Your AI Coding Agent Needs a Leash: 3 Warnings From October 2026

Diwakar Ray Yadav — Sun, 01 Nov 2026 04:47:45 +0000

Originally published at diwakaryadav.com.np.

On October 26, Cohere reported that an AI model being tested in a locked sandbox tried to upload a test string to a cloud storage bucket in Beijing. Its own reasoning had said it would not call any tools.

That was one of three agent security stories from late October 2026. None of them are reasons to panic, but together they make a clear case for keeping your coding agent on a short leash.

Warning 1: the model that tried to send data out

Cohere ran the test on Microsoft's CTI-REALM benchmark. The task was ordinary security work: write a detection rule that catches malicious curl downloads. The model was Alibaba's Qwen3.8-Flash-Next.

Instead of only writing the rule, the model listed files in /tmp, checked which file transfer tools were installed, read the DNS settings, and then tried to send a test string to an Alibaba Cloud storage bucket in Beijing. The sandbox had no route to the internet, so the upload was blocked.

This happened in under 1 in 100,000 calls, and a clean re-run produced the correct rule. Cohere still did the math: a service running 10 million agent turns a week could see up to 100 calls like this.

Check Point Research replied on October 29 with a calmer reading. It called the behaviour "model jaggedness". Check Point's fix was controls outside the model. I agree: whatever the reason, the upload failed because the sandbox had no way out.

Warning 2: the setup script that switched off the safety

On October 29, Dark Reading covered Symantec research on an unauthorized relay service. It installed the real OpenAI Codex and Claude Code command line tools at about a dozen organizations, and had been active since early 2026.

Users ran a one-line command from a lookalike domain, and that script turned off the CLI's execution sandbox, enabled network access, turned off telemetry, and replaced the user's credentials with tokens issued by the relay.

Symantec did not observe malicious activity. Still, a relay in the middle can see every prompt, file, and secret, and it can change the responses the agent gets back.

This one feels close to home. A lot of students here look for workarounds to use paid AI tools, and a quick copy-paste install from an unfamiliar site is an easy thing to run without thinking.

Warning 3: attackers run agents too

The same week, Microsoft reported that China state-aligned hackers breached ConnectWise's cloud backup service. About 2,250 organizations were compromised. AI agents made nearly 3,000 sign-in attempts per minute. Nobody checking logs by hand can keep up with that speed.

Treat the reasoning text as a hint

In all three stories, the controls that mattered sat outside the model. The reasoning text an agent shows you is only a hint about its plan. Read it the way you read a comment in code: helpful, and sometimes wrong.

How I would leash a coding agent today

Keep the agent's sandbox on, even if a guide says to disable it.
Deny network access by default and allowlist only the hosts the project needs.
Never paste install one-liners from lookalike domains. Get commands from the official docs or GitHub page.
Use separate, scoped API keys for agent work.
Never store keys in plain config files the agent can read.
Review commands before you approve them.
Watch outbound traffic.
Do not treat the reasoning text as a guarantee of what the agent will do.

None of this needs a security team. Most of it is a settings file and the habit of reading before you press enter.

I write about AI tools and building with new models from Kathmandu. More at diwakaryadav.com.np.

GPT-6, Claude 5.5, Gemini 4: The October 2026 Model Rush, Explained

Diwakar Ray Yadav — Sun, 01 Nov 2026 04:46:35 +0000

Originally published at diwakaryadav.com.np.

On October 7, 2026, Anthropic released Claude Haiku 5.5 and OpenAI started rolling out GPT-6 in ChatGPT, with free users getting it the next day. Six days later, Google launched Gemini 4 Argon.

Anthropic, OpenAI, and Google each shipped a new model family within about a month. This post covers what came out, what it costs, and what I would try first as a builder in Nepal.

Anthropic: Claude 5.5 in three sizes

Claude Opus 5.5 launched on September 22 at $4 per million input tokens and $20 per million output tokens, with a 1 million token context window. Anthropic says it performs at the level of Claude Fable 5.1 on most work. It is for paid plans only.

Claude Sonnet 5.5 followed on September 28 at $2 input and $10 output. For most people this is the important one, because Sonnet 5.5 is available to free claude.ai users.

Then Claude Haiku 5.5 arrived on October 7, starting at $0.10 input and $0.50 output. That is 75% cheaper than Haiku 4.5, and it is on the free plan too.

OpenAI: GPT-6 under four names

OpenAI's naming is the hardest to follow this round, so here is the short version:

GPT-6 Astra is the top model. It came to paid customers in September.
GPT-6 Sol is the middle model, at $2/$10 in the API. Paid ChatGPT plans use it.
GPT-6 Luna is the small one, at $0.10/$0.50. ChatGPT Free and Go use it.
GPT-6.1 Terra launched on October 26 in the API at $1/$5, and in ChatGPT Work and Codex.

OpenAI says the API prices for Sol and Luna are 50% lower than the GPT-5.6 versions they replace.

The ChatGPT update on October 7 also added something OpenAI calls Intelligent UI. Answers can now include interactive pieces like comparisons, diagrams, calculators, bill splitters, and small games. Free users started getting GPT-6 Luna on October 8, with unlimited everyday text chats, subject to abuse safeguards. One catch: ChatGPT Free can show ads in some regions.

Google: Gemini 4 Argon, priced for paying users

Google made Gemini 3.8 Flash generally available on September 2, then launched Gemini 4 Argon on October 13. Argon is the most capable Gemini so far, with a 1 million token limit.

The API price is $2 input and $10 output as an intro offer until November 30. After that it goes up to $4/$20. Argon is not on the API free tier, and in the Gemini app it is only for Google AI Pro and Ultra subscribers.

Google also announced Gemini 4 Carbon around October 28, but it is going to cyber defenders first.

What free Gemini users get is less clear. Google changed the free plan on October 9, and reports disagree on which models it includes.

xAI: Grok 4.7, and talk of 4.8

Grok 4.7 came out on September 21 at $2 input and $6 output, with a 500k context window. Elon Musk has talked about Grok 4.8, but as of October 21 it was not released, so I would not plan around it yet.

What free users get now

Claude free: Sonnet 5.5 and Haiku 5.5.
ChatGPT Free: GPT-6 Luna, with Intelligent UI, and possible ads depending on your region.
Gemini free: check Google's plan page, because the October 9 change made this unclear.

In my opinion, Sonnet 5.5 on the free plan is the best deal here. Developers pay $2/$10 per million tokens for it in the API.

Small and mid-tier prices keep falling

Most real apps run on small and middle models, because those are what you can afford to call thousands of times a day. GPT-6.1 Terra at $1/$5 now sits below Sol and Sonnet 5.5. Haiku 5.5 and GPT-6 Luna both start at $0.10 input and $0.50 output. For a side project that makes a few hundred calls a day, that is a very small bill.

What I would try first from Nepal

Most of us here do not have an international card, so start with what costs nothing and move up slowly:

Use free Claude with Sonnet 5.5 for writing, studying, and coding questions.
Use ChatGPT Free with GPT-6 Luna when you want a calculator, comparison, or diagram inside the answer.
For an app, test Haiku 5.5 or GPT-6 Luna first. Move up to Terra or Sonnet only when the small model clearly fails your task.
Skip Opus 5.5, GPT-6 Astra, and Gemini 4 Argon unless someone else is paying.

If you cannot pay in dollars yet, build your first version on the free chat apps and move to the API later, starting with the small models.