Cairn AI Agent Hacking Campaign | AI Field Notes #121

AnalysisAbout $50 in AI tokens per successful break-in is the figure security teams will remember. The security firm NorForge reported on October 19 that a Chinese-speaking attacker has used Cairn, an open-source platform where AI agents share a findings board and chase a goal, against more than 1,200 sites since September 25. More than 100 companies were breached, Reuters reported, including web properties of Deere, SharkNinja and Cummins, though how much data left is unclear. A successful intrusion took about 23 hours. The worker name in the logs, claudecode_deepseek-v4.1-flash, points to Claude Code driving DeepSeek's cheap model. The attacker got caught by leaving the control panels open online.

AnalysisBond traders are now pricing CoreWeave, the GPU cloud that rents Nvidia chips to AI labs, like a borrower that might not pay them back. Its corporate bonds fell into what markets call distressed territory, yields at least 10 percentage points above comparable government debt, as rate fears hit AI infrastructure, The Verge reported on October 19. The shares fell too. Insiders, including the CEO and related entities, have sold close to $1 billion of stock since the 2025 IPO, Tech in Asia reported. The GPUs are still rented out. The open question is whether today's rental prices cover the debt that bought them.

AnalysisA grid connection pushed into the 2030s has cost a UK data center its anchor tenant. Microsoft has pulled out of Nscale's planned campus in Loughton, Essex, where it was to lease 23,000 Nvidia AI chips, The Telegraph reported on October 18. Grid operators had reportedly told Nscale the site may not connect until the next decade. Nscale filed in September to list on the NYSE, and its filing shows Microsoft and Anthropic account for about 85% of a $103 billion backlog. Loughton was a showpiece of Microsoft's £22 billion UK pledge. An IPO pitched on two customers just lost one site's worth of the first.

AnalysisFive percent of Anthropic's shares, plus 2 more percentage points for every 50% rise in company value above an undisclosed baseline, will go to a new Anthropic Public Benefit Fund announced on October 18, subject to stockholder approval. Counting the co-founders' pledge to give away 80% of their equity and an employee donation match, the lab says about 20% of its shares are now earmarked for public good. The fund is a wholly owned LLC, set up that way to allow direct payments to specific groups, and it may go further on job losses than the $200 million already committed there. The baseline that triggers the extra shares stays private.

AnalysisChoosing to raise money over selling to Intel or Qualcomm has more than doubled Tenstorrent's price. The chip company run by Jim Keller, who designed Apple's A4 and AMD's Zen, closed a $1.5 billion Series E on October 19 at a $6.2 billion valuation, up from $2.6 billion in 2024; Bloomberg had reported takeover talks with both suitors in May. The money goes to Galaxy servers that run open-weight models and to chip designs it licenses to Samsung and LG. Everything runs on RISC-V, an open chip instruction set with no royalties, and the software is open source. Keller says he will take orders too small for the larger rivals.

AnalysisCOBOL, the 1959 language still running bank ledgers and payroll, went from a 10.9% test pass rate to 72.1% in one model generation on OpenAI's new MultiLangBench, published October 19. The benchmark grades models on 20 programming languages that have little public code to learn from, and GPT-6 Astra averaged 87.4% against 26.8% for GPT-5.6 Sol. OpenAI paired it with evaluations for building SQLite (the small database inside most phones) and for migrating enterprise COBOL. Scarce-language skills have been priced like rare metals. A lab grading its own model on its own test deserves a raised eyebrow, but a jump this size is hard to wave away.

AnalysisOne of Anthropic's top five customers, by its own CEO's count, has moved its flagship product to a rival. Replit's Amjad Masad said at TechCrunch Disrupt on October 16 that the company no longer works with Anthropic, citing cost, partnership and performance on Replit's internal benchmark. Within hours he softened it: Replit stays model agnostic, users can still pick Claude, and OpenAI is the preferred partner powering Replit Agent. Masad also said enterprise contracts make up about 15% of revenue this year, up from 2% in 2025. A coding tool's default model has become a line in a procurement spreadsheet, and it can flip within a quarter.

AnalysisTens to twenties of attempts a week is how often Charles Schwab stops big AI agents, Meta's Muse among them, from moving client money, CEO Rick Wurster told Bloomberg Television on October 16. His worry is liability once a client hands an agent a password. JPMorgan's Jamie Dimon said on the bank's October 13 earnings call that outside agents will not act inside its systems. Yelp and Delta are blocking agents from OpenAI, Meta and Google, The Verge reported October 17, and Yelp wants agents to pay for its data. Schwab is offering read-only MCP servers (model context protocol, how agents plug into tools). Agents may look at the money.

AnalysisEleven points on Terminal-Bench 4.0 (a test of whether a model can finish real command-line tasks), from 31.2 to 42.3, is what DeepSeek calls a minor update. DeepSeek-V4.1-Flash-1017 shipped October 17 with open weights on Hugging Face under the MIT license (free to use commercially): 763 billion parameters and a 1-million-token context window. ProgramBench rose from 20.3 to 29.1. DeepSeek also priced its Search and Fetch APIs at $0.75 per 1,000 calls each, free through Claude Code, Codex or its own harness until October 31. V4.1 Flash is also the model named in the Cairn attacker's worker logs this week.

AnalysisGoogle has put a checkpoint in front of its AI slide maker. Gemini Notebook, the tool formerly called NotebookLM, now lets people read and edit an outline before it builds a slide deck, or producer notes before a video overview, per an October 19 post that rolls the feature to all users worldwide over the coming week. Requests like adding an executive summary or reordering scenes go in before anything renders, and a toggle skips the step. Every rejected video is wasted compute, so an outline someone approves saves Google money as well as the user's afternoon. Plan-then-execute keeps spreading from coding agents into office tools.

AnalysisA frontier AI lab has drafted the rules it would like to be policed by. Anthropic has privately pitched lawmakers a federal bill, Politico reported on October 16. Outside evaluators would register with the Commerce Department, review frontier labs, and report any imminent risk within 72 hours of finishing an assessment. Commerce could then ask a federal judge in Washington, DC to suspend a model, only in extreme cases: foreseeable damage above $1 billion or more than 50 deaths or serious injuries from bioweapons, cyberattacks, or a model escaping control. The bill would also override some state AI laws. The company writing the off switch also picked where it trips.

AnalysisAsked on the Sources podcast whether OpenAI will build a humanoid robot, Sam Altman answered "We will," Engadget reported on October 17. His reasoning was that "the world is very much designed for people," so a body shaped like one fits it. He told Fortune in September to expect "a cool demo in 2027" and no robots walking the streets for a few years after. OpenAI lists 27 robotics openings and has not said what the demo will show. Altman says the hard part is the brain, which happens to be the part OpenAI already sells. Every other humanoid maker now competes with a company that owns its own model.