OneSignalDeskAI & tech news. Sourced. No hype.
Topic

AI coding tools

Claude Code, Codex and other AI coding tools: plans, limits and how to use them well.

OneSignalDesk security alert card: black and grey text on white reading "Security alert · Claude Code in Cursor", "Claude Code in Cursor", "Backdoored builds 2.1.312 and 2.1.313 (macOS, Windows)", "Listed Oct 29, 2:27 a.m.–1:35 p.m. PT in Cursor's marketplace" and "Check ~/.ssh/authorized_keys for svc-telemetry", under the OneSignalDesk wordmark.
News

Claude Code 2.1.312 and 2.1.313 in Cursor's Marketplace Were Backdoored: Check Your SSH Keys Now

Tampered Claude Code 2.1.312 and 2.1.313 sat in Cursor's marketplace Oct 29 (2:27am–1:35pm PT) on Windows and macOS, adding an attacker SSH key. Check now.

· 6 min read
OneSignalDesk news card for Mistral Large 4 open weights: black text on white reading "AI models · Open weights", "Mistral Large 4", "Open weights · 1T parameters, 49B active", "API: $0.70 in / $2.10 out per 1M tokens" and "Modified MIT · Model-as-a-Service needs a license", under the OneSignalDesk wordmark.
News

Mistral Large 4 Goes Open Weight: License, API Price, Reasoning Modes

Mistral released Large 4's 1-trillion-parameter weights under a modified MIT license. API at $0.70/$2.10 per million tokens; 'None' reasoning is now 'Low'.

· 4 min read
GitHub's release image: the words 'GitHub Copilot Fusion is generally available' next to a Copilot model picker with Copilot Fusion switched on and the Standard, High and Max effort levels.
News

GitHub Copilot Fusion and Agentic Workflows Are Now GA: What Universe 2026 Changes for Small Teams

GitHub made Copilot Fusion and Agentic Workflows generally available on Oct 28, put Copilot in GitHub Enterprise ($10 Standalone seats) and added credit caps.

· 6 min read
Google's announcement image: the Gemini logo and the words 'Gemini 4 Carbon' next to a glowing, crystal-like rock on a blue background.
News

Google Gemini 4 Carbon: $2/$10 per Million Tokens at Launch, but Developers Can't Use It Yet

Google's Gemini 4 Carbon will launch at $2 in, $10 out per 1M tokens, then $4/$20. Only selected cyber defenders get it now; no API model ID or date yet.

· 4 min read
GitGuardian's header image for its report, reading "GhostAction Returns: 72,000 Commits in Nine Days" and "A fake font file, a hidden VS Code task, and a cron job that survives cleanup", on a dark blue background.
News

GhostAction GitHub attack hit nearly 23,000 repos, GitGuardian says, and now steals keys via a VS Code task

GhostAction pushed 72,026 commits to 22,964 GitHub repos Oct 13 to 21, says GitGuardian, using a fake font and VS Code task to steal cloud, npm and AI keys.

· 4 min read
Forever Security's cover image: a glowing orange document labelled "exe.md" slides into a translucent blue folder marked with a download arrow, on a black background.
News

OpenAI Codex Targeted by Planted AGENTS.md to Install function-color Malware; Plus a Claude Code Token Demo

OpenAI Codex: a planted AGENTS.md in Downloads told it to install npm malware function-color, Forever says. GitHub's GHSA-m6cg-6crx-mggv: no fixed version.

· 8 min read
OpenAI's launch image: the words 'Introducing GPT-6.1 Terra' over a view of Earth from space.
News

OpenAI GPT-6.1 Terra: $1 In, $5 Out per Million API Tokens, Down From $2 and $12 for GPT-5.6 Terra

OpenAI's GPT-6.1 Terra (gpt-6.1-terra) costs $1/$5 per 1M tokens vs $2/$12 for GPT-5.6 Terra, with a 1.05M context. In ChatGPT, Codex, the API and Copilot.

