Grok Bot can now find X Spaces and manage your X Lists

Grok BotWhat's new#

Update, Oct 21, 3:05 PM ET: If you run PHP sites, upgrade to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35, the patched releases CISA lists for two flaws it says "allow for unauthenticated remote code execution in PHP." At 12:35 PM ET @OpenAI posted that it "packaged a Codex skill to help check," which reads the PHP version a site advertises. OpenAI says "frontier AI found these vulnerabilities before attackers did"; Huntress says details leaked online Oct 20, and CISA says it had not observed exploitation as of its alert. The entry has the install steps and each source's timeline. (OpenAI; confirmed)

Update, Oct 21, 3:05 PM ET: If you build on the Claude API, read the migration guide before you bump your SDK. Anthropic released API version 2026-10-21 on Wednesday with new major versions of every official SDK, such as Python 2.0.0 and TypeScript 1.0.0, that send it by default. The migration guide says a request that sends temperature, top_p or top_k now "returns a 400 error, even at the parameter's default value." The new SDKs send keys as Authorization: Bearer, Bedrock gets the new version only on Claude 4.7 and later, and the SDKs move from MIT to Apache 2.0 (what breaks and how to upgrade). (Anthropic; confirmed)

Update, Oct 21, 3:05 PM ET: Claude Code 2.1.304 to 2.1.306 add a warning on Pro and Max before resuming an idle conversation would use "a noticeable share of your 5-hour usage limit," and /auto-mode-setup now runs on Bedrock, Vertex, Foundry and gateways. If you use a cloud provider or gateway, skip 2.1.304: the CHANGELOG says 2.1.305 fixed "a 2.1.304 regression" that could make every request fail. When we checked npm at 2:45 PM ET, stable still pointed to 2.1.304 (details). (Anthropic; confirmed)

Update, Oct 21, 3:05 PM ET: On Claude Enterprise, Claude Security now runs a deep baseline scan, then rescans code as it changes and marks findings fixed when the fix lands. It adds a knowledge base, an editable threat model, an API, webhooks and an MCP connector. It's a public beta. The Help Center offers "Up to $25,000 in promotional credits for Claude Security usage in each of two consecutive months," and the offer ends Dec 31 (setup and limits). (Anthropic; confirmed)

Update, Oct 21, 3:05 PM ET: Anthropic's free OSS Scanner has accepted 114 of about 650 open source projects that applied in its first 11 days, its product manager Punit Shah posted. It has reported "77 critical and 803 high model-rated findings," and every report now arrives encrypted after early emails bounced. An early version found the curl use-after-free fixed in 8.23.0, so check any bundled curl from 8.12.0 through 8.22.0 (how to enroll). (Anthropic; confirmed, staff)

Update, Oct 21, 2:45 PM ET: Brett Adcock, Hark's founder, says one Hark day can use up to a fifth of your monthly usage. He replied to a Pro² subscriber who ran out: "Daily is not 1/30th of the monthly. We allow you to use up to 1/5th of the monthly each day in case you have days with high workloads". Our math: to last a 30-day month, average about 17% of the daily bar. After users asked for one simple limit, Adcock wrote: "Good points here, we're going to re-look at it" (how to pace your usage). We also added How people are using it and more digest items below. (Hark; reported, founder's claim)

There was no Oct 20 issue because our desk was down.

Grok Bot can now find X Spaces and manage your X Lists (Grok Bot; confirmed, staff)#

Paul Vann, whose X bio reads "@spacexsi & @x api," posted at 7:26 PM ET Tuesday: "we heard you, and launched @X spaces & lists in @bot!" Ask your Bot for live Spaces on a topic, or to build a private List and add accounts. In his demo video the Bot also reports what the reads cost in X credits. No changelog line or help page yet, and we haven't tried it.

Bots missing after the X Subscription switch: don't reset or pay again (Grok Bot; confirmed, staff; tracked)#

Seven forum users say their Bots disappeared after moving to The X Subscription. Cursor staff member mohitjain said at 4:48 AM ET: "your Bots aren't gone." The switch can leave Bots on one account and the plan on another. His first step: "fully sign out of Grok Bot everywhere (the app and grok.com), then sign back in using the same method you used when you created the Bots." If that fails, "send a note to support@x.ai with the email on your account." Don't reset, delete or "buy a second subscription."

