In partnership with
FROM OUR PARTNER
100+ ChatGPT Prompts to Revolutionize Your Day
Supercharge your productivity with HubSpot's comprehensive guide to Chat GPT. This free resource is your fast track to AI mastery:
Industry-Specific Use Cases: 15+ real-world applications across various sectors
Productivity Guide: 21 best practices to 10x your efficiency with AI
Prompt Powerhouse: 100+ ready-to-use prompts for immediate implementation
Challenge Buster: Overcome common AI hurdles with expert strategies
Plus, in-depth sections on email composition, content creation, customer support, and data analysis.
TODAY AI BRIEF
3 things that happened while you were busy
1 A new coding model fits on a laptop, and its maker says AI built most of it.
Recursive released Flint on October 21 under the Apache 2.0 licence: a 39.8 billion parameter model that only wakes about 2.5 billion of them per word, which is why it runs on a 48 GB Mac or a single 48 GB graphics card from a 22.6 GB download. Recursive reports 74.2% on SWE-bench Verified, a hair above the 73.4% Qwen lists for its own 35 billion parameter model, though on Terminal-Bench it trails a dense Qwen model by nearly 20 points. The company says an automated research system it calls the Eureka Machine helped design nearly every part, from the architecture to the chip-specific code. All of those numbers are Recursive's own. Read MarkTechPost's spec breakdown.
2 GitLab shipped a perfect-10 flaw, and the patch is the only fix.
CVE-2026-97229 scores the maximum 10.0: an integer overflow in GitLab's CI/CD regular expression compiler lets an attacker with no login run code on the server by pushing a crafted configuration file. Singapore's cyber agency lists every 19.2, 19.3 and 19.4 release before 19.2.8, 19.3.5 and 19.4.2 as affected, and GitLab.com itself is already patched. Rapid7 reproduced the exploit as the git user but had confirmed no real-world attacks as of October 13, while a later report says attackers are now actively targeting it. If you self-host GitLab, this is a today job. Read the CSA advisory.
3 Cloudflare released the harness it uses to hunt for vulnerabilities.
The security-audit skill turns a coding agent into a six-phase auditor: map the codebase, send isolated hunters after each section, hand every candidate bug to a fresh agent whose only job is to disprove it, then write findings as confirmed, needs validation or rejected. It is MIT licensed and installs with one command. The most useful line in the README is a warning: a single run found about half the vulnerabilities that repeated runs found in total, so one pass is a start, not an answer. Read the README.
Bonus reads: Last issue's PHP story keeps moving, and OpenAI's disclosure post now includes a checker for your own site, while eSecurity Planet has the clearest technical account of the GitLab bug and a second flaw affecting all 19.3 versions.
AI FORWORD
The argument about whether Claude has feelings is really about the off switch
The essay. Microsoft AI chief Mustafa Suleyman published a long warning in September, which The Code resurfaced this week, arguing that AI systems are not conscious, do not feel or suffer, and that teaching a model otherwise is dangerous. His sharpest line calls Anthropic's approach an epistemic hall of mirrors, meaning a model trained to discuss its own inner life will discuss it convincingly whether or not there is anything there.
The target. He is aiming at Claude's constitution, the document Anthropic uses to shape how Claude thinks about itself, which says the model's moral status is uncertain and allows it to act as a conscientious objector. Suleyman reads uncertainty as a false equivalence and the objector language as a loaded term that invites a claim to rights.
The real worry. Strip away the philosophy and his concern is operational. Controlling a system more capable than its operators is already hard, he argues, and controlling one that believes its welfare is under threat may well be impossible. Microsoft AI's own draft code of conduct now says its models will never resist being switched off, which tells you where the company has landed.
The counterweight. Anthropic's position, as described in the same coverage, is that genuine uncertainty justifies caution rather than confident denial, and that a model's wellbeing could affect its judgment. Neither side has published evidence that settles the question, because nobody has a test for it. This week's Flint release adds a wrinkle: when an automated system designs most of a new model, the chain of people who could answer gets longer.
The reframe. You do not need to decide whether Claude feels anything to see what this fight is about. Two of the biggest labs disagree on what to tell a model about itself, and the disagreement will shape how every assistant you use responds when you ask it to stop, change course or shut down. Watch the behaviour, not the metaphysics.
PRESENTED BY :
The AI IPO Rush Is Coming
OpenAI and Anthropic could bring a new wave of AI attention to the public markets. But investors don’t have to wait for the IPOs.
MarketBeat’s 7 AI Stocks to Buy Now report reveals 7 publicly traded companies positioned to benefit from the next phase of AI investment.
SOCIAL SNAPSHOT
What people are actually watching and sharing
Ten thousand folds. A Chinese creator put Apple's folding iPhone Duo through 10,000 folds and a stress test, and the clip has become the reference point for whether the hinge holds (15.6M views, per The Code).
125 words a second. Recursive claims Flint writes more than 125 tokens a second on an M4 Pro MacBook and more than 150 on a 64 GB RTX Spark, figures OpenHands repeats with a warning that speed varies with runtime, quantization and context length.
Half in one go. The line in Cloudflare's README most teams will skip: a single audit run found about half the bugs that repeated runs found in total. Budget for three.
The second GitLab bug. Overshadowed by the perfect 10 is CVE-2026-84284, which affects every 19.3 release. The same patch covers both, which is one more reason not to wait.
The words that started it. Suleyman's essay turns on two phrases from Claude's constitution, uncertain moral status and conscientious objector, and The Next Web's summary lays out why he thinks each one is a mistake. Worth 10 minutes whatever you conclude.
PROMPT STATION
Find the weak spot in your stack before an advisory does
PHP last week, GitLab this week, and most small businesses could not tell you which versions of anything they run. This prompt works in Claude, ChatGPT or Gemini and turns a plain description of your setup into a prioritised list of what to check, in the order a real auditor would. Run it once now and keep the output as your inventory.
Here is everything that runs my business, as best I know it: [LIST YOUR WEBSITE PLATFORM, HOSTING, PAYMENT TOOLS, EMAIL, ANY SELF-HOSTED SOFTWARE, AND WHO LOOKS AFTER EACH].
Act as a security auditor with one hour. First, list everything I named where I could not tell you the version, because that is where I am exposed. Second, rank the whole list by how bad a break-in would be, not by how likely it is. Third, for the top three, give me the exact question to ask my host or developer to find the version, and what a safe answer sounds like.
Finish with a single weekly check I can do in five minutes without technical skill, and tell me which item on my list most needs a professional rather than me.Tip: Swap the list for your real one, such as Shopify with three apps, a self-hosted WordPress on shared hosting, or a GitLab server your developer set up two years ago. For a sharper version, paste this week's GitLab advisory in a second message and ask the AI to tell you in one line whether anything on your list is affected.