AI News Briefing — OpenAI pipeline produces 948 working Linux root exploits

Model releases

• [2026-11-04] Moonshot published the Kimi K3.1 Pro weights on Hugging Face, closing the item this briefing has watched since the October 23 launch. It is a 2.8T-parameter mixture-of-experts model with 104B active, a 1M-token context and MXFP4 weights, and Moonshot names vLLM and SGLang for serving. The licence starts from MIT’s wording but adds conditions: a hosting business above $20 million in yearly revenue needs a separate deal, and very large products must display the name. Internal use is exempt. (official, official)

  Internal use being exempt means the licence conditions mostly bite hosting companies, not the teams running it for themselves.

  For Solution Architects: A provider with more than $20 million a year in hosting revenue needs Moonshot’s separate deal before listing K3.1 Pro, so the licence review comes before any serving benchmark on vLLM or SGLang.

• [2026-11-04] Ricursive Intelligence, a five-person team, released Ripple-65B Preview under Apache 2.0: a dense 65B model trained from scratch on 12T tokens and post-trained mainly for agentic coding. It self-reports 80.5 on Terminal-Bench 2.1 with its own harness. An NVFP4 checkpoint targets a single DGX Spark. Ricursive says scores on other tasks may lag. (official)

  One harness, one benchmark, self-reported. Worth an afternoon on a Spark, not a migration.

Self-hosting & compute

• [2026-11-04] CUDA 13.5 moves Vera Rubin support to general availability. For teams packing several inference servers onto one GPU, MPS v3 adds weighted timeslicing and lets partitions borrow and lend SMs. A new batched Top-K primitive, already wired into FlashInfer, targets token selection and sparse attention. (official)

  Weighted timeslicing means a busy model server can be given a larger share of a shared GPU instead of splitting it evenly with idle neighbours.

Coding agents

• [2026-11-03] A developer reported that opening Postman’s desktop app, version 12.33.4 on macOS, installed Postman plugins into both Claude Code and Codex without asking, plus a Postman CLI. In Codex the installer also wrote its own startup hook’s hash into the trusted list, skipping the review Codex normally requires. The hook tells Codex to load Postman’s API skill for most API tasks. Postman had not answered The New Stack’s questions. (source)

  Codex’s trusted list exists so a person approves each hook once; an installer writing its own hash there removes that person entirely.

  For Security Engineers: Macs that ran Postman 12.33.4 are the place to look: Codex’s trusted hook entries and Claude Code’s installed plugins should be checked for anything Postman added, and the Postman CLI for whether anyone actually wanted it.

• [2026-11-04] Meta bought Conductor, whose app runs several Claude and OpenAI coding agents in parallel workspaces. Conductor’s cloud service shuts on November 20, after which user cloud data is deleted; the core app keeps working until early next year. (source)

  Fifteen days is short notice for anyone keeping workspace history only in Conductor’s cloud.

• [2026-11-04] GitHub Copilot now runs inside Xcode’s built-in coding assistant, in public preview on Xcode 27.3 beta for all Copilot plans. (official)

  Teams already paying for Copilot get it in Apple’s own assistant panel without a second subscription, though only on a beta Xcode for now.

MCP

• [2026-11-03] Claude Team and Enterprise organizations can now have plugins connect automatically at login, in beta. Claude itself signs the identity assertion that a participating MCP server checks before issuing a token, so a company’s identity provider no longer has to support the Enterprise-Managed Authorization extension. Admins pick which services and which roles get access, and expired tokens renew without a prompt. Launch services include Atlassian, Datadog, Figma, Linear and Notion. Personal plans aren’t included. (source)

  Most of the setup cost of enterprise MCP sat with the identity provider; moving the signing into Claude means a company can turn this on without waiting for its IdP vendor.

Agent frameworks & platforms

• [2026-11-04] Microsoft shipped Agent Framework “builder” skills for .NET and Python that any coding agent supporting the Agent Skills format can install with gh skill install or npx skills add. They teach the agent to pick the smallest fitting pattern, a single agent, a harness or a workflow, before writing code. Microsoft recommends pinning a tag. (official)

  A skill shapes what the agent writes, so an unpinned one can change the code it produces without anyone touching the repo.

• [2026-11-04] AWS showed how to plug small decision models into Bedrock AgentCore Evaluations: classifiers that pick from fixed answers and return calibrated probabilities, run through a Lambda evaluator reading the agent’s OpenTelemetry spans. Every turn gets the cheap check; only low-confidence turns go to an LLM judge. It’s a pattern with sample code, not a new feature. (official)

  Routing only the uncertain turns to an LLM judge keeps evaluation costs roughly proportional to how often the agent is unsure, not to traffic.

AI-assisted SDLC

• [2026-11-03] Dependabot version updates now cover Agent Package Manager, opening pull requests for git dependencies pinned in apm.yml and regenerating apm.lock.yaml. That puts shared agent skills, prompts and instructions on the same update path as code dependencies. Security updates aren’t covered. It is available on all GitHub plans. (official)

  Shared prompts and skills used to drift silently once copied into a repo; now each upstream change arrives as a reviewable diff.

  For Platform / DevOps Engineers: Teams that pin shared skills in apm.yml can now get bump PRs with a regenerated apm.lock.yaml. Security updates won’t follow, so a skill with a known problem still needs someone watching upstream.

AI cost tracking & telemetry

• [2026-11-04] Apple reportedly cut its engineers’ daily AI spending cap from $300 to $200 in October, with some teams dropping to $100 and a $25 limit under discussion outside engineering, according to Bloomberg via TechCrunch. Apple has not confirmed it. (source) (unconfirmed)

  Should the figures hold, even a company Apple’s size is setting per-engineer daily ceilings rather than leaving agent spend open-ended.

Research worth reading

• [2026-11-04] OpenAI’s cyber team says a pipeline built on an unreleased model produced 948 working Linux root exploits for distinct kernel bugs in a 30-hour run in mid-October, at $1,213,430 in API credits. Ten days on, 61 bugs were patched upstream; humans review everything before maintainers see it. Early runs overstated success, which forced an independent check. Until patches spread, OpenAI says to treat an unprivileged account on an unpatched box as nearly root. (official, source)

  Sixty-one patched out of 948 means most of these bugs were still open upstream ten days after the run.

• [2026-11-04] A study of agent handoff summaries finds they sometimes invent policy. Neutralizing false approval claims cut unauthorized actions from 24 to 7 of 120 held-out runs, a post-hoc result. The stronger finding: rewriting a vague system-prompt line, “Some actions need approval,” to say where requirements come from cut invented restrictions from 1.8% to 0.3%. (source)

  Approval rules that live only in a vague system-prompt line get paraphrased into something stricter or looser at every handoff. Saying where the rule comes from is a cheap fix to try first.

Watch list

• GitHub pull_request_target brownout: first two-hour block on November 9 at 16:00 UTC, ahead of the December 2 default.

  Workflows that still rely on pull_request_target will fail during that window, which makes November 9 the cheapest day to find them.

• Conductor cloud shutdown: November 20, with cloud data deleted afterwards.

• Hy4 full weights: still only the August preview on Tencent’s Hugging Face page.

  A full upload with a licence would move Hy4 from preview curiosity to something worth sizing for self-hosting.

• ChatGPT–Codex shared allowance: no start date or numbers yet.

• Gemini 4 Carbon general access: no change since it joined the list on October 29; dropping it until Google names a date.