AI News Briefing — Claude Code settings files leak secrets on GitHub

Model releases

• [2026-11-05] Baidu published ERNIE 5.5 Flash Base on Hugging Face in FP8 and BF16: a 280B-parameter mixture-of-experts with 14B active, trained on 33.5T tokens, with vLLM and SGLang recipes. It is a base checkpoint with no post-training. The licence is Baidu’s own and covers every territory except the EU, the UK and South Korea. Commercial use above $50 million in yearly revenue needs written permission from Baidu, and products must show “Powered by ERNIE”. (official, official)

  With no post-training, it won’t follow instructions out of the box; it is raw material for a fine-tune, and EU and UK teams can’t use it at all.

Self-hosting & compute

• [2026-11-06] SageMaker inference endpoints can now carve NVIDIA GPUs into Multi-Instance GPU partitions: up to seven per A100 or H100, two per RTX PRO 4500 Blackwell and four per RTX PRO 6000. The layout is fixed when the endpoint is created and needs inference components, so single-model and serverless endpoints are out. Carving added about 17 seconds to provisioning in AWS’s tests. (official)

  Seventeen seconds of provisioning is small next to a whole A100 sitting mostly idle under a small model.

  For Platform / DevOps Engineers: A small model that leaves most of an H100 idle can now share the card with up to six others, but only on endpoints built with inference components, and because the layout is fixed at creation the partition plan has to be settled before the endpoint exists.

• [2026-11-06] AMD’s InferaSim predicts how a serving configuration will perform on MI355X nodes from one short measured run, instead of benchmarking every candidate. AMD reports a median error of about 8% on throughput and per-token latency across 172 configurations. In one search, 9.1 GPU-hours of anchor runs stood in for 204 hours of measurement. It covers vLLM and SGLang; the figures are AMD’s own. (official)

  AMD’s numbers on AMD’s hardware. An 8% median error is close enough to rank candidate configurations, not to promise a latency target.

Experimental models

• [2026-11-05] NVIDIA released four Cosmos 3 Nano world models for interactive simulation, each about 15B parameters under the OpenMDW 1.1 licence. They stream driving video and LiDAR that respond to updated controls, or predict two-arm robot video from actions. NVIDIA says it has not yet measured where they hold up well enough to train or evaluate policies. (official)

  Until someone measures where these simulations stay faithful, a policy that scores well inside one has only shown it can drive the simulator.

Coding agents

• [2026-11-06] Apiiro scanned public GitHub for .claude/settings.local.json, where Claude Code saves a command as an allow rule when someone picks “Yes, and don’t ask again.” Of 104,185 copies, 1,122 held at least one secret typed into the approved command: 379 database passwords, 43 SSH logins and 23 AWS keys among 1,379 in total. Claude Code adds the file to the user’s global git excludes, not the project’s .gitignore, so a collaborator or a fresh machine without that setting can commit it. gitleaks and TruffleHog both missed 215 of the files. Apiiro says Anthropic hasn’t replied; a related issue was closed as not planned. (source)

  Allow rules store the whole command, so a password typed on the command line once is kept as a permission.

  For Security Engineers: Search the organisation’s repositories for committed .claude/settings.local.json files and rotate any credential in their allow rules; since gitleaks and TruffleHog missed 215 of Apiiro’s files, a scanner pass alone isn’t enough, and adding the path to each project’s .gitignore covers machines without the global exclude.

• [2026-11-06] Forever Security showed that any browser extension able to run scripts on claude.ai could send tasks to Claude Desktop through Dispatch, the phone-to-desktop feature. In its test, a script asked Claude to install an npm package, clicked “Allow” on each approval prompt, and the package’s install script ran. The researchers say Anthropic called the report a duplicate in May and told them in October that Dispatch would be retired. Dispatch is closed to new users but still running for some existing ones. (source)

  The script clicked Allow itself, so once an extension could reach the page, the approval prompt protected nothing.

• [2026-11-06] Copilot code review settings can now be managed through GitHub’s REST and GraphQL APIs, from enterprise policy down to a single repository, including review effort and whether reviews use MCP tools. Responses now say which skills, MCP servers and custom instructions a comment drew on, and review sessions show the AI credits they used. (official)

  Whether reviews may call MCP tools can now be set once in enterprise policy instead of repository by repository.

  For Engineering Managers / Tech Leads: With review effort settable per repository through the API and each session’s AI credits now visible, a team can raise the effort on one repository and compare its credit use against the rest before changing the enterprise policy.

Agent frameworks & platforms

• [2026-11-06] AMD open-sourced PrimusClaw, a managed agent runtime that runs in your own Kubernetes cluster next to Instinct GPUs. It keeps runs as database rows under leases, so another replica can pick up an in-flight run after a crash or upgrade, and agent code runs without platform-wide credentials. It exposes A2A v1.0, MCP in both directions and an API compatible with Claude Managed Agents. MIT licence, with an Apache 2.0 sandbox controller. (official)

  Because runs live as leased database rows, a rolling upgrade no longer has to kill a long agent task halfway through.

AI cost tracking & telemetry

• [2026-11-06] Ramp’s card and bill data shows company spend on AI tokens grew only 1.5% across August and September combined, after 42% in July, then rose 8.9% in the month to October 23. The median company spends $12 to $15 per employee per month; the top tenth spends $600 to $1,000. Ramp’s economist says almost all of it comes from venture-backed tech companies. (source)

  The top tenth spends forty to eighty times the median per employee, so an average says little about any one company’s bill.

Practice & craft

• [2026-11-06] LangChain compared seven browser toolsets for its Deep Agents on 100 WebVoyager tasks with the same model. Stagehand passed 90% for $1.98; Playwright MCP passed 78% for $26.71, mostly from verbose page dumps and one tool call per step. Two findings carry over to other agent tools: letting the agent write one script for several steps cut cost fourfold, and truncating output after the fact saved nothing because the agent fetched the page again. (official)

  Truncation failing is the counterintuitive part: cutting output the agent still needs just buys a second fetch.

• [2026-11-06] Censys found more than 800 deployments of ARTEX, the open-source autonomous pentest framework tied to the South Korean bank and ConnectWise intrusions, reachable from the internet without a password, some holding implants. Not all belong to attackers; many are authorised testers. ARTEX doesn’t need to be internet-facing at all, and Censys couldn’t say why so many were. (source)

  An unauthenticated pentest console is an attack tool for whoever finds it, regardless of who deployed it.

Watch list

• GitHub pull_request_target brownout: two-hour block on November 9 at 16:00 UTC.

• Inkling 2 Small weights: still promised for next week under Apache 2.0.

• Conductor cloud shutdown: November 20, with cloud data deleted afterwards.

• Claude Dispatch retirement: researchers say Anthropic targeted the end of October; the help page names no date, and existing users still have it.

  A date on Anthropic’s own help page would settle whether the extension path described above closes for good.