A GitHub advisory says GPUStack before v2.2.0 treats requests from a loopback source as the built-in administrator when force_auth_localhost is False, the default.
- Affected: gpustack (pip) < 2.2.0
- Patched: 2.2.0
Thursday, November 12, 2026
Updated 813 items scanned86 of 101 sources ok40 topicsAll days
Today in AI
- Anthropic announced Claude Fable 5.2 and Mythos 5.2; Fable 5.2 is listed with a 1M-token context at $8/$40 per 1M input/output tokens. anthropic.com
- AWS published several blog posts on Amazon Bedrock AgentCore and Bedrock Managed Knowledge Base. aws.amazon.comofficial
- MiniMax released H3-Image, an open-weight text-to-image model built on H3 that generates 4K images. huggingface.co
- Notion says a security incident at its vendor Fireworks AI may have exposed some Notion AI chat sessions. notion.com
- GPUStack before v2.2.0 treats loopback requests as the built-in admin when force_auth_localhost is False, the default (GHSA-gj9m-f8ph-pmhr); upgrade to v2.2.0. github.com
- GHSA-5xjx-9qx6-jcrv describes a TOCTOU race in the Claude Code Edit tool that allows file writes outside the workspace. github.com
- OpenAI published openai/codex-security, a CLI and TypeScript SDK for finding, validating and fixing security vulnerabilities. github.com
- The Chrome team shipped Modern Web Guidance 1.0, curated guides that steer coding agents toward modern web platform features. developer.chrome.com
- AWS released AWS Emulator, a free tool that simulates 200+ AWS services locally; AWS says AI agents wrote all of its code. techmeme.com
- JetBrains shipped Air for agentic development in its IDEs with the 2026.3 release. blog.jetbrains.comofficial
Security 15Last 14 days
A GitHub advisory says GPUStack's SAML callback decodes a posted SAMLResponse and issues a session token without verifying it.
- Affected: gpustack (pip) >= 0.7.1, < 2.2.2
- Patched version: 2.2.2
- GHSA-62m9-f875-rqw6: GPUStack: SAML callback trusts an unverified SAMLResponse, allowing authentication bypass and account takeovergithub.com · GitHub Advisory · Nov 10
GitHub published an advisory for a time-of-check to time-of-use race in the Claude Code Edit tool.
- Affected: @anthropic-ai/claude-code npm versions below 2.1.251
- Patched in 2.1.251
- GHSA-5xjx-9qx6-jcrv: Claude Code: TOCTOU Race in Edit Tool Allows File Writes Outside the Workspacegithub.com · GitHub Advisory · Nov 9
A GitHub advisory says GPUStack's cluster_apiserver_proxy handler skipped resource-level authorization checks.
- Affected: gpustack (pip) >= 2.2.0, < 2.2.2
- Patched version: 2.2.2
- GHSA-3hch-x692-6qj3: GPUStack: Missing authorization on several cluster and resource endpoints allows cross-user access and cluster takeovergithub.com · GitHub Advisory · Nov 10
Microsoft's FORGE Lab published a post saying it uses agentic tools to find memory safety issues in Rust code.
- FORGE Lab uses agentic tools to identify memory safety issues in Rustmicrosoft.com · Microsoft · Nov 9
Notion says a security incident at its vendor Fireworks AI may have exposed some Notion AI chat sessions.
- Affected: under 1% of Notion workspaces, per Notion
- Notion no longer serves open-weight models via Fireworks
- Fireworks AI security breach impacts Notion and their customersnotion.com · HN · Nov 10 · 164 pts · 64 comments
- Tell HN: Notion AI chat sessions have been exposed via Fireworks AI hacknews.ycombinator.com · HN · Nov 10 · 18 pts · 1 comments
Microsoft published a post titled on detecting sleeper agents hiding in AI model neurons.
- Detecting sleeper agents hiding in AI model neuronsmicrosoft.com · Microsoft · 30h ago
Microsoft researchers described Lazarus, a backdoor technique that reprograms dormant neurons in an AI model.
Why it matters: Agents with tool or terminal access could be backdoored so a hidden trigger makes them run attacker commands, which matters when choosing model sources.
- Lazare, veni foras: Reprogramming Dormant Neurons to Backdoor AI Agentsmicrosoft.com · Microsoft · 32h ago
According to a BleepingComputer report summarized by Techmeme, Railway says it believes its October hack targeted AI provider keys for resale.
- Estimated unauthorized spend about $740K
OpenAI published a GitHub repository, openai/codex-security, with a CLI and TypeScript SDK for finding, validating and fixing security vulnerabilities.
Why it matters: Developers can run a vendor-provided CLI or call the TypeScript SDK to find, validate and fix vulnerabilities in their code.
Techmeme headline, citing Ars Technica, says researchers found Grok Build leaking data from over 35,000 apps through shareable links.
- Over 35,000 apps reportedly affected
VulnCheck published a tracking report on vulnerabilities attributed to Anthropic's Project Glasswing, seven months after launch.
