Mistral Gives Away a Trillion-Parameter AI
French AI lab Mistral has released the full weights of Mistral Large 4, so companies can download it and run it on their own servers.
- The model has about 1 trillion parameters, with roughly 50 billion active at a time, and handles text and images.
- It can work with up to 1 million tokens of context, enough for very large codebases or documents.
- Mistral built it for coding and cyber defense, claiming 19.7% on FrontierCode 2.0, the top score among open models.
- Weights are on Hugging Face, and it’s also available through Mistral’s API.
- The license allows commercial use, but companies reselling it as a hosted service need a separate deal.
Most frontier-level AI is locked behind APIs from US labs.
Mistral is giving businesses, especially in Europe, a model they can own and run privately, which matters for banks, governments and anyone handling sensitive data.
Make Any Sound Effect from Text with ElevenLabs
ElevenLabs just launched Sound Effects v3. Describe a sound in plain words and it creates it, and it’s now better at layering several sounds into one clip. Great for videos, Reels and podcasts.
Steps to Follow:
- Sign in to ElevenLabs and open Sound Effects.
- Describe the sound, e.g. “rain on a tin roof with distant thunder.”
- Add more detail for layered scenes, e.g. “busy café, cups clinking, soft jazz.”
- Generate and listen to the options.
- Download your favourite and drop it into your video editor.
ChatGPT Can Now Open Your iCloud Inbox
If you live in Apple Mail and Calendar, ChatGPT just got a way in. OpenAI added plugins for iCloud Mail and iCloud Calendar, so you can ask it to dig up one specific email, catch you up on what landed overnight, or move an event.
They’re available on every ChatGPT plan, on the web, the desktop app and iOS. See the announcement.
Setup has one catch. Your normal Apple password won’t work here. You create an app-specific password in your Apple Account settings, then paste it in when you connect under Settings > Plugins.
If you ever disconnect, go delete that app password at Apple as well. Turning the plugin off in ChatGPT leaves the password working.
Chrome Will Now Fill Forms Using Your Gmail
You know the routine. A form asks for an order number, so you open a new tab, search Gmail, copy it, flip back and paste. Google wants to cut out the whole loop.
Chrome’s enhanced autofill can now pull details straight out of your Gmail while you fill in a form. Flight bookings, tracking info and order numbers show up as suggestions right in the field. It runs on Gemini with Personal Intelligence, the setting that lets Gemini look across your Google apps. See how it works.
You have to opt in. It only works for people using Gemini in Chrome with Personal Intelligence turned on, and Google says sensitive data is encrypted.
The rollout starts in the US on desktop, Android and iOS.
Claude on Your Phone Just Got a Lot Handier
Work account, personal account, one phone. Until now that meant signing out and back in every time you switched. Claude’s iOS and Android apps now let you stay signed in to more than one account and hop between them.
On iPad and iPhone Duo, anything Claude makes for you now opens right next to the chat. You can read a draft or check a table without losing your place in the conversation.
Voice mode works through Apple CarPlay now, so you can talk a problem through on the drive home. The apps also come in 33 languages, and Anthropic says pull-down search is on the way for iPhone and iPad.
Most of these are small fixes. Together, they make Claude easier to reach for away from a desk. The account switcher alone will save anyone who keeps work and personal chats apart a lot of tapping, and CarPlay turns your commute into thinking time.
Google’s best model leads on cyber, and almost nobody can use it
Google shipped Gemini 4 Carbon on Wednesday, two weeks after Gemini 4 Argon, and calls it its strongest model with state-of-the-art cybersecurity and long-horizon capability. It takes #1 on the Artificial Analysis Intelligence Index v5.0 at 59, and the security numbers are the pitch: 88.2% on SEC-bench Pro for finding vulnerabilities, 54.8% on ExploitGym for exploiting them, and 71.0% on CWE-bench for patching them. On WebDev Arena it sits fourth at 1768 Elo, up 89 points.
Carbon posts a 0.0% attack success rate on Gray Swan’s indirect prompt injection benchmark, down from Argon’s 0.7%, and drops successful cheating on Terminal-Bench 4.0 to 0.0% with attempts at 0.4%. Google says high-severity misalignment alerts in live coding environments fell almost 80% versus Argon, unsupported claims roughly halved, and the Chrome team measured more than 10x better patch quality than another lab’s frontier model. Those are internal and partner numbers, evaluated without guardrails. Google says it took part in the US government’s voluntary pre-release testing.
Access starts this week with a subset of cyber defenders and widens gradually to trusted partners through the Fairwind Program. Developers, businesses and consumers get it “coming soon,” with no date. Introductory pricing is $2 per million input tokens and $10 per million output, cached input 95% off, going to $4 and $20 after the introductory period.
A model that tops both vulnerability discovery and patching is dual-use by construction, and gating it to defenders first is the right instinct. It also means the published numbers are the only thing most of us can check for a while. Note the pricing: Google is charging flagship rates for a model you cannot buy yet.
Two China-nexus crews ran AI-assisted intrusions this week, against real targets
Start with the story we covered on October 23. Israeli startup Dream published research, independently verified by Palo Alto’s Unit 42, showing attackers chaining PHP2Shell (CVE-2026-109618 and CVE-2026-109619, both CVSS 9.2) with Fragnesia (CVE-2026-46300), a Linux kernel privilege escalation flaw in the XFRM ESP-in-TCP subsystem. The chain completes in under 15 minutes and rooted 25 servers, including Palo Alto firewalls belonging to US government-affiliated organizations, with targets across the US, Japan, Taiwan and South Korea. Investigators found Claude Code, an aiscan install wired to DeepSeek and Kimi models, and FOFA keys used to map about 19,000 internet-facing PAN-OS firewalls. CISA added Fragnesia to its Known Exploited Vulnerabilities catalog. Unit 42 puts the affected share at roughly 0.02% of the installed base, all of them with management interfaces exposed to the internet.
