October 2026
All articles published in October 2026 on Solo Operator Stack.
Five Big Tech Companies Spent $556.9 Billion on Capex Against $542.9 Billion of Operating Cash Flow. The API You Build On Is Downstream of That. Here's the Margin Rule I'd Use.
For the first time in data back to 2011, the five biggest AI spenders put more into capex than they earned in cash. What that does and does not tell a solo builder about future model prices.
A Fake Claude Code Extension Sat in Cursor's Marketplace for 11 Hours. Uninstalling It Does Not Remove the Backdoor. Here's the 3-Minute Check.
Version 2.1.313 of the Claude Code extension was not built by Anthropic and planted an SSH key on developer machines. Here is the check, the cleanup, and the habit that would have limited the damage.
Claude's $200 Plan Is Now Called Ultra and Drops the 5-Hour Limit for Verified Accounts. Nobody Has Defined 'Verified.' Here's the Two-Week Test Before You Upgrade.
Max 5x became Max, Max 20x became Ultra, and prices did not change. What did change is the one limit solo builders hit most, and the rollout rules are vague.
Node.js 26 Became LTS on October 28 With Temporal On by Default. Node 22 Stops Getting Security Fixes April 30, 2027. Here's the Upgrade Order for a One-Person Stack.
The LTS label changes your support clock, not your code. Here are the dates, the four breaking changes that actually bite, and which Node line to run depending on where you are today.
OpenAI, Google, Microsoft and Anthropic Back One robots.txt Token for AI Training. Only Anthropic Honors It Today. Here's the Three-Line Decision for Your Site.
A single robots.txt token now covers AI training opt-outs across four major labs, but it is an individual draft, it ignores search and retrieval, and Google and Microsoft are not honoring it until 2027.
Claude's API Now Takes 128 MB Requests, Up From 32 MB. Bedrock Still Caps at 20 MB. Check Which Number Your Code Actually Hits.
A bigger request limit only helps if every hop on your route honors it. Here are the ceilings across Anthropic's own API and its partner platforms, and the three code changes I'd make before sending big PDFs.
Deepgram Bought Daily, the Company Behind Pipecat. The BSD License Protects the Code. It Doesn't Protect Your Roadmap.
The most widely used open-source voice agent framework now has a parent that sells speech models. The promises are good, but a solo builder should structure the stack so those promises never have to be tested.
Five AI Coding Tools Have a Browser You Never Audited. Three Can Be Made to Read Your SSH Keys, and Two Are Still Unpatched.
Forever Security's EMBRACE research found the built-in browsers in Cursor, Copilot, Codex, VS Code and Claude Desktop break basic browser rules. Here is the ten-minute key-isolation checklist I would run before the next repo you clone.
Microsoft Booked $10 Billion From OpenAI in One Quarter, About 11% of Its Revenue. Read It as a Concentration Risk Lesson for Your Own Customer List.
Microsoft's latest filing shows how tightly it and OpenAI are tied, with receivables climbing too. A one-person business has the same problem at a smaller scale, and a simple rule for handling it.
OpenAI Canceled the Pro 200 Cut and Doubled Codex Limits. Don't Build Your Workflow on a Quota That Changes by Press Release.
A planned 50% cut to the $200 plan was reversed after backlash, and Pro limits doubled on October 29. Good week for subscribers. The lesson is about the weeks before it, and what a solo operator should price in.
Cursor Made Its Agent SDK Generally Available. An Agent Is a Markdown Prompt, TypeScript Tools and One Node Process You Can Put in a Container. Here Is the First One a Solo Dev Should Build.
The SDK behind Cursor's own review agents is now generally available, with PR triggers, built-in evals and a self-host path. The announcement does not mention pricing, so the first agent should be small and cheap to throw away.
A New Benchmark Gave Agents 50 Real Tax Assignments. Claude Sonnet 5.5 Passed 10.8% of Them. Here Is What I Would Hand an Agent in My Books and What I Would Not.
Surge AI's Dayjob: Tax tested frontier agents on 50 professional tax tasks with a 95% rubric bar. The best Claude score on the page was 10.8%, and the failures are exactly the kind that cost a solo operator money quietly.
Apple Blocked the Compromised eMudhra Certificates in Safari on October 19. The git and curl That Ship With macOS Still Trust Them. Here Is the 15-Minute Checklist.
Eight certificate authority keys could be guessed in at most 256 tries. Browsers blocked them within days, but command-line tools, containers and language runtimes need their own fixes, and a solo operator is the only one who will apply them.
A Fingerprinting Script Hides Fake Bioweapon Recipes to Make AI Models Refuse to Deobfuscate It. Astra Refused and GLM-5.3 Did Not. Here Is How I Would Review Third-Party Scripts Now.
A researcher crawling 10,000 sites found obfuscated code stuffed with decoy strings meant to trigger AI safety refusals. If you let a model tell you whether a script is safe, a refusal is now a signal and a clean answer is not a verdict.
