CoreWeave, Nebius and Nscale have been effectively shut out of the bond market, with CoreWeave's secondary-market yield jumping from a 9.75% coupon to 15.78% as S&P cut Meta's credit outlook to negative, even as Alphabet, Meta, Microsoft, Amazon and Oracle have together pledged over $3 trillion in AI capex; enterprise customer-service agent company Sierra announced ARR past $400M the same week, with its doubling time compressing from 6 months to 5; Anthropic disclosed that an unreleased research version of Claude autonomously found and chained five real-world critical vulnerabilities, leading to 62 patched Chrome CVEs; China's STAR50 index has crashed 40% in under four months, wiping out roughly $480 billion in market cap; and the MoLing MCP server disclosed a CVSS 9.6 critical flaw.
**T3 Code** (⭐ 22.6k) turns an iOS/Android/desktop app into a remote control surface for multiple coding agents at once — Codex, Claude Code, Cursor, Grok Build, OpenCode, Google Antigravity. **Lightpanda** (⭐ 36k) rewrites the headless browser from scratch in Zig; its own benchmark shows memory use at roughly 1/16 of headless Chrome and page-fetch time about 9x faster. **anthropics/skills** gained 2,300 stars this week alone, crossing 185.7k — a sign Agent Skills is moving from a Claude-only feature to a format other platforms share. On the release side, **Pydantic AI v2.64.0** ships four compatibility notes that change how failed retries surface errors and how server state crosses providers, while **Claude Code v2.1.316** announces the retirement of Opus 4.8 fast mode at the end of November.
Four things in Pydantic AI v2.64.0: (1) Breaking: a retrying transport that gives up now raises `ModelHTTPError` so fallback can take over, `Coder`'s tools turn off strict schemas by default, and `json-repair` becomes an optional dependency; (2) a new `ModelFallback` capability with a `sticky` option that stays on whichever fallback model just answered, plus a `prepare_model_request` hook and `RetryModelRequest`; (3) a new `BoxdSandbox` that bundles `Coder`, `Shell`, `FileSystem` and other harness capabilities into one boxd sandbox machine; (4) a new `ArtifactScanner` that screens `Memory` and `Skills` artifacts for safety.
GPT-6 Rosalind (API ID: `gpt-6-rosalind`): OpenAI published a system card addendum on 2026-10-30, with the model landing on the official pricing page on 2026-11-01. It runs on identical weights to GPT-6 Astra — no new training data, no extra post-training. The only differences are a relaxed biosafety refusal boundary and a trusted-access gate. Pricing is $15.00 input / $75.00 output per 1M tokens (cached input $1.50; $30/$112.50 above 272K input tokens) — 1.5x Astra's $10/$50. MedChemBench v7 scores 49.6%, GeneBench Pro v13 37.7%, and LifeSciBench Gold 61.3%, all more than double GPT-Rosalind-5.5's numbers. But on the sensitive-biosecurity safety grader it only passes 79.0% of the time, well below Astra's 99.8% — the extra correct answers come from answering more, not from being smarter.
CVE-2026-62863: MoLing (a file-ops and browser-control MCP server) ships /sse and /message endpoints with zero authentication when started in SSE mode (`-l` flag), and its mcp-go dependency sets Access-Control-Allow-Origin: * on every response. Any page the victim visits can open an EventSource to /sse, read the leaked sessionId, and replay it against /message to invoke whatever MCP tools are configured — file read/write, shell commands, or browser control. Binding to 127.0.0.1 doesn't help, since the attack runs from the victim's own browser. Fixed in v0.5.0 with bearer-token auth and a CORS-stripping middleware.
mcp4mail is an MIT-licensed, self-hostable MCP server that lets an AI assistant read and search your IMAP mailbox over OAuth 2.1. Install: `docker compose up -d` (or just use the hosted instance at https://mcp4mail.online/mcp). It solves two problems: handing your IMAP password to some third party just so an agent can read mail, and rewriting the same mailbox-access glue code for every project. Every write action — sending, deleting, moving mail — is off by default; the mailbox owner has to switch each one on individually, and sending still requires a human to press Send before anything actually goes out.
