A GitHub advisory says GPUStack before v2.2.0 treats requests from a loopback source as the built-in administrator when force_auth_localhost is False, the default.
- Affected: gpustack (pip) < 2.2.0
- Patched: 2.2.0
Wednesday, November 11, 2026
Updated 812 items scanned84 of 101 sources ok40 topicsAll days
Today in AI
- Anthropic announced Claude Fable 5.2 and Mythos 5.2; Fable 5.2 lists a 1M-token context at $8/$40 per 1M input/output tokens. anthropic.com
- Anthropic launched the roadshow for its proposed IPO; WSJ and Bloomberg report a target valuation of $1.3T to $1.4T. anthropic.comofficial
- MiniMax released H3-Image, an open-weight image model built on H3, which MiniMax says generates 4K images in about 10 seconds. minimax.ioofficial
- CVE-2026-102895, an improper authentication flaw in GPUStack, is listed in CISA's known exploited vulnerabilities catalog. nvd.nist.gov
- Notion says a security incident at its vendor Fireworks AI may have exposed some Notion AI chat sessions. notion.com
- Advisory GHSA-5xjx-9qx6-jcrv reports a TOCTOU race in the Claude Code Edit tool that allows file writes outside the workspace. github.com
- OpenAI published openai/codex-security, a CLI and TypeScript SDK for finding, validating and fixing security vulnerabilities. github.com
- JetBrains shipped Air for agentic development in its IDEs with the 2026.3 release. blog.jetbrains.comofficial
Security 14Last 14 days
A GitHub advisory says GPUStack's SAML callback decodes a posted SAMLResponse and issues a session token without verifying it.
- Affected: gpustack (pip) >= 0.7.1, < 2.2.2
- Patched version: 2.2.2
- GHSA-62m9-f875-rqw6: GPUStack: SAML callback trusts an unverified SAMLResponse, allowing authentication bypass and account takeovergithub.com · GitHub Advisory · 31h ago
GitHub published an advisory for a time-of-check to time-of-use race in the Claude Code Edit tool.
- Affected: @anthropic-ai/claude-code npm versions below 2.1.251
- Patched in 2.1.251
- GHSA-5xjx-9qx6-jcrv: Claude Code: TOCTOU Race in Edit Tool Allows File Writes Outside the Workspacegithub.com · GitHub Advisory · Nov 9
A GitHub advisory says GPUStack's cluster_apiserver_proxy handler skipped resource-level authorization checks.
- Affected: gpustack (pip) >= 2.2.0, < 2.2.2
- Patched version: 2.2.2
- GHSA-3hch-x692-6qj3: GPUStack: Missing authorization on several cluster and resource endpoints allows cross-user access and cluster takeovergithub.com · GitHub Advisory · 31h ago
CVE-2026-102895 is an improper authentication flaw in GPUStack, listed in CISA's known exploited vulnerabilities catalog.
- CVE: CVE-2026-102895
- Code execution via POST /v2/inference-backends/from-yaml
- CVE-2026-102895: GPUStack Improper Authentication Vulnerability (actively exploited, CISA KEV)nvd.nist.gov · GitHub Advisory · Nov 9
Microsoft's FORGE Lab published a post saying it uses agentic tools to find memory safety issues in Rust code.
- FORGE Lab uses agentic tools to identify memory safety issues in Rustmicrosoft.com · Microsoft · Nov 9
Notion says a security incident at its vendor Fireworks AI may have exposed some Notion AI chat sessions.
- Affected: under 1% of Notion workspaces, per Notion
- Notion no longer serves open-weight models via Fireworks
- Fireworks AI security breach impacts Notion and their customersnotion.com · HN · Nov 10 · 164 pts · 64 comments
- Tell HN: Notion AI chat sessions have been exposed via Fireworks AI hacknews.ycombinator.com · HN · Nov 10 · 17 pts · 1 comments
Microsoft published a post titled on detecting sleeper agents hiding in AI model neurons.
- Detecting sleeper agents hiding in AI model neuronsmicrosoft.com · Microsoft · 24h ago
Microsoft researchers described Lazarus, a backdoor technique that reprograms dormant neurons in an AI model.
Why it matters: Agents with tool or terminal access could be backdoored so a hidden trigger makes them run attacker commands, which matters when choosing model sources.
- Lazare, veni foras: Reprogramming Dormant Neurons to Backdoor AI Agentsmicrosoft.com · Microsoft · 26h ago
According to a BleepingComputer report summarized by Techmeme, Railway says it believes its October hack targeted AI provider keys for resale.
- Estimated unauthorized spend about $740K
OpenAI published a GitHub repository, openai/codex-security, with a CLI and TypeScript SDK for finding, validating and fixing security vulnerabilities.
Why it matters: Developers can run a vendor-provided CLI or call the TypeScript SDK to find, validate and fix vulnerabilities in their code.