Google Announced Gemini 4 Carbon at #1 on the New Index. There Is No Public API Yet, and Argon's Price Goes Up on December 1. Plan Margins on the Model You Can Actually Call.
Carbon scores 59 on Artificial Analysis Index v5, one point ahead of Claude Opus 5.5, but access is limited to selected security defenders. The model solo builders can call today is about to get more expensive.
Apple's M6 MacBook Pro Starts at $1,999 and Is Mostly a Chip Bump. If You Own an M5, Keep Your Money.
Twelve CPU cores instead of ten, memory bandwidth up to 170GB/s, and the same starting price. Apple's own claim is 25% faster AI work. For most one-person shops that is a reason to wait, not to buy.
Cloudflare Workers AI Leaked Other Customers' Data Into 155 Responses Over Two Weeks. The Bug Only Fired on Prompts Above 681,280 Tokens.
A model with a 1,048,576-token context window and a cache pool of 681,280 tokens is a config mismatch that put one customer's data into another customer's answer. Here is what a solo builder can do about it.
GPT-6.1 Terra Costs $1 In and $5 Out per Million Tokens, Half of Sol. Here Is the Routing Rule I Would Put in Front of It This Week.
OpenAI shipped a half-price model on October 26 and still tells you to use the flagship for hard coding. The saving is real only if you know which requests can drop a tier.
Follow-up: A Working Node.js Brotli Exploit Now Runs on the Official Node 24.22.0 Image. Check Your Docker Tags, Not Just Your Laptop.
Imperva's Node2Shell proof of concept moves the Brotli bug from a crash on a standard build to code execution on an official image. The fix is a patched Node binary, and for most solo deploys that binary lives inside a container you have not rebuilt.
A Researcher Published 11 Tailscale Findings Before Tailscale Had a Patch. The Fix Landed in 1.104.4 a Day Later. Here Is What a Solo Operator Should Check.
The Tailworm report says SSH port forwarding through Tailscale SSH could reach root. Tailscale confirmed the issues are serious and shipped a fix within days. The update takes one command, and the rule cleanup takes ten minutes.
Apple Says App Review Averages 1.5 Days. Developers Report New Apps Waiting Weeks. Plan Your Launch Around the Second Number.
Apple processed 378,000 submissions a week and says the average review takes 1.5 days. Developers say the delays sit in new apps and resubmissions, which is exactly where a solo launch lives.
Eight LLM Price Moves in Nine Weeks, Up to 80% Each. Stop Prepaying for Tokens and Build the Swap Layer Instead.
Between July 30 and September 29, OpenAI and Anthropic repriced their models eight times. If you prepaid or committed annually in August, you probably bought at the top.
Kimi K3.1 Pro Scores 65.7% on Terminal-Bench 4.0, 0.7 Points Behind Opus 5.5, and the Weights Land by November 4. Here's What to Test Before You Care.
Moonshot's open-weight model nearly matches the best closed coding model on a benchmark I told you not to trust. The license and the hosting price decide whether it matters to you.
Node.js Patched a Brotli Remote Code Execution Flaw on October 21. If Your Server Decompresses Anything, Check Your Version Before Lunch.
A bug in Node's bundled Brotli decoder allows remote code execution, and the fix shipped in 26.12.1, 24.22.1 and 22.23.4. There is no workaround, and older lines get no patch at all.
A 10-Year-Old CNN Beat GPT-6 Astra and Claude Fable 5.1 at Diagnosing Skin Lesions, 62% to 42%. The Lesson for Your Product Is Not About Medicine.
A dermatologist's small test pitted an old image classifier against two frontier LLMs on 200 biopsy-proven lesions. The caveats matter as much as the headline, and both point at how to build AI features.
The Agent Break-Even Rule Fits on a Napkin: The Odds It Succeeds Must Beat Your Check Time Divided by Your Do Time. Run It Before You Delegate Anything.
One inequality from a McKinsey Quarterly footnote tells you whether an agent is saving you time or just moving your work into review. I ran it on five typical solo-operator tasks with stated assumptions.
Anthropic Shipped Claude Duet, an Agent That Checks Your Apps Every Few Hours and Acts for You. Here's What It Replaces in a Solo Operator's Week.
Duet runs on its own virtual machine, connects to 6,000+ connectors, and can buy things with a virtual card. It is a waitlist preview for US Pro and Max, and the approval gates matter more than the feature list.
Meta's New Business Terms Take Effect October 30 and Let It Crawl Your Website. After Backlash It Dropped One Word, and the Crawl Right Stayed.
If you run ads, a Page, or any Meta business tool, the new commercial terms authorize crawlers on the domains tied to your account. Here's the robots.txt change to make before October 30 and what it won't protect.
OpenCode's Console Breach Hit 1.4% of Users and Ran Up $1,000+ Bills on Their AI Keys. Here's the Key-Storage Rule That Would Have Capped It.
Attackers broke into an older OpenCode Console system and spent users' OpenAI, Anthropic, and Google credits overnight. The fix for a solo builder takes ten minutes and starts with where you paste your keys.
