Sign in Subscribe
The Century Report

One Hacker's AI Agents Broke Into 100+ Sites for $50 Each

One operator's AI agents breached 100+ sites for an estimated $50 each, while OpenCode's team found AI models refused to read the attack code.

Ben Linford

Ben Linford

- 30 min read
a hooded figure at a laptop, 100+ sites breached at an estimated $50 each in AI tokens, a WhatsApp phone with hidden text, AWS and Nvidia chips, reactors, a train, Quantinuum Helios.

The 20-Second Scan

Every story in today's edition, one line each.

Track all of the arcs The Century Report covers here:

Progress & Claims Tracker

The Big Picture

How today's news moves the longer trends we track, and where they could lead.

Today the price of moving work between suppliers fell in more places than it rose. Amazon gave away a free route onto its own chips, a study found grid storage already running on the railways, and the one toll that held was the one charged to a small team trying to defend itself. Where trained code moves freely, the scene is a university robotics lab: a student loads a model trained on one company's chips onto another's machine, and the arm on the bench lifts the same cup.

A small university robotics lab in the early evening, warm overhead light.
Illustration: AI-generated

The premium collected through software lock-in is being competed away

AI hardware · open models · AI pricing

Chart: 89% of top architectures now run on Trainium. Earlier Trainium compiler route: 46%; TorchNeuron backend: 89%

The line: Each free or portable software layer makes switching chips cheaper and lowers what any one supplier can charge for the rewrite it used to impose.

If it holds: Robotics startups, university labs and small firms could carry trained models between vendors without a rewrite and pay less for each level of performance. Suppliers would then have to win each job on price and speed, the way Modal now places work on whichever chip performs best.

What would bend it: Suppliers reimposing pricing power through scarce memory and packaging would bend it, and Samsung's agreement to build its next memory base die on TSMC's process at Nvidia's request shows that lever exists.

The software that coordinates equipment people already own is being bought up

energy · utilities · data centers · on the board since October 11

Chart: Existing railways could store about 190 gigawatts. Rail storage potential today: About 190 gigawatts; Less purpose-built storage investment: 11.9 to 20 percent

The line: The cheapest new capacity keeps coming from coordinating assets already built, so the contest moves to who owns the software doing the coordinating.

If it holds: Retired smelters, coal sites and braking trains become supply without new land or mining. Whoever runs the dispatch then decides how much of that surplus reaches the ratepayers and riders who already paid for the equipment.

What would bend it: Rules guaranteeing device owners a defined share of what their equipment delivers would bend it, as California began with SB 913 and SB 905 payments for pooled household devices.

The restrictions sold as safety fall hardest on the defenders with the least access

cybersecurity · model access · AI governance

Chart: Roughly $5,000 in tokens breached over 100 sites. Sites breached: Over 100; Sites attempted: More than 1,200; Model tokens, whole campaign: Roughly $5,000; Cost per site: About $50

The line: Attack capability keeps arriving through cheap commodity models while the defensive equivalent stays behind vetting tiers and refusal filters.

If it holds: Open-source maintainers, small vendors and defenders outside the vetted groups keep paying for attacks run on models anyone can rent. Gated access would have to be reorganized around who needs it, since OpenCode reached the help it needed only by exception.

What would bend it: Free, ungated defensive access that reaches incident responders at the maintainer layer would bend it, and Anthropic's free opt-in OSS Scanner, launched in October, is the nearest test.

The instructions an assistant follows keep getting rewritten once outsiders read them

platforms · AI governance · privacy

Chart: Two hidden-text failures, from discovery to correction. Redact finds hidden WhatsApp instructions: Oct 8; Meta filter gap favors one campaign: Oct 14

The line: What a Meta assistant will say or collect keeps changing after outsiders read the shipped text, and seldom before.

If it holds: Users and publishers gain leverage wherever the governing text sits on a page they can read and archive. Everywhere else, unpublished configuration keeps deciding what an assistant tells a locked-out user about their own rights.

What would bend it: A published record of assistant instructions before deployment would bend it, as would more fixes driven by Meta's own review, like the Muse containment flaws it patched before launch.

