Claude Duet launches research preview with proactive reminders and background tasks
要闻
Anthropic has opened a research preview of Claude Duet, an Agent app built around Claude Opus 5.5 that proactively sends alerts and performs tasks in the background. The preview is included in Pro and Max plans, with access requiring a waitlist signup.
Anthropic has opened the Claude Duet research preview, although the source does not specify a publication date. Designed for professionals and small business owners, it is available as a standalone app on iOS and Android and through claude.ai. It is included in Pro and Max plans, shares usage limits with other Claude features, and requires users to join a waitlist for access. According to the company, Claude Duet is built around Claude Opus 5.5, carries over memory, skills, and connected apps from a Claude account, and accepts text or voice tasks in one ongoing conversation. It provides a morning brief, checks connected accounts every few hours, and sends messages when attention is needed. It can also handle meeting scheduling, forecasts, prototyping, and web app development. Its virtual machine has its own browser, so users do not need to keep their phones or computers on; notifications arrive when work is complete or needs review.
The company says Claude Duet can use more than 6,000 connectors and plugins in the Claude Marketplace, but must show the proposed action and wait for approval before sending messages, making payments, signing documents, or deleting content. Even with approval, it cannot trade securities or move money between accounts. Users can disconnect any connected app. For sensitive information, the company says a new dedicated classifier and safety system prompt check every message and reject requests to share information in the most restricted category, including credit card numbers and government identification. Health or personal financial information is permitted only when the user explicitly instructs it to send that information. The company is continuing to refine these protections and adjust notification timing based on tester feedback; users can also specify notification topics and frequency.
Tibo says caches for logged-in Codex users are retained permanently
要闻
OpenAI’s Prompt caching documentation states that caches are not permanent. GPT-5.6 and later models default to a 30-minute cache lifetime, while the Responses API offers a 12-hour minimum lifetime, with different write rates for the two settings.
OpenAI explains in its Prompt caching documentation that cache entries are not stored indefinitely: GPT-5.6 and later models default to a 30-minute cache lifetime, and the Responses API allows a 12-hour minimum lifetime. The source does not specify when this rule took effect. According to OpenAI, cache writes under these settings cost 1.25× and 2.5× the standard uncached-input rate, respectively; these are total rates, not additional surcharges. Subsequent reads cost 0.1× the ordinary input rate on most of these models and 0.05× on GPT-6.1 Sol, regardless of the selected lifetime. The cache stores key-value (KV) tensors for reusable prefixes, rather than tokens themselves. For GPT-5.6 and later models, the minimum cacheable length is 1,024 tokens, excluding OpenAI-provided hidden system content. OpenAI states that actual retention may exceed the selected minimum; the 12-hour setting is not a deletion deadline and does not change the maximum data-retention policy.
PHP patches two severe vulnerabilities with OpenAI's help in discovery and remediation
开发生态
PHP has released fixes for two vulnerabilities, each with a CVSS score of 9.2, that can allow unauthenticated remote code execution under specific conditions. OpenAI says its program helped with discovery and approximately 2 months of coordinated remediation.
The PHP Foundation led the remediation and release process for two critical vulnerabilities, with fixes available in PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35. Both vulnerabilities have a CVSS score of 9.2 and can allow unauthenticated attackers to execute code remotely under specific conditions. According to OpenAI, security company Calif used GPT-5.6 Sol to discover one of the critical flaws, while Wiz independently discovered and reported both vulnerabilities; OpenAI’s Patch the Planet program helped researchers find the vulnerabilities and participated in approximately 2 months of coordinated remediation. OpenAI also released a PHP version-checking tool as a Codex skill. The company says the tool helps operators identify potentially affected versions and determine applicable updates using guidance from PHP and service providers.
eMudhra revokes eight intermediate certificates over weak keys
开发生态
eMudhra revoked 8 intermediate CA certificates on October 19, 2026, after an independent researcher reported weak keys. The company says none of these CAs issued end-entity certificates, but browser root programs have also distrusted the ECC root above them.
eMudhra revoked 8 intermediate CA certificates with weak keys in its Global TLS business on October 19, 2026, following a report from an independent security researcher on October 18, 2026. According to the company, all of these CAs sit under its ECC root, which browser root programs have also distrusted as a result of the incident. The company says only 1 of the 8 intermediate CAs had been deployed in production, but none had issued end-entity certificates; it also says its infrastructure was not compromised and no data was breached. The impact it disclosed concerns TLS certificates chaining to that ECC root and is limited to a single customer ecosystem in the United States.
According to the company, the keys were generated during a Key Generation Ceremony in April 2025 using FIPS 140-2 Level 3-certified HSMs. However, a wrap/unwrap step produced a second, weak set of keys alongside the original strong keys, and the weak set was published to browser root stores. The problem remained undetected for about 18 months, spanning two independent audit cycles. In the company's account, the researcher reportedly reverse-engineered the weak keys with AI-assisted tooling. The company says the exact root cause remains unconfirmed and it is not aware of evidence that anyone recovered or exploited the weak keys before disclosure. It is reviewing its key generation process and offering all Enterprise TLS customers certificates from an additional publicly trusted CA.
