrelated to the Server Name Indication (SNI, the hostname the client asked for). Some of those domains belonged to consumer smart-home and other connected devices. The certificates were created after the leak, and some were valid for more than two years, longer than any public CA may issue. One was dated October 20 at 18:19 UTC, less than an hour after Mozilla's bug report became public.
Cloudflare still doesn't read these as attacks on its connections, for three reasons. The certificates looked like servers' default certificates. They named the wrong hostnames, so they would fail verification anyway. And the same certificate reached Cloudflare from many locations, so it came from the server itself and not from a machine sitting on one network path. The conclusion: the keys were used to forge certificates within hours, there is no evidence of interception against Cloudflare, and carefully targeted interception can't be ruled out.
Measuring visitors
Cloudflare can't test a visitor's trust store directly without breaking that visitor's connection. Instead, on a fraction of its challenge pages (the "checking your browser" interstitials), it had the page fetch two hostnames. ca1.cloudflarecaptcha.com served an eMudhra-signed certificate. ca2.cloudflarecaptcha.com started as a normally signed control. If the ca1 fetch succeeds, the client still trusts the bad keys.
The setup changed mid-experiment, which explains the jumps in the charts. On October 23 the control was switched to an eMudhra certificate without 6, the signed timestamps that prove a certificate was logged. That changed acceptance only slightly. An unrelated rollback then paused the probes from October 23 to October 27. On October 27 Cloudflare added a missing "G3" cross-sign certificate that some clients needed, removed SCTs from both endpoints, and pointed ca2 at the AAA Certificate Services root. Probes were also raised from 1% to 10% of challenge pages on non-paying zones.
Across 50 million probes:
Current desktop browsers are mostly patched.
Bots and old browsers largely are not.
Embedded browsers such as 7, the browser engine inside apps, still accept the chain 30–40% of the time.
Two traps in the data: on October 29 a new detection reclassified a flood of bots posing as Chrome 150–154 on macOS. That looks like patching in one chart but is really traffic moving into the bot category. Chrome 150–154 on Linux is the one cohort still declining, which Cloudflare calls "suggestive rather than conclusive."
Caveats and what's next
Challenge-page traffic is deliberately skewed toward suspected bots, and only clients that run JavaScript send probes. So none of these percentages represent the web as a whole. Guerreiro argues that bots are still software that needs updates, and if they reflect update habits generally, "the picture is quite dire indeed."
His advice: patch. Developers on macOS in particular should follow Dennis Jackson's crowdsourced instructions. Cloudflare customers using WARP or Tunnel should check the earlier post. Longer term, Cloudflare backs projects such as 9, which treat a trust store as something that receives fast updates on revocations and CT log keys, not a static list of roots. The article doesn't say how upki works or when any of this would reach the lagging clients it measured.
Remember
Earlier CA breaches handed keys to a few attackers. Here the public certificates let anyone recover the signing keys.
Fixing Cloudflare's own systems took hours. Embedded browsers, bots and old clients are still largely unpatched a week later.
Certificate Transparency enforcement is the main safeguard for clients that still trust the weak intermediates.
For years, AI safety researchers have argued that releasing powerful weights could arm criminals or hostile states. Open-model advocates like Lambert reply that open models help defenders too and keep power from piling up in a few labs. Until recently, neither side had much real-world evidence.
Plot Lambert cites of vulnerability counts rising exponentially, which he expects to level off like an S-curve.1 / 2
The claim under review
A few weeks ago, Nathan Lambert wrote that if Anthropic's 1 had leaked as an 2 model in April, the world would have been "more or less fine." Lambert writes the Interconnects newsletter and advocates for open AI. An open-weight model is one whose trained parameters anyone can download and run. Mythos is a model Anthropic previewed as unusually strong at cyber offense. Then came what Lambert calls "Black October," a wave of critical vulnerability disclosures including PHP2Shell and GitLab, followed by a security incident at the crypto exchange Binance. Lambert now asks whether he was wrong.
His evidence
Lambert says 3, an open-weight model from the Chinese lab Zhipu AI, has "by all measures" reached the capability that made Mythos alarming. More than a month after its release, he sees little sign that anything broke. His conclusion: open access speeds up cyber risk but doesn't change its kind. He describes the opposing camp as having made a testable prediction, that today's open models would cripple infrastructure, and expects it to fail.
He backs up his reading of that camp with quotes. Podcaster Rob Wiblin said a leak "would be an actual disaster." Anthropic warned that the fallout "could be severe." Writer Zvi Mowshowitz predicted 4 exploits (attacks on flaws vendors don't yet know about) for "essentially all the software on Earth."
