Dev & AI weekly — October 10, 2026

The most important story this week isn't a model — it's a piece of malware that turns your incident-response playbook against you. Revoking a stolen token is step one of every credential-leak runbook, and the latest Shai-Hulud variant is built to wipe your machine when you do it. Alongside that: the small-model price war hit its floor, and Mistral shipped a trillion-parameter "open" model whose licence just got less open. Here's what matters if you build.

Tensorlake: the worm that punishes you for revoking it

On October 8, the official TypeScript SDK for Tensorlake — tensorlake@0.5.144 on npm — shipped carrying a payload from the Shai-Hulud worm family, the same lineage behind the ChainDrop campaign we've tracked since August. The first rogue commit landed on October 7; a day later the repository's own release workflow published the malicious version, which meant it went out with a valid npm provenance attestation. The package does roughly 12,000 weekly downloads.

The payload harvests credentials, exfiltrates secrets, executes remotely supplied code, and — like ChainDrop — uses Ethereum as a fallback C2. Two features are new and both deserve attention. First, it writes persistence into the configuration files of AI coding tools, so it can survive being removed from node_modules. Second, it plants a "hostage token": if responders revoke the stolen GitHub token — exactly what standard playbooks say to do first — the malware wipes the victim's machine.

Why it matters: this inverts the first move of credential incident response. The order of operations now has to be isolate, then image, then revoke — take the machine off the network and capture it before you touch the stolen credential, or you destroy both the evidence and the developer's workstation. Two other lessons. Provenance attestations prove a package was built by the project's pipeline; they do not prove the pipeline wasn't compromised, so treat them as necessary rather than sufficient. And if your team uses AI coding agents, their config directories are now a persistence target — add them to whatever you check after a supply-chain incident.

Claude Haiku 5.5: the small-model floor is $0.10

Anthropic shipped Claude Haiku 5.5 on October 7, completing the 5.5 family after Opus and Sonnet. Pricing is $0.10 / M input and $0.50 / M output for prompts up to 100K tokens — roughly 75% below Haiku 4.5 on average, and an exact match for OpenAI's GPT-6 Luna. Above 100K tokens the rate steps up to $0.50 / $2.50. It keeps a 1M-token context and up to 128K output tokens.

The capability jump is large for the tier: on the offline subset of OSWorld 2.1, Haiku 5.5 hits 72.4% versus 15.7% for Haiku 4.5 — a small model doing computer-use work that the previous generation essentially couldn't.

Why it matters: two labs now price their small models identically at $0.10/$0.50, which looks a lot like a floor. For high-volume extraction, routing, classification, and summarisation, the cost question is effectively settled; the remaining decision is which one finishes your task in fewer tokens. Note the 100K-token step: it's the third long-context pricing cliff we've flagged in a month (GPT-6 Astra at 272K, Grok 4.7 at 200K). If your workload stuffs large documents into a small model, model the price above the threshold — that's where the 5× jump bites.

Mistral Large 4: a trillion parameters, a narrower licence

Mistral released Mistral Large 4 as a public preview on October 6 — a mixture-of-experts model with 1 trillion total parameters, 49B active per token, multimodal, with a 1M-token context. Open weights are promised by the end of the month, with October 27 reported as the date.

The catch is the licence. Mistral Large 3 shipped under Apache 2.0. Large 4 is reported to be coming under a custom Mistral licence, with terms not yet published. On capability, Mistral's own numbers are 61.7% on DeepSWE v1.1 and 59.9% on AutomationBench; the first independent composite, Artificial Analysis's Intelligence Index, puts the preview at 38 — behind GLM-5.3 (45) and Kimi K3 (44), ahead of DeepSeek V4 Pro (36). Mistral claims state of the art among open-weight models on SciCode-Verified.

Why it matters: this is the pattern we've been tracking since summer — "open weights" is a spectrum, and it's moving toward the restrictive end. MiniMax H3 shipped with a geography-excluding licence; GLM-5.3's weights slipped indefinitely; now Europe's flagship open lab is moving from Apache 2.0 to a custom licence. Until the terms are published, you cannot know whether Large 4 is usable for your commercial case. And on the independent index, it's not the strongest open model available anyway. If you were planning around it, wait for October 27 and read the licence before the benchmarks.

The through-line

The cheapest tier of AI got cheaper again, the most capable open model got more restrictive, and the most sophisticated attack of the week targeted the place every one of us runs code: an npm install in a CI pipeline, with a token in the environment. That last one is the one to act on. Not because supply-chain attacks are new — we've covered one nearly every month — but because this variant was designed by someone who read the incident-response playbooks and built a trap into step one.

What to watch next: whether other Shai-Hulud variants adopt the hostage-token pattern — and what Mistral's custom licence actually says when the Large 4 weights land on October 27.

Sources: The Hacker News — Tensorlake npm package compromised · Endor Labs — Tensorlake compromised by Shai-Hulud · Aikido — tensorlake package compromised · VentureBeat — Claude Haiku 5.5 matching GPT-6 Luna · MarkTechPost — Claude Haiku 5.5, 1M context at $0.10 · Mistral — Introducing Mistral Large 4 · Beam — Mistral Large 4 benchmarks & open weights · byteiota — Mistral Large 4 has a catch