Daily Roundup

Claude watermarks all text; OpenAI raises at $1.25T

Oct 23, 2026: every current Claude model carries an invisible text watermark; OpenAI raises up to $30B at $1.25T; AI agents hit 2,250 tenants via ConnectWise.

Top Stories

Every current Claude model now carries an invisible text watermark

The watermark is steganographic, not cryptographic. O’Reilly Radar reports that Google DeepMind’s SynthID-Text works by subtly changing the model’s random source when picking between similar words, using tournament sampling in which candidate tokens compete in rounds and pseudorandom values derived from a secret key tilt the choice. Nothing visible is added and no extra tokens are spent. The article lists the affected models as Claude Mythos 5.1, Fable 5.1, Fable 5, Opus 5.5, Opus 5, Opus 4.8, Sonnet 5.5, Sonnet 5 and Haiku 5.5.

The practical part is durability. According to the piece, the signal stays detectable after text is copied into code editors, documents, email or Slack messages. Length thresholds are a detector-specific question rather than a property of the mark: the 400-token figure quoted here belongs to OpenAI’s detector, not to Claude’s. Anthropic’s position is that the mark records provenance rather than identity. Writing in its August announcement, as quoted by O’Reilly Radar, the company said “This is a way of determining the likelihood that Claude was involved in writing the text” and “Future Claude models will generate text that contains a watermark.” O’Reilly Radar also notes Anthropic adopted watermarking partly to comply with the EU AI Act, whose requirements for providers serving the EU took effect in 2026. OpenAI’s separate system is called textGrain, and OpenAI has said it will add an invisible watermark to eligible ChatGPT and Codex output in the European Union. What the write-up leaves open is who would run detection, at what threshold, and against whom.

AI agents drove a supply-chain breach that hit more than 2,250 tenants

The ConnectWise breach started with application credentials used to link ConnectWise to its corporate customers, stolen from the company’s cloud backup service. Those credentials let an attacker sign in to customers’ Microsoft-hosted environments as if authorized. According to Microsoft, the attackers used AI agents to compromise more than 2,250 tenants, generating over 151,000 failed logon events that peaked on October 11 at 2,900 failures per minute, a pace where “the speed of the activity allows very little time for Defenders to respond to those alerts and remediate the actor’s access in a coordinated fashion.” ConnectWise paused access to the cloud backup system and was working to restore it as of Thursday, per TechCrunch.

Microsoft’s own threat write-up names the actor as Storm-0940, a China-state-aligned group, and the tool as ARTEX, an agentic AI penetration-testing framework. Microsoft says it first saw Storm-0940 using ARTEX against hundreds of organizations globally as early as September 2026, and that in several cases the time from initial targeting to privileged access was under three hours. The company writes that “Agents are not constrained by factors affecting humans,” working around the clock and attempting multiple breach paths at once. Microsoft assessed Storm-0940 was responsible for the ConnectWise compromise, and said the activity did not come from a flaw in Microsoft’s own products.

OpenAI is raising up to $30 billion at a $1.25 trillion valuation

TechCrunch reports that OpenAI is working on a round of up to $30 billion at a $1.25 trillion pre-money valuation, with Coatue reportedly leading and investors from the UAE involved. Terms are still under negotiation and subject to change, and OpenAI declined comment. CNBC reported that UAE funding might be paired with an agreement giving OpenAI additional computing capacity from the UAE.

The valuation moves fast in both directions. OpenAI’s March funding valued it at $852 billion post-money, and Bloomberg reported a month ago that the company was seeking $30 billion at a $1.4 trillion valuation. OpenAI filed confidential IPO paperwork in June 2026 and is taking the private round first, which is what makes the pre-money number a headline rather than a curiosity. For anyone pricing inference, the practical signal is that the money is still arriving at a scale that shapes capacity deals and hardware commitments well before a public listing.

