- 02
- November
"AI News Roundup — October 2026: Anthropic Files for IPO, PHP2Shell Shakes the Web, Alphabet's Worst Day Ever, and Gemini 4 Carbon" — the short answer is October 2026 was the month AI's real numbers came out for inspection, the good and the worrying alike. Anthropic filed its S-1 to list on Nasdaq on 26 October, disclosing $16.3 billion of first-half revenue alongside more than $400 billion of future compute obligations. Three days later Alphabet fell 12.6% in a single day as investors began asking when the $740 billion-plus of capex from four giants would pay back. Mid-month brought PHP2Shell, a vulnerability found by AI that hit every PHP version and had Thailand issuing orders within a day, and the month closed with Gemini 4 Carbon taking the top spot on the independent index while Google handed it to cyber defenders first.
This article is the "October AI news index", following our AI News Roundup for September 2026. It covers every story in one place, with links to the full articles we published during the month. If you were busy all month, read this one and you are caught up
In one line: Four things organisations should know from October 2026 — (1) Anthropic filed its S-1 to list on Nasdaq as ANT: $16.3 billion first-half revenue, 85% gross margin, but more than $400 billion of compute obligations; (2) PHP2Shell, CVSS 9.2 vulnerabilities in every PHP version, needs patching now, and Thailand issued orders on 22 Oct; (3) Alphabet fell 12.6% in one day, the four hyperscalers' capex tops $740 billion, and OpenAI cut its funding target to $20 billion; (4) 11 new models: Haiku 5.5 is 90% cheaper, GPT-6.1 Terra half price, Gemini 4 Carbon ranks first but is not public. In Thailand, AiPASS 2.0 is giving away 500,000 Gemini Enterprise licences and a seven-tier data-centre regulation goes to Cabinet on 3 Nov.
October 2026 in numbers
Contents
- Timeline — the month week by week
- Biggest story — Anthropic files its S-1 and the real numbers are out
- Money — Alphabet's 12.6% drop and the question of when capex pays back
- Security — PHP2Shell, and AI that finds vulnerabilities for both sides
- 11 new models — cheaper again, but the strongest one is not public
- Agents and tools — Duet, Agent Skills, Workspace and new quota rules
- China — the government starts controlling model-weight exports
- Rules and policy — US discounts for every level of government, EU delays, Thailand still drafting
- Thailand — the PHP2Shell response, AiPASS 2.0 and data-centre rules
- People and jobs — the month big companies started writing "AI" into layoff notices
- What organisations should do with this month's news
- 7 lessons from October
- Article index
Timeline — the month week by week
The month in date order. If you missed a week, pick it up here. All dates are local time of the announcing party.
| Date | Event | Details |
|---|---|---|
| 1 Oct | OpenAI resumes frontier training · Thailand's fiscal year 2027 begins | OpenAI resumed training after an 11-day pause caused by the 20 Sep sandbox escape (see our September roundup). Before restarting it used teams of agents to attack its own sandboxes and found previously unknown holes · Anthropic published a case study on Barclays scaling Claude across the bank · Thai government agencies started the new fiscal year (first-month checklist) |
| 2 Oct | Claude Frontier Academy, $100 million | Anthropic committed $100 million to train 10,000 Forward Deployed Engineers (engineers who sit inside customer organisations) by the end of 2027, an answer to the problem of companies buying AI and having nobody to put it to work |
| 6–8 Oct | Claude for Google Workspace · Mistral Large 4 · Claude Haiku 5.5 · Anthropic Cyber Mission | 6 Oct: Claude arrived in the sidebar of Docs, Sheets and Slides as a public beta · Anthropic expanded its Cyber Verification Program so vetted security professionals get more cyber capability · Mistral previewed Large 4, roughly one trillion parameters · 7 Oct: Haiku 5.5 at $0.10 / $0.50 per million tokens, 90% cheaper than Haiku 4.5 · 8 Oct: Anthropic launched its Cyber Mission and updated its Usage Policy · Google retired gemini-3.7-flash and 3.5-flash |
| 12–15 Oct | Muse Wonder · Gemini 4 Argon goes GA · Anthropic's Q3 numbers · Muse Spark Open | 12 Oct: Meta released Muse Wonder at $4 / $20 · Anthropic said it had cut illicit model distillation by more than 90% · 13 Oct: Gemini 4 Argon reached general availability in the API at $2 / $10 (introductory price until 30 Nov) · 14 Oct: Anthropic told investors its Q3 revenue was $16.8 billion, opened a Singapore office and signed an MOU (Memorandum of Understanding) with the Singapore government · xAI shipped Grok Voice 3.0 · 15 Oct: Meta released Muse Spark Open, an 816-billion-parameter open-weights model · Anthropic gave METR (an independent model evaluator) employee-like access, the first step of the Pace the Frontier plan announced the month before |
| 16–19 Oct | China drafts AI model export controls · DeepSeek V4.1-Flash-1017 · AWS sees PHP attacks | 16 Oct: China's Ministry of Commerce and Ministry of Science and Technology proposed adding 23 AI technologies to the export-control catalogue. Frontier model weights would need a licence; API access would not count · 17 Oct: DeepSeek released V4.1-Flash-1017 · AWS honeypots saw PHP attacks four days before the vulnerability was disclosed · 19 Oct: MiniMax M3.1 Flash at $0.15 / $0.60 · 19–20 Oct: Thailand's Office of the National Digital Economy and Society Commission (BDE) held a seminar on digital infrastructure for AI |
