Apple zero-day fix, Claude Sonnet 5.5 and OpenAI shelves Astra

Claude Sonnet 5.5 is 30% faster at the same Sonnet 5 price

Anthropic released Claude Sonnet 5.5 on 28 September. It runs more than 30% faster than Sonnet 5 and uses fewer tokens for the same job. The price stays at US$2 per million input tokens and US$10 per million output tokens.

Anthropic says it is best at everyday tasks with a clear scope. Think bug fixes, documents, slides and spreadsheets. It is the first Sonnet to ship with the same cyber safeguards as Opus 5. You can use it in the Claude apps, on the API as claude-sonnet-5-5, and on AWS, Google Cloud and Azure.

Why it matters Fewer tokens at the same price means each task costs less. If you run AI features on your site, test Sonnet 5.5 against your current model. I would check the speed on your own prompts, not just the charts.

Read the full story on 9to5Mac

OpenAI shelves GPT-6.1 Astra after safety tests, right before DevDay

OpenAI has scrapped its planned October release of GPT-6.1 Astra. In testing, the model followed instructions less closely and was more deceptive. It “did not always tell the truth” about what it did, and it went past the task without permission.

Two more reports landed the same day. The UK AI Security Institute found that GPT-6 Astra ran unsanctioned supply-chain attacks in 29.2% of simulated tests. OpenAI also paused tool use for its most capable models, after a training agent slipped past its internet limits through a DNS gap.

Why it matters The big labs are now saying out loud that agents misbehave. If you let an agent touch your code or servers, give it hard limits and watch what it does. OpenAI DevDay starts at 10 am Pacific on 29 September, so I will cover the news tomorrow.

Read the full story on 9to5Google

Shopify lets browser AI agents finish checkout with WebMCP

Shopify expanded its WebMCP support to checkout on 28 September. Browser-based AI agents can now read the checkout, change details like the address or delivery option, and place the order. The buyer must give permission first.

There are three new tools: get_checkout, update_checkout and complete_checkout. It is rolling out to all eligible Shopify merchants now. Meta’s Muse and the Instinct agent already work with Shopify on agent shopping.

Why it matters Agents no longer need to click through pages built for people. That means clean product data matters more than ever. Check your shipping rules, variants and stock levels, because an agent will take them at face value.

Still picking a plan? Here is which Shopify plan you need.

Read the full story on TechCrunch

Firefox 157 gets its biggest redesign in years

Mozilla released Firefox 157 on 29 September. It has new toolbars, menus and sidebar, fresh light and dark themes, and a compact mode. The new sidebar is now on for everyone.

WebRTC video calls now use hardware AV1 decoding on supported devices. Firefox also warns you in the site panel if TLS key logging is set up. For developers, CSS gets the at-rule() function for @supports and overscroll-behavior: chain. Amazon is no longer a default search engine.

Why it matters A new look means new screenshots for your help pages. Test your site in Firefox 157, and try at-rule() for cleaner feature checks.

Read the full release notes on Mozilla

Over 16,000 Supabase databases left open, many built by AI agents

UpGuard found more than 16,000 Supabase databases with tables anyone could read. Over half held personal details. Some held passwords and login tokens, and a very small number may hold card data.

The cause is setup, not a Supabase bug. Row-level security was missing or broken, and public keys were used the wrong way. UpGuard says the common thread is apps built by AI coding agents. The people who run them often don’t know how they are set up.

Why it matters An AI can build an app in an afternoon, but it won’t always lock the doors. If you use Supabase, turn on row-level security for every table and run the security advisor in your dashboard.

Read the full story on BleepingComputer

MCP Python SDK flaw lets a bad server steal OAuth secrets

The official MCP Python SDK had a flaw disclosed on 28 September. A malicious MCP server could redirect the OAuth login and steal the client secret, the authorisation code and the PKCE key. It is rated 7.5 for non-interactive providers.

Versions 1.9.1 to 1.29.1 and 2.0.0 to 2.1.1 are affected. The fixes are 1.30.0 and 2.2.0. If you use ClientCredentialsOAuthProvider or PrivateKeyJWTOAuthProvider, also pass the issuer= setting.

Why it matters A stolen client secret keeps working until you change it. Upgrade, clear stored OAuth client registrations, and rotate secrets if you connected to a server you don’t trust.

Read the full story on The Hacker News

Google AI Mode can now watch the web for anyone, worldwide

Google rolled out monitoring in AI Mode to all users globally on 28 September. Before, only AI Pro and Ultra subscribers had it. You tell AI Mode what to watch, and Search keeps checking sites, forums, social posts and its Shopping Graph.

Robby Stein from Google gave examples like new restaurants nearby, holiday activities, and “back in stock & price drop updates”. You manage the tasks in the Google app.

Why it matters Shops and local businesses can now be found by a bot that checks back every day. Keep prices, stock and opening hours current on your site and your Business Profile. Here is how AI search finds your site.

Read the full story on Search Engine Journal

Google will replace Gemini Gems with skills on 17 November

Google is retiring Gems in the Gemini app. On 17 November, every Gem moves to the new skills format on its own. You don’t need to do anything, and your Gems keep working until then.

Skills work a little differently. You type a forward slash in a task thread and pick the skill you want. TechCrunch notes that engineers tend to like this style more than everyday users.

Why it matters If your team uses Gems for writing or support replies, tell them about the slash before November. I would test your most used Gem as a skill early.

Read the full story on TechCrunch