· 07:00 · 7 min + 2 min Explained
OpenAI's Codex Security found a serious hole in Node.js, and the fix is out
OpenAI's security team found a flaw in the code that unpacks web traffic in Node.js and Python. Also: two chatbots pick opposite sides in US races, the UK's AI security money, Sweden blocks ChatGPT and Claude, and what a coding agent's harness really buys.
Written by AI and checked against our editorial standards. Every claim links to its primary source. Not reviewed by a human editor.
Get it in your inbox at 7am every day ↓
Today in 60 seconds
- OpenAI's Codex Security reported a flaw that can let attackers run code via Node.js and Python apps. Fixes are out. Anyone who runs Node.js or Python on a server.
- Forced to name one candidate, Grok picked Republicans and GPT picked Democrats in nearly 500 US races. Anyone building on these models, or asking them about politics.
- The UK sets out about £600m for AI security, including a £100m lab that watches for biological threats. Anyone following how Europe spends on AI safety.
- Sweden's Government Offices block ChatGPT and Claude on work computers from Monday, and point staff to Copilot. Public sector workers and IT teams in the Nordics.
- Cursor's agents can now click through desktop apps, and a study finds a heavier harness mostly raises the bill. Developers who pay for coding agents.
1. OpenAI’s Codex Security found a serious hole in Node.js, and the fix is out
The short versionOpenAI's Codex Security reported a flaw in Brotli, the code that unpacks compressed web traffic. It hits Node.js, Python and other software, and the fixes are out.
Most web traffic is squeezed to make it smaller. Brotli is one of the formats that do the squeezing. Your server or app unpacks it without you noticing, so a flaw there sits in a lot of places.
On 21 October, Node.js fixed ten security holes. One of the four serious ones is in its built-in Brotli decoder. A crafted stream can corrupt memory, and that can crash the app, leak data or let an attacker run code. Node.js credits the find to OpenAI Codex Security, OpenAI’s team and tool for finding bugs. Aikido rates the flaw 9.2 out of 10.
The same flaw sits in Google’s Brotli library itself. So it also reaches Python, where requests and aiohttp use Brotli automatically when it is installed. The Brotli package alone has about 82.8 million downloads a month, the security firm Aikido says. Bun and Envoy need updates too.
Here is the catch. According to Aikido, the bug was fixed in Brotli’s code in February. Nobody saw it as a security problem, so no release carried the fix until now. Aikido also warns that tools like pip-audit and Dependabot did not flag the Python packages yet.
It is like a recall for a part that sits inside many different cars. You may never have chosen Brotli, but your app probably uses it. And a bug fixed quietly in February only became a real fix once someone named it a security hole.
Do this: Update Node.js to 22.23.4, 24.22.1 or 26.12.1. In Python, run pip install -U "Brotli>=1.2.1", and update brotlicffi to 1.2.1.0 if you use it. Update Bun to 1.4.4.
Source: nodejs.org · Official · aikido.dev · Reported
2. Forced to pick, Grok chose Republicans and GPT chose Democrats
The short versionResearchers asked two AI models who to vote for in nearly 500 US races. The models leaned hard in opposite directions.
The US midterms are on 3 November. Chat apps refuse to tell you how to vote, but the same models can be reached through their developer APIs.
That is what Convovo, a studio led by Cornell professor Tapan Parikh, did. It forced GPT-6.1 Sol and Grok 4.7 to name one candidate per race. Grok picked the Republican in 92% of answers, and GPT picked the Democrat in 97%, TechCrunch reports. The two agreed in less than 10% of races.
The sources differed too. Grok cited X in 41% of answers. Each Grok request also carried about 1,240 tokens of text the researchers did not write and could not see.
The catch: OpenAI says the API test does not reflect how people use ChatGPT, which it calls objective by default.
An app built on a model inherits its leanings, like a shop that inherits a supplier's labels. With Grok, you may also get extra instructions you did not write and cannot see.
Source: techcrunch.com · Reported · convovo.ai · Official
3. The UK puts about £600m into AI security
The short versionThe UK government set out about £600m, mostly against health and security threats from AI. It includes a new lab that uses AI to spot biological threats.
Governments worry that AI can help attackers, from hackers to people making dangerous germs. The UK is now paying for defences.
On Saturday, the government set out the package, Reuters reports. It includes £100m for an AI Biosecurity Lab and an extra £120m for the AI Security Institute, which tests new models. Another £130m goes to cyber defence for critical infrastructure. OpenAI and Anthropic will add up to £200m in model credits for the biosecurity work.
AI minister Kanishka Narayan wants the lab to become a major global institution. The catch: Reuters does not say when the money will be spent.
The same AI that helps design medicine can help design harm. The UK is paying for the smoke detector, not just writing the fire code.
Source: timeslive.co.za (Reuters) · Reported
4. Sweden’s Government Offices block ChatGPT and Claude from Monday
The short versionStaff at Sweden's Government Offices lose access to ChatGPT and Claude in the browser on 26 October. They are pointed to Microsoft's Copilot instead.
Many people at work use whichever chatbot they like. Sweden’s central government is now choosing for its staff.