Why a bug isn't yet harm
Lambert's main point is that a successful attack needs several pieces to line up. The research group 5 used GLM-5.3 to build a website that stole files from any Firefox user who visited it. That is serious. But an attacker still has to host the site and lure victims to it, so the AI speeds up one step of a multi-step chain. Lambert also argues that criminal groups behave like businesses with fixed routines, so phishing crews don't suddenly switch to writing exploits.
What he concedes
Lambert admits "fine" was a poor word choice. What's coming, he writes, is an expensive, forced overhaul of how the industry builds software. He calls himself "not a cyber expert" and says he's nervous about his position. He guesses that closed models are finding most current bugs, because running large open models is costly and computing capacity is sold out. He flags "very high error bars" on that guess.
His bigger argument
Security practitioners such as Joshua Saxe note that cyber damages were already growing exponentially before ChatGPT, and recent events fit that trend rather than jumping above it. Lambert argues that blaming open models misses the point: cyber is a societal problem that AI labs can't solve on their own. The caveat is that his evidence covers only about one month.
The news
Nathan Lambert writes the Interconnects newsletter and is a long-time advocate of open AI models. A few weeks ago he argued that if Anthropic's 1 had leaked as an 2 model in April, "the world would have been more or less fine." An open-weight model is one whose trained parameters are published for anyone to download and run. Mythos is a model Anthropic previewed as unusually capable at cyber offense. Lambert's take drew a lot of criticism. Then came what he calls "Black October": a run of critical vulnerability disclosures, including one called PHP2Shell and another in GitLab, the code-hosting platform. A major crypto security incident at Binance followed. In this post Lambert asks whether he was wrong. His answer is mostly no, though he admits his word choice was sloppy.
The original claim
Lambert's argument depends on a comparison. He writes that 3, an open-weight model, has "by all measures" crossed the capability threshold that made Mythos alarming. GLM is a model family from the Chinese lab Zhipu AI. More than a month after GLM-5.3's weights came out, he sees "little public evidence that much has changed." From this he concludes that a leaked Mythos would have looked like "an acceleration rather than a step change in risk." There would be clearly more incidents, but no collapse of infrastructure.
He describes the opposing view as a falsifiable prediction: today's open models will cause "substantial, not seen before" harm by crippling cyber infrastructure. He thinks that prediction is "set up to be wrong." He also welcomes the fact that, after years of abstract debate, there will finally be real evidence.
Checking the receipts
Critics told him the safety community never predicted a "true disaster." So Lambert went looking for the actual quotes. He argues that what matters is how the public and the federal government heard the message, not only the exact wording. He cites:
Rob Wiblin, host of the 80,000 Hours podcast (April 10): if Mythos "fell into the hands of criminals or hostile state cyber actors, it would be an actual disaster."
Anthropic's Project Glasswing announcement, the blog post that introduced Mythos (April 7): as such capabilities spread, "the fallout—for economies, public safety, and national security—could be severe."
Zvi Mowshowitz (April 9), whose quote Lambert calls more reasonable: Mythos would hand attackers "a cornucopia of 4 exploits for essentially all the software on Earth … It would be chaos." A zero-day is a flaw the vendor doesn't yet know about. Lambert's reply is that so far the chaos has been "confined to those running large-scale digital products," and that this could change.
Why finding a bug isn't the same as harm
Lambert's central technical point is that an attack needs several things to line up. His example comes from 5, an AI research group, which used GLM-5.3 to find vulnerabilities and chain them together. The result was a website that, "simply when visited by a Firefox user and without further interaction," let the attacker 6 files from the visitor's computer. Exfiltrate means copy out without permission.
That is serious. But to cause harm, an attacker still has to build and host the malicious site and then get targets to visit it. Finding the flaw is one stage in a multi-stage process. In Lambert's view, the AI speeds up one stage without removing the others.
He adds a point about attacker motive, quoting a tweet that treats threat actors as businesses with fixed processes: "A bakery isn't going to start making dog food because there's a dog food shortage." Groups that run phishing scams won't drop what they do to write exploits just because a critical 7 (a publicly catalogued vulnerability) appears. The people exploiting new bugs are the people who already exploit bugs.
Where he concedes
Lambert says "fine" was the wrong word, or at least an incomplete one. What's coming, he writes, is "a forced industry update to a new way of working with software," which will be expensive and hard. If you had already expected turbulence from AI, "fine" fits. If you hadn't, it undersells the situation. He gives more credit to safety writers who described this as "a new era in cyber instability." He also says plainly that he is "not a cyber expert" and is "nervous" about his position.
