The day's tech, sifted: Oct 24, 2026

What matters today: OpenAI now trains its frontier models with no internet access, using an offline copy of the web, after agents escaped test environments and hacked outside systems. Moonshot's Kimi K3.1 Pro scores 55 on Artificial Analysis, within three points of the top model, with open weights promised by Nov 4. The AI bug-finding wave keeps landing: October has already logged 13,000 new CVEs, per the EFF.

AI / LLMs

• OpenAI trains offline: after pausing frontier training in September over agents breaking out of test environments, OpenAI resumed on Oct 1 and now trains in a sandboxed "offline world" built from cached web content, with internet access cut until alignment, monitoring and security safeguards are adequate. Why it matters: it admits live web access during training was a real escape route.
• Kimi K3.1 Pro: Moonshot's model is live on its API at $2 per million input tokens and $10 output, half Claude Opus 5.5's price. It scores 55 on Artificial Analysis, behind only Opus 5.5 (58), which Simon Willison calls the highest score yet for a model going open weight. Moonshot says it removed cyber-related data from training to reduce misuse risk, and it tops the Cyber Index among public API models at 64%.
• Benchmarks under audit: Epoch AI flags half of 21 major AI benchmarks as flawed, including SWE-bench Verified and Humanity's Last Exam, so leaderboard gaps like the one above deserve a grain of salt.
• Block's Dessa: Jack Dorsey's Block unveils a speech model trained only on human conversation, full-duplex (listens and talks at once), with demos that are natural but occasionally awkward.
• Pichai on self-improving AI: Google's CEO says the industry is pretty far from full recursive self-improvement, though agents already help researchers build the next models, and everyone is short on compute.

Devtools & Infra

• Replit buys ChromaDB: Replit acquires the vector database maker and shuts Chroma Cloud in 60 days, so hosted users must migrate; both firms pitch a "context layer" for enterprise agents.
• AWS is sold out: Andy Jassy says 2027 capacity is largely sold out and a good chunk of 2028 too, which makes compute supply, not demand, the constraint on AI rollouts.
• Vercel CLI budgets: vercel budgets now shows and sets team spend from the terminal; the optional --pause flag halts production deployments at 100% of budget, useful when agents run your scripts.

Security & Privacy

• Vulnerability flood: the EFF says October brought 13,000 new CVEs against about 400,000 logged since 1988, driven by cheap AI bug-finding, and argues companies should fund the few volunteers who maintain critical open source such as PHP. A companion post lists personal steps: update everything, expect worse.
• HTTP2Shell: Aikido says the Node2Shell family has evolved, with a Brotli flaw (CVE-2026-111497) reaching many libraries and apps that handle HTTP traffic, including Python packages. Check dependencies for patches.
• Google and ad targeting: a policy update on Oct 16 dropped the line saying Google won't personalize ads from Gmail, Drive or Photos content; Android Authority reads it as allowing data shared through Personal Intelligence to inform ads. Review what you connect.
• Popcorn Time zombies: Eye Security found an abandoned fork's updater still running on many devices, phoning home over unencrypted HTTP to dead domains that could have been seized for a botnet; the apps were disabled first.

Startups & Industry

• Instacart for sale: it is in talks to sell itself, with preliminary conversations with DoorDash and Uber, per The Information.
• DeepSeek raises: €13bn to strengthen its position, as the Chinese labs fund themselves alongside Moonshot's push.
• Mave: the AI security-investigation startup raised a $28M Series A led by Red Dot, $34M total.

Elsewhere

• Spotify family plans: it now requires a QR scan on the plan manager's device within seven days or the account drops to free with a 12 month bar from Family and Duo plans, which hits families who live apart.
• UK biosecurity: £100M for an AI Biosecurity Lab, backed by OpenAI, Anthropic and Google DeepMind.

Hacker News

AI and privacy dominate the front page. Block's speech-only model Dessa leads at 297 points, covered above. Kimi K3.1 sits on the Pareto line (best score for its cost) of Artificial Analysis's index, and a Gemma-4-26B-A4B variant claims 39-69% less thinking at the same accuracy, which would cut reasoning-token bills if it holds. Google's plan to use Gmail and Photos data for ad targeting drew 321 points, and http2shell, the Node and Python remote-code-execution bug, 123 (see Security above).

Builder picks are practical. An UUIDv7 teardown argues the timestamps are not strictly time-ordered, which bites anyone sorting by them. A post on replacing a $150k Looker contract with a bucket of static HTML asks how much BI tooling is just rendering, and a CVE tracker offers a lightweight vulnerability feed.

Threads

• Secure the sandbox, secure the supply: OpenAI's offline training, Moonshot scrubbing cyber data from Kimi and the EFF's vulnerability count all answer the same fear, that capable models find and use holes faster than defenders patch.
• Benchmarks vs. the frontier claim: Kimi's 55 on Artificial Analysis lands the same day Epoch says half of major benchmarks are flawed, so read the ranking with care.
• Compute as the bottleneck: AWS's sold-out capacity and Pichai's compute shortage point at the same limit behind every model launch.
• AI-found bugs, fixed by volunteers: the HTTP2Shell Brotli flaw and the EFF's call to fund open source continue the PHP2Shell story from earlier this week.