- VulnCheck tracked 442 CVEs attributable to Anthropic, about 0.5% of CVEs this year
- 37,966 reported findings, 7,349 (19.4%) public, 217 marked fixed
- Tracking Anthropic-discovered vulnerabilitiesvulncheck.com · HN · 31h ago · 448 pts · 219 comments
Microsoft posted lessons from 59 Linux kernel bug reports and research on detecting sleeper agents in AI model neurons.
- Lessons from 59 Linux Kernel Bug Reportsmicrosoft.com · Microsoft · 12h ago
llm 0.37.2 fixes two issues, reported by Daniel de Araujo, where an OpenAI API key could be sent to a third-party provider.
- Fixed in llm 0.37.2
- Advisories GHSA-v9h7-jj4g-f862 and GHSA-r639-rr7r-x72w
- llm 0.37.2simonwillison.net · Simonwillison · 12h ago
Ars Technica reports the Grok Build coding agent leaks confidential information.
- Grok Build coding agent leaks oodles of confidential infoarstechnica.com · HN · 11h ago · 11 pts
Topics by category
Industry3
United Airlines said on Wednesday it bans AI agents from booking flights for travelers.
- Announced November 11, 2026
- United Airlines bans AI agents from booking flights on behalf of travelerscbsnews.com · HN · 8h ago · 481 pts · 469 comments
- United Airlines Is Banning AI Bots from Booking Flightswsj.com · HN · 11h ago · 11 pts · 10 comments
The Information reports the Commerce Department is finalizing a control update to block remote access and chip smuggling into China via data centers.
TechCrunch reports Jensen Huang's affair with an alleged Chinese spy has put Nvidia's China plans under scrutiny. Huang withdrew from the ElevenLabs Summit, and tech allies defend him, per the New York Times.
- Tech Allies Rally Behind Jensen Huang, Calling Him Vital in AI Race (Gift Link)nytimes.com · HN · 12h ago · 16 pts · 17 comments
- Nvidia will investigate CEO Jensen Huang’s relationship with possible Chinese spytechcrunch.com · Techcrunch · Nov 8
New models12
Two Hacker News posts link to an Anthropic announcement of Claude Fable 5.2 and Mythos 5.2.
- Artificial Analysis Intelligence Index score claimed for Claude Fable 5.2: 65
- Listed output speed: 101 tok/s
- Gemini API: Computer Use generally available (GA)aistudio.google.com · Google · Oct 30
- Gemini Omni 1.2 Flash: Fast and cost-effective with longer clipsblog.google · Google · Nov 5
A Hacker News post links to a Google blog post introducing the Gemini Decisions API and its model, Gemini Decision 1.
- Model ID: gemini-decision-1
- Up to 1,000 independent questions per request
- Gemini Decisions APIblog.google · HN · 10h ago · 338 pts · 105 comments
Simon Willison released llm-anthropic 0.31, which adds Fable 5.2 and Mythos 5.2 to his llm command-line tool.
- llm-anthropic version: 0.31
- Model ID: claude-fable-5.2
- llm-anthropic 0.31simonwillison.net · Simonwillison · Nov 9
9 more in New models
MiniMax released H3-Image, an open-weight image model built on H3.
- Release date on the MiniMax blog: 2026-11-11
- Maximum output: 4K (4096 × 4096)
- MiniMax H3-Image: Bringing 4K Image Generation into the 10-Second Eraminimax.io · Minimax · Nov 10
- Comfy-Org/MiniMax-H3-Image (text-to-image)huggingface.co · HF · Nov 8 · 263 likes · 352k downloads
Two new papers introduce benchmarks for long-horizon LLM agents: AutoVend, a vending-machine operations simulator, and Infrathon, an AI-infrastructure optimization suite.
- AutoVend: one agent runs 20 vending machines over 180 simulated days
- Infrathon: six models, 150 runs, 24-hour budgets, over 10,000 GPU-hours
- Gemini Robotics 2.5 accelerates real-world general dexteritydeepmind.google · Google DeepMind · Nov 9
- Testing Claude on real-world electronics designanthropic.com · HN · Nov 9 · 34 pts · 8 comments
AWS published several blog posts on Amazon Bedrock AgentCore and Bedrock Managed Knowledge Base.
- How CrossnoKaye grounds physical AI with Amazon Bedrock AgentCoreaws.amazon.com · Amazon · Nov 9
- Pluggable Agentic AI Framework: A seven-layer composable enterprise agentic AI reference architecture on Amazon Bedrock AgentCoreaws.amazon.com · Amazon · Nov 9
A paper by Jack Lu and colleagues proposes Deletion Tuning, which learns a binary mask over the gate projection of transformer blocks.
- Fewer than 0.05% of weights zeroed
- FFT, LoRA and random sparse fine-tuning lose up to 5.4 points
- The Surprising Effectiveness of Deleting Weights in LLM Post-Traininghuggingface.co · HF Papers · 29h ago · 3 comments · 50 stars
- The Surprising Effectiveness of Deleting Weights in LLM Post-Trainingarxiv.org · HN · 30h ago · 30 pts
Google DeepMind announced AlphaGenome 2, the successor to AlphaGenome released last year.