Techmeme headline, citing Ars Technica, says researchers found Grok Build leaking data from over 35,000 apps through shareable links.
- Over 35,000 apps reportedly affected
VulnCheck published a tracking report on vulnerabilities attributed to Anthropic's Project Glasswing, seven months after launch.
- VulnCheck tracked 442 CVEs attributable to Anthropic, about 0.5% of CVEs this year
- 37,966 reported findings, 7,349 (19.4%) public, 217 marked fixed
- Tracking Anthropic-discovered vulnerabilitiesvulncheck.com · HN · 25h ago · 447 pts · 217 comments
Simon Willison released llm 0.37.2, which fixes two security issues reported by Daniel de Araujo.
- Fixed version: llm 0.37.2
- Advisory IDs: GHSA-v9h7-jj4g-f862 and GHSA-r639-rr7r-x72w
- llm 0.37.2simonwillison.net · Simonwillison · 6h ago
Topics by category
Hot topics2
Bluesky posts make three separate claims.
- Post claims 25,000 agents created over 450 worlds
- Post claims SwarmEvolve explores 5-13x more programs per hour
- Post on Blueskybsky.app · Bluesky · 31h ago · 16 comments · 369 likes
- Post on Blueskybsky.app · Bluesky · Nov 9 · 7 comments · 207 likes
Posts claim a Google engineer pointed 48 AI agents at NASA lidar data and found an unmapped Maya pyramid in Mexico within 72 hours.
- My AI agents found an unmapped Maya sitepietromiotti.com · HN · 11h ago · 900 pts · 329 comments
Industry2
United Airlines says it will stop personal AI assistants from booking tickets on its behalf.
Why it matters: Agents that book United flights for users may be blocked, so travel-booking agents need a fallback such as a human handoff.
- United Airlines bans AI agents from booking flights on behalf of travelerscbsnews.com · HN · 2h ago · 211 pts · 213 comments
- United Airlines says it will prevent personal AI assistants from booking tickets, citing data privacy risks and possible FAA and DOT rule violations (Alison Sider/Wall Street Journal)techmeme.com · Techmeme · 4h ago
TechCrunch reports OpenAI's quarterly revenue crossed $10B, up almost 50% from $6.7B in the second quarter.
- OpenAI’s quarterly revenue reportedly crosses $10B for the first timetechcrunch.com · Techcrunch · 7h ago
New models12
Anthropic announced Claude Fable 5.2 and Mythos 5.2, according to two Hacker News posts linking to its announcement.
- Artificial Analysis Intelligence Index: 65 for Claude Fable 5.2 (Max, Default Fallback)
- Output speed: 101 tok/s on Artificial Analysis
- Gemini API: Computer Use generally available (GA)aistudio.google.com · Google · Oct 30
- Gemini Omni 1.2 Flash: Fast and cost-effective with longer clipsblog.google · Google · Nov 5
Anthropic is targeting a valuation of about $1.4 trillion in its IPO, according to The Verge and Bloomberg.
- Bloomberg headline: $1.4T valuation target
- WSJ headline: $1.3T valuation
- Anthropic to Seek $1.3T Valuation in IPOwsj.com · HN · 34h ago · 60 pts · 86 comments
- Anthropic Targets $1.4T Valuation in IPObloomberg.com · HN · 27h ago · 16 pts · 1 comments
- Gemini Decisions APIblog.google · HN · 5h ago · 192 pts · 63 comments
9 more in New models
Simon Willison released llm-anthropic 0.31, which adds Fable 5.2 and Mythos 5.2 to his llm command-line tool.
- llm-anthropic version: 0.31
- Model ID: claude-fable-5.2
- llm-anthropic 0.31simonwillison.net · Simonwillison · Nov 9
AWS published several blog posts on Amazon Bedrock AgentCore and Bedrock Managed Knowledge Base.
- Reference architecture has 7 composable layers
- How CrossnoKaye grounds physical AI with Amazon Bedrock AgentCoreaws.amazon.com · Amazon · Nov 9
- Pluggable Agentic AI Framework: A seven-layer composable enterprise agentic AI reference architecture on Amazon Bedrock AgentCoreaws.amazon.com · Amazon · Nov 9
MiniMax released H3-Image, an open-weight image model built on H3.
- Output resolution: 4K (4096 × 4096), per MiniMax
- Licence: minimax-h3-image-community-license-agreement
- MiniMax H3-Image: Bringing 4K Image Generation into the 10-Second Eraminimax.io · Minimax · 31h ago
- Comfy-Org/MiniMax-H3-Image (text-to-image)huggingface.co · HF · Nov 8 · 247 likes · 352k downloads
Google DeepMind introduced Gemini Robotics 2.5, which it calls its most capable vision-language-action model.