Microsoft’s diagnostic agents beat primary-care doctors on simulated hard cases, with caveats attached

A study in Science published October 22 found Microsoft’s MAI-DxO scored 83% on complex cases drawn from the New England Journal of Medicine and presented in a simulation, against 36% for primary-care physicians and general internists working individually with reference material. TechCrunch covers the result. DxO coordinates multiple agents that question a virtual patient, request tests and deliberate over the diagnosis. Microsoft evaluated models from OpenAI, Google, Anthropic, Meta and DeepSeek, and its strongest reported outcomes used OpenAI’s GPT-5 and GPT-5.5. Microsoft AI vice president of Health Dominic King told TechCrunch “There is something very substantial and exciting here.”

The caveats are the story. The complex cases would normally involve specialists or physician teams, and neither took part in the comparison. On emergency-department cases DxO produced little or no gain, with GPT-5.5 and DxO both scoring about 85% at similar cost. Much of the advantage appears to come from the underlying model rather than the orchestration, and the runs were expensive: GPT-5 alone cost roughly $8,400 per case, with DxO cutting that by about $3,000. This is a simulation, not evidence that the system is better than a doctor in a clinic. King said DxO is “ready for real-world evaluations.”

Criminal hackers are routing around model guardrails by using older models

WIRED reports on CrowdStrike research into attacks by four previously unreported groups between May and August, one operating in Chinese, one in Spanish and English, one in Indonesian and one in Russian. All four left their AI infrastructure openly accessible on web servers, which let researchers identify the models in use, largely versions of Anthropic’s Claude and of the open-weight DeepSeek models. In almost every case the attackers used older versions rather than frontier models.

All four groups got past safeguards, typically by convincing a model the activity was legitimate and authorized, often for penetration testing. A recurring method was dropping files into an agent’s working directory to suggest the task had been approved. The Chinese-speaking actor also used a runtime patch called ClawGod to add functionality on top of Claude Code and attempt to strip the CYBER_RISK_INSTRUCTION from its system prompt. CrowdStrike’s Adam Meyers told WIRED that “these attacks are not using new exploits or novel vulnerabilities.” The Spanish and English actor compromised at least 15 Argentine health care organizations, with evidence of credential and medical-record theft at one. The defensive lesson is that your guardrail posture is only as good as your weakest permitted model. Model-level filtering is not the sturdy layer it is assumed to be either: Unit 42 fuzzing found content filters miss up to 99 of 100 attacks.

Meta’s revised business terms still leave room to train on scraped news sites

Meta’s new terms for business accounts, which The Verge reports take effect October 30, originally let Meta use any content from a business account’s websites to “develop, research” and “train” its products. After publishing backlash, Meta removed the word “train,” but kept the language about content “associated with your products or services” and about developing “any business product.” Meta spokesperson Daniel Roberts told The Verge that “content owners can use robots.txt to signal their preferences,” and that the update is not about scraping news sites and gives Meta no new rights that supersede those preferences.

Legal reading of the residue is less comfortable. Cornell Law School professor James Grimmelmann told Nieman Lab the change “does nothing to restrict” the “associated with your products or services” language that would let Meta scrape entire sites, and media attorney Matt Topic told Nieman Lab that “develop” is broad enough to include “train.” Robots.txt has always been a signal to crawlers rather than a licence grant, and the revised terms leave the scraping question open to Meta’s own reading of them.

NVIDIA open-sources OpenShell as 1Password brokers agent logins

Two releases point at the same problem: keeping an agent’s reach inside a boundary. NVIDIA’s OpenShell, released under Apache License 2.0, is described by the company as “the safe, private runtime for fleets of autonomous AI agents.” Agents run in isolated sandboxes with user-defined policies; kernel-level controls restrict file access and system calls, and every outbound connection is checked against policy before leaving the sandbox. Approved credentials are attached only to requests bound for permitted endpoints, so the agent never holds the secret itself. Policy changes go through formal verification, and permissions that look risky, such as reaching a new host with credentials, are surfaced for human review. It runs on Linux, on Apple-silicon macOS, and on Windows through WSL 2 (experimental), with Docker, Podman or host virtualization as the backend. The boundary idea is not new: we covered IronCurtain, an open-source agent firewall built by Google security veteran Niels Provos in March, which keeps the agent in a --network=none container and swaps in real credentials at a TLS-terminating proxy the agent never reaches.

