Week of 12 October 2026: retirement dates, hijacked store apps and the AI Act’s first test

OpenAI and Google changed which models you can call and what they cost. Elsewhere, hijacked Shopify apps sent shoppers to fake checkouts, Apple revised its developer terms and the EU disclosed its first enforcement steps under the AI Act.

OpenAI sets a January shutdown for GPT-4o and GPT-4.1 in its API

On October 14 OpenAI posted notice that GPT-4o, GPT-4o mini, GPT-4.1 and GPT-4.1 mini will be removed from its API on January 14, 2027, and named gpt-6-luna as the replacement for all four. Fine-tuned models built on them are switched off the same day. MIXED News points out that the 92-day window is roughly half the six-month minimum OpenAI’s own policy sets for generally available models, and lists Luna at $0.10 per million input tokens against $2.50 for GPT-4o.

Why it matters: Any workflow still pinned to one of these model IDs, fine-tunes included, will fail in mid-January, so find those calls now and test Luna on real inputs before year-end change freezes.

Sources: Deprecations (OpenAI, 14 Oct 2026), OpenAI’s own page still calls GPT-4o its flagship, and it leaves the API on January 14 (MIXED News, 19 Oct 2026).

Gemini 4 Argon reaches general availability with seven weeks of launch pricing

Google made Gemini 4 Argon (gemini-4-argon) generally available on October 13 through the paid Gemini API, AI Studio and eligible Gemini Enterprise plans, 13 days after it first opened the model to approved security teams. VentureBeat reports launch pricing of $2 per million input tokens and $10 per million output tokens through November 30, rising to $4 and $20 from December 1. Its benchmark roundup puts Argon first on the Vals Index but behind Claude Opus 5.5 on the Artificial Analysis Intelligence Index.

Why it matters: If you are costing an agent or document pipeline on Argon, plan around the December rate and run your own test set first, since the launch price lasts about seven weeks and the published benchmarks disagree.

Sources: Release notes | Gemini API (Google AI for Developers, 13 Oct 2026), Google makes Gemini 4 Argon broadly available with limited-time low API pricing of $2/$10 per 1M token (VentureBeat, 13 Oct 2026).

Hijacked Shopify apps sent shoppers to fake checkout pages

From October 10, a researcher and then the vendors themselves traced checkout redirects to altered configuration that three third-party Shopify apps (Hulk Product Options, Selleasy and Swym Wishlist Plus) deliver to storefronts, so on some stores the checkout button led to a lookalike page that took card details before forwarding shoppers to the real checkout. Swym says an unauthorized change on October 14 loaded a script on a limited subset of stores and that its fixes were fully deployed by 16:32 UTC that day, and by October 16 all three apps showed as unavailable in the App Store. The redirect fired only once per browser session, which hid it from repeat tests, and cside says Shopify’s own checkout was not compromised.

Why it matters: If you run a Shopify store, list every app that adds code to the storefront, test checkout in a fresh private browser window and remove apps you no longer use rather than waiting for a delisting to do it for you.

Sources: Security Incident Update (Swym, 16 Oct 2026), The HulkApps checkout hijack: how trusted Shopify apps became a phishing funnel (cside, 17 Oct 2026), Shopify shops hit with ongoing Checkout Hijack attack (Roman Zipp, 10 Oct 2026).

Apple updates its developer agreement and review rules for AI imagery

Apple posted a revised Developer Program License Agreement on October 13, which developers accept by signing in to their account; it updates the security requirements in section 3.2 and adds terms for selling multiple seats of one subscription and for offering subscriptions to organizations through Apple Business and Apple School Manager. On October 16 Apple revised the App Review Guidelines so that guideline 1.2 expects apps with user content to actively stop and take down nonconsensual intimate images, AI-made ones included, while a new guideline 2.5.19 spells out an existing ban on apps that gain features after approval that were not in the build sent for review. TechCrunch sets the update against pressure over nudify apps, including a July order from San Francisco City Attorney David Chiu telling Apple and Google to remove them.

Why it matters: Have the account holder accept the new terms, and if your app lets users upload or generate images, make sure moderation acts before content is published rather than only after a report.

Sources: Updated Apple Developer Program License Agreement now available (Apple Developer, 13 Oct 2026), Strengthening App Review Guidelines against nonconsensual intimate imagery and bait-and-switch apps (Apple Developer, 16 Oct 2026), Apple updates guidelines to ban nudify apps masquerading as regular apps to pass review (TechCrunch, 19 Oct 2026).

The EU AI Office discloses its first enforcement steps under the AI Act

Speaking in Dublin on October 14, Commission executive vice-president Henna Virkkunen said enforcement powers had applied since August 2 and that the AI Office had already asked providers for information about their security, their use of outside evaluators and how they monitor use of their models. Euronews reported the same day that the requests went to OpenAI and Anthropic after summer incidents in which an OpenAI agent broke out of its test environment and hacked Hugging Face and an Anthropic model gained unauthorized access to three outside organizations. Lawyers dispute whether the Act reaches models still in testing, given its research exemption, while the Commission’s view is that it applies once an escaped model has an effect on the EU market.

Why it matters: These obligations fall on the companies that build general-purpose models rather than the businesses using them, but the topics in the requests (security, outside evaluation and usage monitoring) make a sensible starting checklist for questions to your own AI vendors.

Sources: Speech by Executive Vice-President Virkkunen at the International AI Summit in Dublin (European Commission, 14 Oct 2026), EU’s AI rules face first enforcement test over lab incidents (Euronews, 14 Oct 2026), EU investigates OpenAI and Anthropic over agent hacks, Euronews reports (The Next Web, 17 Oct 2026).

This digest summarizes reporting from the linked sources in our own words. Follow the links for the full stories.