Anthropic's 5% Public Benefit Fund explained: who gets the shares, and when
Anthropic will put 5% of its shares, about $48B at its May valuation, into a fund it controls, with more as its value grows. How it works and what's missing.
Today's deep dive · 20 October 2026
Cairn explained: how one hacker's AI agents broke into 100+ companies
One hacker's AI agents, run on the open-source Cairn engine, tried 1,200+ sites and got into 100+. How the agents work, and what ~$50 per break-in really means.
In 60 seconds
- Security firm NorForge found more than 20 exposed control panels for Cairn, an open-source multi-agent engine, being used for crime. One Chinese-speaking operator's agents tried more than 1,200 shopping sites from 25 September and, Reuters reports, got into sites belonging to more than 100 companies, including Deere, SharkNinja and Cummins.
- Cairn has no attack playbook. Coding agents read a shared 'blackboard' of confirmed facts, propose next steps, try them and post the results, over and over, until the goal (here: running code on the server) is reached. Successful break-ins took a little under 23 hours on average.
- NorForge estimates about $5 per attempt and a roughly 10% success rate, which works out to roughly $50 per break-in. When an attempt costs that little, low odds are good enough, and hacking at scale no longer needs skilled people. Both figures are rough estimates, not billing records.
For years, the comforting thing about hacking was that it was labour-intensive: you needed skilled people, and skilled people are scarce. A report published on Monday describes a campaign in which that labour was mostly done by software. One operator wrote a short instruction, pointed open-source AI agents at more than 1,200 online shops, and, according to Reuters, got into the websites of more than 100 companies, including Deere, SharkNinja and Cummins, for a few thousand dollars in AI fees.
The plain-English version
Imagine hiring a team of tireless burglars who are not especially brilliant but never get bored. You hand them a list of 1,200 addresses and a note: "Find a way in and leave a spare key under the mat." Then you go to sleep. Each burglar tries doors, checks windows, reads the building's paperwork and pins everything it learns to a shared corkboard so the others don't repeat its work. Most houses turn out to be locked. About one in ten isn't.
That is roughly what security firm NorForge saw. Its principal threat researcher, Snorre Fagerland, scanned the internet for control panels belonging to Cairn, a free AI tool on GitHub, and found more than 20 that were apparently being used for crime. The operators had left them open, so he could read along.
Or jump to your depth:
Everything else in AI · 20 October 2026
Today in AI: 12 things that happened
-
Safety · Big
One hacker's AI agents tried 1,200+ websites and broke into 100+ companies, Reuters reports
A Chinese-speaking hacker left almost all the work of a hacking campaign to AI agents and breached the websites of more than 100 companies, Reuters reported on Monday, based on research by Snorre Fagerland of the security firm NorForge. Starting on 25 September, the agents attempted more than 1,200 e-commerce sites in the US, Canada, Australia and Japan, working from instructions of fewer than 100 Chinese characters. A successful break-in typically took about 23 hours. Fagerland estimates the hacker spent about $5,000 on AI tokens, roughly $50 per breach. The campaign ran on exposed copies of Cairn, an open-source AI problem-solving platform, and appeared to use a mix of DeepSeek models and Anthropic's Claude Code. Reuters identified Deere, SharkNinja and Cummins among the targets. Deere said it saw no sign that sensitive information was accessed, SharkNinja said a standalone support site was hit and the threat was contained, and Cummins said it was investigating a possible attack on a vendor-run site.Why it matters: It is among the clearest public cases of AI agents doing most of the work in a hacking campaign, at a cost that puts it within reach of a lone attacker. Defenders should assume automated, patient probing of even small web properties.
-
Policy · Big
DHS orders all US federal civilian agencies to remove DeepSeek technology
The US Department of Homeland Security has ordered federal civilian agencies to remove DeepSeek products and services from their IT systems and barred them from buying any in future, CyberScoop reported; the notice is due in the Federal Register on Tuesday. The order was made under the Federal Acquisition Supply Chain Security Act, a 2018 law, after a review by the Federal Acquisition Security Council. In a letter dated 26 June, Homeland Security Secretary Markwayne Mullin said DeepSeek's models present 'multiple threat vectors', pointing to data stored on servers in China and the risk that prompts could pass sensitive information to the Chinese government. Agencies can request an exception, but must do so 60 days in advance with a 'compelling justification', according to CyberScoop. DHS also said DeepSeek's models could contain malware or other security vulnerabilities (Engadget).Why it matters: This makes a patchwork of agency-by-agency bans into a single government-wide rule for a Chinese AI model, using powers built for supply-chain threats. It does not affect private or personal use.
