Archon AI agent's control API has no auth: 9.8 RCE, no patch yet
0.2.13–0.11.1 bind to 0.0.0.0 in bypassPermissions mode, so any network attacker gets a shell. Plus: Microsoft's 2.8T base, FTC demands, cheaper ChatGPT ads.
Copy markdown
Any network user can run commands as you
CVE-2026-111322 (CVSS 9.8): Archon ≥0.2.13 through 0.11.1 exposes its /api/* control API on 0.0.0.0 with no authentication, and the coding agent behind it runs in bypassPermissions. An unauthenticated attacker on your network can hand it instructions and get arbitrary command execution as the Archon user. No fixed version yet — firewall the port or rebind it to 127.0.0.1 before your next session.
Microsoft trained a 2.8T base from scratch
MAI-Base-2 is a 2.8T-parameter MoE (80B active) trained on 50T tokens, with Microsoft claiming 4–12x better pre-training FLOPs efficiency than DeepSeek-V4-Pro-Base. There's nothing to run today — it's still in post-training and goes only to trusted Foundry partners, not open weights — but it's the clearest signal yet that Microsoft is building frontier base models without leaning on OpenAI.
The FTC wants OpenAI and Anthropic's receipts
The FTC reportedly sent civil investigative demands to OpenAI and Anthropic covering security incidents, safeguards, and marketing claims. Your API keys keep working, but formal probes tend to reshape how labs ship and how aggressively they market — worth tracking if your product sits on top of either.
ChatGPT ads get cheaper, aimed at SMBs
Per The Information, OpenAI reportedly cut published ChatGPT ad rates and is courting small and midsize businesses — a sign that ads are becoming a permanent fixture of the ChatGPT surface you and your users rely on. Exact rates stay behind the paywall.