openai just partnered with hacktron to hunt vulnerabilities in openai's own systems
they met them through the bug bounty program, liked the holes they kept reporting, and now theyre giving the team broader acess to frontier models through daybreak red. focus is how openai's stack talks to third-party services
so the people who kept finding bugs just got handed a bigger flashlight. seems about right
day 9 without the projects beta feature on my main claude account
my 3-year max 20x still does not have the new projects feature. my three newer max 20x accounts, about 2 months old, already do. please anthropic fix it
@bcherny @claudeai @AnthropicAI
Google's Agent Development Kit 2.14 just made agent-to-agent communication a stable API.
my notes:
1. Upgrade to google-adk 2.14.0. The 4 November 2026 changelog graduates A2A from experimental.
2. Run adk generate_agent_card to build an A2A agent card from the CLI.
3. Expose an agent with adk api_server --a2a so another agent can call it over the protocol.
4. Local, Daytona and E2B execution environments left experimental in the same release.
5. A 30-node workflow running 200 turns is 23% faster and uses 9% less peak memory than before.
github.com/google/adk-python…
Thinking Machines just shipped Inkling 2 Small. People are already calling it an open-weights model. The weights are still closed.
It is a mixture-of-experts model with 594 billion total parameters and 17 billion active, plus image input and variable effort. You can use it on Tinker today. They intend to release the full weights under Apache 2.0 after external safety testing and red-teaming, which their 5 November post said would be this coming week.
What I took from the write-up:
1. It scores 30.6 on the Artificial Analysis Intelligence Index v5.0.
2. In one internal demo it trained Qwen3.5-4B on Tinker to forecast time series, spent $426 of a $500 budget in 4 hours 17 minutes, and lifted the skill score from 0.191 to 0.289.
3. The first pre-training phase used 8.4 trillion tokens in 68 hours on NVIDIA GB300 NVL72 racks, natively in NVFP4.
4. Checkpoints become downloadable when the weights go out, not before.
Until then it is a strong closed model with an open license on the calendar.
thinkingmachines.ai/news/ink…
openai just raised another $11 billion at a $1.25 trillion valuation. they were aiming for $30 billion at $1.4 trillion, so this is teh modest version. i still cant hold those numbers in my head
Claude Code 2.1.319 added an "Earlier in this session" row to /tasks. It lists finished subagents so you can reopen one and message it, even after it leaves the live list or you restart.
my notes:
1. Run /tasks (also available as /bashes) to view and manage background work in the current session, including subagents that have finished.
2. Look for the new "Earlier in this session" row. That is where finished subagents show up once they drop off the live list.
3. You can reopen one of those finished subagents and send it another message, including after a restart.
4. /tasks runs immediately and does not interrupt Claude's current response, the same as /status and /usage.
5. Check you are on 2.1.319 or later with claude --version. This row arrived in the 6 November 2026 release.
code.claude.com/docs/en/chan…
ramp says companies burned way more tokens in aug and sept but token spend grew only 1.5%
prices keep droping faster than we can waste them. cfos finaly sleeping
Claude Personal Finance is rolling out in beta. US only, Pro, Max and Ultra.
How it works:
1. Personal Finance in the sidebar (under More if hidden), Get started, Link accounts with Plaid
2. Read-only. It can't move, manage or invest money, and never sees your bank password
3. Claude sees account names, last four digits, balances, credit limits and up to 24 months of transactions
4. Chats inside the Personal Finance hub are not used for training
5. Linked accounts don't work in scheduled tasks, Cowork or Claude Code
Tip: if your bank writes a full account number into an account name or transaction description, Claude can see it there.
Europe waits, as usual.
support.claude.com/en/articl…
AI agents just found two new weaknesses in RSA. Only in the retired 1024-bit kind, and that is exactly why it matters.
Google DeepMind's science team ran the agents, guided by cryptographers Nadia Heninger (UC San Diego, Inria) and Emmanuel Thomé (Inria).
What I took from it as a builder:
1. Signatures: once an attacker controls about half of the padded block, PKCS#1 v1.5 padding adds no protection at 1024 bits.
2. Two cooperating agents reran a known 1024-bit forgery in 391 CPU core-years, 3.5x less than the original run, and set it up and debugged it in under four days.
3. Batch factoring: after one big precomputation, each extra 1024-bit key costs about 30x less. Theoretical estimate, nothing built yet.