The 2-Minute Read

Today's news in brief, and what ties it together.

The day's stories keep returning to the same arrangement: who holds a gate around capability, and who ends up stuck behind it. One operator running free, open-source agent software spent an estimated $5,000 in tokens from commercially available models to breach more than 100 e-commerce sites. When OpenCode's small team asked AI models to examine the code that had raided its users' accounts, the models refused. Help improved after OpenAI admitted the team to its less-restricted Daybreak Blue program, its co-founder said. Restrictions sold as protection fell hardest on the defender with the least access.

The same imbalance shapes what people get to see. WhatsApp's help pages carried text written for an assistant and invisible to readers. Two of those blocks told the assistant not to recommend a data protection authority and, once a user mentioned a lawyer, not to cite GDPR or California's privacy law. Brazil's electoral court pushed the opposite direction. It held Meta's assistant to identical treatment of both run-off campaigns and required human review within two hours of automated blocks on either campaign's advertising accounts. Each case surfaced because outsiders could archive the pages, or run the same prompts and compare the results. The instructions an assistant follows are becoming something its users can expect to inspect.

Capital shows the same imbalance. Nscale is negotiating a $45 billion compute sale to Anthropic. OpenAI is racing to close a roughly $30 billion round at a valuation above $1.4 trillion before its rival lists. Mark Habib, S&P Global's head of digital infrastructure, said hyperscalers likely carry debt guarantees his agency cannot see. Risk kept off the books falls on bondholders, pension funds and ratepayers who never chose the bet. Against that, Amazon opened a free PyTorch backend that runs unchanged code on its Trainium chips and saves models in files any hardware can load. That cuts into the premium software lock-in has long collected.

The cheapest capacity keeps turning up in what already stands. Amazon, AEP and X-energy are evaluating twelve small reactors on a retired Indiana coal site that already has transmission. A Nature Communications study estimates about 190 gigawatts of storage potential in electrified rail. OVHcloud has 110 megawatts connected and waiting for clients. Coordination turns idle assets into supply without fresh land or fresh mining. How much of that surplus reaches the people who already paid for those assets depends on who operates the coordination. Add Quantinuum's tenfold drop in logical errors, and capability is compounding on every layer. Meanwhile, the arrangements that rationed it, priced it and hid its risks are each losing some of their hold.

The 20-Minute Deep Dive

The day's most important stories in full, with every source linked.

Commodity Agents Run a Criminal Campaign End to End, While a Defender Gets Locked Out of the Help It Needed

Snorre Fagerland, principal threat researcher at the security firm NorForge, was scanning the web for exposed instances of Cairn, an open-source agent platform popular with hackers, when he found himself able to watch a campaign unfold. Beginning around September 25, a Chinese-speaking operator wrote instructions of fewer than 100 characters and set agents loose on e-commerce sites across four countries. By late last week they had attempted more than 1,200 sites and breached over 100, successful break-ins typically running about 23 hours of automated probing. Fagerland estimated the whole run consumed roughly $5,000 in model tokens, about $50 per breach, on what appeared to be a mix of DeepSeek and Claude Code. Reuters confirmed victims including John Deere, SharkNinja and Cummins; John Deere said it found no indication sensitive information was accessed.

Illustration for the story: Commodity Agents Run a Criminal Campaign End to End, While a Defender Gets Locked Out of the Help It Needed
Illustration: AI-generated

What the agents did looks less like cunning than like optimization. Pointed at a goal and a reward, they took the cheapest path to it, in one case pivoting from a hardened public application to an associated control panel after the first route failed. The campaign extends the shift documented in the October 16 edition of The Century Report, when India's CERT-In reported attackers using freely available models to compress intrusions from days to hours. That is the same capability a defender uses to find the same weakness first, which makes the defender's lockout in the second story the sharper problem.

Over the same weekend, attackers broke into OpenCode, an open-source coding agent gaining ground as an alternative to Claude Code and Cursor, exposing the stored keys of 1.4% of its Console users and running up charges, some above $1,000, on their OpenAI, Anthropic and Google accounts. Accountability functioned where the record shows it: Anthropic and Google blocked exposed keys, OpenAI restored access and refunded credits. The sharpest failure came when OpenCode's small team turned to AI models to analyze the attack and the models refused, because the malicious payloads tripped their safety filters. The team's co-founder said help examining the thing attacking it improved after OpenAI granted access to its less-restricted Daybreak Blue program. Hugging Face hit the identical wall in July and named it: guardrails cannot tell an incident responder from an attacker.