- Announced November 10, 2026
- Tested across over 200 distinct tasks
- Gemini Robotics 2.5 accelerates real-world general dexteritydeepmind.google · Google DeepMind · Nov 9
A paper by Jack Lu and colleagues proposes Deletion Tuning, which learns a binary mask over the gate projection of transformer blocks.
- Fewer than 0.05% of weights zeroed
- FFT, LoRA and random sparse fine-tuning lose up to 5.4 points
- The Surprising Effectiveness of Deleting Weights in LLM Post-Traininghuggingface.co · HF Papers · 23h ago · 2 comments · 41 stars
- The Surprising Effectiveness of Deleting Weights in LLM Post-Trainingarxiv.org · HN · 24h ago · 30 pts
Google DeepMind announced AlphaGenome 2, the successor to AlphaGenome released last year.
- Announced November 11, 2026
- AlphaGenome Atlas covers all 9 billion possible single-letter changes in the human genome
- AlphaGenome 2: Deciphering how cells read DNA to better understand diseasedeepmind.google · Google DeepMind · 8h ago
- Google’s AlphaGenome 2 zooms in on the cellular roots of diseasetheverge.com · Theverge · 8h ago
Google DeepMind announced Gemini 4 Carbon on Nov 10, 2026, available to developers, enterprises, scientists and consumers.
- Announced Nov 10, 2026
- Google says it ranks #1 on CursorBench 4.0, Perplexity's WANDR and Zapier's AutomationBench
- Gemini 4 Carbon is now availableblog.google · HN · 31h ago · 291 pts · 164 comments
A Hugging Face blog post introduces BotPsy, an on-device personal assistant.
- BotPsy: On-Device Personal Assistant with a Sub-Billion-Parameter Agentic Language Modelhuggingface.co · Hugging Face · 18h ago
A Hacker News post links to a Qwen Cloud page titled Qwen 4 Max Preview.
- Token Plan for Individual starts at $3/month
- Page text names Qwen3.8-Max, not Qwen 4
- Qwen 4 Max Previewqwencloud.com · HN · 14h ago · 16 pts · 4 comments
Coding agents3
AWS released AWS Emulator, a free tool that simulates more than 200 AWS services locally.
- Simulates 200+ AWS services locally
- 29,684 commits in the first three weeks, per Simon Willison
- AWS Emulator and the engineer's job when agents write the codeallthingsdistributed.com · HN · 5h ago · 108 pts · 2 comments
- AWS Emulator: 100% built by agentsaboutamazon.com · HN · 5h ago · 10 pts
JetBrains shipped Air in its IDEs with the 2026.3 release.
- Shipped with the 2026.3 release
- JetBrains IDEs Transformed for the Agentic Era of Development – With Airblog.jetbrains.com · Jetbrains · 13h ago
Addy Osmani's agent-skills repo on GitHub collects engineering skills for AI coding agents.
- addyosmani/agent-skills: Production-grade engineering skills for AI coding agents.github.com · GitHub · just now · 116k stars
Claude / Anthropic2
A Yahoo Finance item reports Anthropic says a key AI safety alarm has been triggered, days before its IPO.
- Anthropic says a key AI safety alarm has been triggered, days before its IPOfinance.yahoo.com · HN · 5h ago · 14 pts · 10 comments
Reports say Anthropic's IPO is drawing several times more orders than available shares, with a planned livestream event.
Open source / local1
Leaker Aaron Perris claims Apple is building a Mac app called Harbor, as reported by 9to5Mac.
- Connects multiple Macs over Thunderbolt 5
- Apple has new Mac app coming to make running local AI models easy9to5mac.com · HN · 26h ago · 512 pts · 520 comments
Tools / repos4
GitHub repos released MCP servers for Windows Sandbox, Roblox Studio, Blender, Yandex Metrika, 3D asset search and an Nvidia Auto Ontology knowledge base.
- shanselman/sandbox-mcp: Fresh, throwaway Windows machines for testing your apps: an MCP server and CLI that automate Windows Sandboxgithub.com · GitHub · Nov 6 · 411 stars
- gogoymh/auto-ontology-mcp: NVIDIA Auto Ontology's semantic layer and a personal knowledge base as an MCP server for Claude, ChatGPT and other MCP clients. No LLM API key needed.github.com · GitHub · Nov 6 · 368 stars
A Hacker News post links to an Atuin blog post titled Atuin Threads, which the title says syncs agent sessions across every machine.
- Atuin Threads: All your agent sessions on every machineblog.atuin.sh · HN · 9h ago · 178 pts · 65 comments
A Launch HN post says YC F26 startup Pomerado turns any website into an MCP for agents.
- Launch HN: Pomerado (YC F26) – Turn any website into an MCP for agentsnews.ycombinator.com · HN · 6h ago · 41 pts · 35 comments
1 more in Tools / repos
A Show HN post presents Klad, a source-available paint app written in Rust.
- Show HN: Klad, a paint app your coding agent can drive (source-available)github.com · HN · 7h ago · 68 pts · 28 comments