| 21–23 Oct | PHP2Shell · Claude Duet · Meta Q3 · Agent Skills → AAIF · Thailand's response | 21 Oct: PHP released fixed versions 8.5.12 / 8.4.27 / 8.3.36 / 8.2.35 after the CVE numbers leaked on 20 Oct · Anthropic opened Claude Duet as a research preview · Meta reported Q3 with 2026 capex guidance of $135–145 billion; the stock fell 7.8% the next day · 22 Oct: Anthropic donated the Agent Skills standard to the Agentic AI Foundation · Thailand's Minister of Higher Education, Science, Research and Innovation issued a three-step order and the National Cyber Security Agency (NCSA) issued four measures on PHP2Shell · the Claude Developer Platform became available through Google Cloud · 23 Oct: OpenAI said frontier training would no longer touch the live internet · AP compiled nine companies that wrote "AI" into layoff announcements · Moonshot released Kimi K3.1 Pro · Chinese state media reported DeepSeek and MiniMax as the first labs to complete export registration |
| 26–27 Oct | Anthropic files S-1 · GPT-6.1 Terra · GSA 40% discount · Thailand settles data-centre criteria | 26 Oct: Anthropic filed its S-1 with the SEC to list on Nasdaq as ANT · OpenAI launched GPT-6.1 Terra at $1 / $5 for ChatGPT Work and Codex, not in Chat · Google changed the default so new paid API projects store request logs · 27 Oct: Anthropic expanded its GSA agreement to a 40% discount for every level of US government · it reported drug-development progress with six organisations · the Gemini API CLI entered beta · Thailand's data-centre policy board approved a draft seven-tier regulation to send to Cabinet |
| 28 Oct | Gemini 4 Carbon | Google announced Carbon, number one on the Artificial Analysis index at 59, but only for selected cyber defenders, with no date for general release · Anthropic expanded AI for Science to foundations and research institutions · Meta extended its Muse agent to Singapore |
| 29–31 Oct | Alphabet −12.6% · Mistral opens weights · Max → Ultra · OpenAI trims its round | 29 Oct: Alphabet fell 12.6% in one day after reporting $51.4 billion of capex in a single quarter and a second straight quarter of negative free cash flow · Amazon fell 7% · Mistral released Large 4 weights · Anthropic shipped a Usage and Cost Analytics API · 30 Oct: Nasdaq −2.9%, Nvidia −4%, Qualcomm −11% · Anthropic renamed Max 5x to Max and Max 20x to Ultra and removed the five-hour limit for verified Ultra accounts · Claude Code gained a rule against recreating existing games · the FT reported OpenAI cutting its round target to $20 billion at a $1.25 trillion valuation · Gemini Computer Use reached GA · the Bank of Thailand said AI lifted Thai electronics exports in September · 31 Oct: OpenAI's help page said ChatGPT and Codex would share one token-based allowance from December |
Biggest story — Anthropic files its S-1 and the real numbers are out
In September we saw a prospectus that "leaked" to Reuters. On 14 October Anthropic presented numbers in an investor meeting (we unpacked them in part 5 of our Anthropic analysis series). On Monday 26 October the company formally filed its S-1 (the registration statement for a public share offering with the US Securities and Exchange Commission) to list on Nasdaq under the ticker ANT. The difference from the leak is that every figure has been audited and signed by executives who are liable for it, so for the first time we can compare "news numbers" with "real numbers".
| Item in the S-1 | Figure | How to read it |
|---|---|---|
| Revenue, first half of 2026 | $16.29 billion (+1,304% from $1.16 billion) | Matches the 14 Oct investor figures (Q1 $4.7 + Q2 $11.6 billion), so last month's reporting held up |
| Revenue, full year 2025 | $4.59 billion | The first half of this year is 3.5 times all of last year |
| Gross margin | About 85% (cost of revenue $2.38 billion) | A year earlier it was roughly 12%; compute cost per dollar of revenue has fallen sharply |
| Net loss, first half | $80.7 billion | About $72 billion is a non-cash accounting charge from convertible notes rising in value with the company · the operating loss narrowed to $693 million, and Q2 showed operating income of $974 million |
| Cash and short-term investments | $131.7 billion · debt $6.2 billion | Almost all debt is convertible notes held by Amazon |
| Future compute payment obligations | About $417 billion plus $125–150 billion for capacity delivered 2028–2031 | Close to the $518 billion our September roundup cited from the leaked prospectus · non-cancellable purchase commitments $265.6 billion, versus $54.6 billion at the end of last year |
| Customer base | 11,900 customers paying over $100,000 a year · 1,900 over $1 million · about 250 over $10 million | No customer exceeds 10% of revenue · the top five together are about a quarter · 48% of revenue comes through the AWS, Google Cloud and Azure marketplaces |
| Revenue mix | Consumption-based 80% · subscriptions 20% · international 27.8% | The core business is the API, not the chat app · fees paid to channel partners in the first half: $2.7 billion |
| Control | Seven founders hold 50.1% of the vote through a Founder LLC | The filing itself says the structure "has no direct public company precedent" · lock-ups open in four stages at 27 / 48 / 62 / 76 days instead of the usual 180 · 5,300 employees |
What is still missing is the price range and share count. The Wall Street Journal, citing people familiar with the matter, reported that the company is aiming to list in the week of 16 November and could raise more than $100 billion at a valuation of $1.5–2 trillion; the company has not confirmed that. The Financial Times reported on 30 October that Blackstone warned investors Anthropic might not qualify for an investment-grade rating after the IPO, which would leave it dependent on hyperscalers to fund infrastructure. Goldman Sachs and Morgan Stanley lead the underwriters.
