The stories that matter
Top line
Story 1 of 3
Chrome 156 fixes a Critical flaw, and a Mac sandbox escape now has a public exploit
On Oct 29, Google released Chrome 156.0.8078.79/.80 for Windows and Mac and 156.0.8078.79 for Linux, with 21 security fixes. One is Critical: CVE-2026-76024, memory corruption in MediaStream. Nineteen more are rated High. On Oct 30, PWN.AI published a write-up and proof of concept for CVE-2026-106378, a sandbox escape in Chrome on macOS that Google fixed on Oct 6 in 155.0.8059.39. Chromium rates it Medium, and NVD lists it at CVSS 8.3 (High). The attack starts from a renderer that is already compromised. Neither CVE is on CISA's Known Exploited Vulnerabilities list, and Google hasn't reported exploitation in the wild.
Story 2 of 3
Claude renamed its top plans and removed the 5-hour limit on Ultra
On Friday at 12:29 PM CT, Max 5x became Max ($100/mo) and Max 20x became Ultra ($200/mo). Starting Oct 30, verified Ultra accounts no longer have the 5-hour session limit. They keep a weekly limit of 10x Pro, and Fable has its own separate weekly limit. Unverified accounts get a temporary limit until Claude automatically verifies them based on account and payment history. If Settings > Usage shows no "Current session" bar, the account is verified.
Story 3 of 3
Fast mode for Claude Opus 4.8 will be removed Nov 30
Anthropic deprecated fast mode for Claude Opus 4.8 on Oct 30 and will remove it on Nov 30, 2026. After that, requests to
claude-opus-4-8withspeed: "fast"will return an error. Anthropic recommends moving to Claude Opus 5.5.
Action checklist
What to do
- Update Chrome to 156.0.8078.79 or later. Push the update to every endpoint and force a relaunch. Update Edge and other Chromium-based browsers once their vendors ship builds based on Chromium 156.
- Check Claude seat verification. On Max and Ultra accounts, open Settings > Usage. A "Current session" bar means the account isn't verified yet and still has a temporary limit.
- Find Opus 4.8 fast-mode calls. Search code and configs for
claude-opus-4-8withspeed: "fast"and move them to Opus 5.5 before Nov 30. - Patch agent tooling. Update TAKO AI Agent for Okta to 3.0.1-beta, PraisonAI to 4.6.78 and Crawl4AI to 0.9.5.
Briefly
Also notable
Gemini API Computer Use is GA. Google made the Computer Use tool generally available in the Interactions and GenerateContent APIs. Gemini API changelog
GitHub incidents. On Friday, a burst of errors hit numerous services from 9:21 to 9:30 AM CT. Separately, Actions, Pages and Webhooks had delays and code search had errors from 12:50 to 2:23 PM CT, and Dependabot alerts had errors from 3:59 to 6:29 PM CT. StatusStatusStatus
GPT-6 Rosalind. OpenAI released a model for biological reasoning and scientific tool use, available only to orgs approved for its Rosalind Research trusted-access program. OpenAI API changelog
OpenAI Private Intelligence. OpenAI highlighted zero data retention for eligible API workflows and a Private Inference preview built on confidential computing, with no pricing or GA date yet. @OpenAIOpenAI
OpenAI Agents API. New Auto Review checks commands before they run, and Async Compaction was added too. @OpenAIDevs
AWS GovCloud. Bedrock in GovCloud (US) now serves OpenAI GPT-5.6 (Terra, Luna), and Daybreak Red (GPT-5.6 Cyber) is available to eligible customers in GovCloud (US-East). AWSAWS
Microsoft Mage-VL-Cowork. Microsoft released a 4B Apache-2.0 open model for GUI and terminal computer use, and reports 66.0% on OSWorld-Verified. Hugging Face
Clover-35B-A3B-Preview. China's DiffuSpace open-sourced an Apache-licensed MoE diffusion language model with 35B total and 3B active parameters. It runs on SGLang and llama.cpp. HF blog
TAKO AI Agent for Okta flaw. Before 3.0.1-beta, any authenticated user could run Python as root (CVE-2026-63378, CVSS 8.8). AI Sec Watch
UK regulators on AI agents. The CMA, FCA, ICO and Ofcom published a joint statement on how existing rules apply to personal AI agents. DRCF
OpenAI incidents. Elevated errors in GPT Image 2 API edits were resolved at 1:36 PM CT, and search errors in Dots/ChatGPT Work were resolved at 4:14 PM CT. StatusStatus