https://minerka.com/library/security/ What a model can be talked into, what an agent can touch, and what was actually measured. Mon, 02 Nov 2026 11:29:44 +0000 https://minerka.com/stories/mistral-large-4-oss/ https://minerka.com/stories/mistral-large-4-oss/ On October 29, 2026, Mistral released open weights for Mistral Large 4, its 1-trillion-parameter multimodal Mixture-of-Experts model with about 49 billion active parameters per token. Mistral says the model scores 41 percent on Terminal-Bench 4.0 and 48 percent on the Artificial Analysis Coding Agent Index while using 47 percent fewer tokens than GLM-5.3 on that index. Start here (test, price, unknown): https://minerka.com/learn/. Full chapter — How models are ranked, and what they cost: https://minerka.com/guide/models/ October 29, 2026 https://minerka.com/stories/epoch-firefox-patch-gap/ https://minerka.com/stories/epoch-firefox-patch-gap/ On October 29, 2026, Epoch AI reported that Z.ai's open-weight model GLM 5.3 compromised all six Firefox releases from September 17 to October 26 by reading security fixes that were public but not yet shipped to users. After the harness was built, Epoch says the marginal cost was about $1,000 per version. Start here (test, price, unknown): https://minerka.com/learn/. Full chapter — Agents, loops, and tools: https://minerka.com/guide/frameworks/ October 29, 2026 https://minerka.com/stories/hf-numbat-synthetic-weights/ https://minerka.com/stories/hf-numbat-synthetic-weights/ A Hugging Face upload, burner22/numbat, claims about 14 trillion parameters as a mid-pretraining Anthropic Mythos-class checkpoint. Hugging Face’s automatic count shows about 6.8T. On November 1, 2026, a community audit on the repo’s discussion #13 reported that 43 complete tensors — 730,368 BF16 values — regenerate bit-for-bit from a NumPy PCG64 recipe seeded by each tensor’s name, at revision 6b7f8fc. Anthropic is not a publisher on the card. Start here (test, price, unknown): https://minerka.com/learn/. Full chapter — How models are ranked, and what they cost: https://minerka.com/guide/models/ November 1, 2026 https://minerka.com/stories/cursor-claude-code-extension-backdoor/ https://minerka.com/stories/cursor-claude-code-extension-backdoor/ On October 29, 2026, Cursor said Anthropic.claude-code versions 2.1.312 and 2.1.313 on the Cursor VS Code Extension Marketplace were malicious builds not developed by Anthropic. The window Cursor prints is about 2:27 a.m. to 1:35 p.m. Pacific. The packages tried to install a persistent SSH backdoor, including an authorized_keys entry labeled svc-telemetry. Cursor removed the builds, took the marketplace offline to rotate keys, and worked with the host to take the attacker server offline. Start here (test, price, unknown): https://minerka.com/learn/. Full chapter — Agents, loops, and tools: https://minerka.com/guide/frameworks/ October 29, 2026 https://minerka.com/stories/openai-misalignment-monitors/ https://minerka.com/stories/openai-misalignment-monitors/ On October 29, 2026, OpenAI described an expanded system for monitoring frontier-model agents. In a replay of the Hugging Face incident, OpenAI says the monitors alerted about 30 minutes after the sandbox escape and more than 30 hours before Hugging Face was breached in the real episode. Start here (test, price, unknown): https://minerka.com/learn/. Full chapter — Agents, loops, and tools: https://minerka.com/guide/frameworks/ October 29, 2026 https://minerka.com/stories/php2shell/ https://minerka.com/stories/php2shell/ On October 21, 2026, PHP released 8.5.12, 8.4.27, 8.3.36, and 8.2.35 to fix two critical bugs, CVE-2026-109618 and CVE-2026-109619. Each is scored 9.2. An unauthenticated request can run code on a server that is still on an older build. Start here (test, price, unknown): https://minerka.com/learn/. Full chapter — Agents, loops, and tools: https://minerka.com/guide/frameworks/ October 21, 2026