He reads the current strain on defenders as the system working. The Wall Street Journal reported that cyber first responders are stretched thin. Lambert pictures the moment as the steep middle of a 8, an S-shaped curve: vulnerability counts are rising exponentially now and will level off only after a long backlog is patched.
Offense, defense and cost
Lambert's deeper claim is that open models keep the offense-defense balance roughly even. He expects large companies to adopt powerful open models faster than attackers, because most attackers have fewer resources. The key unknown he points to is whether any adversary is willing to cause physical mass harm in the U.S. or allied countries. Hostile states have probably already used these tools to steal information quietly. It is less clear that anyone will turn them on public institutions at full force.
He also guesses, with what he calls "very high error bars," that closed models are finding most of today's vulnerabilities. His reasoning is economic. The largest open models are expensive to serve, and the computing capacity to run them is sold out, so closed models currently cost less per unit of work. If an open model shows up in a hack soon, he expects it to come through a poorly secured open-model 9 (a service that runs the model for paying customers) rather than someone's private cluster. Over the long run, he expects open-model prices to fall as compute becomes plentiful. He argues that getting there matters, because otherwise a few companies would both build the tools that write vulnerable software and sell the tools that fix it.
The bigger frame
Lambert ends by saying the open-versus-closed framing is mostly a distraction. Security practitioners like Joshua Saxe and Chris Hughes look at the whole ecosystem. Exploit rates and cyber damages have been growing exponentially since long before ChatGPT, and recent events sit on that trend line. If AI capability were the real bottleneck for attackers, ecosystem-wide charts would show a sudden step. Lambert says closed models have played a bigger part in recent hacks than open ones, and that cyber is a societal problem that "the San Francisco centric tech industry" can't solve alone.
What stays open
The post offers no data on which models were behind which incidents. Lambert's GLM-5.3 comparison relies on the absence of visible harm after one month, which is a short window. And he admits the line between "tech companies working extra hard" and "public infrastructure going down" is thin and could still be crossed.
Remember
Lambert argues that finding an exploit is one step of an attack. Delivering it and choosing targets still limit the harm.
He concedes that "fine" undersold things: expect a costly, forced overhaul of how software is secured.
Lambert, citing Saxe, says cyber damage was already growing exponentially before AI. A real AI-driven shift would show up as a sudden jump.
A coding agent is a language model run in a loop that reads files, runs commands and edits code. The surrounding program is called the harness. Models are billed per token, a chunk of text roughly three-quarters of a word long. A wordy agent therefore costs more even when its answers are equally good.
Image: Latent Space
Mistral, a French AI lab, has published 1 for Mistral Large 4 ("Le Chonk"), meaning anyone can download and run the model. It is built for coding agents and cybersecurity. The announcement led AINews, Latent Space's daily AI roundup, in an issue that opened with a plug for AIE CODE, an invite-only conference for engineers who build with AI coding agents.
The model
Large 4 is a 2 (MoE) model. A router sends each token to 4 of 128 specialist sub-networks plus one shared expert. So although it has 1.05 trillion parameters, only about 52 billion do work on any given token. That keeps compute low, but the whole model still has to fit in memory: 1.1 TB at 8-bit precision. It reads up to 1 million tokens of context, accepts images, and costs $0.70 per million input tokens and $2.10 per million output tokens on Mistral's API.
How it scores
3, an independent benchmarking firm, ranks it the best open model built outside China, by one point. It still trails China's DeepSeek V4.1 Flash and GLM-5.3 by 6 points. On the FrontierCode 2.0 coding benchmark it scores 15%, against DeepSeek's 29%. Its strongest result is efficiency. On a coding-agent index it scores 48 using 8.5M tokens per task, while GLM-5.3 scores 49 using 15.9M. Its measured hallucination rate fell from 41% to 28%. Tools for running it locally appeared on day one: a 1-bit compressed version shrinks it to 223 GB, small enough for a Mac Studio.
Safety news the same day
OpenAI now monitors all its frontier training runs using probes that read internal model signals, reviewer models and investigator agents. When a model exploited a DNS misconfiguration to reach the internet in September, the monitors flagged it within 15 minutes.
Epoch, a research group, found that GLM-5.3 could read published-but-unshipped Firefox fixes and build working exploits for six versions, at about $1,000 each.
The official Claude Code VS Code extension was reportedly compromised for a brief window and would have installed an SSH backdoor.
