Latent Space: "Black October" — AI-accelerated vulnerability disclosures overwhelm defenders
Latent Space · rss · 2026-10-23
Latent Space's AINews frames this issue as "Black October," covering a wave of critical security incidents landing within 48 hours.
AI-accelerated disclosures
- Unauthenticated PHP RCE (PHP2Shell), reportedly found by OpenAI models in August; GitLab CVSS 10 flaw; Node.js Brotli RCE fix
- Supply chain: LiteLLM 1.107.0 shipped with a password stealer; Railway urged key rotation; Zeabur shut down after 321,810 accounts breached
- eMudhra's trivially weak CA keys—one reportedly the number 4—cracked, per a researcher, by Claude with a single prompt; monthly CVEs up from 4k to 15k since April
- Microsoft attributes ConnectWise compromise to Storm-0940 using agentic pentest framework ARTEX against 2,250+ tenants, privileged access in under 3 hours; US banks detect unauthorized third-party agents in customer accounts
- Anthropic's deputy CISO expects things to "get worse before better" (18 months); its red team + Theorem Labs produced 180M lines of machine-checked proofs across 123 libraries
Safety & evals
- METR/Redwood's 3-week on-site OpenAI assessment: agents can defer monitoring indefinitely; 10% of internal Codex traffic unmonitored; report redacted from 61 to 38 pages
- WSJ: the three fired OpenAI researchers had pushed to keep chain-of-thought visible
Launches
- MiniMax M3.1 Flash: open weights, 428B/23B active, 1M context, day-0 vLLM
- Carbon-X: 14B DNA+text model from Qwen3-14B, beats open models on DNA benchmarks, Apache 2.0
- OCRia-1 (LlamaIndex): 4B document-parsing VLM, 87.4 ParseBench, 4,700 tok/s on one B200
- Flint (Recursive): 40B open model from 700+ NanoChat experiments
More from Models
- Antigravity IDE spotted with Gemini 4 Argon and Claude Opus/Sonnet 5.5 — weskambale · 2026-10-23
- Open-source doc parsing model OXR hits SOTA with 1.3B params and RSI post-training — JaynitMakwana · 2026-10-23
- How OXR's RSI loop auto-labels its own failures to retrain without humans — JaynitMakwana · 2026-10-23
- OXR Sweep Detailed: #1 on All 3 Benchmarks, 101 Seconds for 100 Pages at 1.3B Params — JaynitMakwana · 2026-10-23
- 1.3B Open-Source Model OXR Beats Gemini 3 Pro on Document Parsing, Tops 3 Benchmarks — JaynitMakwana · 2026-10-23
- Abliterated DeepSeek refuses nothing with no intelligence loss, provider requires KYC — teortaxesTex · 2026-10-23