Claude API ships its first new version since 2023 and drops sampling parameters, OpenAI models come to Google Cloud, IBM opens Granite Speech 5.0
Today's thread is platforms tightening the contract with the people who build on them: Anthropic's new API version removes sampling knobs and its user profiles let enforcement land on a single end customer, while OpenAI spreads to Google Cloud. In open models the gains come from specialization: speech, relational data, even the tokenizer.
On 2026-10-21, a request that sends temperature, top_p or top_k returns a 400, even at the default value. Claude 4.7 and later models already accept only the defaults and sample as before, but on models such as Claude Sonnet 4.6 a lowered temperature loses its effect, and nothing replaces it.
Document blocks placed directly in assistant messages, and text blocks with non-empty citations in user messages, also return a 400.
Python SDK 2.0.0, TypeScript SDK 1.0.0, Go SDK 2.0.0, Java SDK 3.0.0, ant CLI 2.0.0 and the other new versions send 2026-10-21 by default and are licensed under Apache 2.0 instead of MIT.
The new SDKs send the API key as Authorization: Bearer instead of X-Api-Key, so proxies and gateways that read or set X-Api-Key need to change. Requests that rely on non-default sampling can stay on 2023-06-01.
Builder's takeI'd pin the SDK major version first so an automatic dependency bump can't take production down, then grep every repo for temperature and X-Api-Key. AI Interview's scoring calls lowered temperature for consistency; those either stay on 2023-06-01 for now or move to a JSON Schema plus a scoring rubric, with a fixed question set to check the score distribution before switching.
On October 20 Anthropic launched the /v1/user_profiles endpoints for tagging which end customer each API request is for; the SDKs and the ant CLI support them.
On October 21 user profiles gained enforcement_status and enforcement_actions fields, and the list endpoint can filter on enforcement_status[] to find profiles with an open restriction or ban.
Organization webhooks in the Admin API (beta, webhooks-2026-10-07 header, access through your account team) fire when a profile is restricted or banned and when that ends.
Admins can also turn off web fetch for the whole organization on the Console's Capabilities page or set allowed and blocked domains; with it off, Messages API requests that include the tool fail with a 400.
Builder's takeA backend like PandaClaws, where one API account serves many creators, used to risk the whole organization over one user's violation. I'd map user IDs to profiles and attach one to every request, then wire up the webhook so a restriction automatically pauses that user's generation jobs and alerts ops. Read alongside the new Usage Policy taking effect November 12, enforcement is getting down to the individual user.
OpenAI and Google Cloud are bringing OpenAI's frontier models and Codex workflows to Gemini's Model Garden.
Customers get access through Google Cloud Marketplace.
Builder's takeTogether with AWS serving GPT-6 Sol and Luna in five Asia Pacific Regions since October 12, OpenAI can now be bought through two major clouds' bills. If your company has committed spend on Google Cloud, wait for pricing, regions and the feature list, then compare with the direct API, especially whether newer features like 12-hour caching show up there. Keep a model-provider abstraction so switching channels doesn't touch business code.
Patch the Planet connects security researchers, open source maintainers and incident responders to address critical vulnerabilities across open source.
OpenAI frames it as global response coordination for a period when agents are uncovering critical vulnerabilities.
Builder's takeExpect more, and more frequent, critical advisories for open source dependencies. I'd move dependency upgrades from "when there's time" to a fixed weekly window with Dependabot opening PRs, and pair it with the cooldown in GitHub's package firewall, in public preview since October 20, so you keep up with patches without being first to install a poisoned release.
New claude_code.safety_event fires for each tool call that a permission rule, auto mode, a safety check, a hook or the sandbox stopped, prompted or sent back.
New /claude-api api-version moves Claude API code to API version 2026-10-21.
Unparseable tool calls are retried up to twice before the turn ends with an error.
Fixed HTTP MCP tool calls being sent twice when the connection closed mid-call; only read-only or idempotent tools are now retried.
Builder's takeBuilding on the OpenTelemetry export that entered beta on October 14, I'd count safety_event by rule: a rule that prompts constantly is too tight, one that never fires may be doing nothing, which is the same point as my post on scaling agent autonomy with reversibility. If you run your own MCP server, like the one behind AI Interview, make write tools idempotent or mark them clearly instead of relying on the client to deduplicate.
In public preview: log in with gh auth login --expiring, or run gh config set expiring_credentials enabled to opt in for every sign-in.
gh stores an expiring access token alongside a rotating refresh token and refreshes it in the background; a leaked access token becomes unusable within hours instead of lasting indefinitely.
GitHub strongly recommends gh auth setup-git so gh serves the credential to git, and git 2.46 or newer so expiring credentials aren't cached past their lifetime.
