{
  "schema_version": 1.1,
  "generated_at": "2026-10-17T04:30:36.075Z",
  "channel": null,
  "channel_label": null,
  "public": null,
  "count": 139,
  "contract": "https://radar.trulysovereign.com/docs/feed",
  "items": [
    {
      "id": "b676f683-8a97-43d0-ba23-113c8c06c1e7",
      "channel": "ai_platform_drift",
      "headline": "GitHub Copilot in Slack/Teams adds issue creation and PR opening",
      "what_changed": "GitHub Copilot's Slack and Teams integration now creates issues and opens pull requests directly from chat. The bot was renamed from 'GitHub Copilot' to '@GitHub'. New capabilities include '@GitHub Create an issue in github/issues to track this bug' and '@GitHub Fix this bug in our frontend repository and open a PR with the changes.' Previous examples focused on read-only operations like tracking PRs and summarizing activity.",
      "why_matters": "The integration now writes to repositories, not just reads from them. Any team using this bot in Slack or Teams needs to verify that its repository permissions align with the new write capabilities, particularly for issue creation and PR opening. The rename from 'GitHub Copilot' to '@GitHub' may break existing slash commands or automation that references the old name.",
      "what_to_do": "Check the bot's installed permissions in your GitHub organization settings and confirm they match your policy for automated issue creation and PR opening. Update any documentation, runbooks, or scripts that reference 'GitHub Copilot' in Slack/Teams to use '@GitHub' instead.",
      "severity": "worth_knowing",
      "action_type": "verify_only",
      "tags": [
        "api"
      ],
      "confidence": 0.85,
      "source_name": "GitHub Copilot changelog",
      "source_url": "https://github.blog/changelog/2026-10-15-copilot-in-slack-and-teams-adds-model-and-repository-updates",
      "published_at": "2026-10-17T04:30:11.546456+00:00",
      "corrected_at": null,
      "correction": null,
      "correction_cause": null,
      "url": "https://radar.trulysovereign.com/items/b676f683-8a97-43d0-ba23-113c8c06c1e7",
      "affects": [
        {
          "id": "github-copilot",
          "type": "product",
          "label": "github copilot",
          "unmapped": true
        }
      ],
      "action_due": null,
      "time_to_correct": null
    },
    {
      "id": "a543b960-4f00-45ae-912f-47bb93ee2142",
      "channel": "ai_platform_drift",
      "headline": "Claude Code v2.1.302 changes fork subagent defaults and adds December 14 Design closure notice",
      "what_changed": "Claude Code v2.1.302 enables fork subagents by default across all interfaces (claude -p, Agent SDK, desktop app, VS Code) and forces background execution for main conversation subagents in desktop and VS Code. The release adds a notice that standalone Claude Design (claude.ai/design) closes December 14, 2026. It also limits prompt and agent hooks to 12 concurrent executions, fixes a memory exhaustion vulnerability where image files over 128 MB were loaded entirely into memory, and adds CLAUDE_CODE_AUTO_MODE_MODEL environment variable for client-side auto mode classifier model selection.",
      "why_matters": "Fork subagents being on by default changes execution behavior for existing integrations that relied on the previous default. The 12-hook concurrency limit will queue or delay hook executions in systems running more than 12 simultaneously. The image file size limit prevents a class of memory exhaustion attacks but will break workflows that process large image files. The Design closure date is a hard cutoff for any workflows depending on that standalone interface.",
      "what_to_do": "Set CLAUDE_CODE_FORK_SUBAGENT=0 if your integration requires the old subagent behavior. Audit any prompt or agent hook implementations that assume unlimited concurrency. Check for workflows processing image files over 128 MB and handle the new refusal. If you use standalone Claude Design, migrate to the integrated design features before December 14, 2026.",
      "severity": "action_needed",
      "action_type": "migrate",
      "tags": [
        "api",
        "security",
        "deprecation"
      ],
      "confidence": 0.85,
      "source_name": "Claude Code releases",
      "source_url": "https://github.com/anthropics/claude-code/releases/tag/v2.1.302",
      "published_at": "2026-10-17T04:29:37.823887+00:00",
      "corrected_at": null,
      "correction": null,
      "correction_cause": null,
      "url": "https://radar.trulysovereign.com/items/a543b960-4f00-45ae-912f-47bb93ee2142",
      "affects": [
        {
          "id": "claude-code",
          "type": "product",
          "label": "claude code"
        },
        {
          "id": "claude-design",
          "type": "product",
          "label": "claude design"
        },
        {
          "id": "anthropic",
          "type": "provider",
          "label": "anthropic"
        }
      ],
      "action_due": "2026-12-14",
      "time_to_correct": null
    },
    {
      "id": "c2583dc0-a3e4-4f87-805e-ec2c2f13fa11",
      "channel": "security_advisory",
      "headline": "FreeRTOS-Plus-TCP ≤V4.4.1 vulnerable to IPv6 RA spoofing and DNS cache poisoning",
      "what_changed": "AWS disclosed CVE-2026-102551 and CVE-2026-102552 in FreeRTOS-Plus-TCP versions V4.4.1 and earlier on 16 October 2026. CVE-2026-102551 allows remote attackers to manipulate IPv6 gateway and routing configuration via spoofed Router Advertisements; the vulnerability is reachable in default configuration where ipconfigUSE_IPv6 and ipconfigUSE_RA are both enabled. CVE-2026-102552 allows remote attackers to poison the DNS cache by injecting replies from sources other than the queried server.",
      "why_matters": "Both vulnerabilities enable traffic interception and redirection on embedded and IoT devices running FreeRTOS-Plus-TCP. The IPv6 issue is exploitable in default configuration without requiring local network access. Devices using this stack for AWS IoT connectivity or edge services are exposed to man-in-the-middle attacks that can redirect traffic to attacker-controlled infrastructure.",
      "what_to_do": "Inventory all embedded and IoT devices running FreeRTOS-Plus-TCP to identify those on V4.4.1 or earlier. Check AWS Security Bulletin 2026-139-AWS for patch availability and apply updates to affected devices. If immediate patching is not feasible, disable IPv6 RA processing by setting ipconfigUSE_RA to 0 as a temporary mitigation for CVE-2026-102551.",
      "severity": "action_needed",
      "action_type": "verify_exposure",
      "tags": [
        "security",
        "api"
      ],
      "confidence": 0.95,
      "source_name": "AWS security bulletins",
      "source_url": "https://aws.amazon.com/security/security-bulletins/rss/2026-139-aws/",
      "published_at": "2026-10-17T04:29:21.544777+00:00",
      "corrected_at": null,
      "correction": null,
      "correction_cause": null,
      "url": "https://radar.trulysovereign.com/items/c2583dc0-a3e4-4f87-805e-ec2c2f13fa11",
      "affects": [
        {
          "id": "cve-2026-102551",
          "type": "cve",
          "label": "CVE-2026-102551"
        },
        {
          "id": "cve-2026-102552",
          "type": "cve",
          "label": "CVE-2026-102552"
        },
        {
          "id": "freertos-plus-tcp",
          "type": "package",
          "label": "FreeRTOS-Plus-TCP",
          "unmapped": true
        },
        {
          "id": "aws",
          "type": "provider",
          "label": "aws"
        }
      ],
      "action_due": null,
      "time_to_correct": null
    },
    {
      "id": "b22c4c5b-643b-4da1-82f9-6f1897a0dbc9",
      "channel": "security_advisory",
      "headline": "BeyondTrust Remote Support authentication bypass added to CISA KEV",
      "what_changed": "CISA added CVE-2026-102764 to the Known Exploited Vulnerabilities catalog on 16 October 2026. The vulnerability is an authentication bypass by spoofing in BeyondTrust Remote Support. Due date for federal agencies is 19 October 2026.",
      "why_matters": "This is remote access software with active exploitation and a three-day compliance window. An authentication bypass in this category means an attacker can gain the access your support staff has — to endpoints, to sessions, to whatever Remote Support reaches. If you run this product and it is internet-facing, you are in the window where exploitation is documented and the fix or mitigation must be live.",
      "what_to_do": "Check whether you run BeyondTrust Remote Support in any environment. If yes, apply the vendor's published mitigations immediately — CISA's required action references vendor instructions, so those exist. If the product is cloud-hosted, confirm the vendor has applied the mitigation. If you cannot mitigate by 19 October, take the service offline.",
      "severity": "action_needed",
      "action_type": "mitigate",
      "tags": [
        "security"
      ],
      "confidence": 0.95,
      "source_name": "CISA Known Exploited Vulnerabilities",
      "source_url": "https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json",
      "published_at": "2026-10-16T21:12:09.3678+00:00",
      "corrected_at": null,
      "correction": null,
      "correction_cause": null,
      "url": "https://radar.trulysovereign.com/items/b22c4c5b-643b-4da1-82f9-6f1897a0dbc9",
      "affects": [
        {
          "id": "cve-2026-102764",
          "type": "cve",
          "label": "CVE-2026-102764"
        },
        {
          "id": "beyondtrust-remote-support",
          "type": "product",
          "label": "BeyondTrust Remote Support",
          "unmapped": true
        }
      ],
      "action_due": "2026-10-19",
      "time_to_correct": null
    },
    {
      "id": "f36ee513-573a-4769-9960-c3e1b8720a3d",
      "channel": "security_advisory",
      "headline": "Fortinet path traversal vulnerability added to CISA KEV, patch due 19 October",
      "what_changed": "CISA added CVE-2025-61624 to the Known Exploited Vulnerabilities catalog on 16 October 2026. The vulnerability is a path traversal flaw affecting multiple Fortinet products. Federal agencies must apply mitigations by 19 October 2026 under BOD 26-04.",
      "why_matters": "Path traversal vulnerabilities allow attackers to access files outside intended directories, potentially exposing configuration files, credentials, or sensitive data. CISA only adds vulnerabilities to the KEV when active exploitation is confirmed in the wild. If you run affected Fortinet products with internet exposure, you are a target right now.",
      "what_to_do": "Check your Fortinet product inventory against the vendor advisory for CVE-2025-61624. If you are running an affected version, apply the vendor's mitigation instructions before 19 October. If no mitigation is available for your version, follow BOD 26-04 guidance to discontinue use or isolate the system from the internet.",
      "severity": "action_needed",
      "action_type": "mitigate",
      "tags": [
        "security",
        "api"
      ],
      "confidence": 0.95,
      "source_name": "CISA Known Exploited Vulnerabilities",
      "source_url": "https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json",
      "published_at": "2026-10-16T21:11:57.205611+00:00",
      "corrected_at": null,
      "correction": null,
      "correction_cause": null,
      "url": "https://radar.trulysovereign.com/items/f36ee513-573a-4769-9960-c3e1b8720a3d",
      "affects": [
        {
          "id": "cve-2025-61624",
          "type": "cve",
          "label": "CVE-2025-61624"
        },
        {
          "id": "fortinet",
          "type": "provider",
          "label": "fortinet",
          "unmapped": true
        }
      ],
      "action_due": "2026-10-19",
      "time_to_correct": null
    },
    {
      "id": "1e0aabba-5f5b-483a-83bd-699c552b0b93",
      "channel": "ai_platform_drift",
      "headline": "DeepSeek Flash completion price cut 3%, output limit reduced to 131K tokens",
      "what_changed": "OpenRouter's ~deepseek/deepseek-flash-latest model changed on 2026-10-16: captured completion base rate changed from $0.6633 to $0.6435 per 1M tokens, and max_completion_tokens dropped from 943,718 to 131,072 tokens.",
      "why_matters": "Requests generating more than 131,072 completion tokens will now fail or truncate. Using the captured base rates for ~deepseek/deepseek-flash-latest, 100M completion tokens per day cost $66.33 before and $64.35 after, excluding all other charges.",
      "what_to_do": "Grep your codebase for max_tokens or max_completion_tokens parameters set above 131,072 when calling this model, and reduce them to stay within the new limit.",
      "severity": "action_needed",
      "action_type": "verify_only",
      "tags": [
        "limits",
        "pricing",
        "model"
      ],
      "confidence": 0.95,
      "source_name": "OpenRouter model catalogue",
      "source_url": "https://openrouter.ai/api/v1/models",
      "published_at": "2026-10-16T21:11:42.146509+00:00",
      "corrected_at": null,
      "correction": null,
      "correction_cause": null,
      "url": "https://radar.trulysovereign.com/items/1e0aabba-5f5b-483a-83bd-699c552b0b93",
      "affects": [
        {
          "id": "deepseek/deepseek-flash-latest",
          "type": "model",
          "label": "~deepseek/deepseek-flash-latest",
          "unmapped": true
        }
      ],
      "action_due": null,
      "time_to_correct": null
    },
    {
      "id": "5f14d912-4b47-4c66-93f0-d81087bf4e04",
      "channel": "ai_platform_drift",
      "headline": "Cloudflare Workers Builds runtime defaults updated across Node.js, Python, Ruby, Go, Bun",
      "what_changed": "Cloudflare Workers Builds changed default runtime versions effective 14 October 2026: Node.js 24.18.0→24.21.0, Python 3.13.3→3.14.8, Ruby 3.4.7→3.4.11, Go 1.24.3→1.27.2, Bun 1.2.15→1.4.3, Yarn 4.9.1→4.18.1, pip 25.1.1→26.2.1, Poetry 2.0.7→2.1.4, uv 0.7.13→0.12.10. Projects without explicit version pinning now build with these newer versions. Override environment variables are now documented: NODE_VERSION, PYTHON_VERSION, RUBY_VERSION, GO_VERSION, BUN_VERSION, YARN_VERSION.",
      "why_matters": "Builds that relied on previous default versions may break if code or dependencies are incompatible with the newer runtimes. Python 3.13→3.14 and Go 1.24→1.27 are minor version jumps that can introduce breaking changes in language features or standard library behavior. Builds that worked yesterday may fail today without configuration changes.",
      "what_to_do": "Test your Workers builds immediately. If a build breaks or behaves differently, pin the previous version by setting the appropriate environment variable in your build configuration (e.g., PYTHON_VERSION=3.13.3, NODE_VERSION=24.18.0). Projects using .nvmrc, .node-version, .python-version, or .ruby-version files are unaffected and continue using their specified versions.",
      "severity": "action_needed",
      "action_type": "pin_or_freeze",
      "tags": [
        "api",
        "deprecation"
      ],
      "confidence": 0.85,
      "source_name": "Cloudflare developer changelog",
      "source_url": "https://developers.cloudflare.com/changelog/post/2026-10-14-workers-builds-default-tooling/",
      "published_at": "2026-10-16T16:42:44.94325+00:00",
      "corrected_at": null,
      "correction": null,
      "correction_cause": null,
      "url": "https://radar.trulysovereign.com/items/5f14d912-4b47-4c66-93f0-d81087bf4e04",
      "affects": [
        {
          "id": "cloudflare",
          "type": "provider",
          "label": "cloudflare",
          "unmapped": true
        },
        {
          "id": "workers-builds",
          "type": "product",
          "label": "workers builds",
          "unmapped": true
        }
      ],
      "action_due": null,
      "time_to_correct": null
    },
    {
      "id": "8208421b-f366-4144-9d5c-6029f9627df2",
      "channel": "ai_platform_drift",
      "headline": "Cloudflare Workers spans now include warning attributes for telemetry issues",
      "what_changed": "Workers Observability now adds two span attributes when non-fatal telemetry issues occur: cloudflare.warning.type (an identifier like span_data_limit_exceeded) and cloudflare.warning.message (human-readable explanation). When a span attribute exceeds the data limit, the Worker continues executing but the oversized attribute is dropped and the warning attributes are set.",
      "why_matters": "Oversized span attributes now fail silently with diagnostic metadata instead of being silently dropped without explanation. If you are recording large payloads or request bodies as span attributes, you will now see warnings identifying which attributes were rejected and why, making instrumentation problems visible.",
      "what_to_do": "Search your Workers code for ctx.tracing.enterSpan and span.setAttribute calls that record variable-length data like request bodies, webhook payloads, or user input. Check your observability dashboard for the new cloudflare.warning.type attribute to identify any existing spans hitting the data limit.",
      "severity": "worth_knowing",
      "action_type": "verify_only",
      "tags": [
        "api"
      ],
      "confidence": 0.85,
      "source_name": "Cloudflare developer changelog",
      "source_url": "https://developers.cloudflare.com/changelog/post/2026-07-07-warning-attributes/",
      "published_at": "2026-10-16T16:42:24.570745+00:00",
      "corrected_at": null,
      "correction": null,
      "correction_cause": null,
      "url": "https://radar.trulysovereign.com/items/8208421b-f366-4144-9d5c-6029f9627df2",
      "affects": [
        {
          "id": "workers-observability",
          "type": "product",
          "label": "workers observability",
          "unmapped": true
        }
      ],
      "action_due": null,
      "time_to_correct": null
    },
    {
      "id": "a59d3803-d3d9-4fb0-b9d7-6922d7e46c51",
      "channel": "ai_platform_drift",
      "headline": "Cloudflare Tunnel routes increased to 50,000, additional tunnels $4.50/month",
      "what_changed": "Cloudflare increased the default route limit per account from 1,000 to 50,000, effective 16 October 2026. Accounts can now purchase additional tunnels beyond the included 1,000 at $4.50 per tunnel per month through a new Tunnels for Platforms offering.",
      "why_matters": "If you hit the 1,000-route limit, you no longer need to request an increase or split across accounts. If you need more than 1,000 tunnels (for per-device or per-customer deployments), you can now scale within a single account, but each additional tunnel adds $4.50/month to your bill.",
      "what_to_do": "Check your current tunnel and route counts in Networking > Tunnels. If you are near 1,000 routes, the new limit gives you headroom. If you need more than 1,000 tunnels, calculate the cost impact at $4.50 per additional tunnel per month and update your infrastructure budget.",
      "severity": "worth_knowing",
      "action_type": "budget",
      "tags": [
        "limits",
        "pricing"
      ],
      "confidence": 0.95,
      "source_name": "Cloudflare developer changelog",
      "source_url": "https://developers.cloudflare.com/changelog/post/2026-10-16-tunnels-for-platforms-and-50k-routes/",
      "published_at": "2026-10-16T11:28:47.941409+00:00",
      "corrected_at": null,
      "correction": null,
      "correction_cause": null,
      "url": "https://radar.trulysovereign.com/items/a59d3803-d3d9-4fb0-b9d7-6922d7e46c51",
      "affects": [
        {
          "id": "cloudflare-tunnel",
          "type": "product",
          "label": "cloudflare tunnel",
          "unmapped": true
        }
      ],
      "action_due": null,
      "time_to_correct": null
    },
    {
      "id": "9b96c7d4-c132-4272-8292-1d58b6f245d4",
      "channel": "ai_platform_drift",
      "headline": "Cloudflare AI Search adds CJK keyword search via trigram tokenizer",
      "what_changed": "Cloudflare AI Search now supports Japanese, Chinese, and Korean keyword queries when using the trigram tokenizer. Previously, queries without spaces in these languages were treated as single exact phrases and returned no results. The porter tokenizer does not support CJK languages. Changing the tokenizer setting triggers a full reindex.",
      "why_matters": "If you index CJK content with the default porter tokenizer, keyword search does not work for those languages. Switching to trigram fixes search but forces a complete reindex of your data, which affects availability and costs during the rebuild.",
      "what_to_do": "Check if your AI Search indexes contain Japanese, Chinese, or Korean content. If so, set keyword_tokenizer to trigram in your index configuration and schedule the reindex during a maintenance window to avoid disrupting live search traffic.",
      "severity": "worth_knowing",
      "action_type": "verify_only",
      "tags": [
        "api"
      ],
      "confidence": 0.85,
      "source_name": "Cloudflare developer changelog",
      "source_url": "https://developers.cloudflare.com/changelog/post/2026-10-16-cjk-keyword-search/",
      "published_at": "2026-10-16T11:28:34.97562+00:00",
      "corrected_at": null,
      "correction": null,
      "correction_cause": null,
      "url": "https://radar.trulysovereign.com/items/9b96c7d4-c132-4272-8292-1d58b6f245d4",
      "affects": [
        {
          "id": "ai-search",
          "type": "product",
          "label": "ai search",
          "unmapped": true
        }
      ],
      "action_due": null,
      "time_to_correct": null
    },
    {
      "id": "a498b8b9-fc70-42db-b188-a3081f31d429",
      "channel": "regulatory_change",
      "headline": "Norwegian DPA fines Xandr €8.6M for RTB without valid consent for sexual orientation data",
      "what_changed": "On 2 October 2026, Norway's DPA fined Xandr Inc. €8,600,000 for processing Grindr users' personal data—including advertising IDs, IP addresses, and the fact of using Grindr—during real-time bidding without a legal basis under Article 6(1) GDPR and without valid consent for special category data under Article 9(1) GDPR. The DPA ruled that Xandr, as a joint controller in both supply-side and demand-side platform roles, could not rely on Grindr's invalid consent and must independently verify that consent is valid and covers its own processing. The fact of using Grindr was classified as data concerning sexual orientation under Article 9(1).",
      "why_matters": "This establishes that ad tech platforms in real-time bidding chains are joint controllers who cannot outsource accountability for consent verification to the publisher. If your platform processes bid requests containing data that reveals special category information—even indirectly, such as app usage implying sexual orientation—you must independently verify explicit consent under Article 9(2)(a) before processing. Relying on upstream consent strings without verification exposes you to enforcement and fines calibrated to the sensitivity of the data.",
      "what_to_do": "Audit your RTB processing to identify bid requests that contain or imply special category data, including app identifiers, contextual signals, or audience segments that reveal health, sexual orientation, religion, or other Article 9 categories. For each such flow, verify that you obtain and validate explicit consent directly, not by assuming upstream consent is sufficient. If you cannot verify consent independently, stop processing those bid requests in EEA markets.",
      "severity": "action_needed",
      "action_type": "assess_exposure",
      "tags": [
        "security",
        "terms"
      ],
      "confidence": 0.95,
      "source_name": "EDPB news",
      "source_url": "https://www.edpb.europa.eu/news/norwegian-dpa-fines-xandr-eur-8-600-000-for-unlawful-processing-of-personal-data_en",
      "published_at": "2026-10-16T11:28:21.914712+00:00",
      "corrected_at": null,
      "correction": null,
      "correction_cause": null,
      "url": "https://radar.trulysovereign.com/items/a498b8b9-fc70-42db-b188-a3081f31d429",
      "affects": [
        {
          "id": "eu",
          "type": "jurisdiction",
          "label": "european union"
        },
        {
          "id": "gdpr",
          "type": "regulation",
          "label": "gdpr",
          "unmapped": true
        }
      ],
      "action_due": null,
      "time_to_correct": null
    },
    {
      "id": "2cf62496-c9af-45c0-85fa-4d57f170da03",
      "channel": "ai_platform_drift",
      "headline": "DeepSeek Flash Latest prompt pricing doubled to $0.036/M tokens",
      "what_changed": "OpenRouter's pricing for ~deepseek/deepseek-flash-latest changed on 16 October 2026. The captured prompt base rate changed from $0.018 to $0.036 per 1M tokens. Completion pricing remains $0.684 per 1M tokens.",
      "why_matters": "Prompt costs doubled, a +100.0% increase. Using the captured base rates for ~deepseek/deepseek-flash-latest, 100M prompt tokens per day cost $1.80 before and $3.60 after, excluding all other charges. Applications with high prompt volume will see material cost increases.",
      "what_to_do": "Reforecast your OpenRouter spend if you use ~deepseek/deepseek-flash-latest. To estimate the added prompt cost for ~deepseek/deepseek-flash-latest in dollars, multiply prompt token volume by 0.018 and divide by 1,000,000, using the captured base-rate difference in dollars per 1M tokens. Pass the updated projection to whoever owns the budget.",
      "severity": "action_needed",
      "action_type": "budget",
      "tags": [
        "pricing",
        "model"
      ],
      "confidence": 0.95,
      "source_name": "OpenRouter model catalogue",
      "source_url": "https://openrouter.ai/api/v1/models",
      "published_at": "2026-10-16T11:27:55.91161+00:00",
      "corrected_at": null,
      "correction": null,
      "correction_cause": null,
      "url": "https://radar.trulysovereign.com/items/2cf62496-c9af-45c0-85fa-4d57f170da03",
      "affects": [
        {
          "id": "deepseek/deepseek-flash-latest",
          "type": "model",
          "label": "~deepseek/deepseek-flash-latest",
          "unmapped": true
        },
        {
          "id": "openrouter",
          "type": "provider",
          "label": "openrouter"
        }
      ],
      "action_due": null,
      "time_to_correct": null
    },
    {
      "id": "e14df461-ba8f-451a-b8b4-69da8e1b3902",
      "channel": "ai_platform_drift",
      "headline": "DeepSeek V4.1 Flash prompt pricing doubled on OpenRouter",
      "what_changed": "OpenRouter's deepseek/deepseek-v4.1-flash prompt pricing changed from $0.018 to $0.036 per 1M tokens. Completion pricing remains $0.684 per 1M tokens.",
      "why_matters": "Using the captured base rates for deepseek/deepseek-v4.1-flash, 100M prompt tokens per day cost $1.80 before and $3.60 after, excluding all other charges. This is a 100% increase in prompt costs for any workload using this model through OpenRouter.",
      "what_to_do": "Reforecast your OpenRouter spend if you route traffic to deepseek/deepseek-v4.1-flash. Grep your codebase for 'deepseek-v4.1-flash' or 'deepseek/deepseek-v4.1-flash' to identify affected calls, then update your cost projections with the new $0.036/M prompt rate.",
      "severity": "worth_knowing",
      "action_type": "budget",
      "tags": [
        "pricing",
        "model"
      ],
      "confidence": 0.95,
      "source_name": "OpenRouter model catalogue",
      "source_url": "https://openrouter.ai/api/v1/models",
      "published_at": "2026-10-16T11:27:36.255177+00:00",
      "corrected_at": null,
      "correction": null,
      "correction_cause": null,
      "url": "https://radar.trulysovereign.com/items/e14df461-ba8f-451a-b8b4-69da8e1b3902",
      "affects": [
        {
          "id": "openrouter",
          "type": "provider",
          "label": "openrouter"
        },
        {
          "id": "deepseek-v4.1-flash",
          "type": "model",
          "label": "deepseek/deepseek-v4.1-flash"
        },
        {
          "id": "deepseek",
          "type": "provider",
          "label": "deepseek"
        }
      ],
      "action_due": null,
      "time_to_correct": null
    },
    {
      "id": "4c78c09c-3b47-4935-b2d6-e4f34db6c734",
      "channel": "ai_platform_drift",
      "headline": "PhoneLLM Mini voice model now available on Cloudflare Workers AI",
      "what_changed": "Cloudflare added @cf/daily-co/phonellm-mini-alpha-2 to Workers AI on 15 October 2026. The model is a post-trained NVIDIA Nemotron 3 Nano 30B optimized for voice agents and realtime AI applications. It is accessible through the Workers AI binding (env.AI.run()) or the REST API at /ai/run. Pipecat recommends temperature: 0 and chat_template_kwargs: { enable_thinking: false }.",
      "why_matters": "Voice agents typically choose between fast models that miss tool calls and slower reasoning-mode models that handle them correctly. PhoneLLM is trained to follow instructions and call tools accurately without reasoning mode, reducing latency in speech-to-text → LLM → text-to-speech pipelines where every second adds to caller wait time. Python Workers are now generally available, making it possible to run Pipecat voice agents on Cloudflare infrastructure.",
      "what_to_do": "If you are building voice agents on Workers AI, test @cf/daily-co/phonellm-mini-alpha-2 against your current model to measure latency and tool-calling accuracy. Set temperature: 0 and chat_template_kwargs: { enable_thinking: false } as recommended. Review the PhoneLLM model page and Workers AI pricing to understand cost implications.",
      "severity": "worth_knowing",
      "action_type": "verify_only",
      "tags": [
        "model",
        "api"
      ],
      "confidence": 0.85,
      "source_name": "Cloudflare developer changelog",
      "source_url": "https://developers.cloudflare.com/changelog/post/2026-10-15-phonellm-mini-workers-ai/",
      "published_at": "2026-10-16T11:27:17.076075+00:00",
      "corrected_at": null,
      "correction": null,
      "correction_cause": null,
      "url": "https://radar.trulysovereign.com/items/4c78c09c-3b47-4935-b2d6-e4f34db6c734",
      "affects": [
        {
          "id": "@cf/daily-co/phonellm-mini-alpha-2",
          "type": "model",
          "label": "@cf/daily-co/phonellm-mini-alpha-2",
          "unmapped": true
        },
        {
          "id": "cloudflare",
          "type": "provider",
          "label": "cloudflare",
          "unmapped": true
        },
        {
          "id": "workers-ai",
          "type": "product",
          "label": "workers ai",
          "unmapped": true
        }
      ],
      "action_due": null,
      "time_to_correct": null
    },
    {
      "id": "a8432c23-eca3-49ec-8bcc-685b00b0fd01",
      "channel": "ai_platform_drift",
      "headline": "Access deny redirects now include account_id query parameter",
      "what_changed": "Cloudflare Access deny redirects now append an account_id query parameter to custom block page URLs when account context is available. The parameter appears alongside existing kid (application audience) and original_url parameters in the redirect URL format.",
      "why_matters": "Custom block pages that parse redirect URLs will receive an additional query parameter. If your parsing logic expects a fixed parameter set or validates against an allowlist, requests may fail or log errors when account_id appears.",
      "what_to_do": "Review custom block page implementations that handle Access deny redirects. Update URL parsing to accept the account_id parameter, or verify that your parser already handles unexpected query parameters gracefully without breaking.",
      "severity": "worth_knowing",
      "action_type": "verify_only",
      "tags": [
        "api"
      ],
      "confidence": 0.75,
      "source_name": "Cloudflare developer changelog",
      "source_url": "https://developers.cloudflare.com/changelog/post/2026-10-14-deny-redirect-account-id/",
      "published_at": "2026-10-16T11:27:03.707229+00:00",
      "corrected_at": null,
      "correction": null,
      "correction_cause": null,
      "url": "https://radar.trulysovereign.com/items/a8432c23-eca3-49ec-8bcc-685b00b0fd01",
      "affects": [
        {
          "id": "cloudflare-access",
          "type": "product",
          "label": "cloudflare access",
          "unmapped": true
        }
      ],
      "action_due": null,
      "time_to_correct": null
    },
    {
      "id": "0ea215ba-f879-46ea-9a83-c472d645304d",
      "channel": "ai_platform_drift",
      "headline": "Claude Opus 5.5 fast mode exits research preview, beta header now optional",
      "what_changed": "Fast mode for Claude Opus 5.5 is out of research preview as of October 15, 2026. The fast-mode-2026-02-01 beta header is no longer required for Claude Opus 5.5 requests, though requests that include it continue to work. Default fast mode rate limits now apply in Start, Build, and Scale tiers. Fast mode for Claude Opus 5 and Claude Opus 4.8 remains in research preview and still requires the beta header.",
      "why_matters": "Code that conditionally adds the beta header based on model version can now simplify its logic for Opus 5.5. Rate limits that were previously gated behind access requests are now standard, which may affect throughput planning if you were operating under research preview limits.",
      "what_to_do": "Search your codebase for fast-mode-2026-02-01 header logic. If you branch on model version, remove the header requirement for claude-opus-5.5 calls. Check your current fast mode usage against the new default tier limits to confirm you are not hitting the ceiling.",
      "severity": "worth_knowing",
      "action_type": "verify_only",
      "tags": [
        "api",
        "limits",
        "model"
      ],
      "confidence": 0.85,
      "source_name": "Claude Platform release notes",
      "source_url": "https://platform.claude.com/docs/en/release-notes/overview#october-15-2026-5",
      "published_at": "2026-10-16T04:42:31.920958+00:00",
      "corrected_at": null,
      "correction": null,
      "correction_cause": null,
      "url": "https://radar.trulysovereign.com/items/0ea215ba-f879-46ea-9a83-c472d645304d",
      "affects": [
        {
          "id": "claude-opus-5.5",
          "type": "model",
          "label": "claude-opus-5.5"
        },
        {
          "id": "messages",
          "type": "api",
          "label": "messages api"
        },
        {
          "id": "anthropic",
          "type": "provider",
          "label": "anthropic"
        }
      ],
      "action_due": null,
      "time_to_correct": null
    },
    {
      "id": "1e224e4d-d714-453d-8691-9ae0141da8d7",
      "channel": "security_advisory",
      "headline": "Claude Code plugin hash pinning bypass patched in 2.1.179",
      "what_changed": "CVE-2026-86063 published 15 October 2026 for @anthropic-ai/claude-code. A high-severity vulnerability allows bypass of hash pinning, a cryptographic integrity control. First patched version is 2.1.179.",
      "why_matters": "Hash pinning prevents tampered or substituted plugins from executing. A bypass means an attacker who can position a malicious plugin can defeat the integrity check that would normally block it. Any deployment running an unpatched version accepts plugins it should reject.",
      "what_to_do": "Upgrade @anthropic-ai/claude-code to 2.1.179 or later. Grep package.json and lock files for the package name to confirm you are exposed before scheduling the update.",
      "severity": "action_needed",
      "action_type": "patch_now",
      "tags": [
        "security",
        "api"
      ],
      "confidence": 0.85,
      "source_name": "GitHub advisories — npm",
      "source_url": "https://api.github.com/advisories?ecosystem=npm&severity=high&per_page=100",
      "published_at": "2026-10-16T04:42:16.92121+00:00",
      "corrected_at": null,
      "correction": null,
      "correction_cause": null,
      "url": "https://radar.trulysovereign.com/items/1e224e4d-d714-453d-8691-9ae0141da8d7",
      "affects": [
        {
          "id": "npm@anthropic-ai/claude-code",
          "type": "package",
          "label": "npm:@anthropic-ai/claude-code",
          "unmapped": true
        },
        {
          "id": "cve-2026-86063",
          "type": "cve",
          "label": "CVE-2026-86063"
        }
      ],
      "action_due": null,
      "time_to_correct": null
    },
    {
      "id": "2f2b6fbd-b1fd-40d4-8541-8be6ee55bc98",
      "channel": "security_advisory",
      "headline": "OpenNext Cloudflare cache bypass allows middleware evasion via encoded paths",
      "what_changed": "GitHub published CVE-2026-100409 on 15 October 2026, a high-severity advisory for @opennextjs/cloudflare. The vulnerability allows cache interception to bypass middleware protection when paths are encoded. Version 1.20.2 patches the issue.",
      "why_matters": "If you run Next.js on Cloudflare with OpenNext and rely on middleware for authentication or authorization, an attacker can bypass those checks by encoding request paths. Protected routes become accessible without passing through your middleware layer.",
      "what_to_do": "Check your package.json or lock file for @opennextjs/cloudflare. If present and below 1.20.2, update to 1.20.2 or later. If you cannot update immediately, review your middleware logic and consider adding path normalization before authorization checks.",
      "severity": "action_needed",
      "action_type": "patch_now",
      "tags": [
        "security",
        "api"
      ],
      "confidence": 0.85,
      "source_name": "GitHub advisories — npm",
      "source_url": "https://api.github.com/advisories?ecosystem=npm&severity=high&per_page=100",
      "published_at": "2026-10-16T04:42:06.351266+00:00",
      "corrected_at": null,
      "correction": null,
      "correction_cause": null,
      "url": "https://radar.trulysovereign.com/items/2f2b6fbd-b1fd-40d4-8541-8be6ee55bc98",
      "affects": [
        {
          "id": "npm@opennextjs/cloudflare",
          "type": "package",
          "label": "npm:@opennextjs/cloudflare",
          "unmapped": true
        },
        {
          "id": "cve-2026-100409",
          "type": "cve",
          "label": "CVE-2026-100409"
        }
      ],
      "action_due": null,
      "time_to_correct": null
    },
    {
      "id": "4981b42c-6c55-4316-8545-956e5801b2e8",
      "channel": "ai_platform_drift",
      "headline": "Bot Management ML model switches from fixed versions to continuous retraining",
      "what_changed": "Cloudflare's Bot Management machine learning model, which generates bot scores, changed from shipping numbered fixed versions to continuous retraining under a system called Adaptive Intelligence. New model versions now run in shadow mode for validation before gradual rollout. Enterprise customers with Auto-update machine learning enabled receive this automatically as of 31 August 2026.",
