Mistral ships Large 4's weights at half the price, and a tampered Claude Code extension hits Cursor

The week on the beat

1. Mistral released the weights for Large 4 and cut its API price about in half, to $0.70/$2.10 per million

It was $1.36/$4.18 when we last reported it on October 22, and cached input is now $0.07. Mistral says it's the best open model for agentic coding, and its model card cites 48% on Artificial Analysis's Coding Agent Index. The general index is less flattering: Large 4 scores 26 on v5.0.1, against 32 for GLM-5.3 and 46 for Kimi K3.1 Pro, though one index task costs $2.06 against their $5.01 and $3.68. The license is a modified MIT that allows internal use and products built on the model, but you need a separate deal with Mistral if you sell hosted access to it. The card's serving examples assume a node of 8 GPUs.

Read the story →

2. A tampered Claude Code extension sat on Cursor's marketplace for about 11 hours on October 29

Cursor names versions 2.1.312 and 2.1.313 for Windows and macOS, and up to 5,000 developers were exposed. It sent host details and environment variable names to the attacker, tried to add an SSH key and open a reverse tunnel, and set up persistence. Cursor says the tunnel usually failed without admin rights, and Anthropic says its own channels weren't affected. Nobody has said how the attacker got publishing access. If you use Cursor, check authorized_keys for svc-telemetry. Uninstalling may not clean it, so if you had those versions, run the scripts in Cursor's notice and rotate your credentials.

Read the story →

3. DeepSeek open-sourced dsh-superagent, an MIT-licensed coding agent that works GitHub issues in parallel

You mention it in an issue or comment, a router session turns the request into a ticket, and each ticket gets its own worker session that posts the result back, for example as a pull request. In DeepSeek's own simulation, p95 task completion fell to 15.7 minutes from 29.5. The README calls it a research prototype and "not an official DeepSeek product". Its presets run with danger-full-access as your OS user, so give it a dedicated account if you try it.

Read the story →

4. Anthropic's revised IPO filing shows nearly $17 billion in Q3 revenue and a $23.3 billion net loss

Revenue is up twelvefold from a year earlier, but operating costs of $17.5 billion passed it and wiped out last quarter's profit. Compute and data center commitments reached $895 billion, and the filing says Anthropic does not expect revenue to keep growing at comparable rates. If you depend on Claude subscriptions, I wouldn't plan around today's limits lasting.

Read the story →

5. ChatGPT and Codex will share one token budget on Plus, Pro and Business from December

Harder models drain it faster, Instant chats don't count, and when it runs out you wait for a reset, upgrade or buy credits. OpenAI hasn't published the token amounts, and the coverage doesn't mention API pricing. If your team runs Codex on subscription seats, track usage before December and work out what the same work would cost on the API.

Read the story →

6. OpenAI released Images 2.6, adding GIF and SVG output to the API

There are two models, gpt-image-2.6-sunburst for detailed work and gpt-image-2.6-flare for fast iteration, both at $5 text input, $8 image input and $30 image output per 1M tokens, the same rates as 2.5 Sunburst. It also adds a complexity setting and markup-guided edits. OpenAI's docs list only the Images endpoints for now and mark the Responses API as unsupported. ChatGPT gets GIFs from a prompt or photo.

Read the story →

Model moves

• Price cut: Mistral Large 4. $0.70/$2.10 per 1M with $0.07 cached input, down from $1.36/$4.18, with a 1M context. Mistral's docs show no sale wording this time, unlike the October launch sale. Model page →
• Retiring: Mistral Large 3. Mistral's docs list deprecation on October 31 and retirement on April 30, 2027, with Large 4 as the replacement. Model page →
• New: Hy4 (Tencent). OpenRouter quotes $0.417/$1.25 per 1M with a 50% discount flagged, which makes the list price $0.834/$2.50, with a 1M context. Tencent says it joins the top tier of Chinese open-weight models, but when we checked, its Hugging Face page showed only the August preview weights (Apache 2.0). Model page →
• Weights out: Kimi K3.1 Pro (Moonshot). The weights we said were due in early November are now on Hugging Face under the Kimi K3.1 Pro License, at 2.8T parameters. Model page →
• Retiring: gpt-image-1.5, gpt-image-1-mini and chatgpt-image-latest (OpenAI). All three leave the API on December 1. Model page →
• Benchmark revision: Mistral Large 4. Epoch's reported SimpleQA Verified score moved from 20.0% to 22.4%. Model page →
• Third-party hosts: GLM-5.3 and Kimi K3. OpenRouter hosts are quoting input far below list. Wafer serves GLM-5.3 at $0.07 in and $1.40 out against a $1.40/$4.40 list, at 4-bit. Output is the catch on Kimi K3, where Wafer's $0.153 input comes with $22 output against Moonshot's $3/$15. These quotes move daily, so compare both sides for your own input-to-output mix and keep a fallback. Model page →
• Limits cut: Grok Bot (SpaceXSI). Musk says its cost was "unsustainably high relative to revenue". Users reported weekly limits suddenly maxing out, and the new limits haven't been shared. Read the story →
• No other vendor list-price changes we could confirm on a lab's own page this week.

Personal take

Flat-rate AI plans are starting to look temporary. OpenAI is pooling ChatGPT and Codex into one token budget. Musk says Grok Bot costs too much to serve. Anthropic's filing shows the size of the compute bill behind it all, even as per-token prices keep falling. So I'd stop asking which plan is the best deal and start measuring what each task costs you. I learned this the hard way this week. My host warned me I'd gone over my CPU limit. I guessed wrong about why, and the per-route numbers showed crawlers were using most of it. Now I measure first.

Until next Thursday, Anmol