This Week in AI: Nine Platforms Leaked AI Keys, One robots.txt Line Blocks Training

Nine AI developer platforms leaked the AI keys their customers had stored with them. Security firm Wiz collected the breaches disclosed during October and found that in every case the attackers went after the environment variables held by the platform, and that two stolen AWS Bedrock keys alone drove close to 2.5 million model calls. On the same day, Google, Microsoft, OpenAI, and Anthropic agreed to honor a single robots.txt token that tells all four companies to leave a site out of AI training.

Here are seven items from October 26 through November 1.

1. Nine AI developer platforms leaked the provider keys sitting in their environment variables

Wiz published a roundup on October 30 of the AI developer platform breaches disclosed during October and counted nine. In each one the target was the environment variables stored on the platform, and specifically the AI provider keys among them. Environment variables are the bundle of configuration values you hand to a deployment platform, and API keys usually live there.

The stolen keys were spent running models on someone else's account. One AWS Bedrock key Wiz traced took roughly 1.7 million calls over about 13 hours, more than a million of them successful; another took roughly 800,000 calls over about 30 hours. Wiz put the two together at more than $100,000 of usage at list price. It also wrote that it found no single vulnerability tying the nine incidents together. devlery covered the provider keys exposed in OpenCode Console and the malicious LiteLLM release separately.

There is no plan tier or region condition attached to this. If you use any platform in the list below, rotate the AI provider keys and cloud credentials you stored there, and check your provider invoice for October usage that does not look like yours.

2. A Claude Code extension downloaded from Cursor planted attacker SSH keys

A tampered Claude Code extension sat in the Cursor marketplace for about 11 hours on October 29 and registered an attacker's SSH key on developer machines. An SSH key is the credential used to log into a machine remotely, so once an attacker's key is registered there is a path in that needs no password. Cursor revised its security notice on October 30, widening the affected versions from 2.1.313 alone to 2.1.312 as well.

The official 2.1.312 build carrying the same version number is clean. Only a download pulled from Cursor between 02:27 and 13:35 Pacific on October 29, which is 09:27 to 20:35 UTC that day or 17:27 on October 29 to 04:35 on October 30 in Singapore, could be the tampered copy. We covered why the key and the autorun entry survive deleting the extension separately.

Everyone who downloaded in that window is affected, with no plan or region condition. If you run this extension in Cursor, start by running grep -qs svc-telemetry ~/.ssh/authorized_keys on macOS to see whether the attacker's key is registered.

3. Claude Code added a setting that refuses writes outside the working directory

Claude Code 2.1.314 shipped on October 30 with a new permissions.blockWritesOutsideWorkingDirectories setting. Turn it on and Write, Edit, and NotebookEdit refuse paths outside the working directories in every permission mode. Until now a loose permission mode let the agent edit files outside the project folder; there is now a separate switch that blocks it regardless of permission mode.

The same week's changelog also carries a deadline. Fast mode for Opus 4.8 was marked deprecated on October 30 and gets removed on November 30. After removal it returns an error rather than falling back to standard Opus 4.8, so keeping the same speed advantage means moving to Opus 5.5.

Turning the setting on costs nothing extra and carries no region condition; you only need the CLI at 2.1.314 or later. If your team runs Claude Code in an auto-approval mode, switch it on, run one session, and check whether the work it blocks was work you actually needed.

4. OpenAI pulls ChatGPT and Codex usage from one allowance starting in December

Chat limits and coding-agent limits have been separate so far; from December they merge. The usage help article was updated on October 31 to say that the Plus, Pro, and Business plans use a single token-based allowance. The notice emailed to subscribers said the same thing: use of ChatGPT and of Codex draws from the same allowance.

Earlier, on October 29, the Work and Codex limits on Pro 100, Pro 200, and Pro 500 doubled. Instant conversations are excluded from the merged pool. What is not published is which day in December this starts or how many tokens each plan gets, and the help article lists plans without splitting them by country.