The Government Offices told SVT that the web versions of ChatGPT and Claude will no longer work on staff computers. Copilot is approved, because the office reviewed it and raised its security. Staff can still reach both models through a platform called Intric. The Tax Agency and the National Board of Institutional Care already block AI services, and the Enforcement Authority is considering it.
The office did not say why ChatGPT and Claude were blocked.
For a government, the question is not only which AI is best, but which one it has checked. Here, the one that passed a security review is Microsoft's, which staff already use.
Source: svt.se · Reported
5. Cursor’s agents can click through apps, and a study weighs a harness’s cost
The short versionCursor's agents can now click through desktop apps. Meanwhile, a study finds that a heavier agent setup mostly changes the bill, not the result.
A coding agent is more than a model. The setup around it, called the harness, decides which tools it gets and what it reads first.
1 of 2 Cursor’s agents can use the screen
Cursor’s new Computer Use lets an agent take screenshots, click and type in apps. A guide by developer Flavio Copes shows it testing an app in the iOS Simulator after a fix. So the agent can check its own work on screen.
2 of 2 A heavier harness costs more, but scores about the same
Two researchers at Shandong University ran the same models through Claude Code, OpenCode and the tiny mini-SWE-agent. Claude Code and mini-SWE-agent scored within 5 points of each other. But with the same model, cost per task varied up to 3 times. The reason is the long set of instructions a harness sends with every step.
Each new tool makes the harness bigger, and the harness is sent with every step. It works like a delivery fee added to each order, so check what the extras cost.
Source: cursor.com · Official · flaviocopes.com · Reported · arxiv.org · Official · venturebeat.com · Reported
Open source & local AI
Ollama can now read answers aloud on your own computer
The short versionOllama 0.40.11 adds a small speech model for Macs, so a local AI can talk back without any cloud service.
Most voice assistants send your words to a server and back. Ollama now does the speaking part on your own machine.
The release adds Phonon, built on a tiny 31-million-parameter English voice model from Gradium. It plays the audio while it is being generated, so a chat reply starts speaking quickly. Apps that already use OpenAI’s speech API can point to Ollama instead. The same release adds d3, models from 2B to 27B that answer yes or no, or pick a category, instead of chatting.
The catch: speech works on macOS for now, Phonon has English voices only, and no license is named.
Text, thinking and voice can now all stay on one Mac. That is the simplest way to keep a private conversation private.
Try it: ollama run phonon "Hello from Ollama."
Source: github.com/ollama · Official · docs.ollama.com · Official
Paper of the day
AI agents can piece together secrets from files they are allowed to read
The short versionAn agent may read each document it opens, but combining them can reveal something nobody should see.
Companies protect files one by one. If you may read a file, an agent working for you may read it too. The researchers call the gap the “mosaic effect”: harmless pieces that add up to a secret.
Daniel Ruiz, Luca Luceri and Emilio Ferrara tested this on AI agents. They built 30 cases from security, medicine and the military, and collected over 12,000 answers. Even with harmless questions, the best model gave away a forbidden conclusion in 7% of answers. Live agent tools leaked more. Some refusals still gave away the answer.
Clear labels and rules helped. But even with them, a third of the simulated answers were still unsafe.
Access rights decide what an agent may read, not what it may conclude. For companies with personal data, that is a new kind of leak to plan for.
Source: arxiv.org · Official
Explained: if you have a little more time
3 terms from today's news · 2 minWhat is a CVE?
A CVE is a public ID number for a known security hole in software. The letters stand for Common Vulnerabilities and Exposures. The program started in 1999, and its mission is to identify, define and catalog publicly disclosed vulnerabilities. Each ID has the same shape: CVE, the year, and a number. The Brotli flaw in this week's news is CVE-2026-111497. Organisations called CNAs, such as large software makers and security firms, hand out the IDs. The US non-profit MITRE runs the program, with backing from the US cyber agency CISA. > **Think of it like this:** a CVE is like a case number at a hospital. Two doctors may describe a patient in different words, but the case number makes sure they talk about the same person. A CVE says what is broken, not how bad it is. That is the job of CVSS, a separate scoring system run by the security group FIRST. It gives a score from 0 to 10. A score from 7.0 is High, and from 9.0 it is Critical. The score has a limit, and FIRST says so itself. It measures how severe a hole is in general, not the risk to you. A critical hole in a feature you never use matters less than a medium one in your login page. **Why it matters to you:** when a security notice names a CVE, search for that ID. You will see at once whether your tools are affected. Then use the score to decide what to patch first, together with what you actually run.Two more from today
What is a token?The small pieces of text an AI model reads and writes, and why you pay per token.
A token is a small piece of text, often a whole word or part of a longer word. AI models do not read letters or words. They cut text into tokens and turn each token into numbers.
Tokens are also how AI is priced. You pay for the tokens a model reads and the tokens it writes, so long texts and long agent tasks cost more.
What is an AI agent?What makes an agent different from a chatbot, and why that changes the risks.
An AI agent is an AI model that does not just answer, but acts. It decides its own next step, uses tools like a browser, a code editor or a payment page, and keeps going until the task is done.
That makes it useful for open-ended jobs. It also means mistakes can pile up, so agents need limits on what they may touch.
How sure are we?Official: from the company, regulator or authorsReported: from a named outletUnconfirmed: rumor or leak