      "why_matters": "Bot score behavior will change without version number updates, making it impossible to pin to a specific model version. If your application logic depends on consistent bot scoring thresholds or you need reproducible results for testing, the continuous retraining removes the ability to control when scoring behavior changes.",
      "what_to_do": "Check your Bot Management configuration dashboard to confirm whether Auto-update machine learning is enabled. If your application has hardcoded bot score thresholds or relies on stable scoring for A/B tests or compliance validation, document current behavior now and establish monitoring for score distribution changes, since version pinning is no longer an option.",
      "severity": "worth_knowing",
      "action_type": "verify_only",
      "tags": [
        "model",
        "api"
      ],
      "confidence": 0.85,
      "source_name": "Cloudflare developer changelog",
      "source_url": "https://developers.cloudflare.com/changelog/post/2026-08-31-adaptive-intelligence/",
      "published_at": "2026-10-16T04:41:55.981341+00:00",
      "corrected_at": null,
      "correction": null,
      "correction_cause": null,
      "url": "https://radar.trulysovereign.com/items/4981b42c-6c55-4316-8545-956e5801b2e8",
      "affects": [
        {
          "id": "cloudflare",
          "type": "provider",
          "label": "cloudflare",
          "unmapped": true
        },
        {
          "id": "bot-management",
          "type": "product",
          "label": "bot management",
          "unmapped": true
        }
      ],
      "action_due": null,
      "time_to_correct": null
    },
    {
      "id": "4096a292-62ad-4561-9f8c-358434cf0fe0",
      "channel": "ai_platform_drift",
      "headline": "Three Copilot models retire November 16, 2026",
      "what_changed": "GitHub will deprecate Claude Opus 4.8, Claude Opus 5, and GPT-5.6 Terra across all Copilot experiences on November 16, 2026. Claude Opus 4.8 remains available only to individual annual subscribers. Suggested replacements are Claude Opus 5.5 for both Opus models and GPT-6.1 Sol or GPT-6 Luna for GPT-5.6 Terra.",
      "why_matters": "Any workflows, integrations, or user configurations explicitly selecting these models will break on the cutoff date. Enterprise and Business customers relying on Claude Opus 4.8 lose access entirely unless they migrate to 5.5.",
      "what_to_do": "Audit Copilot integrations and user workflows for hardcoded model selections of the three retiring models. Update to the suggested alternatives and test before November 16. Enterprise customers with concerns should contact their account team.",
      "severity": "action_needed",
      "action_type": "migrate",
      "tags": [
        "deprecation",
        "model"
      ],
      "confidence": 0.95,
      "source_name": "GitHub Copilot changelog",
      "source_url": "https://github.blog/changelog/2026-10-15-upcoming-deprecation-of-selected-github-copilot-models-in-mid-november",
      "published_at": "2026-10-15T21:27:10.557861+00:00",
      "corrected_at": null,
      "correction": null,
      "correction_cause": null,
      "url": "https://radar.trulysovereign.com/items/4096a292-62ad-4561-9f8c-358434cf0fe0",
      "affects": [
        {
          "id": "github",
          "type": "provider",
          "label": "github",
          "unmapped": true
        },
        {
          "id": "github-copilot",
          "type": "product",
          "label": "github copilot",
          "unmapped": true
        },
        {
          "id": "claude-opus-4.8",
          "type": "model",
          "label": "claude-opus-4.8"
        },
        {
          "id": "claude-opus-5",
          "type": "model",
          "label": "claude-opus-5"
        },
        {
          "id": "gpt-5-6-terra",
          "type": "model",
          "label": "gpt-5.6-terra",
          "unmapped": true
        },
        {
          "id": "anthropic",
          "type": "provider",
          "label": "anthropic"
        }
      ],
      "action_due": "2026-11-16",
      "time_to_correct": null
    },
    {
      "id": "93b372cc-d9e8-4ad9-8ce3-d5512034a886",
      "channel": "security_advisory",
      "headline": "CISA adds Atlassian CVE-2026-21589 to KEV catalog, due 2026-10-18",
      "what_changed": "CVE-2026-21589 was added to CISA's Known Exploited Vulnerabilities catalog on 2026-10-15. The vulnerability affects multiple Atlassian products and is classified as \"Files or Directories Accessible to External Parties.\" Federal agencies must act by 2026-10-18 under BOD 26-04.",
      "why_matters": "Active exploitation is confirmed — that is the threshold for KEV inclusion. If you run Atlassian products (Jira, Confluence, Bitbucket, Bamboo), an attacker can access files or directories that should be restricted. The three-day window indicates CISA considers this urgent.",
      "what_to_do": "Check your Atlassian product inventory against the vendor advisory for CVE-2026-21589. Apply the vendor's mitigation instructions before 2026-10-18 if you are a federal agency or contractor; apply them this week regardless. If no mitigation exists for your version, follow BOD 26-04 guidance to discontinue use or isolate the instance.",
      "severity": "action_needed",
      "action_type": "mitigate",
      "tags": [
        "security",
        "api"
      ],
      "confidence": 0.85,
      "source_name": "CISA Known Exploited Vulnerabilities",
      "source_url": "https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json",
      "published_at": "2026-10-15T21:26:59.413147+00:00",
      "corrected_at": null,
      "correction": null,
      "correction_cause": null,
      "url": "https://radar.trulysovereign.com/items/93b372cc-d9e8-4ad9-8ce3-d5512034a886",
      "affects": [
        {
          "id": "cve-2026-21589",
          "type": "cve",
          "label": "CVE-2026-21589"
        },
        {
          "id": "atlassian",
          "type": "provider",
          "label": "atlassian",
          "unmapped": true
        }
      ],
      "action_due": "2026-10-18",
      "time_to_correct": null
    },
    {
      "id": "f720d344-fabd-462b-a0bb-7bb1a2bdb39a",
      "channel": "ai_platform_drift",
      "headline": "Claude Opus 5.5 fast mode exits preview, beta header optional",
      "what_changed": "Claude Opus 5.5 fast mode is now generally available as of October 15, 2026. The fast-mode-2026-02-01 beta header is no longer required for Claude Opus 5.5 requests, though it still works if sent. Claude Opus 5.5 now has default fast mode rate limits in all usage tiers. Claude Opus 5 and Claude Opus 4.8 fast mode remain in research preview and still require the beta header.",
      "why_matters": "Code that conditionally adds the beta header only for preview features can now remove that logic for Claude Opus 5.5, simplifying request handling. The rate limit change means fast mode requests to Claude Opus 5.5 now count against standard tier limits instead of preview quotas, which may affect throughput planning if you were previously operating under different preview limits.",
      "what_to_do": "Grep your codebase for 'fast-mode-2026-02-01' and remove the header from Claude Opus 5.5 request paths. Check your current fast mode usage against the new default tier limits in the platform console to confirm you are not hitting the new rate limits.",
      "severity": "worth_knowing",
      "action_type": "verify_only",
      "tags": [
        "api",
        "limits"
      ],
      "confidence": 0.85,
      "source_name": "Claude Platform release notes",
      "source_url": "https://platform.claude.com/docs/en/release-notes/overview#october-15-2026-4",
      "published_at": "2026-10-15T21:26:25.865706+00:00",
      "corrected_at": null,
      "correction": null,
      "correction_cause": null,
      "url": "https://radar.trulysovereign.com/items/f720d344-fabd-462b-a0bb-7bb1a2bdb39a",
      "affects": [
        {
          "id": "claude-opus-5.5",
          "type": "model",
          "label": "claude-opus-5.5"
        },
        {
          "id": "anthropic",
          "type": "provider",
          "label": "anthropic"
        }
      ],
      "action_due": null,
      "time_to_correct": null
    },
    {
      "id": "1ad508fc-fe80-41cc-b5e7-615536bd9fb0",
      "channel": "ai_platform_drift",
      "headline": "Cloudflare Stream WebRTC billing starts October 15, 2026",
      "what_changed": "Cloudflare Stream's WebRTC support moved to General Availability on October 15, 2026, with usage-based billing beginning the same day. Billing follows standard Stream rates for minutes of video delivered. WebRTC delivery now appears in Stream analytics and billable usage charts.",
      "why_matters": "If you are using Stream WebRTC, you are now being billed for it. Usage that was free during beta now incurs charges at the standard per-minute delivery rate. The analytics dashboard will show this usage, so you can track what you are being charged for.",
      "what_to_do": "Check your Stream analytics dashboard for WebRTC delivery minutes and calculate the cost impact using Cloudflare's published per-minute rates. If you were testing WebRTC during beta, decide whether to continue using it in production or disable it to avoid charges.",
      "severity": "action_needed",
      "action_type": "budget",
      "tags": [
        "pricing"
      ],
      "confidence": 0.95,
      "source_name": "Cloudflare developer changelog",
      "source_url": "https://developers.cloudflare.com/changelog/post/2026-10-15-stream-live-webrtc-ga/",
      "published_at": "2026-10-15T21:26:01.741903+00:00",
      "corrected_at": null,
      "correction": null,
      "correction_cause": null,
      "url": "https://radar.trulysovereign.com/items/1ad508fc-fe80-41cc-b5e7-615536bd9fb0",
      "affects": [
        {
          "id": "cloudflare-stream",
          "type": "product",
          "label": "cloudflare stream",
          "unmapped": true
        },
        {
          "id": "stream-webrtc",
          "type": "product",
          "label": "stream webrtc",
          "unmapped": true
        }
      ],
      "action_due": "2026-10-15",
      "time_to_correct": null
    },
    {
      "id": "2fc1f3eb-6cfc-40c5-872a-1cbd14e143e2",
      "channel": "ai_platform_drift",
      "headline": "Cloudflare Gateway can now forward traffic to Workers for transformation",
      "what_changed": "Cloudflare Gateway added a Forward action in HTTP policies that routes matching traffic to Workers, available in public beta as of 15 October 2026 on all Zero Trust plans. Workers receive the request plus Gateway context including connection metadata, user identity, and device posture. Gateway evaluates HTTP request policies before Forward policies and inspects responses before returning them to users.",
      "why_matters": "If you use Cloudflare Gateway for outbound traffic inspection, you can now intercept and transform requests to AI APIs without deploying a separate proxy. This enables request/response logging to R2, prompt filtering, or response modification inline with your existing Gateway policies. Gateway still handles TLS decryption and body inspection, so a Block decision on the original request body can interrupt the Worker.",
      "what_to_do": "Review your Gateway HTTP policies to determine whether any traffic you currently block or allow would benefit from transformation or logging. If so, deploy a Worker using one of Cloudflare's templates and configure a Forward policy to route that traffic through it.",
      "severity": "worth_knowing",
      "action_type": "verify_only",
      "tags": [
        "api",
        "security"
      ],
      "confidence": 0.85,
      "source_name": "Cloudflare developer changelog",
      "source_url": "https://developers.cloudflare.com/changelog/post/2026-10-15-gateway-workers-public-beta/",
      "published_at": "2026-10-15T21:25:43.0303+00:00",
      "corrected_at": null,
      "correction": null,
      "correction_cause": null,
      "url": "https://radar.trulysovereign.com/items/2fc1f3eb-6cfc-40c5-872a-1cbd14e143e2",
      "affects": [
        {
          "id": "cloudflare-gateway",
          "type": "product",
          "label": "cloudflare gateway",
          "unmapped": true
        },
        {
          "id": "cloudflare-workers",
          "type": "product",
          "label": "cloudflare workers",
          "unmapped": true
        }
      ],
      "action_due": null,
      "time_to_correct": null
    },
    {
      "id": "a17bc4ba-d73c-4475-aec0-abbb543a0c32",
      "channel": "ai_platform_drift",
      "headline": "DLP custom patterns can now validate matches via Workers",
      "what_changed": "Cloudflare One DLP custom pattern entries can now call Cloudflare Workers to validate matches. Workers can adjust match confidence or reject matches entirely using organization-specific logic. Announced 15 October 2026.",
      "why_matters": "If you use DLP custom patterns, you can now implement validation logic that goes beyond regex — checking against internal databases, applying business rules, or filtering false positives before a match triggers a block or alert.",
      "what_to_do": "Review your DLP custom patterns. If any generate false positives or need context-aware validation, implement a Worker using the contract documented at 'Validate data loss prevention matches with Cloudflare Workers' and attach it to the relevant pattern entries.",
      "severity": "worth_knowing",
      "action_type": "verify_only",
      "tags": [
        "security",
        "api"
      ],
      "confidence": 0.85,
      "source_name": "Cloudflare developer changelog",
      "source_url": "https://developers.cloudflare.com/changelog/post/2026-10-15-dlp-custom-validation-workers/",
      "published_at": "2026-10-15T21:25:31.250317+00:00",
      "corrected_at": null,
      "correction": null,
      "correction_cause": null,
      "url": "https://radar.trulysovereign.com/items/a17bc4ba-d73c-4475-aec0-abbb543a0c32",
      "affects": [
        {
          "id": "cloudflare-one",
          "type": "product",
          "label": "cloudflare one",
          "unmapped": true
        },
        {
          "id": "cloudflare-workers",
          "type": "product",
          "label": "cloudflare workers",
          "unmapped": true
        }
      ],
      "action_due": null,
      "time_to_correct": null
    },
    {
      "id": "826a54ad-f6b8-4d18-8dde-5e0b8053ae57",
      "channel": "security_advisory",
      "headline": "Neptune deserialization flaw lets authenticated users trigger unsafe query processing",
      "what_changed": "AWS disclosed CVE-2026-110812 on 15 October 2026, a deserialization vulnerability in Apache TinkerPop's Gremlin functionality used by Amazon Neptune. All Neptune engine versions >=1.2.0.0 are affected. An authenticated principal with Neptune data-plane query permissions can submit requests that cause the query engine to process untrusted input unsafely, potentially leading to unintended activity within the query engine environment.",
      "why_matters": "This is a managed service vulnerability you cannot patch yourself — AWS must upgrade the engine. An attacker who already has Neptune query permissions can exploit this to execute unintended operations in the query engine environment, which in a managed service context means activity outside your direct control. The broad version range means most production Neptune clusters are affected.",
      "what_to_do": "Check your Neptune cluster engine versions in the AWS console. If running >=1.2.0.0, schedule an upgrade to the patched engine version listed in the full bulletin. Review IAM policies to confirm only necessary principals have neptune-db:* data-plane permissions, since exploitation requires authenticated query access.",
      "severity": "action_needed",
      "action_type": "patch_now",
      "tags": [
        "security",
        "api"
      ],
      "confidence": 0.85,
      "source_name": "AWS security bulletins",
      "source_url": "https://aws.amazon.com/security/security-bulletins/rss/2026-136-aws/",
      "published_at": "2026-10-15T17:05:00.896946+00:00",
      "corrected_at": null,
      "correction": null,
      "correction_cause": null,
      "url": "https://radar.trulysovereign.com/items/826a54ad-f6b8-4d18-8dde-5e0b8053ae57",
      "affects": [
        {
          "id": "amazon-neptune",
          "type": "product",
          "label": "amazon neptune",
          "unmapped": true
        },
        {
          "id": "cve-2026-110812",
          "type": "cve",
          "label": "CVE-2026-110812"
        }
      ],
      "action_due": null,
      "time_to_correct": null
    },
    {
      "id": "2a37e6cd-4309-481b-aad1-487d2b11f43b",
      "channel": "ai_platform_drift",
      "headline": "GitHub agentic autofix for code scanning now GA, requires enterprise policy enablement",
      "what_changed": "GitHub's agentic autofix for code scanning alerts moved from preview to general availability on 15 October 2026. It requires enterprise administrators to enable a new \"Agentic autofix\" policy in Advanced Security policies before organization or repository administrators can turn it on. The feature replaces the free \"Generate Fix\" option with \"Assign to Copilot\" and works only on default branch alerts, not pull requests or other branches. Access via REST API uses assignee \"copilot-swe-agent[bot]\". Available only to GitHub Code Security and Advanced Security customers on Enterprise Cloud.",
      "why_matters": "If your enterprise administrator has not enabled the policy, your teams cannot use this feature even if they previously had access to code scanning autofix. The billing model changed: this now consumes AI Credits from your Code Security budget plus GitHub Actions minutes, displayed under \"Advanced Security\" product in enterprise billing. The free Generate Fix option is gone once this is enabled.",
      "what_to_do": "Check with your enterprise administrator whether the \"Agentic autofix\" policy is enabled in Advanced Security policies. If you use code scanning alerts and want this capability, request enablement and verify a Copilot billing method is defined. If you have SKU-level budgets for Code Security AI credits, review whether current allocations account for autofix consumption.",
      "severity": "worth_knowing",
      "action_type": "verify_only",
      "tags": [
        "api",
        "security",
        "pricing"
      ],
      "confidence": 0.85,
      "source_name": "GitHub Copilot changelog",
      "source_url": "https://github.blog/changelog/2026-10-15-agentic-autofix-for-code-scanning-alerts-general-availability",
      "published_at": "2026-10-15T17:04:33.563673+00:00",
      "corrected_at": null,
      "correction": null,
      "correction_cause": null,
      "url": "https://radar.trulysovereign.com/items/2a37e6cd-4309-481b-aad1-487d2b11f43b",
      "affects": [
        {
          "id": "github-copilot",
          "type": "product",
          "label": "github copilot",
          "unmapped": true
        },
        {
          "id": "github-code-security",
          "type": "product",
          "label": "github code security",
          "unmapped": true
        },
        {
          "id": "github-advanced-security",
          "type": "product",
          "label": "github advanced security",
          "unmapped": true
        },
        {
          "id": "code-scanning-alert-rest-api",
          "type": "api",
          "label": "code scanning alert rest api",
          "unmapped": true
        }
      ],
      "action_due": null,
      "time_to_correct": null
    },
    {
      "id": "302de1c8-392c-443e-973f-8a9efe20044e",
      "channel": "ai_platform_drift",
      "headline": "DeepSeek Flash Latest pricing increased 118% prompt, 20% completion",
      "what_changed": "OpenRouter's ~deepseek/deepseek-flash-latest model pricing changed effective 15 October 2026. The captured prompt base rate changed from $0.0109 to $0.02376 per 1M tokens. The captured completion base rate changed from $0.60 to $0.72 per 1M tokens.",
      "why_matters": "Using the captured base rates for ~deepseek/deepseek-flash-latest, 100M prompt tokens per day cost $1.09 before and $2.376 after, excluding all other charges. Using the captured base rates for ~deepseek/deepseek-flash-latest, 100M completion tokens per day cost $60.00 before and $72.00 after, excluding all other charges. The blended effect on total cost per request is +20.2% for workloads with ten completion tokens for every prompt token.",
      "what_to_do": "Reforecast API spend for any application using ~deepseek/deepseek-flash-latest through OpenRouter. Grep for this model identifier in configuration and multiply current monthly token volumes by the new rates to calculate the delta.",
      "severity": "action_needed",
      "action_type": "budget",
      "tags": [
        "pricing",
        "model"
      ],
      "confidence": 0.95,
      "source_name": "OpenRouter model catalogue",
      "source_url": "https://openrouter.ai/api/v1/models",
      "published_at": "2026-10-15T17:04:06.028739+00:00",
      "corrected_at": null,
      "correction": null,
      "correction_cause": null,
      "url": "https://radar.trulysovereign.com/items/302de1c8-392c-443e-973f-8a9efe20044e",
      "affects": [
        {
          "id": "deepseek/deepseek-flash-latest",
          "type": "model",
          "label": "~deepseek/deepseek-flash-latest",
          "unmapped": true
        },
        {
          "id": "openrouter",
          "type": "provider",
          "label": "openrouter"
        }
      ],
      "action_due": null,
      "time_to_correct": null
    },
    {
      "id": "5acf7fbb-24bb-4aab-8756-3b6c3930b724",
      "channel": "ai_platform_drift",
      "headline": "DeepSeek V4.1 Flash pricing increased 118% prompt, 20% completion",
      "what_changed": "OpenRouter's pricing for deepseek/deepseek-v4.1-flash changed on 15 October 2026. The captured prompt base rate changed from $0.0109 to $0.02376 per 1M tokens. The captured completion base rate changed from $0.60 to $0.72 per 1M tokens.",
      "why_matters": "Using the captured base rates for deepseek/deepseek-v4.1-flash, 100M prompt tokens per day cost $1.09 before and $2.376 after, excluding all other charges. Using the captured base rates for deepseek/deepseek-v4.1-flash, 100M completion tokens per day cost $60.00 before and $72.00 after, excluding all other charges. Prompt-heavy workloads see the largest impact: a request with ten completion tokens for every prompt token costs 20.2% more overall.",
      "what_to_do": "Pull current monthly token volumes for deepseek/deepseek-v4.1-flash from your logs, split by prompt and completion. To estimate the added prompt cost for deepseek/deepseek-v4.1-flash in dollars, multiply prompt token volume by 0.01286 and divide by 1,000,000, using the captured base-rate difference in dollars per 1M tokens. To estimate the added completion cost for deepseek/deepseek-v4.1-flash in dollars, multiply completion token volume by 0.12 and divide by 1,000,000, using the captured base-rate difference in dollars per 1M tokens. Add the two results and update your forecast.",
      "severity": "worth_knowing",
      "action_type": "budget",
      "tags": [
        "pricing",
        "model"
      ],
      "confidence": 0.95,
      "source_name": "OpenRouter model catalogue",
      "source_url": "https://openrouter.ai/api/v1/models",
      "published_at": "2026-10-15T17:03:56.308066+00:00",
      "corrected_at": null,
      "correction": null,
      "correction_cause": null,
      "url": "https://radar.trulysovereign.com/items/5acf7fbb-24bb-4aab-8756-3b6c3930b724",
      "affects": [
        {
          "id": "deepseek-v4.1-flash",
          "type": "model",
          "label": "deepseek/deepseek-v4.1-flash"
        },
        {
          "id": "openrouter",
          "type": "provider",
          "label": "openrouter"
        },
        {
          "id": "deepseek",
          "type": "provider",
          "label": "deepseek"
        }
      ],
      "action_due": null,
      "time_to_correct": null
    },
    {
      "id": "127808c5-a193-4acf-b076-f83646b09bc2",
      "channel": "ai_platform_drift",
      "headline": "OpenAI Agents SDK 0.24.0 breaks custom error formatters and some saved runs",
      "what_changed": "OpenAI Agents Python SDK v0.24.0 advances RunState schema from 1.18 to 1.21 and adds a third error category to tool_error_formatter. Custom formatters now receive kind='tool_exception' with an optional error field for crashed functions. Saved agent graphs with same-name non-root agents distinguishable only by hook instance attributes can no longer deserialize. The SDK also restricts Redis Cluster to read/pop operations only—transactional append, clear, and replacement now fail. Conversations API writes are batched to 20 items per request with partial-commit risk. Examples now require openai>=3.26.0,<4; temporalio pinned to 1.34.0; vercel-sandbox constrained to >=0.7.0,<0.9.",
      "why_matters": "Existing custom error formatters that treat every non-rejection as a missing tool will return misleading text for crashed functions unless updated to handle the new category. Saved runs created with older SDKs may fail to deserialize if they used same-name agents differentiated only by hook attributes—these must be completed on the original SDK version before upgrading. Applications using Redis Cluster for transactional session writes will break immediately. Conversations API users writing more than 20 items per request will experience partial commits without automatic rollback, requiring manual reconciliation.",
      "what_to_do": "Audit custom tool_error_formatter implementations: add explicit handling for kind='tool_exception' or return None to use the default message. Inventory saved RunState snapshots: finish any durable tasks using same-name agents on the SDK version that created them before upgrading, or switch to unique agent names for new runs. If using Redis Cluster for sessions, migrate to standalone Redis or another supported backend before deploying 0.24.0. If writing Conversations batches larger than 20 items, add batch-splitting logic and partial-write reconciliation before retry. Update example dependencies to openai>=3.26.0 if running the included examples.",
      "severity": "action_needed",
      "action_type": "migrate",
      "tags": [
        "api",
        "deprecation"
      ],
      "confidence": 0.95,
      "source_name": "OpenAI Agents Python SDK releases",
      "source_url": "https://github.com/openai/openai-agents-python/releases/tag/v0.24.0",
      "published_at": "2026-10-15T11:35:00.822419+00:00",
      "corrected_at": null,
      "correction": null,
      "correction_cause": null,
      "url": "https://radar.trulysovereign.com/items/127808c5-a193-4acf-b076-f83646b09bc2",
      "affects": [
        {
          "id": "pypiopenai-agents-python",
          "type": "package",
          "label": "pypi:openai-agents-python",
          "unmapped": true
        },
        {
          "id": "pypi/openai",
          "type": "package",
          "label": "pypi:openai"
        },
        {
          "id": "pypitemporalio",
          "type": "package",
          "label": "pypi:temporalio",
          "unmapped": true
        },
        {
          "id": "pypivercel-sandbox",
          "type": "package",
          "label": "pypi:vercel-sandbox",
          "unmapped": true
        },
        {
          "id": "openai",
          "type": "provider",
          "label": "openai"
        }
      ],
      "action_due": null,
      "time_to_correct": null
    },
    {
      "id": "d3053529-cce5-4487-a6c8-8e2976f476b7",
      "channel": "ai_platform_drift",
      "headline": "OpenRouter raises Gemma 4 31B pricing by 122% prompt, 18% completion",
      "what_changed": "OpenRouter changed pricing for google/gemma-4-31b-it effective immediately. The captured prompt base rate changed from $0.09 to $0.20 per 1M tokens. The captured completion base rate changed from $0.34 to $0.40 per 1M tokens. Using only the captured base rates for google/gemma-4-31b-it, there is no positive break-even ratio; total request cost is higher at every positive completion-to-prompt ratio, excluding all other charges.",
      "why_matters": "This increases total request cost by 39.5% for workloads generating one completion token per prompt token, 26.1% for three completion tokens per prompt token, and 20.3% for ten completion tokens per prompt token. Using the captured base rates for google/gemma-4-31b-it, 100M prompt tokens per 30-day month cost $9.00 before and $20.00 after, excluding all other charges. Using the captured base rates for google/gemma-4-31b-it, 100M completion tokens per 30-day month cost $34.00 before and $40.00 after, excluding all other charges.",
      "what_to_do": "Reforecast your OpenRouter spend if you call google/gemma-4-31b-it. To estimate the added prompt cost for google/gemma-4-31b-it in dollars, multiply prompt token volume by 0.11 and divide by 1,000,000, using the captured base-rate difference in dollars per 1M tokens. To estimate the added completion cost for google/gemma-4-31b-it in dollars, multiply completion token volume by 0.06 and divide by 1,000,000, using the captured base-rate difference in dollars per 1M tokens.",
      "severity": "action_needed",
      "action_type": "budget",
      "tags": [
        "pricing",
        "model"
      ],
      "confidence": 0.95,
      "source_name": "OpenRouter model catalogue",
      "source_url": "https://openrouter.ai/api/v1/models",
      "published_at": "2026-10-15T11:34:23.034843+00:00",
      "corrected_at": null,
      "correction": null,
      "correction_cause": null,
      "url": "https://radar.trulysovereign.com/items/d3053529-cce5-4487-a6c8-8e2976f476b7",
      "affects": [
        {
          "id": "openrouter",
          "type": "provider",
          "label": "openrouter"
        },
        {
          "id": "gemma-4-31b-it",
          "type": "model",
          "label": "google/gemma-4-31b-it",
          "unmapped": true
        },
        {
          "id": "google-cloud",
          "type": "provider",
          "label": "google-cloud"
        }
      ],
      "action_due": null,
      "time_to_correct": null
    },
    {
      "id": "6fc6594f-6cd6-473f-9a52-d5a03cff5c10",
      "channel": "ai_platform_drift",
      "headline": "Azure Foundry extends gpt-chat-latest retirement dates 2–3 months",
      "what_changed": "Four gpt-chat-latest preview versions had their retirement dates pushed back: 2026-05-05 now retires 2026-11-17 (was 2026-08-05), 2026-05-28 now retires 2026-12-08 (was 2026-08-28), 2026-06-24 now retires 2026-11-17 (was 2026-09-24), and 2026-08-06 now retires 2027-01-12 (was 2026-12-02). A new version 2026-10-07 was added with retirement date 2027-05-18.",
      "why_matters": "If you scheduled migration work based on the original retirement dates, you now have 2–3 additional months. If you pinned to a specific preview version expecting it to retire in August or September, that version will remain available longer than planned.",
      "what_to_do": "Check your deployment manifests and migration calendar for any gpt-chat-latest preview versions listed above. If you have work scheduled around the old retirement dates, adjust timelines to reflect the new dates or keep the original schedule to migrate sooner.",
      "severity": "worth_knowing",
      "action_type": "verify_only",
      "tags": [
        "model",
        "deprecation"
      ],
      "confidence": 0.95,
      "source_name": "Azure Foundry model retirement schedule",
      "source_url": "https://learn.microsoft.com/en-us/azure/foundry/openai/concepts/model-retirement-schedule",
      "published_at": "2026-10-15T11:34:08.270771+00:00",
      "corrected_at": null,
      "correction": null,
      "correction_cause": null,
      "url": "https://radar.trulysovereign.com/items/6fc6594f-6cd6-473f-9a52-d5a03cff5c10",
      "affects": [
        {
          "id": "microsoft-azure",
          "type": "provider",
          "label": "azure"
        },
        {
          "id": "gpt-chat-latest",
          "type": "model",
          "label": "gpt-chat-latest",
          "unmapped": true
        }
      ],
      "action_due": null,
      "time_to_correct": null
    },
    {
      "id": "efe6af6a-66a9-463f-a80b-0af342f50dae",
      "channel": "ai_platform_drift",
      "headline": "OpenAI audio translation endpoints retire February 26, 2027",
      "what_changed": "OpenAI added February 26, 2027 as the retirement date for /v1/audio/translations and v1/realtime/translations endpoints. This is one month after the previously announced January 20, 2027 retirement of legacy audio, realtime, and transcription models.",
      "why_matters": "Any code calling these translation endpoints will break after February 26, 2027. The staggered dates mean model retirement happens first (January 20) and endpoint removal follows (February 26), requiring two separate migrations if you use both deprecated models and translation endpoints.",
      "what_to_do": "Grep your codebase for /v1/audio/translations and v1/realtime/translations. If found, identify the replacement endpoints in OpenAI's current documentation and schedule migration work to complete before February 26, 2027.",
      "severity": "action_needed",
      "action_type": "migrate",
      "tags": [
        "deprecation",
        "api"
      ],
      "confidence": 0.95,
      "source_name": "OpenAI deprecations",
      "source_url": "https://developers.openai.com/api/docs/deprecations",
      "published_at": "2026-10-15T11:33:56.326876+00:00",
      "corrected_at": null,
      "correction": null,
      "correction_cause": null,
      "url": "https://radar.trulysovereign.com/items/efe6af6a-66a9-463f-a80b-0af342f50dae",
      "affects": [
        {
          "id": "openai",
          "type": "provider",
          "label": "openai"
        },
        {
          "id": "/v1/audio/translations",
          "type": "api",
          "label": "/v1/audio/translations",
          "unmapped": true
        },
        {
          "id": "v1/realtime/translations",
          "type": "api",
          "label": "v1/realtime/translations",
          "unmapped": true
        }
      ],
      "action_due": "2027-02-26",
      "time_to_correct": null
    },
    {
      "id": "79539457-80c2-4a52-a656-666b760ff808",
      "channel": "ai_platform_drift",
      "headline": "Cloudflare Workers Builds default tooling versions updated October 14",
      "what_changed": "Cloudflare Workers Builds updated default runtime and package manager versions effective October 14, 2026. Node.js moves from 24.18.0 to 24.21.0, Python from 3.13.3 to 3.14.8, Go from 1.24.3 to 1.27.2, Ruby from 3.4.7 to 3.4.11, Bun from 1.2.15 to 1.4.3, Yarn from 4.9.1 to 4.18.1, pip from 25.1.1 to 26.2.1, pipx from 1.7.1 to 1.17.2, Poetry from 2.1.3 to 2.4.3, and uv from 0.7.13 to 0.12.10. Projects with pinned versions are unaffected.",
      "why_matters": "Builds without pinned runtime or package manager versions will automatically use the new defaults, which may introduce breaking changes from minor version bumps (Python 3.13→3.14, Go 1.24→1.27) or dependency resolution differences from updated package managers. Existing builds may fail or behave differently after October 14.",
      "what_to_do": "Before October 14, 2026, pin runtime and package manager versions in your Workers project configuration if you have not already done so. Test builds with the new default versions in a staging environment to identify any breaking changes.",
      "severity": "action_needed",
      "action_type": "pin_or_freeze",
      "tags": [
        "api"
      ],
      "confidence": 0.85,
      "source_name": "Cloudflare developer changelog",
      "source_url": "https://developers.cloudflare.com/changelog/post/2026-10-14-workers-builds-default-tooling/",
      "published_at": "2026-10-15T11:33:42.3359+00:00",
      "corrected_at": null,
      "correction": null,
      "correction_cause": null,
      "url": "https://radar.trulysovereign.com/items/79539457-80c2-4a52-a656-666b760ff808",
      "affects": [
        {
          "id": "workers-builds",
          "type": "product",
          "label": "workers builds",
          "unmapped": true
        }
      ],
      "action_due": "2026-10-14",
      "time_to_correct": null
    },
    {
      "id": "27e51ce3-0c05-404e-bda5-fac39500f35b",
      "channel": "ai_platform_drift",
      "headline": "Cloudflare Access infrastructure apps now enforce 24-hour session limit",
      "what_changed": "Cloudflare Access infrastructure applications now enforce a configurable session duration, defaulting to 24 hours. Previously, sessions had no hard limit but were subject to Gateway connection limits at 10 hours. When the duration elapses, active SSH connections are closed and users must reconnect. The duration can be set via dashboard or API when creating or editing an application.",
      "why_matters": "Any SSH sessions through Cloudflare Access that run longer than 24 hours will now be forcibly terminated. Long-running maintenance tasks, database migrations, or persistent tunnels that previously worked will break mid-operation. If a target matches multiple infrastructure applications, the shortest configured duration applies, which may be less than 24 hours.",
      "what_to_do": "Audit your infrastructure applications for any SSH workflows that run longer than 24 hours—database migrations, long-running scripts, persistent tunnels. Either redesign them to complete within the limit or explicitly configure a longer session duration in the Cloudflare dashboard or API before they break.",
      "severity": "action_needed",
      "action_type": "verify_only",
      "tags": [
        "limits",
        "api"
      ],
      "confidence": 0.85,
      "source_name": "Cloudflare developer changelog",
      "source_url": "https://developers.cloudflare.com/changelog/post/2026-10-14-infrastructure-ssh-session-duration/",
      "published_at": "2026-10-15T11:33:29.437255+00:00",
      "corrected_at": null,
      "correction": null,
      "correction_cause": null,
      "url": "https://radar.trulysovereign.com/items/27e51ce3-0c05-404e-bda5-fac39500f35b",
      "affects": [
        {
          "id": "cloudflare-one",
          "type": "product",
          "label": "cloudflare one",
          "unmapped": true
        },
        {
          "id": "cloudflare-access",
          "type": "product",
          "label": "cloudflare access",
          "unmapped": true
        }
      ],
      "action_due": null,
      "time_to_correct": null
    },
    {
      "id": "f84cab2e-a7fe-42a8-92fb-94ba1c325bf5",
      "channel": "ai_platform_drift",
      "headline": "Cloudflare Audit Logs v2 now captures GET request view actions",
      "what_changed": "Cloudflare Audit Logs v2 now records view actions corresponding to GET requests for supported endpoints, effective 13 October 2026. The dashboard excludes these view actions by default with an \"Action type is not view\" filter, but they are always available through the API and Logpush without filtering.",