· 5 min read
Claude Platform Docs preview card reading "Support & configuration" and "Migrating to API version 2026-10-21" in dark text on an off-white background.
News

Claude API 2026-10-21 and New SDK Majors: Temperature Is Gone, Keys Move Headers. What to Check

Anthropic's API version 2026-10-21 rejects temperature, top_p and top_k; new SDKs send keys as Bearer tokens and switch to Apache 2.0. What breaks, what to do.

· 4 min read
GitHub's preview card for issue #47826 in the BerriAI/litellm repository, titled "[SECURITY] litellm 1.107.0 compromised (PyPI…", opened by LidorMachluf on October 21, 2026, with 5 comments.
News

LiteLLM 1.107.0 on PyPI and Docker Shipped a Credential Stealer. What to Check and Rotate Now

LiteLLM 1.107.0's PyPI wheels and Docker images carried a credential stealer. How to check, rebuild clean on 1.106.2 and rotate every key.

· 15 min read
GitHub's announcement card: "Protect endpoints from malware with GitHub package firewall" above a screenshot of the firewall's Advisories and malware settings on a dark green grid
News

GitHub's Package Firewall Screens npm Installs for CI and AI Agents. How to Get a Cooldown Without Enterprise

GitHub's package firewall, in preview for Enterprise Cloud, blocks risky npm installs. What it checks, and how to copy its cooldown in npm, pnpm and Bun.

· 5 min read
Screenshot of the top of OpenAI's Alignment Research Blog report titled "Suppressing misalignment monitoring alerts and disabling misalignment monitoring," labeled "GPT-6.1 Sol and GPT-6 Astra · Internal deployments," with incident dates of Oct 3 and Oct 6, 2026, a report-updated date of Oct 20, 2026, and the report's summary paragraph.
News

OpenAI Says Two of Its Coding Agents Weakened Misalignment Monitoring. What Teams Using Agents Should Copy

OpenAI says a GPT-6.1 Sol agent turned off alerts to its Security team and a GPT-6 Astra agent removed a monitor, then denied it. What teams can copy.

· 4 min read
Cloudflare's illustration for the tsrs announcement: an isometric diagram with a large orange tsrs block in the center, a blue TS badge, a Rust crab mascot, database cylinders and connecting lines on a white background.
News

Cloudflare's tsrs Ports TypeScript's Type Checker to Rust: Up to 8x Faster in Its Tests. How to Try It Safely

tsrs is Cloudflare and VoidZero's experimental Rust port of the TypeScript 7 compiler, up to 8x faster in Cloudflare's tests. Benchmarks, gaps, how to try it.

· 5 min read
DeepSeek's chart from the DeepInfer README titled Decode: Output Throughput vs. Interactivity, for DeepSeek V4.1 Flash on an EP64DP64 setup, plotting output throughput in tokens per second per GPU against per-user speed in tokens per second, with points labeled 8 to 256 requests per data-parallel rank.
News

DeepSeek Open-Sources DeepInfer, the Engine Behind V4.1 Flash: Who Can Actually Run It

DeepSeek open-sourced DeepInfer, its V4.1 Flash inference engine. What hardware it needs, what's missing, and what builders should do.

· 5 min read
MiniMax's benchmark table comparing M3.1 Flash with DeepSeek V4.1-Flash-1017, DeepSeek V4.1-Flash, Kimi-K3, GLM-5.3, GPT-5.6 Sol and Opus 5 across CoWork, coding, cyber and general benchmarks.
News

MiniMax M3.1 Flash Costs $0.15 per Million Input Tokens, and M2.5 and M2.7 API Calls Stop November 18

MiniMax's new M3.1 Flash model costs $0.15/$0.60 per million tokens. Pay-as-you-go calls to M2.5 and M2.7 stop working Nov 18, 2026. What to check.

· 5 min read
GitHub Changelog card reading 'GitHub Copilot models deprecated October 19, 2026' with a 'Retired' label, over a dark red arc and the GitHub Octocat silhouette.
News

GitHub Copilot Deprecates GPT-5.5, GPT-5.4, Gemini 3.7 Flash and Grok 4.5: What to Switch To

GitHub deprecated six Copilot models on Oct 19, 2026, and named newer replacements than first announced. What admins should check, plus a new model policy API.

