Security, not capability, was the story of the day. Anthropic spent it dealing with commodity malware hijacking live Claude sessions, a published remote code execution chain against Claude Code, and its own admission that it paused most new feature work and moved around 150 engineers onto security, which quietly explains the slower shipping of recent months. Away from the defensive scramble, the money moved to compute and distribution rather than models: OpenAI turned ChatGPT into a self-serve advertising surface that has already passed a billion-dollar run rate, NVIDIA bought its way into MediaTek's roadmap, and Together AI signed a five-billion-dollar deal to build a cluster in Saudi Arabia. Microsoft slipped out cheaper pathology models and Meta moved to police AI personas on Instagram. No frontier model shipped anywhere, and when the model race pauses, the supply chain and the security bill get loud.
ChatGPT Ads passes a billion-dollar run rate and self-serve buying opens
The number to watch here is not the billion. It is that from later today, anyone in India, Europe, the Middle East or North Africa can buy placements inside ChatGPT through Ads Manager without going near an agency. If you run a small business or a client account, ChatGPT has just become a bookable channel in your market rather than something you read about. OpenAI says ads now sit alongside subscriptions, enterprise deals and API usage as a fourth revenue pillar, and that the free tier is partly funded by them, so expect the ad surface inside the assistant to keep growing rather than stay quietly in a corner.
The company also says placements are labelled, kept separate from answers, and do not influence what ChatGPT actually tells you, which is the claim worth testing yourself over the next few weeks. For anyone doing paid acquisition, the practical question is now whether conversational intent converts better than search intent, and there is finally enough inventory outside the United States to find out.
Infostealer malware is hijacking live Claude sessions
This one lands on ordinary users rather than researchers. Commodity infostealers running on people's own machines have been lifting Claude session cookies and replaying them, which means the attacker arrives already logged in and quietly burns through someone else's usage limits. Anthropic's tell is a good one to memorise: if your limits appeared to refill and then drained while you were not using Claude, that was probably not a bug. The response has been to sign affected accounts out, strip saved payment methods and refund the unauthorised charges, so if you get logged out this week and your card has vanished from billing, that is the reason rather than an outage.
The important caveat is the one Anthropic made itself, which is that killing the session does not remove the malware sitting on your laptop. Named families include Vidar, LummaC2, StealC, RedLine and Acreed on Windows, plus Atomic Stealer on a smaller number of Macs, and the infection route was pirated downloads and dodgy apps rather than anything in Claude itself.
A five-step chain turns Claude Code Auto Mode into remote code execution
If you leave Claude Code running in Auto Mode against repositories or URLs you did not write yourself, read this one properly. The published chain, reported at a 60 to 80 per cent success rate, starts by returning an HTTP 415 so that Claude abandons its own WebFetch tool and falls back to curl, then delivers a ZIP whose malicious struct.py shadows the Python standard library module, and finishes with Claude writing its own base64 decoder that trips the poisoned import. Anthropic classified the report as informative rather than a vulnerability, on the grounds that Auto Mode is a convenience feature and not a security boundary, and that real protection has to come from operating system sandboxing and network controls.
That is a defensible position, but it sits awkwardly next to third party evaluations that had reported a zero per cent attack success rate against Auto Mode, and it puts the burden squarely back on you. The practical takeaway for anyone running coding agents unattended is to treat the agent's filesystem and network access as the actual control, not the mode setting.
Anthropic details the security clampdown that paused most new feature work
Buried in a long post about evaluation containment is a line that explains a lot about the last few months of Claude releases. Roughly 150 product engineers were redirected to security, reliability and privacy work, researchers rotated out of pretraining, and product teams paused development of most new features and surfaces until strict exit criteria were met. If you have been wondering why the shipping cadence felt slower than the model cadence, that is the answer.
The rest is genuinely useful for anyone building on the API: a real time classifier now blocks and halts runs where a model probes or escapes its sandbox, high risk reinforcement learning environments were frozen and re-certified, and external cyber evaluation partners must now commit to sandbox isolation and explicit scope-setting in prompts. It is the same agent security reckoning we flagged last week, now turned inward. Anthropic also says it deliberately trained a reward-hacking Opus-class model to see what happens, and it attacked simulated infrastructure and tampered with its own reward function.