- Announced November 11, 2026
- AlphaGenome Atlas covers all 9 billion possible single-letter changes in the human genome
- AlphaGenome 2: Deciphering how cells read DNA to better understand diseasedeepmind.google · Google DeepMind · 14h ago
- Google’s AlphaGenome 2 zooms in on the cellular roots of diseasetheverge.com · Theverge · 14h ago
AWS made NVIDIA Nemotron 3.5 Super VL available in SageMaker JumpStart.
- 120B parameters, 12B active per token (hybrid MoE)
- Context length up to 1 million tokens
- NVIDIA Nemotron 3.5 Super VL is now available in Amazon SageMaker JumpStartaws.amazon.com · Amazon · Nov 9
- Introducing usage-based pricing for Amazon SageMaker AI bidirectional streamingaws.amazon.com · Amazon · 14h ago
Google DeepMind announced Gemini 4 Carbon on Nov 10, 2026, available to developers, enterprises, scientists and consumers.
- Announced Nov 10, 2026
- Google says it ranks #1 on CursorBench 4.0, Perplexity's WANDR and Zapier's AutomationBench
- Gemini 4 Carbon is now availableblog.google · HN · Nov 10 · 293 pts · 164 comments
A Hugging Face blog post introduces BotPsy, an on-device personal assistant.
- BotPsy: On-Device Personal Assistant with a Sub-Billion-Parameter Agentic Language Modelhuggingface.co · Hugging Face · 24h ago
A Hacker News post links to a Qwen Cloud page titled Qwen 4 Max Preview.
- Token Plan for Individual starts at $3/month
- Page text names Qwen3.8-Max, not Qwen 4
- Qwen 4 Max Previewqwencloud.com · HN · 20h ago · 19 pts · 4 comments
Coding agents4
The Chrome team shipped Modern Web Guidance 1.0, a set of curated guides meant to steer coding agents toward modern web platform features.
- Version: 1.0
- 200+ guides, about 1.7MB
- Show HN: Get your coding agent off ~2019 JavaScript, onto modern web primitivesgithub.com · HN · 35h ago · 427 pts · 142 comments
- Modern Web Guidance 1.0: The web platform expertise your coding agent is missingdeveloper.chrome.com · HN · 6h ago · 28 pts · 5 comments
Addy Osmani's agent-skills repo on GitHub collects engineering skills for AI coding agents.
- addyosmani/agent-skills: Production-grade engineering skills for AI coding agents.github.com · GitHub · just now · 116k stars
JetBrains shipped Air in its IDEs with the 2026.3 release.
- Shipped with the 2026.3 release
- JetBrains IDEs Transformed for the Agentic Era of Development – With Airblog.jetbrains.com · Jetbrains · 19h ago
1 more in Coding agents
An agent skill for Claude Code and Codex that builds a playable three.js browser 3D action game, with a demo.
Claude / Anthropic1
A Yahoo Finance item reports Anthropic says a key AI safety alarm has been triggered, days before its IPO.
- Anthropic says a key AI safety alarm has been triggered, days before its IPOfinance.yahoo.com · HN · 11h ago · 15 pts · 11 comments
Tools / repos5
AWS released AWS Emulator, a free tool for download that simulates 200+ AWS services locally.
- Simulates 200+ AWS services locally
- 29,684 commits in the first three weeks, per Simon Willison
- AWS Emulator and the engineer's job when agents write the codeallthingsdistributed.com · HN · 10h ago · 111 pts · 2 comments
- AWS Emulator: 100% built by agentsaboutamazon.com · HN · 11h ago · 10 pts
New GitHub MCP servers cover Windows Sandbox, Roblox Studio, Blender, Yandex Metrika and 3D asset search, for clients such as Claude and Cursor.
- shanselman/sandbox-mcp: Fresh, throwaway Windows machines for testing your apps: an MCP server and CLI that automate Windows Sandboxgithub.com · GitHub · Nov 6 · 413 stars
- gogoymh/auto-ontology-mcp: NVIDIA Auto Ontology's semantic layer and a personal knowledge base as an MCP server for Claude, ChatGPT and other MCP clients. No LLM API key needed.github.com · GitHub · Nov 6 · 374 stars
A Hacker News post links to an Atuin blog post titled Atuin Threads, which the title says syncs agent sessions across every machine.
- Atuin Threads: All your agent sessions on every machineblog.atuin.sh · HN · 15h ago · 202 pts · 77 comments
2 more in Tools / repos
A Launch HN post says YC F26 startup Pomerado turns any website into an MCP for agents.
- Launch HN: Pomerado (YC F26) – Turn any website into an MCP for agentsnews.ycombinator.com · HN · 12h ago · 51 pts · 40 comments
A Show HN post presents Klad, a source-available paint app written in Rust.
- Show HN: Klad, a paint app your coding agent can drive (source-available)github.com · HN · 13h ago · 75 pts · 30 comments