hello everyone 👋,
Quick life update: I had the flu for the first time in my life, and it absolutely knocked me out for the entire week.
Turns out AI had a rough week too. A popular AI tool shipped malware, hackers raided three developer platforms, and one guy used AI agents to break into over 100 companies.
People are calling it “Black October”, so that’s the main story this week, plus a 10-minute checklist so you’re not the one paying for someone else’s AI bill.
After that it gets more fun: Claude Code deleting the ads from smart TVs, Claude finally getting its own AI agent, and a Chinese model that's actually pretty good.
📍 TL;DR
Hackers are stealing AI keys like credit cards. Here's what happened and how to make sure you're not next.
Claude Code deleted the ads from smart TVs. Now there's a free app that does it from your phone.
Claude finally got its own AI agent. It's the cheapest of the big four, but US-only for now.
Kimi K3.1 Pro is actually pretty good. Top 4 in the world at half the price of Opus.
OpenAI made an AI that just makes decisions. Sorting 10,000 emails with it costs about 70 cents.
Hackers came for your AI keys
If you only read one thing in this newsletter, make it this.
The short version: hackers are now using AI agents to break into websites for them, AI is finding bugs faster than anyone can fix them, and the thing everyone wants to steal is your AI keys (the passwords that let apps use ChatGPT, Claude or Gemini on your account).
A stolen AI key is basically a stolen credit card. Thieves use it to run up huge bills on your account or to train copycat models.
Here's what actually happened, in plain English:
→ A popular AI tool shipped malware. LiteLLM (a tool loads of AI apps use to talk to ChatGPT, Claude and Gemini) had a poisoned version online for under two hours. It got downloaded about 49,000 times and stole passwords, cloud logins and AI keys. The way hackers got in is almost funny: a master password that had been sitting in a public file for five months.
→ Three biggest developer platforms got hacked for AI keys. Railway says up to about 100,000 workspaces could be affected and that the attacker was specifically after AI keys. OpenCode users reported surprise bills of up to around $1,700, and Zeabur is shutting down completely.
→ AI found a bug that lets hackers take over websites without a password. It's in PHP, the behind-the-scenes language that runs roughly 7 in 10 websites, including every WordPress site. Every version from the last 14 years is affected. A fix came out on 22 Oct, but attackers started trying it within hours, and Cloudflare was soon seeing millions of attempts. This explainer covers what to ask your host.
→ One hacker let AI agents do the hacking for them. According to Reuters, they set up a team of AI agents, gave them a few short instructions and let them loose. Since late September, the agents have tried to break into over 1,200 websites and got into more than 100. The whole thing cost roughly $5,000 in AI credits, which works out to about $50 per hack, while the agents did all the work.
The good news is that OpenAI, Anthropic and Google weren't hacked themselves. The keys leaked from smaller tools built around them, and protecting yourself takes about 10 minutes.
The 10-minute checklist 🚨
Use one key per tool. If five apps share one key, you'll never know which one leaked.
Delete the keys you don't use anymore. Old forgotten keys got stolen too.
Got a WordPress site? Ask your host to confirm PHP is updated. Updating WordPress itself doesn't update PHP.
Claude Code deleted the ads from smart TVs
This was the most viral AI story of the week: people are using Claude Code to strip the ads out of their smart TVs.
It started with one developer who pointed Claude Code at his Google TV and asked if it could get rid of the ads and junk apps.
Claude found the TV on his Wi-Fi, switched off the ad and tracking apps, installed a cleaner home screen and made the menus way snappier. No jailbreak needed: it just uses the developer settings that are already built into the TV.
Someone else then turned the prompt into a free project called CleanYourTV. It went from zero to about 32,000 GitHub stars in roughly a week, and it's been tested on well over 100 TV models.
The easiest way to try it is the free community-made phone app. No laptop or coding needed: it finds your TV, shows you what it'll switch off, saves a restore point and locks everything back up at the end. It's Android phones only for now.
You can also just give that repo to your AI (Claude or Codex) and ask it to remove all the bloatware from your TV!
Claude finally got its own AI agent
In the last ten weeks, every big AI company has launched a personal agent that works for you in the background. Claude was the last one missing, and now it's here.
Claude Duet sends you a morning brief, checks your connected apps every few hours and only messages you when something needs you. It runs on its own computer and browser in the cloud, so your laptop can stay closed, and it always asks before it sends, pays, signs or deletes anything.
