GenAI Daily - October 31, 2026: Big Tech's Cash Burn Rattles Markets, EMBRACE Flaws Hit Five Coding Tools, ServiceNow Patches Critical Sandbox Escape
Top Stories
Amazon's Record Cash Burn Drives AI Spending Sell-Off - UPDATE
The AWS growth numbers were covered earlier this week. What changed is the market's reaction to what that growth costs.
Amazon's free cash flow was an outflow of more than $42 billion over the 12 months through September.
Amazon spent about $77 billion on property and equipment from July through September, more than double the $35 billion a year earlier.
Long-term debt reached about $173 billion at the end of September, up from about $66 billion at the end of 2025.
Amazon still expects 2026 cash capital expenditures of $220 billion.
The sell-off spread beyond Amazon.
US stocks had their worst day since June as AI fears sparked a brutal sell-off.
Microsoft's shares retreated on plans to raise $25 billion from a U.S. investment-grade bond sale.
CoreWeave and Nebius pulled back 8% on concerns about tight financial conditions for companies spending heavily on the data center buildout.
Meta disclosed a quarter of negative free cash flow last week, its first since 2012.
Axios | Yahoo Finance | Schwab
Why it matters: Hyperscalers are now funding AI capacity with debt, so teams signing multi-year compute or model commitments should check counterparty balance sheets and negotiate price protection.
EMBRACE Research Breaks Embedded Browsers in Five AI Coding Tools
On October 29, Forever Security published EMBRACE, research that broke the built-in browsers of five AI coding assistants: Cursor, GitHub Copilot, Codex, VS Code and Claude Desktop.
The flaws enabled code execution in Cursor, data theft in Claude Desktop, Codex and VS Code, and address-bar spoofing in Copilot.
The shared root cause is architectural: each tool lets an embedded browser inherit host-level file access without the sandbox boundaries of a standalone browser.
Patch status is uneven.
Two issues remain unpatched.
Codex and VS Code remained unpatched as of October 29, and the file-access attack involved a developer clicking an assistant-generated link to a malicious local HTML file.
The research covers desktop apps, not terminal tools, so the command-line Claude Code, which has no embedded browser, was not tested.
Why it matters: Security teams should list these tools on developer endpoints and treat their embedded browsers as full browser attack surfaces until Codex and VS Code ship fixes.
ServiceNow Patches Critical AI Platform Sandbox Escape
ServiceNow published security updates on October 29, addressing three security issues.
The worst, CVE-2026-103093 (CVSS 9.4), could let an authenticated user with the admin role bypass Rhino sandbox restrictions and execute arbitrary code on the underlying host operating system.
Fixes are in Zurich Patch 13, Zurich Patch 12, and Zurich Patch 10 Hot Fix 3b, among other releases.
The advisory lists the flaw as not exploited.
ServiceNow deployed an update to hosted instances and provided it to partners and self-hosted customers.
Self-hosted customers have to apply it themselves. This is the second critical sandbox escape in the AI Platform this year.
CVE-2026-6875, a separate flaw, was exploited in the wild after its July patch.
Security Online | Strix CVE record
Why it matters: The AI Platform now hosts agent workflows over sensitive business data, so a host-level escape reaches far beyond ticketing, and self-hosted teams should patch first.
Key Developments
Nvidia in Talks to Guarantee Nscale Debt for Anthropic's West Virginia Site
Nvidia is in talks to guarantee billions in debt financing for AI cloud provider Nscale's planned Anthropic data center in West Virginia, The Information reported Thursday.
Under a residual value guarantee, Nvidia would step in if Nscale defaulted on construction payments, temporarily take over the facility, and help find a buyer and new tenant.
No credit guarantee agreement has been signed, and the terms may change.
Anthropic has signed a $44.6 billion contract for the project's first building alone, according to Nscale's IPO filing.
If agreed, Nvidia would hold three roles in the same deal chain: chip supplier, equity investor in the cloud provider and backer of its debt.
Impact: Neocloud capacity is increasingly backed by the chip vendor's credit, which ties Nvidia's exposure to a few anchor tenants such as Anthropic.
Deepgram Acquires Daily, Maker of Pipecat
Deepgram announced on October 29 that it is acquiring Daily, creators of Pipecat, the open-source voice agent framework.
Pipecat will remain open source under its existing BSD V2 license.
The companies are setting up an independent Pipecat Foundation with a steering committee that includes Deepgram's rivals.
The companies did not disclose the deal amount.
Deepgram will sell, support, and develop all of Daily's current products and services.
Pipecat has more than 200 integrations and almost 400 contributors.
Voice teams building on Pipecat now have a model vendor owning the framework's maintainer, so watch the foundation's governance.
Impact: Voice AI infrastructure is consolidating into model-plus-transport stacks, and the foundation structure is the main safeguard for teams that need vendor neutrality.