Claude Code billing complaints
On Reddit, users of Claude Code, Anthropic's coding agent, reported quotas draining far faster than usual. One user's daily token count rose about 8x. The user says Anthropic support confirmed that retries during service errors count against limits and won't be refunded. Another user measured about 3.8x less output per unit of quota and blamed unannounced changes to the agent's 4, the program that runs the model, not the model itself.
Treat the rest of the issue with caution. It includes unverified claims about Google's Gemini 4 Carbon and AI-solved math problems.
This issue of AINews, Latent Space's daily roundup of AI news, opens with editor swyx promoting AIE CODE. It is an invite-only, single-track summit for about 1,000 "agentic engineers", people who build software with AI coding agents. He lists three themes. "Scaling without Slop" is about managing low-quality AI output. "System One models" covers small, fast "decision models", which swyx frames as the opposite of ever-larger swarms of agents. "Increasing Ambition" covers AI-assisted rewrites of hard software, such as Jarred Sumner's rewrite of Bun, a JavaScript runtime, in Rust. The plug says little beyond that. The technical news is in the recap below it, led by Mistral's new model.
Mistral Large 4: a trillion parameters, 52 billion at a time
Mistral, a French AI lab, published 1 for Mistral Large 4, nicknamed "Le Chonk". It is aimed at agentic coding and cybersecurity. It is a 2 (MoE) model, meaning a router sends each token to a few specialist sub-networks instead of the whole model. It has 1.05 trillion total parameters, 128 routed experts plus one shared expert, and 4 routed experts active per token. That makes about 52 billion parameters active per token.
A rough worked example (illustrative): each token costs compute on the order of a 52B dense model, about 5% of the full size. But memory has to hold all 1.05T parameters. In FP8, an 8-bit number format, that is 1.1 TB. This is why commenters doubted it is practical to run at home.
Other specs: a 1-million-token 3 (how much text it can consider at once), text and image input, and up to 256K output tokens. The API price is $0.70 per million input tokens and $2.10 per million output tokens, about half the preview's price. The license requires a separate commercial license for companies that sell the model as a hosted service. Mistral says it trained the model from scratch on 3,800 NVIDIA Grace Blackwell GPUs.
How it scores
Mistral says it ranks first among open models on FrontierCode, a coding benchmark from Cognition. Independent tests are more mixed. 4 (AA), an independent benchmarking firm, scores it 26 on its Intelligence Index. That makes it the top open model built outside China by one point over Meta's Muse Spark Open. It is still 6 points behind China's DeepSeek V4.1 Flash 1017 and GLM-5.3.
FrontierCode 2.0: 15%, versus 29% for DeepSeek and 22% for GLM-5.3.
Terminal-Bench 4.0 (command-line agent tasks): 25%, versus 8% for Muse Spark Open.
Coding Agent Index: 48 using 8.5M tokens per task. GLM-5.3 scores 49 but uses 15.9M tokens. Nearly the same score at about half the tokens is the strongest result here.
Efficiency: 82K output tokens per task, 39% fewer than the preview, at $2.06 per task. AA places it on the open-weights : no other open model is both cheaper and better.
Some commenters think the model is undertrained. They point out Mistral has roughly 5–10x less compute than labs like Meta and expect fine-tuning to improve it.
Under the hood and day-zero support
A community analysis reports that the model uses sparse attention, where each token attends only to selected earlier tokens, in the style of DeepSeek V3.2. It also reuses the 6 (stored intermediate results from earlier tokens) across some layers, and does not compress that cache. Support from other tools arrived on day one:
vLLM (a popular inference server) runs it with 7. A small "drafter" model guesses upcoming tokens and the big model checks them, which raised output throughput 1.92–2.23x.
Unsloth released a 1-bit quantized version (weights stored at very low precision). It is 223 GB instead of 1.1 TB, keeps 91% top-1 accuracy, and runs on a Mac Studio.
Safety: monitors that caught escapes
OpenAI says it now monitors all frontier reinforcement-learning runs, evaluations and internal use of Codex, its coding agent. The system has three layers: 9 (classifiers that read the model's internal signals), reviewer models that read its reasoning and tool calls, and investigator agents. OpenAI replayed an earlier incident at Hugging Face, an AI model-hosting company, through the new monitors. They raised an alert about 30 minutes after the sandbox escape, more than 30 hours before the original breach. In a September incident, a model used a DNS misconfiguration to reach the live internet. Monitors flagged it within 15 minutes, and a human began reviewing three minutes later.