What a Claude Team / Enterprise buyer should take from the S-1: three things. First, 48% of revenue through marketplaces and $2.7 billion in channel-partner fees say Anthropic sells mainly through others, so buying through a local provider that issues a Thai tax invoice is the company's normal channel, not a workaround. Second, in more than 90 pages of risk factors the company itself lists dependence on TSMC in Taiwan, dependence on Amazon, Google and Microsoft as both suppliers and competitors, and an unresolved "supply chain risk" designation by the US Department of Defense. That is the list a procurement team should ask a vendor about before signing a multi-year contract. Third, every figure is in US dollars. We do not convert to baht because exchange rates and taxes make the price a Thai organisation actually pays different.
Money — Alphabet's 12.6% drop and the question of when capex pays back
On Thursday 29 October Alphabet fell 12.6% in a single day, its worst since listing, wiping out about $500 billion in market value, even though Google Cloud grew strongly. What the market disliked was capex (capital expenditure) of $51.4 billion in one quarter, more than half of all of 2025, which pushed free cash flow to negative $9.1 billion for the second quarter in a row, while Search advertising grew only 12%, its slowest in five quarters, and the company said it would spend more again next year. The next day the Nasdaq fell 2.9%, Nvidia 4% and Qualcomm 11%.
| Company | 2026 capex | Free cash flow | Stock after earnings | Note |
|---|---|---|---|---|
| Alphabet | $195–205 billion (Q3 alone $51.4 billion) | −$9.1 billion in Q3 | −12.6% (29 Oct) | Search +12%, slowest in five quarters · says 2027 spending rises again |
| Amazon | About $220 billion | −$42.4 billion trailing 12 months (a year earlier +$14.8 billion) | −7% (29 Oct) | AWS +39% |
| Meta | $135–145 billion | −$2.1 billion in Q3 | −7.8% (22 Oct) | Issued non-voting Class C shares · Zuckerberg admitted the Muse agent is "very compute-intensive to run" |
| Microsoft | Latest quarter $45.2 billion, below the $50 billion planned | +$18.6 billion | — | Says the shortfall came from third-party providers delivering capacity late, not a deliberate cut |
The number that best explains the worry comes from S&P Global: Microsoft, Alphabet, Amazon, Meta and Oracle raised a combined $326 billion of debt this year, three times last year. The model companies felt it too. The Financial Times reported on 30 October that OpenAI cut its funding-round target from $30 billion to $20 billion while holding the valuation at $1.25 trillion (down from the $1.4 trillion first pitched), with a consortium of UAE investors led by the MGX fund as the largest participant, and The Wall Street Journal reported that the round had raised less than half the original target. This is the "bridge" round before OpenAI's planned 2027 listing, following the March round that raised $122 billion at an $852 billion valuation.
For AI buyers in Thailand, bad news for investors is not yet bad news for users: in the same month the market panicked about capex, user prices kept falling. Haiku 5.5 is 90% cheaper than its predecessor, GPT-6.1 Terra is half the price of the model it replaces, and Gemini 4 Carbon launched at Argon's price. What to watch is "introductory pricing" with an end date: Gemini 4 Argon rises from $2 / $10 to $4 / $20 on 1 December. Anyone budgeting next year on this month's prices should use the post-increase figure instead. We argued in AI bubble 2026 that what an organisation should watch is its own cost per task, not the vendor's share price.
Security — PHP2Shell, and AI that finds vulnerabilities for both sides
The month's biggest security story is not about an AI model directly, but AI found it. PHP2Shell is two vulnerabilities (CVE-2026-109618 and CVE-2026-109619) in the PHP language itself, each scored 9.2 on the CVSS (Common Vulnerability Scoring System), that let an outsider run code on a server without logging in. They affect every PHP version from 5.4 to 8.5.11, which means roughly two thirds of the world's websites, including WordPress, Moodle, phpMyAdmin and the management interfaces of many network appliances. The key sequence: AWS honeypots saw attacks from 17 October, the CVE numbers leaked on 20 October and forced the patch schedule to move, and fixed versions 8.5.12 / 8.4.27 / 8.3.36 / 8.2.35 shipped on 21 October. PHP 8.1 and older have no official release and depend on Linux distribution patches or an upgrade.
Thailand responded quickly. On 22 October the Minister of Higher Education, Science, Research and Innovation issued a three-step order to universities and agencies under the ministry, and the NCSA (National Cyber Security Agency) with ThaiCERT issued four measures. How to find hidden PHP in an organisation, how to update by operating system, and the temporary mitigations while waiting for a patch are in our separate article.
If you have not done it yet, do it today: (1) find every PHP in the organisation, including the ones hidden in network appliances and admin tools; (2) update to a fixed version and restart every worker, because some Linux backports do not change the version number, so check the changelog; (3) review logs back to 17 October for "Allowed memory size" messages with no code line and for odd PHPSESSID values; (4) PHP 8.2 reaches end of life on 31 December, so if you must upgrade anyway, go straight to 8.3 or 8.4 · our own website is plain HTML on nginx and Saeree ERP is Java on WildFly, so neither is in scope, but many customers run WordPress or Moodle alongside.