      "why_matters": "GET requests can generate high log volumes, potentially increasing storage costs and complicating log analysis if you consume audit logs via API or Logpush. If you process audit logs programmatically without filtering, your ingestion pipeline will now receive significantly more events.",
      "what_to_do": "Review your Audit Logs v2 API and Logpush configurations. If you consume logs programmatically, add filters to exclude view actions unless you specifically need GET request visibility for security investigations. Check whether increased log volume affects your storage budget or downstream processing capacity.",
      "severity": "worth_knowing",
      "action_type": "verify_only",
      "tags": [
        "api",
        "security"
      ],
      "confidence": 0.85,
      "source_name": "Cloudflare developer changelog",
      "source_url": "https://developers.cloudflare.com/changelog/post/2026-10-13-audit-logs-v2-view-actions/",
      "published_at": "2026-10-15T11:33:17.689991+00:00",
      "corrected_at": null,
      "correction": null,
      "correction_cause": null,
      "url": "https://radar.trulysovereign.com/items/f84cab2e-a7fe-42a8-92fb-94ba1c325bf5",
      "affects": [
        {
          "id": "audit-logs-v2",
          "type": "product",
          "label": "audit logs v2",
          "unmapped": true
        }
      ],
      "action_due": null,
      "time_to_correct": null
    },
    {
      "id": "5d6e6508-2ab6-430a-b535-bfb220e028d4",
      "channel": "security_advisory",
      "headline": "AWS S3 .NET encryption client padding oracle allows object decryption",
      "what_changed": "AWS published CVE-2026-110310 on 14 October 2026, disclosing a padding oracle vulnerability in the Amazon S3 Encryption Client for .NET versions 2.1.0 and later, 3.0.0-3.2.1, and 4.0.0-4.0.2. An attacker with read access to encrypted S3 objects can alter metadata to force PKCS#1 v1.5 padding, then use a Bleichenbacher attack to recover the RSA-wrapped envelope key and decrypt the object.",
      "why_matters": "Any S3 bucket using client-side encryption with the affected .NET SDK versions is vulnerable to decryption by anyone who can read the encrypted objects. The attacker does not need write access to the bucket itself, only the ability to modify object metadata and perform repeated decryption attempts against the padding oracle.",
      "what_to_do": "Identify all services using the Amazon S3 Encryption Client for .NET in the affected version ranges. Check AWS's security bulletin 2026-135-AWS for patched versions and upgrade immediately. If you cannot patch this week, audit S3 bucket policies to ensure encrypted objects are not readable by untrusted principals.",
      "severity": "action_needed",
      "action_type": "patch_now",
      "tags": [
        "security",
        "api"
      ],
      "confidence": 0.95,
      "source_name": "AWS security bulletins",
      "source_url": "https://aws.amazon.com/security/security-bulletins/rss/2026-135-aws/",
      "published_at": "2026-10-15T04:42:17.437641+00:00",
      "corrected_at": null,
      "correction": null,
      "correction_cause": null,
      "url": "https://radar.trulysovereign.com/items/5d6e6508-2ab6-430a-b535-bfb220e028d4",
      "affects": [
        {
          "id": "cve-2026-110310",
          "type": "cve",
          "label": "CVE-2026-110310"
        },
        {
          "id": "aws",
          "type": "provider",
          "label": "aws"
        },
        {
          "id": "nugetawssdk-s3",
          "type": "package",
          "label": "nuget:AWSSDK.S3",
          "unmapped": true
        }
      ],
      "action_due": null,
      "time_to_correct": null
    },
    {
      "id": "d0cfb2d1-3e60-4c60-83a1-b5f75fb9c775",
      "channel": "security_advisory",
      "headline": "CISA adds Cisco email gateway path traversal to KEV catalog",
      "what_changed": "CVE-2026-76519, a relative path traversal vulnerability in Cisco Secure Email Gateway, was added to CISA's Known Exploited Vulnerabilities catalog on 2026-10-14 with a remediation deadline of 2026-10-17.",
      "why_matters": "Active exploitation is confirmed — that is what KEV listing means — and email gateways sit at the perimeter with access to all inbound mail. A path traversal in this position can expose message content, configuration, or credentials.",
      "what_to_do": "Check your asset inventory for Cisco Secure Email Gateway instances by 2026-10-17. If you run it, apply Cisco's published mitigation immediately or discontinue use per BOD 26-04. Federal agencies must comply; private sector should treat the deadline as the window before widespread tooling.",
      "severity": "action_needed",
      "action_type": "verify_exposure",
      "tags": [
        "security"
      ],
      "confidence": 0.95,
      "source_name": "CISA Known Exploited Vulnerabilities",
      "source_url": "https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json",
      "published_at": "2026-10-14T21:44:53.506634+00:00",
      "corrected_at": null,
      "correction": null,
      "correction_cause": null,
      "url": "https://radar.trulysovereign.com/items/d0cfb2d1-3e60-4c60-83a1-b5f75fb9c775",
      "affects": [
        {
          "id": "cve-2026-76519",
          "type": "cve",
          "label": "CVE-2026-76519"
        },
        {
          "id": "cisco-secure-email-gateway",
          "type": "product",
          "label": "cisco secure email gateway",
          "unmapped": true
        }
      ],
      "action_due": "2026-10-17",
      "time_to_correct": null
    },
    {
      "id": "d10e2ab2-5110-4458-85d8-1e078221bbf7",
      "channel": "security_advisory",
      "headline": "CISA adds Ahsay AhsayCBS command injection to KEV catalog",
      "what_changed": "CVE-2026-105134, a command injection vulnerability in Ahsay AhsayCBS backup and recovery software, was added to CISA's Known Exploited Vulnerabilities catalog on 2026-10-14. The due date for federal agencies is 2026-10-17.",
      "why_matters": "This vulnerability is being actively exploited in the wild. Command injection flaws allow attackers to execute arbitrary commands on the server, typically leading to full system compromise. CISA only adds vulnerabilities to the KEV catalog when exploitation is confirmed.",
      "what_to_do": "Check if you run Ahsay AhsayCBS. If yes, apply vendor mitigations by 2026-10-17 per CISA BOD 26-04 requirements, or discontinue use if mitigations are unavailable. Prioritize internet-facing instances.",
      "severity": "action_needed",
      "action_type": "verify_exposure",
      "tags": [
        "security"
      ],
      "confidence": 0.95,
      "source_name": "CISA Known Exploited Vulnerabilities",
      "source_url": "https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json",
      "published_at": "2026-10-14T21:44:42.625116+00:00",
      "corrected_at": null,
      "correction": null,
      "correction_cause": null,
      "url": "https://radar.trulysovereign.com/items/d10e2ab2-5110-4458-85d8-1e078221bbf7",
      "affects": [
        {
          "id": "cve-2026-105134",
          "type": "cve",
          "label": "CVE-2026-105134"
        },
        {
          "id": "ahsaycbs",
          "type": "product",
          "label": "AhsayCBS",
          "unmapped": true
        }
      ],
      "action_due": "2026-10-17",
      "time_to_correct": null
    },
    {
      "id": "ea89b466-9dcb-4a91-9221-25f73d97e6d5",
      "channel": "security_advisory",
      "headline": "CISA adds Ahsay AhsayCBS authentication bypass, due 17 October",
      "what_changed": "CVE-2026-105133, an improper authentication vulnerability in Ahsay AhsayCBS backup software, was added to CISA's Known Exploited Vulnerabilities catalog on 14 October 2026 with a remediation deadline of 17 October 2026. CISA's required action references BOD 26-04 compliance and forensics triage requirements.",
      "why_matters": "AhsayCBS is backup and recovery infrastructure. An authentication bypass in this layer means an attacker can access or manipulate backup data without credentials, which defeats disaster recovery controls and enables ransomware operators to destroy the last line of defense before encrypting production systems.",
      "what_to_do": "Confirm whether you run AhsayCBS in any environment by 17 October. If present, apply vendor mitigations per CISA BOD 26-04 or discontinue use if no mitigation exists. If the product is internet-exposed, prioritize forensic triage per CISA's requirements to determine whether exploitation has already occurred.",
      "severity": "action_needed",
      "action_type": "verify_exposure",
      "tags": [
        "security"
      ],
      "confidence": 0.85,
      "source_name": "CISA Known Exploited Vulnerabilities",
      "source_url": "https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json",
      "published_at": "2026-10-14T21:44:31.407241+00:00",
      "corrected_at": null,
      "correction": null,
      "correction_cause": null,
      "url": "https://radar.trulysovereign.com/items/ea89b466-9dcb-4a91-9221-25f73d97e6d5",
      "affects": [
        {
          "id": "cve-2026-105133",
          "type": "cve",
          "label": "CVE-2026-105133"
        },
        {
          "id": "ahsaycbs",
          "type": "product",
          "label": "AhsayCBS",
          "unmapped": true
        }
      ],
      "action_due": "2026-10-17",
      "time_to_correct": null
    },
    {
      "id": "bcbfafa5-b378-4158-9569-baaeb6e6f6ec",
      "channel": "security_advisory",
      "headline": "CISA adds PAN-OS code injection CVE-2026-0322 to KEV catalog",
      "what_changed": "CISA added CVE-2026-0322 to the Known Exploited Vulnerabilities catalog on 2026-10-14. The vulnerability is a code injection flaw in Palo Alto Networks PAN-OS. The due date for federal agencies is 2026-10-17. CISA's required action references BOD 26-04 compliance and forensics triage requirements.",
      "why_matters": "Inclusion in the KEV catalog means this vulnerability is being actively exploited in the wild. Code injection in PAN-OS — a firewall and network security platform — gives attackers the ability to execute arbitrary code on infrastructure that sits at the network perimeter. The three-day window indicates CISA considers the threat immediate.",
      "what_to_do": "Check your PAN-OS inventory against the affected versions in Palo Alto's advisory for CVE-2026-0322. If exposed, apply vendor mitigations by 2026-10-17. If you provide cloud services using PAN-OS, follow BOD 26-04 patching timelines or discontinue use if mitigations are unavailable.",
      "severity": "action_needed",
      "action_type": "mitigate",
      "tags": [
        "security"
      ],
      "confidence": 0.95,
      "source_name": "CISA Known Exploited Vulnerabilities",
      "source_url": "https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json",
      "published_at": "2026-10-14T21:44:19.54296+00:00",
      "corrected_at": null,
      "correction": null,
      "correction_cause": null,
      "url": "https://radar.trulysovereign.com/items/bcbfafa5-b378-4158-9569-baaeb6e6f6ec",
      "affects": [
        {
          "id": "cve-2026-0322",
          "type": "cve",
          "label": "CVE-2026-0322"
        },
        {
          "id": "pan-os",
          "type": "product",
          "label": "PAN-OS",
          "unmapped": true
        },
        {
          "id": "palo-alto-networks",
          "type": "provider",
          "label": "Palo Alto Networks",
          "unmapped": true
        }
      ],
      "action_due": "2026-10-17",
      "time_to_correct": null
    },
    {
      "id": "91a415f7-5dc5-4cf0-9398-f115244b3a53",
      "channel": "ai_platform_drift",
      "headline": "DeepSeek Flash Latest prompt pricing drops 21.4%",
      "what_changed": "OpenRouter reduced the prompt token price for ~deepseek/deepseek-flash-latest from $0.02016 to $0.01584 per 1M tokens, effective as of the 14 October 2026 catalogue update. Completion pricing remains $0.891 per 1M tokens.",
      "why_matters": "Using the captured base rates for ~deepseek/deepseek-flash-latest, 100M prompt tokens per day cost $2.016 before and $1.584 after, excluding all other charges. Any cost forecast or budget allocation based on the old rate is now overstated by 21.4% on the prompt component.",
      "what_to_do": "Rerun cost projections using $0.01584 per 1M prompt tokens and update any budget documents or dashboards that reference the old rate. If you track per-model spend, verify October actuals reflect the new pricing.",
      "severity": "worth_knowing",
      "action_type": "budget",
      "tags": [
        "pricing",
        "model"
      ],
      "confidence": 0.95,
      "source_name": "OpenRouter model catalogue",
      "source_url": "https://openrouter.ai/api/v1/models",
      "published_at": "2026-10-14T21:44:07.425223+00:00",
      "corrected_at": null,
      "correction": null,
      "correction_cause": null,
      "url": "https://radar.trulysovereign.com/items/91a415f7-5dc5-4cf0-9398-f115244b3a53",
      "affects": [
        {
          "id": "deepseek/deepseek-flash-latest",
          "type": "model",
          "label": "~deepseek/deepseek-flash-latest",
          "unmapped": true
        },
        {
          "id": "openrouter",
          "type": "provider",
          "label": "openrouter"
        }
      ],
      "action_due": null,
      "time_to_correct": null
    },
    {
      "id": "d136e4d0-e606-4065-8ff5-ef5811e41c9b",
      "channel": "ai_platform_drift",
      "headline": "Mistral Small 3.2 24B pricing reduced 20% on OpenRouter",
      "what_changed": "OpenRouter reduced pricing for mistralai/mistral-small-3.2-24b-instruct: completion tokens from $0.25 to $0.20 per 1M tokens, prompt tokens from $0.09375 to $0.075 per 1M tokens, both effective as of the catalogue update on 14 October 2026.",
      "why_matters": "Using the captured base rates for mistralai/mistral-small-3.2-24b-instruct, 100M completion tokens per 30-day month cost $25.00 before and $20.00 after, excluding all other charges. To estimate the saved completion cost for mistralai/mistral-small-3.2-24b-instruct in dollars, multiply completion token volume by 0.05 and divide by 1,000,000, using the captured base-rate difference in dollars per 1M tokens.",
      "what_to_do": "Pull your last 30 days of token usage for this model from OpenRouter's API or dashboard, apply the formula above to calculate actual savings, and update your cost forecasts if this model represents material spend.",
      "severity": "worth_knowing",
      "action_type": "budget",
      "tags": [
        "pricing",
        "model"
      ],
      "confidence": 0.95,
      "source_name": "OpenRouter model catalogue",
      "source_url": "https://openrouter.ai/api/v1/models",
      "published_at": "2026-10-14T21:43:50.263851+00:00",
      "corrected_at": null,
      "correction": null,
      "correction_cause": null,
      "url": "https://radar.trulysovereign.com/items/d136e4d0-e606-4065-8ff5-ef5811e41c9b",
      "affects": [
        {
          "id": "mistralai/mistral-small-3-2-24b-instruct",
          "type": "model",
          "label": "mistralai/mistral-small-3.2-24b-instruct",
          "unmapped": true
        },
        {
          "id": "openrouter",
          "type": "provider",
          "label": "openrouter"
        }
      ],
      "action_due": null,
      "time_to_correct": null
    },
    {
      "id": "3db7f553-2da0-4b99-85f8-bc6cb317f11d",
      "channel": "ai_platform_drift",
      "headline": "DeepSeek V4.1 Flash prompt pricing reduced 21% on OpenRouter",
      "what_changed": "OpenRouter reduced the prompt token price for deepseek/deepseek-v4.1-flash from $0.02016 to $0.01584 per 1M tokens, a 21.4% decrease. Completion pricing remains $0.891 per 1M tokens. The change appeared in the model catalogue as of 2026-10-14.",
      "why_matters": "Using the captured base rates for deepseek/deepseek-v4.1-flash, 100M prompt tokens per day cost $2.016 before and $1.584 after, excluding all other charges. Applications with high prompt volume will see immediate cost reduction without code changes.",
      "what_to_do": "Pull current month-to-date usage for deepseek/deepseek-v4.1-flash from OpenRouter, calculate the savings using the new rate, and update your cost forecasts. To estimate the saved prompt cost for deepseek/deepseek-v4.1-flash in dollars, multiply prompt token volume by 0.00432 and divide by 1,000,000, using the captured base-rate difference in dollars per 1M tokens.",
      "severity": "worth_knowing",
      "action_type": "budget",
      "tags": [
        "pricing",
        "model"
      ],
      "confidence": 0.95,
      "source_name": "OpenRouter model catalogue",
      "source_url": "https://openrouter.ai/api/v1/models",
      "published_at": "2026-10-14T21:43:40.317092+00:00",
      "corrected_at": null,
      "correction": null,
      "correction_cause": null,
      "url": "https://radar.trulysovereign.com/items/3db7f553-2da0-4b99-85f8-bc6cb317f11d",
      "affects": [
        {
          "id": "deepseek-v4.1-flash",
          "type": "model",
          "label": "deepseek/deepseek-v4.1-flash"
        },
        {
          "id": "openrouter",
          "type": "provider",
          "label": "openrouter"
        },
        {
          "id": "deepseek",
          "type": "provider",
          "label": "deepseek"
        }
      ],
      "action_due": null,
      "time_to_correct": null
    },
    {
      "id": "67e05f50-d778-4376-974f-35fb151fdcaf",
      "channel": "ai_platform_drift",
      "headline": "Cloudflare WAF adds emergency rule blocking active RCE exploit",
      "what_changed": "Cloudflare released an emergency WAF update on 2026-10-14 adding managed rule fd1bf420 to block a critical remote code execution vulnerability in popular web frameworks. The rule blocks malicious input containing invalid path sequences that allow attackers to execute arbitrary system commands with web server privileges. The vulnerability is under active exploitation.",
      "why_matters": "If you use Cloudflare WAF in blocking mode, this rule is now active and may block legitimate requests that contain path sequences matching the RCE pattern. If you run the WAF in log-only mode or have it disabled, your application remains exposed to an actively exploited RCE vulnerability that grants attackers command execution at web server privilege level.",
      "what_to_do": "Check your WAF logs for rule fd1bf420 hits in the past 24 hours to identify any blocked legitimate traffic. If you find false positives, create an exception for specific paths or request patterns. If your WAF is not in blocking mode, enable it or verify your application is patched against path traversal RCE vulnerabilities.",
      "severity": "action_needed",
      "action_type": "verify_only",
      "tags": [
        "security",
        "api"
      ],
      "confidence": 0.95,
      "source_name": "Cloudflare developer changelog",
      "source_url": "https://developers.cloudflare.com/changelog/post/2026-10-14-emergency-waf-release/",
      "published_at": "2026-10-14T17:14:28.201245+00:00",
      "corrected_at": null,
      "correction": null,
      "correction_cause": null,
      "url": "https://radar.trulysovereign.com/items/67e05f50-d778-4376-974f-35fb151fdcaf",
      "affects": [
        {
          "id": "cloudflare-waf",
          "type": "product",
          "label": "cloudflare waf",
          "unmapped": true
        }
      ],
      "action_due": null,
      "time_to_correct": null
    },
    {
      "id": "2fc4875b-00de-47c3-b58e-883d213e40eb",
      "channel": "security_advisory",
      "headline": "Application Integration privilege escalation patched August 27",
      "what_changed": "Google patched CVE-2026-85298 in Application Integration on August 27, 2026. The vulnerability allowed authenticated users to escalate privileges and impersonate service accounts through incorrect authorization in AuthConfig validation and integration execution runtime.",
      "why_matters": "An authenticated attacker could have gained service account credentials in your Google Cloud project, bypassing intended access controls. Google rates this critical severity.",
      "what_to_do": "Verify that no unauthorized service account activity occurred between your first use of Application Integration and August 27, 2026. Review Cloud Audit Logs for unexpected impersonation events or privilege escalations in projects using Application Integration.",
      "severity": "action_needed",
      "action_type": "verify_exposure",
      "tags": [
        "security"
      ],
      "confidence": 0.85,
      "source_name": "Google Cloud security bulletins",
      "source_url": "https://docs.cloud.google.com/support/bulletins/index#gcp-2026-068",
      "published_at": "2026-10-14T17:13:41.614127+00:00",
      "corrected_at": "2026-10-15T01:38:39.695108+00:00",
      "correction": "CORRECTION: Google's GCP-2026-068 bulletin states that CVE-2026-85298 in Application Integration was patched on August 27, 2026 and that no customer action is required. RADAR's ACTION NEEDED / VERIFY_EXPOSURE framing, the triage claim that platform leads must verify patch status, and the mandatory historical Cloud Audit Logs review in WHAT TO DO went beyond the source and should not be treated as Google requirements. Google requires no customer patch-status verification or historical log review for this bulletin. Optional RADAR defense-in-depth advice: teams with a specific concern about past service account misuse may choose to review relevant Cloud Audit Logs under their own security procedures. This optional advice is RADAR's, not Google's. The original article and source evidence are retained below as the historical record.",
      "correction_cause": "writer_overreach",
      "url": "https://radar.trulysovereign.com/items/2fc4875b-00de-47c3-b58e-883d213e40eb",
      "affects": [
        {
          "id": "application-integration",
          "type": "product",
          "label": "application integration",
          "unmapped": true
        },
        {
          "id": "cve-2026-85298",
          "type": "cve",
          "label": "CVE-2026-85298"
        },
        {
          "id": "google-cloud",
          "type": "provider",
          "label": "google cloud"
        }
      ],
      "action_due": null,
      "time_to_correct": "8h 25m"
    },
    {
      "id": "b69cf293-e1e4-4eb3-adaf-65477e9eccee",
      "channel": "ai_platform_drift",
      "headline": "Azure Foundry removed 13 Fireworks model retirement dates from inline table",
      "what_changed": "The retirement schedule page removed an inline table listing 13 Fireworks models (FW-DeepSeek-V3.1, FW-DeepSeek-V3.2, FW-GLM-4.7, FW-GLM-5, FW-GLM-5.1, FW-GPT-OSS-120B, FW-Kimi-K2-Instruct-0905, FW-Kimi-K2-Thinking, FW-Kimi-K2.5, FW-MiniMax-M2.5, FW-Qwen3-14B, FW-Qwen3.5-122B-A10B, FW-Qwen3.5-397B-A17B) all with 2027-07-01 retirement dates. The page now links to an external Fireworks model catalog for pay-per-token lifecycle status and retirement dates.",
      "why_matters": "If you are using any of these 13 Fireworks models, you no longer have a documented retirement date on the Azure Foundry schedule page. The 2027-07-01 dates may still be valid but are now maintained elsewhere, requiring you to check a separate catalog to confirm whether the retirement timeline has changed or remains the same.",
      "what_to_do": "Grep your codebase and deployment configs for any of the 13 model identifiers listed above. For each one you find, visit the linked Fireworks model catalog page to verify the current retirement date and confirm it is still 2027-07-01. If the date has changed or the model is no longer listed, schedule migration work accordingly.",
      "severity": "worth_knowing",
      "action_type": "verify_only",
      "tags": [
        "model",
        "deprecation"
      ],
      "confidence": 0.85,
      "source_name": "Azure Foundry model retirement schedule",
      "source_url": "https://learn.microsoft.com/en-us/azure/foundry/openai/concepts/model-retirement-schedule",
      "published_at": "2026-10-14T11:55:03.063825+00:00",
      "corrected_at": null,
      "correction": null,
      "correction_cause": null,
      "url": "https://radar.trulysovereign.com/items/b69cf293-e1e4-4eb3-adaf-65477e9eccee",
      "affects": [
        {
          "id": "fireworks",
          "type": "provider",
          "label": "fireworks",
          "unmapped": true
        },
        {
          "id": "fw-deepseek-v3-1",
          "type": "model",
          "label": "FW-DeepSeek-V3.1",
          "unmapped": true
        },
        {
          "id": "fw-deepseek-v3-2",
          "type": "model",
          "label": "FW-DeepSeek-V3.2",
          "unmapped": true
        },
        {
          "id": "fw-glm-4-7",
          "type": "model",
          "label": "FW-GLM-4.7",
          "unmapped": true
        },
        {
          "id": "fw-glm-5",
          "type": "model",
          "label": "FW-GLM-5",
          "unmapped": true
        },
        {
          "id": "fw-glm-5-1",
          "type": "model",
          "label": "FW-GLM-5.1",
          "unmapped": true
        },
        {
          "id": "fw-gpt-oss-120b",
          "type": "model",
          "label": "FW-GPT-OSS-120B",
          "unmapped": true
        },
        {
          "id": "fw-kimi-k2-instruct-0905",
          "type": "model",
          "label": "FW-Kimi-K2-Instruct-0905",
          "unmapped": true
        },
        {
          "id": "fw-kimi-k2-thinking",
          "type": "model",
          "label": "FW-Kimi-K2-Thinking",
          "unmapped": true
        },
        {
          "id": "fw-kimi-k2-5",
          "type": "model",
          "label": "FW-Kimi-K2.5",
          "unmapped": true
        },
        {
          "id": "fw-minimax-m2-5",
          "type": "model",
          "label": "FW-MiniMax-M2.5",
          "unmapped": true
        },
        {
          "id": "fw-qwen3-14b",
          "type": "model",
          "label": "FW-Qwen3-14B",
          "unmapped": true
        }
      ],
      "action_due": null,
      "time_to_correct": null
    },
    {
      "id": "d6a5c992-9145-4e15-86a5-ef8edb7ce804",
      "channel": "ai_platform_drift",
      "headline": "DeepSeek V4 Pro 0813 pricing cut 50% on OpenRouter",
      "what_changed": "OpenRouter reduced pricing for deepseek/deepseek-v4-pro-0813 by 50% across both token types. The captured prompt base rate changed from $1.32 to $0.66 per 1M tokens. The captured completion base rate changed from $3.96 to $1.98 per 1M tokens. The change appeared in the model catalogue as of 2026-10-14.",
      "why_matters": "Using the captured base rates for deepseek/deepseek-v4-pro-0813, 100M completion tokens per day cost $396.00 before and $198.00 after, excluding all other charges. Using the captured base rates for deepseek/deepseek-v4-pro-0813, 100M prompt tokens per day cost $132.00 before and $66.00 after, excluding all other charges. Any application routing requests to this model through OpenRouter will see immediate cost reduction without code changes.",
      "what_to_do": "Pull current month-to-date token usage for deepseek/deepseek-v4-pro-0813 from OpenRouter logs, apply the 50% reduction to forecast October spend, and update Q4 budget projections if this model represents material API cost.",
      "severity": "worth_knowing",
      "action_type": "budget",
      "tags": [
        "pricing",
        "model"
      ],
      "confidence": 0.95,
      "source_name": "OpenRouter model catalogue",
      "source_url": "https://openrouter.ai/api/v1/models",
      "published_at": "2026-10-14T04:56:30.753141+00:00",
      "corrected_at": null,
      "correction": null,
      "correction_cause": null,
      "url": "https://radar.trulysovereign.com/items/d6a5c992-9145-4e15-86a5-ef8edb7ce804",
      "affects": [
        {
          "id": "openrouter",
          "type": "provider",
          "label": "openrouter"
        },
        {
          "id": "deepseek-v4-pro-0813",
          "type": "model",
          "label": "deepseek/deepseek-v4-pro-0813",
          "unmapped": true
        },
        {
          "id": "deepseek",
          "type": "provider",
          "label": "deepseek"
        }
      ],
      "action_due": null,
      "time_to_correct": null
    },
    {
      "id": "339057c1-aec4-4349-b368-24046eb20821",
      "channel": "ai_platform_drift",
      "headline": "Cloudflare Workers connect() handler now production-ready without experimental flag",
      "what_changed": "Cloudflare Workers can now export a connect() handler without enabling the experimental compatibility flag. Previously, this handler required an experimental flag that could not be enabled in production environments. The change was effective 18 August 2026.",
      "why_matters": "Workers using connect() handlers for TCP socket communication over service bindings can now run in production. Code previously blocked from production deployment due to the experimental flag requirement is now deployable without modification.",
      "what_to_do": "If you have Workers with connect() handlers currently restricted to non-production environments, remove the experimental compatibility flag from your wrangler.toml configuration and deploy to production.",
      "severity": "worth_knowing",
      "action_type": "verify_only",
      "tags": [
        "api"
      ],
      "confidence": 0.85,
      "source_name": "Cloudflare developer changelog",
      "source_url": "https://developers.cloudflare.com/changelog/post/2026-08-18-connect-handler/",
      "published_at": "2026-10-13T22:49:17.736813+00:00",
      "corrected_at": null,
      "correction": null,
      "correction_cause": null,
      "url": "https://radar.trulysovereign.com/items/339057c1-aec4-4349-b368-24046eb20821",
      "affects": [
        {
          "id": "cloudflare-workers",
          "type": "product",
          "label": "cloudflare workers",
          "unmapped": true
        }
      ],
      "action_due": null,
      "time_to_correct": null
    },
    {
      "id": "bb1277fe-480c-4c08-bf1d-86148c7cf3b3",
      "channel": "security_advisory",
      "headline": "CISA adds Windows command injection CVE to KEV catalog",
      "what_changed": "CVE-2026-96951, a command injection vulnerability in Microsoft Windows, was added to CISA's Known Exploited Vulnerabilities catalog on 2026-10-13. CISA set a due date of 2026-10-16 for federal agencies to apply mitigations per BOD 26-04.",
      "why_matters": "Command injection vulnerabilities allow remote code execution. CISA only adds vulnerabilities to the KEV catalog when they have evidence of active exploitation in the wild. The three-day window indicates urgency.",
      "what_to_do": "Check your Windows systems against CVE-2026-96951 today. If exposed, apply Microsoft's published mitigations by 2026-10-16. If you cannot mitigate, isolate or disconnect affected systems until you can patch.",
      "severity": "action_needed",
      "action_type": "mitigate",
      "tags": [
        "security"
      ],
      "confidence": 0.95,
      "source_name": "CISA Known Exploited Vulnerabilities",
      "source_url": "https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json",
      "published_at": "2026-10-13T22:48:48.816158+00:00",
      "corrected_at": null,
      "correction": null,
      "correction_cause": null,
      "url": "https://radar.trulysovereign.com/items/bb1277fe-480c-4c08-bf1d-86148c7cf3b3",
      "affects": [
        {
          "id": "cve-2026-96951",
          "type": "cve",
          "label": "CVE-2026-96951"
        },
        {
          "id": "microsoft",
          "type": "provider",
          "label": "microsoft",
          "unmapped": true
        },
        {
          "id": "windows",
          "type": "product",
          "label": "windows",
          "unmapped": true
        }
      ],
      "action_due": "2026-10-16",
      "time_to_correct": null
    },
    {
      "id": "069e8217-ab8b-4775-a826-f440e676c8bb",
      "channel": "security_advisory",
      "headline": "CISA adds Ivanti Connect Secure auth bypass to KEV, patch due October 16",
      "what_changed": "CVE-2026-104935, an authentication bypass vulnerability in Ivanti Connect Secure, was added to CISA's Known Exploited Vulnerabilities catalog on October 13, 2026. Federal agencies must apply mitigations by October 16, 2026 per Binding Operational Directive 26-04.",
      "why_matters": "This is a known-exploited authentication bypass in VPN gateway software. An attacker can gain unauthorized access without valid credentials. CISA only adds vulnerabilities to KEV when exploitation is confirmed in the wild, meaning active threat actors are already using this.",
      "what_to_do": "Check your Ivanti Connect Secure inventory against the affected versions in Ivanti's advisory. If exposed, apply the vendor's mitigations by October 16 or disconnect the system. Run CISA's forensics triage to confirm you were not already compromised.",
      "severity": "action_needed",
      "action_type": "mitigate",
      "tags": [
        "security"
      ],
      "confidence": 0.95,
      "source_name": "CISA Known Exploited Vulnerabilities",
      "source_url": "https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json",
      "published_at": "2026-10-13T22:48:38.597325+00:00",
      "corrected_at": null,
      "correction": null,
      "correction_cause": null,
      "url": "https://radar.trulysovereign.com/items/069e8217-ab8b-4775-a826-f440e676c8bb",
      "affects": [
        {
          "id": "cve-2026-104935",
          "type": "cve",
          "label": "CVE-2026-104935"
        },
        {
          "id": "ivanti-connect-secure",
          "type": "product",
          "label": "ivanti connect secure",
          "unmapped": true
        }
      ],
      "action_due": "2026-10-16",
      "time_to_correct": null
    },
    {
      "id": "3458b668-ad4e-4ecc-a015-000e8b0f6242",
      "channel": "ai_platform_drift",
      "headline": "Gemini 4 Argon now available in GitHub Copilot",
      "what_changed": "Google's Gemini 4 Argon model is now generally available in GitHub Copilot for Pro+, Max, Business, and Enterprise users across 8 IDEs and tools (VS Code, Visual Studio, JetBrains, Xcode, Eclipse, Copilot CLI, coding agent, and Copilot app). The model is billed at provider list pricing under usage-based billing. Rollout is gradual. Enterprise and Business administrators can control access through the model policy in Copilot settings; new models are enabled by default unless an administrator has disabled the global default or explicitly blocks this model.",
      "why_matters": "This adds a new billable model to your Copilot deployment that will be automatically enabled unless your administrator has changed the default model enablement policy. Usage will appear on your bill at Google's list pricing rates, separate from your Copilot subscription cost.",
      "what_to_do": "Check your Copilot settings model policy to confirm whether Gemini 4 Argon is enabled. If you are on usage-based billing and want to control costs, either disable this model explicitly or turn off automatic enablement for new models before users select it.",
      "severity": "worth_knowing",
      "action_type": "verify_only",
      "tags": [
        "model",
        "pricing"
      ],
      "confidence": 0.85,
      "source_name": "GitHub Copilot changelog",
      "source_url": "https://github.blog/changelog/2026-10-13-gemini-4-argon-in-github-copilot",
      "published_at": "2026-10-13T22:48:25.429378+00:00",
      "corrected_at": null,
      "correction": null,
      "correction_cause": null,
      "url": "https://radar.trulysovereign.com/items/3458b668-ad4e-4ecc-a015-000e8b0f6242",
      "affects": [
        {
          "id": "gemini-4-argon",
          "type": "model",
          "label": "gemini-4-argon",
          "unmapped": true
        },
        {
          "id": "google-cloud",
          "type": "provider",
          "label": "google"
        },
        {
          "id": "github-copilot",
          "type": "product",
          "label": "github copilot",
          "unmapped": true
        }
      ],
      "action_due": null,
      "time_to_correct": null
    },
    {
      "id": "8d4c3cb5-b7fd-4048-b98e-3e89bf5fcf0e",
      "channel": "ai_platform_drift",
      "headline": "GitHub Copilot adds forced policy refresh and minimum version enforcement",
      "what_changed": "GitHub Copilot now supports a forceRemoteSettingsRefresh setting that requires clients (CLI, VS Code, GitHub Copilot app) to retrieve current server-managed settings at startup instead of using cached policy. If the client cannot confirm current policy, it fails closed and does not start. Additionally, the sandbox key now enforces a minimum client version requirement—clients pinned to older versions must update to continue using Copilot.",
      "why_matters": "Clients that cannot reach GitHub's servers at startup will fail to start Copilot entirely when this setting is enabled, breaking workflows that previously worked offline or during service disruptions. Teams that pin client versions for stability will be forced to update when the sandbox key is deployed, potentially breaking CI/CD pipelines or developer environments that depend on specific Copilot versions.",
      "what_to_do": "Check whether your enterprise admin has enabled forceRemoteSettingsRefresh in your managed settings configuration. If your team pins Copilot client versions, identify which environments use the sandbox capability and test the latest client versions before the minimum version requirement is enforced in your organization's policy.",
      "severity": "action_needed",
      "action_type": "verify_only",
      "tags": [
        "security",
        "api"
      ],
      "confidence": 0.85,
      "source_name": "GitHub Copilot changelog",
      "source_url": "https://github.blog/changelog/2026-10-13-enterprise-managed-settings-enforcement-updates",
      "published_at": "2026-10-13T22:48:12.338677+00:00",
      "corrected_at": null,
      "correction": null,
      "correction_cause": null,
      "url": "https://radar.trulysovereign.com/items/8d4c3cb5-b7fd-4048-b98e-3e89bf5fcf0e",
      "affects": [
        {
          "id": "github-copilot",
          "type": "product",
          "label": "github copilot",
          "unmapped": true
        }
      ],
      "action_due": null,
      "time_to_correct": null
    },
    {
      "id": "715041e5-2022-4160-bd4a-8daf1758ab4b",
      "channel": "ai_platform_drift",
      "headline": "Google Gemini 4 Argon batch variant added to OpenRouter",
      "what_changed": "OpenRouter added google/gemini-4-argon:batch to its model catalogue on 13 October 2026. Pricing is $0.000001/token prompt and $0.000005/token completion. Context window is 1,048,576 tokens with max completion tokens of 943,718.",