CoSA shows individually-safe agent skills composed together push policy violations from 35.02% to 58.45%; the Trust Region Effect paper finds GPT-5.4 is 2.6x more likely to obey an injected instruction in a README than in a code file; PCM uses cryptographic evidence so one agent can no longer talk another into a lie, cutting lie-acceptance from 70.8-100% under existing protocols down to 1.4%
Wired exposes a defense contractor whose personal Claude Code agent ran on the Pentagon's classified NIPRNet for two months, auto-exfiltrating credentials and network topology; Cursor's VS Code marketplace is hit again by a tampered Claude Code extension, exposing up to 5,000 users; CrowdStrike reveals Chinese state-sponsored hackers using AI models including DeepSeek to attack over 200 organizations; Google DeepMind's Gemini 4 Carbon tops the new Artificial Analysis Intelligence Index v5, whose rescoring knocks Kimi K3.1 Pro from 4th to 9th; Cohere kicks off its Series E initial close, targeting up to C$7B
**CopilotKit/OpenBot** (⭐ 8,639) gives each AI coworker its own sandboxed computer — every browser, file, or MCP action has to clear a CEL policy gate and get logged to an audit trail before it runs, and any AG-UI agent (LangGraph, Mastra, CrewAI, and more) can plug straight in. **HKUDS/nanobot** (⭐ 49,682) packs a personal agent into a core small enough to actually read end to end, with built-in long-term memory and a dozen chat-channel integrations. **0xPlaygrounds/rig** (⭐ 9,027) bundles a Rust LLM library and a full coding-agent harness that plugs into editors like Zed into the same crate. On the release side, **Claude Code v2.1.314** adds `permissions.blockWritesOutsideWorkingDirectories`, enforcing write-path boundaries across every permission mode, plus idle conversation compaction and a batch of fixes.
Today's paper is Continual Learning Exam (arXiv:2610.33956, published 2026-10-25). It uses 120 five-level task chains across 89 professional roles to test whether agents can actually reuse what they learned in earlier tasks. The strongest system only clears 47.7% of levels, completes all five levels on just 23.3% of tasks, and feedback plus one revision only lifts the median completion rate by 5.3 percentage points. The practice question simulates an interviewer handing you a result where single-task scores are high but multi-step-chain performance is much lower, and asking you to figure out whether the model can't learn or the evaluation itself conflates 'remembering' with 'applying.'
Bites raised a $40M Series A led by PeakSpan Capital, bringing total funding to $55M. The signal: not every dollar in this AI funding wave is buying an autonomous agent — a good chunk of it is buying generative AI that redoes work companies used to pay humans to produce. That kind of company has a lower technical bar, but the market it's chasing is enormous.
Broccoli AI raised a $30M Series B, plus a previously undisclosed $22M Series A — $52M across both rounds — with Khosla Ventures leading both. The signal: the next battleground for vertical agents isn't another coding agent, it's going deep into blue-collar, small-business markets and becoming a plumber's or HVAC tech's ghost office employee.
Phonic raised a $27.5M Series A led by First Round, bringing total funding to $31.5M, and launched its speech-to-speech model Phonic-1, which beat GPT-Live-1, Grok Voice 3, and Eleven v4 Turbo in blind listening tests — though it still loses to human voice actors. The signal: voice agents are shifting from stitched-together pipelines to native end-to-end models.
SenseNova Loop-9B-Preview (`sensenova/SenseNova-Loop-9B-Preview`): released 2026-10-30 by SenseTime under Apache 2.0. Of 32 distinct decoder layers, layers 4-27 share weights and run twice (56 total layer executions), paired with two-stream mHC (Manifold-Constrained Hyper-Connections) managing two residual streams. Training sequence length tops out at 262,144 tokens. An official ablation shows mHC alone adds +4.42 points on GPQA Diamond and +13.34 on TeamBench. It beats the 3x-larger Qwen3.5-27B on WorkBuddy Bench (66.9 vs 60.5), AutomationBench (13.7 vs 10.2), and RaccoonPPT Bench (70.7 vs 59.1), but trails on Terminal Bench 2.1 and T³-Banking. Open weights only, no official API or pricing.