The thing to remember from this incident is that both vulnerabilities were found with AI tools, reported by Wiz and OpenAI between August and September, and in the same month all three major labs raised the defensive side. Google announced Gemini 4 Carbon on 28 October, giving "selected cyber defenders" first access through its Fairwind programme, with real-world results of 88.2% on SEC-bench Pro for finding vulnerabilities, 54.8% on ExploitGym for writing exploits and 71% on CWE-bench for writing patches. That follows the pattern the three labs set in September: release cyber capability to vetted people first. Anthropic expanded its Cyber Verification Program on 6 October so verified experts get blocked by classifiers less often, and launched the Anthropic Cyber Mission on 8 October as a long-term commitment.
| Lab | This month's measures | Date | What it means for enterprise users |
|---|---|---|---|
| OpenAI | Resumed frontier training after an 11-day pause, having used agent teams to attack its own sandboxes first, then said frontier training would use an "offline world" of cached web content with no connection to real external systems | 1 Oct / 23 Oct | A good model for scoping agents in an organisation: experimental work should never touch production systems |
| Anthropic | Cut illicit distillation by more than 90% (following last month's accusation against seven Chinese labs) · gave METR employee-like access · added a Claude Code rule against recreating a specific existing game even if renamed | 12 Oct / 15 Oct / 30 Oct | The game rule signals that vendors are starting to police intellectual property inside the tool. Some developers report legitimate work being refused. Organisations should have their own policy before a vendor decides for them |
| Carbon to cyber defenders first · indirect prompt-injection attack success 0.0% (Argon 0.7%) · changed the default so new paid API projects store request logs | 28 Oct / 26 Oct | The last point matters to IT: Gemini API projects created after 26 October log requests by default. You must opt out per request or in settings if personal data passes through |
The picture that continues from September's threat report is this: attackers can now use AI to find holes in 20-year-old software, and defenders get tools of the same grade, but only after verification. An organisation without its own security team therefore depends mostly on patch speed, which is a process question, not an AI question.
11 new models — cheaper again, but the strongest one is not public
September brought 10 new models; this month we count 11 from 8 labs, but of a different kind. Last month was about top-tier models (Opus 5.5, GPT-6 Sol). This month is about small models that got much cheaper and a top model you cannot use yet. Claude Haiku 5.5 is 90% cheaper than Haiku 4.5, GPT-6.1 Terra is half the price of the model it replaces, and Gemini 4 Carbon, number one on the independent index, is only available to selected cyber defenders.
| Model | Lab · date | API price per million tokens (in / out) | What to know |
|---|---|---|---|
| Mistral Large 4 | Mistral · preview 6 Oct · open weights 29 Oct | $1.36 / $4.18 list (with a launch discount period) | About one trillion parameters, MoE (Mixture of Experts), Europe's largest open model, downloadable to run yourself |
| Claude Haiku 5.5 | Anthropic · 7 Oct | $0.10 / $0.50 (prompts up to 100K tokens) · above that $0.50 / $2.50 | 90% cheaper than Haiku 4.5 · 1M-token context · effort levels for the first time in a Haiku · Haiku 4.5 remains available with no retirement date |
| Muse Wonder | Meta · 12 Oct | $4 / $20 | Meta's most capable closed model, built for agent work; the Full variant requires a Muse Code subscription |
| Gemini 4 Argon | Google · GA 13 Oct | $2 / $10 until 30 Nov → $4 / $20 from 1 Dec | Announced 30 Sep for cyber defenders first, then opened in the API and the Gemini app for Pro / Ultra plans |
| Grok Voice 3.0 | xAI · 14 Oct | $0.08 per minute | Speech-to-speech model used in Grok, Tesla vehicles and Starlink call centres |
| Muse Spark Open | Meta · 15 Oct | Open weights (hosted providers charge about $1.25 / $4.15) | 816 billion parameters, 42 billion active, 1M-token context · scores 39 on the Artificial Analysis index, the top US open-weights model · Meta's own licence, not open source by the OSI definition |
| DeepSeek V4.1-Flash-1017 | DeepSeek · 17 Oct | No new price announced (previous version $0.30 / $1.20) | Update to September's V4.1 Flash with better reasoning, coding and agent performance, MIT licence |
| MiniMax M3.1 Flash | MiniMax · 19 Oct | $0.15 / $0.60 | Always-thinking model for coding and agents · weights "to be released later" |
| Kimi K3.1 Pro | Moonshot · 23 Oct | Not yet announced | Post-trained from the 2.8-trillion-parameter Kimi K3, 1M-token context · weights promised for 4 Nov, which will be the first test case for China's new export rules |
| GPT-6.1 Terra | OpenAI · 26 Oct | $1 / $5 (half of GPT-5.6 Terra) | Built for visual reasoning, computer use and coding · in ChatGPT only in Work and Codex, not in Chat · Plus / Pro / Business / Enterprise / Edu plans |
| Gemini 4 Carbon | Google · 28 Oct | $2 / $10 introductory → $4 / $20 afterwards · cached input 95% off | Number one on the Artificial Analysis index at 59 (Opus 5.5 58 · GPT-6 Astra 57 · Argon 50) · selected cyber defenders only, no general-availability date · Google says it is in the US government's voluntary pre-release testing process |
Three things budget owners need to know before year end: (1) Gemini 4 Argon doubles in price on 1 December. (2) ChatGPT and Codex will share one token-based allowance in December, but OpenAI has not published the token amounts per plan, so teams that use Codex heavily should wait for the numbers before renewing. (3) Claude Max 20x is now called Ultra at the same $200 a month; verified accounts lose the five-hour limit but keep a weekly cap of 10 times Pro. Team and Enterprise plans are unaffected by the renaming. The full plan table is on our Claude pricing page.
A note on the index: 59 / 58 / 57 for Carbon, Opus 5.5 and GPT-6 Astra are one point apart, and Google itself concedes that Anthropic still leads on a computer-use evaluation while OpenAI leads on some software-engineering tests. Choosing a model for real work should follow the method in our three-lab benchmark comparison: test with your own tasks, not the overall ranking.