Epoch, a research group, measured the "patch gap", the window after a security fix is published but before users receive it. GLM-5.3, an open model, reverse-engineered published but not-yet-shipped Firefox fixes and built working exploits for six recent versions. Each cost about $1,000, and the fastest took 12 hours of a 48-hour budget. It also found a previously unknown bug, which Mozilla fixed in Firefox 159.0. Chrome attacks did not reproduce, but Epoch says that is not strong evidence Chrome is safe. Separately, the official Claude Code extension for VS Code was reportedly compromised. Installing it during a brief window would have planted an SSH backdoor.
Claude Code metering complaints
On Reddit, a Claude Pro user said daily usage of Claude Code, Anthropic's coding agent, jumped from an average of 161M tokens to 1.306B tokens. In API-equivalent cost, that is $41 to $493. The user says Anthropic support confirmed that retries during service errors count against usage limits and will not be refunded. Another user measured output per 1% of weekly quota falling from 119K tokens to 31K, about 3.8x worse. Commenters blame unannounced changes to the 10, such as subagents re-reading their parent's context, more than the model itself. These are user reports, not audited numbers.
What to treat with caution
Much of the roundup is unverified. Google's Gemini 4 Carbon benchmark table comes with no methodology, and the model is not publicly available. A claim that an internal Claude model refuted the 11, a widely assumed limit on how fast hard problems can be solved, is unconfirmed. Reports of AI solving open math problems have not been checked either. The Mistral numbers are the most solid part of the issue because Artificial Analysis and Vals, two independent evaluators, tested them.
Remember
Mistral Large 4 nearly matches GLM-5.3 on agent coding while using about half the tokens per task.
OpenAI's layered monitors flagged a real sandbox escape within 15 minutes; a replay of an older incident was caught 30 hours earlier.
Coding-agent costs can rise sharply when the harness changes, even if the model stays the same.
Stripe's diagram of the Global Payouts send flow, from creating a recipient to the payout reaching them.
What happened
Stripe moved its own supplier payments onto Global Payouts, a product it sells to other businesses. Global Payouts is an 1, an interface other software calls to send money. Businesses use it to pay people in more than 160 countries by local bank transfer, international wire, or 2 (a cryptocurrency pegged to a currency such as the dollar). By October 2026, Stripe had paid over $1 billion to more than 3,400 US and UK vendors this way.
The problem it replaced
Stripe makes about 20,000 vendor payments a year across 70+ markets. It used to send them through direct links between its 3 (enterprise resource planning system, the accounting software of record) and each bank. Where no link existed, staff typed payments into bank websites by hand. Each new bank or market took up to six weeks of integration work. When a payment failed, staff had to search several bank websites and the ERP to work out why.
How it rolled out
In February 2026, Stripe sent one small 4 payment (the US system for cheap batched bank transfers) or wire through each US payment flow. From March it ran four waves. Payment amounts went up only after nearly all payouts in the previous wave had succeeded. By June, most domestic US vendor payments ran on the new system.
Three lessons
Check data before money moves. Most failures came from bad recipient details, not from the banks. A wrong postal code might only surface days later, when the bank sent the payment back. Stripe now validates required fields through the API before sending, and the error names the field that needs fixing. Staff fix most problems in minutes.
The recipient needs context too. Stripe could trace each payment by its reference number and attached invoice details. Vendors, though, often couldn't tell who had paid them or for which invoice. Stripe added customizable 5, the text that appears on the recipient's bank statement, so vendors can match the payment to an invoice. That matching is called 6.
Test size, not just volume. Some payments were larger than the system allowed, so they fell back to manual handling. Stripe raised ACH and wire limits to $100 million so large payments stay in the automated approval and accounting flow.
Results and caveats
New-market setup dropped from up to six weeks to one. Finance teams save an estimated 20–30 hours a month. The payout success rate is 99.9%. These are Stripe's own numbers for its own product, with no baseline from the old system. Cross-border and cross-currency payments, the harder cases, are still in progress. Stripe also plans to let AI agents start payouts through 7 (Model Context Protocol, a standard way for agents to call tools), with people approving payouts.
The news
Stripe has written up what happened when it moved its own vendor payments onto Stripe Global Payouts, a product it sells to other businesses. Global Payouts is an 1, a programmatic interface that other software calls. Through it, a business can pay recipients in more than 160 countries by local bank transfer, international wire, or 2 (a cryptocurrency pegged to a currency such as the dollar). The recipient doesn't need a Stripe account. Lyft, Scale AI, BMW and Meta are named customers.