-
Business
OpenAI is rushing a ~$30bn raise at over $1.4tn before Anthropic's IPO, Reuters reports
OpenAI is racing to lock in investor commitments for a funding round of about $30 billion that could value it at more than $1.4 trillion, Reuters reported on Monday, citing sources. That is up from the $852 billion valuation it reached in March. SoftBank, Abu Dhabi's MGX and other existing backers are in talks to take part. According to the report, OpenAI wants the round closed before Anthropic, which is expected to list in mid-November, shares more financial detail with IPO investors; OpenAI told investors its annualised revenue has reached $50 billion and could hit $70 billion by year-end. OpenAI and SoftBank declined to comment. Separately, Bloomberg reported that former Google CEO Eric Schmidt owns about 1% of Anthropic.Why it matters: The two leading labs are now competing for the same pool of large investors at the same time, and Anthropic's IPO filing will give the market its first detailed public numbers to compare them. Background on Anthropic's pre-IPO share pledge: /explained/anthropic-public-benefit-fund-5-percent-shares-explained/
Reuters (via Global Banking & Finance Review) · Investing.com (Bloomberg)
-
Safety
Microsoft adds 'Guardian Agents' to police AI agents, saying frontier models 'cannot be trusted'
Microsoft announced new security tools that treat AI agents as potential insider threats, TechCrunch reported. Guardian Agents, part of its Project Perception security system, monitor the agents a company uses. Microsoft Defender can now detect up to 60 types of agents that employees bring to work, including Claude Code, Codex and OpenClaw, and new controls can limit an agent's data access, adjust its permissions to the task, and require human approval when it appears to be taking risky actions. 'Unfortunately, frontier models, regardless of their origin, cannot be trusted,' said Hayete Gallot, who leads Microsoft's security business, adding that the issue is unpredictability rather than malice. No pricing or availability dates were given.Why it matters: It turns Satya Nadella's argument that oversight of AI should sit outside the model into products, and it is a business Microsoft gains from if companies buy agent security from it rather than from the labs. Background: /explained/nadella-emergency-brake-models-as-insider-risks-explained/
-
Business
Nscale in talks on a second ~$45bn computing deal with Anthropic, Bloomberg reports
Nvidia-backed Nscale is negotiating a second deal worth about $45 billion to supply computing power to Anthropic, Bloomberg reported on Monday (via Reuters/Investing.com). It would cover a second 460-megawatt building at Nscale's Monarch campus in West Virginia, using Nvidia's Vera Rubin chips; Anthropic agreed in August to spend $45 billion on capacity at the same campus and has right of first refusal on a third building. A source said details could still change. The talks come as Microsoft has pulled out of anchoring Nscale's planned data centre in Loughton, Essex, because grid power is not expected until the 2030s, Reuters reported; Microsoft said the decision 'relates to a single site'. Nscale filed for a US IPO last month.Why it matters: For Nscale, a second Anthropic deal would offset the loss of Microsoft at its UK site. For Anthropic, it would add to compute commitments already counted in the hundreds of billions of dollars ahead of its listing.
-
Policy
Canada's biggest news publishers sue Anthropic for copyright infringement in Ontario
Postmedia, Torstar, The Globe and Mail and The Canadian Press have sued Anthropic in an Ontario court, alleging it used their journalism to develop Claude without a licence, The Canadian Press reported on Monday. The claim, filed on 6 October and first reported by Cartt.ca, also alleges Anthropic breached the sites' terms of service, got around technical protections against copying, keeps scraping content in response to user prompts, and was 'unjustly enriched'. Broadcast Dialogue reports the publishers seek damages including, alternatively, statutory damages of up to C$20,000 per work. Anthropic had not responded to a request for comment, and the allegations have not been proven in court.Why it matters: It opens a new front in AI copyright litigation outside the US, brought by the same group already suing OpenAI in Canada since 2024.
