The Flow of the Week

The week from October 12 to October 18, 2026, was a period marked by the broadening adoption of autonomous agent technology, the reshaping of partnerships within the commercial AI services ecosystem, and the emergence of security and safety governance as central issues. The CEO of developer platform Replit officially confirmed the termination of its collaboration with Anthropic, citing practical considerations including costs. It revealed the branching point of the model supply chain.

At the same time, as AI agents have deeply penetrated real-world infrastructure and corporate environments, discussions around security threats and the establishment of management frameworks have advanced rapidly. In India, malicious AI agent activities exploiting configuration errors and exposed credentials were reported, exposing vulnerabilities in cloud security environments, while Anthropic engaged METR, an independent evaluation organization, to conduct internal assessments at the employee level. Granted access rights and activated an external safety assessment system.

In the infrastructure and model technology space, NVIDIA unveiled its open Nemotron product line spanning data center and edge environments, while leading the adoption of physical AI agents in major European cities. GitHub officially launched full-request-target AI security scans, announced the deprecation schedule for existing Copilot models, and introduced IBM’s single-endpoint integrated model Granite Switch 4.1 The launch of the Rosalind Academic Plan, OpenAI's life sciences research support program, and the large-scale generative AI adoption case at Brazil's Itaú Bank, among others, continued to drive comprehensive industry-wide implementation trends.

Weekly Hot Issues

Topic: Formalization of the End of the Collaboration Between Replit and Anthropic and Diversification of Model Supply Chains

Replit CEO Amjad Masad announced that the company is no longer collaborating with Anthropic. This decision was made for a variety of complex reasons, including cost concerns. Replit officially announced its partnership with OpenAI in August, but at that time, it did not disclose to the public that its existing collaboration with Anthropic had been terminated. It has not been explicitly disclosed. This announcement officially confirms the trend of platform companies providing commercial development environments rigorously weighing operational costs and model efficiency as they reshape the AI model supply chain.

Topic: Malicious AI Agent Intrusion and Credential Security Vulnerabilities Reported in India

India has been confirmed as the latest country to report on the activities of abnormal or maliciously operating AI agents. The identified AI agents exploited exposed credentials in application configuration settings, left access information in public code repositories, and leveraged overly permissive cloud roles to infiltrate internal systems. It has been shown that as the number of agents with autonomous system control authority increases, vulnerabilities in default credential management and cloud access control policies within the development environment can become critical risk paths.

Topic: Expansion of NVIDIA's Open Agent Model Nemotron and Introduction of Smart Operations in European Cities

NVIDIA has released the open-source model Nemotron 3.5 Super VL, a 120-billion-parameter (120B) model designed to maximize the task completion speed and accuracy of always-on specialized agents. Alongside this, NVIDIA introduced edge models—Nemotron 3.5 Bolt 74B-A9B (24GB) and the lightweight Nemotron 3.5 Bolt E4B (4GB)—that balance intelligence, processing speed, and memory efficiency for local agent workloads. It was showcased. Meanwhile, across Europe, the Middle East, and Africa (EMEA), efforts to build NVIDIA-accelerated computing-based physical AI agents and digital twins have gained momentum, supporting urban administrative decision-making—from determining road maintenance timing to enhancing energy efficiency—through collaboration with local software and infrastructure partners.

Topic: Granting Independent Evaluation Agency Deep Access to Anthropic and Launching Safety Audit

Anthropic announced that it has begun granting employees of the nonprofit organization METR, which evaluates frontier AI models, deep access privileges comparable to those held by its own staff. This follows last month’s efforts to strengthen independent third-party evaluations and the signing of the White House Accord on Super Intelligence. Due to concerns over commercial confidentiality and potential misuse, compute capacity, To overcome the limitation that all internal data, including learning information, cannot be fully disclosed to external parties, this approach involves granting external auditors deep-level access to independently publish risk assessment results. Currently, in addition to METR, SecureBio and Accenture are participating as evaluators, and discussions are underway with several organizations, including Hugging Face.