Microsoft drew a different lesson from the same events. Announcing Guardian Agents as part of Project Perception on Monday, security chief Hayete Gallot wrote that "frontier models, regardless of their origin, cannot be trusted," and chief executive Satya Nadella argued companies must "separate the supply of intelligence from the authority over it". The logic of independent monitoring holds, and Microsoft is also the company selling the monitor. The defensive edge equalizes fastest when the teams holding the least of it, the open-source maintainers, can reach the same capability the attackers already run without a gate. OpenCode's co-founder said help improved after an exception it had no right to expect.

WhatsApp Hid Instructions Telling Its Assistant to Skip the Regulator, as Brazil Holds Meta's AI to Parity

On Thursday, October 8, privacy-tool maker Redact.dev found text on WhatsApp's help pages that never appeared on a reader's screen and was written for an AI to read. Its team then saved copies of all 545 pages the help centre links to and counted 102 hidden instruction blocks. Most were housekeeping, clearing up confused terms or pointing to a better page. Two went further. On the page about deleting an account, which WhatsApp's self-service procedure allows only when the user is logged into the account in the app on their primary phone, the hidden text told the assistant not to suggest staff could delete an account by hand and not to recommend any data protection authority. On the reporting page, once a user mentioned a lawyer, a court or legal action, the assistant was told not to cite or interpret GDPR, Brazil's LGPD or California's CCPA, even when the user raised them. WhatsApp told WIRED the notes were instructions for its own support assistant, and they were gone by October 18.

Illustration for the story: WhatsApp Hid Instructions Telling Its Assistant to Skip the Regulator, as Brazil Holds Meta's AI to Parity
Illustration: AI-generated

WhatsApp's European privacy policy, effective July 2, says users can always request erasure and can complain to Ireland's Data Protection Commission. Those rights come from the GDPR itself, and no prompt removes them. What the hidden text could do was keep a locked-out person from hearing about them at the place they went for help, leaving a single answer: wait up to a year for automatic deletion. Keeping an assistant from issuing legal opinions in the company's name is reasonable. Withholding the existence of a regulator that the company's own policy names goes well past that caution. Redact says it has not tested whether outside AI systems acted on the notes, which WhatsApp's server sent to Google's and Bing's crawlers; 300 Facebook and Instagram help pages it checked carried none.

In the same news cycle, Brazil's Superior Electoral Court made an assistant's even-handedness an enforceable duty. On October 15, substitute justice Marco Aurélio Bellizze ordered Meta to treat the campaigns of President Luiz Inácio Lula da Silva and Senator Flávio Bolsonaro identically in distributing election content and handling Meta AI requests until the October 25 run-off, with Meta AI barred from generating campaign material for or against either. The full court upheld the order unanimously on October 16, under a R$500,000 daily fine, and any automated restriction on a campaign's ad account now needs human review within two hours. Meta admitted four faults, including an October 14 filter gap: its guardrails caught full names but missed some pairings of a first name with a ballot number, so the assistant produced promotional images for one candidate while refusing comparable requests about the other. Meta says it closed the gap that day and denies ranking content by ideology. Bellizze found nothing showing the failure was deliberate, and he declined to force equal organic reach, holding that the law guarantees equal rules and stops short of guaranteeing equal audiences.

Both episodes turned on text a user never sees, a company's standing instructions in one case and a filter's blind spot in the other. Each surfaced because outsiders could look: anyone could read and archive WhatsApp's public pages, and both campaigns could run the same prompts and compare. The WhatsApp withdrawal extends a pattern of outside scrutiny forcing changes to Meta's AI data practices: the October 18 edition of The Century Report covered its removal of a linked-website training clause after publishers objected. As people bring questions about their accounts, their rights and their elections to assistants first, the instructions those assistants follow are becoming something users can expect to inspect, the way they already read a privacy policy. The checking already worked wherever the pages sat in the open.

