Skip to content

AI security this week: 5 changes (31 October 2026)

Five confirmed AI security items from the week to 31 October 2026. The action most tenants can take today: block device code flow, which Microsoft recommends after tracking North Korean actors' use of AI.

This is our weekly AI security roundup. It was due on Friday 30 October and is published a day late. Every item comes from a primary source read on 31 October 2026.

Already briefed

  1. Copilot Studio retires older models; agents are moved to replacements on 12 November 2026. Makers and Power Platform admins. Brief: Copilot Studio model retirement. Source: MC1506318.
  2. LiteLLM 1.107.0 supply-chain compromise stole credentials through Python startup hooks. Anyone running LiteLLM. Brief: LiteLLM 1.107.0 compromise.

New this week

Microsoft Threat Intelligence: North Korean actors' AI use, and "block device code flow"

Microsoft's 29 October post groups the actors it tracks by how far they have adopted AI. Microsoft names Onyx Sleet and Pearl Sleet as using "the open-source agentic AI penetration testing framework ARTEX", and Coral Sleet as trojanising private GitHub repositories. Its recommendations include: "Microsoft recommends blocking device code flow wherever possible", EDR in block mode, and zero-hour auto purge in Defender for Office 365.

Copilot Memory with work data: rollout to end of November 2026, Enhanced Personalization on by default

MC1492154: "expect to complete by end of November 2026 (previously late October)". Admins control it with enhancedPersonalizationSetting. MC1530959 (29 October) now states the default: the Enhanced Personalization control "is on by default and can be turned off for the entire tenant or for specific users through a Microsoft Entra group". Copilot Chat also starts showing which memories it used ("late October 2026").

  • Who acts: Copilot admins and the privacy or data protection lead.
  • Check: decide whether the tenant default stays on, and who may manage it (Global Administrators and People Administrators can). Pair it with the Copilot Memory retention item in our Data & compliance roundup.
  • Source: MC1492154 · MC1530959. Related: M365 Copilot Readiness Kit.

Claude Code 2.1.314: a new write guard and four guardrail fixes

The changelog adds permissions.blockWritesOutsideWorkingDirectories: "Write, Edit and NotebookEdit refuse paths outside the working directories in every permission mode". It also fixes sandbox protections not applying to a worktree entered by claude -p --resume or --continue, Bash hooks not running on commands started by the Monitor tool, and forceRemoteSettingsRefresh no longer applying once the stored copy had expired, which "let sessions start without policy when the server could not be reached". The changelog gives no release date.

  • Who acts: teams that rely on Claude Code hooks, the sandbox or managed settings as guardrails.
  • Check: claude --version on developer machines and CI runners shows 2.1.314 or later. Consider setting permissions.blockWritesOutsideWorkingDirectories: true in managed settings.
  • Source: Claude Code CHANGELOG. Related: M365 AI Agent Hardening Kit.

More: all AI security news · Microsoft 365 security deadlines.

Last reviewed: 31 October 2026. Runbook Lab is not affiliated with Microsoft or Anthropic.