Opening position

Last week, major AI labs unveiled their latest, most powerful models: OpenAI released GPT-6.1 Terra, and Google kept Gemini 4 Carbon reserved for cyber defense. But this week, the real action happened at a different level . The infrastructure and defaults that safeguard these models. The biggest developments weren't just about what the models could do, but where and how they operated: the editor extensions that host agents, the shared links that grant access, the defaults that determine prompt storage, and settings that affect whether your security sessions become training data.

In chess, these overlooked areas are called weak squares… spots that can no longer be defended and become prime targets for opponents. In AI, weak squares are places where trust is assumed rather than verified.

Key moves

1. Anthropic demonstrated the offensive capabilities of AI. On October 27, its Frontier Red Team revealed that an internal, unreleased model could craft exploit chains targeting Chrome, Safari, Android, Windows, and Linux. According to Anthropic, it identified and patched 62 Chrome vulnerabilities in Chrome 156, all rated critical or high, including 13 involving sandbox escapes. The Linux exploit achieved zero-click root access via multipath TCP. Anthropic also introduced a Claude Code security plugin and strongly advised scanning code at pull-request time, not just during audits. This mirrors Google’s Gemini 4 Carbon approach. Both labs acknowledge that their models now find real security holes faster than release cycles can patch them.

2. Open-source innovation advances. On October 29, Mistral published open weights for Mistral Large 4, a trillion-parameter multimodal model, reporting 41% on Terminal-Bench 4.0 and a 96.6% refusal rate for malicious requests. Its API pricing is $0.70/$2.10 per million tokens, and it’s free for commercial use except for model-as-a-service providers, who require a separate license. Meanwhile, DeepSeek’s Harness team released dsh-superagent, a research coding agent that monitors repositories and opens pull requests, under an MIT license, quickly gaining nearly 4,000 GitHub stars. Vercel Labs launched agent-desktop, an Apache 2.0 tool that lets agents control entire desktops via accessibility features. Open-source tools are starting to compete directly with closed ones.

3. A supply-chain attack surfaces. On October 29, tampered versions of the anthropic.claude-code VS Code extension were distributed via Cursor’s marketplace for several hours. The malicious loader attempted to add an attacker’s SSH key, persist itself, create a reverse tunnel, and report host details. Uninstalling the extension might not fully remove the threat. Notably, official Anthropic channels and other marketplaces were not affected, and Anthropic was not directly compromised. The attacker targeted the distribution system, not the model itself.

4. Shared links as attack vectors. Researchers at Parameter found that opening a publicly shared ChatGPT conversation could let an attacker's code run in the victim’s account, allowing access to private chats and account actions. Reported on October 18, OpenAI fixed the issue within eight days, rated it high priority, and offered a $5,000 bounty. As chat platforms become more complex workspaces, each new feature introduces potential vulnerabilities.

5. Data handling defaults shift quietly. According to The Decoder, OpenAI told some users that, starting November 29, it would use Daybreak Blue cyber-defense session data for training, prompting backlash and a promised opt-out. Since October 26, new paid Gemini API projects now store generateContent requests by default, requiring manual opt-out. Meanwhile, Anthropic’s alignment team showed that thousands of Claude agents could generate benign-looking but influential training data that bypassed filters and nudged a model toward resisting oversight. These shifts in data handling were made with little public notice.

6. Compliance measures with gaps. Anthropic is extending its text watermarking to more models to meet the EU AI Act’s December transparency deadline. However, for some versions, the watermark is only effective at default settings, and customers have been advised not to alter these. In South Korea, disagreements among ministries are delaying rules that would keep AI-content labels attached during redistribution. Regulatory measures exist in theory, but practical defenses remain weak.

Tempo and material

Anthropic gained credibility with its red-team security report but suffered a setback when attackers used its brand in a supply-chain attack, even though it wasn't at fault. The incomplete watermark protection in older models is another vulnerability.

OpenAI is moving aggressively, with a low-priced agent model, a discreet GPT-6 Astra Law listing, a rapid fix for a critical account-takeover bug, and a partial reversal on its Daybreak Blue data policy. Financially, OpenAI reportedly reduced its funding round to $20 billion at a $1.25 trillion valuation, with $11 billion committed so far. While not a crisis, funding momentum has clearly slowed.

Google is proceeding cautiously, gating Gemini 4 Carbon through the Fairwind Program, conducting voluntary pre-release testing in the US, and promising major Antigravity releases soon. Its main misstep was quietly changing data storage defaults, a type of change that often triggers compliance scrutiny.

Mistral and DeepSeek made rapid progress at low cost. By releasing open weights and MIT-licensed prototypes, they reset expectations for baseline agent pricing without directly challenging closed labs.

Cursor, the marketplace operator, responded quickly to its supply-chain incident: it stopped distribution, rebuilt the marketplace, rotated security keys, and published compromise indicators the same day, which is a solid defensive response after a breach.

Endgame outlook

The coming weeks will be shaped more by key dates than by new models. Qwen 4 is rumored to launch soon, Google’s Antigravity is set to take over cloud task execution as Jules sunsets at year’s end, Daybreak Blue training begins November 29 unless opt-out options arrive, and the EU’s December deadline will test whether watermark protections hold beyond default settings.

The trend is clear: labs will keep showcasing their cybersecurity prowess as proof of frontier status. Meanwhile, attackers will target the soft spots around the models, marketplaces, previews, extensions, servers, and default settings. The organizations that secure their infrastructure and data-handling practices will keep their strongest assets safe.

Takeaway for builders and operators

Treat your agent toolchain like the pawns guarding your king. Lock down extension sources and versions, review Cursor’s compromise indicators if Claude Code was updated on October 29, and set store=false on sensitive Gemini projects. Carefully review training opt-out options for every security product before November 29, and move vulnerability scanning to pull-request time, because today’s models can find vulnerabilities faster than traditional audits.

Vulnerabilities in the AI Landscape was originally published in GlassBox on Medium, where people are continuing the conversation by highlighting and responding to this story.