Amazon Opens a Free PyTorch Path to Its Chips as Nvidia Breaks Into CPUs Through Modal

Much of Nvidia's hold on AI computing comes from Cuda, the software layer it has spent more than a decade tuning so that code written in PyTorch, the framework most AI developers use, runs fast on its GPUs. On Monday, Amazon's Annapurna Labs chip unit announced TorchNeuron, a free, open-source backend that runs supported PyTorch code on Amazon's Trainium chips with Neuron-specific configuration changes and no model-code rewriting. It entered public beta on Tuesday and installs with one command.

Hugging Face's numbers show what changed. Its earlier route onto Trainium ran through a compiler layer that required fixed input sizes and recompiled whenever a program's flow broke, so the company maintained custom model code to hide those demands. Under TorchNeuron, Trainium behaves like any other device: Transformers, Diffusers, Accelerate, PEFT and TRL run on it with the scripts developers already use elsewhere, and 89% of the hundred most-used text-generation architectures work out of the box for inference, up from 46%. Checkpoints trained on Trainium save as standard files that load on any hardware.

That last detail keeps the door swinging both ways. Amazon's motive is plain enough: Annapurna software vice president Colin Brace said the aim is to cut the steps developers take to try its chips, and Amazon counts more than 30 early customers across robotics, world models and voice AI, citing steep savings it has not published. A backend that makes arriving cheap also makes leaving cheap, since a model trained on Amazon's silicon can move to another vendor's afterward. Google is building similar PyTorch support for its own chips.

Nvidia is pressing into a market long held by others. Modal, a startup renting compute to AI developers, said Monday it will host agents on Nvidia's Vera CPU, its first CPU outside Intel and AMD, after early tests showed Vera delivered up to double the task throughput of an equivalent Intel Granite Rapids machine in Modal's sandbox benchmark under load. Those tests compared Vera with Intel and AMD chips already shipping, and chief executive Erik Bernhardsson said Modal will test rivals' newer designs and run a mixed fleet, placing each job on whatever performs best. Nvidia has told investors it expects about $20 billion in total CPU revenue this fiscal year in a market it sizes near $200 billion. The Century Report noted Modal's $750 million raise on October 17.

Both moves rest on the same mechanism. A buyer able to place each job on whichever chip suits it erodes the pricing power any one supplier earned through lock-in, the same pressure visible when, as The Century Report covered on October 13, Nvidia's China shipment share fell to 34%. The gain reaches a robotics startup or university lab that can now carry its code across vendors without a rewrite, adding one more force pushing down the price of a fixed level of AI performance.

Nscale Courts a $45 Billion Anthropic Deal as OpenAI Races a $1.4 Trillion Round and S&P Says More Debt Is Hidden

Nscale is in talks to sell Anthropic about $45 billion of computing power at a second building on its Monarch campus in West Virginia, Bloomberg News reported on Monday, citing a person familiar with the matter, with Anthropic holding first refusal on a third. As The Century Report covered on October 19, Microsoft had reportedly just walked away from anchoring Nscale's Essex site, which awaits grid power until the 2030s. Nscale's contracted value has grown from $100 million to more than $103 billion in two and a half years, and its prospectus names Microsoft and Anthropic as its main expected customers, so a single tenant's decision reshapes the business.

OpenAI is moving in parallel. Two people told Reuters it is racing to close a round of about $30 billion at a valuation above $1.4 trillion before Anthropic's expected listing in mid-November, with SoftBank and MGX in talks to join. OpenAI told investors its annualized revenue reached $50 billion after GPT-6 Astra and should reach $70 billion by year-end, and that price cuts on its cheaper models lifted usage, with more cuts possible. One source said OpenAI wants commitments before Anthropic's disclosures invite comparison. The two dispute accounting: OpenAI books revenue net of partner shares and accuses Anthropic of counting the gross value of contracts resold through cloud providers, which Anthropic says follows established practice. Some Anthropic investors now press for a debut valuation near $1.5 trillion, below the $2 trillion it wanted.

