Daily Digest – 18 October 2026

Morning from Oslo. It was a quiet weekend news cycle, so agent security carries the day, led by a breach at OpenCode that leaked stored provider API keys. DeepSeek also shipped a stronger agentic Flash model, and Meta backed down on training AI with content from business websites.

Tech sector

Meta drops the AI-training line from its new business terms

After publishers pushed back, Meta deleted a sentence in its pending Commercial Terms (live 30 Oct) that would have let it train models on content crawled from business-linked websites. Crawling is now limited to ads, business products and integrity and security.

Why it matters: If you build sites for clients who run Meta ads, check what their robots.txt and terms actually allow. Under GDPR and the EU AI Act's copyright opt-out rules, "we never agreed to training" is a stronger position in Europe than in the US.

Source: Unite.AI · 17 Oct · Nieman Lab (background)

Anthropic's Jack Clark: AI could add ~32% to US output by 2030, plus mandatory kill switches

At the IMF–World Bank meetings in Bangkok, Clark described an internal Anthropic scenario that puts US GDP near $44T in 2030, well above a baseline without AI. He also called for international rules, including mandatory kill switches for advanced systems.

Why it matters: A frontier lab asking for regulation on an IMF stage lines up with the EU approach that Norway follows through the EEA. Expect kill-switch requirements to appear in procurement checklists before they appear in law.

Source: CNBC · 17 Oct

Jefferies: AI earnings growth is about to drop off a cliff

Jefferies expects consensus earnings growth for AI-linked stocks to fall from close to 100% in 2026 to about 30% in 2027 and 22% in 2028. It tells investors to diversify away from AI while keeping some infrastructure exposure, citing valuations, doubts about capex and rising debt.

Why it matters: Norway's oil fund owns slices of all of these companies. A cooling AI trade also tends to mean tighter budgets for AI projects, so work that shows a clear return will be easier to fund than demos.

Source: IANS · 17 Oct

Oracle redesigns Project Jupiter's gas fuel-cell microgrid to cut emissions ~35%

Oracle and Yucca proposed a change to the roughly 7,000 Bloom fuel cells powering the Project Jupiter campus in New Mexico. It lowers permitted emissions from 8.8M to 5.7M tonnes a year. The state's air-permit hearing moved to 7 December.

Why it matters: US hyperscale campuses are running their own on-site gas plants, while Norway sells hydro-powered, cool-climate capacity. Expect this contrast in every pitch for building a data centre in the Nordics.

Source: MGRID · 17 Oct

AI agents

OpenCode breach leaks stored provider API keys

The AI coding-agent platform says an attacker reached a legacy system it was retiring. The breach exposed OpenAI and Anthropic keys stored in workspaces for about 1.4% of Console users. OpenCode calls it a "distillation attack". Some users found unexpected charges, one of them around $400.

Why it matters: If you used OpenCode Console, rotate your keys today. Treat any agent tool that stores your own keys as part of your supply chain, and put spend limits on every provider key.

Source: Notebookcheck · 17 Oct (updated 18 Oct) · Cyera rotation guide

DeepSeek V4.1-Flash-1017: big agentic gains, MIT weights and a public search API

The refreshed Flash model scores clearly higher on agent benchmarks while producing shorter outputs, at unchanged API prices. Terminal-Bench 4.0 went from 31.2 to 42.3, and ProgramBench from 20.3 to 29.1. DeepSeek also opened its own AI-native search and fetch API, which it says filters out SEO spam and low-quality AI content.

Why it matters: With MIT-licensed weights and a 1M-token context, you can host this yourself in an EU region and keep data in the EEA. A built-in search tool also removes one more paid dependency from a DIY agent stack.

Source: DeepSeek changelog · 17 Oct · Hugging Face

Agents crack theoretical physics with counterexamples to Grad's 1967 fusion conjecture

Frontier models helped produce hand-verified counterexamples to a decades-old conjecture about plasma equilibria in stellarators. On the new 50-problem TheoPhysEval benchmark, one agent got 49 right for under $3 per problem.

Why it matters: Agents improve fastest where answers can be checked automatically. Use the same rule in your own codebase: put agents to work where a test suite or validator can grade the output.

Source: MACCUS · 17 Oct

Hacker News buzz

Mercor: 90% of US work hours fall on tasks AI benchmarks barely cover

Mercor mapped prompts from 29 agentic benchmarks onto US Department of Labor (O*NET) tasks. Only 208 of 923 occupations have a task with 5 or more prompts, and coverage leans toward high-wage jobs that are already exposed to AI.

Why it matters: Leaderboard scores tell you little about the actual tasks on your team. Build a small eval set from your own tickets before you pick a model.

551 points · 482 comments · HN discussion

How the Claude Code team does code review

The post describes how most line-by-line review moved to machines. Each change gets self-verification before a PR, then AI review, a blocking security review and CI. Human approval scales with a risk tier, from zero approvers to two.

What commenters argued about: The line "nobody keeps a complete mental model" of the codebase. Some saw a debugging time bomb, and others said big legacy systems have always worked this way. Many also said tactics that need huge token budgets don't carry over to smaller teams.

Why it matters: Risk-tiered approval is something a small team can adopt this sprint, even without an unlimited token budget.

403 points · 379 comments · HN discussion

Claude traces the origins of the NIST ECDSA curve seeds

Anthropic research says the "random" seeds behind P-192 through P-521 came from the C library's lrand48 generator seeded with a Unix timestamp. It was previously claimed they came from a hashed passphrase.

What commenters argued about: One side said this explains how the seeds were generated, and leaves open how the final curves were chosen. Filippo Valsorda countered that the leftover freedom was only about 30 bits, far too little to plant a weakness. Others brought up Dual_EC as a reason to stay suspicious.

Why it matters: P-256 sits under most TLS, passkeys and BankID-style flows. Knowing how the seeds were made feeds directly into the choice between Ed25519 and NIST curves in your next auth design.

935 points · 340 comments · HN discussion