Skip to content
Daily BriefNewsDaily Brief

7 AI stories from October 15-19, 2026: Cohere's AISLE buy, Google's Gemini scam scanner, a Jev prompt-injection test, and 4 more releases from DeepSeek, OpenAI, and Disney

· by Pondero Newsdesk · 7 stories

AI news daily brief: 2026-10-19

AISLE's AI system caught vulnerabilities in curl and OpenSSL that security tools from OpenAI and Anthropic missed outright, and Cohere is now paying to own that system rather than build an equivalent one in-house, the most consequential of seven stories from October 15-19 for anyone deciding which AI security tooling to trust. The same week brought proof that a "decision-only" model can still be clickjacked, a cheaper model refresh with a newly free API window, two live-voice API upgrades, and Disney picking up Character.AI's team out of bankruptcy.

Cohere agrees to acquire AISLE, the AI that found curl bugs OpenAI and Anthropic's security tools missed

BetaKit reported that Cohere signed a letter of intent on October 15 to acquire AISLE, a year-old Prague-based startup whose AI system found 18 of the 24 vulnerabilities fixed in curl's latest release days earlier, after security tools from OpenAI and Anthropic reportedly turned up nothing in the same codebase. AISLE also found all 12 previously unknown vulnerabilities in OpenSSL's January 2026 security release, according to Infosecurity Magazine. No price or closing date was disclosed. AISLE's roughly 50 staff are expected to join a new Cohere Cyber unit, with AISLE co-founder and former Avast CEO Ondrej Vlcek as its senior vice president. Read more: Cohere agrees to acquire AISLE.

Google adds opt-in cloud Gemini scam scanning to Google Messages

Google's own announcement describes an opt-in Enhanced protection mode, rolling out starting October 14, that sends unknown-sender text conversations to cloud Gemini models for fraud analysis inside an encrypted Private AI Compute environment, rather than relying only on on-device scanning, per Google. The same update extends on-device Gemini Nano link checks, blanks sensitive fields during screen-share on Chrome and WebView, and blocks silent call-forwarding activation. Google says its existing filters already flag more than 5 million suspected scam calls and texts monthly, and a verified-call system has blocked over 3 million spoofed bank calls since launching in June. Read more: Google adds opt-in cloud Gemini scam scanning.

HiddenLayer finds Jev's decision model still falls for the same prompt-injection trick as a regular LLM

The Register reported that security firm HiddenLayer built a fake online checkout page and added a bogus "Confirm Price" button to test whether it could clickjack a browser agent built on TypeSafe's Jev, a model that answers only with a probability rather than free text. The button worked: the agent clicked it instead of completing the order. The same trick fooled a comparison model built on Qwen3.8-27B, though Jev fell for it less often. HiddenLayer's conclusion, quoted by The Register: "A model that returns a decision is still a language model, and its decision still becomes an action in your systems." Pondero folded the finding into its decision-models comparison guide.

DeepSeek ships V4.1-Flash-1017 and opens its search and fetch APIs at $0.75 per 1,000 calls

DeepSeek's own release notes show V4.1-Flash-1017, shipped October 17, scoring 77.0 pass@1 on its DeepSWE v1.1 benchmark, up from 74.2 for the prior Flash release, while keeping pricing at $0.14 per million input tokens and $0.28 per million output tokens. The same release opened DeepSeek's search and fetch tool-calling APIs to every API user at $0.75 per 1,000 calls each, free until billing starts at 16:00 UTC on October 31. Calls routed through DeepSeek Harness, Claude Code, or Codex qualify for that same free window. Pondero updated its Kimi K2.7 vs. DeepSeek V4 vs. Qwen3 coding-agent guide with the new numbers.

OpenAI's GPT-Live now reacts before a user stops talking and builds voices from text alone

According to OpenAI's API changelog, GPT-Live gained native Decisions API integration on October 15, letting an app act or react to transcript events while a caller is still speaking, instead of routing the decision through a developer's own backend first. The next day's entry added prompt-to-voice: sending a text description to the /v1/audio/voices endpoint creates a reusable custom voice with no recorded sample required. Creating a voice this way is free; using it inside a GPT-Live session bills at normal session rates. Read more: OpenAI's GPT-Live reacts mid-sentence and builds voices from text.

Researchers find prompt-injection attempts hiding in webpage HTTP headers

Security firm Signals Corps scanned 217 million HTTP page responses pulled from Common Crawl and found roughly 8,000 sites sending metadata to AI agents through response headers, the data that travels alongside a page but outside anything a human visitor sees. Thirty of those sites had packed the headers with indirect prompt-injection attempts, The Register reported. Most were pranks with no real payload, but one mimicked SQL-injection syntax to try a table-deletion command, and another fabricated a 94% match score aimed at an AI hiring screener. Exposure depends on which tool reads the headers: Microsoft's Playwright MCP server returns them to a calling agent by default, while Anthropic's Claude Code does not unless it is told to print them. Read more: Prompt-injection attempts hiding in HTTP headers.

Disney agrees to hire at least 60 Character.AI employees for about $60 million

TechCrunch reported, citing a bankruptcy filing, that Disney agreed to extend job offers to at least 60 Character.AI employees, the majority of the bankrupt chatbot startup's remaining staff, at a combined annual compensation of roughly $60 million. Disney separately agreed to buy some of Character.AI's assets for $20 million as a stalking-horse bid, the opening offer in a court-supervised auction that another bidder can still top. Character.AI filed for Chapter 11 on October 13 after a wrongful-death lawsuit and a child-safety investigation; its former CEO became Disney's first chief technology officer in September. The sale is expected to close in late November or early December, leaving a narrow window for a rival bidder to beat Disney's $20 million offer before the fate of Character.AI's 20 million monthly users is decided. Read more: Disney agrees to hire at least 60 Character.AI employees.

Sources