Week of 19 October 2026: breaking API changes and a backup app breach

Anthropic issued its first new API version since 2023 and OpenAI made its typed-answer Decisions API available to all customers, while a trusted backup app became a route into Microsoft 365 tenants. Elsewhere, Salesforce agreed to buy Braze and Apple began selling app subscriptions to organizations by the seat.

Anthropic’s first new API version since 2023 drops sampling controls

On 21 October Anthropic published API version 2026-10-21 together with new major SDK releases, including Python 2.0.0 and TypeScript 1.0.0, which use that version by default and move from the MIT license to Apache 2.0. Requests on 2026-10-21 that set temperature, top_p or top_k are rejected with a 400 error even at default values, and the same applies to document blocks sent in assistant messages and to user text blocks that carry citations; separately, the updated SDKs put the API key in an Authorization: Bearer header rather than X-Api-Key. Integrations that stay on 2023-06-01 are unaffected because that version has not been deprecated.

Why it matters: Treat the SDK upgrade as a migration rather than a routine bump: remove sampling parameters and update any proxy or gateway that reads X-Api-Key before you move, or production calls can start failing.

Sources: Claude Platform release notes (Anthropic, 21 Oct 2026), Migrating to API version 2026-10-21 (Anthropic, 21 Oct 2026), Anthropic Removes Three Sampling Controls From Claude API Requests (TokenPost, 22 Oct 2026).

OpenAI’s Decisions API leaves beta for classification and routing work

OpenAI moved its Decisions API to general availability on 22 October after a public beta that opened on 6 October; the endpoint runs only on gpt-6-luna and replies with structured values rather than free text, such as the probability that a condition holds, one option from a list you provide or a position on an ordered rubric. This release raises the per-request limit from 200 questions to 400 and adds prompt cache discounts, images inside individual question instructions and JSON input through input_json, with uncached input priced at $0.10 per million tokens and no charge for output. Speak’s chief technology officer told TechCrunch that using the API brought the wait between actions down to 0.13 seconds from 1.4.

Why it matters: Classification steps such as ticket triage, lead scoring and approval routing that run through a full chat model today may be cheaper, faster and easier to test on a typed endpoint like this.

Sources: Changelog (OpenAI, 22 Oct 2026), Decisions (OpenAI, undated documentation), OpenAI makes its Jev competitor widely available as decision model competition heats up (TechCrunch, 22 Oct 2026).

Microsoft ties the ConnectWise backup breach to an agent-run attack on Microsoft 365

In a 21 October report, Microsoft attributed the compromise of the ConnectWise Cloud Backup app to Storm-0940, a group it describes as aligned with the Chinese state, and said the attackers used the stolen identities of several ConnectWise apps to reach customer tenants through permissions those apps already held, with no interactive user sign-in involved. The group ran the operation with ARTEX, an open-source penetration testing tool made up of multiple AI agents, and tried to get into more than 2,250 tenants; most attempts failed, but some reached privileged access less than three hours after targeting began. Microsoft said no vulnerability in its own products or systems was involved and advised admins to leave the ConnectWise apps disabled, look them up by application ID rather than display name and review activity from 15 October onward, taking service principal sign-in checks back to 1 October where records exist.

Why it matters: Every third-party app with consent to your Microsoft 365 tenant is a standing credential, so keep a list of granted apps and alert on new app credentials and role changes.

Sources: AI-driven, large-scale nation-state campaign using ARTEX enables supply chain compromise (Microsoft Security Blog, 21 Oct 2026), China-linked hackers used agentic AI in attack on 2,250 Microsoft 365 tenants (CSO Online, 22 Oct 2026).

Salesforce agrees to buy Braze for about $5.66 billion

Salesforce announced on 20 October a definitive agreement to buy the customer engagement platform Braze for $47.50 per share in cash, which puts the enterprise value near $5.66 billion. Salesforce expects Braze’s real-time engagement and AI decisioning tools to complement Marketing Cloud, Data 360 and Agentforce, and Braze chief executive Bill Magnuson says the business will carry on under the Braze name. Closing depends on Braze shareholder and regulatory approval and is targeted for Salesforce’s fiscal 2028, which PPC Land notes starts on 1 February 2027.

Why it matters: Nothing changes for Braze or Marketing Cloud customers until the deal closes, but anyone renewing either should keep contract terms short and integrations portable in case the products are merged.

Sources: Salesforce Signs Definitive Agreement to Acquire Braze (Salesforce, 20 Oct 2026), Salesforce to acquire Braze in $5.66bn deal (Financier Worldwide, 22 Oct 2026), Salesforce agrees to buy Braze for $5.66bn in cash (PPC Land, 21 Oct 2026).

Apple starts selling app subscriptions by the seat to businesses and schools

From 22 October, organizations enrolled in Apple Business or Apple School Manager can buy several seats of an auto-renewable subscription through one in-app purchase, hand them out with the device management tools they already run and change the seat count whenever they need to. The option is switched on by default in App Store Connect for any developer who had not touched the setting, although PPC Land reports that subscriptions created before 14 September 2026 begin opted out if the app lacks StoreKit 2 or the subscription uses Family Sharing. Consumer group purchases are due on the App Store this winter, and developers can test them in the sandbox from November.

Why it matters: If you sell an iOS subscription, check its purchase options in App Store Connect now, because organizations may already be able to buy seats at your standard price unless you set volume price bands.

Sources: Offer your subscriptions to businesses and schools (Apple Developer, 22 Oct 2026), Apple puts developers’ subscriptions on sale to schools and firms by default (PPC Land, 25 Oct 2026).

This digest summarizes reporting from the linked sources in our own words. Follow the links for the full stories.