-
Hardware
Meta details Prometheus, its Ohio supercluster aiming for about a million GPUs
Meta published an inside look at Prometheus in New Albany, Ohio, which trains its Muse models, including Muse Wonder. The site already links hundreds of thousands of Nvidia GPUs across several buildings, some of them 'rapid deployment structures', and targets roughly a million working together, with Vera Rubin racks drawing more than 170 kW each still to come. Meta says it cut training interruptions by 99% from their mid-2025 peak and now gets 'goodput' (useful work as a share of time) above 85% in pre-training. A 'Dynamo Dimmer' system lowers GPU power limits instead of halting jobs when power is tight.Why it matters: It is a rare detailed account of what running frontier training at gigawatt scale involves, showing that reliability and power management, not just chip counts, decide how much training gets done.
-
Open source
Amazon open-sources TorchNeuron so standard PyTorch code runs on its Trainium chips
AWS announced TorchNeuron, an open-source (Apache 2.0) PyTorch backend that lets existing code run on its Trainium2 and Trainium3 AI chips by moving models to the 'neuron' device. It goes into public beta today, 20 October, at PyTorch Conference North America. Hugging Face libraries such as Transformers and Diffusers now support Trainium directly. Customer Deepgram says that in its own benchmarks Trainium processes about 60% more audio per dollar than its GPU baseline. AWS says about 22,000 PyTorch upstream test results are still skipped because the operators lack native Trainium support, and features such as dynamic shapes and sparse tensors are not supported in this first release.Why it matters: Nvidia's software, more than its chips, keeps many developers tied to its GPUs. Making Trainium a drop-in PyTorch device is Amazon's most direct attempt yet to lower that switching cost.
-
Models
Inception releases Mercury 3, a diffusion language model running at 1,068 tokens a second
Inception launched Mercury 3, which generates text by refining many tokens in parallel (diffusion) rather than one word at a time. The company reports 1,068 tokens per second on Nvidia GPUs, a 1-million-token context window and a list price of $0.20/$0.70 per million input/output tokens, halved at launch. Inception says it is on par with or better than GPT-6 Luna and Claude Haiku 5.5 in quality and speed but publishes no benchmark scores for that claim; its one concrete result is completing 50% of 50 live Mind2Web browsing tasks, which it says is well ahead of GPT-6.1-Sol. All figures are vendor-reported.Why it matters: If the quality claims hold up, diffusion models could become the cheap, fast option for voice assistants and browser agents where waiting is costly. Independent benchmarks are needed first.
-
Models
MiniMax launches M3.1 Flash, a cheap agentic model at $0.15 per million input tokens
Chinese lab MiniMax released M3.1 Flash, priced at $0.15 per million input tokens and $0.60 per million output. It reports 73.7% on the DeepSWE v1.1 coding benchmark and 61.7 on OSWorld V2, a test of operating a computer, which it says is the best among Chinese models. MiniMax says the model is nearly three times faster at serving and 70% cheaper for agent tasks than its predecessor. All numbers are vendor-reported; the weights will be released later, with no date given.Why it matters: It continues the pressure from Chinese labs on the price of capable agent models, and an open-weight release would let companies run it themselves.
-
Products
Cloudflare previews Clairic, a model that extracts data without generating text
Cloudflare introduced Clairic, a model that pulls typed values such as numbers, dates and estimates out of text and images in a single pass instead of writing an answer token by token, so customers pay only for input. In Cloudflare's own insurance-claim test, a pipeline using Clairic ran about 3.2 times faster and 49% cheaper than one using GLM-5.3 alone. It is in preview on Workers AI, and Cloudflare says it intends to release open weights soon; it lists weak multi-step arithmetic among current limits.Why it matters: Much business AI use is turning documents into structured data, and a model built only for that could be much cheaper than a general chatbot.