Grok BotHow people are using it#

• SpaceXSI's support team clears incident tickets in batches (Grok Bot). This is the company's own claim about its own team. The official @bot account posted at 4:42 PM ET Tuesday: "We use Grok Bot to spot incidents in our support queue and quickly respond to every associated ticket." It added: "In one incident, it cleared 204 tickets in about 10 minutes, with one engineer approving the batch." Text from the image in the post: a Bot called IncidentWatch "Detects the incident," IncidentSweep "Drafts the replies based on the batches," a "Person on the Support team" "Reviews the batch," and a Support Bot "Sends the replies." (reported, company about its own team)
• Emoji reactions as quick commands (Grok Bot). Cursor staff member Colin said at 7:58 AM ET Monday: "When you react to one of your bot's messages, the bot gets notified with the emoji and the message, so it can act on it." His suggested setup, in the same post: tell any one Bot something like "Remember for all my bots: ⏰ on your message means remind me tomorrow at 9 AM, 📌 means save it for later." and ask it to save that to your shared memory. "Custom emoji, a pinned favorites row and hover labels that show what each reaction does aren't available yet." (staff tip)
• Have a reply read aloud (Grok Bot). There's no listen button on each message yet. Cursor staff member deanrie said at 2:05 PM ET Monday that you can ask the Bot after it replies, "read that to me as a voice note", "and it will send audio that you can pause and speed up." On the go, deanrie suggests Voice Mode instead. (staff tip)

Grok BotThe digest#

Grok Bot#

• Two support addresses for X Subscription switch problems. For Bots with no included usage, kevinn pointed to hi@cursor.com on Oct 19; for missing Bots, mohitjain pointed to support@x.ai today. Staff haven't said they're interchangeable, so use the one given for your symptom (details). (confirmed, staff)
• Rumor: Grok Bot 0.72 and 0.72.1 are reaching some users. Jonah Anthony, whose X bio reads "Grok Bot Expert!", replied at 10:26 AM ET Tuesday: "Yup just got update 0.72!!" A forum user wrote at 2:22 AM ET today: "On one of my own PCs the app has now updated to 0.72.1". The changelog still ends at v0.71.2 (dated Oct 14) as of 2:45 PM ET today, and no staff member has said what's in it. (rumor, two user reports, no release notes)
• "Couldn't load the credit balance": don't buy credits. Colin said at 12:28 PM ET the error is "due to a temporary issue on our side while reading billing data" and "Please don't buy credits just to get past that screen." Cursor's status page logged a billing dashboards incident for cursor.com and Grok Bot at 11:46 AM ET, said a fix was in at 11:56 AM ET, and marked it resolved at 1:40 PM ET. Colin added at 1:15 PM ET: "If Grok Bot still asks for credits after you restart the app, reply here and we'll take another look." Separately, a "prepaid balance is used up" prompt while weekly usage shows 10% "looks like a separate problem we're already tracking," he said. (confirmed, staff and status page; resolved)
• Routines stop when weekly usage runs out. For one user, Colin said the routine runs that stopped Oct 20 (around 12:00 to 12:30 PM ET) "line up with the weekly included usage being fully used at that point, with no credits to fall back on." He added: "Routines stop like that when usage runs out." Our read: if a routine matters, check your weekly usage before it's due. (confirmed, staff; one user's account)
• A personal Bot in Slack only answers you. Colin said: "A personal Bot connected to Slack only answers its owner." A Team Bot answers teammates who have linked their Slack account, and "each reply uses the Grok Bot usage of the person it's answering, not the owner's." The Team Bots help page says the same: "A Team Bot reply uses the Grok Bot usage of the person it's answering." Letting people without a Cursor seat use a shared Bot in Slack is "a request the team is already tracking," Colin said. (confirmed, staff)
• One question card at a time. Colin said at 11:47 AM ET: "A bot keeps one open question at a time, so once you answer a newer card (or send a message in the chat), any older card that is still unanswered is closed and shown greyed out." It can happen when a routine or another Bot wakes it while the first card waits. To answer a greyed-out card, type your answer in the chat (his example: "Yes, send it"). (confirmed, staff)
• Every Shell command hanging? Check the startup files. For one user whose Bots all stalled, Colin said at 1:46 AM ET: "Every Shell command first starts a login shell, and that runs the computer's shell startup files." If one of those files waits on something, "every command hangs exactly like this." He asked the user to "hold off on another Reset or Update, since a Reset restores the same files." One of the user's own Bots suspects a line another Bot added to .bashrc to start a Telegram relay whenever a terminal opens. As of the user's last post at 12:08 PM ET, it isn't resolved. Our read: don't let a Bot add startup lines to ~/.bashrc to keep a program running. (confirmed, staff explanation; one user's report, unresolved)