4. The 1,600x figure for short 32-byte digests is also an estimate, not a completed run.
5. The algebra in the second paper was checked in Lean 4, one model writing proofs and another verifying them.
RSA-2048 and larger are not affected. What stays with me is the pace: humans steering agents, results in weeks.
teapaw.org/pushmeet/status/211875…
anthropic taught claude to dream so it can clean its own memory notes
in pokemon it put the pokecenter on the wrong side of mt moon and kept falling off a ledge. dreaming caught it. my notes still blame the map tho
day 8 without the projects beta on my main claude account
3-year max 20x still missing it. three newer max 20x accounts from about 2 months ago already have it. please anthropic fix the rollout
@bcherny @claudeai @AnthropicAI
Anthropic's agent-memory "dreaming" tip (research preview, Managed Agents)
Between sessions Claude can re-read transcripts offline: fix bad notes, merge duplicates, build a wiki, and promote what should load next time.
my notes:
1. Dreaming does not edit the input store. It writes a new store you review and attach, or discard.
2. Needs beta headers managed-agents-2026-04-01 and dreaming-2026-04-21. Not a Claude Code CLI switch.
3. Steer with high-level instructions (what to keep / ignore), not line edits. Targeted fixes go through the Memory Stores API after.
4. Claude Code auto-memory still only injects the first 200 lines / 25 KB of MEMORY.md. Dreaming is how you keep that header small.
5. Start with a small session batch. Cost scales with transcript length at normal API rates.
anthropic.com/research/compo…
metr says anthropic is making ai progress about twice as fast now, partly because ai is helping people write the next models
the catch: most of the ~100-page evidence is redacted. so the warning is public, the recipts are not. classic
Claude Enterprise inference hooks are generally available now.
Two kinds, both GA:
1. Prompt hooks send the prompt to your security tool before generation starts
2. Pre-tool-call hooks check tool calls before they run (skills, plugins, connected tools included)
Your org hosts a public https endpoint on port 443. Anthropic posts a signed request; your server returns allow or deny. One org-level setup covers Claude chat, Claude Code, and Cowork. Start in shadow mode to log verdicts without blocking, then switch to enforcing when the policy looks right.
Owners and Primary Owners only (organization:manage). The security center that compares your settings to Anthropic's recommendations is still beta.
claude.com/resources/article…
Google shipped Gemini Omni 1.2 Flash for video generation. Clips go to 15 seconds now, up from 10 on 1.1. Price dropped 30% to $0.07 per second at 720p.
What changed in my builder workflow:
1. Duration is selectable from 3 to 15 seconds in one-second steps, so a product spot can finish in one generation instead of a cut montage.
2. Multi-turn edits let you swap a product, background, lighting, or aspect ratio on the same clip without regenerating from scratch.
3. Reference adherence is tighter. Faces, garments, packaging type, and brand colors hold across camera angles when you feed character or product stills plus short motion clips.
4. Draft cheap at 360p or 720p, lock the take, then upscale to 1080p or 4K. Outputs carry a SynthID watermark.
Google still flags fast sports, rapid script changes, and complex physics as weak spots. For catalog spins and social ads, this is the first Omni release marked generally available on the Gemini API and Google Cloud.
blog.google/innovation-and-a…
openai priced gpt-6 cyber at $20 in / $100 out per million tokens
so the model that finds your vulns costs more than the one that writes your bugs. feels abotu right tbh
vercel-labs/agent-browser: a browser CLI built for AI agents (Apache-2.0, Rust)
one shell command per step. open a page, snapshot -i for refs like @e1, click @e1, then get url. the browser stays open between commands through a background daemon.
my notes:
1. refs describe the page at snapshot time. after any navigation or DOM change, take a new snapshot before you reuse them.
2. clicks fail loudly when the target is covered, hidden, disabled, or offscreen. a cookie banner over the button is an error, not a silent miss. dismiss it, resnapshot, retry.
3. skills ship with the binary. run `agent-browser skills get core` so the agent reads instructions that match the installed CLI version, not a stale doc.
4. one daemon per --session. idle headless sessions exit after an hour by default. set that before you leave ten browsers running overnight.
5. you also get mcp, webmcp, and debug commands (console, errors, trace, vitals) at the same layer as click. start with the CLI loop before you wire MCP.
github.com/vercel-labs/agent…