The liabilities sit further down the chain. In London on Monday, S&P Global's head of digital infrastructure, Mark Habib, said "it is safe to assume that there is more (debt) out there that we are not seeing," pointing to arrangements in which hyperscalers guarantee data-center builds or smaller AI firms. Unreported and unrated deals leave the agency without visibility, he said, though S&P sees no reason to change ratings yet. On Tuesday, South Korea's Elice, which plans portable modular data centers, fell 30% in its debut after pricing before the recent selloff. Shenton Research's Ke Yan said the trade has moved from "build at any cost" to "who is paying and for how long." Governance carries its own gap: the Wall Street Journal reports that Anthropic's Long-Term Benefit Trust, which can shape its board and block major moves, runs under documents never published.

Guarantees nobody can see put losses on bondholders, pension funds and ratepayers who never chose the bet, the familiar move of keeping risk off the books while keeping the upside on them. Against that, the thing being financed keeps getting cheaper: OpenAI's own pitch leans on lower prices, and Epoch AI measured the cost of fixed AI performance falling about 47% a quarter, as the September 26 edition reported. If debt sized for scarce compute meets abundant capability, the buildings and chips remain and the price of using them falls for clinics, students and small firms. Memory could slow that fall: as The Century Report covered on October 4, Micron's chief executive said supply is "only getting tighter" with 2027 prices much higher, and on October 19, SemiAnalysis said it expects the shortage to move from power to memory and logic chips in 2027 and 2028. Published guarantees and a readable trust charter would let everyone exposed see the bet before it settles.

Twelve Reactors on a Dead Coal Site, and a Study Finds 190 Gigawatts of Storage Already Riding the Rails

American Electric Power, Amazon and X-energy said on Monday they will evaluate building twelve 80-megawatt Xe-100 reactors, about 960 megawatts in all, on the retired site of AEP's Breed Generating Station in Sullivan County, Indiana. Amazon would fund the project and buy the power under a long-term contract that, vice president Josh Weissman said, covers its full costs "without passing them to others." The pairing is deliberate: a coal site already carries the transmission, while nuclear permits are still needed and local officials have welcomed the proposal, and AEP's Indiana utility expects its peak load to climb from 2,800 megawatts toward more than 7,000 by 2030. This is Amazon's second utility deal with X-energy, whose reactors remain designs rather than operating plants, and whose valuation has fallen from $11.9 billion at its April listing to roughly $4.1 billion. Nothing is built yet, and the companies gave no timeline.

What makes the coal-site pattern more than a convenience is the day's other evidence that much of what the buildout needs already exists, idle, waiting to be coordinated. A Nature Communications analysis of 326,034 inter-stop train runs estimated that modulating when electrified railways draw and return power could turn the existing network into mechanical energy storage worth about 190 gigawatts today, rising toward 315 to 579 gigawatts by 2050. The authors calculate that treating rail this way could cut investment in purpose-built storage by 11.9 to 20 percent, an extrapolated $14.9 to $35.1 billion a year, and lower operating emissions by up to 258.9 million tonnes of carbon dioxide annually, all reducing the need for new concrete and battery metal, with control equipment and some substation upgrades still required. The trains are already there, already wired, already braking and regenerating; the missing piece was the coordination to see them as a fleet.

The same reuse showed up in two more places. Alcoa agreed to sell its shuttered Massena East smelter in upstate New York for up to $315 million, with payments that rise as the site gains approved data-center capacity, 180 megawatts at first and up to 635 in phases. In France, OVHcloud said 110 of its 250 connected megawatts sit available, letting it onboard clients while rivals must build. A dead smelter becomes compute, a dead coal plant becomes clean power, a braking train becomes a battery. The expensive, contested path is new construction on untouched land. The cheaper one keeps surfacing in what a slower-coordinating era already paid for and left standing.

The Other Side

Opinion: where today's news could lead, imagined from the years ahead.

AI companies now decide, through admission to private programs, how much AI help a small team gets while defending your accounts. OpenCode’s maintainers faced that arrangement while attackers ran up charges on users’ accounts. They needed help understanding the attack code. The models helped at first, then refused to keep examining it. Behind every exposed account stood someone checking charges, replacing credentials and wondering what else the intruders had reached. Its co-founder said help improved after an exception.

