Today's thread
Today's news points one way. AI is holding more of the keys to our mail, calendars and services and acting on its own, so a leaked key now does more damage. Anthropic's Claude Duet is an assistant that keeps working while you are away, and on the same day Railway told customers that the secrets they stored may have been exposed and should all be replaced.
On cost, MiniMax M3.1 Flash locked in low list prices, a sign that running automation keeps getting cheaper. In Korea, MyOrange won an R&D grant to build AI that produces social-impact reports. Tools are getting cheaper and broader, but people still have to decide what to hand over and how to manage the keys.
Claude Duet: a proactive AI assistant, previewed in the US
Anthropic released Claude Duet as a research preview on October 21. US Pro and Max subscribers join a waitlist to get access; Team and Enterprise plans are not included yet. There is no separate price, and use draws on your existing plan limits. It runs as an iOS and Android app and on the web.
Until now, chatbots answered only when asked. Duet is built as an agent, meaning an AI that takes a goal and carries out several steps on its own: it picks out what needs your attention in your inbox and calendar and drafts replies. It runs on its own cloud computer, so work continues after you close the app, and it messages you when it is done or needs a decision. It can use more than 6,000 connectors, plug-ins that link it to other services such as Gmail, Google Calendar, Slack and Microsoft 365.
If you spend time every day sorting mail and schedules, now is the moment to draw the line on what an assistant may do. Anthropic says Duet asks before sensitive actions such as sending messages or paying. A list of tasks you would delegate outright and tasks that must be confirmed will serve as your standard when similar tools reach your company.
Anthropic lists the limits itself: Duet may misread a thread, misjudge what is urgent, or miss items that arrive between check-ins. There is no official date for Korea.
Railway voids all API tokens after possible secrets exposure
App deployment platform Railway announced on October 21 that it had detected anomalous activity in systems that store customer environment variables. Environment variables are settings an app reads when it starts, such as passwords and API keys; think of them as a key ring kept in a safe outside the code. Railway recommended revoking and reissuing every stored variable, and on October 22 it invalidated all Railway API tokens. Tokens created before the incident stay invalid, so new ones are needed.
A security incident and an outage arrived together. During the response the dashboard, API and CLI went down and new builds, the step that packages code into a runnable app, stopped in every region, then returned in stages: Enterprise, Pro, Hobby, then Free. Per the status page, builds were back for all plans by the night of October 22 (UTC), but new signups stayed paused into the early hours of the 23rd. Over the same days Supabase also posted incidents for management API errors and project creation and restart problems.
Even if you do not code, a service built for you by a contractor may run on Railway. If the OpenAI, Anthropic, payment or database keys that app used were in scope, they must be revoked at the issuer, replaced, and the app redeployed. Railway also posted guidance to check Stripe, OpenAI, Anthropic, OpenRouter and similar accounts for unexpected usage.
What was actually taken, how many customers were affected and the root cause have not been disclosed. The status page says only that the preliminary incident report is delayed.
MiniMax M3.1 Flash: $0.15 per million input tokens
Chinese AI company MiniMax officially launched M3.1 Flash on October 19. Pricing is flat regardless of prompt length: $0.15 per million input tokens, $0.60 per million output tokens and $0.015 per million cached input tokens. Tokens are the small chunks an AI counts as it reads and writes text, and billing is based on that count.
The company says responses are nearly three times faster than its predecessor and overall usage cost on agent tasks is 70% lower. Right after launch, time-limited free trial versions appeared on OpenRouter, a broker that lets you use many companies' AI through one account, among others; the OpenRouter trial page no longer loads. Costs should now be calculated at list price.
In automation that repeats the same job thousands of times, such as sorting mail or summarizing documents, the model's unit price is the running cost. Recalculate what you used during the trial at list price, compare quality against your current model on the same work samples, then decide whether to switch.
MiniMax says only that model files will be released later, with no date. The 70% saving is the company's own measurement, so check whether your workload sees the same result.
MyOrange wins TIPS R&D for AI impact-report automation
Impact-data startup MyOrange was reported on October 22 to have been selected for the general-track R&D program of TIPS, run by Korea's Ministry of SMEs and Startups. The project totals 1.06 billion won, including 800 million won in government funding, over two years. TIPS adds government R&D money to startups that a private investor has already backed.
The goal is an automation platform where AI reads business documents and raw data, finds social-value indicators, verifies the evidence and produces reports in a set format. The company says it will draw on more than 4,300 framework designs built up in its existing service, Orange Impact. This work has typically taken months of outside consulting, from field data collection to the final report.
For people who own ESG or CSR reporting, the point is less that AI writes the report and more that evidence checking is part of the same flow. Split your current manual work into gathering data, choosing indicators, checking evidence and writing, and it becomes clear where AI can take over first.
R&D is just starting, so launch timing and pricing have not been announced.
Try this today
If you have a service on Railway, including one built by a contractor, ask the owner three things today: were all stored keys reissued at their source, was a new Railway API token created, and was the app redeployed after the change?
Open the usage graphs for the last three days in the admin consoles of AI services such as OpenAI and Anthropic. If any day spikes above normal, revoke that key first.
Write two columns: what an AI assistant may do on its own and what it must confirm with you. One line each is enough, for example drafting replies is fine but sending needs approval, proposing meetings is fine but external invites need approval.
If you tried the MiniMax M3.1 Flash trial, multiply the tokens you used by the list price to estimate a month's cost. Put it next to your current model's cost and you will see right away whether switching is worth it.