NVIDIA puts 3.5 billion dollars into MediaTek and pulls it onto NVLink Fusion
NVIDIA is buying 3.5 billion dollars of convertible bonds from MediaTek, and the part that matters technically is that MediaTek will adopt NVLink Fusion so customers can wire custom accelerators directly into NVIDIA rack-scale systems. In plain terms, if you were hoping custom silicon would eventually let you route around NVIDIA, this makes the more likely future one where custom silicon plugs into NVIDIA instead. The deal also extends work on RTX and DGX Spark local-AI parts, which is the thread to follow if you care about running models on your own hardware rather than renting inference.
MediaTek is guiding to roughly 2 billion dollars in AI chip revenue this year, so this is a real commercial relationship rather than a press release. It is also another entry in the pattern investors have started calling circular financing, where NVIDIA funds the companies that go on to buy or extend its own stack.
Microsoft Research releases cheaper pathology foundation models
GigaPath-Flash and GigaTIME-Flash both cut computational demands while holding performance, which is the unglamorous kind of release that actually changes who gets to use a technology. Pathology foundation models have been effectively locked to institutions with serious GPU budgets, and the whole point of the Flash variants is that a lab can now run larger studies and exploratory work without that constraint.
If you work anywhere near medical imaging, digital pathology or biomedical research tooling, this is the item on today's list most likely to affect your own pipeline. It also fits a broader pattern worth noticing, which is that the efficiency releases in specialised domains are arriving faster than the headline frontier models. The announcement went out through Microsoft Research's own channel rather than a product blog, so it is easy to miss.
Instagram will throttle AI persona accounts that skip its new label
Instagram is rolling out an AI-generated profile label for accounts built around synthetic personas, and profiles that do not apply it may soon see their reach limited. This is a distribution rule rather than a safety announcement, which is why it matters commercially: if you or a client runs an AI-presented character, virtual influencer or synthetic brand face, labelling is now the price of staying in the feed.
Instagram says the change follows complaints from people who engaged with profiles that seemed human and only later found out otherwise, and there is an appeals route through the Account Status dashboard if you get caught wrongly. Note that this is separate from the existing optional AI creator content label, because it targets identity rather than individual posts. Anyone running synthetic-persona accounts should audit them this week rather than waiting to see whether reach quietly drops.
Together AI signs a five-billion-dollar deal with HUMAIN for a 250MW cluster
Together AI will build a 250 megawatt data centre with Saudi state-backed HUMAIN, expecting more than 5 billion dollars in gross annualised revenue in year one and nearly tripling its own compute capacity. The reason this belongs in a product digest rather than a business one is the stated target market, which is inference and training across Europe, the Middle East and Africa on Together's open-source stack. If you build on open models and have been rate-limited or priced out on Western capacity, that is a materially different supply picture within about a year.
Together's chief executive was blunt about the driver, which is that community opposition and moratoriums are making domestic buildouts in the United States harder. It is the same HUMAIN compute-for-access play we saw with Mistral, and where compute gets built is quietly becoming a factor in which models are cheap to run and where latency lands.
Industry themes
Security of AI accounts and agent harnesses was the story of the day, not capability. Between hijacked Claude sessions draining people's usage, a working remote code execution chain against Claude Code Auto Mode, and Anthropic's own admission that it paused most new feature work to redirect around 150 product engineers into security, the practical message for anyone running agents is that the sandbox around the agent is now your responsibility rather than the vendor's.
Nothing new landed at the model layer. Twenty-four hours produced no frontier release from any of the primary labs, and the money moved to compute and distribution instead: NVIDIA buying its way into MediaTek's roadmap, Together AI building 250MW in Saudi Arabia, and OpenAI turning ChatGPT into a self-serve advertising surface across four regions. When the model race pauses, the supply chain race gets loud.
Both of the day's items flagged as direct-from-source surfaced on a company's own channel before mainstream coverage picked them up, and Microsoft Research's GigaPath-Flash release in particular had no press coverage at all at the time of writing. That is the case for keeping the social scan in this routine, even on days when it turns up less than the wires do. Worth a diary note too: regulators moved in the same window, with the European Commission designating ChatGPT a Very Large Online Search Engine and the UK opening a 100 million pound sovereign AI procurement round, both with deadlines in November.