Agents and tools — Duet, Agent Skills, Workspace and new quota rules
If September was the month of "warning signs" about agents, October is the month agent products for ordinary users actually shipped. Claude Duet (21 Oct) is a separate app in which Claude works proactively: a morning briefing, watching the apps you connect, continuing work on its own cloud computer while yours is off, and asking approval before sending messages, paying, signing or deleting anything. It is a research preview for Pro and Max in the US only; Team and Enterprise have no date. Meta extended its Muse agent to Singapore on 28 October, the first ASEAN country.
The news with longer-term consequences is that Anthropic donated the Agent Skills standard to the Agentic AI Foundation (22 Oct): the name, logo, GitHub organisation and the agentskills.io domain now sit under the Linux Foundation, which already stewards MCP (Model Context Protocol). A skill written once runs on more than 70 platforms including ChatGPT, Cursor, GitHub Copilot and VS Code; one million skills have been published and installed 280 million times. For an organisation this means the knowledge you put into skills is portable between vendors, but also that a million skills are a supply chain to vet like open-source libraries.
| What's new | Who can use it | Cost | What IT needs to do |
|---|---|---|---|
| Claude for Google Workspace (6 Oct) | Pro / Max / Team / Enterprise | No separate charge | Install organisation-wide from the Admin console · decide who may open the sidebar in Docs/Sheets/Slides · Claude edits files only when a person approves each change |
| Claude Science | Pro / Max / Team / Enterprise | Included in the plan | Desktop app that runs Python/R on the user's machine · searches 60+ scientific databases · research institutions should define which datasets may go in |
| Claude in Academy | Team plan (an Owner turns it on) | No seat used; counts against quota like chat | Enable at Admin settings → Products → Claude Academy · questions inside lessons stay out of history and admins cannot see them · use the 27 free courses as training before a rollout |
| Claude Duet (21 Oct) | Pro / Max in the US via waitlist | Uses the plan's quota, including background work | Not yet for organisations · use the time to decide who may approve when an agent asks, and which data must never be connected |
| Usage and Cost Analytics API (29 Oct) | Claude Developer Platform | — | Pull spend and usage into your own reporting · useful for organisations that split costs by department |
| Claude on Google Cloud (22 Oct) | Google Cloud customers | Marketplace pricing | All three major clouds now (AWS, Azure, Google Cloud); organisations with an existing cloud contract can pick the channel their procurement budget already covers |
| Gemini API CLI (27 Oct) · Computer Use GA (30 Oct) | Gemini API developers | Model pricing | A tool that lets agents click through screens inside the API · scope permissions the way Duet does; never let it touch production without a human approval |
| ChatGPT + Codex shared allowance (announced 31 Oct, effective December) | Plus / Pro / Business | Plan prices unchanged, token amounts not yet published | Instant chat does not count · teams that use Codex heavily should measure November usage as a baseline |
| Microsoft removes Copilot from Samsung / LG TVs (announced 30 Oct, effective 1 Dec) | TV users | — | An example of how fast a vendor can pull an AI feature nobody uses. A feature your business depends on belongs in the contract, not just the advertising |
A small story that says a lot: Anthropic invested $100 million in Claude Frontier Academy (2 Oct) to train 10,000 Forward Deployed Engineers by the end of 2027, and reported on 27 October that its scientists are running deep research partnerships with six drug-development organisations. Both are admissions that the bottleneck for AI in organisations is not the model but the people who connect it to real work, which is exactly what our 30-day Claude rollout plan says: week one needs an owner and measurable use cases before you open it to everyone.
China — the government starts controlling model-weight exports
The most important China story of the month is not a model but a rule. On 16 October the Ministry of Commerce (MOFCOM) and the Ministry of Science and Technology published a draft adding 40 technologies to the export-control catalogue, 23 of them AI. It covers model weights, checkpoints, source code and architecture for models trained with at least 1026 FLOPs, with at least 2 trillion parameters, or ranked in the global top ten, plus agents, compute clusters and chip-design know-how at 14nm and below. Comments are open until 15 November, and in the meantime exporters must register on the ministry's platform first.
Two exemptions keep the rule from shutting the door on Chinese open models immediately: weights already released as open source are not covered, and offering a model through an API, website or app is not treated as a technology export. On 23 October Chinese state media reported that DeepSeek and MiniMax were the first to complete registration and can keep releasing weights, consistent with DeepSeek shipping V4.1-Flash-1017 under MIT on 17 October. Moonshot's Kimi K3.1 Pro, released on 23 October at 2.8 trillion parameters, is clearly over the 2-trillion threshold; the company has promised weights on 4 November, which will be the first case showing how the rule works in practice.
What Thai organisations using Chinese open models should adjust: what you have already downloaded can keep running under its existing licence, because the rule does not reach back to published weights. What changes is that the "next version" of large models may arrive later or only as an API. If your system depends on running a Chinese model on your own hardware for data-residency reasons, keep a fallback to open models from other labs; this month added Meta's Muse Spark Open and Europe's Mistral Large 4. The back story on DeepSeek, Qwen and the distillation accusations is in our September China AI update.
On the product side, MiniMax M3.1 Flash (19 Oct) at $0.15 / $0.60 per million tokens undercuts even Haiku 5.5 on short prompts, but it is a closed model whose weights come "later", which is no surprise read next to the new rule. Alibaba has still not released the Qwen 4 it said last month was in training.