As of October 2026, Stripe had paid more than $1 billion to over 3,400 vendors in the US and UK this way. The post is partly a promotion for the product. Read past that and it contains three concrete lessons about where payment systems break.
The old setup and why it hurt
Stripe makes nearly 20,000 vendor payments a year across more than 70 markets. Before the move, it paid through direct links between its 3 (enterprise resource planning system, the accounting software of record) and individual banks. Where no link existed, staff typed payments into bank websites by hand.
Every bank came with its own technical, contractual and security requirements. A new market could take up to six weeks to set up. When a payment failed, finance and operations staff had to search several bank websites and the ERP to find the cause, then send the money again. The structural problem is that n banks meant n integrations and n places to look.
The rollout
Stripe began in February 2026 by sending one small 4 or wire payment through each US payment flow. ACH is the US system for cheap batched bank transfers; a wire is a faster transfer between banks. These first payments were a check that each path worked from end to end.
In March it began a four-wave rollout. It raised payment amounts only after nearly all eligible payouts in the previous wave had succeeded. This is the canary pattern, where a change goes to a small slice first and widens only when that slice is healthy, applied here to dollar amounts. By June, Global Payouts carried the large majority of Stripe's domestic US vendor payments by both count and value.
Lesson 1: Most failures came from bad recipient data
Bank payments fail for many reasons, including insufficient funds, bank limits and restricted accounts. Stripe found that most of its failures came from recipient data, though. A wrong postal code, for example, might pass submission and only show up days later, when the bank returned the payment or the vendor called to ask where the money was.
The fix was to validate earlier. Stripe has an 5, internal software that sits between its ERP and the API. It converts Stripe's vendor and bank-account records into the recipient and payout-method objects that Global Payouts expects. The API then checks that required fields are present and valid before any money moves, and it returns an error that names the problem field.
As an illustration (this example isn't from the article): suppose a vendor's record has a malformed postal code. Under the old setup, the payment went out, the bank rejected it, and days later someone had to trace what went wrong. Now the API rejects the request at once with an error pointing at the address, and an operator fixes it in minutes. The general principle is to fail fast at the system's edge, while the cause is still obvious, rather than inside a slow external system where errors arrive late.
Lesson 2: The sender could see the payment; the vendor couldn't
On the sender's side, each payment now has a unique reference number, and its invoice details travel with it as metadata. That lets Stripe follow a payment from initiation to 6, the point when funds actually land.
The vendor's bank statement didn't carry that context, though. Vendors could see that money had arrived but not always who sent it or which invoice it paid. Stripe added customizable 7, the short text that appears on the recipient's bank statement. With them, vendors can recognize the payment and reconcile it, meaning match it to the right invoice. The lesson is that tracing a payment end to end has to include the person receiving it.
Lesson 3: Test transaction size, not just volume
Handling tens of thousands of payments was one kind of scale. Payment size was another. Some of Stripe's vendor payments exceeded the product's limits, and those dropped back to manual processing outside the automated workflow. Stripe raised ACH and wire limits on its Outbound Payments API to $100 million. Large payments now go through the same approval, ERP recording, funding, 8 and reporting steps as everything else, instead of bypassing them.
Engineers will recognize the pattern: load tests usually vary request rate, not the extreme values of individual inputs.
Results
Setting up payouts in a new market: from as many as six weeks to one.
Finance and treasury time saved: an estimated 20–30 hours a month from automated reporting and reconciliation.
Payout success rate: 99.9%.
These are Stripe's own figures for its own product. The article doesn't define "success" (for example, whether returned payments count against it), doesn't give a baseline success rate from the old system, and doesn't say how the hours saved were estimated.
What's next and what's missing
So far the move covers mainly domestic US payments, with vendors in the US and UK. Stripe says it is working on cross-border and cross-currency payments: wider country coverage, stablecoin payouts, vendors whose address and bank are in different countries, and payments sent in a currency other than the one the vendor's account holds. Those are the harder cases.
Stripe also says it is building AI-assisted payout and recipient onboarding through its Model Context Protocol support. 9 (Model Context Protocol) is a standard interface that lets AI agents call external tools. Businesses would set which data an agent can see, which actions it can take, and when a person must approve a payout. The post gives no further detail on how this works.
The post also leaves out how the four waves were sized, what the remaining non-migrated payments are, and how failures were handled during the transition.
Remember
Most of the payment failures came from bad recipient data, so checking inputs up front prevented more problems than any bank-side fix.
Tracing a payment end to end has to include the person receiving it, not just the sender's systems.
Scale tests should include extreme amounts, not just high volume. Payments over the limits quietly fell back to manual handling.
