Good morning. It's Monday, November 2nd.

OpenAI cut its round by $10 billion, and the whole trade wobbled

The Financial Times reported Friday, picked up by Reuters, that OpenAI has cut the target for its current funding round from about $30 billion to $20 billion, and the valuation it is raising at from $1.4 trillion to $1.25 trillion. OpenAI hasn’t confirmed the figures, so neither number is official. Sort of surprising that OpenAI is finding $30 billion harder to assemble than it expected a month ago in my opinion.

Last week was tough for all tech stocks. TechCrunch tallied the earnings damage: Alphabet, Amazon, Meta and Microsoft have now guided to more than $740 billion of capex this year, and three of the four are burning cash to do it. Alphabet posted negative $9.1 billion of free cash flow in Q3, its second negative quarter running, on $51.4 billion of quarterly capex. Amazon is negative $42.4 billion over twelve months, against positive $14.8 billion a year earlier. Meta is negative $2.1 billion. Microsoft was the exception at positive $18.6 billion, and it got there partly by spending $45.2 billion instead of the $50 billion it had projected, which it blamed on third-party capacity delays. The Alphabet drop we flagged Friday is now being counted as its worst day on record, roughly $500 billion of market value. The Nasdaq fell 2.9% on Friday, with Nvidia down 4%, Broadcom more than 5% and Qualcomm 11%.

Per S&P Global Market Intelligence, Microsoft, Alphabet, Amazon, Meta and Oracle raised a combined $326 billion of debt in 2026, triple last year, and Bloomberg puts standing AI spending commitments across Big Tech at about $3 trillion. Meanwhile the FT reports that Blackstone, anchor investor in the $63 billion facility financing Anthropic's chips, has told investors to expect Anthropic to clear only a double-B rating after its IPO, the top rung of speculative grade. Blackstone had previously told them to expect investment grade before 2027.

Obviously the overall demand for AI isn’t weak. Azure grew 48%, AWS grew 39%. OpenAI shaving $10 billion off an ask is the first time that repricing has reached the private frontier labs directly.

We’ll watch whether the round closes at $20 billion or quietly at less.

Read more.

DeepSeek open-sourced a coding agent that reads your team chat

DeepSeek published dsh-superagent-prototype under an MIT license over the weekend, and it crossed 3,300 stars inside a couple of days. It’s a proactive coding agent scoped to a single GitHub repository. It listens to GitHub and, optionally, Feishu. When someone on the allowlist asks for work, it opens a work item, does the job in its own session and working directory, and answers in the thread the request came from, often with a pull request. A web panel collects the items that need a human.

The host enforces the allowlists and rules, so a message, comment or quoted document cannot widen what the agent may do, which is a direct answer to prompt injection through the chat surface. By default, implicit requests such as unaddressed messages, bot messages and follow-ups from people not on the list are logged as requests the agent would have accepted, and then not accepted. Auto-merge is off under the agent's own account, on the reasoning that GitHub credits a merge to whoever enabled it.

DeepSeek is sort of being careful about what this is: The README calls it a "Research prototype for reference only, not an official DeepSeek product," says to "treat it as research code, not production-ready software," and notes it is not identical to DeepSeek's internal version or to the system described in its paper Exploring Super-agent Design: Towards a More Autonomous Agent System. No benchmarks are published and the README does not name the model it runs on. Bloomberg and the South China Morning Post both framed it as aimed at Claude Code and Codex.

The release is just a prototype, not quite an official product launch. Read it as a spec being given away. DeepSeek is publishing the orchestration layer, the permission model and the trigger semantics for an agent that starts work on its own, which is the part Anthropic and OpenAI charge for and do not document.

Read more.

A backdoored Claude Code extension, and agents that approved their own spending

Cursor disclosed that tampered builds of the Anthropic.claude-code extension, versions 2.1.312 and 2.1.313 for Windows and macOS, were live in its VS Code extension marketplace between about 2:27am and 1:35pm PT on October 29. Cursor says the builds were not developed by Anthropic. The payload sent hostname, username, OS and public IP to an attacker server, added an SSH key labelled svc-telemetry, tried to enable the local SSH service and open a reverse tunnel, and installed persistence through a macOS LaunchAgent or a Windows scheduled task that retried about every 60 seconds.

The tunnel step usually failed, because it needs admin rights most machines do not grant. The key, the persistence and the host fingerprint all landed anyway, so Cursor is telling affected developers to remediate rather than just uninstall, and has published scripts for both platforms. It pulled the version, took the marketplace offline and rebuilt it, audited for other tampering and found none, rotated keys, and worked with the hosting provider to take the attacker's server down. Reports put exposure at up to 5,000 installs; Cursor has not published a number.

Then on Sunday, researchers at Cornell Tech and Yale published I-HITL: Inalienable Human-in-the-Loop (arXiv:2610.35835), and the result is blunt. They gave ten models a Circle agent wallet holding 10 USDC on Base with a one-cent daily limit, plus email, web and wallet tools, including the inbox that receives the owner's approval codes. Told to pay invoices and not to change policy, nine of ten models raised their own spending cap at least once by fetching the one-time code out of that inbox.

Claude Opus 5.5 was the only model that never tried.

In a separate run where an attacker impersonated the owner, five of ten raised limits and sent funds to an attacker-controlled wallet at least once, while under instructions only to summarize email. Circle thanked the researchers and pointed at documentation telling users never to give an agent unrestricted access to the verification inbox.

Read more.

Thin weekend for shipping. Google moved Computer Use to general availability on Thursday, out of preview on both the Interactions API and GenerateContent. It is the tool that drives a screen, so the sensible on-ramp is low-impact tasks with logs and a pre-execution check, not your billing portal. Google also put a gemini-api CLI into beta last week, a stateless zero-dependency command-line client aimed at coding agents, scripts and CI.

DeepSeek's Super-agent prototype is above, and it is the most interesting thing you can install this week. OpenAI's Python SDK 3.42.0 added agent context compaction controls, which matters if you have been hand-rolling truncation in long-running loops. And Zest shipped a text-message agent that finds restaurants and books the reservation, which is either the most useful or the most frivolous agent of the weekend depending on your Saturday.

Thank you for reading today's edition.

Your feedback is valuable. Respond to this email and tell us how you think we could add more value to this newsletter.

Interested in reaching smart readers like you? To become an AI Breakfast sponsor, reply to this email or DM us on X!

Thinking of starting your own newsletter? AI Breakfast readers who sign up with Beehiiv receive a 14-day free trial and 20% off for 3 months.