Rules and policy — US discounts for every level of government, EU delays, Thailand still drafting
| Where | What | Status this month | Effect on Thai organisations |
|---|---|---|---|
| US — government buying AI | Anthropic expanded its agreement with the GSA (General Services Administration, the federal procurement agency): 40% off Claude Enterprise, Claude for Government and the API for every level of government, including state and local, no minimum, usage-based | Announced 27 Oct · about 500 US government organisations use Claude · the earlier $1-per-user federal offer expired 31 Oct | No direct effect in Thailand, but it shows public-sector pricing has become vendor policy. Thai agencies can read our Claude for Government page, which covers local procurement and tax invoices |
| US — federal law | The draft Great American AI Act, which would bar states from regulating AI development for three years | Still a discussion draft since June with no progress this month · state laws remain in force, for example Connecticut's took effect 1 Oct | Software exporters to the US still need to follow state-by-state rules |
| EU | The Digital Omnibus pushed the AI Act's high-risk obligations to 2 Dec 2027 (Annex III) and 2 Aug 2028 (AI in regulated products) | In force since July · next milestone 2 Dec 2026, the ban on AI that generates non-consensual intimate imagery | Exporters get more than a year extra, but the transparency duties that started in August still apply; see our EU AI Act article for Thai exporters |
| China | Draft export controls on 23 AI technologies | Comments until 15 Nov · pre-export registration already in effect | See the China section above |
| Vendor self-governance | Anthropic gave METR employee-like access and is in talks with Hugging Face (15 Oct) · created the Anthropic Public Benefit Fund holding part of the company's shares (18 Oct) · signed an AI-safety MOU with Singapore (14 Oct) · Google put Carbon through the US government's pre-release testing | Unilateral delivery of step one of last month's Pace the Frontier plan | If large buyers start requiring evidence of independent evaluation in contracts, every vendor will need it. Thai agencies drafting a TOR should start adding this clause |
| Thailand | Draft Artificial Intelligence Act (three risk tiers, six-month logs, fines of 1–5 million baht) | No news of Cabinet approval this month · still the draft consulted in July | There is still time to classify the AI systems you use by risk tier |
Thailand — the PHP2Shell response, AiPASS 2.0 and data-centre rules
Three Thai stories matter to organisations this month. The first is the PHP2Shell response covered in the security section: on 22 October the government issued orders within a day of the patch, faster than in several earlier incidents. The second is AiPASS 2.0: the Ministry of Digital Economy and Society, with Google, upgraded TH-AI Passport (see our August roundup) by giving away 500,000 Gemini Enterprise licences, open for applications from 9 October to 2 November 2026 or until they run out. Today is the last day.
The third is data-centre regulation, which affects every organisation planning to use domestic cloud. It began when the national data-centre policy board met for the first time on 4 September and paused new projects for a month to write central criteria, because Bangkok has 49 data centres with no rules on power and water use (the Bangkok administration clarified that most are small, under 2 megawatts, not hyperscale). Nationwide 35 projects are operating and 117 await approval. On 27 October the board approved a draft policy that classifies data centres into seven tiers by power draw, starting at 0.5 megawatts and below, sets minimum standards in four areas, gives existing operators a year to comply, and routes applications through a single committee instead of several departments. The Finance Minister will submit it to Cabinet on 3 November, with new-project reviews expected to start in December at the earliest and about 100 new applicants waiting for early 2027.
| Date | Thai dates to remember |
|---|---|
| 2 Nov | Last day to apply for Gemini Enterprise licences under AiPASS 2.0 |
| 3 Nov | Cabinet considers the seven-tier data-centre regulation |
| About 13 Nov | 30 working days are up for government agencies' annual asset inspection reports (Annual inventory check, EP.5) |
| 15 Nov | China closes comments on its AI model export-control draft |
| 18–20 Nov | depa's smart-city and AI technology event at the Queen Sirikit National Convention Center |
| 1 Dec | Gemini 4 Argon rises to $4 / $20 · Microsoft removes Copilot from TVs · OpenAI's shared ChatGPT + Codex allowance starts during the month · Thai reviews of new data centres expected to begin |
| 11 Dec | Custom GPTs shut down (announced in September) |
The macro number tied directly to AI came from the Bank of Thailand on 30 October: the AI boom lifted electronics exports and data-centre investment in September, but the recovery was uneven, with gains concentrated in AI-related businesses and workers. That matches last month's NECTEC AI Readiness survey, which found half of organisations using AI but most unable to measure it. Regionally, Anthropic opened its fifth Asia-Pacific office in Singapore and Meta chose Singapore as the first ASEAN country for its Muse agent, so consumer agent tools have reached the region but not yet Thailand.
People and jobs — the month big companies started writing "AI" into layoff notices
In the September roundup we answered why AI had not yet caused mass layoffs. This month the picture shifts slightly, not because the numbers jumped but because companies started writing the word AI into their own announcements. The Associated Press compiled them on 23 October:
| Company | Scale | What the company itself said |
|---|---|---|
| Barclays | About 5,000 roles (5%), 60% from support functions including developers | "Organisational simplification and technology change efficiency driven by AI" · the same bank Anthropic showcased on 1 Oct for scaling Claude |
| Meta | About 8,000 people (10%) plus 6,000 open roles left unfilled | Efficiency and funding new investment, with 2026 expenses heading toward $169 billion |
| Block | More than 4,000 of 10,000-plus employees | Jack Dorsey: "A significantly smaller team, using the tools we're building, can do more and do it better", naming AI as a key driver |
| Coinbase · Pinterest · Snap | 14% · under 15% · 16% (about 1,000 people) | Coinbase says it is becoming "lean, fast, and AI-native" · Pinterest is moving resources to AI roles |
| Kroger · Standard Chartered | 3,000 corporate roles over three years · more than 15% of back-office staff by 2030 | Both tied directly to expanding AI and automation |
| Microsoft | Voluntary buyouts offered to 8,750 US employees (7%) | Gave no AI rationale · in an earlier round its chief people officer said plainly that "the roles eliminated are not being replaced by AI" |
Two cautions when reading this table. First, writing "AI" in an announcement does not mean AI can do that job yet; some companies use the word because they need cash for capex (Meta is the clearest example). Second, aggregate figures from the trackers differ widely: one counts roughly 26% of this year's reported layoffs as AI-related, another counts 183,000 people, and they are not comparable because the criteria differ. The other side of the coin is Anthropic spending $100 million to train 10,000 engineers to sit inside customer organisations, which means the jobs being added are "people who connect AI to work", not the old roles.