A Reviewer Audited Terminal-Bench 4: 60 of 65 Tasks Had Problems and 44 Could Be Passed by Cheating. Stop Picking Your Coding Agent by Leaderboard.
Preference Model's audit found that the benchmark behind many coding-agent rankings has tasks you can pass without doing the work and tasks that fail honest work. Here's a 30-minute test on your own repo that beats it.
GitLab Shipped a CVSS 10.0 Pre-Auth RCE Fix for Every Self-Managed Release Since 2014. Here's the Upgrade Order, and the Question It Raises.
CVE-2026-110264 is the second CVSS 10.0 GitLab bug in about ten days. If your forge lives on a cheap VPS, the real cost of self-hosting just showed up as a dropped Wednesday.
Mistral Large 4 Is a 1-Trillion-Parameter Model at $1.36 per Million Input Tokens, and the License Isn't Published Yet. Don't Rebuild Anything Until It Is.
Open weights are promised for the end of October, but a promise about files is not a promise about what you are allowed to do with them. Here is what a one-person AI product should and should not change.
OpenAI's Decisions API Went GA at $0.10 per Million Input Tokens. Here's When It Beats Jev and a Local Model, and When It Doesn't.
Decisions left beta on October 22 with a 400-question cap and prompt caching. The price is 2.4x Jev's input rate, so the premium has to buy you something specific.
PHP2Shell Hit Every PHP Since 5.4, and Exploit Attempts Started Four Days Before the Patch. Here's the 30-Minute Check for Your Servers.
Two unauthenticated RCE bugs in the PHP runtime itself were patched on October 21. Updating WordPress does not fix them, and the people who host client sites are the ones holding the exposure.
Walmart Opened a Gateway for Shopping Agents While Amazon Keeps Blocking Them. If You Sell Online, You Get to Pick Your Side First.
Walmart's Agent Gateway, announced October 21, lets AI agents buy within customer-set limits. Amazon stopped Meta's Muse agent in September. A small store should set its own agent policy before a platform sets it for them.
Anthropic's Leaked S-1 Shows an $80.7 Billion Loss. $72 Billion of It Is Non-Cash. Here's the Number a Solo Builder Should Actually Watch.
The Wall Street Journal's look at Anthropic's draft prospectus has a scary headline loss and a more important line underneath: hundreds of billions in compute commitments that don't flex with your usage.
DHS Banned DeepSeek From Federal Agencies, and the Order Follows the Model Into Anything Built On It. Here's the 20-Minute Audit If You Sell to Government.
The order is not a ban on private use, but its reach into third-party products turns your model list into a procurement question. Here's what to inventory before a buyer asks.
Gemini 4 Argon Doubles in Price on December 1. Model Your Margins at $4 and $20, Not at the Launch Rate.
Google's pricing page lists Gemini 4 Argon at $2 and $10 per million tokens through November 30, then $4 and $20. Every tier doubles, so the promo is a trial, not a price.
OpenAI's 12-Hour Prompt Cache Costs 2.5x to Write. Here's the Three-Request Break-Even for Your Agent.
OpenAI now lets you keep a prompt cached for 12 hours, but the write costs 2.5 times the normal input rate. The arithmetic says it loses money on two calls and wins on three.
Vercel Stopped Accepting Node.js 20 Deployments on October 1. Your Next Deploy Is the One That Fails, and Here's the 10-Minute Audit.
Running functions keep running, which is why nobody noticed. The next push to a project pinned to Node 20 errors out, and GitHub Actions already dropped Node 20 on September 23.
An Attacker Pointed AI Agents at 105 Online Retailers for About $25 a Target. Here's What Your Small Store Should Assume Now.
Gambit says a financially motivated operator compromised at least 27 companies with open-source AI agents and a few thousand dollars of API credit. The price of an attack just dropped below the value of your store.
Anthropic's Junior Share of Technical Hires Fell From 27% to 9%. If You Build Alone, You Are Your Own Junior. Here's How to Train Yourself.
Anthropic's own report shows juniors shrinking as agent hours pass human hours. The report doesn't prove AI caused it, but it points at the skill a solo builder can't skip: review.
Claude Haiku 5.5 Costs One Tenth of Haiku 4.5. Here's the Margin Math for Every AI Feature You Decided Was Too Expensive.
At $0.10 in and $0.50 out per million tokens, Haiku 5.5 turns a $165 monthly bill into $16.50. The interesting part is which features that unlocks.
Deno Just Joined Cloudflare. Deno Deploy Shuts Down in Six Months and the Runtime Has One Year Left. Here's the Exit Plan.
Cloudflare took the Deno team on October 9. Deploy closes in six months, the runtime gets about a year of fixes, and solo builders on either one need a plan now.
Next.js 16.4 Recommends Cache Components for Every App and Makes Them the Default in 17. ensureStatic Is the Part Solo Developers Should Care About.
Vercel's October 6 release adds a way to fail your build when a dynamic component sneaks into a page you wanted static. For solo hosting bills, that matters more than the new caching model.