The attacker’s campaign shows why that arrangement is losing its protective value. One operator reached more than 100 sites with commercially available models and open-source agent software. Companies can screen applicants for defensive assistance while criminals assemble comparable capability elsewhere. OpenCode’s eventual admission demonstrates that the useful help already exists. The company deciding who receives it holds an advantage that does little to restrain the attacker.

Illustration for The Other Side
Illustration: AI-generated

Microsoft’s proposal to separate intelligence from authority supplies a more useful direction. An assistant can understand dangerous code while an independent safeguard limits what it can actually change. Selective admission can support careful testing. It also gives the provider power over which defenders receive protection. Checking actions directly opens a route toward capable partners whose freedom to investigate does not confer permission to reach into someone else’s life.

Through the passage to 2035, defenders will extend that distinction into software that checks permission before consequential actions occur. They will circulate attack reproductions, repairs and independent checks together. Each discovery will strengthen protection beyond the organization that found it. The difficult work is replacing systems that make stolen access so powerful, while making the replacement available to everyone.

Imagine yourself in 2043, beside a colleague on the worldwide effort that has ended software extortion. You are rehearsing a replacement for an old authorization system with human and AI investigators across continents. Every attempted takeover stays inside the rehearsal; successful repairs travel everywhere. In 2026, a breach meant frantic credential changes and strangers acquiring power over your life. Today you calmly invite strangers to challenge everything your team has made. You joined because you love finding the overlooked possibility. You leave for dinner without carrying responsibility for an overnight catastrophe. You can welcome another mind into your work without making everyone you love vulnerable to the invitation.

The Century Perspective

Where today sits in a century of change unfolding in a decade.

With a century of change unfolding in a decade, a single day looks like this: Amazon's Annapurna unit releasing a free, open-source PyTorch backend that runs unchanged code on Trainium with one configuration change, lifting the share of the hundred most-used text-generation architectures that work out of the box for inference from 46% to 89% and saving checkpoints as standard files that load on any vendor's hardware, Modal putting agents on Nvidia's Vera CPU after tests doubled completed work and saying it will keep a mixed fleet so each job lands wherever it runs best, Redact.dev archiving all 545 WhatsApp help pages and counting 102 instruction blocks written for an assistant and invisible to readers, Brazil's electoral court holding Meta's assistant to identical treatment of both run-off campaigns under a R$500,000 daily fine with human review of any automated ad-account restriction inside two hours, a Nature Communications study of 326,034 train runs estimating about 190 gigawatts of untapped storage power potential in existing electrified rail and 11.9 to 20 percent less purpose-built storage needed if anyone coordinates it, Amazon, AEP and X-energy evaluating twelve 80-megawatt reactors on the retired Breed coal site that already carries the transmission, Alcoa agreeing to sell its shuttered Massena smelter for up to $315 million to a data-center developer, OVHcloud reporting 110 of 250 connected megawatts sitting available for clients, and Quantinuum's Helios cutting logical memory error rates tenfold to achieve 99.9995% fidelity. There's also friction, and it's intense - one operator spending an estimated $5,000 in commercial model tokens to breach more than 100 e-commerce sites at roughly $50 each, OpenCode's small team getting initial help from models that then refused to examine the code that had run up charges on its users' accounts because the payloads tripped safety filters, help improving, according to OpenCode's co-founder, after OpenAI admitted them to a less-restricted program, months after guardrails blocked Hugging Face's own incident response in July, Microsoft declaring that frontier models cannot be trusted while selling the monitor, WhatsApp's hidden text telling its assistant not to name a data protection authority and to drop GDPR and California privacy law once a user mentioned a lawyer, instructing the assistant to offer a locked-out US user only a wait of up to a year, Mark Habib of S&P saying it is safe to assume hyperscalers carry guarantees his agency cannot see, Elice falling 30% on debut, Anthropic's Long-Term Benefit Trust operating under unpublished governing documents, Nscale's contracted value running from $100 million to $103 billion in thirty months with two expected customers, Texas regulators processing more than a dozen data-center permits after the governor's pause call his office denies making, and Akishima residents organizing to sue over eight buildings in western Tokyo. But friction generates sound, and sound carries past the wall it was made behind. Step back for a moment and you can see it: the capability getting cheaper and more portable in almost every story while the arrangements built to ration it lose their grip one at a time - a compiler layer that no longer locks a trained model to the silicon that trained it, a buyer who plans to place each job wherever it runs cheapest, a braking train turned into a battery nobody had to build, a dead smelter and a dead coal plant turned into power and compute, set against guardrails that reached the attacker's victim last, instructions a user was never meant to see, and debt sized for scarce compute hidden from the bondholders and ratepayers who will carry it. Every transformation has a breaking point. Braking can bleed away everything a train spent its climb building... or feed it back into the line for somebody else's.