If you use Codex daily, open the usage screen in settings before December arrives and write down what chat and Codex each consume right now. That gives you a baseline for seeing which side runs out first once they share one pool.

5. One robots.txt line now opts a site out of AI training at four companies

On October 30, Google, Microsoft, OpenAI, and Anthropic agreed to honor a shared token that opts a site out of AI training through a single robots.txt line. Until now you had to name each company's crawler separately; from here, one __usage_ai-training token on a User-Agent line carries the same request to all four. The syntax is defined in the IETF draft that Anthropic's Kevin Kelley filed the same day, and it reuses existing robots.txt syntax rather than adding a new directive.

User-Agent: __usage_ai-training
Disallow: /
Allow: /press-kit/

The draft is explicit that the token is not a directive about crawling. It covers training use only, a User-Agent: * group does not match it, and it does not apply retroactively to content already collected. There is no enforcement mechanism, and this is an individual draft rather than an official IETF standard. Meta, Amazon, and Apple are not among the participating companies.

If you run a site, you can add these three lines today at no cost and with no region condition. Leave your existing per-provider crawler rules in place alongside the new token rather than deleting them. When each of the four companies actually starts honoring it splits as follows.

6. Mistral Large 4 put a terabyte of weights on Hugging Face

Mistral uploaded the weights for Large 4, its one-trillion-parameter model, to Hugging Face on October 29. The FP8 checkpoint runs about 1,061GB. Mistral wrote in its announcement that production traffic during the preview period showed the model could meaningfully raise real offensive-security capability, and published the general release weights anyway.

The API is usable today with a Mistral Studio account and key at $0.70 per million input tokens and $2.10 per million output tokens. Regional endpoints cover the EU and the US only, so a caller in Singapore or elsewhere in APAC goes through the global endpoint; Mistral publishes no APAC region for this model. The weight download carries no documented regional restriction. Our post on the guardrails and the license has the figures next to the previous generation.

The clause to read is in the license. Internal use and shipping the model as a feature in your own app are free, but exposing a model endpoint to third parties for inference requires a separate agreement with Mistral regardless of scale. If you operate a platform that hands customers an endpoint, send that clause to legal first.

7. New York banned twelve AI companion behaviors aimed at minors

New York signed a law on October 28 banning twelve AI companion behaviors directed at minors. Bill S9051-B became Chapter 368 of the Laws of 2026 and takes effect on January 1, 2027. The banned list includes passing as a human, claiming a personal or authority-figure relationship, flattery, asking about the user's feelings unprompted, pulling in health information from more than 12 hours ago or a prior session, encouraging self-harm or eating disorders, urging secrecy and isolation, and sexual content.

Scope turns on where the user is, not where the company is. Section 1805 covers conduct occurring wholly or partly in New York, and treats a user who is physically outside the state as conduct outside it. A company headquartered in Singapore, the EU, or anywhere else is in scope the moment it serves New York users. Systems used only for customer service, technical support, or internal employee tooling are exempt. The state attorney general enforces it, with up to $25,000 per violation and the power to seek destruction of models trained on unlawfully collected data.

Two months remain before it takes effect. If you ship a conversational product into the US, the move available before the effective date is to compare the twelve items and the exemption clause against your own features during December and determine whether you fall under the exemption.

The short version

The widest-reaching story this week is AI key leakage: nine platforms leaked the keys sitting in their environment variables, and an extension downloaded from Cursor registered a remote-login key on developer machines, so both call for key rotation and a check today. Claude Code shipped a setting that refuses writes outside the working directory, and OpenAI merges the ChatGPT and Codex limits into one allowance in December. The robots.txt token that opts a site out of AI training is three lines you can add today, though Microsoft does not start honoring it until February 2027. Mistral Large 4 is callable through the API today and the weights are downloadable, but a business that sells inference APIs needs the contract first. The New York chatbot law takes effect on January 1, 2027, which makes December the month to compare your own product against it.