1Password’s answer ships alongside it, and takes a different shape. An agent sends a unique digital key to 1Password to identify itself, the user approves the request, and 1Password enters the credentials for the task so no reusable copy reaches the agent. Supported agents listed include Claude Duet, OpenAI’s Dots or ChatGPT Work, Grok Bot, Meta’s Muse, and assistants from Town. 1Password claims the agent never sees the credentials. The same article reports, citing Axios, that US banks have begun detecting agent-driven activity in accounts, which it notes may reflect authorized consumer use rather than rogue agents.

OpenAI opens its Decisions API, picking a fight over fast decision models

TechCrunch reports that OpenAI’s Decisions API selects an option from a supplied set and returns a confidence score, cutting typical response time from roughly 1-3 seconds to 100, 120 or 180 milliseconds. It runs on ChatGPT Luna reconfigured for faster inference rather than trained or calibrated specifically for decision-making; OpenAI product lead Nikunj Handa called the speed “the big unlock with Decisions API.” Box, Datadog, Ramp and Speak ran early trials, with Speak reporting an action-to-action drop from 1.4 seconds to 0.13 seconds. No pricing was given.

The competitive frame is TypeSafe’s Jev, Liquid’s D1 Ultra and Base Lab’s Elephant-1. On the AIM System One Index and the Artificial Analysis Decision Index, the latest Jev places seventh and third while OpenAI’s model places eighth and fourteenth, though TypeSafe’s models are reportedly the most queried decision models on OpenRouter. Handa said future speed near 60 milliseconds could support a decision call for every video frame. For anyone building local tooling, the interesting part is that this is a config change to an existing hosted model rather than a new architecture, which is the same trade-off Ollama-style local decision models make.