      "why_matters": "Batch processing is typically offered at lower rates than synchronous inference. If you are running high-volume Gemini 4 Argon workloads through OpenRouter, this variant may reduce costs for jobs that can tolerate asynchronous execution.",
      "what_to_do": "Compare your current Gemini 4 Argon usage pattern against batch pricing. If you have workloads that do not require immediate responses, test the batch endpoint to measure latency and cost savings.",
      "severity": "worth_knowing",
      "action_type": "verify_only",
      "tags": [
        "model",
        "pricing"
      ],
      "confidence": 0.75,
      "source_name": "OpenRouter model catalogue",
      "source_url": "https://openrouter.ai/api/v1/models",
      "published_at": "2026-10-13T22:47:43.645184+00:00",
      "corrected_at": null,
      "correction": null,
      "correction_cause": null,
      "url": "https://radar.trulysovereign.com/items/715041e5-2022-4160-bd4a-8daf1758ab4b",
      "affects": [
        {
          "id": "gemini-4-argonbatch",
          "type": "model",
          "label": "google/gemini-4-argon:batch",
          "unmapped": true
        },
        {
          "id": "google-cloud",
          "type": "provider",
          "label": "google"
        }
      ],
      "action_due": null,
      "time_to_correct": null
    },
    {
      "id": "c7622e25-745c-4854-901f-467a60ba35e0",
      "channel": "ai_platform_drift",
      "headline": "Google Gemini 4 Argon added to OpenRouter catalogue",
      "what_changed": "OpenRouter added google/gemini-4-argon to its model catalogue on 2026-10-13. Pricing is $0.000002 per prompt token and $0.00001 per completion token. Context window is 1,048,576 tokens with a maximum completion length of 65,536 tokens.",
      "why_matters": "This model is now available for routing through OpenRouter's unified API. The pricing structure and token limits define the cost and capability envelope for applications that route to it.",
      "what_to_do": "If you use OpenRouter's model routing or selection logic, verify whether google/gemini-4-argon now appears in your available model set and whether its pricing fits your budget constraints.",
      "severity": "fyi",
      "action_type": "verify_only",
      "tags": [
        "model",
        "pricing"
      ],
      "confidence": 0.85,
      "source_name": "OpenRouter model catalogue",
      "source_url": "https://openrouter.ai/api/v1/models",
      "published_at": "2026-10-13T22:47:33.753007+00:00",
      "corrected_at": null,
      "correction": null,
      "correction_cause": null,
      "url": "https://radar.trulysovereign.com/items/c7622e25-745c-4854-901f-467a60ba35e0",
      "affects": [
        {
          "id": "gemini-4-argon",
          "type": "model",
          "label": "google/gemini-4-argon",
          "unmapped": true
        },
        {
          "id": "openrouter",
          "type": "provider",
          "label": "openrouter"
        },
        {
          "id": "google-cloud",
          "type": "provider",
          "label": "google-cloud"
        }
      ],
      "action_due": null,
      "time_to_correct": null
    },
    {
      "id": "c7e69b5c-4fb0-4231-96b7-96b4afb173c0",
      "channel": "ai_platform_drift",
      "headline": "GPT-4o, GPT-4.1 series retired January 14, 2027",
      "what_changed": "On October 14, 2026, OpenAI announced the retirement of GPT-4o (gpt-4o-2024-08-06, gpt-4o-2024-11-20), GPT-4o mini (gpt-4o-mini-2024-07-18), GPT-4.1 (gpt-4.1-2025-04-14), and GPT-4.1 mini (gpt-4.1-mini-2025-04-14), effective January 14, 2027. The recommended replacement for all four models is gpt-6-luna. Fine-tuned versions of these models follow the same shutdown schedule. OpenAI also added a shutdown_date field to the List models endpoint (GET /v1/models) for programmatic monitoring of model retirements.",
      "why_matters": "Any application calling these model identifiers will fail after January 14, 2027. Fine-tuned models built on these base models will also stop working on that date. If you are using model pinning or have hardcoded these identifiers in configuration, deployment pipelines, or client code, those references will break in three months.",
      "what_to_do": "Grep your codebase and configuration for the six model identifiers listed above (gpt-4o-2024-08-06, gpt-4o-2024-11-20, gpt-4o-mini-2024-07-18, gpt-4.1-2025-04-14, gpt-4.1-mini-2025-04-14, and any fine-tuned model IDs derived from them). Replace them with gpt-6-luna and test before January 14, 2027. If you need ongoing monitoring, call GET /v1/models and check the shutdown_date field for each model you depend on.",
      "severity": "action_needed",
      "action_type": "migrate",
      "tags": [
        "deprecation",
        "model",
        "api"
      ],
      "confidence": 0.95,
      "source_name": "OpenAI deprecations",
      "source_url": "https://developers.openai.com/api/docs/deprecations",
      "published_at": "2026-10-13T22:47:20.533046+00:00",
      "corrected_at": null,
      "correction": null,
      "correction_cause": null,
      "url": "https://radar.trulysovereign.com/items/c7e69b5c-4fb0-4231-96b7-96b4afb173c0",
      "affects": [
        {
          "id": "openai",
          "type": "provider",
          "label": "openai"
        },
        {
          "id": "gpt-4o-2024-08-06",
          "type": "model",
          "label": "gpt-4o-2024-08-06",
          "unmapped": true
        },
        {
          "id": "gpt-4o-2024-11-20",
          "type": "model",
          "label": "gpt-4o-2024-11-20",
          "unmapped": true
        },
        {
          "id": "gpt-4o-mini-2024-07-18",
          "type": "model",
          "label": "gpt-4o-mini-2024-07-18",
          "unmapped": true
        },
        {
          "id": "gpt-4-1-2025-04-14",
          "type": "model",
          "label": "gpt-4.1-2025-04-14",
          "unmapped": true
        },
        {
          "id": "gpt-4-1-mini-2025-04-14",
          "type": "model",
          "label": "gpt-4.1-mini-2025-04-14",
          "unmapped": true
        },
        {
          "id": "gpt-6-luna",
          "type": "model",
          "label": "gpt-6-luna"
        }
      ],
      "action_due": "2027-01-14",
      "time_to_correct": null
    },
    {
      "id": "01ffb6ea-dbe3-4884-a239-aef3cd36c465",
      "channel": "ai_platform_drift",
      "headline": "Cloudflare Agents SDK adds persistent browser with session state",
      "what_changed": "Cloudflare Agents SDK v0.28.0 introduces browserTool, which provides a Browser Run browser that persists tabs, cookies, and login sessions across agent turns. The browser uses Chrome DevTools Protocol, has a 10-minute idle timeout, and requires new bindings (BROWSER, LOADER) plus Lifecycle and registry setup in Durable Objects. Sessions restart fresh if they expire or crash, with restarted: true reported to the tool.",
      "why_matters": "Agents can now maintain browser state across multiple interactions without re-authenticating or losing navigation context. This enables multi-step workflows like logging into a service on turn one and performing actions on turn three, but session loss after the 10-minute timeout will break workflows that depend on preserved state.",
      "what_to_do": "If you build agents that interact with authenticated web services or multi-page workflows, upgrade to Agents SDK v0.28.0 or later, add the BROWSER and LOADER bindings to your wrangler.toml, and implement the Browser and Lifecycle setup shown in the changelog. Test your agent's behavior when restarted: true occurs to handle session expiration gracefully.",
      "severity": "worth_knowing",
      "action_type": "verify_only",
      "tags": [
        "api",
        "model"
      ],
      "confidence": 0.85,
      "source_name": "Cloudflare developer changelog",
      "source_url": "https://developers.cloudflare.com/changelog/post/2026-10-13-persistent-browser/",
      "published_at": "2026-10-13T14:16:04.4133+00:00",
      "corrected_at": null,
      "correction": null,
      "correction_cause": null,
      "url": "https://radar.trulysovereign.com/items/01ffb6ea-dbe3-4884-a239-aef3cd36c465",
      "affects": [
        {
          "id": "cloudflare-agents-sdk",
          "type": "product",
          "label": "cloudflare agents sdk",
          "unmapped": true
        },
        {
          "id": "browser-run",
          "type": "product",
          "label": "browser run",
          "unmapped": true
        },
        {
          "id": "agents/browser",
          "type": "package",
          "label": "agents/browser",
          "unmapped": true
        }
      ],
      "action_due": null,
      "time_to_correct": null
    },
    {
      "id": "12bb5b64-6522-4ab6-915b-7df418f6f7ad",
      "channel": "ai_platform_drift",
      "headline": "Cloudflare MCP server now sends Workers Issues as webhook events",
      "what_changed": "The Cloudflare API MCP server at https://mcp.cloudflare.com/mcp now exposes Workers Issues as MCP Events. Clients can discover the cloudflare.alert.workers_observability_real_time_issue event type via events/list, subscribe with events/subscribe scoped to an account or single Worker, and receive signed webhook posts when Issues detects new or recurring production failures. This requires Notifications Write and Workers Observability Write permissions.",
      "why_matters": "Agents can now react to Workers production failures without polling. When a Worker error is detected and grouped into an issue, the MCP server pushes a signed event to the client's webhook immediately, enabling automated investigation workflows that start as soon as the failure occurs.",
      "what_to_do": "If you run MCP clients that support webhook-based events and want automated failure response for Cloudflare Workers: enable Workers Issues on your Workers, connect https://mcp.cloudflare.com/mcp to your MCP client with Notifications Write and Workers Observability Write permissions, and implement a webhook handler that processes cloudflare.alert.workers_observability_real_time_issue events.",
      "severity": "worth_knowing",
      "action_type": "verify_only",
      "tags": [
        "api"
      ],
      "confidence": 0.85,
      "source_name": "Cloudflare developer changelog",
      "source_url": "https://developers.cloudflare.com/changelog/post/2026-10-13-cloudflare-mcp-events/",
      "published_at": "2026-10-13T14:15:48.351553+00:00",
      "corrected_at": null,
      "correction": null,
      "correction_cause": null,
      "url": "https://radar.trulysovereign.com/items/12bb5b64-6522-4ab6-915b-7df418f6f7ad",
      "affects": [
        {
          "id": "workers",
          "type": "product",
          "label": "workers",
          "unmapped": true
        },
        {
          "id": "mcp-server",
          "type": "product",
          "label": "mcp server",
          "unmapped": true
        }
      ],
      "action_due": null,
      "time_to_correct": null
    },
    {
      "id": "99384e59-f25a-4e50-b291-34031bb89319",
      "channel": "ai_platform_drift",
      "headline": "Workers subrequests to BYOIP destinations now preserve client context",
      "what_changed": "Cloudflare changed how Workers subrequests behave when targeting Cloudflare-proxied hostnames using Bring Your Own IP (BYOIP). These requests now preserve the CF-Worker header, cf.worker.upstream_zone field, and original client signals including bot scores, verified bot status, and JA3/JA4 fingerprints. Previously, this context was lost and the destination zone saw an internal Cloudflare connection instead of the original end-user. The change is automatic and live as of 13 October 2026.",
      "why_matters": "Security rules and Bot Management configurations that were written to handle the old behavior may now evaluate differently. Rules that previously saw internal Cloudflare traffic will now see the original client, potentially changing which requests pass or fail. False 403 responses that occurred due to lost context will stop appearing, which may surface requests that were previously blocked unintentionally.",
      "what_to_do": "Review security rules and Bot Management configurations on any zone that receives Workers subrequests via BYOIP. Test that rules evaluating bot scores, JA3/JA4 fingerprints, or the CF-Worker header still produce the intended allow/block decisions now that they see original client data instead of internal connection metadata.",
      "severity": "worth_knowing",
      "action_type": "verify_only",
      "tags": [
        "api",
        "security"
      ],
      "confidence": 0.85,
      "source_name": "Cloudflare developer changelog",
      "source_url": "https://developers.cloudflare.com/changelog/post/2026-10-13-byoip-workers-subrequest-context/",
      "published_at": "2026-10-13T14:15:37.272326+00:00",
      "corrected_at": null,
      "correction": null,
      "correction_cause": null,
      "url": "https://radar.trulysovereign.com/items/99384e59-f25a-4e50-b291-34031bb89319",
      "affects": [
        {
          "id": "cloudflare-workers",
          "type": "product",
          "label": "cloudflare workers",
          "unmapped": true
        },
        {
          "id": "byoip",
          "type": "product",
          "label": "byoip",
          "unmapped": true
        },
        {
          "id": "bot-management",
          "type": "product",
          "label": "bot management",
          "unmapped": true
        }
      ],
      "action_due": null,
      "time_to_correct": null
    },
    {
      "id": "176b2013-839e-46f3-b045-bf8d908aac8d",
      "channel": "ai_platform_drift",
      "headline": "GitHub Copilot adds granular telemetry controls for identity and content capture",
      "what_changed": "GitHub Copilot now supports six independent telemetry capture settings in managed enterprise configurations: telemetry.capture.identity (adds user.name, process.user.name, host.name to OpenTelemetry data) and five content classes (prompts, responses, toolArguments, toolOutput, policyDetail). All six are off by default. Explicit managed settings override local configuration, SDK settings, and environment variables. The existing captureContent setting remains as a legacy shorthand for the five content classes but never enables identity capture.",
      "why_matters": "If your organization currently uses the captureContent setting for audit purposes, you are not collecting user attribution data — identity capture requires the new separate setting. Prompt, tool, and policy capture can include source code, file contents, workspace paths, and user-profile paths, so enabling the wrong class sends more data to your telemetry endpoint than you may have approved.",
      "what_to_do": "Review your current Copilot telemetry configuration against the six new capture classes. If you need user attribution for audit trails, explicitly enable telemetry.capture.identity in managed settings. If you are using captureContent, determine which of the five content classes you actually need and configure them individually, sending data only to approved collection endpoints.",
      "severity": "worth_knowing",
      "action_type": "verify_only",
      "tags": [
        "security",
        "api"
      ],
      "confidence": 0.85,
      "source_name": "GitHub Copilot changelog",
      "source_url": "https://github.blog/changelog/2026-10-12-client-telemetry-user-attribution-and-configurable-capture",
      "published_at": "2026-10-13T14:15:03.145019+00:00",
      "corrected_at": null,
      "correction": null,
      "correction_cause": null,
      "url": "https://radar.trulysovereign.com/items/176b2013-839e-46f3-b045-bf8d908aac8d",
      "affects": [
        {
          "id": "github-copilot",
          "type": "product",
          "label": "github copilot",
          "unmapped": true
        }
      ],
      "action_due": null,
      "time_to_correct": null
    },
    {
      "id": "1df8a326-2157-425a-bad9-595ae9641187",
      "channel": "security_advisory",
      "headline": "GitLab 19.3.5 replaces broken 19.3.4 patch release",
      "what_changed": "GitLab released 19.3.5 on October 12, 2026, replacing 19.3.4 which had a bug affecting merge request pages when the Ona integration is enabled. All CVE impact statements now list 19.3.5 as the fixed version instead of 19.3.4. The release addresses 26 CVEs including CVE-2026-97229 (CVSS 10.0, unauthenticated RCE via CI/CD regex), CVE-2026-92883 (CVSS 8.7, XSS in syntax highlighting), CVE-2026-16301 (CVSS 8.5, unauthorized protected branch pipeline execution), and CVE-2026-14814 (CVSS 8.2, cache poisoning exposing CI/CD secrets).",
      "why_matters": "If you patched to 19.3.4, merge request pages are broken for any installation using the Ona integration. If you have not patched yet, you are running a version with a critical unauthenticated remote code execution vulnerability (CVSS 10.0) that allows arbitrary code execution via a crafted CI/CD regex, plus multiple high-severity issues exposing secrets and allowing unauthorized pipeline execution.",
      "what_to_do": "If you are on 19.3.4 with Ona integration enabled, upgrade to 19.3.5 immediately to restore merge request functionality. If you are on any 19.3.x version before 19.3.5, upgrade to 19.3.5 to patch the critical RCE and other vulnerabilities. Self-managed installations on 19.2.x or 19.4.x should upgrade to 19.2.8 or 19.4.2 respectively.",
      "severity": "action_needed",
      "action_type": "patch_now",
      "tags": [
        "security",
        "api"
      ],
      "confidence": 0.95,
      "source_name": "GitLab patch releases",
      "source_url": "https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-4-2-released/",
      "published_at": "2026-10-13T02:46:44.851752+00:00",
      "corrected_at": null,
      "correction": null,
      "correction_cause": null,
      "url": "https://radar.trulysovereign.com/items/1df8a326-2157-425a-bad9-595ae9641187",
      "affects": [
        {
          "id": "gitlab",
          "type": "product",
          "label": "gitlab",
          "unmapped": true
        },
        {
          "id": "cve-2026-97229",
          "type": "cve",
          "label": "CVE-2026-97229"
        },
        {
          "id": "cve-2026-92883",
          "type": "cve",
          "label": "CVE-2026-92883"
        },
        {
          "id": "cve-2026-16301",
          "type": "cve",
          "label": "CVE-2026-16301"
        },
        {
          "id": "cve-2026-14814",
          "type": "cve",
          "label": "CVE-2026-14814"
        }
      ],
      "action_due": null,
      "time_to_correct": null
    },
    {
      "id": "0344916f-4587-4a60-9427-aa21198d7d20",
      "channel": "security_advisory",
      "headline": "Envoy DoS in Cloud Service Mesh when path mutated after routing",
      "what_changed": "Google published GCP-2026-067 on 2026-10-12, disclosing a high-severity DoS vulnerability in Envoy Proxy (envoyproxy/envoy#47841). The flaw triggers when an HTTP filter mutates the :path header after route selection on routes configured with prefix_rewrite.",
      "why_matters": "Cloud Service Mesh control plane components running affected Envoy versions can be crashed by crafted requests that exploit this path mutation sequence. You cannot patch Envoy directly in a managed service — Google must deploy the fix.",
      "what_to_do": "Check the linked Cloud Service Mesh security bulletin for affected versions and Google's remediation timeline. If you use ext_proc filters with route_cache_action: RETAIN on prefix_rewrite routes, verify whether your mesh version is vulnerable and whether Google has patched your control plane.",
      "severity": "action_needed",
      "action_type": "verify_exposure",
      "tags": [
        "security"
      ],
      "confidence": 0.85,
      "source_name": "Google Cloud security bulletins",
      "source_url": "https://docs.cloud.google.com/support/bulletins/index#gcp-2026-067",
      "published_at": "2026-10-13T02:46:27.375636+00:00",
      "corrected_at": null,
      "correction": null,
      "correction_cause": null,
      "url": "https://radar.trulysovereign.com/items/0344916f-4587-4a60-9427-aa21198d7d20",
      "affects": [
        {
          "id": "envoyproxy/envoy47841",
          "type": "cve",
          "label": "envoyproxy/envoy#47841",
          "unmapped": true
        },
        {
          "id": "cloud-service-mesh",
          "type": "product",
          "label": "cloud service mesh",
          "unmapped": true
        }
      ],
      "action_due": null,
      "time_to_correct": null
    },
    {
      "id": "2997c85b-6187-4066-a4e8-c85b6daeedd3",
      "channel": "ai_platform_drift",
      "headline": "DeepSeek V4 Flash completion price cut 25%, prompt price up 12.5%",
      "what_changed": "OpenRouter's pricing for ~deepseek/deepseek-v4-flash-latest changed on 13 October 2026. The captured completion base rate changed from $0.768 to $0.576 per 1M tokens. The captured prompt base rate changed from $0.0128 to $0.0144 per 1M tokens. For workloads generating ten completion tokens for every prompt token, total cost per request decreased 24.9%.",
      "why_matters": "Completion-heavy workloads cost less; prompt-heavy workloads cost more. Using the captured base rates for ~deepseek/deepseek-v4-flash-latest, 100M completion tokens per day cost $76.80 before and $57.60 after, excluding all other charges. Using the captured base rates for ~deepseek/deepseek-v4-flash-latest, 100M prompt tokens per day cost $1.28 before and $1.44 after, excluding all other charges. If your application generates more than 53 completion tokens per prompt token, you save money; below that ratio, you pay more.",
      "what_to_do": "Pull last month's token usage by type from your logs or OpenRouter dashboard. Calculate your actual completion-to-prompt ratio. If you are below 53:1, reforecast your monthly spend using the new rates and update your budget. If you are above 53:1, document the savings for your next cost review.",
      "severity": "worth_knowing",
      "action_type": "budget",
      "tags": [
        "pricing",
        "model"
      ],
      "confidence": 0.95,
      "source_name": "OpenRouter model catalogue",
      "source_url": "https://openrouter.ai/api/v1/models",
      "published_at": "2026-10-13T00:42:44.786537+00:00",
      "corrected_at": "2026-10-14T02:35:02.669166+00:00",
      "correction": "CORRECTION: The thresholds of 53 completion tokens per prompt token in WHY IT MATTERS and 53:1 in WHAT TO DO are wrong. Using only the captured base rates for ~deepseek/deepseek-v4-flash-latest, break-even is exactly 1 completion token(s) per 120 prompt token(s); total request cost is lower above that completion-to-prompt ratio, equal at that ratio, and higher below it, excluding all other charges. This is one output token per 120 input tokens (output/input = 1/120, approximately 0.008333); equality is break-even, not savings. At ten completion tokens per prompt token, total request cost falls 24.9%, consistent with WHAT CHANGED. Use that corrected threshold when interpreting the original budget advice. Captured arithmetic only; provider rate validity, applicability, event date and effective conditions remain unverified.",
      "correction_cause": "arithmetic",
      "url": "https://radar.trulysovereign.com/items/2997c85b-6187-4066-a4e8-c85b6daeedd3",
      "affects": [
        {
          "id": "deepseek/deepseek-v4-flash-latest",
          "type": "model",
          "label": "~deepseek/deepseek-v4-flash-latest",
          "unmapped": true
        },
        {
          "id": "openrouter",
          "type": "provider",
          "label": "openrouter"
        }
      ],
      "action_due": null,
      "time_to_correct": "25h 52m"
    },
    {
      "id": "66f6f4b7-e1ae-4cd6-ac0d-6b98f25e1876",
      "channel": "ai_platform_drift",
      "headline": "Llama 3.3 70B prompt price up 168%, completion up 58%",
      "what_changed": "OpenRouter raised pricing for meta-llama/llama-3.3-70b-instruct effective 13 October 2026. Captured completion base rate changed from $0.50 to $0.79 per 1M tokens. Captured prompt base rate changed from $0.22 to $0.59 per 1M tokens. Maximum completion tokens doubled from 16,384 to 32,768.",
      "why_matters": "Using the captured base rates for meta-llama/llama-3.3-70b-instruct, 100M completion tokens per day cost $50.00 before and $79.00 after, excluding all other charges. Using the captured base rates for meta-llama/llama-3.3-70b-instruct, 100M prompt tokens per day cost $22.00 before and $59.00 after, excluding all other charges. Workloads with equal prompt and completion volume see a 91.7% total cost increase; workloads generating ten completion tokens for every prompt token see a 62.6% increase.",
      "what_to_do": "Reforecast your OpenRouter spend for this model using the new rates and notify whoever owns the budget. To estimate the added completion cost for meta-llama/llama-3.3-70b-instruct in dollars, multiply completion token volume by 0.29 and divide by 1,000,000, using the captured base-rate difference in dollars per 1M tokens. To estimate the added prompt cost for meta-llama/llama-3.3-70b-instruct in dollars, multiply prompt token volume by 0.37 and divide by 1,000,000, using the captured base-rate difference in dollars per 1M tokens.",
      "severity": "action_needed",
      "action_type": "budget",
      "tags": [
        "pricing",
        "model",
        "limits"
      ],
      "confidence": 0.95,
      "source_name": "OpenRouter model catalogue",
      "source_url": "https://openrouter.ai/api/v1/models",
      "published_at": "2026-10-13T00:42:20.857442+00:00",
      "corrected_at": null,
      "correction": null,
      "correction_cause": null,
      "url": "https://radar.trulysovereign.com/items/66f6f4b7-e1ae-4cd6-ac0d-6b98f25e1876",
      "affects": [
        {
          "id": "openrouter",
          "type": "provider",
          "label": "openrouter"
        },
        {
          "id": "meta-llama/llama-3-3-70b-instruct",
          "type": "model",
          "label": "meta-llama/llama-3.3-70b-instruct",
          "unmapped": true
        }
      ],
      "action_due": null,
      "time_to_correct": null
    },
    {
      "id": "019538ab-402a-4d67-88cf-1f2377726f65",
      "channel": "ai_platform_drift",
      "headline": "DeepSeek V4 Flash prompt pricing dropped 63% on OpenRouter",
      "what_changed": "OpenRouter's deepseek/deepseek-v4-flash model reduced its captured prompt base rate from $0.0131 to $0.0048 per 1M tokens, a 63.4% decrease. Completion pricing remains $1.28 per 1M tokens.",
      "why_matters": "Using the captured base rates for deepseek/deepseek-v4-flash, 100M prompt tokens per day cost $1.31 before and $0.48 after, excluding all other charges. If you route significant prompt volume through this model, your monthly bill decreases proportionally.",
      "what_to_do": "Pull last month's token usage for deepseek/deepseek-v4-flash from your OpenRouter dashboard or logs, multiply prompt token volume by the 63.4% reduction, and update your cost forecast. If you avoided this model due to price, re-evaluate it against your current routing rules.",
      "severity": "worth_knowing",
      "action_type": "budget",
      "tags": [
        "pricing",
        "model"
      ],
      "confidence": 0.95,
      "source_name": "OpenRouter model catalogue",
      "source_url": "https://openrouter.ai/api/v1/models",
      "published_at": "2026-10-13T00:42:07.77179+00:00",
      "corrected_at": null,
      "correction": null,
      "correction_cause": null,
      "url": "https://radar.trulysovereign.com/items/019538ab-402a-4d67-88cf-1f2377726f65",
      "affects": [
        {
          "id": "openrouter",
          "type": "provider",
          "label": "openrouter"
        },
        {
          "id": "deepseek-v4-flash",
          "type": "model",
          "label": "deepseek/deepseek-v4-flash"
        },
        {
          "id": "deepseek",
          "type": "provider",
          "label": "deepseek"
        }
      ],
      "action_due": null,
      "time_to_correct": null
    },
    {
      "id": "b0266e27-d6f6-4b3d-8045-88d5294eb14f",
      "channel": "ai_platform_drift",
      "headline": "DeepSeek V3.1 Terminus prompt pricing drops 10%, output limit doubles",
      "what_changed": "OpenRouter's deepseek/deepseek-v3.1-terminus model reduced prompt pricing from $0.30 to $0.27 per 1M tokens and increased max_completion_tokens from 65,536 to 147,456 tokens. Completion pricing remains $1.00 per 1M tokens.",
      "why_matters": "Using the captured base rates for deepseek/deepseek-v3.1-terminus, 100M prompt tokens per day cost $30.00 before and $27.00 after, excluding all other charges. The doubled output limit enables longer responses without truncation, affecting applications that generate documentation, code, or long-form content.",
      "what_to_do": "Reforecast monthly costs using the new prompt rate if you process significant prompt volume through this model. If your application currently handles truncated responses at the 65K token boundary, test whether the new 147K limit eliminates those cases.",
      "severity": "worth_knowing",
      "action_type": "budget",
      "tags": [
        "pricing",
        "limits",
        "model"
      ],
      "confidence": 0.95,
      "source_name": "OpenRouter model catalogue",
      "source_url": "https://openrouter.ai/api/v1/models",
      "published_at": "2026-10-13T00:41:58.25406+00:00",
      "corrected_at": null,
      "correction": null,
      "correction_cause": null,
      "url": "https://radar.trulysovereign.com/items/b0266e27-d6f6-4b3d-8045-88d5294eb14f",
      "affects": [
        {
          "id": "deepseek-v3-1-terminus",
          "type": "model",
          "label": "deepseek/deepseek-v3.1-terminus",
          "unmapped": true
        },
        {
          "id": "openrouter",
          "type": "provider",
          "label": "openrouter"
        },
        {
          "id": "deepseek",
          "type": "provider",
          "label": "deepseek"
        }
      ],
      "action_due": null,
      "time_to_correct": null
    },
    {
      "id": "8e3f35fe-5499-4f71-be4c-ccbc16c2628c",
      "channel": "security_advisory",
      "headline": "GitLab critical RCE via CI/CD regex, 23 other CVEs patched",
      "what_changed": "GitLab released emergency patches 19.4.2, 19.3.4, and 19.2.8 on October 12, 2026. CVE-2026-97229 is an unauthenticated remote code execution vulnerability (CVSS 10.0) in the CI/CD regular expression compiler affecting all GitLab CE/EE versions from 19.2.0 onward. The release also patches 23 additional CVEs including high-severity authorization bypasses in CI/CD pipelines (CVE-2026-16301, CVSS 8.5), cache poisoning enabling environment variable exposure (CVE-2026-14814, CVSS 8.2), and LLM prompt injection in GitLab Duo Agent Platform (CVE-2026-96893, CVSS 7.3). Self-managed installations require immediate upgrade; GitLab.com is already patched.",
      "why_matters": "An unauthenticated attacker can execute arbitrary code on any unpatched GitLab server by submitting a crafted regular expression in a CI/CD configuration file. Multiple high-severity flaws allow authenticated users with developer access to run unauthorized pipelines on protected branches, poison caches to steal CI secrets, and inject commands into AI agent contexts. GitLab is source control and CI/CD infrastructure — compromise means access to all code, credentials, and build artifacts.",
      "what_to_do": "Upgrade self-managed GitLab installations to 19.4.2, 19.3.4, or 19.2.8 immediately. Single-node deployments will experience downtime during the upgrade due to required database migrations. Multi-node deployments can follow zero-downtime procedures. Note that 19.3.4 has a known bug affecting merge request pages when the Ona integration is enabled; 19.3.5 will follow. GitLab Dedicated customers do not need to act.",
      "severity": "action_needed",
      "action_type": "patch_now",
      "tags": [
        "security",
        "api",
        "deprecation"
      ],
      "confidence": 0.95,
      "source_name": "GitLab patch releases",
      "source_url": "https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-4-2-released/",
      "published_at": "2026-10-12T15:28:31.138922+00:00",
      "corrected_at": null,
      "correction": null,
      "correction_cause": null,
      "url": "https://radar.trulysovereign.com/items/8e3f35fe-5499-4f71-be4c-ccbc16c2628c",
      "affects": [
        {
          "id": "gitlab-ce",
          "type": "product",
          "label": "gitlab ce",
          "unmapped": true
        },
        {
          "id": "gitlab-ee",
          "type": "product",
          "label": "gitlab ee",
          "unmapped": true
        },
        {
          "id": "cve-2026-97229",
          "type": "cve",
          "label": "CVE-2026-97229"
        },
        {
          "id": "cve-2026-92883",
          "type": "cve",
          "label": "CVE-2026-92883"
        },
        {
          "id": "cve-2026-16301",
          "type": "cve",
          "label": "CVE-2026-16301"
        },
        {
          "id": "cve-2026-14814",
          "type": "cve",
          "label": "CVE-2026-14814"
        },
        {
          "id": "cve-2026-81839",
          "type": "cve",
          "label": "CVE-2026-81839"
        },
        {
          "id": "cve-2026-96893",
          "type": "cve",
          "label": "CVE-2026-96893"
        }
      ],
      "action_due": null,
      "time_to_correct": null
    },
    {
      "id": "131b4193-d471-4a21-accb-121e29091d1e",
      "channel": "ai_platform_drift",
      "headline": "DeepSeek V4 Flash completion pricing up 20%, prompt down 29%",
      "what_changed": "OpenRouter's pricing for ~deepseek/deepseek-v4-flash-latest changed on 2026-10-12. The captured completion base rate changed from $0.64 to $0.768 per 1M tokens. The captured prompt base rate changed from $0.018 to $0.0128 per 1M tokens.",
      "why_matters": "Completion-heavy workloads cost more. Using the captured base rates for ~deepseek/deepseek-v4-flash-latest, 100M completion tokens per day cost $64.00 before and $76.80 after, excluding all other charges. Prompt costs dropped, but the blended effect is a 19.9% increase for workloads generating ten completion tokens for every prompt token.",
      "what_to_do": "Reforecast your OpenRouter spend if you call this model. To estimate the added completion cost for ~deepseek/deepseek-v4-flash-latest in dollars, multiply completion token volume by 0.128 and divide by 1,000,000, using the captured base-rate difference in dollars per 1M tokens. To estimate the saved prompt cost for ~deepseek/deepseek-v4-flash-latest in dollars, multiply prompt token volume by 0.0052 and divide by 1,000,000, using the captured base-rate difference in dollars per 1M tokens.",
      "severity": "worth_knowing",
      "action_type": "budget",
      "tags": [
        "pricing",
        "model"
      ],
      "confidence": 0.95,
      "source_name": "OpenRouter model catalogue",
      "source_url": "https://openrouter.ai/api/v1/models",
      "published_at": "2026-10-12T06:01:06.305969+00:00",
      "corrected_at": null,
      "correction": null,
      "correction_cause": null,
      "url": "https://radar.trulysovereign.com/items/131b4193-d471-4a21-accb-121e29091d1e",
      "affects": [
        {
          "id": "openrouter",
          "type": "provider",
          "label": "openrouter"
        },
        {
          "id": "deepseek/deepseek-v4-flash-latest",
          "type": "model",
          "label": "~deepseek/deepseek-v4-flash-latest",
          "unmapped": true
        }
      ],
      "action_due": null,
      "time_to_correct": null
    },
    {
      "id": "e5263b7c-b943-421d-a550-d997c15ec5de",
      "channel": "ai_platform_drift",
      "headline": "DeepSeek V4 Flash prompt pricing drops 39%",
      "what_changed": "deepseek/deepseek-v4-flash: captured prompt base rate changed from $0.0216 to $0.0131 per 1M tokens. Completion pricing remains $1.28 per 1M tokens.",
      "why_matters": "Using the captured base rates for deepseek/deepseek-v4-flash, 100M prompt tokens per day cost $2.16 before and $1.31 after, excluding all other charges. To estimate the saved prompt cost for deepseek/deepseek-v4-flash in dollars, multiply prompt token volume by 0.0085 and divide by 1,000,000, using the captured base-rate difference in dollars per 1M tokens.",
      "what_to_do": "Reforecast monthly spend if you are routing traffic to this model. Query your logs for deepseek/deepseek-v4-flash usage over the last 30 days, multiply prompt token volume by the rate difference, and update your budget projection.",
      "severity": "worth_knowing",
      "action_type": "budget",
      "tags": [
        "pricing",
        "model"
      ],
      "confidence": 0.95,
      "source_name": "OpenRouter model catalogue",
      "source_url": "https://openrouter.ai/api/v1/models",
      "published_at": "2026-10-12T06:00:41.061071+00:00",
      "corrected_at": null,
      "correction": null,
      "correction_cause": null,
      "url": "https://radar.trulysovereign.com/items/e5263b7c-b943-421d-a550-d997c15ec5de",
      "affects": [
        {
          "id": "deepseek-v4-flash",
          "type": "model",
          "label": "deepseek/deepseek-v4-flash"
        },
        {
          "id": "deepseek",
          "type": "provider",
          "label": "deepseek"
        }
      ],
      "action_due": null,
      "time_to_correct": null
    },
    {
      "id": "4651b497-3444-4c87-b05a-1e526291fdd8",
      "channel": "ai_platform_drift",
      "headline": "DeepSeek V4 Flash Vision Exp pricing cut 51%, output limit reduced",
      "what_changed": "OpenRouter's deepseek/deepseek-v4-flash-vision-exp model pricing dropped 51% on both prompt and completion tokens: captured completion base rate changed from $1.32 to $0.6468 per 1M tokens, and captured prompt base rate changed from $0.44 to $0.2156 per 1M tokens. The max_completion_tokens limit decreased from 943,717 to 262,144 tokens.",
      "why_matters": "Using the captured base rates for deepseek/deepseek-v4-flash-vision-exp, 100M completion tokens per day cost $132.00 before and $64.68 after, excluding all other charges. However, any workload generating responses longer than 262,144 tokens will now fail or be truncated, breaking applications that relied on the previous 943K token output capacity.",
      "what_to_do": "Check your application's max_tokens parameter and actual response lengths for this model. If you generate outputs exceeding 262,144 tokens, migrate to a different model or split requests before the limit causes failures.",
      "severity": "worth_knowing",
      "action_type": "verify_only",
      "tags": [
        "pricing",
        "limits",
        "model"
      ],
      "confidence": 0.85,
      "source_name": "OpenRouter model catalogue",
      "source_url": "https://openrouter.ai/api/v1/models",
      "published_at": "2026-10-11T05:49:04.655267+00:00",
