All Articles
9 min

Claude Fable 5.2 vs Gemini 4 Carbon, Plus the Railway, React and Outlook Fixes

Most RecentTrendingAI

In this video I put Claude Fable, Gemini and ChatGPT on one question: can AI build a Call of Duty style game? The guide below covers the prices and security news from the same week. Facts checked on 12 November 2026.

Short answer: Claude Fable 5.2 (released 9 November) costs $8 per million input tokens and $40 per million output tokens, down from $10 and $50. Gemini 4 Carbon (released 10 November) is reported at $4 and $20 once its introductory pricing ends on 30 November. In the same 72 hours, Railway said stolen customer secrets paid for about $740,000 of AI usage, React disclosed a critical Server Components flaw (CVE-2026-126187), and Microsoft patched an Outlook bug attackers were already using (CVE-2026-124194). If you run React Server Components, Next.js, Railway or Outlook, you have something to patch or rotate this week.

How much do Claude Fable 5.2 and Gemini 4 Carbon cost?

ModelReleasedInput per 1M tokensOutput per 1M tokensWho can use it
Claude Fable 5.1Earlier in 2026$10$50Replaced by 5.2
Claude Fable 5.29 Nov 2026$8$40Everyone, through Anthropic, AWS, Google Cloud and Azure
Claude Mythos 5.29 Nov 2026Not publicNot publicLife Sciences and Cyber verification programs only
Gemini 4 Carbon10 Nov 2026$4 (reported)$20 (reported)Developers, enterprises and general users
PRICE PER 1 MILLION TOKENS (USD)AI got cheaper this weekinputoutputClaude Fable 5.1previous version$10$50Claude Fable 5.2released 9 Nov 2026$8$40Gemini 4 Carbonafter 30 Nov, per one report$4$20zubairhussain.xyzZubair Hussain · Nov 2026

Anthropic says Fable 5.2 answers up to 30% faster than 5.1 and that it solved two open problems in black hole physics. Both are company claims with no independent check published yet. Gemini 4 Carbon sits above Gemini 4 Argon, which Google released on 13 October. The Carbon price comes from one report, so confirm it on Google's pricing page before you budget against it.

What does the price cut mean for a real app?

Take a support chatbot with 10,000 conversations a month, each using about 2,000 input tokens and 500 output tokens. That is 20 million input and 5 million output tokens.

  • Claude Fable 5.1: 20 × $10 + 5 × $50 = $450 a month
  • Claude Fable 5.2: 20 × $8 + 5 × $40 = $360 a month
  • Gemini 4 Carbon: 20 × $4 + 5 × $20 = $180 a month
WORKED EXAMPLE · ONE CHATBOT, ONE MONTH10,000 chats a month2,000 input + 500 output tokens per chat = 20M input, 5M output$450/moFable 5.1$360/moFable 5.2$180/moGemini 4 Carbonzubairhussain.xyzZubair Hussain · Nov 2026

Per-token price is only half the bill. A model that needs fewer retries, shorter prompts or less output to finish a task can cost less per task even at a higher token price. Run your own prompts through both before you switch.

What happened at Railway, and what should you rotate?

Railway first told customers to rotate their secrets on 22 October. On 10 November it said attackers exploited infrastructure vulnerabilities, stole customer authentication secrets and used them for about $740,000 of fraudulent AI usage. Credentials for up to 100,000 workspaces may have been exposed. Railway says it found no evidence that customer Git repositories or databases were accessed. Builds came back for Pro and Enterprise first, and new signups are paused.

RAILWAY BREACH · UPDATE OF 10 NOVEMBER 2026The AI bill nobody orderedCLOUD USAGE RECEIPTAI usage$740,000Output tokens18.5 billion(at $40 per million)Workspaces at riskup to 100,000NOT ORDERED BY YOU22 Oct: Railway tells customersto rotate their secrets.10 Nov: attackers used stolenauth secrets for AI usage.No evidence that Git repos ordatabases were accessed.zubairhussain.xyzZubair Hussain · Nov 2026

For scale: at Fable 5.2's output price of $40 per million tokens, $740,000 buys 18.5 billion output tokens. Rotate in this order so your app stays up:

  1. Create a new key at the provider (Anthropic, Google, OpenAI, Stripe and so on).
  2. Replace the value in your Railway service variables.
  3. Redeploy and confirm requests succeed with the new key.
  4. Revoke the old key at the provider.
  5. Read the provider's usage log from 22 October onward and report any spend you don't recognise.

Was React hacked? CVE-2026-126187 explained

No. React disclosed and fixed a critical flaw. CVE-2026-126187 (GHSA-xqc2-xf4c-x3h3, published 10 November) allows unauthenticated remote code execution through React Server Components. It is rated 9.5 by one source and 10.0 by another, and no exploitation has been reported. The affected packages are react-server-dom-webpack, react-server-dom-turbopack and react-server-dom-parcel. Fixed versions are 19.0.9, 19.1.10, 19.2.9 and 19.3.1.

