Today's flow
All three stories today ask the same question: where and how does the thing you handed over actually run? Tailscale, a remote-access tool, fixed flaws that let someone who already had access go beyond it, and Douzone Bizon, maker of the accounting program Smart A 10, disclosed that an outsider entered a development server with an employee account. Neither began with a broken door; both began with keys that had already been handed out.
AI models follow the same pattern. On the v5 leaderboard from independent evaluator Artificial Analysis, which changed how it scores, the top three were one point apart, yet the same Claude Opus 5.5 ranged from 35 to 58 points, and roughly tenfold in cost per task, depending on how deeply it was told to think. Which settings you use matters as much as which model you pick.
Tailscale 1.104.4 fixes four SSH and Serve flaws
On October 26 Tailscale posted four security bulletins, TS-2026-014 to 017, and fixed all of them in 1.104.4, released October 28. Tailscale links office and home computers over the internet like one office network; Tailscale SSH opens a command window on another computer in it. The most serious, TS-2026-014, applied when access rules allowed forwarding (opening a separate channel between two computers): a connected user could reach internal channels meant only for the administrator. TS-2026-015 let a single session keep inflating memory until the service stopped, and the other two came from Serve, the feature that exposes internal services to the network.
What we reported the day before yesterday was the stage where the flaws were made public before any fix existed. Tailscale has since confirmed on its investigation page that most are privilege escalation, meaning a user already allowed to connect could act beyond the permissions of their assigned account. As a stopgap before the fix, it advised adding TS_SSH_DISABLE_FORWARDING=1 to the tailscaled service settings and restarting, and said there is no need for everyone to turn off Tailscale SSH.
This applies if you run AI-built internal tools on an office computer or server and reach them from outside through Tailscale. The starting point is not a random outsider but a device or person already allowed in, so risk grows if freelance developers, former staff or shared laptops are still on the access list. Treat updating and pruning that list as one job.
The bulletins do not state the exact range of affected versions. Tailscale said it will publish a further advisory with confirmed flaws and affected versions, plus a technical write-up, but gave no date. Until then, the only test you need is whether you are on 1.104.4 or later.
Douzone Bizon warns of possible leaks from Smart A 10 and APO Backup
On October 18 Douzone Bizon announced signs of an intrusion on the development server for Smart A 10, its accounting and HR program. An unidentified person used an employee's VPN account (an account for a private channel into the company network from outside) to access internal systems and look up data. Possibly exposed items are names, the last six digits of resident registration numbers, account numbers, addresses, phone numbers and emails held by some customers; the ID digits and account numbers are encrypted, it said. On October 23 it added that some encrypted data seems to have left its APO Backup service via a flaw in a backup vendor's product.
In both notices the company said a leak is not confirmed, that it is warning in advance, and that it has not yet identified which customers or what data are involved. It said all backup data was encrypted and found no sign the encryption keys leaked. Korea's Ministry of Science and ICT judged it a serious incident on October 26 and formed a joint public-private investigation team, and the company was reported as saying more than 110,000 businesses use Smart A 10.
Small firms and tax and accounting offices keep payroll and HR records in cloud programs like this. Even if you are never breached yourself, a breach at the place you entrusted can expose your staff's data, and telling staff and preparing for impersonation attempts falls to the customer. Douzone Bizon urged people not to respond to anyone posing as the company or the intruder who demands money or asks them to open files or links.
The actual scope of the leak, the attacker and the exact time of intrusion are still under investigation. The company said its work platform WEHAGO was not affected but recommended turning on two-step verification as a precaution. It said it will notify affected customers and items once the investigation concludes.
Artificial Analysis v5: top three within one point
On October 27 independent evaluator Artificial Analysis moved its Intelligence Index, which combines many tests into one overall score for AI models, to v5. In the first release Claude Opus 5.5 scored 58, GPT-6 Astra 57 and GPT-6.1 Sol 55, all at the setting that makes the model think hardest. The next day Google's Gemini 4 Carbon took first place with 59, though it is still open only to selected users.
In v5 about 60% of the tests use unpublished questions or hidden answers. Models may have seen public test questions during training, so the change aims to measure skill on questions they have never seen. The index now weights knowledge work, coding, science and general tasks at 25% each, so scores should not be compared directly with earlier versions.
The more useful number for daily work is the gap between settings. Claude Opus 5.5 scored 58 at $10.04 per task when told to think hardest, and 35 at $0.98 when told to think least. This is the same menu as Claude's effort or ChatGPT's reasoning level, the choice of how long the model thinks, and choosing it to fit the job can move costs more than switching to the top-ranked model.
An overall score is not a ranking for every task. Carbon led 4 of the 9 tests, but in the evaluation of handing over coding work, Opus 5.5 used with Claude Code scored 62, above Carbon's 59. Carbon's cost per task, $7.76, was lower than Opus 5.5 at its top setting ($10.04) and higher than GPT-6 Astra at its top setting ($6.25).
Try today
On every computer running Tailscale, type tailscale version in a command window to check the version and upgrade to 1.104.4 or later. For servers you cannot upgrade right away, add TS_SSH_DISABLE_FORWARDING=1 to the tailscaled service settings and restart.
If your company uses Smart A 10 or APO Backup, check whether you received Douzone Bizon's individual notice and warn staff about impersonation texts and calls. Individuals in Korea can use the Financial Supervisory Service's identity-exposure accident prevention system, M-Safer to block phone lines opened in their name, and the account information integrated management service to see all accounts in their name at once.
Open your list of company VPN and remote-access accounts and remove former staff, contractors and unused devices. Both security incidents today started from accounts that had already been issued.
Pick one task you hand to AI often, run it with the same model at low, medium and high thinking settings, and note the quality, time taken and usage. The difference on your own work, not a one-point gap on a leaderboard, should guide your choice of model and setting.