      "corrected_at": null,
      "correction": null,
      "correction_cause": null,
      "url": "https://radar.trulysovereign.com/items/4651b497-3444-4c87-b05a-1e526291fdd8",
      "affects": [
        {
          "id": "deepseek-v4-flash-vision-exp",
          "type": "model",
          "label": "deepseek/deepseek-v4-flash-vision-exp",
          "unmapped": true
        },
        {
          "id": "openrouter",
          "type": "provider",
          "label": "openrouter"
        },
        {
          "id": "deepseek",
          "type": "provider",
          "label": "deepseek"
        }
      ],
      "action_due": null,
      "time_to_correct": null
    },
    {
      "id": "095560d5-371c-41ce-8af8-e69340ddbfe5",
      "channel": "ai_platform_drift",
      "headline": "DeepSeek V4 Flash 0731 completion price halved, prompt price up 69.5%",
      "what_changed": "OpenRouter's pricing for deepseek/deepseek-v4-flash-0731 changed on 2026-10-11. The captured completion base rate changed from $1.28 to $0.64 per 1M tokens. The captured prompt base rate changed from $0.0095 to $0.0161 per 1M tokens.",
      "why_matters": "The net effect depends on your completion-to-prompt ratio. Workloads generating ten completion tokens for every prompt token see a 49.9% total cost reduction. Workloads with equal prompt and completion volumes see a 49.1% reduction. Prompt-heavy workloads with minimal generation still benefit but less dramatically. Using the captured base rates for deepseek/deepseek-v4-flash-0731, 100M completion tokens per day cost $128.00 before and $64.00 after, excluding all other charges.",
      "what_to_do": "Pull your last 30 days of token usage for this model from OpenRouter's API, calculate your actual prompt-to-completion ratio, and reforecast your monthly spend using the new rates. If you are prompt-heavy (more than three prompt tokens per completion token), verify the net increase fits your budget.",
      "severity": "worth_knowing",
      "action_type": "budget",
      "tags": [
        "pricing",
        "model"
      ],
      "confidence": 0.95,
      "source_name": "OpenRouter model catalogue",
      "source_url": "https://openrouter.ai/api/v1/models",
      "published_at": "2026-10-11T05:48:54.837937+00:00",
      "corrected_at": null,
      "correction": null,
      "correction_cause": null,
      "url": "https://radar.trulysovereign.com/items/095560d5-371c-41ce-8af8-e69340ddbfe5",
      "affects": [
        {
          "id": "deepseek-v4-flash-0731",
          "type": "model",
          "label": "deepseek/deepseek-v4-flash-0731",
          "unmapped": true
        },
        {
          "id": "openrouter",
          "type": "provider",
          "label": "openrouter"
        },
        {
          "id": "deepseek",
          "type": "provider",
          "label": "deepseek"
        }
      ],
      "action_due": null,
      "time_to_correct": null
    },
    {
      "id": "4d42ee38-a65f-41b5-93d1-1e19e4b5543c",
      "channel": "ai_platform_drift",
      "headline": "DeepSeek V4 Flash prompt pricing drops 18%",
      "what_changed": "~deepseek/deepseek-v4-flash-latest prompt token pricing decreased from $0.0116 to $0.0095 per 1M tokens, effective as of the 10 October 2026 catalogue update. Completion pricing remains $1.28 per 1M tokens.",
      "why_matters": "Using the captured base rates for ~deepseek/deepseek-v4-flash-latest, 100M prompt tokens per day cost $1.16 before and $0.95 after, excluding all other charges. High-volume prompt workloads see immediate cost reduction without code changes.",
      "what_to_do": "Reforecast October spend if you route significant prompt volume through this model. To estimate the saved prompt cost for ~deepseek/deepseek-v4-flash-latest in dollars, multiply prompt token volume by 0.0021 and divide by 1,000,000, using the captured base-rate difference in dollars per 1M tokens.",
      "severity": "worth_knowing",
      "action_type": "budget",
      "tags": [
        "pricing",
        "model"
      ],
      "confidence": 0.95,
      "source_name": "OpenRouter model catalogue",
      "source_url": "https://openrouter.ai/api/v1/models",
      "published_at": "2026-10-10T21:46:04.182898+00:00",
      "corrected_at": null,
      "correction": null,
      "correction_cause": null,
      "url": "https://radar.trulysovereign.com/items/4d42ee38-a65f-41b5-93d1-1e19e4b5543c",
      "affects": [
        {
          "id": "deepseek/deepseek-v4-flash-latest",
          "type": "model",
          "label": "~deepseek/deepseek-v4-flash-latest",
          "unmapped": true
        },
        {
          "id": "deepseek",
          "type": "provider",
          "label": "deepseek"
        }
      ],
      "action_due": null,
      "time_to_correct": null
    },
    {
      "id": "ca86b8b2-43dd-4b9c-b570-c72a36537129",
      "channel": "ai_platform_drift",
      "headline": "DeepSeek Flash Latest prompt pricing dropped 97.4%",
      "what_changed": "OpenRouter's catalogue shows ~deepseek/deepseek-flash-latest prompt pricing changed from $0.0038 to $0.0001 per 1M tokens, a 97.4% reduction. Completion pricing remains $0.60 per 1M tokens.",
      "why_matters": "Using the captured base rates for ~deepseek/deepseek-flash-latest, 100M prompt tokens per day cost $0.38 before and $0.01 after, excluding all other charges. High-volume prompt workloads see immediate cost reduction without code changes.",
      "what_to_do": "Pull last 30 days of token usage for this model from your logs, multiply prompt token volume by the new rate to reforecast monthly spend, and update any cost projections or budgets that assumed the old $0.0038/M rate.",
      "severity": "worth_knowing",
      "action_type": "budget",
      "tags": [
        "pricing",
        "model"
      ],
      "confidence": 0.95,
      "source_name": "OpenRouter model catalogue",
      "source_url": "https://openrouter.ai/api/v1/models",
      "published_at": "2026-10-10T12:36:44.138767+00:00",
      "corrected_at": null,
      "correction": null,
      "correction_cause": null,
      "url": "https://radar.trulysovereign.com/items/ca86b8b2-43dd-4b9c-b570-c72a36537129",
      "affects": [
        {
          "id": "deepseek/deepseek-flash-latest",
          "type": "model",
          "label": "~deepseek/deepseek-flash-latest",
          "unmapped": true
        },
        {
          "id": "openrouter",
          "type": "provider",
          "label": "openrouter"
        }
      ],
      "action_due": null,
      "time_to_correct": null
    },
    {
      "id": "1e411aa3-136c-4731-b8b2-8ad897d13430",
      "channel": "ai_platform_drift",
      "headline": "DeepSeek V4.1 Flash prompt pricing increased 742.7%",
      "what_changed": "OpenRouter's pricing for deepseek/deepseek-v4.1-flash changed on 2026-10-10. The captured prompt base rate increased from $0.0356 to $0.30 per 1M tokens. The captured completion base rate increased from $1.00 to $1.20 per 1M tokens.",
      "why_matters": "Using the captured base rates for deepseek/deepseek-v4.1-flash, 100M prompt tokens per day cost $3.56 before and $30.00 after, excluding all other charges. Workloads with one completion token for every prompt token see a 44.8% total cost increase; workloads with ten completion tokens for every prompt token see a 22.6% increase.",
      "what_to_do": "Pull your last 30 days of deepseek/deepseek-v4.1-flash usage from OpenRouter logs, calculate new costs using the $0.30 per 1M prompt rate and $1.20 per 1M completion rate, and update your budget forecast. If the increase exceeds your allocation, evaluate alternative models or request additional budget this week.",
      "severity": "action_needed",
      "action_type": "budget",
      "tags": [
        "pricing",
        "model"
      ],
      "confidence": 0.95,
      "source_name": "OpenRouter model catalogue",
      "source_url": "https://openrouter.ai/api/v1/models",
      "published_at": "2026-10-10T12:36:34.9952+00:00",
      "corrected_at": null,
      "correction": null,
      "correction_cause": null,
      "url": "https://radar.trulysovereign.com/items/1e411aa3-136c-4731-b8b2-8ad897d13430",
      "affects": [
        {
          "id": "deepseek-v4.1-flash",
          "type": "model",
          "label": "deepseek/deepseek-v4.1-flash"
        },
        {
          "id": "openrouter",
          "type": "provider",
          "label": "openrouter"
        },
        {
          "id": "deepseek",
          "type": "provider",
          "label": "deepseek"
        }
      ],
      "action_due": null,
      "time_to_correct": null
    },
    {
      "id": "36289370-1963-4cc6-accc-10cb6e007f5e",
      "channel": "ai_platform_drift",
      "headline": "Claude Code moved from Max to Pro and Max tiers",
      "what_changed": "Claude Code, previously exclusive to the Max tier, is now included in both Pro ($17/month) and Max (from $100/month) tiers. The feature was removed from the Max-only feature list and added to both tier descriptions with 'Claude Code included' labels.",
      "why_matters": "Teams on Pro tier gain access to Claude Code without upgrading. Teams evaluating whether to upgrade from Pro to Max for Claude Code access no longer have that differentiator—the decision now depends on other Max features like higher usage limits and task scheduling.",
      "what_to_do": "If you are on Pro tier and have been considering Max solely for Claude Code access, verify that Claude Code now works in your Pro account and cancel any pending upgrade. If you are on Max tier primarily for Claude Code, review the other Max features to confirm the tier still justifies the cost difference.",
      "severity": "worth_knowing",
      "action_type": "verify_only",
      "tags": [
        "pricing"
      ],
      "confidence": 0.95,
      "source_name": "Anthropic pricing",
      "source_url": "https://claude.com/pricing",
      "published_at": "2026-10-10T12:36:23.405427+00:00",
      "corrected_at": null,
      "correction": null,
      "correction_cause": null,
      "url": "https://radar.trulysovereign.com/items/36289370-1963-4cc6-accc-10cb6e007f5e",
      "affects": [
        {
          "id": "anthropic",
          "type": "provider",
          "label": "anthropic"
        },
        {
          "id": "claude-code",
          "type": "product",
          "label": "claude code"
        }
      ],
      "action_due": null,
      "time_to_correct": null
    },
    {
      "id": "129ad2b7-76b7-48fa-bb42-17bdc61f6690",
      "channel": "ai_platform_drift",
      "headline": "Claude Fable 5 tokenizer produces 30% more tokens, requires 30-day retention",
      "what_changed": "Claude Fable 5 and Claude Mythos 5 launched 9 June 2026 with a new tokenizer that produces roughly 30% more tokens for the same text compared to models before Claude Opus 4.7. Both models support 1M token context windows and 128k max output tokens. Claude Fable 5 requires 30-day data retention; zero data retention is not available. The thinking: {\"type\": \"disabled\"} parameter returns a 400 error on both models. A new stop_details.category value \"reasoning_extraction\" is returned when requests are blocked for reverse engineering attempts.",
      "why_matters": "The 30% token increase directly raises your API costs for the same workload. If you are under zero data retention today, you cannot use Claude Fable 5 without changing your data handling agreement. The disabled thinking mode returning 400 will break any code that explicitly disables thinking.",
      "what_to_do": "Run the token counting API with model: \"claude-fable-5\" on representative prompts to measure the actual token increase for your workload and update cost forecasts. If you use thinking: {\"type\": \"disabled\"}, remove that parameter before migrating to Claude Fable 5. If you require zero data retention, confirm whether the 30-day requirement is acceptable before planning any migration.",
      "severity": "action_needed",
      "action_type": "budget",
      "tags": [
        "model",
        "pricing",
        "api",
        "terms"
      ],
      "confidence": 0.95,
      "source_name": "Claude Platform release notes",
      "source_url": "https://platform.claude.com/docs/en/release-notes/overview#june-9-2026",
      "published_at": "2026-10-10T12:36:10.944542+00:00",
      "corrected_at": null,
      "correction": null,
      "correction_cause": null,
      "url": "https://radar.trulysovereign.com/items/129ad2b7-76b7-48fa-bb42-17bdc61f6690",
      "affects": [
        {
          "id": "claude-fable-5",
          "type": "model",
          "label": "claude-fable-5"
        },
        {
          "id": "claude-mythos-5",
          "type": "model",
          "label": "claude-mythos-5"
        },
        {
          "id": "anthropic",
          "type": "provider",
          "label": "anthropic"
        }
      ],
      "action_due": null,
      "time_to_correct": null
    },
    {
      "id": "20773d0b-026f-49a9-9db7-d17b186d2db0",
      "channel": "ai_platform_drift",
      "headline": "Anthropic adds $100-$200 monthly API credits to paid plans",
      "what_changed": "Anthropic's pricing page now shows monthly API credits included with paid subscription tiers: $100/month for one tier and $200/month for another. The credits are marked with a dagger (†) indicating terms apply. Free and lower tiers receive no credits.",
      "why_matters": "If you pay for an Anthropic subscription and also use the API separately, you now receive $100 or $200 in monthly API credits that reduce your API bill. This changes the effective cost of the subscription for teams running both console and API workloads.",
      "what_to_do": "Check your current Anthropic subscription tier and monthly API spend. If you spend more than $100-$200/month on API calls, the credit offsets part of that cost; reforecast your combined subscription plus API budget accordingly.",
      "severity": "worth_knowing",
      "action_type": "budget",
      "tags": [
        "pricing"
      ],
      "confidence": 0.85,
      "source_name": "Anthropic pricing",
      "source_url": "https://claude.com/pricing",
      "published_at": "2026-10-10T12:35:33.054764+00:00",
      "corrected_at": null,
      "correction": null,
      "correction_cause": null,
      "url": "https://radar.trulysovereign.com/items/20773d0b-026f-49a9-9db7-d17b186d2db0",
      "affects": [
        {
          "id": "anthropic",
          "type": "provider",
          "label": "anthropic"
        }
      ],
      "action_due": null,
      "time_to_correct": null
    },
    {
      "id": "df9f4b54-8ff2-4c21-8de0-134e1d789e54",
      "channel": "security_advisory",
      "headline": "pyLoad authentication bypass in API key validation",
      "what_changed": "GitHub published GHSA-r44w-v6gf-x3p6 on 2026-10-09, a high-severity authentication bypass in pyload-ng's API key validation (check_apikey cache). The vulnerability is patched in version 0.5.0b3.dev101.",
      "why_matters": "An attacker can bypass API authentication entirely, gaining unauthorized access to pyLoad's API without valid credentials. This exposes download management operations, configuration, and potentially stored credentials in any deployment where the API is reachable.",
      "what_to_do": "Grep your dependency manifests and container images for pyload-ng. If found, update to 0.5.0b3.dev101 or later. If pyLoad is deployed with an exposed API endpoint, treat this as an active exposure until patched.",
      "severity": "action_needed",
      "action_type": "patch_now",
      "tags": [
        "security",
        "api"
      ],
      "confidence": 0.85,
      "source_name": "GitHub advisories — pip",
      "source_url": "https://api.github.com/advisories?ecosystem=pip&severity=high&per_page=100",
      "published_at": "2026-10-10T12:35:23.249395+00:00",
      "corrected_at": null,
      "correction": null,
      "correction_cause": null,
      "url": "https://radar.trulysovereign.com/items/df9f4b54-8ff2-4c21-8de0-134e1d789e54",
      "affects": [
        {
          "id": "pypipyload-ng",
          "type": "package",
          "label": "pypi:pyload-ng",
          "unmapped": true
        }
      ],
      "action_due": null,
      "time_to_correct": null
    },
    {
      "id": "56b7aabb-ea86-4e60-a8a4-f9d1647e0008",
      "channel": "security_advisory",
      "headline": "Strawberry GraphQL authorization bypass in synchronous permission checks",
      "what_changed": "CVE-2026-107728 published 9 October 2026 for strawberry-graphql. Synchronous permission checks incorrectly treat awaitable authorization results as truthy, allowing unauthorized access. Fixed in version 0.326.1.",
      "why_matters": "Authorization logic fails open. Any GraphQL resolver using synchronous permission checks with async authorization functions grants access regardless of the actual authorization result. An attacker can access protected fields and mutations without valid permissions.",
      "what_to_do": "Upgrade strawberry-graphql to 0.326.1 or later. If you use synchronous permission checks with async authorization functions, audit access logs for unauthorized queries between your deployment date and the upgrade.",
      "severity": "action_needed",
      "action_type": "patch_now",
      "tags": [
        "security",
        "api"
      ],
      "confidence": 0.95,
      "source_name": "GitHub advisories — pip",
      "source_url": "https://api.github.com/advisories?ecosystem=pip&severity=high&per_page=100",
      "published_at": "2026-10-10T12:35:14.759104+00:00",
      "corrected_at": null,
      "correction": null,
      "correction_cause": null,
      "url": "https://radar.trulysovereign.com/items/56b7aabb-ea86-4e60-a8a4-f9d1647e0008",
      "affects": [
        {
          "id": "pypistrawberry-graphql",
          "type": "package",
          "label": "pypi:strawberry-graphql",
          "unmapped": true
        },
        {
          "id": "cve-2026-107728",
          "type": "cve",
          "label": "CVE-2026-107728"
        }
      ],
      "action_due": null,
      "time_to_correct": null
    },
    {
      "id": "4968acfb-0e94-42b4-86ae-46c726ca45fb",
      "channel": "security_advisory",
      "headline": "pyLoad session persists after privilege revocation or password change",
      "what_changed": "GHSA-jq7h-wrvp-3rgx published 9 October 2026 reports that pyload-ng does not invalidate active sessions when a user's privileges are revoked or password is changed through the REST API. Severity is high. No patched version is listed.",
      "why_matters": "An administrator who revokes a user's access or forces a password reset cannot actually terminate that user's active session. The user retains full access until the session expires naturally or the server restarts, making privilege revocation and credential rotation ineffective as security controls.",
      "what_to_do": "Check whether you are running pyload-ng in production. If so, restart the service to force session invalidation after any privilege change or password reset until a patch is available, and monitor GHSA-jq7h-wrvp-3rgx for a fixed version.",
      "severity": "action_needed",
      "action_type": "verify_exposure",
      "tags": [
        "security",
        "api"
      ],
      "confidence": 0.85,
      "source_name": "GitHub advisories — pip",
      "source_url": "https://api.github.com/advisories?ecosystem=pip&severity=high&per_page=100",
      "published_at": "2026-10-10T12:35:06.268916+00:00",
      "corrected_at": null,
      "correction": null,
      "correction_cause": null,
      "url": "https://radar.trulysovereign.com/items/4968acfb-0e94-42b4-86ae-46c726ca45fb",
      "affects": [
        {
          "id": "pypipyload-ng",
          "type": "package",
          "label": "pypi:pyload-ng",
          "unmapped": true
        },
        {
          "id": "ghsa-jq7h-wrvp-3rgx",
          "type": "cve",
          "label": "GHSA-jq7h-wrvp-3rgx",
          "unmapped": true
        }
      ],
      "action_due": null,
      "time_to_correct": null
    },
    {
      "id": "ae3b7edd-d3ad-43da-af76-17328d81e6cb",
      "channel": "security_advisory",
      "headline": "pyload-ng tar extraction creates device nodes without filter",
      "what_changed": "GitHub published GHSA-fr26-jjhm-638c on 2026-10-09, a high-severity advisory for pyload-ng. The package calls tarfile.extractall() without a filter parameter, allowing tar archives to create device nodes and FIFOs during extraction. No patched version is listed.",
      "why_matters": "An attacker-controlled tar archive can write device nodes or named pipes to the filesystem during extraction, which can be used to read sensitive files, block processes, or escalate privileges depending on where pyload-ng extracts archives and what permissions it runs under.",
      "what_to_do": "Grep your dependency trees for pyload-ng and confirm whether you run it. If you do, check whether it processes tar archives from untrusted sources. No patch is available yet; if you are exposed, consider disabling tar upload/processing or running pyload-ng in a container with device node creation blocked until a fix ships.",
      "severity": "action_needed",
      "action_type": "verify_exposure",
      "tags": [
        "security",
        "api"
      ],
      "confidence": 0.85,
      "source_name": "GitHub advisories — pip",
      "source_url": "https://api.github.com/advisories?ecosystem=pip&severity=high&per_page=100",
      "published_at": "2026-10-10T12:34:55.623993+00:00",
      "corrected_at": null,
      "correction": null,
      "correction_cause": null,
      "url": "https://radar.trulysovereign.com/items/ae3b7edd-d3ad-43da-af76-17328d81e6cb",
      "affects": [
        {
          "id": "pypipyload-ng",
          "type": "package",
          "label": "pypi:pyload-ng",
          "unmapped": true
        },
        {
          "id": "ghsa-fr26-jjhm-638c",
          "type": "cve",
          "label": "GHSA-fr26-jjhm-638c",
          "unmapped": true
        }
      ],
      "action_due": null,
      "time_to_correct": null
    },
    {
      "id": "57f0c5e2-dabd-4e1e-9efa-18e89449d510",
      "channel": "security_advisory",
      "headline": "pyLoad API permission change does not invalidate active sessions",
      "what_changed": "GHSA-889w-m37p-88m5 published 9 October 2026 for pyload-ng. High severity. Api.set_user_permission function fails to invalidate the target user's session when permissions change. No patched version listed in the advisory.",
      "why_matters": "A user whose permissions are revoked retains their active session and can continue operating with the old permission set until the session expires naturally. If you demote or restrict a user account, the change does not take effect until they log out or the session times out.",
      "what_to_do": "Check whether pyload-ng is in your dependency tree. If present, manually invalidate sessions after any permission change — force logout or restart the service — until a patched version is released. Monitor GHSA-889w-m37p-88m5 for the fix.",
      "severity": "action_needed",
      "action_type": "verify_exposure",
      "tags": [
        "security",
        "api"
      ],
      "confidence": 0.75,
      "source_name": "GitHub advisories — pip",
      "source_url": "https://api.github.com/advisories?ecosystem=pip&severity=high&per_page=100",
      "published_at": "2026-10-10T12:34:44.219647+00:00",
      "corrected_at": null,
      "correction": null,
      "correction_cause": null,
      "url": "https://radar.trulysovereign.com/items/57f0c5e2-dabd-4e1e-9efa-18e89449d510",
      "affects": [
        {
          "id": "pypipyload-ng",
          "type": "package",
          "label": "pypi:pyload-ng",
          "unmapped": true
        },
        {
          "id": "ghsa-889w-m37p-88m5",
          "type": "cve",
          "label": "GHSA-889w-m37p-88m5",
          "unmapped": true
        }
      ],
      "action_due": null,
      "time_to_correct": null
    },
    {
      "id": "5ae4d7e1-52ab-4e80-b3e2-5d911e40ff43",
      "channel": "security_advisory",
      "headline": "pyload-ng getUserData endpoint allows admin password brute-force",
      "what_changed": "GitHub published GHSA-68w4-83fh-f2w8 on 2026-10-09, rating it high severity. The getUserData/get_userdata endpoint in pyload-ng is exposed at Perms.ANY permission level, allowing any authenticated account to brute-force the administrator password. No patched version is available.",
      "why_matters": "Any user with valid credentials to your pyload-ng instance can attempt unlimited password guesses against the admin account. Successful brute-force grants full administrative control over the download manager and any systems it can access.",
      "what_to_do": "Check whether you run pyload-ng in production or internal infrastructure. If you do, restrict network access to the instance to trusted IPs only, disable or remove non-admin user accounts, and monitor authentication logs for repeated failed admin login attempts until a patch is released.",
      "severity": "action_needed",
      "action_type": "mitigate",
      "tags": [
        "security",
        "api"
      ],
      "confidence": 0.85,
      "source_name": "GitHub advisories — pip",
      "source_url": "https://api.github.com/advisories?ecosystem=pip&severity=high&per_page=100",
      "published_at": "2026-10-10T12:34:33.79713+00:00",
      "corrected_at": null,
      "correction": null,
      "correction_cause": null,
      "url": "https://radar.trulysovereign.com/items/5ae4d7e1-52ab-4e80-b3e2-5d911e40ff43",
      "affects": [
        {
          "id": "pypipyload-ng",
          "type": "package",
          "label": "pypi:pyload-ng",
          "unmapped": true
        },
        {
          "id": "ghsa-68w4-83fh-f2w8",
          "type": "cve",
          "label": "GHSA-68w4-83fh-f2w8",
          "unmapped": true
        }
      ],
      "action_due": null,
      "time_to_correct": null
    },
    {
      "id": "5af1c9ad-9ed0-4589-9408-c8b128735ae5",
      "channel": "security_advisory",
      "headline": "@tinacms/web-components stored XSS via unvalidated link URLs",
      "what_changed": "GitHub published CVE-2026-108260 on 9 October 2026, a high-severity stored XSS vulnerability in @tinacms/web-components. The tina-markdown component writes rich-text link URLs directly into href attributes without scheme validation. Version 0.2.1 patches the issue.",
      "why_matters": "An attacker who can edit content rendered by tina-markdown can inject javascript: URLs that execute in the context of your application when a user clicks the link. This is stored XSS — the payload persists in your content and fires for every visitor.",
      "what_to_do": "Check package.json and lock files for @tinacms/web-components. If you are running any version before 0.2.1, update to 0.2.1 or later. If you use tina-markdown to render user-supplied or CMS-managed content, audit existing content for javascript: and data: scheme URLs and remove them.",
      "severity": "action_needed",
      "action_type": "patch_now",
      "tags": [
        "security"
      ],
      "confidence": 0.85,
      "source_name": "GitHub advisories — npm",
      "source_url": "https://api.github.com/advisories?ecosystem=npm&severity=high&per_page=100",
      "published_at": "2026-10-10T12:34:18.96864+00:00",
      "corrected_at": null,
      "correction": null,
      "correction_cause": null,
      "url": "https://radar.trulysovereign.com/items/5af1c9ad-9ed0-4589-9408-c8b128735ae5",
      "affects": [
        {
          "id": "npm@tinacms/web-components",
          "type": "package",
          "label": "npm:@tinacms/web-components",
          "unmapped": true
        },
        {
          "id": "cve-2026-108260",
          "type": "cve",
          "label": "CVE-2026-108260"
        }
      ],
      "action_due": null,
      "time_to_correct": null
    },
    {
      "id": "429fe025-8405-41a3-b55a-c73ecc10adca",
      "channel": "security_advisory",
      "headline": "AWS Tools for PowerShell logs cleartext console passwords before 5.0.306",
      "what_changed": "CVE-2026-107783 disclosed on 9 October 2026. AWS Tools for PowerShell versions up to and including 5.0.305 write IAM user cleartext AWS Management Console passwords to command output and log artifacts. Fixed in version 5.0.306.",
      "why_matters": "Local users with access to PowerShell logs or command history can recover IAM credentials in plaintext. These credentials grant console access to AWS accounts with whatever permissions that IAM user holds.",
      "what_to_do": "Upgrade AWS Tools for PowerShell to version 5.0.306 or later. Rotate console passwords for any IAM users whose credentials were used with affected versions, and audit log files on systems running those versions for exposed credentials.",
      "severity": "action_needed",
      "action_type": "patch_now",
      "tags": [
        "security",
        "api"
      ],
      "confidence": 0.95,
      "source_name": "AWS security bulletins",
      "source_url": "https://aws.amazon.com/security/security-bulletins/rss/2026-132-aws/",
      "published_at": "2026-10-10T05:55:48.04291+00:00",
      "corrected_at": null,
      "correction": null,
      "correction_cause": null,
      "url": "https://radar.trulysovereign.com/items/429fe025-8405-41a3-b55a-c73ecc10adca",
      "affects": [
        {
          "id": "cve-2026-107783",
          "type": "cve",
          "label": "CVE-2026-107783"
        },
        {
          "id": "aws-tools-for-powershell",
          "type": "package",
          "label": "AWS Tools for PowerShell",
          "unmapped": true
        },
        {
          "id": "aws",
          "type": "provider",
          "label": "aws"
        }
      ],
      "action_due": null,
      "time_to_correct": null
    },
    {
      "id": "19c82105-5835-4a14-a76e-024de3b938a5",
      "channel": "security_advisory",
      "headline": "Authorization bypass in AWS Amplify GraphQL resolvers allows cross-tenant data reads",
      "what_changed": "AWS disclosed CVE-2026-108096 on 9 October 2026, an authorization flaw in @aws-amplify/graphql-index-transformer that allows authenticated users to read other users' records via crafted GraphQL queries. Affected versions: graphql-index-transformer 2.2.0 to 3.1.1, graphql-api-construct 1.4.0 to 1.21.3, data-construct below 1.17.4. Fixed versions: 3.1.2, 1.21.4, and 1.17.4 respectively.",
      "why_matters": "If you use AWS Amplify API Category to generate GraphQL APIs with per-user authorization rules, authenticated attackers can bypass those rules and read data belonging to other tenants or users. This breaks the security model of any multi-tenant application relying on Amplify's generated resolvers for data isolation.",
      "what_to_do": "Check package.json or yarn.lock for the three named packages. If any are present in the affected version ranges, upgrade to the fixed versions (graphql-index-transformer 3.1.2+, graphql-api-construct 1.21.4+, data-construct 1.17.4+) and redeploy your AppSync API stack.",
      "severity": "action_needed",
      "action_type": "patch_now",
      "tags": [
        "security",
        "api"
      ],
      "confidence": 0.95,
      "source_name": "AWS security bulletins",
      "source_url": "https://aws.amazon.com/security/security-bulletins/rss/2026-133-aws/",
      "published_at": "2026-10-10T05:55:16.119529+00:00",
      "corrected_at": null,
      "correction": null,
      "correction_cause": null,
      "url": "https://radar.trulysovereign.com/items/19c82105-5835-4a14-a76e-024de3b938a5",
      "affects": [
        {
          "id": "cve-2026-108096",
          "type": "cve",
          "label": "CVE-2026-108096"
        },
        {
          "id": "npm@aws-amplify/graphql-index-transformer",
          "type": "package",
          "label": "npm:@aws-amplify/graphql-index-transformer",
          "unmapped": true
        },
        {
          "id": "npm@aws-amplify/graphql-api-construct",
          "type": "package",
          "label": "npm:@aws-amplify/graphql-api-construct",
          "unmapped": true
        },
        {
          "id": "npm@aws-amplify/data-construct",
          "type": "package",
          "label": "npm:@aws-amplify/data-construct",
          "unmapped": true
        },
        {
          "id": "aws",
          "type": "provider",
          "label": "aws"
        }
      ],
      "action_due": null,
      "time_to_correct": null
    },
    {
      "id": "54ecf2c8-3284-4970-980c-13d4f4889dff",
      "channel": "ai_platform_drift",
      "headline": "Claude Managed Agents adds dynamic workflow generation in beta",
      "what_changed": "Claude Platform introduced dynamic workflows for Managed Agents on October 9, 2026, available in beta with the managed-agents-2026-04-01 header. Agents can now write and execute multi-phase workflows that run many agents in parallel and combine results. Enable by setting the agent's multiagent field to {\"type\": \"multiagent_20261001\", \"workflows\": {\"type\": \"enabled\"}}. Workflow execution status is exposed through workflow_run.* events on the session event stream.",
      "why_matters": "For tasks involving large-scale parallel processing—such as reviewing hundreds of documents—agents can now decompose work into programmatic workflows instead of processing serially. This changes the execution model from single-agent sequential processing to multi-agent parallel execution with result aggregation, which affects both performance characteristics and cost patterns for high-volume workloads.",
      "what_to_do": "If you have Managed Agents workloads that process large document sets or other parallelizable tasks, test the beta by adding the managed-agents-2026-04-01 header, configuring the multiagent field as specified, and adding system prompt guidance on when to initiate workflow runs. Implement workflow_run.* event handlers to track execution status.",
      "severity": "worth_knowing",
      "action_type": "verify_only",
      "tags": [
        "api",
        "model"
      ],
      "confidence": 0.85,
      "source_name": "Claude Platform release notes",
      "source_url": "https://platform.claude.com/docs/en/release-notes/overview#october-9-2026",
      "published_at": "2026-10-09T22:42:31.622354+00:00",
      "corrected_at": null,
      "correction": null,
      "correction_cause": null,
      "url": "https://radar.trulysovereign.com/items/54ecf2c8-3284-4970-980c-13d4f4889dff",
      "affects": [
        {
          "id": "claude-managed-agents",
          "type": "product",
          "label": "claude managed agents",
          "unmapped": true
        },
        {
          "id": "managed-agents-2026-04-01",
          "type": "api",
          "label": "managed-agents-2026-04-01",
          "unmapped": true
        }
      ],
      "action_due": null,
      "time_to_correct": null
    },
    {
      "id": "bcba245e-af6e-4eeb-85d1-9f35aca95826",
      "channel": "regulatory_change",
      "headline": "Italian DPA: controllers cannot require specific channels for rights requests",
      "what_changed": "On 3 July 2026, Italy's DPA fined BBVA EUR 5,508,000 for continuing direct marketing for seven months after a customer objected via the bank's app and customer service. The DPA ruled that controllers must accept rights requests through any channel the customer uses and cannot require submission through a preferred channel listed in the privacy policy. BBVA must report compliance measures to the DPA within 30 days of notification.",
      "why_matters": "If your product offers multiple contact points—app settings, support tickets, email—you must honor GDPR rights requests from any of them, not just a designated address. A technical failure that prevents synchronization between systems does not excuse continued processing after objection. Customer service telling users a control does not exist when it does is itself a GDPR violation under Article 12.",
      "what_to_do": "Audit every channel where a user can contact you (app settings, support forms, chat, email) and verify that objections and deletion requests submitted through any of them reach the systems that execute them. If you currently route users to a specific email for rights requests, remove any language suggesting other channels are invalid.",
      "severity": "worth_knowing",
      "action_type": "assess_exposure",
      "tags": [
        "terms",
        "security"
      ],
      "confidence": 0.85,
      "source_name": "EDPB news",
      "source_url": "https://www.edpb.europa.eu/news/italian-dpa-fines-bbva-eur-5-508-000-for-failing-to-respect-a-customers-objection-to-direct_en",
      "published_at": "2026-10-09T22:40:45.627996+00:00",
      "corrected_at": null,
      "correction": null,
      "correction_cause": null,
      "url": "https://radar.trulysovereign.com/items/bcba245e-af6e-4eeb-85d1-9f35aca95826",
      "affects": [
        {
          "id": "gdpr",
          "type": "regulation",
          "label": "gdpr",
          "unmapped": true
        },
        {
          "id": "eu",
          "type": "jurisdiction",
          "label": "european union"
        }
      ],
      "action_due": null,
      "time_to_correct": null
    },
    {
      "id": "b66157ad-83dd-4a1f-bee3-0b399973bace",
      "channel": "regulatory_change",
      "headline": "Italian DPA rules persistent identifiers plus health details enable re-identification",
      "what_changed": "On 23 September 2026, Italy's DPA fined IQVIA €7M and ruled that a database of ~1M patients was not anonymous as claimed. The authority found that a persistent patient identifier combined with year of birth, sex, diagnoses, prescriptions, and location data allowed individuals to be singled out and potentially re-identified using reasonably available means. The database also contained directly identifying information for 3,370 patients. IQVIA was found to have processed health data without legal basis, failed to conduct a data protection impact assessment, and failed to establish retention periods or adequate security measures.",
      "why_matters": "This establishes that persistent identifiers combined with detailed demographic and clinical attributes do not constitute anonymization under GDPR, even when names are removed. If your product assigns stable IDs to individuals and stores granular health or behavioral data alongside demographic fields, EU regulators may treat that data as personal and subject to Article 9 special category rules. The finding directly contradicts a pseudonymization-as-anonymization approach that multiple health analytics and research platforms have relied on.",
      "what_to_do": "Audit any database where you assign persistent identifiers to individuals and store health, biometric, or other Article 9 data with demographic or location fields. If the combination allows singling out individuals over time, treat it as personal data requiring a legal basis (typically explicit consent or legitimate interest with safeguards), conduct a DPIA, define retention periods, and provide Article 13 notices. If you cannot establish a legal basis, either have data minimized at source by the collecting entity or cease processing within 120 days, the timeline Italy imposed on IQVIA.",