CVE-2026-126187 · GHSA-XQC2-XF4C-X3H3 · CRITICALReact Server Components: remote code executionAffected packagesreact-server-dom-webpackreact-server-dom-turbopackreact-server-dom-parcelNo login needed. CVSS 9.5 to 10.No known exploitation yet.Upgrade to19.0.xto19.0.919.1.xto19.1.1019.2.xto19.2.919.3.xto19.3.1Next.js 16.4.6 still bundles 19.3.0-canaryzubairhussain.xyzZubair Hussain · Nov 2026

Check your direct dependencies first:

npm ls react-server-dom-webpack react-server-dom-turbopack react-server-dom-parcel

If you use Next.js, that command can print nothing and you are still not in the clear. Next.js compiles its own copy of the React server runtime inside the next package, so the code never appears in your dependency tree and npm audit cannot see it. Read the bundled version directly:

grep -o "19\.[0-9]*\.[0-9]*-canary-[a-z0-9-]*" node_modules/next/dist/compiled/react/cjs/react.production.js | head -1

On 12 November, Next.js 16.4.5 and 16.4.6, the latest stable release, both bundle React 19.3.0-canary-278794d7-20261002. That build is from 2 October, before the fix, and Next.js has not published its own advisory for this CVE yet. The 16.5.0-canary.48 build from 11 November moves to a newer React canary, but I could not confirm it contains the fix, so I would not put a canary into production for this. Watch the Next.js security advisories and upgrade as soon as a stable release names CVE-2026-126187.

Separately, two npm packages with React-sounding names, read-react-app-in and read-react-app-out, were flagged as malware on 10 November. Before you install an unfamiliar package, check its age and owner:

npm view <package-name> time.created maintainers repository.url

Was Microsoft 365 breached? Outlook CVE-2026-124194 explained

No. Microsoft patched an Outlook spoofing bug that attackers were already exploiting. When someone opens a malicious message file, Outlook connects to an attacker-controlled server without the usual external-content warning and sends the user's NTLMv2 hash. It does not trigger from the Preview Pane. Affected products are Microsoft 365 Apps for Enterprise, Office LTSC 2021 and Office LTSC 2024. Microsoft first scored it 6.5 and later 7.0. CISA added it to its Known Exploited Vulnerabilities list with a 24 November deadline for US federal agencies. It was one of 1,094 fixes in the November update.

CVE-2026-124194 · EXPLOITED · PATCHED NOVEMBER 2026How one opened file leaks your login hash1Maliciousmessage file opened2Outlook connectswith no warning3Attacker servergets the request4NTLMv2 hashis leakedFix: install the November Office and Windows updates, then restart.Also block outbound SMB (TCP 445) to the internet. CISA deadline: 24 Nov.zubairhussain.xyzZubair Hussain · Nov 2026

Install the November Office and Windows updates and restart. Microsoft also recommends blocking outbound SMB to the internet. This PowerShell rule, run as administrator, blocks TCP 445 to internet addresses only, so file shares on your local network keep working:

New-NetFirewallRule -DisplayName "Block outbound SMB to internet" -Direction Outbound -Protocol TCP -RemotePort 445 -RemoteAddress Internet -Action Block

Why does one leaked key cost more in 2026?

A stolen API key used to expose data. Now it can also spend money on AI at machine speed, and the cheaper and more useful models get, the more a leaked key is worth to an attacker. This week my own booking calendar stopped loading times because one Google OAuth token had expired. Nobody attacked it, but one forgotten credential took a working feature offline.

THREAT MODELWhat one leaked API key unlocksYour dataYour AI billYour deploysYour clientszubairhussain.xyzZubair Hussain · Nov 2026

Set a hard spending limit wherever the provider offers one, for example a monthly limit on the Anthropic Console workspace that holds the key. A Google Cloud budget sends alerts when spend crosses a threshold; on its own it does not stop the spending.

The 20-minute checklist

20 MINUTES, TODAYThe security checklist for this weekCheck react-server-dom-*versions and upgradeRotate every Railway secret,AI provider keys firstSet a spending limit onevery AI API keyInstall the November Officeand Windows updatesRead new npm packagenames twiceWrite down where each secretlives and when it expireszubairhussain.xyzZubair Hussain · Nov 2026
  1. Upgrade react-server-dom-* to 19.0.9, 19.1.10, 19.2.9 or 19.3.1, and check the copy bundled inside Next.js.
  2. If you host on Railway, rotate every secret in the order above, AI provider keys first.
  3. Put a spending limit on every AI API key you own.
  4. Install the November Office and Windows updates and add the outbound SMB rule.
  5. Read new npm package names twice and check their age before installing.
  6. Scan your repository for committed secrets, for example with gitleaks git -v, and write down where each secret lives and when it expires.

Frequently asked questions

Is Next.js affected by CVE-2026-126187?

Next.js bundles React's server runtime, and as of 12 November the latest stable release, 16.4.6, ships a React 19.3.0 canary from before the fix. Next.js has not published an advisory yet, so treat App Router sites as exposed until a stable release names the CVE.

Which is cheaper, Claude Fable 5.2 or Gemini 4 Carbon?

Per token, Gemini 4 Carbon is reported at half the price: $4 and $20 per million tokens against $8 and $40 for Fable 5.2. Cost per finished task depends on how many tokens each model needs, so test both on your own prompts.

Do I need to do anything if I don't use Railway?

Yes. Every platform that stores API keys can leak them. Put spending limits on AI keys and keep a list of where each secret is stored.

Sources

Want to build something fast and secure?

I'm Zubair Hussain, a web developer, video editor and designer based in Hyderabad, Pakistan. I build Next.js websites, React Native apps and AI chatbots for clients worldwide, with security updates and spending limits set up from day one. See my web development services or book a free 30-minute call.

View original on Blogger