Here's how it stacks up against the others:
→ Grok Bot (xAI): $30/month with SuperGrok. It's been out the longest, and this week it landed on the iPhone Action Button and got 1Password, so it can sign into your accounts for you. The downside is that the usage runs out pretty fast.
→ Meta Muse: free, with paid plans at $20 and $100/month. It's the only one you can try for free, and it can book travel, shop, send emails and even negotiate your bills, right inside WhatsApp. The downside is that it runs on Meta's own models, which still don't feel as good as Claude in my testing.
→ ChatGPT Dots: needs ChatGPT Pro, from $100/month. Each "dot" gets its own computer in the cloud and connects to over 4,000 apps. The downside is that its quite laggy and not that ‘smart’.
→ Claude Duet: included in Claude Pro at $20/month, which makes it the cheapest paid option. It runs on Opus 5.5 and connects to over 6,000 apps. The only downside is that it's a US-only waitlist for now.
Kimi K3.1 Pro is actually pretty good
Moonshot (the Chinese lab behind Kimi) has a habit of dropping bangers. Its last model, K3, came out in July as the biggest open model ever released, and the head of LMArena (the site where people blind-test AI models) called it the biggest release of the year.
Now it's back with Kimi K3.1 Pro, and the numbers are looking really good ⬇️
It also costs half as much as Opus 5.5, and Moonshot claims it even beats Opus at long coding tasks. I doubt that, because they probably distilled a lot of it from Claude (trained it on Claude's answers) lol.
The one catch is that it's very chatty, so it uses a lot more words to finish the same job, which eats into those savings (think Opus 5 all over again).
My take: it's actually pretty good so far, but nothing crazy. Moonshot says the open version is coming by 4 November, so soon you'll be able to run it yourself (if you have a $30k+ computer lol).
Sort 10,000 emails for 70 cents
OpenAI's Decisions API is now out for everyone (I covered the beta two weeks ago).
Quick refresher: instead of writing you an essay, it just makes a call. Yes or no, which category, or a score out of 10. It reads text and images, answers in a fraction of a second, and it's ridiculously cheap because the answers are free and you only pay for what you feed it.
Sorting 10,000 emails costs about 70 cents, and going through 50,000 comments costs about $1.50.
What you can actually use it for 🚨
→ Sort your inbox into urgent, can wait, brand deal or spam.
→ Flag which Instagram or YouTube comments are real questions that need a reply.
→ Score leads from a form ("is this a real business?", "budget over $5k?") so you know who to call first.
→ Tag your ad library by format (UGC, product shot, meme, text-heavy) and see which type sells.
→ Route support messages to billing, shipping or tech, and rate how angry the customer is.
→ Check photos of damaged orders before approving a refund.
→ Screen giveaway entries or user submissions for anything that breaks your rules.
→ Score reviews from 1 to 5 and flag any that mention a competitor.
It's a developer tool, so it needs a little bit of code, but you can just ask Claude Code to build any of these for you.
Also this week
🎨 AI that makes editable logos. Ideogram Vector 1.0 turns a prompt or an image into a vector file (the kind you can edit shape by shape in Figma or Illustrator). It's a nice rematch for VectorCraft from last week's Adobe clones.
🧩 Skills now work in every AI tool. Anthropic handed Agent Skills to the same open foundation that runs MCP, and over 70 tools already support them, including ChatGPT, Cursor and GitHub Copilot. Build a skill once and use it everywhere. You can grab Anthropic's official ones here.
My latest carousel just passed 162K views, and I made the whole thing without leaving ChatGPT. Here's the exact flow:
→ Find an outlier. I found a "Promise vs Reality" carousel on Top Carousels that got 6.9x its creator's usual engagement. It rates famous books on what they promise vs what they actually deliver.
the outlier
→ Pull it into ChatGPT. Top Carousels plugs straight into ChatGPT and Claude, so I just pasted the link and asked it to pull the carousel.
pull it through mcp
→ Recreate it for my niche. I asked it to recreate the carousel for AI tools. It found all the logos and built the entire carousel, and I could still tweak every slide before exporting.
the carousel studio it built me
→ Post it. Here's how it did ⬇️
my actual carousel
It's the Krabby Patty formula from a few weeks ago (find an outlier outside your niche, then rebuild it with AI), except now the whole thing happens in one chat.
Setup takes about 2 minutes, step by step here.
It's out now and you can start for free here :)
That's it for this week.
See you next Sunday,
