Anthropic and OpenAI wanted control over what outside evaluators print
Reuters reported on 13 October that Anthropic and OpenAI have each sought significant control over what external reviewers of their models may publish, citing the risk that findings expose trade secrets. The account, relayed by TNW, rests on two people familiar with the talks. Measures discussed included having lab staff observe embedded review teams and barring a reviewer from working for two labs at once; the sharpest concern is reviewers working inside the building, who could carry knowledge to a rival. Both companies had said the opposite in public weeks earlier: in the Reuters wire text, Dario Amodei said last month that external evaluators should have the right to publish key findings “without editorial control”, and OpenAI agreed days later, saying assessors should have “editorial independence”. Reuters’ two sources put both labs still seeking strict editorial control as recently as 5 October; by the 8th, one of them said, Anthropic’s talks with some evaluators appeared to have evolved.
The positions each lab gave Reuters are narrower than the public line. Anthropic says reviewers it has worked with before set their own methods and publication decisions, while new firms are subject to its comment and approval on reports as they learn the models. OpenAI says it does not seek approval of whole reports, typically redacts non-public detail, and lets reviewers disclose when large cuts were made — it redacted non-public information from METR and Redwood Research’s account of its agents’ Hugging Face intrusion. Both groups said nothing else important to their conclusions was removed — and also that they edited the report’s structure, emphasis, clarity and tone on OpenAI’s feedback, and that the risk of deterring developers from bringing in outside evaluators after serious incidents shaped their judgement calls in drafting, editing and redacting it. Rumman Chowdhury, former US science envoy for AI, told Reuters that “evaluators have this very privileged access, but whether explicitly or implicitly, they know that it comes at a cost.” For a buyer, the practical point is that a third-party assurance report is only as independent as its publication terms, and those terms are private contract language rather than a standard.
An independent run of a merge-quality coding benchmark puts the best model at 52%
Artificial Analysis published its own results for Cognition’s FrontierCode 1.1 on 12 October, and the numbers sit well below the pass rates coding agents usually advertise. The launch article reports Claude Opus 5.5 (max, with fallback) first at 52%, GPT-6.1 Sol and Claude Fable 5.1 tied at 49%, MiMo-V2.6-Pro top of the open-weights field at 45%, DeepSeek V4.1 Flash and Kimi K3 at 44%, and GPT-6 Luna at 42%. Nine of the hundred tasks were passed by no model on any attempt, and no task was passed by every model every time. The benchmark itself is not new — Cognition announced it in June and released 1.1 in July — but these are the first scores from an independent run of it.
What it measures is why the scores land where they do. FrontierCode asks whether a change is good enough for that repository’s maintainer to merge, and penalises out-of-scope edits and unhelpful tests rather than only checking that tests pass; Cognition built it with the maintainers of 36 flagship open-source repositories, more than 20 developers spending over 40 hours per task. Artificial Analysis runs 100 of the 150 private tasks, three attempts each, in its own Stirrup harness at a 250-turn cap; an attempt that fails any blocking check scores zero, and one that clears them all scores between 70% and 100%. That is the gap worth reading: Opus 5.5 averages 52% on a 58% pass rate, so roughly two attempts in five cleared nothing at all. Two caveats the page states plainly — the review step is judged by GPT-6 Luna (medium), a sibling of a model on the leaderboard it grades, and FrontierCode is not part of the Intelligence Index.
Euro-area banks have until the end of this month to produce their AI cyber-threat plans
Reuters also reported on 13 October that banking supervisors on both sides of the Atlantic are pressing banks on AI, and one euro-area ask has a date on it. Per the Reuters account, the ECB in July gave lenders an end-October deadline to produce plans to counter AI-enabled cyber threats, including improved back-up and recovery; asked about its strategy for regulating AI, the ECB pointed to that letter and to a June speech by board member Frank Elderson. Separately, and with no deadline attached, one of the article’s sources said euro-area banks are also being asked to map how AI is used across their businesses and their third-party providers, to understand the key dependencies, and to ensure they can switch systems off and restart them in a controlled manner — with significant gaps still remaining at some firms. The Fed, OCC and FDIC are asking comparable questions about limits on autonomous systems, how agent actions are monitored and approved, whether decisions can be tracked and audited, and whether humans remain involved, and are still gathering information rather than being prescriptive. British supervisors are encouraging the largest banks to examine “bare metal recovery plans” — systems entirely independent of a bank’s main technology set-up, able to take over if the primary ones are compromised. Like their US counterparts, UK supervisors are also asking banks to use frontier AI to identify vulnerabilities and accelerate patching.