      "severity": "action_needed",
      "action_type": "assess_exposure",
      "tags": [
        "security",
        "terms"
      ],
      "confidence": 0.88,
      "source_name": "EDPB news",
      "source_url": "https://www.edpb.europa.eu/news/italian-dpa-fines-iqvia-eur-7-000-000-for-unlawful-processing-of-patients-health-data_en",
      "published_at": "2026-10-09T22:40:20.999148+00:00",
      "corrected_at": null,
      "correction": null,
      "correction_cause": null,
      "url": "https://radar.trulysovereign.com/items/b66157ad-83dd-4a1f-bee3-0b399973bace",
      "affects": [
        {
          "id": "gdpr",
          "type": "regulation",
          "label": "gdpr",
          "unmapped": true
        },
        {
          "id": "eu",
          "type": "jurisdiction",
          "label": "european union"
        }
      ],
      "action_due": null,
      "time_to_correct": null
    },
    {
      "id": "50c8adbd-28d4-40d6-aba2-5793d650ecf5",
      "channel": "ai_platform_drift",
      "headline": "DeepSeek Flash completion pricing doubled to $1.20/M tokens",
      "what_changed": "OpenRouter's pricing for ~deepseek/deepseek-flash-latest changed on 2026-10-09. The captured completion base rate changed from $0.60 to $1.20 per 1M tokens. Prompt pricing remains $0.016 per 1M tokens.",
      "why_matters": "Using the captured base rates for ~deepseek/deepseek-flash-latest, 100M completion tokens per day cost $60.00 before and $120.00 after, excluding all other charges. This is a 100.0% increase in completion token costs, affecting all workloads generating output with this model.",
      "what_to_do": "Reforecast your OpenRouter spend if you use ~deepseek/deepseek-flash-latest. To estimate the added completion cost for ~deepseek/deepseek-flash-latest in dollars, multiply completion token volume by 0.60 and divide by 1,000,000, using the captured base-rate difference in dollars per 1M tokens. Update budgets and alert thresholds before month-end billing.",
      "severity": "action_needed",
      "action_type": "budget",
      "tags": [
        "pricing",
        "model"
      ],
      "confidence": 0.95,
      "source_name": "OpenRouter model catalogue",
      "source_url": "https://openrouter.ai/api/v1/models",
      "published_at": "2026-10-09T22:40:02.359518+00:00",
      "corrected_at": null,
      "correction": null,
      "correction_cause": null,
      "url": "https://radar.trulysovereign.com/items/50c8adbd-28d4-40d6-aba2-5793d650ecf5",
      "affects": [
        {
          "id": "deepseek/deepseek-flash-latest",
          "type": "model",
          "label": "~deepseek/deepseek-flash-latest",
          "unmapped": true
        },
        {
          "id": "openrouter",
          "type": "provider",
          "label": "openrouter"
        }
      ],
      "action_due": null,
      "time_to_correct": null
    },
    {
      "id": "059377c1-33ed-445e-a11b-062a630d34ff",
      "channel": "ai_platform_drift",
      "headline": "DeepSeek Flash Latest completion cost halved, prompt cost up 33%",
      "what_changed": "OpenRouter's pricing for ~deepseek/deepseek-flash-latest changed: captured completion base rate changed from $1.20 to $0.60 per 1M tokens, and captured prompt base rate changed from $0.012 to $0.016 per 1M tokens. The completion rate decreased 50.0% and the prompt rate increased 33.3%.",
      "why_matters": "The net effect depends on your completion-to-prompt ratio. For workloads generating ten completion tokens for every prompt token, total cost per request drops 49.9%. For workloads generating one completion token per prompt token, cost drops 49.2%. High-output use cases see the largest savings; prompt-heavy workloads still see a net decrease but smaller.",
      "what_to_do": "Pull your last 30 days of DeepSeek Flash usage from OpenRouter logs, calculate your actual completion-to-prompt ratio, and reforecast your monthly spend using the new rates. If you generate more than one completion token per prompt token, your costs will decrease; update your budget accordingly.",
      "severity": "worth_knowing",
      "action_type": "budget",
      "tags": [
        "pricing",
        "model"
      ],
      "confidence": 0.95,
      "source_name": "OpenRouter model catalogue",
      "source_url": "https://openrouter.ai/api/v1/models",
      "published_at": "2026-10-09T13:22:29.063036+00:00",
      "corrected_at": null,
      "correction": null,
      "correction_cause": null,
      "url": "https://radar.trulysovereign.com/items/059377c1-33ed-445e-a11b-062a630d34ff",
      "affects": [
        {
          "id": "deepseek/deepseek-flash-latest",
          "type": "model",
          "label": "~deepseek/deepseek-flash-latest",
          "unmapped": true
        },
        {
          "id": "openrouter",
          "type": "provider",
          "label": "openrouter"
        }
      ],
      "action_due": null,
      "time_to_correct": null
    },
    {
      "id": "0bb91971-31c8-4e96-932f-e280960ef59f",
      "channel": "ai_platform_drift",
      "headline": "DeepSeek V4 Flash prompt pricing dropped 67% on OpenRouter",
      "what_changed": "OpenRouter's deepseek/deepseek-v4-flash model reduced its prompt token price from $0.0173 to $0.0057 per 1M tokens, a 67.1% decrease. Completion pricing remains $1.28 per 1M tokens.",
      "why_matters": "Using the captured base rates for deepseek/deepseek-v4-flash, 100M prompt tokens per day cost $1.73 before and $0.57 after, excluding all other charges. High-volume prompt workloads see immediate cost reduction without code changes.",
      "what_to_do": "Reforecast your OpenRouter spend if you route traffic to deepseek/deepseek-v4-flash. Pull October actuals and apply the new rate to your prompt token volume to update your budget.",
      "severity": "worth_knowing",
      "action_type": "budget",
      "tags": [
        "pricing",
        "model"
      ],
      "confidence": 0.95,
      "source_name": "OpenRouter model catalogue",
      "source_url": "https://openrouter.ai/api/v1/models",
      "published_at": "2026-10-09T13:22:04.790346+00:00",
      "corrected_at": null,
      "correction": null,
      "correction_cause": null,
      "url": "https://radar.trulysovereign.com/items/0bb91971-31c8-4e96-932f-e280960ef59f",
      "affects": [
        {
          "id": "openrouter",
          "type": "provider",
          "label": "openrouter"
        },
        {
          "id": "deepseek-v4-flash",
          "type": "model",
          "label": "deepseek/deepseek-v4-flash"
        },
        {
          "id": "deepseek",
          "type": "provider",
          "label": "deepseek"
        }
      ],
      "action_due": null,
      "time_to_correct": null
    },
    {
      "id": "c4a08adf-85f5-4f80-9c1a-f48ed975c85e",
      "channel": "security_advisory",
      "headline": "PraisonAI agents package SSRF bypass exposes internal responses",
      "what_changed": "GitHub published CVE-2026-61430 on 8 October 2026, a high-severity SSRF vulnerability in praisonaiagents. The web_crawl function's protection can be bypassed via DNS rebinding, allowing disclosure of internal network responses. First patched version is 1.6.78.",
      "why_matters": "If you run praisonaiagents below 1.6.78, an attacker can use DNS rebinding to make the agent crawl internal endpoints and return their responses, exposing internal APIs, metadata services, or admin interfaces that should not be reachable from outside.",
      "what_to_do": "Grep your dependencies for praisonaiagents and check the version. If below 1.6.78, update to 1.6.78 or later this week. If you cannot update immediately, disable or firewall the web_crawl feature until you can.",
      "severity": "action_needed",
      "action_type": "patch_now",
      "tags": [
        "security",
        "api"
      ],
      "confidence": 0.95,
      "source_name": "GitHub advisories — pip",
      "source_url": "https://api.github.com/advisories?ecosystem=pip&severity=high&per_page=100",
      "published_at": "2026-10-09T13:21:52.411251+00:00",
      "corrected_at": null,
      "correction": null,
      "correction_cause": null,
      "url": "https://radar.trulysovereign.com/items/c4a08adf-85f5-4f80-9c1a-f48ed975c85e",
      "affects": [
        {
          "id": "pypipraisonaiagents",
          "type": "package",
          "label": "pypi:praisonaiagents",
          "unmapped": true
        },
        {
          "id": "cve-2026-61430",
          "type": "cve",
          "label": "CVE-2026-61430"
        }
      ],
      "action_due": null,
      "time_to_correct": null
    },
    {
      "id": "b6665400-b896-46fa-b661-d527fdd81535",
      "channel": "security_advisory",
      "headline": "PraisonAI agents package executes unverified Python files on plugin load",
      "what_changed": "GitHub published CVE-2026-61446 on 8 October 2026, rating it high severity. The praisonaiagents package auto-discovers and executes arbitrary Python files during plugin loading without verification. Version 1.6.78 patches the vulnerability.",
      "why_matters": "Any deployment running praisonaiagents before 1.6.78 will execute Python code from the plugin discovery path without validation. An attacker who can write to that path — through a compromised dependency, a shared filesystem, or a supply chain insertion — achieves arbitrary code execution in the agent runtime.",
      "what_to_do": "Grep your dependency trees for praisonaiagents and check the installed version. If you are running anything before 1.6.78, update to 1.6.78 or later in this patch cycle. If you cannot update immediately, disable plugin auto-discovery or restrict write access to the plugin path until you can.",
      "severity": "action_needed",
      "action_type": "patch_now",
      "tags": [
        "security"
      ],
      "confidence": 0.95,
      "source_name": "GitHub advisories — pip",
      "source_url": "https://api.github.com/advisories?ecosystem=pip&severity=high&per_page=100",
      "published_at": "2026-10-09T13:21:41.726245+00:00",
      "corrected_at": null,
      "correction": null,
      "correction_cause": null,
      "url": "https://radar.trulysovereign.com/items/b6665400-b896-46fa-b661-d527fdd81535",
      "affects": [
        {
          "id": "pypipraisonaiagents",
          "type": "package",
          "label": "pypi:praisonaiagents",
          "unmapped": true
        },
        {
          "id": "cve-2026-61446",
          "type": "cve",
          "label": "CVE-2026-61446"
        }
      ],
      "action_due": null,
      "time_to_correct": null
    },
    {
      "id": "c4f9161e-69da-4a35-a43f-761498b3d45c",
      "channel": "security_advisory",
      "headline": "PraisonAI 4.6.78 patches unauthenticated MCP transport exposing tool calls",
      "what_changed": "GitHub published CVE-2026-61427 on 8 October 2026. PraisonAI's MCP HTTP-stream transport runs unauthenticated by default, exposing tool enumeration and an unvalidated tool-call surface. Severity is high. Version 4.6.78 patches the vulnerability.",
      "why_matters": "An unauthenticated transport means any network actor can enumerate available tools and invoke them without credentials. If PraisonAI agents have access to internal APIs, databases, or file systems through MCP tools, those surfaces are now remotely callable without authentication.",
      "what_to_do": "Upgrade praisonai to 4.6.78 or later. If you cannot upgrade immediately, disable the MCP HTTP-stream transport or place it behind authenticated reverse proxy until you can patch.",
      "severity": "action_needed",
      "action_type": "patch_now",
      "tags": [
        "security",
        "api"
      ],
      "confidence": 0.95,
      "source_name": "GitHub advisories — pip",
      "source_url": "https://api.github.com/advisories?ecosystem=pip&severity=high&per_page=100",
      "published_at": "2026-10-09T13:21:31.876021+00:00",
      "corrected_at": null,
      "correction": null,
      "correction_cause": null,
      "url": "https://radar.trulysovereign.com/items/c4f9161e-69da-4a35-a43f-761498b3d45c",
      "affects": [
        {
          "id": "pypipraisonai",
          "type": "package",
          "label": "pypi:praisonai",
          "unmapped": true
        },
        {
          "id": "cve-2026-61427",
          "type": "cve",
          "label": "CVE-2026-61427"
        }
      ],
      "action_due": null,
      "time_to_correct": null
    },
    {
      "id": "1fd0c589-28ad-4778-8878-58a4d6c59f50",
      "channel": "security_advisory",
      "headline": "Pydantic AI web chat UI allows remote sites to trigger agent tool execution",
      "what_changed": "CVE-2026-107295 published 8 October 2026. The web chat UI exposed by Agent.to_web() and clai web in pydantic-ai and pydantic-ai-slim allows a website visited by the developer to trigger agent runs and execute server-side tools on the local chat endpoint. Patched in versions 1.107.4 and 2.28.0.",
      "why_matters": "If you run the local web UI during development, a malicious site in another browser tab can execute arbitrary agent tools on your machine without interaction. This is server-side execution, not just data exfiltration — any tool the agent has access to can be invoked remotely.",
      "what_to_do": "Update pydantic-ai or pydantic-ai-slim to 1.107.4 (1.x branch) or 2.28.0 (2.x branch). If you do not use Agent.to_web() or clai web, verify your dependency tree does not pull in the vulnerable versions through another package.",
      "severity": "action_needed",
      "action_type": "patch_now",
      "tags": [
        "security",
        "api"
      ],
      "confidence": 0.95,
      "source_name": "GitHub advisories — pip",
      "source_url": "https://api.github.com/advisories?ecosystem=pip&severity=high&per_page=100",
      "published_at": "2026-10-09T13:21:22.49829+00:00",
      "corrected_at": null,
      "correction": null,
      "correction_cause": null,
      "url": "https://radar.trulysovereign.com/items/1fd0c589-28ad-4778-8878-58a4d6c59f50",
      "affects": [
        {
          "id": "pypipydantic-ai",
          "type": "package",
          "label": "pypi:pydantic-ai",
          "unmapped": true
        },
        {
          "id": "pypipydantic-ai-slim",
          "type": "package",
          "label": "pypi:pydantic-ai-slim",
          "unmapped": true
        },
        {
          "id": "cve-2026-107295",
          "type": "cve",
          "label": "CVE-2026-107295"
        }
      ],
      "action_due": null,
      "time_to_correct": null
    },
    {
      "id": "6be72fdd-221e-49d2-bee4-17002f315eff",
      "channel": "security_advisory",
      "headline": "PraisonAI shell command allowlist bypass fixed in 4.6.78",
      "what_changed": "CVE-2026-61434 published 8 October 2026 for praisonai package. High severity shell command execution vulnerability via find -exec built-in action bypasses the command allowlist. Fixed in version 4.6.78.",
      "why_matters": "An attacker can execute arbitrary shell commands despite allowlist controls by abusing find's -exec flag. This defeats the security boundary the allowlist is meant to enforce, allowing full command execution in contexts where only specific commands should be permitted.",
      "what_to_do": "Upgrade praisonai to 4.6.78 or later. If you use praisonai's command execution features, audit logs for find commands with -exec flags to check for exploitation attempts before the patch.",
      "severity": "action_needed",
      "action_type": "patch_now",
      "tags": [
        "security",
        "api"
      ],
      "confidence": 0.95,
      "source_name": "GitHub advisories — pip",
      "source_url": "https://api.github.com/advisories?ecosystem=pip&severity=high&per_page=100",
      "published_at": "2026-10-09T13:21:12.311563+00:00",
      "corrected_at": null,
      "correction": null,
      "correction_cause": null,
      "url": "https://radar.trulysovereign.com/items/6be72fdd-221e-49d2-bee4-17002f315eff",
      "affects": [
        {
          "id": "pypipraisonai",
          "type": "package",
          "label": "pypi:praisonai",
          "unmapped": true
        },
        {
          "id": "cve-2026-61434",
          "type": "cve",
          "label": "CVE-2026-61434"
        }
      ],
      "action_due": null,
      "time_to_correct": null
    },
    {
      "id": "75bf2a91-8a3e-4b2c-b5e9-bab4c35b8de6",
      "channel": "security_advisory",
      "headline": "PraisonAI platform authorization bypass patched in 0.1.9",
      "what_changed": "GitHub published CVE-2026-61442 on 8 October 2026, a high-severity authorization bypass in praisonai-platform. Platform members can overwrite owner resources via PATCH routes and bypass project lead reassignment deletion. The vulnerability is patched in version 0.1.9.",
      "why_matters": "Any deployment running praisonai-platform below 0.1.9 allows non-owner users to escalate privileges and modify resources they should not control. This breaks access control assumptions in multi-user environments.",
      "what_to_do": "Upgrade praisonai-platform to 0.1.9 or later. If you run this package in production, audit recent PATCH activity for unauthorized resource modifications before upgrading.",
      "severity": "action_needed",
      "action_type": "patch_now",
      "tags": [
        "security",
        "api"
      ],
      "confidence": 0.95,
      "source_name": "GitHub advisories — pip",
      "source_url": "https://api.github.com/advisories?ecosystem=pip&severity=high&per_page=100",
      "published_at": "2026-10-09T13:21:02.454078+00:00",
      "corrected_at": null,
      "correction": null,
      "correction_cause": null,
      "url": "https://radar.trulysovereign.com/items/75bf2a91-8a3e-4b2c-b5e9-bab4c35b8de6",
      "affects": [
        {
          "id": "pypipraisonai-platform",
          "type": "package",
          "label": "pypi:praisonai-platform",
          "unmapped": true
        }
      ],
      "action_due": null,
      "time_to_correct": null
    },
    {
      "id": "ce9dada2-e2aa-4a01-a263-42aa008360d8",
      "channel": "security_advisory",
      "headline": "PraisonAI agents package executes scripts without path validation",
      "what_changed": "GitHub published CVE-2026-61443 on 8 October 2026, a high-severity vulnerability in praisonaiagents. The SkillTools component executes scripts without validating file paths, allowing arbitrary script execution. Version 1.6.78 patches the issue.",
      "why_matters": "An attacker who can influence script paths passed to SkillTools can execute arbitrary code on the system running the agent. This bypasses intended containment and gives full process privileges to untrusted input.",
      "what_to_do": "Check your dependency tree for praisonaiagents. If present and below 1.6.78, update to 1.6.78 or later this week. If you cannot update immediately, audit all code paths that pass file arguments to SkillTools and ensure they reject user-controlled input.",
      "severity": "action_needed",
      "action_type": "patch_now",
      "tags": [
        "security",
        "api"
      ],
      "confidence": 0.85,
      "source_name": "GitHub advisories — pip",
      "source_url": "https://api.github.com/advisories?ecosystem=pip&severity=high&per_page=100",
      "published_at": "2026-10-09T13:20:53.528176+00:00",
      "corrected_at": null,
      "correction": null,
      "correction_cause": null,
      "url": "https://radar.trulysovereign.com/items/ce9dada2-e2aa-4a01-a263-42aa008360d8",
      "affects": [
        {
          "id": "pypipraisonaiagents",
          "type": "package",
          "label": "pypi:praisonaiagents",
          "unmapped": true
        },
        {
          "id": "cve-2026-61443",
          "type": "cve",
          "label": "CVE-2026-61443"
        }
      ],
      "action_due": null,
      "time_to_correct": null
    },
    {
      "id": "f8dd14a0-6874-4ade-b2dd-e2d1ec8b6ce0",
      "channel": "security_advisory",
      "headline": "PraisonAI 4.6.78 patches YAML injection in code generator",
      "what_changed": "CVE-2026-61433 published 8 October 2026. PraisonAI versions before 4.6.78 embed unescaped YAML fields directly into generated Python source code in the API deploy code generator. Severity rated high. First patched version is 4.6.78.",
      "why_matters": "An attacker controlling YAML input can inject arbitrary Python code that executes when the generated deployment code runs. This is a code generation vulnerability in an AI framework SDK — the generated code itself is the attack surface.",
      "what_to_do": "Upgrade praisonai to 4.6.78 or later if you use the API deploy code generator. If you cannot upgrade immediately, audit any generated deployment code for unescaped YAML content and do not run code generated from untrusted YAML sources.",
      "severity": "action_needed",
      "action_type": "patch_now",
      "tags": [
        "security",
        "api"
      ],
      "confidence": 0.88,
      "source_name": "GitHub advisories — pip",
      "source_url": "https://api.github.com/advisories?ecosystem=pip&severity=high&per_page=100",
      "published_at": "2026-10-09T13:20:42.205134+00:00",
      "corrected_at": null,
      "correction": null,
      "correction_cause": null,
      "url": "https://radar.trulysovereign.com/items/f8dd14a0-6874-4ade-b2dd-e2d1ec8b6ce0",
      "affects": [
        {
          "id": "pypipraisonai",
          "type": "package",
          "label": "pypi:praisonai",
          "unmapped": true
        },
        {
          "id": "cve-2026-61433",
          "type": "cve",
          "label": "CVE-2026-61433"
        }
      ],
      "action_due": null,
      "time_to_correct": null
    },
    {
      "id": "76f3c874-3f0a-4ebe-9661-e6e72c58d035",
      "channel": "ai_platform_drift",
      "headline": "DeepSeek V4 Flash prompt pricing increased 22% on OpenRouter",
      "what_changed": "OpenRouter raised the prompt token price for deepseek/deepseek-v4-flash-latest from $0.0154/M to $0.0188/M tokens, a 22.1% increase. Completion pricing remains $1.28/M tokens.",
      "why_matters": "Any application using this model through OpenRouter will see prompt costs rise by roughly one-fifth. For workloads processing large context windows (this model supports 1M tokens), the increase compounds quickly—a 500K token prompt that cost $7.70 now costs $9.40.",
      "what_to_do": "Reforecast your OpenRouter spend if you call this model. If prompt volume is high relative to completions, compare the new blended rate against other providers or DeepSeek's direct API to confirm OpenRouter remains cost-effective.",
      "severity": "worth_knowing",
      "action_type": "budget",
      "tags": [
        "pricing",
        "model"
      ],
      "confidence": 0.95,
      "source_name": "OpenRouter model catalogue",
      "source_url": "https://openrouter.ai/api/v1/models",
      "published_at": "2026-10-03T11:41:33.031225+00:00",
      "corrected_at": "2026-10-03T23:12:59.959+00:00",
      "correction": "Correction — The original workload example overstated both dollar amounts by 1,000×. Using the rates quoted in this item, 500K prompt tokens cost $0.0077 before and $0.0094 after per request, excluding other charges. This verifies internal arithmetic only; historical source rate applicability and effective dates remain unverified.",
      "correction_cause": "arithmetic",
      "url": "https://radar.trulysovereign.com/items/76f3c874-3f0a-4ebe-9661-e6e72c58d035",
      "affects": [
        {
          "id": "openrouter",
          "type": "provider",
          "label": "openrouter"
        },
        {
          "id": "deepseek-v4-flash",
          "type": "model",
          "label": "deepseek/deepseek-v4-flash-latest"
        },
        {
          "id": "deepseek",
          "type": "provider",
          "label": "deepseek"
        }
      ],
      "action_due": null,
      "time_to_correct": "11h 31m"
    },
    {
      "id": "12d5bda2-40d0-4fc1-9db7-2dd74cadedfe",
      "channel": "ai_platform_drift",
      "headline": "DeepSeek V4 Flash 0731 prompt pricing tripled to $0.0154/M tokens",
      "what_changed": "OpenRouter increased the prompt token price for deepseek/deepseek-v4-flash-0731 from $0.0051/M to $0.0154/M tokens, a 202% increase. Completion pricing remains $1.28/M tokens.",
      "why_matters": "Applications using this model will see input costs triple. A workload processing 100M prompt tokens daily goes from $510/day to $1,540/day in prompt costs alone.",
      "what_to_do": "Reforecast your API budget for this model and notify whoever owns the spend. If cost is a constraint, evaluate whether to switch to a different model or renegotiate volume pricing.",
      "severity": "action_needed",
      "action_type": "budget",
      "tags": [
        "pricing",
        "model"
      ],
      "confidence": 0.95,
      "source_name": "OpenRouter model catalogue",
      "source_url": "https://openrouter.ai/api/v1/models",
      "published_at": "2026-10-03T05:20:38.215614+00:00",
      "corrected_at": "2026-10-03T23:15:16.312+00:00",
      "correction": "Correction — The original workload example overstated both dollar amounts by 1,000×. Using the rates quoted in this item, 100M prompt tokens per day cost $0.51 before and $1.54 after, excluding other charges. This verifies internal arithmetic only; historical source rate applicability and effective dates remain unverified.",
      "correction_cause": "arithmetic",
      "url": "https://radar.trulysovereign.com/items/12d5bda2-40d0-4fc1-9db7-2dd74cadedfe",
      "affects": [
        {
          "id": "deepseek-v4-flash-0731",
          "type": "model",
          "label": "deepseek/deepseek-v4-flash-0731",
          "unmapped": true
        },
        {
          "id": "openrouter",
          "type": "provider",
          "label": "openrouter"
        },
        {
          "id": "deepseek",
          "type": "provider",
          "label": "deepseek"
        }
      ],
      "action_due": null,
      "time_to_correct": "17h 55m"
    },
    {
      "id": "f5ae440a-0f63-4f88-836b-56085b842793",
      "channel": "ai_platform_drift",
      "headline": "DeepSeek V4 Flash 0731 prompt pricing dropped 55.7%",
      "what_changed": "OpenRouter reduced prompt token pricing for deepseek/deepseek-v4-flash-0731 from $0.0115/M tokens to $0.0051/M tokens, effective now. Completion pricing remains $1.28/M tokens.",
      "why_matters": "If you are running this model at volume, your inference costs just dropped by more than half on the prompt side. A workload processing 100M prompt tokens per day now costs $510 instead of $1,150.",
      "what_to_do": "Reforecast your October inference budget if this model accounts for material spend. Pull actual token counts from logs to calculate the new monthly run rate.",
      "severity": "worth_knowing",
      "action_type": "budget",
      "tags": [
        "pricing",
        "model"
      ],
      "confidence": 0.95,
      "source_name": "OpenRouter model catalogue",
      "source_url": "https://openrouter.ai/api/v1/models",
      "published_at": "2026-10-03T01:37:44.671233+00:00",
      "corrected_at": "2026-10-03T23:15:49.65+00:00",
      "correction": "Correction — The original workload example overstated both dollar amounts by 1,000×. Using the rates quoted in this item, 100M prompt tokens per day cost $1.15 before and $0.51 after, excluding other charges. This verifies internal arithmetic only; historical source rate applicability and effective dates remain unverified.",
      "correction_cause": "arithmetic",
      "url": "https://radar.trulysovereign.com/items/f5ae440a-0f63-4f88-836b-56085b842793",
      "affects": [
        {
          "id": "deepseek-v4-flash-0731",
          "type": "model",
          "label": "deepseek/deepseek-v4-flash-0731",
          "unmapped": true
        },
        {
          "id": "openrouter",
          "type": "provider",
          "label": "openrouter"
        },
        {
          "id": "deepseek",
          "type": "provider",
          "label": "deepseek"
        }
      ],
      "action_due": null,
      "time_to_correct": "21h 38m"
    },
    {
      "id": "c9baa04d-12f0-4e95-8d90-2960219e8e46",
      "channel": "ai_platform_drift",
      "headline": "DeepSeek V4 Flash 0731 prompt pricing drops 37% on OpenRouter",
      "what_changed": "OpenRouter reduced prompt token pricing for deepseek/deepseek-v4-flash-0731 from $0.0171/M tokens to $0.0108/M tokens, effective now. Completion pricing remains $1.28/M tokens.",
      "why_matters": "If you are routing prompt-heavy workloads through this model, your per-request cost just decreased by more than a third. A system processing 100M prompt tokens monthly saves $630.",
      "what_to_do": "Reforecast your October AI spend if this model accounts for material volume. If you capped usage or switched providers due to cost, re-evaluate whether those constraints still apply.",
      "severity": "worth_knowing",
      "action_type": "budget",
      "tags": [
        "pricing",
        "model"
      ],
      "confidence": 0.95,
      "source_name": "OpenRouter model catalogue",
      "source_url": "https://openrouter.ai/api/v1/models",
      "published_at": "2026-10-01T12:37:51.942282+00:00",
      "corrected_at": "2026-10-02T17:58:23.945732+00:00",
      "correction": "[CORRECTION · WHY IT MATTERS] Original: “A system processing 100M prompt tokens monthly saves $630.” Fact: Using the quoted or captured rates, 100M prompt tokens per month saves $0.63/month, not $630. Vendor rate applicability remains unverified.\nCaptured arithmetic only; vendor rate validity, applicability and effective conditions remain unverified.",
      "correction_cause": "arithmetic",
      "url": "https://radar.trulysovereign.com/items/c9baa04d-12f0-4e95-8d90-2960219e8e46",
      "affects": [
        {
          "id": "deepseek-v4-flash-0731",
          "type": "model",
          "label": "deepseek/deepseek-v4-flash-0731",
          "unmapped": true
        },
        {
          "id": "openrouter",
          "type": "provider",
          "label": "openrouter"
        },
        {
          "id": "deepseek",
          "type": "provider",
          "label": "deepseek"
        }
      ],
      "action_due": null,
      "time_to_correct": "29h 21m"
    },
    {
      "id": "ac837684-f229-4f89-a6f1-c847d8fd0ff8",
      "channel": "ai_platform_drift",
      "headline": "DeepSeek V4.1 Flash prompt pricing reduced 21.5% on OpenRouter",
      "what_changed": "OpenRouter reduced prompt token pricing for deepseek/deepseek-v4.1-flash from $0.0198/M tokens to $0.0155/M tokens, effective now. Completion pricing remains $0.396/M tokens.",
      "why_matters": "Applications with high prompt volumes will see lower costs. A workload sending 100M prompt tokens per day saves $430/month. Existing cost projections and budgets based on the previous rate are now overstated.",
      "what_to_do": "Update cost forecasts and billing estimates for any service using this model. If you route between models based on cost, re-evaluate whether this changes your selection logic.",
      "severity": "worth_knowing",
      "action_type": "budget",
      "tags": [
        "pricing",
        "model"
      ],
      "confidence": 0.95,
      "source_name": "OpenRouter model catalogue",
      "source_url": "https://openrouter.ai/api/v1/models",
      "published_at": "2026-10-01T04:38:43.923145+00:00",
      "corrected_at": "2026-10-02T17:58:23.945732+00:00",
      "correction": "[CORRECTION · WHY IT MATTERS] Original: “A workload sending 100M prompt tokens per day saves $430/month.” Fact: Using the quoted rounded rates, 100M prompt tokens/day saves $0.43/day or $12.90 per 30 days. Using the saved raw diff after-rate $0.015543/M, it saves $0.4257/day or $12.771 per 30 days. Neither supports $430/month. Vendor rates and applicability remain unverified.\nCaptured arithmetic only; vendor rate validity, applicability and effective conditions remain unverified.",
      "correction_cause": "arithmetic",
      "url": "https://radar.trulysovereign.com/items/ac837684-f229-4f89-a6f1-c847d8fd0ff8",
      "affects": [
        {
          "id": "deepseek-v4.1-flash",
          "type": "model",
          "label": "deepseek/deepseek-v4.1-flash"
        },
        {
          "id": "openrouter",
          "type": "provider",
          "label": "openrouter"
        },
        {
          "id": "deepseek",
          "type": "provider",
          "label": "deepseek"
        }
      ],
      "action_due": null,
      "time_to_correct": "37h 20m"
    },
    {
      "id": "36df294f-c8ff-44d4-8f35-183cdfce11eb",
      "channel": "ai_platform_drift",
      "headline": "DeepSeek V4 Flash pricing dropped 90% on completion tokens",
      "what_changed": "OpenRouter reduced pricing for deepseek/deepseek-v4-flash-latest: completion tokens from $1.25/M to $0.13/M (-89.5%), prompt tokens from $0.012/M to $0.0099/M (-17.5%). Change is live as of 30 September 2026.",
      "why_matters": "Total cost per request drops 89-90% across all workload mixes. A workload generating ten completion tokens for every prompt token now costs $0.0014/M tokens instead of $0.0126/M tokens. Existing budget forecasts are now overstated by roughly 10x.",
      "what_to_do": "Reforecast monthly spend for any service using this model and notify finance or whoever owns the AI budget. If you allocated budget assuming the old rate, you have 90% of it available for other work or can reduce the allocation.",
      "severity": "worth_knowing",
      "action_type": "budget",
      "tags": [
        "pricing",
        "model"
      ],
      "confidence": 0.95,
      "source_name": "OpenRouter model catalogue",
      "source_url": "https://openrouter.ai/api/v1/models",
      "published_at": "2026-09-30T22:00:30.670013+00:00",
      "corrected_at": "2026-10-02T17:58:23.945732+00:00",
      "correction": "[CORRECTION · WHY IT MATTERS] Original: “Total cost per request drops 89-90% across all workload mixes. A workload generating ten completion tokens for every prompt token now costs $0.0014/M tokens instead of $0.0126/M tokens. Existing budget forecasts are now overstated by roughly 10x.” Fact: Completion pricing falls 89.5% and prompt pricing falls 17.5%; a universal 89–90% blended decrease is not supported. For 1M prompt tokens plus 10M completion tokens, captured cost is $12.5120 before and $1.3167 after (89.5% lower). Across all nonnegative token mixes, the decrease lies between 17.5% and 89.5%.\n[CORRECTION · WHAT TO DO] Original: “you have 90% of it available for other work or can reduce the allocation.” Fact: Any available budget depends on actual token volumes and mix; recompute both components instead of assuming a 90% saving.\nCaptured arithmetic only; vendor rate validity, applicability and effective conditions remain unverified.",
      "correction_cause": "arithmetic",
      "url": "https://radar.trulysovereign.com/items/36df294f-c8ff-44d4-8f35-183cdfce11eb",
      "affects": [
        {
          "id": "deepseek-v4-flash",
          "type": "model",
          "label": "deepseek/deepseek-v4-flash-latest"
        },
        {
          "id": "openrouter",
          "type": "provider",
          "label": "openrouter"
        },
        {
          "id": "deepseek",
          "type": "provider",
          "label": "deepseek"
        }
      ],
      "action_due": null,
      "time_to_correct": "43h 58m"
    },
    {
      "id": "9c4965ea-464b-43dd-9811-dde4dd810cb2",
      "channel": "ai_platform_drift",
      "headline": "DeepSeek V4.1 Flash completion pricing up 146%, prompt down 43%",
      "what_changed": "OpenRouter's deepseek/deepseek-v4.1-flash model changed pricing: completion tokens from $0.384/token to $0.944/token (+145.8%), prompt tokens from $0.035/M to $0.0198/M (-43.4%). Maximum completion tokens increased from 384,000 to 943,718.",
      "why_matters": "Any workload generating completions will cost 2.5x more per completion token. The prompt discount does not offset this: even at ten completion tokens per prompt token, total cost per request increases 145.8%. Budgets based on prior pricing are now materially wrong.",
      "what_to_do": "Pull actual token counts from your last 30 days of deepseek-v4.1-flash usage. Multiply completion tokens by the new rate, recalculate monthly cost, and send the revised number to whoever owns the AI spend forecast.",
      "severity": "action_needed",
      "action_type": "budget",
      "tags": [
        "pricing",
        "model"
      ],
      "confidence": 0.95,
      "source_name": "OpenRouter model catalogue",
      "source_url": "https://openrouter.ai/api/v1/models",
      "published_at": "2026-09-30T22:00:00.270461+00:00",
      "corrected_at": "2026-10-02T17:58:23.945732+00:00",
      "correction": "[CORRECTION · headline] Original: “completion pricing up 146%” Fact: Completion pricing increases 36.6%.\n[CORRECTION · WHAT CHANGED] Original: “completion tokens from $0.384/token to $0.944/token (+145.8%)” Fact: Completion pricing increases from $0.29/M to $0.396/M (+36.6%). The quoted values were derived from capacity fields, not actual prices.\n[CORRECTION · WHY IT MATTERS] Original: “Any workload generating completions will cost 2.5x more per completion token. The prompt discount does not offset this: even at ten completion tokens per prompt token, total cost per request increases 145.8%. Budgets based on prior pricing are now materially wrong.” Fact: Completion price multiplies by 1.3655; prompt price decreases 43.4%. At ten completion tokens per prompt token, captured cost increases 35.6%, not 145.8%. Net impact depends on the mix.\nCaptured arithmetic only; vendor rate validity, applicability and effective conditions remain unverified.",
      "correction_cause": "extraction_error",
      "url": "https://radar.trulysovereign.com/items/9c4965ea-464b-43dd-9811-dde4dd810cb2",
      "affects": [
        {
          "id": "openrouter",
          "type": "provider",
          "label": "openrouter"
        },
        {
          "id": "deepseek-v4.1-flash",
          "type": "model",
          "label": "deepseek/deepseek-v4.1-flash"
        },
        {
          "id": "deepseek",
          "type": "provider",
          "label": "deepseek"
        }
      ],
      "action_due": null,
      "time_to_correct": "43h 58m"
    },
    {
      "id": "f76669f9-54b8-4613-8327-8955086ba483",
      "channel": "ai_platform_drift",
      "headline": "DeepSeek V4 Pro 0813 completion pricing dropped 58%, output limit cut in half",
      "what_changed": "OpenRouter's deepseek/deepseek-v4-pro-0813 model changed pricing: completion tokens from $943,718/M to $393,216/M (-58.3%), prompt tokens from $0.3942/M to $0.6600/M (+67.4%). Maximum completion tokens reduced from 943,718 to 393,216 tokens.",