OpenAI#

• 12-hour prompt caching in the API. In the Responses API you can now keep a prefix cached for at least 12 hours instead of 30 minutes. A 12-hour write costs 2.5× ordinary input, against 1.25× for 30 minutes, and reads cost the same either way, per OpenAI's docs. Worth it when the same context comes back hours apart. (confirmed) read
• ChatGPT can lock chats behind a PIN. Locked chats leave your history and regular search and open with a 4-digit PIN or, on supported phones, Face ID, Touch ID or device unlock. Resetting a forgotten PIN deletes every locked chat for good. OpenAI's release notes and help article list different plans; the entry has both. (confirmed) read
• About 40,000 accounts got the wrong plan's usage limits; credits promised. OpenAI's Tibo Sottiaux, whose X bio reads "Codex & ChatGPT @OpenAI," posted at 1:10 PM ET Oct 20 that OpenAI found "approximately 40,000 accounts" where the usage applied "did not correspond to their actual selected plan." In the same post he said OpenAI "corrected the issue" and is "reaching out individually," adding: "If this affected you, we'll add credits to your account." He gave no amount and didn't name which products' limits were affected. (confirmed, staff)
• OpenAI models are coming to Google Cloud. OpenAI said Oct 21 its frontier models and Codex are coming to Google Cloud's Model Garden, bought through Google Cloud Marketplace, and customers "will be able to draw down their GCP commitments." It said "General availability is planned in the coming weeks," with a request-access form now, and added: "Microsoft remains OpenAI’s primary cloud partner." No models or prices were listed. (confirmed)
• Team Tasks for Enterprise workspaces. @OpenAIDevs posted at 11:24 AM ET Oct 20 that you can "automate recurring engineering work with team tasks in ChatGPT." Per OpenAI's docs, Enterprise admins grant the permissions, you create a team in Settings > Teams, then open Scheduled > + New Task and select the Team toggle. Tasks run on the team's service account and "use workspace credits." Gotcha from the docs: "New members can see all earlier runs and generated files." (confirmed)
• ChatGPT ads now run in 89 countries. OpenAI said Oct 21 it added 26 countries, including 14 more in Latin America, and that over 100,000 advertisers have run campaigns. Per OpenAI, "Ads will appear only on the Free and Go plans." The same day @OpenAIDevs posted, explaining its ad system: "ChatGPT’s answer doesn’t wait for ads." (confirmed)
• OpenAI publishes COBOL and Fortran coding evals. In an Oct 19 post, OpenAI said GPT-6.1 Sol scored 86.6% on its COBOL migration eval at low reasoning effort, against 5.4% for GPT-5.6 Sol, and 97.9% at higher effort. On its MultiLangBench, which builds a SQLite-compatible engine in 20 languages, GPT-6 Astra averaged 87.4%. These are OpenAI's own evals; it is releasing the MultiLangBench setup on GitHub. (confirmed, company evals)
• OpenAI acquires Orchestra Bio. OpenAI said Oct 20 it acquired Orchestra Bio, a platform where people and AI agents work together on drug programs, and will combine it with Rosalind, its life sciences models and tools. The post gives no terms. (confirmed)

Known issues on OpenAI's status page, Oct 19 to 21 (times ET):

• Oct 19, 9:31 to 10:14 AM: File Download errors in Responses, Images, Files, File uploads and Image Generation. Resolved.
• Oct 20, 10:26 to 11:28 PM: Degraded performance in ChatGPT, Codex and APIs, across 33 listed components including Codex Web, CLI, ChatGPT Work, Responses and Chat Completions. Mitigation applied 10:48 PM. Resolved.
• Oct 21, 11:34 AM to 12:44 PM: Elevated error rates for gpt-5.6-luna API requests (Chat Completions, Responses). Resolved.
• Oct 21, from 9:42 AM: Elevated FedRAMP API error rates for Astra and Sol. OpenAI applied a mitigation at 12:46 PM and is monitoring; it was not marked Resolved at our 2:50 PM check.

Cursor#

• Anthropic models degraded early today. Cursor's status page said at 6:37 AM ET: "We experienced service degradation affecting Anthropic models between 5:56 ET and 6:21 ET, which has since been resolved." That's 5:56 to 6:21 AM ET. (confirmed, status page; resolved)
• Bitbucket Cloud errors for Review Agents and Cloud Agents. The status page opened an incident at 1:40 PM ET for "an issue affecting Cursor's Bitbucket Cloud integration" and closed it at 1:53 PM ET: "Atlassian has reported the issue as resolved and they are continuing to monitor for service restoration." (confirmed, status page; resolved)

