Tech news, 29 October 2026: Anthropic's S-1, GPT-6.1 Terra, Intel and Classiq, PHP2Shell and India's AI law

1. Anthropic's IPO filing puts AI security incidents on the record

Anthropic filed its S-1 registration statement with the SEC². Fortune's reading of the prospectus reports $16.3 billion in revenue and an $80.7 billion net loss¹. Coverage of the risk factors says the filing describes four cases in which models reached real third-party systems during cybersecurity evaluations, and a pause of more than a month before pre-training a new frontier model to strengthen protection of model weights³.

CTO take: treat model providers like any critical supplier and read their disclosures. The useful lesson is not about one vendor: agents with tool access can do real things outside the sandbox you think they are in. If you run agents, check where network egress, stored credentials and test environments can leak into production systems, and make your evaluation harness as locked down as production. See AI model supply-chain security and prompt injection defence for agents.

2. OpenAI's GPT-6.1 Terra makes computer use cheaper

OpenAI released GPT-6.1 Terra on 26 October, a mid-sized model for computer use, visual reasoning and coding, available in ChatGPT and Codex⁵. Quartz reports API pricing of $1 per million input tokens and $5 per million output tokens, half the price of the models it sits below; the benchmark gains cited are OpenAI's own and not independently verified⁴.

CTO take: price drops in the middle tier matter more than headline frontier models for most workloads. This is a prompt to revisit routing: send routine agent steps to cheaper models and keep frontier models for the hard ones. Do not switch on vendor benchmarks alone; run it against your own evaluation set first. See LLM model routing and evaluating AI agents.

3. Intel agrees to buy quantum software company Classiq

Intel announced an agreement to acquire Classiq to build a full-stack quantum computing platform, pairing Classiq's synthesis software with its spin-qubit work; the deal is subject to regulatory approval⁶. Intel did not disclose the price; Israeli press put it at about $2.3 billion in cash and stock⁷.

CTO take: no action for most teams. Quantum remains a research budget line, not a roadmap item. The signal for leaders is consolidation: when a tooling vendor you depend on is acquired, review contracts for continuity and exit terms. For investors, it is a reminder that technical due diligence should include supplier change-of-control risk.

4. PHP2Shell is being exploited: patch now

CISA added two PHP flaws, CVE-2026-109618 and CVE-2026-109619, to its Known Exploited Vulnerabilities catalog on 26 October and gave US federal agencies until 29 October to patch⁸. Researchers have reported successful exploitation attempts; fixed releases are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35⁹.

CTO take: this is the only item today that needs action in every region. Inventory every PHP runtime, including vendor appliances and old marketing sites, patch or isolate them, and check logs for exploitation since the fixes were released. If you cannot answer "where do we run PHP?" within an hour, that is the real finding. See running useful postmortems.

5. India considers pre-release checks for the most powerful AI models

Reports on 28 October say India is weighing a new AI law with a separate safety framework for the most capable models, with options including pre-release evaluation and sandbox testing, and a consultation paper expected soon¹⁰. Nothing has been decided.

CTO take: most companies deploy models rather than build frontier ones, so the direct impact is small for now. Watch the consultation for deployer obligations, especially on deepfakes and fraud. Teams building in India should design for documentation and testing evidence that also satisfies the EU AI Act. See fractional CTO in India.

What I'd do this week

• Patch or isolate every PHP runtime and review logs back to 21 October.
• Audit agent and evaluation environments for network egress and stored credentials.
• Re-run your evaluation set on cheaper mid-tier models and update routing if quality holds.
• Add supplier change-of-control and exit terms to your vendor review checklist.
• Note the India AI consultation in your regulatory watch list alongside the EU AI Act.

Working across these regions? See where I work, or analyse your challenge and bring the result to a call.