Hackers hijacked about 1,900 GitHub accounts and used them to insert credential-stealing GitHub Actions workflows into more than 30,000 repositories. They targeted CI/CD secrets, including cloud access keys and AI provider API keys, with the biggest activity on October 8 and 9, when they attempted to extract 3,174 secrets from repositories tied to about 3,000 users and organizations. GitHub blocked the malicious workflows, but many were recycled and only 16% (124 out of 772) of the affected repositories had been cleaned by October 5, prompting secret and token rotation and account access revocation.
OpenAI will retire GPT-4o, GPT-4o mini, GPT-4.1, and GPT-4.1 mini from its API on January 14, 2027, including dated snapshots and fine-tunes based on them. The deprecation notice delivered Wednesday gives developers about 3 months to migrate production traffic. Developers must move to GPT-6 Luna and adjust API usage and settings because tool-calling and reasoning behavior differs, including limits on temperature/top_p/logprobs and the need to use the Responses API for combined reasoning plus tools.
Meta launched Muse Spark Open, an 816B open-weight AI model with 42B active parameters, and made it available via multiple model APIs and major model hubs under the Muse Model License. The model uses a 1 million token window. The license adds limits tied to developers’ revenue and requires UI attribution (“Built with Muse Spark Open”), while Meta’s benchmarks claim it performs at or above several top Chinese open-weight models but trails them on specific coding tests like Terminal-Bench 2.1.
Google’s Universal Cart shopping tool has launched for U.S. users, letting people save and track items across Google Search and the Gemini app. It was first previewed at Google I/O in May and can send notifications for price drops and when out-of-stock items come back. The change is that shoppers get a centralized cart with progress persistence, plus deal, availability, payment-perk, and promo-code support tied to Google’s Universal Commerce Protocol.
Google is adjusting how inline links show up inside its AI Overviews and AI Mode search responses. The update is intended to make inline links appear higher up in responses and more frequently. Publishers may see different traffic patterns as key sources become more immediately clickable, potentially shifting clicks away from traditional link lists.
Grok announced Grok Voice 3.0, a speech-to-speech model it says improves call resolution and speed. Artificial Analysis testing reports an 86.9 Speech-to-Speech Index score. It is available in the Voice Agent API starting today at $0.08 per minute, the same as Grok Voice 2.0.
Jev released an improved Jev 1.14.0 plus experimental “danger zone” API features aimed at less-reliable, creativity-focused use cases. The experimental image and longer-context options are enabled via headers named TypeSafe-Danger-Zone-Images: true and TypeSafe-Danger-Zone-Long-Context: true. Developers can now opt in to composable image support, add a new box type, and use longer context lengths, while production use is discouraged for these experimental capabilities.
OpenCode 2.0 overhauls how its coding agent runs tools and manages sessions, including making the local service auto-start and updating the API and client packages. The update adds 80+ internal plugins that keep the Plugin API maintained and brings MCP servers into Code Mode by default. As a result, users and scripts get simpler local orchestration, more capable agent-to-tool workflows, and breaking changes for 1.0 plugins and the server/API structure when upgrading.
Toad was launched as an automation tool that lets Claude, Claude Code, Cursor, or any MCP client run commands and work with files on multiple machines via one MCP server. It uses a small service installed on each machine with no open ports and requires approval for every change. As a result, users can centrally control remote file/command access from their MCP clients with explicit per-change approval.
Google is rolling out its Universal Cart shopping tool across the US in the Gemini app and Google Search. The rollout is launching ahead of Black Friday and the holidays. As a result, shoppers can save products from multiple retailers in one unified cart and keep them organized across Google platforms.
SpaceXAI released Grok Voice 3.0, a speech-to-speech voice agent model exposed via a realtime WebSocket endpoint. It scored 86.9 to rank #1 on the Artificial Analysis Speech-to-Speech Index. Developers keep the same endpoint/events and $0.08 per minute price while the grok-voice-latest alias updates automatically, with Grok Voice 3.0 available only via hosted API (no weights).
Figma announced new features at its first Config event in India to let teams define brand design rules for use by agents, including a Markdown-based “Figma Specs” editor and integrations with libraries and headless CMS. Payload downloads increased sixfold in the last 12 months, and Figma is also moving its code-layers prototype feature from private beta to public beta in India. As a result, agents on Figma can follow more standardized design guidance while users can generate or iterate code-based prototypes directly on the canvas.
Skisso launched a free Chrome extension that lets designers and developers target live UI elements and apply edits via AI coding agents using only the exact change. It claims the prompt shrinks from 25,700 tokens to about 380 tokens in its test. As a result, users can run the tool locally without an account and avoid describing pixels or pasting entire pages.
Meta’s Muse Spark Open open-weight agentic coding model launched on Together AI and is available using serverless and dedicated infrastructure. It includes a 1M-token context window, and Together AI lists pricing at $1.25 per 1M input tokens and $4.25 per 1M output tokens. Developers can now run Muse Spark Open via the Together API on day 0, with support for long-running code-understanding workflows.
Every AI story that matters,
in your inbox by 8am.
TLDRocket reads all relevant sources, removes duplicate coverage, and summarises the
day in two minutes. Follow companies and topics for alerts, or get the
briefing in Slack. Free, no spam, unsubscribe anytime.
Reading TLDRocket needs no cookies, and the readership counts we rely on come from
our own cookieless analytics. Google Analytics is the exception: it sets cookies and
reports to Google, so it stays switched off until you allow it. You can change your
mind any time from “Cookie settings” in the footer.
Strictly necessary
Session security and form protection (tldrocket-session,
XSRF-TOKEN, 2 hours). The site cannot work without them,
so they need no consent.
Always on
Google Analytics 4 (_ga,
_ga_<id>, up to 2 years). Measures which
stories and sections readers use. Google acts as a third-party processor and may
store the data outside the EU. No advertising, no profiling, no data sold.