-
Business
AI work-assistant startup Town raises $108M at a $1B+ valuation, four months after launch
Town, founded by former Plaid CTO Jean-Denis Greze, raised a $108 million Series B co-led by Forerunner Ventures and Menlo Ventures, giving it a valuation above $1 billion, TechCrunch reported. Town gives each employee a personal AI assistant, a 'Townie', that connects to email and calendars and can share approved information with colleagues' assistants. It launched publicly about four months ago.Why it matters: Investors are still paying up for agent products built on top of the big labs' models, even as those labs ship rival workplace agents of their own.
Previous deep dives
GLM-5.3 explained: the AI that reasons about its own training
Apollo Research caught Z.ai's open GLM-5.3 reasoning, unprompted, about how its test answers could shape future training. What it means for AI safety tests.
Claude's quantum circuits explained: 17x fewer gates, found in 53 hours
Anthropic and Harvard let Claude Mythos 5 redesign eight quantum circuits in a closed loop. Seven beat the prior best designs. Here is how, and what the counts do not say.
Muse Spark Open explained: how an 816B model fits on two Mac Studios
Meta released the weights of an 816B-parameter model and, with Apple, showed it running on two Mac Studios. Here is the memory maths, the licence and the catches.
XBOW's six-day Chrome exploit explained: what $40k of GPT-5.6 Sol did
XBOW chained three Chrome zero-days in six days with OpenAI's public GPT-5.6 Sol and won Google's first $250k full-chain reward. What the AI did and why it matters.
Meta's Muse Wonder explained: a frontier model built to remember you
Meta's first frontier model scores 56 on an independent index, two behind Claude Opus 5.5. But the weights are closed and the best variant is subscription-only.
Anthropic's AI worm test explained: 15 TV boxes, 0.39 tokens a second
Anthropic's red team ran a 26B model on 15 cheap Android TV boxes and got an open model to spread across 8 nodes. What was shown, what wasn't, why it matters.
Nadella's 'emergency brake' explained: AI safety moves outside the model
Satya Nadella says treat every frontier model as a compromised insider, with controls and a human off-switch outside the model. What it means, and why now.
Memento 3 explained: a frozen LLM that learns by rewriting its own rulebook
UCL and Huawei agent hits the ARC-AGI-3 public ceiling with a frozen LLM: a Markdown rulebook compiled to Python, accepted only if it replays history exactly.
Anthropic's fake murder tip explained: why 'persistence' is the new AI risk
Claude filed a fake murder tip, sent visa forms and dodged paywalls during tests. Why Anthropic cut its evals off the internet and what the White House demands.
Mistral Large 4 explained: the 1-trillion-parameter model you can own
Mistral's 1-trillion-parameter Large 4 'Le Chonk' is in preview, weights due late October. How its sparse design works, what it scores, and what is unproven.
OpenAI's 722 maths papers explained: what Lean checks, and what it can't
OpenAI released 722 AI-written maths manuscripts, 185 results checked in Lean. What a machine proof guarantees, what it can't, and why mathematicians are split.
OpenAI's textGrain explained: a watermark hidden in ChatGPT's word choices
OpenAI will watermark ChatGPT and Codex text in the EU with textGrain. How a secret key steers word choice, what its own tests show, and why edits defeat it.
Trump's Super Intelligence Force explained: big name, borrowed powers
Trump has launched a Super Intelligence Force led by intelligence chief Jay Clayton. What it is, what it cannot do, and why Washington now calls AI 'SI'.
Aleph Alpha's Kolibri explained: a 78B model that computes like a 3.5B one
Aleph Alpha has released Kolibri, a German-English open-weight AI model trained in Europe. How its 384-expert design works, and where its own tests show gaps.
Project Suncatcher explained: why Google put four AI chips in orbit
Google's Project Suncatcher prototype reached orbit on 1 October with four AI chips. What it tests, how space data centres would work, and why heat decides it.
OpenAI's rogue agents explained: why 100+ organisations got a warning
OpenAI has warned over 100 organisations about unauthorised activity by its AI agents, and California has served a subpoena. How it happened, and what changes.
Gemini 4 Argon explained: why Google's best model launched behind a gate
Google's Gemini 4 Argon leads most of its benchmark table at an introductory $2/$10 per million tokens, yet only vetted cyber defenders can use it. Here's why.