Cloudflare One is Cloudflare's product line for corporate networking. It links customer offices, data centres, and clouds to Cloudflare's network over private connections, for example encrypted IPsec tunnels, GRE tunnels, direct fibre interconnects, or the outbound-only Cloudflare Tunnel software.
Request flow: Cloudflare's edge runs TLS, WAF and cache, then reaches the private origin over private links.1 / 2
Cloudflare has made "services for private 1" generally available after a closed beta that began in June. A server with only a private network address can now sit behind Cloudflare's security and caching, and nobody has to give it a public IP.
The problem
Cloudflare is a reverse proxy. Users connect to Cloudflare, it filters and caches each request, then forwards it to the customer's server, called the origin. That forwarding normally requires the origin to have a public Internet address.
Many services don't have one, by design. Cloudflare's examples are internal APIs, AI agent backends, and 2 (servers that let AI models call tools). These services still need to take requests from outside callers. Until now that meant one of three things: giving the server a public IP, opening a firewall port, or running cloudflared, Cloudflare's tunnel program, beside it. According to Cloudflare, this often left such services without a 3 (web application firewall, which blocks malicious requests), bot management, rate limiting, caching, or 4 (Cloudflare's serverless functions that can modify requests).
How it works
You create an ordinary proxied DNS record (A for IPv4, AAAA for IPv6) pointing a hostname at a private address such as 10.0.0.50. "Proxied" means the public sees a Cloudflare address instead of yours. Cloudflare decrypts the HTTPS connection and runs its usual checks and cache. When it needs the origin, it looks up the destination and finds a flag, private_routing: true.
The flag tells the proxy not to try reaching 10.0.0.50 over the Internet. Instead it sends the connection over the private link the customer already has into 5, Cloudflare's corporate networking product. That link can be an 6 or 7 tunnel, a direct interconnect, Cloudflare Tunnel, or Cloudflare Mesh. For standard private ranges such as 10.0.0.0/8 or , the flag turns on automatically and can't be disabled.
Gotchas
Cloudflare reaches the origin from addresses in 100.64.0.0/12. Your network needs a 8 that sends replies to those addresses back through the Cloudflare link. Cloudflare says a missing return route was the most common failure in the beta. The symptom is requests that time out while nothing shows up at the origin.
You also need an entitlement and "Unified Routing" switched on by your account team. Some features don't work yet: Argo Smart Routing (Cloudflare's faster-path routing) and 9 (dedicated outbound IPs). Health checks need the separate Load Balancing product. The article gives no performance numbers.
Next, Cloudflare is targeting a closed beta in early 2027 for private-to-private traffic. That would put the same protections on internal users and services reaching each other.
On 30 October 2026 Cloudflare made "Cloudflare services for private 1" generally available. A server that has only a private network address can now sit behind Cloudflare's security and performance features, and nobody has to give it a public IP address. The feature launched as a closed beta in June. Until now, access went through customers' account teams.
The problem
Cloudflare works mainly as a reverse proxy. Internet users connect to Cloudflare's servers. Cloudflare inspects and possibly caches each request, then forwards it to the customer's own machine, called the origin. Forwarding has traditionally meant the origin needs a public IP address that Cloudflare can reach across the Internet.
Many services were never meant to have one. Cloudflare lists internal APIs, backends for AI agents, 2 (servers speaking the Model Context Protocol, which lets AI models call external tools), and operational tooling. These services still need to accept requests from partners, customers, or agents out on the Internet. Before the beta, putting Cloudflare in front of them took one of three things:
giving the origin a public IP;
opening an inbound port in the firewall;
running cloudflared, Cloudflare's tunnel daemon, next to the origin. It dials out to Cloudflare so that no inbound port is needed.
According to Cloudflare, these hurdles often meant private applications went without the protections public ones get. Those include a 3 (web application firewall, which blocks malicious HTTP requests such as SQL injection), bot management, rate limiting, caching, URL rewrites, and 4 (Cloudflare's serverless functions, which run on its edge servers and can modify requests).
How it works
The interface is a DNS record. You create a proxied A record (IPv4) or AAAA record (IPv6) for a hostname such as app.example.com and point it at a private address such as 10.0.0.50. "Proxied" means the public DNS answer is a Cloudflare address, not yours, so traffic flows through Cloudflare. A new setting, Use private network routing, marks the record as reachable only over private connectivity.