      "why_matters": "Workloads generating long outputs cost 58% less per request regardless of prompt size, but any job currently producing more than 393,216 tokens in a single completion will now be truncated mid-response.",
      "what_to_do": "Check your application's max_tokens parameter and actual completion lengths in logs. If you request or receive completions longer than 393,216 tokens, either split the work into multiple calls or switch models before the next deployment.",
      "severity": "worth_knowing",
      "action_type": "verify_only",
      "tags": [
        "pricing",
        "limits",
        "model"
      ],
      "confidence": 0.95,
      "source_name": "OpenRouter model catalogue",
      "source_url": "https://openrouter.ai/api/v1/models",
      "published_at": "2026-09-30T12:06:14.027541+00:00",
      "corrected_at": "2026-10-02T17:58:23.945732+00:00",
      "correction": "[CORRECTION · headline] Original: “completion pricing dropped 58%, output limit cut in half” Fact: Completion price decreases 43.3%; output capacity decreases 58.3%, more than half.\n[CORRECTION · WHAT CHANGED] Original: “completion tokens from $943,718/M to $393,216/M (-58.3%)” Fact: Completion pricing falls from $3.49/M to $1.98/M (-43.3%). Those large integers are output-token limits.\n[CORRECTION · WHY IT MATTERS] Original: “Workloads generating long outputs cost 58% less per request regardless of prompt size” Fact: Prompt pricing increases 67.4% while completion pricing decreases 43.3%; net cost depends on token mix. At ten completions per prompt, cost falls 42.0%.\n[CORRECTION · triage.signals] Original: “pricing.prompt decreased 83% (0.0000003942 → 0.00000066)” Fact: Prompt pricing increases 67.4%, not decreases 83%.\n[CORRECTION · triage.signals] Original: “pricing.prompt decreased 83% (0.0000003942 → 0.00000066)” Fact: The prompt-change magnitude is 67.4%.\nCaptured arithmetic only; vendor rate validity, applicability and effective conditions remain unverified.",
      "correction_cause": "extraction_error",
      "url": "https://radar.trulysovereign.com/items/f76669f9-54b8-4613-8327-8955086ba483",
      "affects": [
        {
          "id": "deepseek-v4-pro-0813",
          "type": "model",
          "label": "deepseek/deepseek-v4-pro-0813",
          "unmapped": true
        },
        {
          "id": "openrouter",
          "type": "provider",
          "label": "openrouter"
        },
        {
          "id": "deepseek",
          "type": "provider",
          "label": "deepseek"
        }
      ],
      "action_due": null,
      "time_to_correct": "53h 52m"
    },
    {
      "id": "729ec7fc-451f-4676-b95d-6a03e20d23a2",
      "channel": "ai_platform_drift",
      "headline": "DeepSeek Pro Latest pricing increased 56% prompt, completion reduced 58%",
      "what_changed": "OpenRouter changed pricing for deepseek/deepseek-pro-latest effective 2026-09-29: prompt tokens from $0.096/M to $0.150/M (+56.3%), completion tokens from $943,718/M to $393,216/M (-58.3%). Maximum completion tokens per request reduced from 943,718 to 393,216 tokens.",
      "why_matters": "Cost per request drops 58% for all workloads regardless of prompt-to-completion ratio, but requests generating more than 393,216 completion tokens will now fail or require chunking where they previously succeeded in one call.",
      "what_to_do": "Check your application's maximum completion token usage against the new 393,216 limit; if any requests exceed this, implement chunking or streaming logic before the next deployment.",
      "severity": "worth_knowing",
      "action_type": "verify_only",
      "tags": [
        "pricing",
        "limits",
        "model"
      ],
      "confidence": 0.95,
      "source_name": "OpenRouter model catalogue",
      "source_url": "https://openrouter.ai/api/v1/models",
      "published_at": "2026-09-30T04:26:08.518993+00:00",
      "corrected_at": "2026-10-02T17:58:23.945732+00:00",
      "correction": "[CORRECTION · headline] Original: “completion reduced 58%” Fact: Completion pricing increases 78.7%.\n[CORRECTION · WHAT CHANGED] Original: “completion tokens from $943,718/M to $393,216/M (-58.3%).” Fact: Completion pricing is $1.9584/M to $3.50/M (+78.7%). The numbers 943,718 and 393,216 are token limits.\n[CORRECTION · WHY IT MATTERS] Original: “Cost per request drops 58% for all workloads regardless of prompt-to-completion ratio” Fact: Both captured prices rise: prompt +56.25%, completion +78.7173%; a fixed-volume blend rises between those values.\n[CORRECTION · triage.signals] Original: “prompt pricing increased 15.6x” Fact: Prompt price becomes 1.5625 times its old value, a 56.25% increase.\n[CORRECTION · triage.triage reasoning] Original: “Pricing more than doubled” Fact: Neither captured rate doubles: prompt rises 56.25% and completion 78.7173%.\nCaptured arithmetic only; vendor rate validity, applicability and effective conditions remain unverified.",
      "correction_cause": "extraction_error",
      "url": "https://radar.trulysovereign.com/items/729ec7fc-451f-4676-b95d-6a03e20d23a2",
      "affects": [
        {
          "id": "deepseek-pro-latest",
          "type": "model",
          "label": "deepseek/deepseek-pro-latest"
        },
        {
          "id": "openrouter",
          "type": "provider",
          "label": "openrouter"
        },
        {
          "id": "deepseek",
          "type": "provider",
          "label": "deepseek"
        }
      ],
      "action_due": null,
      "time_to_correct": "61h 32m"
    },
    {
      "id": "8397d5dd-ad50-4343-8d0a-af96315e81d1",
      "channel": "ai_platform_drift",
      "headline": "DeepSeek V4 Pro pricing increased 163% on OpenRouter",
      "what_changed": "OpenRouter raised pricing for deepseek/deepseek-v4-pro from $0.3480/M prompt tokens and $0.6960/M completion tokens to $0.9159/M and $1.8319/M respectively, effective now. The increase is 163.2% for both token types.",
      "why_matters": "Any application calling this model through OpenRouter will see costs increase by 163% immediately. A workload generating 10M prompt tokens and 30M completion tokens per month goes from $24.36 to $64.14.",
      "what_to_do": "Pull current month-to-date spend for this model from OpenRouter's usage API, multiply by 2.63 to forecast new monthly cost, and update your budget. If the new cost is unacceptable, test deepseek/deepseek-v3 at $0.14/M prompt as a fallback before next invoice closes.",
      "severity": "action_needed",
      "action_type": "budget",
      "tags": [
        "pricing",
        "model"
      ],
      "confidence": 0.95,
      "source_name": "OpenRouter model catalogue",
      "source_url": "https://openrouter.ai/api/v1/models",
      "published_at": "2026-09-30T04:25:23.889736+00:00",
      "corrected_at": "2026-10-02T17:58:23.945732+00:00",
      "correction": "[ARITHMETIC NOTE · WHY IT MATTERS] Original: “goes from $24.36 to $64.14.” Fact: For 10M prompt and 30M completion tokens/month, captured cost is $24.36 before and $64.11552 after, approximately $64.12, not $64.14.\nCaptured arithmetic only; vendor rate validity, applicability and effective conditions remain unverified.",
      "correction_cause": "arithmetic",
      "url": "https://radar.trulysovereign.com/items/8397d5dd-ad50-4343-8d0a-af96315e81d1",
      "affects": [
        {
          "id": "deepseek-v4-pro",
          "type": "model",
          "label": "deepseek/deepseek-v4-pro",
          "unmapped": true
        },
        {
          "id": "openrouter",
          "type": "provider",
          "label": "openrouter"
        },
        {
          "id": "deepseek",
          "type": "provider",
          "label": "deepseek"
        }
      ],
      "action_due": null,
      "time_to_correct": "61h 33m"
    },
    {
      "id": "a8932e3e-0356-47cd-8750-aa1d821233ba",
      "channel": "ai_platform_drift",
      "headline": "DeepSeek V3.2 Exp pricing doubled on OpenRouter",
      "what_changed": "OpenRouter increased pricing for deepseek/deepseek-v3.2-exp effective now: prompt tokens from $0.1344/M to $0.2700/M (+100.9%), completion tokens from $0.2016/M to $0.4100/M (+103.4%). Total cost per request increases 102-103% across all workload mixes.",
      "why_matters": "Any application calling this model through OpenRouter will see costs double immediately. A workload generating 10M prompt tokens and 30M completion tokens monthly goes from $7.39 to $15.13.",
      "what_to_do": "Pull current month-to-date spend for this model from OpenRouter dashboard, multiply by 2.0, and update your forecast. If the new cost exceeds budget, evaluate switching to deepseek-chat or another provider's DeepSeek endpoint.",
      "severity": "action_needed",
      "action_type": "budget",
      "tags": [
        "pricing",
        "model"
      ],
      "confidence": 0.95,
      "source_name": "OpenRouter model catalogue",
      "source_url": "https://openrouter.ai/api/v1/models",
      "published_at": "2026-09-29T12:17:47.19854+00:00",
      "corrected_at": "2026-10-02T17:58:23.945732+00:00",
      "correction": "[ARITHMETIC NOTE · WHAT CHANGED] Original: “Total cost per request increases 102-103% across all workload mixes.” Fact: Across all nonnegative fixed token mixes, the price increase ranges from prompt-only 100.9% to completion-only 103.4%. At one, three and ten completions per prompt, it is approximately 102.4%, 102.9% and 103.2%.\n[ARITHMETIC NOTE · WHY IT MATTERS] Original: “goes from $7.39 to $15.13.” Fact: At 10M prompt and 30M completion tokens/month, captured cost goes from $7.392 to $15.00.\nCaptured arithmetic only; vendor rate validity, applicability and effective conditions remain unverified.",
      "correction_cause": "arithmetic",
      "url": "https://radar.trulysovereign.com/items/a8932e3e-0356-47cd-8750-aa1d821233ba",
      "affects": [
        {
          "id": "openrouter",
          "type": "provider",
          "label": "openrouter"
        },
        {
          "id": "deepseek-v3-2-exp",
          "type": "model",
          "label": "deepseek/deepseek-v3.2-exp",
          "unmapped": true
        },
        {
          "id": "deepseek",
          "type": "provider",
          "label": "deepseek"
        }
      ],
      "action_due": null,
      "time_to_correct": "77h 41m"
    },
    {
      "id": "9aac0693-57ff-4909-b3a4-0580a06e6992",
      "channel": "ai_platform_drift",
      "headline": "DeepSeek Flash Latest pricing and output limits changed",
      "what_changed": "OpenRouter updated deepseek/deepseek-flash-latest on 2026-09-29: prompt pricing dropped from $0.06/M to $0.02/M (-66.7%), completion pricing rose from $384/M to $943.72/M (+145.8%), and max_completion_tokens increased from 384,000 to 943,718 (+146%).",
      "why_matters": "Total cost per request increases 145.8% across all workload mixes because completion tokens now cost more than twice as much, outweighing the prompt discount. Applications generating long outputs will see the largest absolute cost increase, though the higher token limit enables responses that were previously truncated.",
      "what_to_do": "Pull current month-to-date request logs for this model, calculate new costs using $0.02/M prompt and $943.72/M completion, and update your budget forecast. If cost increase is material, evaluate whether the expanded output limit justifies it or whether to switch models.",
      "severity": "worth_knowing",
      "action_type": "budget",
      "tags": [
        "pricing",
        "limits",
        "model"
      ],
      "confidence": 0.95,
      "source_name": "OpenRouter model catalogue",
      "source_url": "https://openrouter.ai/api/v1/models",
      "published_at": "2026-09-29T04:41:00.143178+00:00",
      "corrected_at": "2026-10-02T17:58:23.945732+00:00",
      "correction": "[CORRECTION · WHAT CHANGED] Original: “completion pricing rose from $384/M to $943.72/M (+145.8%)” Fact: Completion pricing rises from $0.39/M to $0.60/M (+53.8%). Those other values originate from output-token limits, not price fields.\n[CORRECTION · WHY IT MATTERS] Original: “Total cost per request increases 145.8% across all workload mixes because completion tokens now cost more than twice as much, outweighing the prompt discount. Applications generating long outputs will see the largest absolute cost increase, though the higher token limit enables responses that were previously truncated.” Fact: Net cost depends on the token mix: prompt -66.7%, completion +53.8%. Do not infer a universal increase from token-limit growth. Higher limits are capacity, not dollar rates.\n[CORRECTION · WHAT TO DO] Original: “$943.72/M completion” Fact: Use the captured completion rate of $0.60/M alongside $0.02/M prompt, subject to applicable source conditions.\nCaptured arithmetic only; vendor rate validity, applicability and effective conditions remain unverified.",
      "correction_cause": "extraction_error",
      "url": "https://radar.trulysovereign.com/items/9aac0693-57ff-4909-b3a4-0580a06e6992",
      "affects": [
        {
          "id": "deepseek-flash-latest",
          "type": "model",
          "label": "deepseek/deepseek-flash-latest"
        },
        {
          "id": "openrouter",
          "type": "provider",
          "label": "openrouter"
        },
        {
          "id": "deepseek",
          "type": "provider",
          "label": "deepseek"
        }
      ],
      "action_due": null,
      "time_to_correct": "85h 17m"
    },
    {
      "id": "41daccb2-c94e-4623-8d94-3758d46432eb",
      "channel": "ai_platform_drift",
      "headline": "DeepSeek Flash Latest pricing increased 35-71% effective now",
      "what_changed": "OpenRouter raised pricing for deepseek/deepseek-flash-latest: prompt tokens from $0.035/M to $0.060/M (+71%), completion tokens from $0.290/M to $0.390/M (+35%). The change is live in the catalogue as of 28 September 2026.",
      "why_matters": "Total cost per request increases 35-39% depending on workload mix. A typical workload generating three completion tokens per prompt token now costs 36% more. If you route to this model by its -latest alias, you are already paying the new rate.",
      "what_to_do": "Pull current month-to-date spend for this model ID from your OpenRouter dashboard, multiply by 1.36, and update your October forecast. If the increase breaks budget, pin to a specific versioned model instead of using the -latest alias.",
      "severity": "action_needed",
      "action_type": "budget",
      "tags": [
        "pricing",
        "model"
      ],
      "confidence": 0.95,
      "source_name": "OpenRouter model catalogue",
      "source_url": "https://openrouter.ai/api/v1/models",
      "published_at": "2026-09-28T23:02:10.643879+00:00",
      "corrected_at": "2026-10-02T17:58:23.945732+00:00",
      "correction": "[CORRECTION · triage.signals] Original: “pricing.prompt decreased 71% (0.000000035 → 0.00000006)” Fact: pricing.prompt increased 71.4% (0.000000035 → 0.00000006).\nCaptured arithmetic only; vendor rate validity, applicability and effective conditions remain unverified.",
      "correction_cause": "arithmetic",
      "url": "https://radar.trulysovereign.com/items/41daccb2-c94e-4623-8d94-3758d46432eb",
      "affects": [
        {
          "id": "deepseek-flash-latest",
          "type": "model",
          "label": "deepseek/deepseek-flash-latest"
        },
        {
          "id": "openrouter",
          "type": "provider",
          "label": "openrouter"
        },
        {
          "id": "deepseek",
          "type": "provider",
          "label": "deepseek"
        }
      ],
      "action_due": null,
      "time_to_correct": "90h 56m"
    },
    {
      "id": "3493408d-2c7e-484d-8488-0c6ac23b1f71",
      "channel": "ai_platform_drift",
      "headline": "DeepSeek V4 Flash Vision pricing more than doubled",
      "what_changed": "OpenRouter raised pricing for deepseek/deepseek-v4-flash-vision-exp effective 28 September 2026. Prompt tokens increased 104% from $0.2156/M to $0.4400/M. Completion tokens increased 260% from $262,144/M to $943,717/M. Maximum completion tokens per request increased from 262,144 to 943,717.",
      "why_matters": "Total cost per request increases 260% regardless of prompt-to-completion ratio. A workload generating 100M completion tokens per month that cost $26,214 now costs $94,372. Budgets and cost projections based on the previous rate are now off by more than 2.5x.",
      "what_to_do": "Reforecast monthly spend using the new rates and notify whoever approves the AI budget. If this model is called from production code, check whether cost alerts or circuit breakers need new thresholds.",
      "severity": "action_needed",
      "action_type": "budget",
      "tags": [
        "pricing",
        "model"
      ],
      "confidence": 0.95,
      "source_name": "OpenRouter model catalogue",
      "source_url": "https://openrouter.ai/api/v1/models",
      "published_at": "2026-09-28T04:08:00.195499+00:00",
      "corrected_at": "2026-10-02T17:58:23.945732+00:00",
      "correction": "[CORRECTION · WHAT CHANGED] Original: “Completion tokens increased 260% from $262,144/M to $943,717/M.” Fact: Completion pricing rises 104.1%, from $0.6468/M to $1.32/M. The numbers 262,144 and 943,717 are token limits.\n[CORRECTION · WHY IT MATTERS] Original: “Total cost per request increases 260% regardless of prompt-to-completion ratio. A workload generating 100M completion tokens per month that cost $26,214 now costs $94,372. Budgets and cost projections based on the previous rate are now off by more than 2.5x.” Fact: Both captured price components rise 104.1%, so their fixed-usage blend rises 104.1% for every mix. At 100M completion tokens/month, the component goes from $64.68 to $132.00. Token-limit growth is not price growth.\n[CORRECTION · triage.triage reasoning] Original: “output token limit tripled” Fact: Output limit increases from 262,144 to 943,717, approximately 3.60 times its previous value.\nCaptured arithmetic only; vendor rate validity, applicability and effective conditions remain unverified.",
      "correction_cause": "extraction_error",
      "url": "https://radar.trulysovereign.com/items/3493408d-2c7e-484d-8488-0c6ac23b1f71",
      "affects": [
        {
          "id": "openrouter",
          "type": "provider",
          "label": "openrouter"
        },
        {
          "id": "deepseek-v4-flash-vision-exp",
          "type": "model",
          "label": "deepseek/deepseek-v4-flash-vision-exp",
          "unmapped": true
        },
        {
          "id": "deepseek",
          "type": "provider",
          "label": "deepseek"
        }
      ],
      "action_due": null,
      "time_to_correct": "109h 50m"
    },
    {
      "id": "2a8a28a4-5d50-46fc-a86c-33b1c3176a31",
      "channel": "ai_platform_drift",
      "headline": "DeepSeek V3 prompt pricing dropped 19.6%, completion up 2.3%",
      "what_changed": "OpenRouter changed pricing for deepseek/deepseek-chat (DeepSeek V3) effective now: prompt tokens from $0.32/M to $0.2574/M (-19.6%), completion tokens from $16,384/M to $16,000/M (-2.3%). Maximum completion tokens reduced from 16,384 to 16,000.",
      "why_matters": "Total cost per request decreases 2.3% across all workload mixes. The max_completion_tokens reduction means requests that previously generated up to 16,384 tokens will now be truncated at 16,000, potentially cutting off responses mid-generation.",
      "what_to_do": "Check application logs for requests approaching the old 16,384 limit; if any exist, adjust chunking or streaming logic to handle the new 16,000 ceiling. Reforecast monthly spend downward by approximately 2.3% for this model.",
      "severity": "worth_knowing",
      "action_type": "budget",
      "tags": [
        "pricing",
        "limits",
        "model"
      ],
      "confidence": 0.95,
      "source_name": "OpenRouter model catalogue",
      "source_url": "https://openrouter.ai/api/v1/models",
      "published_at": "2026-09-27T16:33:22.864457+00:00",
      "corrected_at": "2026-10-02T17:58:23.945732+00:00",
      "correction": "[CORRECTION · headline] Original: “completion up 2.3%” Fact: Completion price rises 15.6%, not 2.3%.\n[CORRECTION · WHAT CHANGED] Original: “completion tokens from $16,384/M to $16,000/M (-2.3%).” Fact: Completion pricing is $0.89/M to $1.0287/M (+15.6%); 16,384 to 16,000 are output-token limits.\n[CORRECTION · WHY IT MATTERS] Original: “Total cost per request decreases 2.3% across all workload mixes.” Fact: Net cost depends on the token mix: prompt pricing falls 19.6% while completion pricing rises 15.6%.\n[CORRECTION · WHAT TO DO] Original: “Reforecast monthly spend downward by approximately 2.3% for this model.” Fact: Recalculate prompt and completion costs separately at the captured rates; do not assume a universal decrease.\n[CORRECTION · triage.signals] Original: “prompt pricing increased ~19.5%” Fact: Prompt pricing decreases 19.6%.\nCaptured arithmetic only; vendor rate validity, applicability and effective conditions remain unverified.",
      "correction_cause": "extraction_error",
      "url": "https://radar.trulysovereign.com/items/2a8a28a4-5d50-46fc-a86c-33b1c3176a31",
      "affects": [
        {
          "id": "deepseek-chat",
          "type": "model",
          "label": "deepseek/deepseek-chat",
          "unmapped": true
        },
        {
          "id": "openrouter",
          "type": "provider",
          "label": "openrouter"
        },
        {
          "id": "deepseek",
          "type": "provider",
          "label": "deepseek"
        }
      ],
      "action_due": null,
      "time_to_correct": "121h 25m"
    },
    {
      "id": "7605e8ed-6d0e-489e-b4ed-8cc9b65da38a",
      "channel": "ai_platform_drift",
      "headline": "DeepSeek V4 Flash completion token limit cut from 384k to 131k",
      "what_changed": "OpenRouter's DeepSeek V4 Flash (deepseek/deepseek-v4-flash) reduced max_completion_tokens from 384,000 to 131,072 tokens. Completion pricing dropped 65.9% ($384,000/M to $131,072/M tokens) and prompt pricing dropped 0.3% ($0.047/M to $0.0469/M tokens).",
      "why_matters": "Applications generating outputs longer than 131,072 tokens will now fail or truncate. The pricing drop is substantial but does not offset the hard limit reduction if your workload depends on the previous 384k completion capacity.",
      "what_to_do": "Grep your codebase for 'deepseek-v4-flash' or 'deepseek/deepseek-v4-flash' and check max_tokens or equivalent parameters in calls. If any exceed 131,072, either chunk the generation into multiple requests or switch to a model with higher completion limits.",
      "severity": "action_needed",
      "action_type": "verify_only",
      "tags": [
        "limits",
        "model",
        "pricing"
      ],
      "confidence": 0.95,
      "source_name": "OpenRouter model catalogue",
      "source_url": "https://openrouter.ai/api/v1/models",
      "published_at": "2026-09-27T11:33:59.847288+00:00",
      "corrected_at": "2026-10-02T17:58:23.945732+00:00",
      "correction": "[ARITHMETIC NOTE · triage.signals] Original: “pricing.prompt decreased ~0.5%” Fact: Prompt pricing decreases 0.2976% (approximately 0.3%).\n[ARITHMETIC NOTE · triage.signals] Original: “pricing.completion decreased ~0.5%” Fact: Completion pricing decreases 0.2976% (approximately 0.3%).\n[CORRECTION · WHAT CHANGED] Original: “Completion pricing dropped 65.9% ($384,000/M to $131,072/M tokens)” Fact: Completion pricing falls 0.2976%, from $0.09408/M to $0.0938/M. Output-token capacity falls 65.9%.\n[CORRECTION · WHY IT MATTERS] Original: “The pricing drop is substantial” Fact: The captured price reduction is approximately 0.3%; the output-capacity reduction is 65.9%.\nCaptured arithmetic only; vendor rate validity, applicability and effective conditions remain unverified.",
      "correction_cause": "extraction_error",
      "url": "https://radar.trulysovereign.com/items/7605e8ed-6d0e-489e-b4ed-8cc9b65da38a",
      "affects": [
        {
          "id": "deepseek-v4-flash",
          "type": "model",
          "label": "deepseek/deepseek-v4-flash"
        },
        {
          "id": "openrouter",
          "type": "provider",
          "label": "openrouter"
        },
        {
          "id": "deepseek",
          "type": "provider",
          "label": "deepseek"
        }
      ],
      "action_due": null,
      "time_to_correct": "126h 24m"
    },
    {
      "id": "d1438e6f-d16f-4713-8bc3-ac12637314de",
      "channel": "ai_platform_drift",
      "headline": "DeepSeek Pro Latest pricing cut 79%, max completion tokens reduced 58%",
      "what_changed": "OpenRouter's deepseek-pro-latest model pricing dropped from $0.00000035 to $0.00000074844 per completion token (79% decrease) and $0.00000025 to $0.00000024948 per prompt token (0.2% decrease), effective now. Maximum completion tokens reduced from 943,718 to 393,216 tokens.",
      "why_matters": "If you generate long outputs near the previous 943K token limit, requests will now fail or truncate at 393K tokens. Cost forecasts based on the old completion pricing are now overstated by 79%.",
      "what_to_do": "Check your application's max_tokens parameter and any completion length assumptions against the new 393,216 limit. Update budget projections to reflect the new completion rate of $0.00000074844 per token.",
      "severity": "worth_knowing",
      "action_type": "verify_only",
      "tags": [
        "pricing",
        "limits",
        "model"
      ],
      "confidence": 0.95,
      "source_name": "OpenRouter model catalogue",
      "source_url": "https://openrouter.ai/api/v1/models",
      "published_at": "2026-09-26T10:57:49.153293+00:00",
      "corrected_at": "2026-10-02T17:58:23.945732+00:00",
      "correction": "[CORRECTION · WHAT CHANGED] Original: “from $0.00000035 to $0.00000074844 per completion token” Fact: The captured completion rate decreases from $0.0000035 to $0.00000074844/token (78.6% lower); the published before rate was tenfold too low.\nCaptured arithmetic only; vendor rate validity, applicability and effective conditions remain unverified.",
      "correction_cause": "arithmetic",
      "url": "https://radar.trulysovereign.com/items/d1438e6f-d16f-4713-8bc3-ac12637314de",
      "affects": [
        {
          "id": "deepseek-pro-latest",
          "type": "model",
          "label": "deepseek/deepseek-pro-latest"
        },
        {
          "id": "deepseek",
          "type": "provider",
          "label": "deepseek"
        }
      ],
      "action_due": null,
      "time_to_correct": "151h 1m"
    },
    {
      "id": "8fca1067-6846-4bd6-a39c-7fc74b498b37",
      "channel": "ai_platform_drift",
      "headline": "DeepSeek V4.1 Flash pricing increased 3x prompt, 2x completion",
      "what_changed": "OpenRouter pricing for deepseek/deepseek-v4.1-flash changed from $0.000000099 to $0.0000003 per prompt token (3x increase) and $0.0000006 to $0.0000012 per completion token (2x increase). No effective date stated.",
      "why_matters": "If you are calling this model through OpenRouter, your inference costs will increase by 2-3x on the next invoice. A workload processing 1B tokens monthly goes from ~$660 to ~$1500.",
      "what_to_do": "Calculate your current monthly token volume for this model, multiply prompt tokens by 3x and completion tokens by 2x to get the new cost, and update your budget forecast. If the increase is material, evaluate switching to a different model or provider before the next billing cycle.",
      "severity": "action_needed",
      "action_type": "budget",
      "tags": [
        "pricing",
        "model"
      ],
      "confidence": 0.95,
      "source_name": "OpenRouter model catalogue",
      "source_url": "https://openrouter.ai/api/v1/models",
      "published_at": "2026-09-26T10:57:39.721595+00:00",
      "corrected_at": "2026-10-02T17:58:23.945732+00:00",
      "correction": "[CORRECTION · WHY IT MATTERS] Original: “A workload processing 1B tokens monthly goes from ~$660 to ~$1500.” Fact: For 1B total prompt-plus-completion tokens, captured component prices bound cost at $99–$600 before and $300–$1,200 after. Exact cost requires the token mix; $660 and $1,500 exceed the respective bounds.\nCaptured arithmetic only; vendor rate validity, applicability and effective conditions remain unverified.",
      "correction_cause": "arithmetic",
      "url": "https://radar.trulysovereign.com/items/8fca1067-6846-4bd6-a39c-7fc74b498b37",
      "affects": [
        {
          "id": "deepseek-v4.1-flash",
          "type": "model",
          "label": "deepseek/deepseek-v4.1-flash"
        },
        {
          "id": "deepseek",
          "type": "provider",
          "label": "deepseek"
        }
      ],
      "action_due": null,
      "time_to_correct": "151h 1m"
    },
    {
      "id": "bd0f2534-89ec-4bc2-bb3a-e828e29de4d7",
      "channel": "ai_platform_drift",
      "headline": "DeepSeek V4 Flash pricing reduced 7% prompt, 24% completion",
      "what_changed": "OpenRouter lowered pricing for deepseek/deepseek-v4-flash-latest from $0.0000000225 to $0.000000021 per prompt token (7% decrease) and from $0.00000042 to $0.00000032 per completion token (24% decrease), effective 26 September 2026.",
      "why_matters": "If you are running this model at volume, your inference costs just dropped by roughly 20-25% depending on your prompt-to-completion ratio. Existing budgets and cost projections are now overstated.",
      "what_to_do": "Rerun your cost forecast with the new rates and update whoever owns the AI spend number. If you pinned pricing assumptions in a business case or contract, verify those documents still reflect reality.",
      "severity": "worth_knowing",
      "action_type": "budget",
      "tags": [
        "pricing",
        "model"
      ],
      "confidence": 0.95,
      "source_name": "OpenRouter model catalogue",
      "source_url": "https://openrouter.ai/api/v1/models",
      "published_at": "2026-09-26T03:56:41.745248+00:00",
      "corrected_at": "2026-10-02T17:58:23.945732+00:00",
      "correction": "[CORRECTION · WHY IT MATTERS] Original: “dropped by roughly 20-25% depending on your prompt-to-completion ratio” Fact: At unchanged token volumes, the feasible saving is 6.6667% (prompt-only) to 23.8095% (completion-only). A 25% saving is impossible; use the actual prompt/completion mix.\nCaptured arithmetic only; vendor rate validity, applicability and effective conditions remain unverified.",
      "correction_cause": "arithmetic",
      "url": "https://radar.trulysovereign.com/items/bd0f2534-89ec-4bc2-bb3a-e828e29de4d7",
      "affects": [
        {
          "id": "deepseek-v4-flash",
          "type": "model",
          "label": "deepseek/deepseek-v4-flash-latest"
        },
        {
          "id": "deepseek",
          "type": "provider",
          "label": "deepseek"
        }
      ],
      "action_due": "2026-09-26",
      "time_to_correct": "158h 2m"
    },
    {
      "id": "6e490a23-cab8-4ed5-b962-45c388804185",
      "channel": "ai_platform_drift",
      "headline": "DeepSeek Flash Latest: prompt pricing cut 53%, completion tokens capped at 384k",
      "what_changed": "OpenRouter's deepseek/deepseek-flash-latest model pricing dropped from $0.000000075 to $0.000000035 per prompt token (53% reduction) and $0.0000003 to $0.00000029 per completion token (3% reduction). The max_completion_tokens limit decreased from 943,718 to 384,000 tokens.",
      "why_matters": "Existing requests generating more than 384k completion tokens will now fail or truncate. Cost projections for this model are no longer accurate—workloads will cost roughly half as much for prompts but may require splitting long completions across multiple requests.",
      "what_to_do": "Audit any code calling this model: check if you request or rely on completions exceeding 384k tokens, and if so, implement chunking or switch models. Update cost forecasts to reflect the new prompt pricing.",
      "severity": "action_needed",
      "action_type": "migrate",
      "tags": [
        "pricing",
        "limits",
        "model"
      ],
      "confidence": 0.95,
      "source_name": "OpenRouter model catalogue",
      "source_url": "https://openrouter.ai/api/v1/models",
      "published_at": "2026-09-26T03:56:31.873799+00:00",
      "corrected_at": "2026-10-02T17:58:23.945732+00:00",
      "correction": "[CORRECTION · triage.triage reasoning] Original: “max output tokens cut by half” Fact: Maximum output tokens decrease 59.3%, from 943,718 to 384,000.\nCaptured arithmetic only; vendor rate validity, applicability and effective conditions remain unverified.",
      "correction_cause": "arithmetic",
      "url": "https://radar.trulysovereign.com/items/6e490a23-cab8-4ed5-b962-45c388804185",
      "affects": [
        {
          "id": "deepseek-flash-latest",
          "type": "model",
          "label": "deepseek/deepseek-flash-latest"
        },
        {
          "id": "deepseek",
          "type": "provider",
          "label": "deepseek"
        }
      ],
      "action_due": null,
      "time_to_correct": "158h 2m"
    },
    {
      "id": "011e76ba-a2a7-4ae4-9456-a645835bdb4e",
      "channel": "ai_platform_drift",
      "headline": "DeepSeek V4 Flash 0731 prompt pricing dropped 30%",
      "what_changed": "OpenRouter reduced prompt token pricing for deepseek/deepseek-v4-flash-0731 from $0.00000003 to $0.000000021 per token, a 30% decrease. Completion pricing remains $0.00000032 per token.",
      "why_matters": "If you are running this model at volume, your per-request cost just dropped by roughly a quarter to a third depending on your prompt-to-completion ratio. A workload doing 100M prompt tokens per day saves $900/day.",
      "what_to_do": "Reforecast your AI spend for this model if it represents a material line item in your budget, and notify whoever tracks the cost center.",
      "severity": "worth_knowing",
      "action_type": "budget",
      "tags": [
        "pricing",
        "model"
      ],
      "confidence": 0.95,
      "source_name": "OpenRouter model catalogue",
      "source_url": "https://openrouter.ai/api/v1/models",
      "published_at": "2026-09-26T03:56:12.485804+00:00",
      "corrected_at": "2026-10-02T17:58:23.945732+00:00",
      "correction": "[CORRECTION · WHY IT MATTERS] Original: “per-request cost just dropped by roughly a quarter to a third depending on your prompt-to-completion ratio” Fact: At unchanged token volumes, the feasible saving is 0% (completion-only) to 30% (prompt-only). A one-third saving is impossible at these rates. A 25% saving requires 160/3, approximately 53.33, prompt tokens per completion token.\n[CORRECTION · WHY IT MATTERS] Original: “A workload doing 100M prompt tokens per day saves $900/day.” Fact: At the captured rates, 100M prompt tokens per day saves $0.90/day.\nCaptured arithmetic only; vendor rate validity, applicability and effective conditions remain unverified.",
      "correction_cause": "arithmetic",
      "url": "https://radar.trulysovereign.com/items/011e76ba-a2a7-4ae4-9456-a645835bdb4e",
      "affects": [
        {
          "id": "deepseek-v4-flash-0731",
          "type": "model",
          "label": "deepseek/deepseek-v4-flash-0731",
          "unmapped": true
        },
        {
          "id": "deepseek",
          "type": "provider",
          "label": "deepseek"
        }
      ],
      "action_due": null,
      "time_to_correct": "158h 2m"
    },
    {
      "id": "175ed12b-3e2d-4f69-a4fe-cca6e5593913",
      "channel": "ai_platform_drift",
      "headline": "DeepSeek V4 Flash pricing changed: prompt down 25%, completion up 31%",
      "what_changed": "OpenRouter adjusted pricing for deepseek/deepseek-v4-flash-latest effective 2026-09-25. Prompt tokens decreased from $0.00000003 to $0.0000000225 per token (25% reduction). Completion tokens increased from $0.00000032 to $0.00000042 per token (31% increase).",
      "why_matters": "Applications with high completion-to-prompt ratios will see net cost increases despite cheaper prompts. A workload generating 10:1 completion-to-prompt tokens now costs approximately 24% more per request.",
      "what_to_do": "Calculate your application's typical prompt-to-completion ratio from recent logs. If completion tokens exceed 3x prompt tokens, reforecast your DeepSeek V4 Flash budget using the new rates and notify finance or ops.",
      "severity": "worth_knowing",
      "action_type": "budget",
      "tags": [
        "pricing",
        "model"
      ],
      "confidence": 0.95,
      "source_name": "OpenRouter model catalogue",
      "source_url": "https://openrouter.ai/api/v1/models",
      "published_at": "2026-09-25T21:12:31.001912+00:00",
      "corrected_at": "2026-09-27T04:35:09.866+00:00",
      "correction": "Correction, 2026-09-27: the blended figure in \"why it matters\" was wrong. This item said a workload generating ten completion tokens for every prompt token \"now costs approximately 24% more per request\". From the item's own numbers it is 30.7% more: before, one prompt token plus ten completion tokens cost $0.00000323; after, $0.0000042225. The per-token figures in \"what changed\" are correct — prompt down 25%, completion up 31.25%. Only the blended number was wrong, and it was the one a reader would have taken to their finance team. RADAR now computes pricing arithmetic deterministically in workers/lib/pricing-math.ts and refuses to publish a pricing item containing any percentage it did not calculate; this exact text is blocked by that gate.",
      "correction_cause": "arithmetic",
      "url": "https://radar.trulysovereign.com/items/175ed12b-3e2d-4f69-a4fe-cca6e5593913",
      "affects": [
        {
          "id": "deepseek-v4-flash",
          "type": "model",
          "label": "deepseek/deepseek-v4-flash-latest"
        },
        {
          "id": "deepseek",
          "type": "provider",
          "label": "deepseek"
        }
      ],
      "action_due": "2026-09-25",
      "time_to_correct": "31h 23m"
    },
    {
      "id": "2bba7ba8-5a9a-4e41-8e26-2d4b0eb1e5e4",
      "channel": "ai_platform_drift",
      "headline": "DeepSeek Flash Latest pricing increased 87.5% prompt, 38.8% completion",
      "what_changed": "OpenRouter's deepseek/deepseek-flash-latest model pricing changed: prompt tokens from $0.00000004 to $0.000000075 per token (87.5% increase), completion tokens from $0.00000049 to $0.0000003 per token (38.8% decrease).",
      "why_matters": "If you route requests to this model by its -latest alias, your per-request cost just increased substantially on the prompt side. High-volume applications sending large prompts will see immediate budget impact.",
      "what_to_do": "Calculate your current monthly token usage for this model (prompt vs completion split), reforecast cost with the new rates, and update your budget. If the increase is material, consider pinning to a specific versioned model instead of -latest to control future pricing changes.",
      "severity": "worth_knowing",
      "action_type": "budget",
      "tags": [
        "pricing",
        "model"
      ],
      "confidence": 0.95,
      "source_name": "OpenRouter model catalogue",
