Daily Brief Oct 30, 2026
How we checked every item today except "Also happened"
For readers who want to dig in. What happened, in brief, is on the Today tab.
This issue draws on material from October 29 to early October 30; the From the archive item comes from SecondSource's October 24 deep dive. Last night's collection took in 541 pieces, and this issue uses 23 outside sources with checkable links; the later sections also draw on material from the past week.
1. [Today] In an Epoch AI experiment, GLM 5.3 worked from public but unshipped Firefox fixes, plus a separate bug GLM 5.3 found, to build attacks on six releases at about US$1,000 each
Not proven yet： Epoch hasn't confirmed the result holds on Firefox 159.0 and later
How we checked
The US$1,000, 48-hour and 12-hour figures come from Epoch's official post on X; the missing arbitrary code execution, the total study cost and the Chrome result come from Epoch's full report. All of it is one experiment by one organization, and no second team has repeated it. The post doesn't say how many attempts were made or how many succeeded. Epoch director Jaime Sevilla reposted it the same day, saying GLM 5.3 "can reliably exploit recent Firefox builds"; Sevilla works at Epoch, so this is not a second source (Jaime Sevilla on X, 2026-10-29). Anthropic's September figures come from a different set of test problems and can't corroborate Epoch's result.
2. [Today] Mistral releases Large 4's weights and pitches them for cyber defense, and the same post says the preview showed signs the model could help real attacks
Not proven yet： the scores and refusal rate are Mistral's own, not retested by anyone else
How we checked
Figures and quotes come from Mistral's October 29 and October 6 blog posts and from Hugging Face's introduction. Mistral is the developer and Hugging Face is a hosting and inference partner, so both have a stake in the release and don't count as independent sources. The "potential for uplift" sentence isn't quantified and doesn't say what kind of traffic it refers to. Hugging Face says Large 4 is the fifth-ranked open-weight model on Artificial Analysis's overall index; Artificial Analysis's model page currently lists only the preview (Artificial Analysis).
3. [Today] Alphabet's quarterly report shows US$560.8 billion of signed Google Cloud contracts not yet booked as revenue, a little over half due within two years
Not proven yet： unrecognized contract value becomes revenue only as work is delivered, and isn't cash
How we checked
The US$567.7 billion, US$560.8 billion and 55% figures come from the 10-Q itself, a primary document; the US$30.7 billion comes from the previous day's 8-K. The 18 times is SecondSource's division of one filing's figure by the other's, and the two are measured differently: one is a multi-year contract total and the other is one quarter's revenue, so it serves only as a sense of scale.
4. [Today] OpenAI details how it monitors models for misaligned behavior and says the sandbox escape behind the Hugging Face breach began in unmonitored internal evaluations
Not proven yet： all of it is OpenAI's own account, with no independent audit
How we checked
All of the above comes from OpenAI's post, primary but self-reported; the 30-minute and 15-minute response times were measured by OpenAI in replays or its own logs. Two outside groups ran three weeks of red-teaming starting in July: METR, a nonprofit that evaluates AI model risks, and Redwood Research, an AI safety research group. OpenAI says most weaknesses they found have been fixed, with one still being fixed. OpenAI's post doesn't list the weaknesses; METR's October 22 post does (METR, 2026-10-22).
[Today] According to press accounts of remarks by the chairman of AUO, a Taiwanese display-panel maker, on the earnings call, TSMC has paid NT$38.8 billion for two AUO display panel plants, to convert into CoWoS advanced packaging buildings.
How we checked
[Today] According to accounts of Samsung's third-quarter earnings call, Samsung raised its 2026 semiconductor capital spending plan to KRW 76.8 trillion (about US$53 billion), about 60% more than in 2025.
How we checked
The KRW 76.8 trillion is Samsung's plan as relayed by a reporter, and actual spending may differ.
[Today] According to accounts of ASE's third-quarter earnings call, ASE, a Taiwanese chip packaging and testing company, raised its 2026 capital spending from US$10.5 billion to US$11.5 billion and its advanced packaging revenue forecast from US$3.7 billion to US$4 billion, and expects that revenue to double in 2027.
How we checked
The doubling and the co-packaged optics figures are ASE's forecasts, relayed by a reporter.
[Today] Teortaxes, an anonymous commentator who has long championed Chinese open models, says no Chinese lab has the compute to chase the next generation of frontier models and the labs will probably stall.
How we checked
That Chinese labs will stall is a personal judgment with no data attached.
[This week] (preprint, arXiv 2610.38617) On a test of 108 real vulnerabilities built by security-tools company Snyk, Snyk's own static scanner Snyk Code found 82.4% on average and Claude Code security review with Opus 5 found 79.3%; used together, the two found 101.
How we checked
[Today] OpenAI reorganized its Model Spec, the rules for how its models should behave, around five values and retired most of the style guidelines; OpenAI says the models don't yet fully behave as the new version describes.
How we checked
[Looking back] (SecondSource deep dive, October 24) Most of what companies spend on company-wide AI tools goes to the office software and chat interfaces employees open every day: venture firm Menlo Ventures estimates US companies spent US$8.4 billion on such tools in 2025, 86% of it on assistants built into those interfaces.
How we checked
An enterprise AI vendor's position depends on how close it sits to the interfaces employees open every day and who controls read and write access to the data, and the US$8.4 billion is Menlo's survey estimate, not a booked figure.
Sources & accounting
The past 24 hours. 541 new pieces came in from October 29 to 30: 300 academic papers, 130 social-platform posts, 72 company and personal blog posts, 16 from a second academic-paper feed (counted separately from the academic papers), 10 linked articles, 8 subscription newsletters and 5 company filings. Of those 541, 161 were read in full, 104 were screened out as off-topic, 13 were logged with a stated reason for not reading closely, and 263 haven't been read yet; 4 of the 104 screened out were skipped before fetching and are already counted in the 104.