It's opt-in today and planned as the default for new sign-ins in a future release; scripts and extensions that store the output of gh auth token for reuse will break.
Builder's takeOn dev machines and cloud sessions where agents run gh, I'd turn this on first; like the package firewall, it shrinks the blast radius of the credentials an agent holds. Before you do, search your scripts for places that write the output of gh auth token to a file or environment variable, and change them to fetch it each time.
WebMCP is an experimental browser standard proposed by Google that lets a page offer agents structured tools such as search_products; today it works behind Chrome flags, in Origin Trials and in some agentic browsers.
Commerce.com runs almost 100,000 domains on Cloudflare; Cloudflare's edge implementation, in beta since August, injects a script at the edge so the tools appear without merchants writing code.
Each merchant can opt out: an edge Configuration Rule checks custom hostname metadata and bypasses WebMCP for stores that flip the opt-out switch.
The tools run inside the shopper's browser session on the merchant's own domain, so no credentials go to a third party; the agent can search products, check details, build a cart and get a checkout link.
Builder's takeThe standard is still experimental, so there's no rush to ship, but it's worth listing the three to five actions agents most often do on your product, such as searching files in AI Cloud Drive or checking stats in PandaClaws, and exposing them as read-only tools first. Platforms can copy the approach here: on by default, with an opt-out per tenant. Today's pick axuse makes the same case from the other side: structured interfaces beat screenshots and clicks.
A pretrained relational foundation model: for a predictive query it gathers up to 10,000 historical examples as context and predicts in a single forward pass, with no task-specific training, feature engineering or flattening of tables.
Across 41 tasks on 15 databases it beats supervised relational deep learning models and expert-engineered gradient-boosted tree pipelines; on the SAP SALT enterprise benchmark it beats AutoGluon ensembles by 8% in MRR.
It scales to databases with 500B+ rows and runs through NVIDIA's open-source structured-data-models library or as a NIM; the library downloads the weights from the Hugging Face Hub on first use.
The code is under Apache 2.0 and the model weights under the OpenMDW License Agreement 1.1.
Builder's takeWhat small teams lack is the people to build a feature and training pipeline for every prediction task. For questions like subscription churn in AI Interview or storage growth in AI Cloud Drive, I'd run it on my own database as a baseline and compare it with rules or a simple model before investing more. The results are the vendor's own, so trust your data over them, and have someone read the weights license first.
granite-speech-5.0-2b transcribes English, French, German, Spanish, Portuguese and Japanese, translates between those and English, and also translates English to Italian and Mandarin; trained on 390,000 hours of public audio, it ranks #2 among open-weight models on the Open ASR Leaderboard at a 5.06% average English short-form WER.
It supports keyword lists of up to 2,000 terms, naming the input language in the prompt, and punctuation and capitalization on request, with support in Transformers, vLLM, llama.cpp and mlx-audio.
The 470M Turbo CTC now covers 7 languages with native punctuation, and its RTFx rose from about 12,600 to 19,870, roughly 1.6x faster.
granite-speech-4.1-2b-plus, for meetings and calls, is a drop-in replacement: long-form WER falls from 13.53 to 10.22, biased-keyword WER with 20-term lists from 11.79 to 6.48, and average timestamp shift from 210.86 to 98.54.
Builder's takeNote that it doesn't transcribe Chinese; Mandarin is only a translation target from English, so Chinese interviews still need another option. For English mock interviews it's worth a try: put the role's technical terms in the keyword list to catch the words that get mangled most, like Kubernetes or gRPC, and use 4.1-2b-plus when you need speaker-split recordings. Run your own recordings through it and Mistral's Voxtral 3 from October 20 before choosing.
The Portuguese essay grader is built on Qwen3-4B and scored a 151,669-entry vocabulary at every generated token; VocabX rebuilt the vocabulary while keeping the same base model, data and training recipe.
On the same 500 requests on an RTX 5090 with vLLM, the average response fell from 350 to 101 tokens, cost fell 77.0%, and the bench score rose from 0.703 to 0.810.
The first version fused each grade with the surrounding JSON into one macro token: a 73.3% cost cut, but the bench score fell to 0.689; giving the grade its own token cost 2 extra tokens per response and came out better on both quality and cost.
The numbers come from a paper still under review and may change before publication.
Builder's takeAI Interview's scoring report is also fixed-format JSON, so the setup is nearly identical, but this only applies to self-hosted fine-tuned small models; if you call an API you can't change the vocabulary. The lesson worth keeping is the mistake: compress all you like, but don't fuse the value that carries the decision into the same token as the formatting, or you save cost and lose accuracy.
Researched and drafted with AI assistance; editorial standards and views set by Darius.