Find the signal fast

Five AI targets fell at Pwn2Own Ireland 2026. No CVEs or bug details are public yet, so here is what ZDI confirmed and what to harden now.

Sonnet 5.5 cache reads fell from $0.20 to $0.10 per MTok on Oct 7. Break-even stays at 2 requests (5-min cache) or 3 (1-hour); each hit costs half as much.

A use-after-free in llama-server lets a remote client crash it with one POST /completion request. Builds b8227 to b11392 are affected; upgrade to b11393.

Ollama's unauthenticated /api/pull path traversal (CVE-2026-103663) can plant a binary that runs as root on restart in Docker. Fixed in 0.35.0.

Claude Max and Team now include monthly API credits: $100 on Max 5x, $200 on Max 20x, up to $500 for Team. Claude Code is excluded and credits expire monthly.

Haiku 5.5 costs $0.10/$0.50 per MTok vs $1/$5 on Haiku 4.5, but a tokenizer change and a 5x tier above 100K tokens decide your real bill.