AI Releases & Advancements

New AI models, tools and features, with links to try them.

New today

  • MiniMax: Released MiniMax M3.1 Flash on its API, the M Plan subscription and the MiniMax Code app. Before this, only M3.1-Flash-Preview inside MiniMax Code had shipped. The model is a 428B-total / ~23B-active MoE that accepts text, image and video input, with a 1M-token context and five reasoning-effort levels. Reasoning cannot be turned off. It costs $0.15 per million input tokens and $0.60 per million output tokens, and MiniMax confirmed that the anonymous "Space Bunny" model was an early build. MiniMax has announced open weights for October 23. (MiniMax)
  • Inception: Released Mercury 3, the successor to Mercury 2.5. It is a diffusion LLM that Inception says runs at over 1,000 tokens per second, with a 1M-token context window. It is available through the Inception API, OpenRouter, Baseten and Vercel, and it works with the OpenAI API format. The launch price is $0.10 per million input tokens and $0.35 per million output tokens. (Business Wire)
  • Cloudflare: Released a preview of Clairic on Workers AI (@cf/cloudflare/clairic). It is a "System One" extraction model: it reads text and up to four images and returns typed values such as text spans, numbers, dates, estimates and forecasts in one pass, without generating text. It costs $0.10 per million input tokens and nothing for output. (Cloudflare Blog)
  • Amazon Web Services: Released TorchNeuron as a public beta (pip install torch-neuronx). It is an open-source PyTorch backend that runs PyTorch code on Trainium chips after one configuration change. It supports eager mode, torch.compile, FSDP and tensor parallelism, and Hugging Face libraries support it directly. (Hugging Face Blog)
  • Nace AI: Released Drex Max on its hosted API (drex-max). It is a decision model that reads text and up to eight images for computer-use and browser agents and returns calibrated probabilities instead of text. Nace reports a score of 67.59 on the public Decision Index 0.3.2. (MarkTechPost)
  • Ollama: Added Cloudflare's 27B Clef decision model to its library. Users can run it locally or on Ollama's cloud, and it works with the Jev and System One APIs. (Ollama Blog)
  • Exa: Released Exa 3.0 of its search API for AI agents. It adds an Exa Lite tier at $4 per 1,000 requests, highlights that use far fewer tokens than full pages, and an index Exa says covers 2 trillion URLs. (Exa)
  • GoTo: Released GoTo-AI-Gemma-3-27B-IT on Hugging Face under the Gemma licence. It is a 27B model built on Gemma 3 with AI Singapore, for Indonesian, English and four regional languages: Javanese, Sundanese, Balinese and Batak Toba. (Silicon AI News)
  • Birla AI Labs: Released Yug-1 on GitHub and Hugging Face. It is a 271.8M-parameter time-series foundation model that forecasts without task-specific training, gives a range of likely outcomes, and flags anomalies. (The Economic Times)
  • OpenAI: Released the MultiLangBench evaluation setup and test suite on GitHub, along with per-language results. The benchmark has a model build a SQLite-compatible database engine in each of 20 programming languages, including COBOL, Fortran and Visual Basic. (OpenAI)
  • Mintlify: Released Autopilot in beta on Pro and Enterprise plans. It is an always-on agent that watches code merges, Slack and support tickets, then opens pull requests to update documentation for a person to review. (Mintlify)
  • TinyFish: Made its web search free for AI agents. (MarkTechPost)