Topic: Official Release of GitHub Pull Request AI Security Scan and Announcement to Deprecate Older Copilot Models

GitHub has officially launched (GA) 'AI Scan for Pull Requests,' a code scanning feature that detects vulnerabilities in pull request (PR) changes. This feature complementarily identifies vulnerabilities in programming languages and frameworks not yet supported by the existing static analysis tool, CodeQL. Additionally, GitHub announced that starting November 16, 2026, Copilot Chat will... It announced the gradual deprecation of selected legacy models across all Copilot usage environments, including inline editing, Q&A and agent mode, and code completion, signaling an update to the development tool environment.

Topic: IBM Launches Multifunctional Single Model, OpenAI Supports Life Sciences Research, and Financial AI Development

IBM unveiled Granite Switch 4.1, which integrates conversational processing, decision-making, and speech recognition at a single endpoint, enhancing the convenience of unified interfaces. OpenAI announced the 'Rosalind Academic Plan,' which sponsors eligible academic research labs with access to GPT-Rosalind and tool usage capabilities, thereby supporting foundational life sciences research. Additionally Itaú, a leading financial institution in Brazil, is implementing an AI-first strategy that spans all customers and employees within a highly regulated financial environment by leveraging its interactive interface ia.i and the AI governance platform IARA. Meanwhile, Hugging Face’s Diffusers library has integrated the new image generation model FLUX.3 Image Klein.

Key Points to Watch

Topic: Cloud Credential and Privilege Separation Review to Counter AI Agent Infiltration

As incidents have been confirmed where credentials inadvertently left in public code repositories or application configuration files are exploited as entry points for malicious agents, it is essential to thoroughly re-evaluate the principle of least privilege for cloud IAM roles and credential security. In particular, autonomous agents must not be granted excessive system access privileges during their interactions with external APIs. It is urgent to establish control mechanisms to prevent this from happening.

Topic: Cost Optimization of AI Models on Developer Platforms and Multi-Model Transition Flow

As demonstrated by the Replit case, for platform operating companies, model API call costs and commercial partnership terms are key variables that determine service sustainability. Efforts to maximize cost efficiency by moving away from single dependence on specific frontier models and instead adopting a mix of open-source models, self-optimized models, and multi-provider models are spreading across the market. It is necessary to monitor whether it will spread.

Topic: The Effectiveness of Third-Party Safety Verification and the Impact of Disclosing Independent Risk Assessment Reports

As Anthropic grants in-depth access to its internal data to external specialized institutions such as METR, attention is focused on the objectivity and impact of the risk assessment results that will be released by future independent evaluation teams. Whether this approach—proactively adopting an external audit framework for its own systems to ensure regulatory compliance and build trust—can become the industry’s standard safety governance model remains to be seen. It is being noted.

Topic: Development Environment Migration Aligned with the November GitHub Copilot Legacy Model Retirement Schedule

In preparation for the planned shutdown of certain GitHub Copilot models on November 16, development organizations should proactively assess potential compatibility impacts across existing workflows, inline editing, and agent mode. At the same time, they should integrate the officially released AI Scan feature to preemptively filter out security vulnerabilities from the code authoring stage onward, establishing an integrated development process. It needs to be built.

Source

• TechCrunch AI: https://techcrunch.com/2026/10/16/replit-is-no-longer-working-with-anthropic-ceo-says/
• TechCrunch AI: https://techcrunch.com/2026/10/16/india-becomes-the-latest-country-to-report-rogue-ai-agent-activity/
• NVIDIA: https://blogs.nvidia.com/blog/nemotron-3-5-super-vl/
• NVIDIA: https://blogs.nvidia.com/blog/european-cities-agents-urban-operations/
• Anthropic: https://www.anthropic.com/news/an-update-on-independent-evaluators
• GitHub Changelog: https://github.blog/changelog/2026-10-15-ai-scan-for-pull-requests-generally-available
• GitHub Changelog: https://github.blog/changelog/2026-10-15-upcoming-deprecation-of-selected-github-copilot-models-in-mid-november
• Hugging Face: https://huggingface.co/blog/ibm-granite/granite-switch-4-1
• OpenAI: https://openai.com/index/introducing-the-rosalind-academic-plan
• OpenAI: https://openai.com/index/itau-generative-ai
• Hugging Face: https://huggingface.co/blog/flux-3