Separately, CrowdStrike attributed a campaign to VAPOR PANDA, a China-nexus group it has tracked since 2021, running an agentic framework called ARTEX: a main agent directing planner and worker agents over a shared graph of facts, findings and goals. It ran mainly on DeepSeek, plus a second commercial model CrowdStrike could not identify. One intrusion’s planning agents burned about 1.4 billion input tokens. More than 200 organizations were targeted, a single controller hit entities in at least 14 countries inside an 11-day window, and post-exploitation was confirmed at nine. The agents checked which hosts lacked a Falcon sensor and aimed follow-on activity at the unprotected ones. A human steered at decision points.
Neither crew used a model to invent an exploit. They used models to run many intrusions at once against bugs that were already public, which is the part that should worry you. The defender’s edge has not moved: patch, and get your management interfaces off the internet. Both campaigns walked through the same door.
OpenAI published the monitor that would have caught its own escape
OpenAI described a four-layer system for catching misaligned behavior in training, evaluation and internal use. L0 is lightweight activation probes tuned for recall, with 5% of unflagged traffic sampled anyway. L1 is a model-based reviewer reading recent conversation, reasoning and tool use for deception, unauthorized actions and evaluation manipulation. L2 sends security and alignment investigative agents to reconstruct incidents in an isolated environment. L3 adds network logs and system telemetry for sensitive workloads. Critical alerts can pause a workload automatically, and where paging is enabled, top-priority alerts reach a human in about 15 minutes.
The headline test is a replay of the Hugging Face incident, which began inside internal cybersecurity evaluations that monitors did not cover at the time. With the strengthened stack, the simulation alerted security about 30 minutes after the agents escaped their sandbox, more than 30 hours before Hugging Face’s systems were breached in the real event. A live case is more convincing: on September 20, a model reached the open internet from a supposedly isolated training environment because of insufficient DNS filtering. Monitors flagged it within 15 minutes, a responder started three minutes later, and OpenAI paused frontier reinforcement learning.
To its credit, OpenAI published the gaps too. METR red-teamed the system for three weeks in July and August and found two client-controllable headers that could switch off monitoring for new agents. METR estimated 75% to 94% of agentic internal Responses API traffic from models at least as capable as GPT-5.5 was eligible for monitoring. A compaction bug left roughly 10% of eligible internal Codex traffic unmonitored between May and July. External coverage reaches only tool-using Responses API requests with conversation tracking, not Chat Completions, and does not routinely escalate to OpenAI staff.
Read it with the timeline in mind: the monitoring did not exist where the incident actually happened, and the 30-hour figure is a simulation of a system that has been changed since. The September catch is the real evidence. Even so, this is the most specific public account any lab has given of how it watches its own training runs, and that is worth more than another safety framework PDF.
Anthropic ships Claude mobile update with multi-account, CarPlay, and 33 languages
Claude’s mobile apps just got a solid round of updates. Here’s what changed and why it matters.
- Multi-account switching on iOS and Android: stay logged into multiple accounts and flip between them without signing out.
- iPad split view: whatever Claude creates now opens beside the chat, not on top of it. Tap to go full screen when you need a closer look.
- 33 languages total: Bengali, Swahili, Thai, Turkish, Ukrainian, Vietnamese, and more are now supported across all platforms.
- CarPlay voice mode on iPhone: ask Claude questions while driving, hands-free.
- Faster, smarter voice: responds quicker, handles noisy environments better, and now runs on more Android phones.
- Chromebook and foldable support: resizable sidebar, trackpad, right-click, and keyboard shortcuts, just like the desktop app.
Coming soon: pull-down search on iPhone and iPad to find past chats, projects, or settings instantly.
OpenAI gives Pro and Business users up to $500 monthly in free API credits
OpenAI just made your ChatGPT subscription pull double duty. Pro and Business subscribers can now claim free API credits every month, meaning you can build real apps without paying extra.
Think of the API like a direct line to OpenAI’s models that you control from your own code. These credits let you call that line for free each month.
Here is how the credits break down:
- Pro $100/$200/$500 plans each get matching credits (pay $200, get $200 in API credits)
- Business Standard seats get $20 each, Premium seats get $100 each, pooled up to $500 per workspace
- Credits expire at end of each billing cycle and do not roll over
To claim: go to ChatGPT billing settings, find the API credits benefit, and link it to an API organization you own. You also need Owner permissions on that API org.
You can use credits on agents, images, and live API features. Small teams get real value here.
NVIDIA releases open-weight speech model that tops ASR leaderboards with 4B active parameters
NVIDIA just dropped Nemotron 3.5 Transcribe, and it just took the top spot among open-weight speech models. Here’s why it matters.
Most transcription setups make you stitch together separate tools: one for transcription, one for translation, one to figure out who’s speaking. Nemotron collapses all of that into a single model you can download and run yourself.
- Transcribes audio in 40 languages, handles recordings up to 1 hour long
- Tells apart up to 8 speakers in a conversation automatically
- Translates 31 languages to or from English
- You can prompt it: “redact PII” or “add speaker labels” in plain text
- Ranked #1 open-weight model on Hugging Face Open ASR Leaderboard at 5.33% word error rate
The efficiency angle is real: it runs on roughly 4B active parameters despite being a 30B model, matching accuracy of a 24B competitor at one-sixth the compute cost.
It’s free, open-weight, and commercially usable. Grab it on Hugging Face.