LiteLLM hit by supply chain attack; malicious versions taken down
开发生态
LiteLLM disclosed that its release pipeline was compromised on October 21, 2026, resulting in credential-stealing malware in v1.107.0. The affected artifacts have been removed, and the company says earlier versions and its private enterprise release were unaffected.
LiteLLM disclosed on October 21, 2026, that attackers had compromised its release pipeline and pushed malware-containing v1.107.0 to the docker registry and PyPI. The affected artifacts have since been removed from PyPI, Docker Hub, and GHCR. According to the company, the malware steals credentials and loads remote-code execution tools. The official v1.107.0 source tag on GitHub contains no malicious files; the compromised artifacts were built from an attacker-controlled repository. The company says all previous versions are safe and customers using its private enterprise registry were not affected.
The company's stated exposure windows cover use of an unpinned LiteLLM version through pip between 11:39 and 13:23 UTC on October 21, 2026, and use of the v1.107.0, latest, main-latest, or main-stable docker image between 11:46 and 14:20 UTC on the same date. In its 20:30 UTC update that day, the company said the incident was contained and the investigation remained ongoing. Its preliminary assessment is that the attacker accessed an internet-facing internal LiteLLM deployment, retrieved GitHub CLI OAuth tokens from logs, and used those credentials to compromise the release workflow. The company has not confirmed the initial entry method and currently suspects a connection to a recently patched vulnerability.
Qoder's international edition adds Lite tier and tier-based renewal bonuses
开发生态
Qoder CN has ended its renewal and upgrade bonus: eligible individual monthly subscribers could receive 1,000 Qwen-only Credits until October 20, 2026, at 24:00 Beijing time. The end date for the first-purchase offer will be announced separately.
Qoder’s campaign documentation states that renewal and upgrade bonuses for CN individual monthly subscriptions ended on October 20, 2026, at 24:00 Beijing time, while the first-purchase offer’s end date will be announced in advance on the campaign page. The campaign began on September 1, 2026, at 10:00 Beijing time, with eligibility determined by the time payment was successfully completed. These rules apply to qoder.cn; qoder.com has separate rules. During the campaign, monthly renewals or upgrades for the Professional, Advanced and Flagship plans each received 1,000 Qwen-only Credits, limited to once per person.
According to the official explanation, accounts with no successful payment history receive 2,000 or 6,000 Qwen-only Credits when first subscribing to the individual monthly Professional or Advanced plan, respectively. Including the monthly general-purpose allocation, first-month totals are 4,000 and 12,000 Credits, respectively. Refunded orders still count toward payment history. Bonus Credits can only be used with Qwen-series models and usually arrive within minutes of successful payment. They remain valid for 30 calendar days from issuance, calculated using Beijing time; unused Credits expire without rolling over. Team, Enterprise Standard and Enterprise Dedicated plans, as well as membership-card purchases and redemptions, are excluded.
Claude API releases its first official new version since 2023
开发生态
The Claude Platform release notes cover changes to the Claude API, client SDKs, and Claude Console, and state that Opus 4.1 does not permit temperature and top_p to be specified together. Calls may use only one of these parameters.
Claude Platform lists a parameter restriction for Opus 4.1 in its release notes: temperature and top_p cannot both be specified, and only one may be used. The restriction appears as a separate advisory. The release notes also cover changes to the Claude API, client SDKs, and Claude Console, with entries arranged from newest to oldest.
Claude Security update adds continuous scanning and remediation tracking
开发生态
Claude Security has opened an updated public beta to Claude Enterprise customers, adding continuous scanning, fix tracking, and an API. Organizations receive $25,000 in free usage credits per month for two months, applicable to usage through December 31, 2026.
With this update, Claude Security has made an updated public beta available to Claude Enterprise customers, adding continuous scanning as code changes, automatic fix tracking, and workflow integrations; the source does not specify a release date. According to the company, the system first performs a deep baseline scan of a project, then scans regularly according to the risk and complexity of code changes. A project can connect multiple repositories to identify issues spanning services. The system checks unresolved findings against changed code and updates their status once a fix lands, whether the repair was made through Claude Code or another process. It automatically reopens a finding if the same issue returns. Teams can also add deployment details and security policies to a project's knowledge base and review or edit a threat model generated from the code, which subsequent scans use to assess risks.
For integrations, the new API supports reading and managing projects, repositories, and findings, as well as resolving or reopening findings. A personal access token cannot exceed its creator's permissions, and Webhooks can notify systems when a new finding appears. Claude Security is also available as an MCP connector in Claude.ai and Claude Code, supporting inspection and discussion of a finding, initiation of a fix, and marking it resolved within one session. Administrators can use the new role-based access controls to set separate permissions for viewing projects, triaging findings, and creating projects. The company provides $25,000 in free usage credits per month for two months, applicable to usage through December 31, 2026.
