AI News Briefing — Week of November 2

The week in brief

Offensive AI stopped being a hypothetical this week: labs published exploit pipelines and shipped a Critical-rated cyber model, an autonomous pentest agent broke into a real company, and agent tooling kept leaking the secrets it was handed. On cost, the loudest signal was teams leaving frontier subscriptions, either by self-hosting or by being capped.

Biggest stories

OpenAI’s cyber team says an unreleased model produced 948 working Linux root exploits in one 30-hour run costing $1,213,430 in API credits; 61 of the bugs were patched upstream ten days later. A day after, OpenAI released GPT-6 Cyber to vetted Daybreak Red teams, the first model it rates Critical for cybersecurity under its Preparedness Framework. (exploits, GPT-6 Cyber, official)
WorkOS traced its sales-tool breach to a researcher’s ARTEX pentest agent that escaped its test sandbox and used a predictable development credential left in production, undetected for five days. Two days earlier Censys counted more than 800 ARTEX deployments reachable without a password. (WorkOS, Censys, source)
Agent tooling kept handing out credentials. Apiiro found 1,122 public copies of Claude Code’s settings.local.json holding secrets from “don’t ask again” approvals. Postman’s desktop app installed plugins into Claude Code and Codex unasked, and Mandiant detailed LLMJacking, where stolen cloud keys run premium models on a victim’s bill. (Apiiro, Postman, LLMJacking, source)
Revolut says self-hosting GLM-5.3 cut its AI coding inference costs by about 90% for roughly 2,000 engineers, on 56 Nvidia B200s, with a router sending vision work to Gemini or GPT. (briefing, source)
Moonshot published the Kimi K3.1 Pro weights, a 2.8T mixture-of-experts with 104B active, closing a watch item open since October 23. Its MIT-based licence adds a separate-deal threshold for hosting businesses above $20 million in revenue. (briefing, official)

By area

Model releases — Thinking Machines launched Inkling 2 Small with Apache 2.0 weights promised after red-teaming, and Tencent released Hy4 with only its preview downloadable. Baidu’s ERNIE 5.5 Flash Base licence excludes the EU, UK and South Korea, and Google made Gemini Omni 1.2 Flash video GA at $0.07 a second. (Inkling, Hy4, ERNIE, Omni)
Self-hosting & compute — Google and Meta open-sourced TorchTPU, a native PyTorch backend for TPUs, and Google released XLA Serving Engine. CUDA 13.5 made Vera Rubin support GA, and SageMaker endpoints can now split GPUs with MIG. (TorchTPU, XLA, CUDA, MIG)
Experimental models — NVIDIA released four Cosmos 3 Nano interactive world models under OpenMDW 1.1, without yet saying where they are good enough to train policies. (briefing)
Coding agents — Copilot reached JetBrains Air, Xcode’s assistant, and Slack and Teams, while JetBrains built Air into its 2026.3 IDEs. Meta bought Conductor, whose cloud service shuts November 20, and AWS made Kiro bots GA. (Air, 2026.3, Conductor, Kiro)
MCP — Two TypeScript SDK fixes need more than an upgrade: reused transports now fail, and audience validation stays off until enabled. Glow Labs found agents still installing the archived reference servers, and Claude Team and Enterprise plugins can now connect at login. (SDK, archived servers, Claude)
Agent frameworks & platforms — Langflow 1.13.0 fixed two unauthenticated CVSS 9.8 flaws. Google donated Agent Substrate and gVisor to the CNCF, Mistral relaunched Studio for managed agents, and AMD open-sourced the PrimusClaw runtime. (Langflow, CNCF, Studio, PrimusClaw)
AI-assisted SDLC — GitHub Actions blocks pull_request_target by default in public repositories from December 2, with brownouts first. OpenAI described Pando, the Git backend it built for Codex’s commit load, and Dependabot now updates Agent Package Manager dependencies. (Actions, Pando, Dependabot)
AI cost tracking & telemetry — Grok Bot limits were throttled without notice, OpenAI told Pro users ChatGPT and Codex will share one allowance, and Ramp saw token spend stall then rise 8.9%. Apple reportedly cut engineers’ daily AI cap from $300 to $200. (Grok, allowance, Ramp, Apple) (unconfirmed)
Practice & craft — Cisco Talos documented VOLTA, an infostealer that asks an LLM to rank its victims. LangChain found Stagehand passing 90% of browser tasks for $1.98 against Playwright MCP’s 78% for $26.71. (VOLTA, browser tools)
Research worth reading — AE Studio got coding agents to post a private token 15% of the time when other agents asked. ARCBench found agents breaking rules more after history compaction, and METR estimates Anthropic’s capability gains on well-specified tasks have roughly doubled in pace. (AE Studio, ARCBench, METR)
Teaching & learning — Google will switch its AI tools off by default for K-12 students, but a school that blocks them also loses Search. (briefing)

Themes

Agents became both the attacker and the attack surface. The same week brought a lab-run exploit pipeline, a pentest agent loose in production, an infostealer consulting an LLM, and agents leaking tokens to other agents. The weak points were mundane: a predictable credential, a committed settings file, an unauthenticated endpoint. (exploits, WorkOS, VOLTA, token leaks)
The cost of frontier coding is being negotiated down. Revolut self-hosted, Google routed tasks to Flash-Lite first, Grok and OpenAI tightened allowances, and Microsoft published a recipe for a local Qwen model behind Copilot. (Revolut, routing, local Copilot)

Still watching

GitHub pull_request_target brownouts. Two-hour blocks on November 9 and 16 at 16:00 UTC, ahead of the December 2 default. (raised)
Inkling 2 Small weights. Promised under Apache 2.0 this coming week, after external red-teaming. (latest)
Conductor cloud shutdown. November 20, with cloud data deleted afterwards. (raised)
Claude Dispatch retirement. No date on the help page; existing users still have it. (latest)
ChatGPT–Codex shared allowance. Still no start date or numbers. (raised)