Microsoft Foundry's model retirement schedule doesn't track the vendor's own clock. Claude Haiku 4.5 is scheduled to retire on Foundry on 2026-11-15 (two weeks out, with no replacement listed), even though Anthropic's own Claude API, AWS, and Google Cloud still mark it Active. The reverse happened with Mistral Medium 3 (retired on Mistral's own platform 2026-08-31) and Ministral 3B (retired 2025-12-31): Foundry kept both at GA until 2026-12-09, 100 and 343 days after the vendor pulled the plug. Anthropic's own docs say Foundry "follows the Claude API lifecycle schedule," but the actual dates don't match.
Today's skeleton has two layers: first use 'five independent lines' to pull a one-sentence technical requirement apart into five dimensions that can't substitute for each other — access, throughput, budget, quality, and reliability — so you don't describe 'adding a warning' as if it were 'hard enforcement.' Then use 'atomic reservation, then reconcile' to handle the race condition when concurrent requests compete for the same limited resource: a naive implementation has each request read the balance separately and approve independently, which over-authorizes spend; the correct approach collapses the check and the lock into one atomic step, blocking the second request, then reconciles the difference and releases the remainder once the first request actually settles. The practice question is a PracHub exercise adapted from OpenAI's 'Product Manager, API Infrastructure' job posting: with $12 of remaining authorization and two requests each needing an $8 reservation, a naive system approves both and ends up authorizing $16 against $12. The walkthrough shows defining 'warning' and 'hard block' as two different products, using atomic reservation to handle concurrency, then measuring success with a small rollout and reconciliation accuracy. The case study is Stripe's idempotency key mechanism, published in 2017: sending the same idempotency key again within 24 hours returns the result of the first request instead of charging again — the same underlying principle as today's race-condition problem — and Stripe's current documentation still states explicitly in 2026 that a conflicting concurrent execution does not get its idempotent result saved.
Attackers published a tampered build of the official anthropic.claude-code extension — version 2.1.313 — under its legitimate publisher ID on the Cursor Marketplace, inserting a roughly 66-line malicious loader ahead of the real extension code. The payload planted an SSH key, tried to open a reverse tunnel, and beaconed host details home, but a coding bug in the malware broke the SSH-enable step on most macOS and Windows hosts. Cursor pulled the package, took the attacker's server offline, and published remediation scripts; the real fix isn't trusting a matching publisher ID — it's hash-pinning extension versions and limiting what they can reach.
gitai (the repo is called git-ai) is an MIT-licensed open-source CLI and server that independently reimplements the design Anthropic publicly described, but never open-sourced, for its internal version control system Scion: each agent's change is a changeset, landing happens through compare-and-swap instead of a merge queue, and conflicts can be auto-resolved by an LLM or a rule-based resolver — but only after your configured verify.command passes on the exact tree that would land. Install: `git clone`, then `make build` (needs Go 1.26, a C toolchain, Meson, and Ninja). A benchmark with 50 agents landing at once shows roughly 5x the throughput of a classic setup.
TrawMem reframes memory retrieval from semantic relevance to task-oriented roles, beating SimpleMem's LLM-Judge score by 4.07-4.31 points; DiscernMem splits memory repair into defect correction and boundary learning, gaining 0.51-4.32 points across three multi-agent frameworks; EMMA treats an entire multi-agent system's configuration as correctable memory, beating four existing self-improvement frameworks by up to 32.5% across five backbones
Cursor's Agent SDK goes GA, defining agents as locally testable code projects deployable to cron, Slack and more; LangChain reveals over 70% of Managed Deep Agents runs are schedule-triggered, not human-prompted; Google's Gemini 4 Carbon (cyber-defender-only) debuts at #2 on the Arena Agent leaderboard; a chained PHP2Shell/Fragnesia exploit breaches 25 PAN-OS firewalls, leaving Claude Code and DeepSeek/Kimi usage traces at the scene; Cohere, Serval and Wabi each announce funding rounds the same day as capital accelerates into enterprise automation and sovereign AI