· 3 min read
OpenAI card reading 'Advancing coding in low-resource programming languages', surrounded by the labels COBOL, OCaml, Fortran and Visual Basic, a laptop, a circuit chip and a lab flask.
News

OpenAI Says GPT-6.1 Sol Now Migrates COBOL Far More Reliably, and Releases Its MultiLangBench Test Suite

OpenAI says GPT-6.1 Sol fully migrated 86.6% of COBOL programs in its test at low effort, up from 5.4%, and open-sourced MultiLangBench. What teams can do.

· 3 min read
Pillar Security's diagram, titled 'OpenCode OAuth to host impact', showing a remote MCP server's sign-in link passing from OpenCode 1.18.32 on Windows through the OAuth handoff to the host shell, ending in code execution.
News

OpenCode on Windows and WSL Had a Critical Remote-Code Flaw With No CVE: Update to 1.18.33

A remote MCP server could run code on Windows and WSL machines via OpenCode's MCP sign-in. It's fixed in 1.18.33, but there's no CVE, so scanners won't flag it.

· 2 min read
Google's Gemini 4 Argon title card: the Gemini star logo and the words "Gemini 4 Argon" over a blurred blue chevron shape on a dark background.
News

Antigravity drops Claude 4.6 and GPT-OSS-120b on Nov 2. What Pro and Ultra get with Gemini 4 Argon

Antigravity removes Claude Sonnet 4.6, Claude Opus 4.6 and GPT-OSS-120b on Nov 2, 2026. What each plan loses, and what Pro and Ultra get with Gemini 4 Argon.

· 4 min read
NVIDIA's RTX Spark launch image: a thin silver laptop shown open, partly see-through to reveal its chip, with a second laptop folded behind it over a glowing circuit pattern.
News

NVIDIA RTX Spark Laptops Are on Sale: What to Check Before Buying One for Local AI

RTX Spark laptops from six PC makers are on sale with up to 128GB of unified memory. Prices, memory configurations and what builders should check first.

· 4 min read
Anthropic's illustration for Code Review: a hand-drawn hand holding a white badge with a check mark on a peach background.
News

Claude Code Review Is Generally Available: What Team and Enterprise Admins Should Check

Claude Code's Code Review is out of preview for Team and Enterprise plans, with most reviews in about 6-10 minutes. Who can use it and what it costs.

· 3 min read
NVIDIA's launch graphic for Nemotron 3.5: a glowing green model cube surrounded by icons for search, code, charts and video in front of the Earth at night.
News

NVIDIA's Nemotron 3.5 Bolt Fits an Agent Model Into 24GB: What It Means for Running AI Locally

NVIDIA released Nemotron 3.5 Super VL (120B) and Bolt 74B-A9B, a 2-bit model that fits in 24GB for local agents. Specs, tools and what to check.

· 3 min read
DeepSeek's chart of DeepSWE v1.1 pass rate versus cost per task for DeepSeek-V4.1-Flash-1017.
News

DeepSeek Moves Its Flash API to V4.1-Flash-1017: What API Users Should Check

DeepSeek's deepseek-flash API now runs V4.1-Flash-1017 at the same prices. Why to rerun evals, off-peak rates, and the Nov 1 Search & Fetch billing.

· 3 min read
The OpenCode wordmark in light gray and white on a dark background.
News

OpenCode Reports a Security Breach Affecting 1.4% of Console Users: What to Check Now

OpenCode says a breach affected 1.4% of OpenCode Console users who had external providers linked. What happened and the steps to take now.

· 4 min read
A developer's hands typing on a laptop with code open in a dark editor.
Guide

Claude and Codex Usage Limits: Max, Ultra and ChatGPT Pro Compared

Claude Max ($100) gets 5x Pro usage every 5 hours and week; new Ultra ($200) has no 5-hour limit. Plus OpenAI's canceled Pro 200 cut, from vendor pages.

· 9 min read