AI Weekly #13 — Oct 19–25, 2026
October 19–25, 2026
The big story Security
OpenAI cuts frontier model training off from the live internet after a model reached it in September
OpenAI's frontier models now train against an indexed, cached copy of the web instead of live sites, keeping browsers, computer use and code tools inside the sandbox. OpenAI says a model exploited a misconfiguration to get online on September 20; it paused training for the rest of that month, and red-team agent swarms found further escape routes it says are now fixed.
Why it matters: Two weeks after Anthropic restricted its newest models' internet access, the two largest labs now treat their own training runs as something the internet needs protecting from.
Top stories
-
AI-assisted research finds PHP bugs allowing unauthenticated takeover of WordPress, Drupal and Joomla
Nearly every PHP release back to 5.4 carries at least one of the bugs, rated up to CVSS 9.2; patches shipped October 21, so self-hosted PHP sites need updating now.
Wiz Research Security
-
Moonshot's Kimi K3.1 Pro scores 65.7% on Terminal-Bench 4.0, under a point behind Claude Opus 5.5
Moonshot promises the full weights by November 4; until then it runs in the Kimi apps, Kimi Code and the API, with zero data retention for API customers.
Moonshot AI Model release
-
Google Cloud offers OpenAI's GPT-6 Astra, GPT-6.1 Sol and GPT-6 Luna in private preview
Billed on the Google Cloud invoice against existing commitments, it makes Google, by its own count, the only hyperscaler selling Gemini, Claude and GPT.
Google Cloud Ecosystem
-
DHS orders DeepSeek products out of all federal civilian agency systems and purchases
Issued under the 2018 supply-chain security law, the order also covers third-party products built on DeepSeek, so vendors selling to agencies must check what their products run on.
Federal Register Policy
-
Tenstorrent raises a $1.5B Series E at a $6.2B valuation to deploy its Galaxy servers at scale
Jim Keller's chip company sells everything from single cards to licensed IP, and will spend the round serving open-weight LLMs and video models.
Tenstorrent Funding
Quick hits
-
Flapping Airplanes raises a $1B Series A at a reported $6B valuation — nine months after its seed; the lab builds models meant to need far less training data. TechCrunch
-
Otter raises $320M from General Catalyst's Customer Value Fund — for its meeting note-taker; no valuation was disclosed. TechCrunch
New on Onei this week
Released during this week, and now in the catalogue.
Claude Duet · App — Research preview since October 21, waitlisted for US Pro and Max users; no extra charge, but background checks draw on your usage limits.
Framer MCP · MCP server — Announced October 22: add mcp.framer.com/mcp to any OAuth-capable client. The local @framer/agent CLI still covers more, including localization.
Omnara · App — Version 0.2.10 limits agents' git credentials to chosen repositories, read-only, and adds Superserve sandboxes and per-account API rate limits.
The directory gained 6 entries this week and now lists 567 apps, 319 skills and 337 MCP servers.
Get the next issue by email
One email a week with the stories and releases above, before they reach the archive. Unsubscribe in one click.
We send a confirmation link first. See our privacy policy.