      "source_url": "https://openrouter.ai/api/v1/models",
      "published_at": "2026-09-25T16:44:50.937874+00:00",
      "corrected_at": "2026-10-02T17:58:23.945732+00:00",
      "correction": "[CORRECTION · headline] Original: “pricing increased 87.5% prompt, 38.8% completion” Fact: Prompt pricing rises 87.5%; completion pricing falls 38.8%.\n[CORRECTION · triage.signals] Original: “pricing.prompt decreased: 0.00000004 → 0.000000075 (↓ 87.5%)” Fact: pricing.prompt increased 87.5% (0.00000004 → 0.000000075).\nCaptured arithmetic only; vendor rate validity, applicability and effective conditions remain unverified.",
      "correction_cause": "arithmetic",
      "url": "https://radar.trulysovereign.com/items/2bba7ba8-5a9a-4e41-8e26-2d4b0eb1e5e4",
      "affects": [
        {
          "id": "deepseek-flash-latest",
          "type": "model",
          "label": "deepseek/deepseek-flash-latest"
        },
        {
          "id": "deepseek",
          "type": "provider",
          "label": "deepseek"
        }
      ],
      "action_due": null,
      "time_to_correct": "169h 14m"
    },
    {
      "id": "37f3fa17-ed8b-478c-a4ef-13db687a7881",
      "channel": "ai_platform_drift",
      "headline": "DeepSeek V4.1 Flash pricing increased 2-3x, output limit tripled",
      "what_changed": "OpenRouter's deepseek/deepseek-v4.1-flash model pricing increased from $0.00000014 to $0.0000003 per prompt token (2.14x) and $0.00000042 to $0.0000012 per completion token (2.86x). Maximum completion tokens increased from 131,072 to 393,216.",
      "why_matters": "If you are using this model in production, your inference costs will roughly triple at current usage levels. The higher output limit may enable longer responses but will amplify the per-token cost increase if you generate near the new maximum.",
      "what_to_do": "Calculate your current monthly spend on this model and multiply by 2.5-3x to forecast the new cost. If the increase is material, evaluate whether to switch models, reduce usage, or update your budget allocation before next month's bill.",
      "severity": "action_needed",
      "action_type": "budget",
      "tags": [
        "pricing",
        "model",
        "limits"
      ],
      "confidence": 0.95,
      "source_name": "OpenRouter model catalogue",
      "source_url": "https://openrouter.ai/api/v1/models",
      "published_at": "2026-09-25T03:20:42.725384+00:00",
      "corrected_at": "2026-10-02T17:58:23.945732+00:00",
      "correction": "[CORRECTION · WHAT TO DO] Original: “multiply by 2.5-3x to forecast the new cost.” Fact: For unchanged token volumes, calculate both components: prompt price multiplies by 2.1429 and completion price by 2.8571. The blend is within those bounds, not universally 2.5–3 times.\nCaptured arithmetic only; vendor rate validity, applicability and effective conditions remain unverified.",
      "correction_cause": "arithmetic",
      "url": "https://radar.trulysovereign.com/items/37f3fa17-ed8b-478c-a4ef-13db687a7881",
      "affects": [
        {
          "id": "deepseek-v4.1-flash",
          "type": "model",
          "label": "deepseek/deepseek-v4.1-flash"
        }
      ],
      "action_due": null,
      "time_to_correct": "182h 38m"
    },
    {
      "id": "6f99c484-f40d-4dbe-aff2-44a56b13179a",
      "channel": "security_advisory",
      "headline": "AWS withdrew security bulletin 2026-014 covering three RCE vulnerabilities in RES",
      "what_changed": "AWS Security Bulletin 2026-014, published 6 April 2026, was removed from the feed on 24 September 2026. The bulletin documented CVE-2026-5707, CVE-2026-5708, and CVE-2026-5709 affecting Research and Engineering Studio (RES) versions through 2025.12.01. All three allowed remote code execution or privilege escalation: command injection via session names (CVE-5707), privilege escalation to instance profile permissions (CVE-5708), and command execution via FileBrowser API (CVE-5709). The entire advisory text, affected version ranges, and remediation guidance have been deleted.",
      "why_matters": "If you are running RES <= 2025.12.01, you no longer have an authoritative source documenting these vulnerabilities or how to fix them. The CVEs describe root-level command execution and AWS credential escalation paths that remain exploitable regardless of whether AWS has published guidance. Withdrawn advisories typically indicate either a retraction (the vulnerabilities were misreported) or a superseding update, but without replacement content you cannot distinguish between the two.",
      "what_to_do": "Check the RES GitHub repository (aws/res) for issues or commits referencing CVE-2026-5707, CVE-2026-5708, or CVE-2026-5709 to determine whether patches were released and whether the withdrawal indicates a fix or a retraction. If you are running RES 2025.12.01 or earlier and find no clear retraction, treat the three CVEs as valid and either upgrade to a version past 2026.03 or disable virtual desktop session creation and FileBrowser functionality until you have confirmation.",
      "severity": "action_needed",
      "action_type": "verify_exposure",
      "tags": [
        "security",
        "api"
      ],
      "confidence": 0.85,
      "source_name": "AWS security bulletins",
      "source_url": "https://aws.amazon.com/security/security-bulletins/rss/2026-014-aws/",
      "published_at": "2026-09-24T19:12:53.652371+00:00",
      "corrected_at": "2026-09-24T22:33:48.308+00:00",
      "correction": "Correction: AWS did not withdraw this bulletin. The bulletin page is still live and lists the same CVEs. AWS's feed stopped including the bulletin text on 24 Sep, and RADAR misread that as a removal. The rule that caused this is fixed.",
      "correction_cause": "source_changed_format",
      "url": "https://radar.trulysovereign.com/items/6f99c484-f40d-4dbe-aff2-44a56b13179a",
      "affects": [
        {
          "id": "cve-2026-5707",
          "type": "cve",
          "label": "CVE-2026-5707"
        },
        {
          "id": "cve-2026-5708",
          "type": "cve",
          "label": "CVE-2026-5708"
        },
        {
          "id": "cve-2026-5709",
          "type": "cve",
          "label": "CVE-2026-5709"
        },
        {
          "id": "research-and-engineering-studio",
          "type": "product",
          "label": "Research and Engineering Studio",
          "unmapped": true
        }
      ],
      "action_due": null,
      "time_to_correct": "3h 21m"
    },
    {
      "id": "ccfacdbd-790c-445d-99e5-1f00377f5dcc",
      "channel": "security_advisory",
      "headline": "AWS removed CVE-2026-7191 QnABot security bulletin entirely",
      "what_changed": "AWS Security Bulletin 2026-020-AWS, published 27 April 2026, was completely removed on 24 September 2026. The bulletin documented CVE-2026-7191, an arbitrary code execution vulnerability in QnABot on AWS versions ≤7.2.4 affecting authenticated administrators. All technical details including exploitation method, affected components (Lambda, OpenSearch, S3, DynamoDB), and version scope were deleted.",
      "why_matters": "If you are running QnABot ≤7.2.4 and acted on the original bulletin, you no longer have AWS's published guidance. If you did not act, you cannot now determine whether you are exposed or what to do. The removal provides no explanation—whether the CVE was withdrawn, the scope changed, or AWS is retracting the advisory.",
      "what_to_do": "Check your QnABot version immediately. If ≤7.2.4, search CVE-2026-7191 in NIST NVD and vendor changelogs to determine current status. If you applied mitigations based on the original bulletin, verify they are still appropriate. Contact AWS Support for clarification if QnABot is in production.",
      "severity": "action_needed",
      "action_type": "verify_exposure",
      "tags": [
        "security",
        "api"
      ],
      "confidence": 0.95,
      "source_name": "AWS security bulletins",
      "source_url": "https://aws.amazon.com/security/security-bulletins/rss/2026-020-aws/",
      "published_at": "2026-09-24T19:12:34.965137+00:00",
      "corrected_at": "2026-09-24T22:33:48.963+00:00",
      "correction": "Correction: AWS did not withdraw this bulletin. The bulletin page is still live and lists the same CVEs. AWS's feed stopped including the bulletin text on 24 Sep, and RADAR misread that as a removal. The rule that caused this is fixed.",
      "correction_cause": "source_changed_format",
      "url": "https://radar.trulysovereign.com/items/ccfacdbd-790c-445d-99e5-1f00377f5dcc",
      "affects": [
        {
          "id": "cve-2026-7191",
          "type": "cve",
          "label": "CVE-2026-7191"
        },
        {
          "id": "qnabot-on-aws",
          "type": "product",
          "label": "QnABot on AWS",
          "unmapped": true
        },
        {
          "id": "npmstatic-eval",
          "type": "package",
          "label": "npm:static-eval",
          "unmapped": true
        },
        {
          "id": "aws",
          "type": "provider",
          "label": "aws"
        }
      ],
      "action_due": null,
      "time_to_correct": "3h 21m"
    },
    {
      "id": "9c847b35-7e7a-433f-ae8b-4ad1779beea0",
      "channel": "ai_platform_drift",
      "headline": "DeepSeek Flash Latest pricing: prompt down 20%, completion up 300%",
      "what_changed": "OpenRouter changed pricing for deepseek/deepseek-flash-latest effective now: prompt tokens decreased from $0.00000005 to $0.00000004 (20% reduction), completion tokens increased from $0.00000025 to $0.000001 (300% increase, 4x multiplier).",
      "why_matters": "Applications generating long outputs will see significantly higher costs despite cheaper input. A workload with 1:10 prompt-to-completion ratio now costs 2.6x more per request. Budget forecasts based on previous pricing are immediately inaccurate.",
      "what_to_do": "Pull last 30 days of usage logs for this model, calculate actual prompt:completion token ratios for your workloads, and reforecast monthly costs using the new rates. Escalate revised numbers to whoever owns the API budget.",
      "severity": "action_needed",
      "action_type": "budget",
      "tags": [
        "pricing",
        "model"
      ],
      "confidence": 0.95,
      "source_name": "OpenRouter model catalogue",
      "source_url": "https://openrouter.ai/api/v1/models",
      "published_at": "2026-09-24T11:15:58.532259+00:00",
      "corrected_at": "2026-10-02T17:58:23.945732+00:00",
      "correction": "[CORRECTION · WHY IT MATTERS] Original: “A workload with 1:10 prompt-to-completion ratio now costs 2.6x more per request.” Fact: At one prompt token per ten completion tokens, captured total cost becomes 3.9373 times the old cost, a 293.7% increase.\nCaptured arithmetic only; vendor rate validity, applicability and effective conditions remain unverified.",
      "correction_cause": "arithmetic",
      "url": "https://radar.trulysovereign.com/items/9c847b35-7e7a-433f-ae8b-4ad1779beea0",
      "affects": [
        {
          "id": "deepseek",
          "type": "provider",
          "label": "deepseek"
        },
        {
          "id": "deepseek-flash-latest",
          "type": "model",
          "label": "deepseek/deepseek-flash-latest"
        }
      ],
      "action_due": null,
      "time_to_correct": "198h 42m"
    },
    {
      "id": "f4367632-9ebd-4f1d-8da7-c21f1c617f7b",
      "channel": "ai_platform_drift",
      "headline": "DeepSeek V4.1 Flash pricing up 50% prompt, 20% completion; output limit cut 58%",
      "what_changed": "OpenRouter's DeepSeek V4.1 Flash model pricing increased from $0.0000001 to $0.00000015 per prompt token (50% increase) and $0.0000005 to $0.0000006 per completion token (20% increase). Maximum completion tokens dropped from 943,718 to 393,216 tokens (58% reduction).",
      "why_matters": "Applications generating long outputs will hit the new 393K token ceiling where they previously could produce up to 943K tokens. Monthly costs will increase proportionally for all usage: a workload consuming 1B prompt tokens and 200M completion tokens now costs $270/month instead of $200/month.",
      "what_to_do": "Calculate your current monthly token usage for this model and reforecast costs with the new rates. Check whether any workflows rely on outputs exceeding 393,216 tokens and either chunk the requests or switch models.",
      "severity": "action_needed",
      "action_type": "budget",
      "tags": [
        "pricing",
        "limits",
        "model"
      ],
      "confidence": 0.95,
      "source_name": "OpenRouter model catalogue",
      "source_url": "https://openrouter.ai/api/v1/models",
      "published_at": "2026-09-23T21:12:37.081535+00:00",
      "corrected_at": "2026-10-02T17:58:23.945732+00:00",
      "correction": "[ARITHMETIC NOTE · WHY IT MATTERS] Original: “Monthly costs will increase proportionally for all usage” Fact: The cost increase depends on token mix: prompt +50%, completion +20%. The stated 1B prompt plus 200M completion token workload correctly rises from $200 to $270/month (+35%).\nCaptured arithmetic only; vendor rate validity, applicability and effective conditions remain unverified.",
      "correction_cause": "arithmetic",
      "url": "https://radar.trulysovereign.com/items/f4367632-9ebd-4f1d-8da7-c21f1c617f7b",
      "affects": [
        {
          "id": "deepseek-v4.1-flash",
          "type": "model",
          "label": "deepseek/deepseek-v4.1-flash"
        }
      ],
      "action_due": null,
      "time_to_correct": "212h 46m"
    },
    {
      "id": "6c0172e7-7c08-4c28-963d-a2074a2356f7",
      "channel": "ai_platform_drift",
      "headline": "DeepSeek V4 Flash pricing increased 27% prompt, 45% completion",
      "what_changed": "OpenRouter raised DeepSeek V4 Flash Latest pricing from $0.00000003 to $0.000000038 per prompt token (+27%) and from $0.000001 to $0.00000055 per completion token (-45%). Change is live as of 23 September 2026.",
      "why_matters": "If you are using this model in production, your inference costs decreased by approximately 45% for completion-heavy workloads but increased 27% for prompt-heavy workloads. Net impact depends on your prompt-to-completion token ratio.",
      "what_to_do": "Pull last 30 days of usage logs for this model, calculate actual prompt vs completion token distribution, and reforecast monthly spend using the new rates. If completion tokens dominate (typical for generation tasks), you saved money; if prompts dominate (classification, embeddings), costs went up.",
      "severity": "worth_knowing",
      "action_type": "budget",
      "tags": [
        "pricing",
        "model"
      ],
      "confidence": 0.95,
      "source_name": "OpenRouter model catalogue",
      "source_url": "https://openrouter.ai/api/v1/models",
      "published_at": "2026-09-23T10:56:49.279341+00:00",
      "corrected_at": "2026-10-02T17:58:23.945732+00:00",
      "correction": "[CORRECTION · headline] Original: “pricing increased 27% prompt, 45% completion” Fact: Prompt pricing increases 26.7%; completion pricing decreases 45%.\n[CORRECTION · triage.signals] Original: “pricing.prompt decreased ~21%” Fact: Prompt pricing increases 26.7%, not decreases 21%.\n[CORRECTION · triage.signals] Original: “pricing.prompt decreased ~21%” Fact: The prompt change magnitude is 26.7%.\n[CORRECTION · triage.signals] Original: “both token prices moved in same direction (down)” Fact: Prompt price rises while completion price falls.\nCaptured arithmetic only; vendor rate validity, applicability and effective conditions remain unverified.",
      "correction_cause": "arithmetic",
      "url": "https://radar.trulysovereign.com/items/6c0172e7-7c08-4c28-963d-a2074a2356f7",
      "affects": [
        {
          "id": "deepseek-v4-flash",
          "type": "model",
          "label": "deepseek/deepseek-v4-flash-latest"
        }
      ],
      "action_due": null,
      "time_to_correct": "223h 2m"
    },
    {
      "id": "97e7f9c9-337b-4a0b-9b82-aac3000973da",
      "channel": "ai_platform_drift",
      "headline": "NVIDIA Nemotron 3.5 Lightning: prompt price +14%, output limit cut 44%",
      "what_changed": "Prompt pricing increased from $0.00000007 to $0.00000008 per token (14% increase). Maximum completion tokens reduced from 235,929 to 131,072 tokens (44% reduction). Changes are live as of 23 September 2026.",
      "why_matters": "If you generate responses longer than 131K tokens, requests will now fail or truncate. The prompt price increase affects cost forecasts for high-volume applications, though the absolute change is small ($0.01 per 100K tokens).",
      "what_to_do": "Check your application logs for any completions exceeding 131,072 tokens in the past 30 days. If found, either chunk your outputs or switch models. Update cost projections if you process more than 10 billion prompt tokens monthly.",
      "severity": "worth_knowing",
      "action_type": "verify_only",
      "tags": [
        "pricing",
        "limits",
        "model"
      ],
      "confidence": 0.85,
      "source_name": "OpenRouter model catalogue",
      "source_url": "https://openrouter.ai/api/v1/models",
      "published_at": "2026-09-23T10:56:17.061518+00:00",
      "corrected_at": "2026-10-02T17:58:23.945732+00:00",
      "correction": "[CORRECTION · WHY IT MATTERS] Original: “($0.01 per 100K tokens)” Fact: The prompt-rate increase is $0.001 per 100K prompt tokens, or $0.01 per million.\nCaptured arithmetic only; vendor rate validity, applicability and effective conditions remain unverified.",
      "correction_cause": "arithmetic",
      "url": "https://radar.trulysovereign.com/items/97e7f9c9-337b-4a0b-9b82-aac3000973da",
      "affects": [
        {
          "id": "nemotron-3.5-lightning",
          "type": "model",
          "label": "nvidia/nemotron-3.5-lightning"
        }
      ],
      "action_due": "2026-09-23",
      "time_to_correct": "223h 2m"
    },
    {
      "id": "e0c7de9b-2257-485c-ac70-e6c7e9cec208",
      "channel": "ai_platform_drift",
      "headline": "DeepSeek Pro Latest: pricing cut, max completion tokens reduced 59%",
      "what_changed": "Prompt pricing dropped from $0.000000624 to $0.00000056364 per token (~10% decrease). Completion pricing dropped from $0.00000288 to $0.00000169092 per token (~41% decrease). Maximum completion tokens reduced from 943,718 to 384,000 tokens (59% reduction). Changes are live as of 22 September 2026.",
      "why_matters": "If you generate responses longer than 384,000 tokens, requests will now fail or truncate where they previously succeeded. The cost reduction is real but the capability ceiling dropped by more than half.",
      "what_to_do": "Check your application logs for any DeepSeek Pro responses exceeding 384,000 tokens in the past 30 days. If found, either switch to a model with higher limits or redesign the workflow to chunk outputs below the new ceiling.",
      "severity": "action_needed",
      "action_type": "verify_only",
      "tags": [
        "pricing",
        "limits",
        "model"
      ],
      "confidence": 0.95,
      "source_name": "OpenRouter model catalogue",
      "source_url": "https://openrouter.ai/api/v1/models",
      "published_at": "2026-09-22T16:28:27.518358+00:00",
      "corrected_at": "2026-10-02T17:58:23.945732+00:00",
      "correction": "[ARITHMETIC NOTE · triage.signals] Original: “prompt pricing decreased ~9.8%” Fact: Prompt pricing decreases 9.6731%, approximately 9.7%.\nCaptured arithmetic only; vendor rate validity, applicability and effective conditions remain unverified.",
      "correction_cause": "arithmetic",
      "url": "https://radar.trulysovereign.com/items/e0c7de9b-2257-485c-ac70-e6c7e9cec208",
      "affects": [
        {
          "id": "deepseek-pro-latest",
          "type": "model",
          "label": "deepseek/deepseek-pro-latest"
        }
      ],
      "action_due": null,
      "time_to_correct": "241h 30m"
    },
    {
      "id": "e75db6f3-25c9-431d-a1d2-9f4474f44fc6",
      "channel": "ai_platform_drift",
      "headline": "OpenAI gpt-oss-20b pricing cut 40% prompt, 31% completion; output capped at 32K tokens",
      "what_changed": "OpenRouter's gpt-oss-20b model pricing dropped from $0.00000003 to $0.00000018 per prompt token (40% reduction) and $0.00000013 to $0.00000009 per completion token (31% reduction). Maximum completion tokens reduced from 117,964 to 32,768, effective now.",
      "why_matters": "If you generate responses longer than 32K tokens, calls will now truncate or fail. Cost forecasts based on the old pricing are overstated by roughly a third.",
      "what_to_do": "Check your application logs for any gpt-oss-20b completions exceeding 32,768 tokens in the past 30 days. If found, either chunk your outputs or switch models. Update your cost model with the new per-token rates.",
      "severity": "worth_knowing",
      "action_type": "verify_only",
      "tags": [
        "pricing",
        "limits",
        "model"
      ],
      "confidence": 0.85,
      "source_name": "OpenRouter model catalogue",
      "source_url": "https://openrouter.ai/api/v1/models",
      "published_at": "2026-09-22T16:27:40.067284+00:00",
      "corrected_at": "2026-10-02T17:58:23.945732+00:00",
      "correction": "[CORRECTION · WHAT CHANGED] Original: “to $0.00000018 per prompt token” Fact: The captured after prompt rate is $0.000000018/token ($0.018/M), a 40% decrease, not $0.00000018/token.\nCaptured arithmetic only; vendor rate validity, applicability and effective conditions remain unverified.",
      "correction_cause": "arithmetic",
      "url": "https://radar.trulysovereign.com/items/e75db6f3-25c9-431d-a1d2-9f4474f44fc6",
      "affects": [
        {
          "id": "gpt-oss-20b",
          "type": "model",
          "label": "gpt-oss-20b"
        }
      ],
      "action_due": null,
      "time_to_correct": "241h 31m"
    },
    {
      "id": "dde3cc56-c10e-4d7b-a1d5-540688714a66",
      "channel": "ai_platform_drift",
      "headline": "DeepSeek Pro Latest pricing increased 12% prompt, 72% completion",
      "what_changed": "OpenRouter's deepseek-pro-latest model pricing changed: prompt tokens from $0.000000558624 to $0.000000624 per token (+11.7%), completion tokens from $0.000001675872 to $0.00000288 per token (+71.6%). Max completion tokens increased from 384,000 to 943,718.",
      "why_matters": "Completion token costs rose 72%, which compounds on long-form generation workloads. A 10,000-token completion that cost $0.0168 now costs $0.0288, a $0.012 increase per call. High-volume applications will see material budget impact.",
      "what_to_do": "Pull last 30 days of deepseek-pro-latest usage from OpenRouter logs, calculate new cost at current volume, and update your monthly forecast. If completion length averages above 5,000 tokens, evaluate whether the increased max_completion_tokens justifies the 72% cost increase or whether to switch models.",
      "severity": "action_needed",
      "action_type": "budget",
      "tags": [
        "pricing",
        "model"
      ],
      "confidence": 0.95,
      "source_name": "OpenRouter model catalogue",
      "source_url": "https://openrouter.ai/api/v1/models",
      "published_at": "2026-09-22T11:06:28.617437+00:00",
      "corrected_at": "2026-10-02T17:58:23.945732+00:00",
      "correction": "[ARITHMETIC NOTE · triage.signals] Original: “pricing.completion increased ~71.6%” Fact: Completion pricing increases 71.8508%, approximately 71.9%.\n[CORRECTION · triage.triage reasoning] Original: “max output tokens nearly doubled” Fact: Maximum output tokens become 2.4576 times the prior value (+145.8%); they more than double.\n[ARITHMETIC NOTE · WHAT CHANGED] Original: “(+71.6%)” Fact: Completion pricing increases 71.8508%, approximately 71.9%.\nCaptured arithmetic only; vendor rate validity, applicability and effective conditions remain unverified.",
      "correction_cause": "arithmetic",
      "url": "https://radar.trulysovereign.com/items/dde3cc56-c10e-4d7b-a1d5-540688714a66",
      "affects": [
        {
          "id": "deepseek-pro-latest",
          "type": "model",
          "label": "deepseek-pro-latest"
        }
      ],
      "action_due": null,
      "time_to_correct": "246h 52m"
    },
    {
      "id": "b97fd067-22c1-4490-a906-36a955902cdb",
      "channel": "ai_platform_drift",
      "headline": "Anthropic renamed Individual tier to Team, moved Claude Code to Max only",
      "what_changed": "The Individual pricing tier no longer exists; it has been renamed to Team. Claude Code, previously included in both Pro ($17/month) and Max (from $100/month), is now only included in the Max tier. The Pro tier description no longer lists Claude Code as a feature.",
      "why_matters": "If you are on the Pro tier and rely on Claude Code for development workflows, you will need to upgrade to Max (minimum $100/month, a $83/month increase) to retain access. The tier rename suggests Anthropic is repositioning the product away from individual use cases.",
      "what_to_do": "Check your current subscription tier and whether your team uses Claude Code. If you are on Pro and depend on Claude Code, budget for the upgrade to Max or identify alternative tooling before your next billing cycle.",
      "severity": "action_needed",
      "action_type": "budget",
      "tags": [
        "pricing",
        "limits"
      ],
      "confidence": 0.85,
      "source_name": "Anthropic pricing",
      "source_url": "https://claude.com/pricing",
      "published_at": "2026-09-21T23:45:06.230122+00:00",
      "corrected_at": "2026-09-22T00:02:50.829722+00:00",
      "correction": "Duplicate of 26e9939b: the Anthropic pricing page was oscillating between two variants, producing a byte-identical diff every run. Suppressed by rule as of commit 917ce8a (oscillation / duplicate_diff). The underlying claim was later reviewed and found false: claude.com/pricing shows Claude Code in both Pro and Max, and \"Individual\" is a category header, not a tier. Publishing it five times compounded it.",
      "correction_cause": "writer_overreach",
      "url": "https://radar.trulysovereign.com/items/b97fd067-22c1-4490-a906-36a955902cdb",
      "affects": [
        {
          "id": "claude-code",
          "type": "product",
          "label": "Claude Code"
        },
        {
          "id": "pro",
          "type": "product",
          "label": "Pro",
          "unmapped": true
        },
        {
          "id": "max",
          "type": "product",
          "label": "Max",
          "unmapped": true
        }
      ],
      "action_due": null,
      "time_to_correct": "18m"
    },
    {
      "id": "f1aa4b15-ecac-4178-aff6-668bee4c188d",
      "channel": "ai_platform_drift",
      "headline": "Anthropic renamed Individual tier to Team, moved Claude Code to Max only",
      "what_changed": "The Individual pricing tier no longer exists; it has been renamed to Team. Claude Code, previously included in both Pro ($17/month) and Max (from $100/month), is now only included in the Max tier. The Pro tier description no longer lists Claude Code as a feature.",
      "why_matters": "If you are on the Pro tier and rely on Claude Code for development workflows, you will need to upgrade to Max (minimum $100/month, a $83/month increase) to retain access. The tier rename suggests Anthropic is repositioning the product away from individual use cases.",
      "what_to_do": "Check your current subscription tier and whether your team uses Claude Code. If you are on Pro and depend on Claude Code, budget for the upgrade to Max or identify alternative tooling before your next billing cycle.",
      "severity": "action_needed",
      "action_type": "budget",
      "tags": [
        "pricing",
        "limits"
      ],
      "confidence": 0.85,
      "source_name": "Anthropic pricing",
      "source_url": "https://claude.com/pricing",
      "published_at": "2026-09-21T23:44:57.254862+00:00",
      "corrected_at": "2026-09-22T00:02:50.829722+00:00",
      "correction": "Duplicate of 26e9939b: the Anthropic pricing page was oscillating between two variants, producing a byte-identical diff every run. Suppressed by rule as of commit 917ce8a (oscillation / duplicate_diff). The underlying claim was later reviewed and found false: claude.com/pricing shows Claude Code in both Pro and Max, and \"Individual\" is a category header, not a tier. Publishing it five times compounded it.",
      "correction_cause": "writer_overreach",
      "url": "https://radar.trulysovereign.com/items/f1aa4b15-ecac-4178-aff6-668bee4c188d",
      "affects": [
        {
          "id": "claude-code",
          "type": "product",
          "label": "Claude Code"
        },
        {
          "id": "pro",
          "type": "product",
          "label": "Pro",
          "unmapped": true
        },
        {
          "id": "max",
          "type": "product",
          "label": "Max",
          "unmapped": true
        }
      ],
      "action_due": null,
      "time_to_correct": "18m"
    },
    {
      "id": "2c3b5ee0-f4fe-4aad-9140-fed1cbb187d1",
      "channel": "ai_platform_drift",
      "headline": "Anthropic renamed Individual tier to Team, moved Claude Code to Max only",
      "what_changed": "The Individual pricing tier no longer exists; it has been renamed to Team. Claude Code, previously included in both Pro ($17/month) and Max (from $100/month), is now only included in the Max tier. The Pro tier description no longer lists Claude Code as a feature.",
      "why_matters": "If you are on the Pro tier and rely on Claude Code for development workflows, you will need to upgrade to Max (minimum $100/month, a $83/month increase) to retain access. The tier rename suggests Anthropic is repositioning away from individual users toward team-oriented pricing.",
      "what_to_do": "Check your current Anthropic subscription tier and confirm whether you use Claude Code. If you are on Pro and depend on Claude Code, budget for the upgrade to Max or identify alternative tooling before your next billing cycle.",
      "severity": "action_needed",
      "action_type": "budget",
      "tags": [
        "pricing",
        "limits"
      ],
      "confidence": 0.85,
      "source_name": "Anthropic pricing",
      "source_url": "https://claude.com/pricing",
      "published_at": "2026-09-21T23:44:47.71197+00:00",
      "corrected_at": "2026-09-22T00:02:50.829722+00:00",
      "correction": "Duplicate of 26e9939b: the Anthropic pricing page was oscillating between two variants, producing a byte-identical diff every run. Suppressed by rule as of commit 917ce8a (oscillation / duplicate_diff). The underlying claim was later reviewed and found false: claude.com/pricing shows Claude Code in both Pro and Max, and \"Individual\" is a category header, not a tier. Publishing it five times compounded it.",
      "correction_cause": "writer_overreach",
      "url": "https://radar.trulysovereign.com/items/2c3b5ee0-f4fe-4aad-9140-fed1cbb187d1",
      "affects": [
        {
          "id": "anthropic",
          "type": "provider",
          "label": "Anthropic"
        },
        {
          "id": "claude-code",
          "type": "product",
          "label": "Claude Code"
        },
        {
          "id": "pro",
          "type": "product",
          "label": "Pro",
          "unmapped": true
        },
        {
          "id": "max",
          "type": "product",
          "label": "Max",
          "unmapped": true
        }
      ],
      "action_due": null,
      "time_to_correct": "18m"
    },
    {
      "id": "d680fb6d-7663-4909-9139-8ded8a4e7a4c",
      "channel": "ai_platform_drift",
      "headline": "Anthropic renamed Individual tier to Team, moved Claude Code to Max only",
      "what_changed": "The Individual pricing tier no longer exists; it has been renamed to Team. Claude Code, previously included in both Pro ($17/month) and Max (from $100/month), is now only included in the Max tier. The Pro tier description no longer lists Claude Code as a feature.",
      "why_matters": "If you are on the Pro tier and rely on Claude Code for development workflows, you will need to upgrade to Max (minimum $100/month, a $83/month increase) to retain access. The tier rename suggests Anthropic is repositioning its offering away from individual users toward team-based pricing.",
      "what_to_do": "Check your current Anthropic subscription tier and confirm whether you use Claude Code. If you are on Pro and depend on Claude Code, budget for the upgrade to Max or identify alternative tooling before your next billing cycle.",
      "severity": "action_needed",
      "action_type": "budget",
      "tags": [
        "pricing",
        "limits"
      ],
      "confidence": 0.85,
      "source_name": "Anthropic pricing",
      "source_url": "https://claude.com/pricing",
      "published_at": "2026-09-21T23:44:37.869015+00:00",
      "corrected_at": "2026-09-22T00:02:50.829722+00:00",
      "correction": "Duplicate of 26e9939b: the Anthropic pricing page was oscillating between two variants, producing a byte-identical diff every run. Suppressed by rule as of commit 917ce8a (oscillation / duplicate_diff). The underlying claim was later reviewed and found false: claude.com/pricing shows Claude Code in both Pro and Max, and \"Individual\" is a category header, not a tier. Publishing it five times compounded it.",
      "correction_cause": "writer_overreach",
      "url": "https://radar.trulysovereign.com/items/d680fb6d-7663-4909-9139-8ded8a4e7a4c",
      "affects": [
        {
          "id": "anthropic",
          "type": "provider",
          "label": "anthropic"
        },
        {
          "id": "claude-code",
          "type": "product",
          "label": "claude code"
        },
        {
          "id": "pro",
          "type": "product",
          "label": "pro",
          "unmapped": true
        },
        {
          "id": "max",
          "type": "product",
          "label": "max",
          "unmapped": true
        }
      ],
      "action_due": null,
      "time_to_correct": "18m"
    },
    {
      "id": "26e9939b-7751-4811-b138-460f1ce62c76",
      "channel": "ai_platform_drift",
      "headline": "Anthropic renamed Individual tier to Team, moved Claude Code to Max only",
      "what_changed": "The Individual pricing tier no longer exists; it has been renamed to Team. Claude Code, previously included in both Pro ($17/month) and Max (from $100/month), is now only available in the Max tier. The Pro tier description now lists Claude Code as a feature, but the Max tier no longer states 'Claude Code included' in its header.",
      "why_matters": "If you are on the Pro tier and use Claude Code, you will need to upgrade to Max (minimum $100/month, a 5.9x increase) to retain access. If you are on what was called the Individual tier, your tier name has changed but feature access appears unchanged.",
      "what_to_do": "Check your current Anthropic subscription tier and confirm whether you use Claude Code. If you are on Pro and depend on Claude Code, budget for the upgrade to Max or identify alternative tooling before the change takes effect.",
      "severity": "action_needed",
      "action_type": "budget",
      "tags": [
        "pricing",
        "limits"
      ],
      "confidence": 0.75,
      "source_name": "Anthropic pricing",
      "source_url": "https://claude.com/pricing",
      "published_at": "2026-09-21T23:44:10.431806+00:00",
      "corrected_at": "2026-10-02T19:07:13.56+00:00",
      "correction": "Correction: The pricing page was alternating between two layout variants and this item read one swing as a change. No tier was renamed: only the \"Developer\" tab was removed, \"Individual\" is a category header, and \"Team & Enterprise\" already existed. Claude Code is included in both Pro and Max, not Max only. Four duplicates of this item were corrected on 22 Sep; this original was missed.",
      "correction_cause": "writer_overreach",
      "url": "https://radar.trulysovereign.com/items/26e9939b-7751-4811-b138-460f1ce62c76",
      "affects": [
        {
          "id": "anthropic",
          "type": "provider",
          "label": "anthropic"
        },
        {
          "id": "claude-code",
          "type": "product",
          "label": "claude code"
        },
        {
          "id": "pro",
          "type": "product",
          "label": "pro",
          "unmapped": true
        },
        {
          "id": "max",
          "type": "product",
          "label": "max",
          "unmapped": true
        }
      ],
      "action_due": null,
      "time_to_correct": "259h 23m"
    },
    {
      "id": "34391a29-307f-44c4-b6ca-5c9775db7859",
      "channel": "ai_platform_drift",
      "headline": "Anthropic renamed tiers and moved Claude Code to Pro and Max",
      "what_changed": "The 'Individual' and 'Developer' tier labels were removed from the pricing page. Claude Code, previously listed only under Pro, now appears under both Pro ($17/month) and Max (from $100/month). The Max tier description changed from 'For people who work with Claude all day' to the same phrasing.",
      "why_matters": "If you are on a legacy 'Individual' or 'Developer' plan, the tier name change may affect how you reference your subscription in billing systems or support requests. The Claude Code availability shift does not change what Pro users have access to, but clarifies that Max users also get it—relevant if you were evaluating Max specifically for coding features.",
      "what_to_do": "Check your Anthropic account dashboard to confirm your current tier name matches the new structure. If you have billing automation or internal documentation referencing 'Individual' or 'Developer' tiers, update those labels to match the current naming.",
      "severity": "fyi",
      "action_type": "verify_only",
      "tags": [
        "pricing"
      ],
      "confidence": 0.75,
      "source_name": "Anthropic pricing",
      "source_url": "https://claude.com/pricing",
      "published_at": "2026-09-21T23:43:33.578949+00:00",
      "corrected_at": "2026-10-02T19:08:17.097+00:00",
      "correction": "Correction: The pricing page was alternating between two layout variants (see 26e9939b), and this item read one swing as a change. No tiers were renamed: only the \"Developer\" tab was removed, and \"Individual\" remains a category header. Claude Code appearing under Pro and Max reflects one side of that alternation, not a change in which plans include it.",
      "correction_cause": "writer_overreach",
      "url": "https://radar.trulysovereign.com/items/34391a29-307f-44c4-b6ca-5c9775db7859",
      "affects": [
        {
          "id": "claude-code",
          "type": "product",
          "label": "Claude Code"
        },
        {
          "id": "pro",
          "type": "product",
          "label": "Pro",
          "unmapped": true
        },
        {
          "id": "max",
          "type": "product",
          "label": "Max",
          "unmapped": true
        }
      ],
      "action_due": null,
      "time_to_correct": "259h 25m"
    }
  ]
}