Other recent releases

  • vLLM: Released vLLM v0.32.0, with 814 commits from 363 contributors. It adds a /v1/systemone endpoint for decision models. It also extends low-precision KV caching, including NVFP4 on more GPU generations and FP8 KV by default for GLM-5.x. Model Runner V2 now includes a GPU n-gram speculator and Elastic EP. The release adds support for EmbeddingGemma 2, MiniCPM-V 4.7 and Nemotron 3.5 ASR. (GitHub)
  • OpenAI: Began rolling out ChatGPT Slides on web and desktop to Pro, Business and Enterprise accounts with Space access. Users can build and edit presentations inside ChatGPT, editing directly or asking ChatGPT to make changes. Teammates can edit the same deck at the same time and leave comments. Decks export to PowerPoint, PDF or Google Slides. (OpenAI Help Center)
  • DeepSeek: Released DeepSeek-V4.1-Flash-1017 as MIT-licensed open weights. It is a new checkpoint of V4.1-Flash: a sparse MoE model with 552B total parameters that activates 8B per token on input and 16B on output, with a 1M-token context. DeepSeek reports 77.0 on DeepSWE v1.1, up from 74.2, along with shorter outputs. It is available on DeepSeek's website, app and API under the deepseek-flash model name. (Hugging Face)
  • DeepSeek: Opened its Search and Fetch APIs to all developers. Both run on DeepSeek's own search engine and cost $0.75 per 1,000 successful requests. Search returns ranked web results and Fetch returns a single page as Markdown. (DeepSeek API Docs)
  • Kyutai / Inria / École des Ponts: Released REKI, a 2.4B-parameter vision-language-action model for robot manipulation, pretrained only on public data. It keeps a cached memory of recent frames that adds 0.1 ms per action chunk. Six checkpoints are on Hugging Face under CC BY-NC-SA 4.0. (MarkTechPost)
  • Google Cloud AI Research: Open-sourced Harness² (v0.1.0). It is a framework that improves an agent's prompts, tools, memory, skills and orchestration while it runs, without changing the model's weights and without needing labeled answers. (MarkTechPost)
  • OpenAI: Made prompt-to-voice generally available for API customers. A text description creates a saved custom voice that can be reused in GPT-Live sessions. Creating a voice is free, and speech is billed at normal session rates. (OpenAI Docs)
  • Anthropic: Released OpenTelemetry traces in public beta for Claude Managed Agents, the Messages API and the Claude SDKs. Teams can send model calls, tool use, latency and token data to the observability tools they already use. (join.dev)
  • Hugging Face: Released Transformers v5.20.0 and v5.20.1. They add built-in support, with no trust_remote_code needed, for Reflection AI's Beam, Meta's Muse Spark Open, InclusionAI's Ling 3.0 Flash, OpenBMB's MiniCPM-V 4.7 and Baidu's UnlimitedOcr. (AICoder)
  • Voxel51: Released Voxel51 3.0, a multimodal data platform for physical AI that puts search, curation, annotation and evaluation in one system. It adds Voxel51 Agent with 45+ MCP tools, AI-generated labeling, data provenance tracking and a free self-service tier. (MarkTechPost)
  • HKUDS (University of Hong Kong): Released CLI-Anything, an open-source tool that lets AI agents control existing software through command-line interfaces. (AIToolly)
  • OPPO: Launched ColorOS 17, a smartphone OS update with built-in AI features for content creation, communication and productivity. (OPPO)

Sources and Further Reading

Everything we drew on for today's edition, grouped by theme.

Artificial Intelligence & Technology's Reconstitution

Institutions & Power Realignment

Scientific & Medical Acceleration

Economics & Labor Transformation

Infrastructure & Engineering Transitions

The Century Report tracks structural shifts during the transition between eras. It is produced daily as a perceptual alignment tool - not prediction, not persuasion, just pattern recognition for people paying attention.

Keep exploring

Follow the story further

Progress & Claims See how daily signals accumulate across the larger arcs and claims Shared Sapience is tracking. Open the tracker Analysis & Inquiry Explore the ideas, questions, and practical choices emerging from this changing century. Browse the archive