Friday, 23 October 2026

Google's privacy policy, effective October 16, 2026, still says Google does not show personalized ads based on your content from Drive, Gmail or Google Photos, but it now adds an exception: "unless you choose to make data from these services available to other Google services that support personalized ads" [1]. The same policy says services such as Search or Gemini Apps can be allowed to access Photos, Gmail and Drive, and that Search "may process some of the data that you allow Search to access to personalize content, including ads" [1].

The data path is Personal Intelligence in Search. If you connect Gmail, Google Calendar or Google Photos, AI Mode can use insights from them in its answers [2]. Google's help page now says ads will not be based directly on your inbox or Photos library, but that summaries, excerpts and inferences drawn from them may be used to show you ads [2]. Advertisers do not get access to your inbox or Photos, and ads are not personalized on sensitive categories such as race, religion, sexual orientation or health [2][3]. According to [5], Google said in March that AI Mode with connected apps would carry no ads for now, and it is now testing ads there.

You can disconnect apps or turn off Personalized Recommendations from the Search Services Personalization settings [3][4]. Disconnecting an app does not delete data already saved in Search Services History, Google says, and that data can still be used for product improvement, including training generative AI models [2]. Connecting apps is limited to users 18 and over [2].

OpenAI has made its Decisions API generally available [1]. It is built on GPT-6 Luna and answers questions with bounded answers: a developer defines a question and the allowed answers, passes text, images or JSON, and gets back a probability, a choice from a list, or a score on a rubric [1]. OpenAI says it returns decisions up to 10x faster than GPT-6 Luna through the Responses API [1]. It was announced at OpenAI's developer day on September 29 and reached all customers on Thursday, according to [2].

The company says that since the public beta it has added a native GPT-Live integration for voice apps, prompt caching, inference residency in the US and EU, JSON inputs, images in question instructions, and up to 400 questions per request, twice the previous limit [1]. The price is $0.10 per million input tokens and $0.01 per million cached input tokens, with no charge for output tokens [1]. Zero Data Retention is available to eligible customers [1].

The customer numbers are OpenAI's. It quotes Sierra at under 280 ms p95 and Speak cutting time to next action from 1.4s to 0.13s [1]. The model is not specially trained for decisions: OpenAI's API product lead told TechCrunch the team reconfigured Luna to run faster and cheaper [2]. The category is crowded. TechCrunch notes that TypeSafe's Jev made that startup a $7.6 billion company, and that on two public decision-model indices OpenAI's model ranks eighth and fourteenth, behind Jev [2]. Benchmarks differ by workload, so the useful test is your own data.

1Password has launched 1Password for Agents, a platform that lets personal AI agents sign in to accounts without seeing or storing the password [1]. When an agent reaches a sign-in form, it verifies itself to 1Password with a unique digital key [1]. You see which credential it wants and why, and approve the request on your own device; 1Password then fills the credential into the form instead of sending it to the agent [1][2].

The company names integrations with Meta's Muse, Anthropic's Claude Duet, OpenAI's ChatGPT Work and dots, Grok Bot and Town's Townie [1]. Other partners include Browserbase, Browser Use, Perplexity and Ramp [1]. Not every integration is live: Anthropic's product chief says in the release that 1Password will "soon" complete sign-ins for Claude Duet [1]. The release does not give a price or say which 1Password plans include it.

The reason is plain. 1Password says handing a password to an agent is a common shortcut, but a copy gets saved and sits where you can no longer control it [1][2]. TechCrunch reports that the launch came the same day Axios reported that US banks are detecting agent activity inside customer accounts and that most banks cannot tell whether a customer asked for it [2]. A Chase spokesperson told Axios that customers "should not give their usernames and passwords to anyone," according to [2].

For a small team, approval per sign-in adds a step to every login. Once signed in, the agent continues the task on its own, the company says, so the account's own permissions still matter [1].

Canva has released Canva Craft, the first image generation model built and trained from scratch by its research lab, Canva Research [1]. It is available to all Canva users from the Dream Lab panel and to developers through Canva's public API; access through the Canva MCP server is marked coming soon [1][3]. The developer announcement names a model value, craft_v1_2k, for the image-generation endpoint [3].

Craft works in two stages, the company says. A planning model first writes out the composition, including which elements appear, their positions, relative scale and any text, and a rendering model then draws the image at up to 2K resolution in more than 30 aspect ratios [1][2]. Prompts can be in any language, and Craft can render text in 55 languages [1]. Canva says that while most image models are trained mainly on photographs, Craft's training puts much more weight on design, and its training data includes millions of human-made templates from its library, such as posters, social posts, menus and infographics [1][2]. The structure is meant to make outputs easier to convert into editable layers with Magic Layers [1].

The rankings are Canva's claims, based on DesignArena: fourth among image models at debut, and first in the People & Portraits and Landscapes & Nature categories [1]. Canva says two cheaper variants, Craft-fast and Craft-ultrafast, are coming [1]. Canva has used several outside image models, and it says its own model also gives it better control of quality and speed, not only cost, according to [2]. Pricing for Craft is not public in these announcements.

Moonshot AI has released Kimi K3.1 Pro, a post-trained version of Kimi K3 with a 1-million-token context window, and a Highspeed variant it says runs 2-3x faster [1]. Both are available on Kimi.ai, Kimi Work, Kimi Code and the Kimi API, and the company says full model weights will be released by Nov 4 [1]. Kimi Enterprise administrators must switch it on; access is off by default [1].