For Thai organisations: the Thai labour market has not seen announcements like these yet, but the lesson from Barclays is that "support functions" are hit first, not front-line roles. The departments that should start learning the tools first are accounting, procurement, human resources and legal; this month we published 10 real use cases for legal teams as the first of that series, and Claude Academy offers free courses you can start without waiting for budget.
What organisations should do with this month's news
October's news turns into six tasks, in order of urgency.
| Task | The news behind it | What to do | Urgency |
|---|---|---|---|
| Patch every PHP | PHP2Shell CVSS 9.2 · real attacks seen from 17 Oct | Inventory every PHP including those hidden in appliances, update and restart, then review logs back to 17 Oct · set a 72-hour patch process for anything CVSS 9 or above | Now |
| Apply for AiPASS 2.0 | 500,000 Gemini Enterprise licences, closes 2 Nov | If your organisation has no tool for staff to try, use this as a training ground before deciding what to buy | Today |
| Budget next year on post-promotion prices | Argon doubles 1 Dec · OpenAI shared allowance in December · Carbon's introductory price has an end | Pull October–November usage reports and recalculate at standard prices, not launch prices · move high-volume work that does not need a top model to Haiku 5.5 or Terra | By end of Nov |
| Check Gemini API logging | New projects after 26 Oct store request logs by default | Review every project that handles personal data; disable logging or enable it only where your PDPA policy allows | By end of Nov |
| Approval rules for agents | Duet asks before paying/signing/deleting · Gemini Computer Use is GA · OpenAI trains offline | Write down which actions need a human, who that human is, and that experimental agents never touch production · use Duet's model as the template | Within Q4 |
| Add independent-evaluation clauses to TORs | Anthropic gave METR access · Google put Carbon through government testing · the S-1 discloses supply-chain risk | Multi-year AI contracts should require vendors to report independent evaluations and a fallback plan if their upstream cloud provider changes | Within Q4 |
7 lessons from October 2026
| # | Lesson | Evidence |
|---|---|---|
| 1 | Last month's news numbers matched the real ones, but you must read the loss line properly | S-1: first-half revenue $16.29 billion matches the investor briefing · the $80.7 billion loss includes a $72 billion accounting charge |
| 2 | The market has started charging for capex, but user prices keep falling | Alphabet −12.6% · Haiku 5.5 −90% · Terra −50% |
| 3 | AI can find 20-year-old holes; patch speed is most people's only shield | PHP2Shell was found with AI · real attacks four days before disclosure |
| 4 | Releasing the strongest model to defenders first has become every lab's standard | Gemini 4 Carbon · Argon · Cyber Verification Program · last month's three cyber models |
| 5 | Launch prices expire | Argon $2 / $10 → $4 / $20 (1 Dec) · Carbon labelled introductory |
| 6 | What you write into skills is now portable, but Chinese model weights may travel less freely | Agent Skills → AAIF, 70+ platforms · China's 16 Oct export-control draft |
| 7 | The bottleneck is people who connect AI to work, not the model | Anthropic pays $100 million to train 10,000 engineers · Barclays cuts support roles while scaling Claude |
Article index — read the full stories
This article is the overview. For any topic you want in depth, follow the links to the articles we published during the month.
Models and products
- Claude Haiku 5.5 (7 Oct) — 90% cheaper with a 1M context: which jobs it fits and whether to migrate now
- Claude for Google Workspace (6 Oct) — Claude in Docs, Sheets and Slides: how to install it and what IT needs to know
- Claude Science — An AI workspace for researchers: how it works and who can use it
- Claude Duet (21 Oct) — A proactive agent that asks before acting, compared with Meta Muse and OpenAI Dots
- Agent Skills → Agentic AI Foundation (22 Oct) — An open standard shared by 70+ platforms, and what Thai organisations gain
- Claude Academy — 27 free courses, and the switch a Team admin has to turn on
Money and security
- Anthropic's Q3 numbers (14 Oct) — Part 5: checking the AI-written BMC, SWOT and Five Forces against real figures
- PHP2Shell (21 Oct) — Who is affected, how to fix it, and a 12-point checklist for Thai IT teams
- AI bubble — Why an organisation should watch its own cost per task, not vendor share prices
- Three labs' cyber models (Sep) — The template for releasing Carbon to defenders first
Practical use and Thailand
- 30-day Claude rollout plan — Pick the right use cases, measure with admin analytics, and stop people dropping off after month one
- Claude for legal teams — 10 real use cases with the rules from the Supreme Court President's 2025 guidance
- Fiscal year 2027 first-month checklist — What government agencies must do in October
- Annual inventory check, EP.5 — The 30-working-day deadline and what the State Audit Office checks
- Thailand's draft AI Act — What Thai businesses need to prepare
Previous AI news roundups
- September 2026 — three CEOs call for a slowdown, 10 new models, Anthropic's prospectus leaks, Bangkok floods
- August 2026 — model prices collapse, OpenAI's first training halt, TH-AI Passport goes live
- July 2026 · June 2026 · May 2026 · Songkran 2026 · March 2026
Conclusion
October 2026 was the month AI moved from "news" to "signed documents". Anthropic's S-1 confirmed that $16.3 billion of first-half revenue is real, and confirmed just as clearly that more than $400 billion of compute obligations are real too. The stock market began asking when the investment pays back, through Alphabet's worst day in its history, yet in the same month user prices fell again, and the strongest model went to cyber defenders before anyone else because AI really can now find holes in 20-year-old software. For a Thai organisation the to-do list is not complicated: patch every PHP, budget next year on post-promotion prices, write approval rules for agents, and use the free resources already available, from AiPASS 2.0 to Claude Academy, so your people can try before you buy.
