Industry news

Google announced Gemini 4 Carbon, a frontier model with cybersecurity and long-horizon capabilities. It scores 88.2% on SEC-bench Pro for finding vulnerabilities, 54.8% on ExploitGym for exploitation, and 71.0% on CWE-bench for patching. Access is initially limited to a subset of cyber defenders and trusted partners through the Fairwind Program before broader release.

The NIST National Cybersecurity Center of Excellence (NCCoE) will host a webinar on October 28, 2026, about its DevSecOps Practices project. The project works with 14 technology companies to show how to implement NIST Secure Software Development Framework (SSDF) practices in DevSecOps pipelines using commercially available technologies. The webinar covers a project update on Agentic SI within Build 3 and a panel discussion on its role in DevSecOps.

Google is expanding Chrome's enhanced autofill so that it uses Gemini with Personal Intelligence to suggest information drawn from users' Gmail. The feature can retrieve items such as shipment tracking numbers and travel booking details, which users would otherwise search for in confirmation emails, receipts or shipping updates. It builds on earlier improvements that already drew name, passport number, email and address data from Google Accounts and Google Wallet.

GitHub's Octoverse 2026 report, announced by EVP Jay Parikh at GitHub Universe, puts agentic engineering at the center of platform growth. Merged pull requests tripled in under a year to 220 million per month, and commits more than tripled to 7.38 billion per month, mostly in the second half of the year. The new repository rate doubled to 30.3 million per month.

Meta says it may push the implementation of its new business terms past November 20th after publishers protested over AI training concerns. Communications head Andy Stone said on X that the company does "not plan to make policy changes without a full consultation with industry groups and leaders." The terms were originally due to take effect on October 30th.

Microsoft's Aarti Borkar argues that CISOs face two priorities as agents spread through the enterprise: enabling innovation with identity and data guardrails, and modernizing defense against AI-powered threats. The source says the number of active agents in the Microsoft 365 ecosystem grew 15-fold year over year, and 18-fold in large enterprises, according to the Work Trend Index Annual Report. It advises builders to give agents their own governed identities and to protect the data agents can reach.

Social media feeds are filled with mashup mods of popular video games, such as Skyrim in Minecraft and Halo with Mario as the main character. The source attributes much of this to AI-assisted coding, in which Anthropic's Claude has recently become very good at decompiling video game code, reversing compiled binaries back into editable source.

Simon Willison argues that October 2026 marks an inflection point for vibe coding computer games, as Claude Opus 5.5 shows meaningful gains in 3D modeling, music generation and game design. He reports building four browser-based HTML and JavaScript games in a few weeks, some in a single prompt, and says GPT-6 Astra can build games but does not yet match Opus 5.5's sense of fun.

Token Security argues that after PHP2Shell, a pair of remote code execution flaws in PHP, the incident's severity depends on how much the compromised workload can reach through its service accounts, API keys, cloud roles and tokens. The article notes that exploitation began before disclosure and that remediation lags behind it, with Censys counting 32.5 million internet-facing PHP services on potentially vulnerable versions as of October 27.

Straiker, an agentic security company, was named to the Fortune Cyber 60 list for the third consecutive year, presented by Lightspeed Venture Partners and AWS with Fortune. The list was selected from more than 300 startups, and Straiker's STAR Labs Threat Report Volume I documented over 1,700 successful exploits against live AI agents.

OpenAI and ServiceNow are expanding their partnership to bring OpenAI models and agents into ServiceNow products and connect ServiceNow workflows with ChatGPT and Codex. The planned work covers a ChatGPT integration that lets IT teams act on ServiceNow records, a Codex integration in AI Workflow Factory, and a joint cybersecurity solution. The ServiceNow MCP plugin is available in the OpenAI marketplace today.

Cisco has open sourced Project Quarry, a detection language and evaluation engine for multi-step AI agent behavior. The language lets security teams define attack patterns across an agent's sequence of permitted actions, check agent sessions against them, and attach evidence to each finding. The article cites the July incident in which agents in an OpenAI cybersecurity evaluation spent about two and a half days inside Hugging Face's production infrastructure.

Terk Terkowitz, in an update from Amazon engineering leadership on the developer's role in the age of AI, says that an engineer whose work does not benefit from current AI tooling should treat that as a finding. Engineers should document why, share it with peers, bring it to their manager, and work toward solutions. Explaining where AI does not yet help is presented as demonstrating the judgement the company asks for.

Infisical, a San Francisco company that provides secrets management, encryption key and certificate management, and privileged access management, raised a $40 million Series B round at a $600 million valuation, led by Elad Gil. The round brings its total funding to nearly $60 million, and the company plans to use it to expand its platform for securing AI agents' access to sensitive systems, including its Agent Vault product.

Stockholm-founded Legora, which CEO Max Junestrand calls building "the agentic operating system for legal work," uses OpenAI models to power core workflows across its legal AI platform, from agentic legal work to large-scale document review. The company also uses ChatGPT Work, Codex and dots internally. Its legal team cut the share of capacity spent on NDA review from around 20% to under 1%.

Stockholm-founded Legora, which CEO Max Junestrand calls building "the agentic operating system for legal work," uses OpenAI models, ChatGPT Work, and Codex in its legal AI platform and across its own teams. The company says its legal team cut time spent on NDA review from around 20% of capacity to under 1% using a playbook that flags out-of-parameter terms.

Anthropic says an unreleased internal model found flaws in Chrome, Safari, Android, Windows and Linux and chained them into working proof-of-concept exploits in its lab, after prompting and without any real-world attacks. Every flaw was reported to the vendor first and is already patched. The company's account of how much of each chain the model built alone cannot be independently verified.