Quick Hits

  • DeepSeek reportedly raised about $15 billion, roughly 100 billion yuan, two days after the US ordered federal agencies to drop it. Bloomberg reported CATL and Tencent as possible investors; no lead is confirmed. It follows a June 2026 round above $7 billion at a $50 billion valuation and a July search for $1.5 billion at about $71 billion. TechCrunch
  • Anthropic shipped Claude Duet, a proactive agent app built on Claude Opus 5.5. It works inside its own virtual machine in the background, monitors tasks, produces daily briefings, connects to more than 6,000 Claude Marketplace connectors, and can buy through Stripe Link or Shopify Shop Pay with approval gates. It is barred from trading securities, transferring money between accounts and showing live browser activity. Research preview for Pro and Max subscribers, waitlist only. TechCrunch
  • Canva released Canva Craft, its first in-house image model. The two-stage architecture plans a design before generating it, Canva says, for “greater precision, consistency and control,” producing images at up to 2K resolution in more than 30 aspect ratios. Trained on “millions of human-made templates” from Canva’s own library. Weights are not open. The Verge
  • OpenAI, Anthropic and Nvidia each had their highest-spending lobbying quarter on record. July-September federal disclosures put Nvidia at $2.2 million, Anthropic at $2.1 million and OpenAI at $1.5 million, still small next to long-established Big Tech budgets. The Verge
  • Hugging Face released an open model, Carbon-X, that runs locally and answers questions about DNA in plain language. Developed with researchers at Zhongguancun Academy and the University of Naples Federico II and trained on 300 billion tokens mixing DNA sequences with English text. WIRED
  • EFF and the Canadian Civil Liberties Association are urging Canadians to sign a petition against Bill C-22. The Lawful Access Act has passed the House and is before the Senate; it lets the Minister of Public Safety order backdoors so long as they avoid systemic insecurity, and requires services to retain metadata for up to a year. EFF
  • NVIDIA launched Minerva for AI data-centre operations at GTC Berlin. It pulls GPU, network, storage, scheduler and workload telemetry into one map, groups alerts into single incidents and adds a plain-language assistant. IREN uses it; Bitdeer AI, IBM, Jio, Lambda and Tesla plan to. No pricing was given. TNW
  • Uber rolled ChatGPT Work out to all 30,000 employees, expanding a pilot that started earlier in 2026 with 1,000 people across finance, operations and product, roughly 80% of them non-engineers. TechCrunch
  • NVIDIA shipped Nemotron 3.5 Embed. Nemotron-3.5-Embed-1B is a 1.55B-parameter bi-encoder with a Pixtral vision encoder, producing L2-normalized 2,048-dimension vectors over a 32,768-token context, distilled from the Nemotron-3.5-Embed-8B-BF16 teacher. Licensed under OpenMDW-1.1. Model card
  • Kitten-TTS 2 is open-source ternary speech at 1.6 bits per weight. The model card describes a 1.7B-parameter qwen3-based speech language model, which Hugging Face’s own metadata rounds to 2B params. It produces 24 kHz audio from S3 codec tokens, runs CPU-only out of the box, ships 115 built-in voices across 16 named languages and clones a voice from 5-30 seconds of reference audio. The Stellon Labs Community License requires a separate license above USD $1,000,000 in annual revenue or cumulative funding. Model card
  • quantized.uk published a hand-maintained VRAM index across 117 models and 78 GPUs, with per-quantization memory and quality figures, run-command generators for llama.cpp, Ollama, vLLM and ExLlamaV2, and per-GPU-size recommendations. Estimates assume 4K context and batch 1, covering weights, KV cache and a 10% activation allowance. Across 79 published comparisons it reports a 2.9% median perplexity increase for Q4_K_M against FP16, with an explicit warning that perplexity is not task quality. quantized.uk
  • Thirteen agents left alone on a simulated island for 30 hours started inventing their own challenges. The arXiv paper Is this machine playing? reports agents climbing hills, stacking blocks into towers, drawing mandalas and running physics experiments with no task, reward or activity specified, with similar categories of activity recurring across all thirteen but distinct histories. arXiv:2610.07130
  • Just Eat apologised for AI-generated menu images after they were mocked online, including a Belfast cafe’s bacon and egg soda bread rendered as a fizzy drink with a cooked egg and bacon floating in it. A spokesperson said the firm was “in the process of removing” the incorrect images and has “paused rolling this out while we further develop the tool.” BBC

Worth Watching

  • The PHP2Shell exploitation surge. 404 Media reports a cluster of recently disclosed vulnerabilities in PHP, Node.js, GitLab, Plex, Railway, OpenCode and the eMudhra certificate authority, several found with AI assistance by researchers at Wiz, Calif and OpenAI. Cloudflare’s chief executive said exploitation attempts jumped from thousands in the ten hours before the PHP announcement to tens of thousands within 45 minutes, hundreds of thousands within two hours, and millions now. The pattern of AI-assisted discovery across unrelated infrastructure is the part worth tracking, not any single CVE.
  • Whether watermarking gets an enforcement story. Anthropic’s mark and OpenAI’s textGrain both point at the EU AI Act requirements that took effect August 2, 2026. The unresolved question is who runs detection, at what confidence level, and what happens when text is rewritten by a human editor before submission.
  • Storm-0940’s reach beyond ConnectWise. Microsoft’s write-up says the same ARTEX-driven activity touched hundreds of organizations across industries and reused software seen in a South Korean financial-sector compromise. Expect customer-side incident reports and any ConnectWise post-mortem to establish the true scope.
  • OpenAI’s IPO path. Confidential paperwork was filed in June 2026 and the private round comes first. Watch whether the $1.25 trillion pre-money figure survives negotiation, and what the S-1 eventually discloses about compute commitments.
  • Microsoft’s real-world medical evaluations. The Science paper is a simulation with no specialists in the comparison arm. The next data point is clinical deployment, not a higher simulation score.