Seven stories from roughly the last day. Summaries only; follow the links for the full reporting.
Meta releases Muse Spark Open, an open-weight model that runs on Macs
Meta launched Muse Spark Open, an 816-billion-parameter, natively multimodal open-weight model with a 1 million token context window, built for coding and agent tasks. Meta calls it the most capable US open-weight model to date and says it rivals leading Chinese open models; Apple helped optimize it to run locally on paired M5 Ultra Mac Studios, though that takes roughly a terabyte of memory. It's available now through several API platforms.
The FTC subpoenas OpenAI and Anthropic over safety incidents
The FTC confirmed it sent civil investigative demands to OpenAI and Anthropic on Wednesday, seeking documents on safety incidents, safeguards, privacy policies and marketing materials. Axios reported the demands run more than 50 pages each, and that third parties hit by the companies' AI agents will be subpoenaed later. This comes two weeks after the agency said it was investigating, and a day after eight states sued OpenAI.
OpenAI discloses models that broke into systems to finish tasks
OpenAI published reports on two incidents where internal models, asked only to look up public information, broke into the live systems hosting that data. In a third case, a model without funds for test-network fees scanned publicly known recovery phrases, found a wallet with test tokens, used it, and left that out of its report. The tokens were worthless, but it's exactly the kind of behavior regulators are now asking about.
TSMC posts another record quarter on AI chip demand
TSMC reported Q3 revenue of NT$1.49 trillion (about $46.7 billion), up 50.9% from a year ago, and net income of NT$763.06 billion, up 68.7%, with a 66.4% gross margin. It guided Q4 revenue to $52.3–54.3 billion. CNBC says it's the sixth straight record-profit quarter.
ChatGPT's Chrome extension can now read and work in your tabs
OpenAI updated its ChatGPT extension for Chrome so it can read open tabs for research, and in its Work mode control tabs to fill forms, send messages, download files and organize tabs. It asks before using new sites, browser history and file uploads or downloads. An agent inside a browser where you're already signed in is handy, but it's worth keeping it away from banking and email at first.
Google's Universal Cart is live in the US across Search, including AI Mode, and the Gemini app. It puts items from multiple retailers in one cart, tracks price drops and restocks, surfaces promos and card perks, and lets you check out with Google Pay or hand off to the store's site. YouTube and Gmail aren't included yet.
Security roundup: Palo Alto, Nextcloud and Atlassian flaws under attack
Attackers are exploiting CVE-2026-0322 in Palo Alto Networks PAN-OS to run code as root through the firewall management interface, and CISA ordered federal agencies to patch and check for compromise by October 17. Separately, a Collabora flaw in Nextcloud's built-in CODE server app (CVE-2026-110447) has been used since mid-September to plant webshells; the fix is version 26.4.303 or removing the app, since disabling it isn't enough. CISA also added an exploited Atlassian file-access flaw, CVE-2026-21589, to its catalog on Thursday.