The same institution put numbers on the exposure the same day. In dinner remarks in Dublin, ECB executive board member Philip Lane said euro-area firms are set to devote around 10% of total investment to AI this year and that AI-related lending accounts for roughly a quarter of recent credit growth to firms, while the ECB’s own enterprise survey for the fourth quarter of 2025 found 64% of firms using AI experimentally or moderately and only 7% describing their use as “significant”. Lane put US AI computing capacity at 75% of the global aggregate against Europe’s 5%, and said the AI-driven rise in long-term rates constitutes “a material tightening of financial conditions for the euro area”. A supervisor asking which model runs where, under whose contract, and what happens when it is switched off is asking an inventory question — and most of the inventory is somebody else’s infrastructure.
Quick Hits
- An MCP gateway shipped its own signing key, and forged admin tokens outlive the password reset. — CVE-2026-53709 (9.8, published 13 October) says IBM’s MCP Context Forge shipped a known JWT_SECRET_KEY in mcpgateway/config.py and .env.example before 1.0.2 and accepted HS256 tokens signed with it, minting a platform administrator whenever the token subject matched PLATFORM_ADMIN_EMAIL and REQUIRE_USER_IN_DB was false. The advisory spells out the consequence: while that key stays configured, forged access survives password rotation, account deletion and session revocation. A second record published the same minute, CVE-2026-53711 (5.1), is stored XSS in the Global Prompts feature of a far older line, fixed back in 0.3.1.
- Megatron-LM’s October bulletin is three flaws, and the second checkpoint RCE needs a later fix than the first. — NVIDIA’s bulletin 5881, dated 13 October, carries CVE-2026-65180 and CVE-2026-65110 — both CWE-502 deserialisation in checkpoint loading, both 7.8, both triggered by convincing someone to load a crafted file — plus CVE-2026-65104 (7.1), hash collisions in the inference request cache leading to data tampering. The version table is worth reading twice: 65180 is listed as affecting “0 to 16.9” and fixed in “17.0”, while 65110 and 65104 affect “0 to 17” and are fixed in “17.1”. The bulletin’s own remediation text keeps the leading zero the table drops, and says twice to update to 0.17.1 or later — so anyone who patched for the first checkpoint flaw and stopped still has the second.
- Plugin4Shell’s Claude Code strand now has a CVE, 25 days after it ran here with none. — CVE-2026-86063 (7.5 on CVSS 4.0, GitHub’s own score, published 13 October) covers the flaw this brief wrote about on 18 September: the Claude Code and Claude Desktop plugin install flow runs git checkout for a marketplace-pinned commit without verifying that the resulting HEAD equals the pinned 40-character SHA, so a repository on a host that allows SHA-shaped branch names can serve the branch tip instead. Fixed in 2.1.179, which shipped in June — the action is still a version check, not an upgrade.
- A coding agent’s command allowlist was beaten by bash’s own prompt expansion. — CVE-2026-109429 (8.7 on CVSS 4.0, 8.8 on 3.1, both VulnCheck’s, published 13 October) says Mistral Vibe before 2.25.4 let a command substitution hide inside a single-quoted variable that tree-sitter-bash’s static parse could not see, then re-expanded it with the ${var@P} prompt-transform operator so bash’s promptvars feature ran it while only the trailing allowlisted command got classified. files it as CWE-436, interpretation conflict: the gate was reading a different language than the shell was.