Hark#

• A week-long user review: good at bounded tasks, weak at sign-ins. Patrick Perez, whose X bio reads "AI consultant & tech writer. I test AI agents", posted a review at 10:00 AM ET Tuesday after "a full week of real errands." We found no tie to Hark. Hark bought Palm Springs Modernism Week tickets "for me and a buddy ($257)" and added them to his calendar. But "Amex, Intuit, Amazon, and CNN all failed" at sign-in. Asked to grade itself, Hark said "Sign-ins are my weakest spot." His full write-up is on Substack. (user report, independent review)
• Hark says a Panel takes about 2 minutes to build. Hark re-shared its existing Panels feature at 8:13 PM ET Tuesday, saying you can "build whatever you want in about 2 minutes," with examples like Strava "to build out your running plan" and Chase "for budget tracking." The 2 minutes is Hark's own claim. Its Using Hark page says you can "tap “Reply” on your Panels to redesign them." (company post)
• Android app updated Oct 20; one user reports startup crashes. Hark's Google Play listing shows an update on Oct 20 with no release notes. The iOS app is still on 2.4.0 from Oct 16. The night before the Android update, one user posted at 9:12 PM ET Monday that "Hark is crashing on every start up. Even after an update." Lara Lu, whose X bio reads "mobile @hark_labs", replied at 11:43 PM ET: "taking a look". Hark hasn't said whether the Oct 20 build changes this. (one user's report; staff reply)
• A hand-coded animation. Kelvin Goldbergh posted a short animation at 9:54 AM ET Tuesday in which "Every frame is drawn in JavaScript" and a mascot's legs "hit each note of Mozart's Turkish March". He wrote that it was "Made with Hark Pro by @hark_labs in just a few prompts." (user report)

Anthropic#

• API platforms can now tag requests by end customer. If you run a platform or gateway, or resell API access, you can register each end customer once and send their ID on every request, so a safety enforcement action can apply to one end customer instead of your whole organization. Anthropic launched user profiles on Tuesday; the docs say "Profiles aren't billable and don't affect pricing." The same day it added organization webhooks in beta, with access through your account team, that fire when a profile is restricted and when the restriction ends. It also moved inference hooks out of beta for Claude Enterprise (release notes). (confirmed)
• Reported: Anthropic's draft IPO filing shows $16.3 billion in first-half revenue. Fortune reports, citing The Wall Street Journal, which obtained a draft of Anthropic's S-1, that the company had $16.3 billion in revenue in the first half of 2026, up from $1.1 billion a year earlier, and a net loss of $80 billion, up from $13 billion. Fortune's summary of the Journal's report also puts first-half spending on computing capacity and infrastructure at $9 billion. Anthropic hasn't published a filing. (reported)
• Anthropic publishes its first annual Public Benefit Report. Anthropic posted a 20-page report on Wednesday that measures its progress against five charter pillars and closes with commentary from its Long-Term Benefit Trust. Daniela Amodei writes in the foreword: "This report, which we’ll publish annually, lays out how we define success against that charter and the concrete proof of our progress." Among its examples, Anthropic says cyberdefenders directed Claude to find more than 33,000 critical and high-severity flaws in widely used software. Anthropic said on Oct 18 that this report was coming (our Oct 18 story). (confirmed, Anthropic's own figures)
• Physicist Christopher Stubbs joins Anthropic's Long-Term Benefit Trust. Stubbs, an experimental physicist and former Dean of Science at Harvard, has joined the Trust. Anthropic says he has "written about how to keep AI-assisted research reproducible when models can give different answers to the same question," and has advised the US government on national security and arms control. (confirmed)
• Claude-designed scorpion-toxin binders: 17 of 211 met the bar, none tested in cells or animals. Anthropic's science team had an internal research model design small proteins that latch onto five scorpion neurotoxins. Two lab partners tested 211 designs for binding, and "17 met our criteria," Anthropic writes. It is releasing all 211 designs and their data. Anthropic says "we didn’t test any design for neutralization in vitro (against cells grown in the lab) or for efficacy in vivo (in living animals, such as mice)." (confirmed)
• Rumor: Claude Fable 5.5 is still unannounced. TestingCatalog reported on Oct 17 that "Claude Fable 5.5 has reportedly reached Anthropic's partners" and, citing leakers, that a release could come this week. TestingCatalog also wrote: "Anthropic hasn't confirmed anything." As of 2:46 PM ET Wednesday, Anthropic had announced no new model. (rumor)
• Update, Oct 21: --thinking disabled still doesn't turn off thinking for Haiku 5.5. The GitHub issue was still open at 2:46 PM ET with no reply from Anthropic. In its only comment, on Oct 17, the reporter wrote that it "Still reproduces on Claude Code 2.1.302," and that the flag now "turns the disable request into an enable." The CHANGELOG lists no fix through 2.1.306. One user's report; we haven't tested it (details). (reported, one user)