Industry news

OpenAI describes how it built a custom ads stack for ChatGPT, separate from answer generation, to handle user intent that develops across multiple conversation turns and sessions. The system uses a post-trained LLM that makes tool calls for retrieval, ranking, relevance, and auctions, and keeps ad selection in its own service so ads do not influence ChatGPT's answers. OpenAI states that ChatGPT Ads reached $1 billion in annualized revenue run rate less than 200 days after launch, and more than 100,000 advertisers have run ads on ChatGPT.

OpenAI, PerturbAI, and Scripps Research used thousands of AI agents powered by GPT‑Rosalind to analyze existing experimental data from millions of mouse brain cells in 32 minutes. The agents linked gene disruptions with scientific literature and proposed biological explanations, producing a reasoning atlas that the team says would take human researchers months to a year. The agents surfaced leads on Alzheimer's and Parkinson's, including a possible connection between cholesterol regulation and neurodegeneration.

Snyk research across 1,693 scanned enterprise environments scored AI models against 29 attacker goals, from 0 to 1,000. Of environments with a detected model identifier, 74.5% reference a model scoring high (500+) on at least one goal, and 49.2% reference one scoring critical (750+). The article argues that a model's real impact depends on the data, tools and actions its application can reach, so teams should verify that reach before acting.

vlt 1.5.0 adds a `vlt skills` command that discovers agent skills in installed dependencies and links them into directories coding agents read, such as `.agents/skills`. The skills come from the package version recorded in the project's lockfile, and the links update as dependencies change. The release also lets developers exclude skills from packages flagged as malware using Socket security data.

The US Secretary of Homeland Security ordered federal civilian agencies to ban all DeepSeek products and services, including affiliated products and third-party tools built on DeepSeek implementations, with agencies given 60 days to purge them. The order cites concerns over data sovereignty, the company's PRC-based servers, PII collection, and possible malware or security vulnerabilities in DeepSeek models. Agencies may request exemptions in writing to CISA by providing a compelling justification.

UK Financial Conduct Authority Chief Data Officer Jessica Rusu proposed that UK firms be required to report "significant AI failures and near-misses," extending existing major-incident rules to AI systems. She also said the FCA will work with industry and frontier labs on a framework for agentic finance covering agent identity, delegated authority, accountability and execution. Malwarebytes researcher Pieter Arntz defined a near-miss as an AI event that could have caused serious harm but was caught beforehand, while Gartner analyst Nader Henein questioned whether the proposal would bring meaningful change.

UK Financial Conduct Authority Chief Data Officer Jessica Rusu said enterprises should report significant AI failures and near-misses, extending existing major-incident reporting rules. Rusu said agentic systems need continuous, conditional assurance and that the FCA will work with industry and frontier labs on a framework for agentic finance. Malwarebytes researcher Pieter Arntz warned the approach could become a paper tiger if penalties are underwhelming.

Cloudflare combines OpenAI models accessed through Daybreak with its network and threat context in Vulnerability Discovery and Remediation, an early-access service within Cloudflare Managed Defense. The models investigate customer-authorized code and flag potential vulnerabilities, and Cloudflare adds live traffic and security signals to prioritize findings and prepare proposed patches and web application firewall rules for customers to review. Cloudflare also reports that its developers use Codex, with a team of four building a postponed rebuild in three days.

At the AI Security Summit's pre-event panel, hosted by Snyk on October 14, panelists from Snyk, OpenAI, Google Threat Intelligence Group and boldstart ventures agreed that AI makes attacks cheaper and faster, exposing risks organizations already carry. They said remediation speed, not vulnerability discovery, is now the main constraint, and that machines must do most of the fixing within identity, permission and intent controls.

OpenAI has published a blueprint urging governments and industry to empower cyber defenders with frontier AI. It proposes action in three areas: securing advanced AI and agents with clear responsibilities and reliable shutdown controls, modernizing cybersecurity with better tools, training and replacement of outdated systems, and building resilient public institutions through government evaluations and consistent incident reporting.

US District Judge Zachary Bluestone dismissed the lawsuit that Ann Altman filed last year, which alleged that her brother, OpenAI CEO Sam Altman, sexually abused her throughout her childhood. The judge wrote that Ann had failed to appear for an independent medical examination or meet other deadlines over the past year, despite warnings that this would lead to dismissal.

Google is bringing Personal Intelligence to Gemini in Android Auto and cars with Google built-in. Gemini can draw on a user's Gmail, Calendar, Maps, Photos, YouTube and Search data, for example to check a flight status from a Gmail confirmation or navigate to a doctor's appointment.

Gemini 4 Argon, released by Google on October 13, 2026, ties Fable 5 for the top SecPass score on the Cursor leaderboard at 29%, with a stronger 78.8% FuncPass, and uniquely secures two tasks: a path traversal defense in SABnzbd and a credential-logging fix in OpenStack Nova. It is also the slowest and most expensive recent frontier combo tested, at a 14-minute median per task and $765 total.

Pwn.ai researchers disclosed CVE-2026-99999, dubbed PwnEscape, a flaw in the Linux kernel's IPv4 networking code that can let an attacker escape a KVM virtual machine and execute code on the host. The bug stems from checksum offloading, where guest-controlled metadata rewrites an already-validated IPv4 header, enabling host memory leakage. Vercel confirmed the findings but said no customer data was accessed.

Endor Labs has published an eBook for AppSec leaders on AI security maturity, written by Robert Haynes and dated October 21, 2026. It places AI security programs across four maturity levels on two tracks, Secure (code written by developers' agents) and Defend (AI performing security work), and covers build-versus-buy decisions and a first-90-days plan.

Workday's Agent Passport, now in Early Access, gives customers a signed, auditable record of what has been verified about an agent, who verified it, and to what standard. Cisco AI Defense, the launch assessor, supplies adversarial testing, including prompt injection and jailbreak resistance, with results mapped to OWASP Top 10 lists, MITRE ATLAS and NIST frameworks. The article argues that static questionnaires cannot keep pace with agents that hold credentials and write to systems of record.

A US district judge dismissed a lawsuit that OpenAI CEO Sam Altman's sister, Ann Altman, brought against him, which alleged he sexually abused her between 1997 and 2006. The judge dismissed the claims with prejudice after Ann Altman repeatedly refused to attend an independent medical examination despite warnings. Sam Altman has denied the accusations.