On the API, kimi-k3.1-pro costs $2 per million input tokens and $10 per million output tokens, with cheaper cache hits; the Highspeed version costs $4 and $20 [2]. All K3 series models support a 1,048,576-token context window [2]. The same page says K2 series models will close to newly registered users from October 31, 2026, and that Moonshot plans to retire all K2 models by the end of December 2026 [2].

The benchmark claims are Moonshot's own. It reports 65.7% on Terminal-Bench 4.0, against 58.2% for GPT-6 Astra and 66.4% for Claude Opus 5.5, with K3.1 Pro run in the Claude Code harness [1]. On its internal hallucination stress test, the claim-level error rate fell from 23.4% for K3 to 8.3%, and Moonshot warns these are not everyday error rates [1].

Moonshot also describes removing cyber-related data from training for the open-weight release. On its internal cyber benchmark, xdev-bench-hard, a checkpoint without that removal solved 90.5% of problems and the final model 81.0%, and the company says its cyber capability remains behind frontier proprietary models [1]. Zero Data Retention is available to API customers [1].

Sweden's Government Offices, Regeringskansliet, are blocking ChatGPT and Claude, which from Monday can no longer be reached from staff work computers, according to Sveriges Radio's Ekot [1]. Staff are directed to approved services, including Microsoft's Copilot [1][2]. Ekot reports, from internal information, that the Government Offices also raised security in Copilot after a review; the press office would not give details, citing security [1].

Digitalisation director Mikael Wettercrantz declined an interview, but said in a comment on the internal intranet that using AI services without an agreement can have "consequences for our information security," according to [1]. Some staff will keep access to ChatGPT and Claude through a separate AI-assistant platform the Government Offices built themselves, the press office told Ekot [1]. The Government Offices had already restricted DeepSeek [1].

It is not the only Swedish agency doing this. Blocks are already in place at the Swedish Tax Agency, Skatteverket, and at the National Board of Institutional Care, Sis, and the Enforcement Authority, Kronofogden, is preparing a decision, according to [1][2]. Ekot also cites an internal audit at the Swedish Transport Administration, Trafikverket, which earlier this year found widespread and risky use of about ten different AI services, with problem examples that included the sensitivity of information typed into open AI services [1].

The stated concern is use without an agreement more than the models themselves: Copilot stays as the approved tool, and some staff keep ChatGPT and Claude through the in-house platform [1]. Neither report gives any finding against ChatGPT or Claude as products.

Microsoft AI has published results for MAI-DxO, its AI diagnostic system, in Science [1][2]. MAI-DxO runs several AI agents as a panel of virtual physicians: they propose diagnoses, choose which questions or tests to order, challenge each other, and weigh each test's value against its cost [1]. It was tested on a benchmark Microsoft built, SDBench, with 304 complex cases from The New England Journal of Medicine and more typical emergency-department cases from MIMIC-IV-ED [1].

On the complex cases, Microsoft says MAI-DxO was correct 83% of the time, against 36% for physicians using reference resources and 22% without them [1]. On emergency cases it reports 80% against 47% for physicians [1]. TechCrunch points out that the physicians were primary care doctors and general internists working alone, and that specialists and physician teams, who usually handle cases this hard, were not part of the comparison [2].

Much of the gain comes from the underlying models, according to [2]. GPT-5 alone with a basic prompt scored 78.9% on complex cases at about $8,400 per case, and DxO cut that cost by about $3,000 while adding about four points [2]. With GPT-5.5, DxO raised accuracy from 72% to nearly 87% on complex cases, but brought little on emergency cases, where both scored about 85% [2]. These were simulations run on published and recorded cases, not live patients [1][2]. Microsoft says a prospective study at Beth Israel Deaconess Medical Center in Boston will have patients interact with the system directly [1]. Neither source gives a release date for DxO as a product.

Anthropic says it used Claude, in a collaboration with Theorem, to write formal proofs that 239 fuzz-test entry points across 123 open-source libraries from Google's OSS-Fuzz never crash on any input up to 64 MB [1]. The proofs target the compiled RISC-V binaries rather than the source code, and they are checked by the Rocq proof assistant, so virtually none of the proof needs human review [1][2]. They run to about 180 million lines of Rocq [1].

The guarantee has stated limits. It assumes the program runs as a single-threaded static binary with a fixed memory budget on a RISC-V CPU under Linux, and it relies on the proof checker and Theorem's RISC-V and Linux models being correct [1]. Anthropic says this does not mean the libraries have no bugs [1].

The by-product is bugs. Claude patched what it found along the way, and the attempts surfaced hundreds of bugs, Anthropic says, including an out-of-bounds write that only appeared on inputs of around 20 MB, which a fuzzer would be unlikely to reach [1]. In a separate effort on a widely used PDF reader, it says it found as many security bugs in one week as are typically reported in a year [1].

Cost is the obstacle: proofs can take hundreds of millions of tokens [1]. Anthropic reports that Opus 5.5 proves half of 36 small verification tasks with about 40% fewer tokens than Opus 5 [1]. Theorem is offering the same pipeline free to qualifying open-source projects, with enrollment by pull request in the style of OSS-Fuzz, and only core maintainers can enroll a project [2].