Daily · AI Infrastructure Costs and Security Risks · October 29, 2026

Key points

Hyperscaler Earnings: Capex vs. Cash Flow

Alphabet's third-quarter results revealed a widening gap between AI infrastructure spending and cash generation. The company reported negative free cash flow of $9.07 billion, compared to analyst expectations of $2.70 billion. This marks the second consecutive quarter of negative free cash flow, following a $5.86 billion deficit in the prior quarter. Long-term debt surged 479% year-on-year to $125.1 billion, driven by $51.36 billion in capital expenditures for the quarter.

Revenue of $127.58 billion missed the $128.22 billion estimate, with search revenue growing 12% to $63.35 billion, below the $64.96 billion forecast. Chief Business Officer Philipp Schindler attributed the deceleration in search growth to increased usage of AI Mode, which currently has lower monetization than traditional search. Despite the miss, Google Cloud revenue more than doubled to $30.71 billion, with a backlog of $561 billion. Shares fell 13% in early trading, marking the company's worst post-earnings reaction since its 2004 IPO.

Microsoft reported contrasting results, with Azure revenue growing 48% to $33.17 billion. However, Microsoft's capital expenditures of $45.2 billion fell below the $50.67 billion analyst estimate, leading to a 27% decline in free cash flow to $18.63 billion. The company reduced its full-year capex forecast to $170 billion from $175 billion. These results triggered a drop in neocloud stocks like CoreWeave and Nebius, as investors questioned the sustainability of AI infrastructure spending.

The divergence between Alphabet's debt-fueled expansion and Microsoft's more conservative approach highlights the growing cost-of-capital risk in the AI sector. With combined 2026 capex projections for major tech firms exceeding $700 billion, the market is increasingly sensitive to any signal of slowing returns or rising leverage.

Open-Weight Models and Coding Agents

Mistral released open weights for its Large 4 model, a 1.05-trillion-parameter system with 52 billion active parameters. The model scores 26 on the Artificial Analysis Intelligence Index v5, making it the highest-scoring open-weight model developed outside China. Crucially, the release includes a 63% reduction in cost per task compared to the October preview, dropping from $5.54 to $2.06. API rates are set at $0.70 per million input tokens and $2.10 for output.

The model demonstrates strong performance in coding and cybersecurity tasks. On Terminal-Bench 4.0, it improved by 13 percentage points to 41%, leading among open-weight models. It also achieved a 96.6% refusal rate on malicious cyber prompts. The license is a modified MIT with a commercial restriction requiring a separate license for model-as-a-service providers. Mistral stated that the model was trained on 3,800 Nvidia Grace Blackwell GPUs in European data centers.

Simultaneously, GitHub unveiled Copilot Fusion, a model-orchestration engine that routes requests across multiple AI models. Independent benchmarks show Fusion Max achieves near-frontier coding performance at roughly half the per-task cost of single-model configurations. It scored 60 on the Coding Agent Index v2.0, close to Claude Code's 62, while using approximately 51% less cost per task. This development offers enterprises a new option for optimizing AI development budgets and vendor selection.

Critical Firmware and Software Vulnerabilities

A critical vulnerability, CVE-2026-97631, was disclosed in TianoCore EDK II's PXE-Base Code driver. The 16-year-old buffer overflow allows an attacker with local network access to execute code in ring 0 before Secure Boot and TPM defenses load. With a severity rating of 9.5 out of 10, the flaw affects most server vendors using EDK2 with PXE functionality, which is enabled by default. The exploit code became publicly available after a botched coordinated disclosure, increasing urgency for infrastructure teams to deploy BIOS/UEFI updates.

In a related incident, Alpine Linux rebuilt its GitLab instance from scratch after an attacker attempted to exploit CVE-2026-97229, a CVSS 10.0 vulnerability in GitLab's regex evaluation. The attack crashed GitLab worker processes eight times. Alpine discovered that upgrading GitLab alone was insufficient because the fix required a patch to Ruby, which was not included in their custom build. The company reset all passwords and replaced secret keys, verifying that no packages were tampered with during the incident.

Additionally, a researcher published a proof-of-concept for a zero-click remote denial-of-service vulnerability in Android's WAP Push SMS handling. A single malformed message can crash the telephony system, dropping active calls including emergency ones. Repeated messages can corrupt the SQLite database, persistently bricking telephony until a factory reset is performed. Google classified the issue as non-security across three tickets, highlighting potential gaps in vulnerability triage for remote, zero-interaction exploits.

National Cyber Emergencies and Data Leaks

Japan declared a 'state of emergency in cyberspace' on October 9 following a ransomware attack on IDC Frontier, SoftBank's cloud subsidiary. The attack took down systems at 495 companies and local governments. The declaration came after more than 20 major Japanese companies disclosed cyberattacks in the preceding weeks. This event serves as a concrete warning for organizations dependent on shared cloud infrastructure in the region.

In the US, the Department of Homeland Security (DHS) confirmed a data breach exposing details of over 41,000 employees and contractors across seven component agencies. The leak, published by the hacker group 'Department of Peace,' included names, contact information, and references to undercover operations. DHS stated it was aware of the potential breach, while Okta, the identity provider, denied any compromise of its systems. This marks the third major US government data leak in a month.

The Australian Signals Directorate (ASD) released its 2026 cyber threat assessment, warning that frontier AI models have 'redefined' the threat landscape. The report noted over 4,400 notifications to Australian organizations about malicious activity, an increase of almost 80% from 2025. ASD Director General Abigail Bradshaw stated that AI is enabling attacks at greater speed and scale, prompting new early-warning protocols with frontier AI companies.

Regulatory and Infrastructure Developments

The Bank of England launched a consultation on central counterparties accepting tokenized forms of eligible collateral. The proposed Supervisory Statement aims to provide clarity on how the Bank would assess applications involving tokenized assets, provided they meet standards for valuation, transfer, and realization in stressed conditions. The consultation closes on February 12, 2027.

The European Commission published a joint communication describing the Pan-Arctic Cable project, a flagship EU plan for the first subsea Internet cable directly connecting Europe to Greenland. The project could extend to Canada, Japan, and South Korea, bypassing the United States and Red Sea routes. This move aims to diversify Europe's critical digital infrastructure and enhance data sovereignty.

In financial markets, the ECB confirmed that Europe will move to T+1 securities settlement on October 11, 2027. Changes to the T2S night-time settlement process are planned for June 2027. The Eurosystem also plans to extend Pontes operating hours significantly by mid-2027 and achieve 24/7/365 availability in 2028, supporting the growth of tokenized finance.

Our read

The dominant theme this week is the financial and security strain of the AI infrastructure buildout. Alphabet's negative free cash flow and soaring debt signal that the cost of maintaining AI leadership is becoming a material risk factor for investors and lenders. This is compounded by the market's reaction to below-expected capex from Microsoft, suggesting a potential slowdown in the aggressive spending cycle.

Simultaneously, the security landscape is deteriorating. The disclosure of a pre-boot firmware vulnerability and the Japanese cyber emergency highlight that the physical and foundational layers of digital infrastructure are increasingly exposed. For decision-makers, this means that AI strategy must now be balanced against a heightened risk of operational disruption and data compromise. The shift toward open-weight models like Mistral's Large 4 offers a potential mitigation by allowing enterprises to control their own AI stack, reducing dependency on opaque third-party services.

This material was produced automatically by a large-language-model system from the public sources listed below; it is AI-generated content and may contain inaccuracies — verify facts against the original sources.

Sources