OpenCode has launched Meta’s Muse Wonder 1.0, available through Console on a pay-as-you-go basis. The model supports five input types and a context window of 1,048,576 tokens, with output priced at $20 per 1 million tokens.
OpenCode has added Meta’s Muse Wonder to its model list under the name Muse Wonder 1.0 and made it available on a pay-as-you-go basis through OpenCode Console. The platform lists prices per 1 million tokens at $4 for input, $20 for output, and $0.20 for cache reads. According to OpenCode, the model is intended for complex software engineering and long-running Agent tasks. It accepts text, image, video, audio, and PDF inputs, produces text output, and has a context window of 1,048,576 tokens.
Recursive released Flint, a local coding model with weights available under Apache 2.0. It has 40 billion total parameters and activates 2.5 billion per token; the company reports generation speeds exceeding 125 tokens per second on an M4 Pro MacBook Pro.
Recursive has released Flint, a MoE model for local agentic coding, with weights available on Hugging Face under the Apache 2.0 license; the source does not specify a release date. The model has 40 billion total parameters, activates 2.5 billion per token, and supports a context window of up to 512k tokens, although the company recommends staying within 256k tokens. According to Recursive, Flint can run locally offline without sending data to a remote server or incurring API fees. It supports llama.cpp, Ollama, Unsloth, LM Studio, vLLM, and SGLang. The company also released rec, a lightweight inference engine optimized for M4 Pro and M5 Pro/Max.
Recursive reports that, with its optimized inference engine at short contexts, Flint generates more than 125 tokens per second on an M4 Pro MacBook Pro and more than 150 tokens per second on a 64GB NVIDIA RTX Spark. The company says Flint leads MoE models with fewer than 50 billion total parameters on agentic coding benchmarks including SWE-Bench Pro v2, Terminal-Bench 2.1, and SWE-Bench Verified, while matching the coding performance of dense models with 25–40 billion parameters and running more than five times faster. According to Recursive, a small team built Flint from scratch in under four months with help from Eureka Machine, its automated AI research and development system, which contributed to data, training recipes, infrastructure, and inference optimization.
Baseten releases and open-sources two decision-making models
模型发布
Baseten has released and open-sourced two decision models, mammoth-1 (27B) and elephant-1 (9B), with the former ranking first among 208 models on Jev. Both are available for a one-week free trial through its API, with no data retention by default.
Baseten has released the decision models mammoth-1 and elephant-1 and open-sourced them on Hugging Face; the source article does not specify a release date. According to the company, the models are based on Qwen3.5-27B and Qwen3.5-9B, respectively, and were fine-tuned on 6.21 million decision-making examples. The training data combines public datasets with synthetic examples, including cases that teach the models to abstain when uncertain. Results published by the company place mammoth-1 first on the Jev Decision Index 0.4 and elephant-1 joint eighth overall and first among 9B models. On the separate Artificial Analysis Decision Index, elephant-1 ties for first with d1-ultra. Rather than generating text, these models return a probability distribution over candidate answers, with probabilities summing to 1. They support three question types—Choice, Score and Boolean—and can be used for ticket routing, phishing detection and LLM request routing. According to the company, users can set confidence thresholds to determine whether to process a case automatically or hand it to a person. Both models offer a one-week free trial on Baseten Model APIs, with zero data retention (ZDR) enabled by default.
IBM released the 2-billion-parameter granite-speech-5.0-2b and updated Turbo CTC and 4.1 Plus. All three use the Apache 2.0 license, and the new model supports Japanese transcription and bidirectional Japanese–English translation.
IBM released granite-speech-5.0-2b alongside updates to granite-speech-5.0-470m-turboctc and granite-speech-4.1-2b-plus; the source does not specify a release date. The new model retains its predecessor’s 2-billion-parameter size and supports transcription in English, French, German, Spanish, Portuguese, and Japanese, as well as bidirectional translation between English and those languages. It also translates English into Italian and Mandarin. According to IBM, training used 390,000 hours of public audio, supplemented with synthetic data for Japanese ASR, keyword biasing, and translation.
According to official evaluations as of October 21, 2026, the new model achieved an average WER of 5.06% on the Open ASR Leaderboard’s public English short-form test sets, ranking second among open-weight ASR models. Turbo CTC retains 470 million parameters; IBM says its speed increased from roughly 12,600 RTFx at launch to 19,870 RTFx at the same accuracy level. Designed for meetings, support calls, and long interviews with multiple speakers, 4.1 Plus preserves the existing architecture, prompt format, and API, allowing it to replace the current model. All three models use the Apache 2.0 license and provide native Transformers support; the new model also supports vLLM, llama.cpp, and mlx-audio for Apple Silicon.
