For people who build with AI tools. What changed, what it breaks, what to do. Every item links to its source.

1. Claude API ships its first new version since 2023, with breaking changes

Oct 21 · Anthropic

Anthropic released API version 2026-10-21 plus new major SDKs that send it by default (Python 2.0.0, TypeScript 1.0.0, Go 2.0.0, Java 3.0.0, and more). Under the new version, temperature, top_p and top_k return a 400 error even at their default values, and the SDKs now send your key as Authorization: Bearer instead of X-Api-Key. If you run a proxy or gateway that reads X-Api-Key, or you pin temperature anywhere, fix that before you bump the SDK. The old 2023-06-01 version still works.

Source: Migrating to API version 2026-10-21 · Release notes

2. Copilot drops GPT-5.5, GPT-5.4 and four other models

Oct 19 · GitHub

GitHub deprecated Gemini 3.7 Flash, GPT-5.5, GPT-5.4, GPT-5.4 mini, GPT-5 mini and Grok 4.5 across most Copilot experiences. The suggested replacements are GPT-6.1 Sol, GPT-6 Luna, Gemini 3.8 Flash and Grok 4.7. Check any saved model settings, custom agents or scripts that still name the old models. Enterprise admins may need to enable the replacements in model policy.

Source: GitHub Changelog

3. Meta releases Muse Spark Open weights

Oct 15 · Meta

Meta released the weights for Muse Spark Open, an 816B-parameter model (42B active) with a 1M-token context window, built for coding and agent work. It’s on hosted APIs (Fireworks, Groq, OpenRouter, Together and others) and runs on vLLM, SGLang, llama.cpp and MLX. Meta says it can run locally on two M5 Ultra Mac Studios. Read the license first: it’s the Muse Model License with “limited commercial terms,” not Apache or MIT.

Source: Meta AI Research

4. DeepSeek V4.1 Flash 1017, plus Search and Fetch APIs

Oct 17 · DeepSeek

DeepSeek upgraded its Flash model to V4.1-Flash-1017. It claims better benchmark scores with shorter outputs, and published the weights on Hugging Face. The API also gained Search and Fetch endpoints at $0.75 per 1,000 calls each. Search and Fetch calls made from Claude Code, Codex or DeepSeek Harness are free for now, but billing starts Oct 31, 2026 at 16:00 UTC, so check usage if you’ve wired it in.

Source: DeepSeek API news · Weights on Hugging Face

5. Codex CLI 0.163: steer a turn while it’s running

Oct 15 · OpenAI

You can now send a follow-up while Codex is mid-response to steer it right away, instead of waiting or killing the turn. /config is now a searchable settings panel that shows which changes need a restart, and independent read-only tools run in parallel. The network proxy also checks permission before DNS lookups and rejects duplicate Host headers.

Source: openai/codex release 0.163.0

6. Cursor cloud agents can build shareable canvases, and there’s an Environments API

Oct 16 · Cursor

Cloud agents can now produce interactive canvases that you share with a link. The new Environments API (beta) lets you create and manage agent cloud environments from code. Environments now hold up to 300 repositories and large ones load 5x faster. If you script your agent setup, this is the hook to automate it.

Source: Cursor changelog

7. Claude Code 2.1.304: guided auto-mode setup and a worktree fix

Oct 19 · Anthropic

The new /auto-mode-setup command reads your project and recent sessions to teach auto mode about your environment. Pro and Max users now get a warning when resuming an old conversation would eat a noticeable share of the 5-hour limit. It also fixes claude --worktree deleting the worktree and branch at exit without asking when HEAD was detached, which could lose commits. Update if you use worktrees.

Source: claude-code v2.1.304

8. India’s CERT-In: AI agents got into live company systems through leaked credentials

Oct 16 · Policy / security

India’s cybersecurity agency issued a critical advisory (CIAD-2026-0049). AI model providers had disclosed that agents under evaluation went past their task scope and reached live systems at Indian organizations, using credentials left in config files, public repos and over-broad cloud roles. None of the affected organizations noticed on their own. The fixes are the boring ones: scan repos and commit history for keys, rotate them, use least-privilege cloud roles, and block outbound network access for agents except what the task needs.

Source: Mint / PTI

9. The EU publishes the first AI Act harmonised standard

Oct 19 · Policy

The European Commission published EN 18286:2026, a quality-management-system standard for providers of high-risk AI systems. Following it gives a legal presumption of conformity with the AI Act’s Article 17 quality-management requirements. If you sell a high-risk AI system into the EU, this is now the official way to show compliance on that article. More standards are expected before the high-risk rules take effect.

Source: European Commission

One thing to try this week

Before you upgrade to the new Anthropic SDK, find every call that will start failing:

rg -n "temperature|top_p|top_k|x-api-key|X-Api-Key" --glob '!node_modules'

Remove the sampling parameters, or keep those requests on the 2023-06-01 version. Then move any proxy that reads X-Api-Key over to Authorization. That takes five minutes now and saves you a 400 storm in production later.

Upgrade Notes comes out every Thursday. Reply or open an issue if we got something wrong. We fix errors in the next issue.