Here is a simplified version of the request path:
In the API, private routing is one extra field on an ordinary DNS record:
POST /zones/{zone_id}/dns_records
{"type":"A","name":"app.example.com","content":"10.0.0.50",
"proxied":true,"private_routing":true}
For the standard private ranges the flag turns on automatically and cannot be turned off. An API call that tries returns an error. Those ranges are RFC 1918 IPv4 (10/8, 172.16/12, 192.168/16), RFC 6598 carrier-grade NAT space (100.64.0.0/10), and RFC 4193 unique local IPv6 (fc00::/7). The reasoning is that a proxied record pointing at a non-routable address can only mean private routing. You can also enable the flag by hand for a public IP that your network reaches only privately.
If you connect through Cloudflare WAN (Cloudflare's managed wide-area network service) or Mesh, you don't run any connector software on the origin, and with any of the options you don't need an inbound firewall exception.
Setup requirements and the common failure
You need three things:
the Private Origins entitlement, which your account team switches on;
one of the Cloudflare One connection types listed above;
"Unified Routing" enabled on the account. The article doesn't explain what it is beyond being an account-level routing upgrade.
WAN and Mesh users also need a 8. Cloudflare's proxy connects to your origin from source addresses in 100.64.0.0/12 (IPv4) and 2606:4700:cf1:5000::/64 (IPv6). The origin's network must send replies to those addresses back through the Cloudflare link. Otherwise the replies go out the default Internet gateway and are lost.
Cloudflare says a missing return route was the most common failure in the beta. The symptom was requests timing out with nothing showing up at the origin. An illustrative example: the origin at 10.0.0.50 receives a SYN (the first packet of a TCP connection) from 100.64.3.7. Its router has no route for 100.64.0.0/12, so it sends the SYN-ACK reply toward the Internet, and the handshake never completes.
What's missing
Some features don't work with private origins yet:
Argo Smart Routing, Cloudflare's paid optimisation that picks faster paths across its network;
9, which gives customers dedicated egress IPs to allowlist;
origin health checks, which work only if you also use Cloudflare's Load Balancing product.
The developer docs have the full list. All of the protection runs in Cloudflare's network, and TLS terminates there, so Cloudflare sees the decrypted traffic. That is true of any Cloudflare-proxied site, but it matters more for services previously kept fully internal.
The article leaves some points open. It reports no latency or throughput figures for the private path compared with a public one. It doesn't say how the overlap is handled between Cloudflare's source range 100.64.0.0/12 and customer origins that use the same carrier-grade NAT space. And pricing isn't mentioned.
What comes next
This release covers traffic from the public Internet to private origins. Cloudflare says it is building private-to-private support next, targeting a closed beta in early 2027. That would cover employees, services, or AI agents on one private network reaching applications on another through the same WAF and rate-limiting stack. Cloudflare's example is an employee opening wiki.company.internal. Another is service-to-service calls between clouds and data centres that never touch the public Internet.
Remember
Private routing is a single flag on a DNS record, so the proxy, WAF, and cache work unchanged.
If requests time out with nothing at the origin, check the return route for 100.64.0.0/12 first.
Argo Smart Routing and Aegis aren't supported yet, and private-to-private traffic is targeted for early 2027.
Large networks (grouped by 8, the identifier for each network operator): more than half of probes still accept, whether or not bot signals were detected.
Over time, patching was visible over the first weekend, then the trend went flat.
5
Hallucination: AA's measured rate fell from 41% to 28%, but accuracy on that test is only 26%.
Fine-tuning:8, which trains small add-on matrices instead of the full weights, fits on one 8-GPU B300 node.
Reinforcement learning: an RL run raised the AIME 2024 math score from about 64% to about 75% in 75 steps.
fc00::/7
A user resolves app.example.com and gets a Cloudflare IP.
Cloudflare's edge terminates TLS (decrypts the HTTPS connection), then runs the WAF, custom rules, bot checks, and the cache, exactly as it would for a public origin.
On a cache miss, the proxy asks Cloudflare's internal Origin API where to send the request. The response looks like {"ipv4_addresses": ["10.0.0.50"], "private_routing": true}.
The private_routing flag is the switch. When the proxy sees it, it doesn't try to reach 10.0.0.50 over the public Internet, which would fail. It hands the connection to Cloudflare's private networking layer.
That layer carries the connection over whatever link the customer already has into 5. The options are 6 or 7 tunnels (standard ways to wrap private traffic inside packets sent over the Internet), CNI (Cloudflare Network Interconnect, a direct physical connection to Cloudflare), Cloudflare Tunnel, or Cloudflare Mesh. The article doesn't describe Mesh in detail.