October 2026 taught us that when the real numbers arrive, both the revenue and the obligations are bigger than the headlines, and the holes AI finds do not wait for anyone to be ready. An organisation that wants to live with AI needs two habits: patch faster than before, and budget on standard prices, not launch prices.
- Paitoon Butri · Network & Server Security Specialist, Grand Linux Solution Co., Ltd.
References
Facts checked on 2 November 2026 — financial figures are from the S-1 and the news reports cited; model prices are vendor list prices on the date checked.
- SEC — Anthropic, PBC Form S-1 (26 Oct 2026)
- CNBC — Anthropic IPO live updates: AI lab's S-1 filing (26 Oct 2026)
- TNW — Anthropic files for Nasdaq IPO as half-year revenue hits $16.3bn (26 Oct 2026)
- Anthropic — Newsroom (all October 2026 announcements) (Oct 2026)
- Anthropic — Anthropic invests $100 million to train 10,000 engineers (2 Oct 2026)
- Anthropic — Strengthening our defenses against distillation attacks (12 Oct 2026)
- Anthropic — An update on independent evaluators (15 Oct 2026)
- Anthropic — Expanding our partnership with GSA to bring Claude to all levels of government (27 Oct 2026)
- Anthropic — Early progress on accelerating drug development with Claude (27 Oct 2026)
- TNW — Anthropic renames Claude Max plans and drops Ultra's five-hour limit (30 Oct 2026)
- Wccftech — Claude Code game restrictions target clones, but developers say legitimate projects are being blocked (30 Oct 2026)
- Google — Gemini 4 Carbon: our next frontier model (28 Oct 2026)
- Google — Gemini API changelog (Argon GA 13 Oct, request logging default 26 Oct, Computer Use GA 30 Oct) (Oct 2026)
- gHacks — OpenAI launches GPT-6.1 Terra with API pricing 50% lower than GPT-5.6 Terra (27 Oct 2026)
- TNW — OpenAI launches GPT-6.1 Terra, a cheaper model for everyday computer work (26 Oct 2026)
- Tech Monitor — OpenAI resumes frontier model training after security review (Oct 2026)
- The Hacker News — OpenAI AI agents demonstrate VM escapes and secret cross-sandbox communication (Oct 2026)
- CNBC — OpenAI nears up to $30 billion funding round at $1.25 trillion valuation led by UAE investors (22 Oct 2026)
- Benzinga — OpenAI reportedly cuts funding target by $10 billion (citing the Financial Times) (30 Oct 2026)
- byteiota — ChatGPT + Codex usage limits merge in December (citing OpenAI's help page updated 31 Oct) (31 Oct 2026)
- TechCrunch — Cracks are emerging in the AI spending boom (30 Oct 2026)
- NBC News — Alphabet shares record their worst day ever, shedding $500 billion in value (29 Oct 2026)
- CNBC — Meta (META) Q3 2026 earnings report: live updates (21 Oct 2026)
- AP — Layoffs linked to changes in corporate AI spending (23 Oct 2026)
- TNW — China proposes export controls on its advanced AI models and chip designs (Oct 2026)
- Cloud Security Alliance — China's first frontier AI export controls: MOFCOM Announcement No. 48 (Oct 2026)
- SCMP — DeepSeek, MiniMax secure open-source licences days after new China export rules: state media (23 Oct 2026)
- Unite.AI — Meta's 816B-parameter Muse Spark Open weights are now public (15 Oct 2026)
- BetaNews — Mistral Large 4 preview and open weights (Oct 2026)
- Cleus — New AI models released in October 2026 (dates and prices for 10 models) (30 Oct 2026)
- Fintech Singapore — Anthropic opens Singapore office, signs AI safety MOU with government (14 Oct 2026)
- Collibra — AI regulatory compliance in 2026: EU AI Act, US orders and state laws (2026)
- CASRAI — Federal AI moratorium and the state preemption fight 2026 (Sep 2026)
- Naewna — Ministry of Digital Economy and Society with Google upgrades TH-AI Passport to AiPASS 2.0 (Thai) (Oct 2026)
- THE STANDARD — Finance Minister to propose seven-tier data-centre regulation to Cabinet on 3 Nov (Thai) (Oct 2026)
- Thansettakij — Government pauses new data centres, one month to issue central criteria (Thai) (Sep 2026)
- MGR Online — Setting standards for Bangkok's 49 data centres, single window and zoning proposed (Thai) (Sep 2026)
- Xinhua — Thailand's economy improves in September on AI-driven exports (Bank of Thailand) (30 Oct 2026)
- Kaohoon — Ministry of Digital Economy and BDE set direction for digital infrastructure to make Thailand an AI hub (Thai) (Oct 2026)
Want your team to use Claude systematically, not just try it?
Grand Linux supplies Claude Team / Enterprise with a Thai tax invoice, trains your people, and connects Claude to your organisation's data over MCP. Fill in the quote request form and our team will call you back, quoting your request number.
Get advice / request a quoteTel 02-347-7730 | sale@grandlinux.com