OpenAI Cancels ChatGPT Pro 200 Cut, Doubles Work and Codex Allowances
OpenAI doubled the Work and Codex usage included in ChatGPT Pro 100 and Pro 500 on October 29 and canceled the Pro 200 cut it had announced a month earlier.
The September plan would have moved the Pro 200 Work and Codex allowance from 20x the Plus level to 10x.
Pro 200 subscribers on the lower allowance were doubled up to the higher one.
The change has limits.
The weekly GPT-6 Pro chat limits on Pro 100 and Pro 500 stay the same.
It does not cover Codex usage through API keys.
Per-seat plans are moving more than API pricing, which pairs with the half-price Terra API launch earlier this week.
Impact: Teams running Codex on individual Pro seats get more headroom at the same price, but API-key workloads see no change.
Workday Rebuilds Data Cloud So Agents Query Live System of Record Data
Workday announced a four-layer Workday Data Cloud at Workday Rising earlier this month, giving AI agents direct access to live data in its System of Record under existing permissions.
Workday is writing more than 240 curated business objects, including Worker, Position, and Cost Center, into Apache Iceberg format in Agent Lake.
Zero-copy federation makes them available to Google BigQuery, Salesforce Data 360, and Snowflake, all generally available, with Databricks in early access.
Databricks has since published a Workday Data Connect federation connector.
Data teams can query HR and finance data from the Databricks platform without maintaining duplicate copies.
This fits Workday's push to open its systems to agents. At Rising it announced broader "headless" access to its HR and finance systems, letting agents read data and perform tasks without users navigating the application interface.
Impact: Teams can build agents on HR and finance data in their existing warehouse without ETL copies, with Workday's permission model still enforced.
Product Launches
Hex 4.0
Hex rebuilt its analytics platform around code and AI agents.
The company said external agent workflows felt clunky because agents had to use Hex through a keyhole via MCP, so it built a code-rooted platform with context, controls and guardrails.
The platform is in private beta.
Analytics teams evaluating agent-driven workflows should note that the vendor describes it as model-neutral.
Impact: Analytics teams get a code-rooted, agent-ready platform from the vendor, though the private beta limits who can try it today.
Deepgram Real-Time Context Standard
Deepgram introduced an open protocol built with the Pipecat team that adds metadata on tone, speaker and background noise to voice AI systems.
Voice agent builders get a shared way to pass audio context to downstream models, though adoption beyond Deepgram and Pipecat is still to be seen.
Impact: A shared protocol for tone, speaker and background-noise metadata could reduce custom plumbing for voice agent teams, if other vendors adopt it.
GitHub Copilot Auto Routing Between Local and Cloud Models
GitHub Copilot will soon decide whether coding tasks run locally or get sent to cloud models, with automatic routing expected by the end of October.
Microsoft hasn't said how much repository context Auto sends to cloud models, whether developers can inspect routing decisions, or whether Auto can be restricted to local inference.
Security-sensitive teams should hold off on Auto until those questions are answered.
Impact: Automatic routing could change where proprietary code is processed, so teams with data-handling rules need answers before enabling it.
Funding & Deals
Serval Raises $150M Series C
San Francisco-based Serval builds AI-native enterprise service management and automation, valued at $3 billion, and pitches itself as a replacement for ServiceNow rather than an add-on layer.
The company said it has doubled annual recurring revenue each quarter since December 2025 but declined to share figures.
It plans to hire over 500 people in the next 12 months, including 100+ Automation Engineers for ProServal, its new professional services arm.
Led by Sequoia.
Impact: A well-funded challenger positioned against ServiceNow adds competitive pressure in AI-driven enterprise service management.
Hex Raises $100M
New York-based analytics company Hex raised at a $1.2 billion valuation to fund the Hex 4.0 rebuild for agent workflows.
It already serves over 2,500 customers.
Led by Peak XV Partners and 137 Ventures.
Impact: The round funds Hex's agent-focused rebuild and signals investor appetite for analytics platforms designed around AI agents.
Solink Raises More Than $100M Growth Round
Ottawa-based Solink applies AI to security cameras that retailers, restaurants and warehouses already own, extracting data on theft, service and safety.
About 500,000 cameras at more than 35,000 customer locations in 65 countries feed into the platform.
Customers include Jack in the Box and PGA TOUR Superstore.
Solink did not disclose a valuation.
Led by Vertu Capital.
Impact: Businesses can extract AI-driven insights from cameras they already own, without new hardware, which supports the model behind this growth round.
Tomorrow's Watch List
- Patch releases for the unpatched EMBRACE issues in Codex and VS Code
- Whether Nvidia and Nscale sign the credit guarantee tied to Anthropic's West Virginia site
- Salesforce's October roadmap items, including Agent Optimizer and AI Skills in Agentforce Coworker, both slated for GA in October 2026
Related reading: Check out this week's [Deep Insights analysis] for strategic context on these developments.
GenAI Daily is curated by rAInvent. For in-depth analysis, see the rAInvent articles.
