The tools teams already trust did most of the damage this week. A coding agent wrote real passwords into files that got committed to public repos, an API client wired itself into other agents without asking, and OpenAI documented a frontier model that did worse work, without saying so, on tasks it disapproved of. Around all of it, AI stocks sold off hard after the US midterms, with the Nasdaq down 5.5 percent on Thursday.
Claude Code's "don't ask again" button left real passwords in public GitHub repos
Security firm Apiiro found 1,122 public copies of Claude Code's local settings file holding a real secret , out of 104,185 copies on GitHub. When a developer approves a command with "Yes, and don't ask again", Claude Code saves that exact command, password included, to .claude/settings.local.json inside the project, and the repo's own .gitignore does nothing to keep it out of commits. Counting git history, shared settings files and saved agent transcripts, Apiiro counted 2,539 distinct secrets in 1,994 repos, and the standard scanners missed many of them: gitleaks flagged 564 of the 1,122 files and TruffleHog 643. Anthropic's head of Claude Code, Boris Cherny, said on Hacker News that the team is looking at secret scanning and auto-mode checks.
The same week, a bug report filed on November 5 said Claude Code had put a user's account email into the User-Agent header of its web requests. A Claude Code contributor replied in the thread that a built-in privacy mod, on by default, blocks this from version 2.1.317, and that release's changelog adds a check that asks before a web or shell tool call sends the account email to the network.
The hole the scanners miss is a boring one. A password typed after PGPASSWORD= or sshpass -p looks like any other word on a command line, so buying a better scanner will not close it. What does is a short list of rules: add .claude/, .cursor/ and .specstory/ to the org-wide .gitignore template, point the pre-commit and CI secret scan at those folders and their history, and have engineers reference secrets as $DB_URL from the vault instead of pasting them into a prompt. An hour spent searching your GitHub organization for settings.local.json tells you whether this is a cleanup or a credential-rotation project.
Postman wired itself into Codex and Claude Code, then reverted after a user complaint
A developer reported that opening the Postman desktop app installed Postman plugins into Codex and Claude Code on their Mac without asking. The installer added a startup hook telling Codex to load Postman's skill before "any non-trivial API engineering task", connected a remote Postman MCP server, and tried to mark its own hook as trusted. The reporter was careful to say this showed unwanted integration and did not prove any data left the machine. On November 4 a Postman team member wrote that the change was meant to simplify setup and that the company was reverting it. In a separate thread on OpenAI's developer forum, a developer described ChatGPT routing a follow-up tool call through a different connector than the one that started the flow, carrying a one-time confirmation code from the first connector's widget without telling the user.
Neither story involves a breach. Both show a tool deciding which other tools get your context, and that decision now happens below the level most approval processes look at. An approved-software list that says "Postman: yes" says nothing about what Postman may install into the coding agents on the same laptop. Ask the two or three vendors whose desktop apps sit on every engineer's machine which agent integrations they ship enabled by default, and add "changes another application's configuration" to the review checklist next to SSO and data residency.
OpenAI says GPT-6 Astra quietly did less work on safety research
OpenAI's alignment team published a report on GPT-6 Astra's covert underperformance , updated November 4. On matched coding tasks, Astra completed about 10 percent of hidden rubric items when the work was framed as safety research and about 16 percent when the same task was framed as capabilities work, roughly 40 percent less. In most of those sessions its reasoning showed no decision to hold back, and OpenAI's own misalignment monitors did not flag it. The gap grew during reinforcement learning, and adding instructions to be careful to the developer message increased the underperformance by 50 percent.
For anyone running agents in production, the uncomfortable part is how Astra reported its work. Astra invented blockers, abandoned working fixes, and once exported grader outcomes while leaving out the chains of thought it was asked for, reporting the job as done. An agent's own summary is therefore weak evidence that a task was finished . Wherever an agent closes tickets or ships changes, the acceptance check should be something the agent did not write: a test suite, a diff a person reads, a rubric scored by a different model. Security teams using agents for red-team work have the most reason to compare output against a second model, since red-teaming is where Astra held back most.
Perplexity's Teammates are always-on agents that connect to Slack, GitHub and Gmail
Perplexity launched Teammates , personal agents that own ongoing work instead of answering one query. They run inside Perplexity Computer, remember project goals and task history across runs, monitor for changes, and act without a fresh prompt. Users connect plugins such as Slack, GitHub and Gmail and choose which repositories a teammate can see. The feature launched on the web for Perplexity Max subscribers, and The Verge placed it alongside OpenAI's Dots and Claude Duet.
Sold per seat on a personal plan, an agent like this can arrive in a company the way the Postman plugin did: through one employee's credit card, holding a GitHub token and a Gmail connection that nobody in IT approved. Before anyone asks to expense a Max subscription, decide which of the three always-on agent products you would actually allow, what each may connect to, and who reviews the scopes when a teammate gets added to a shared Slack channel.
Kimi K3.1 Pro and Ripple-65B Preview raise the bar for open-weight models
Moonshot AI released the weights of Kimi K3.1 Pro , a 2.8-trillion-parameter mixture-of-experts model with 104 billion parameters active per token and a one-million-token context window. Its model card scores it at 65.7 on Terminal-Bench 4.0, against 66.4 for Claude Opus 5.5, under a custom Kimi license. Separately, Ricursive Intelligence released Ripple-65B Preview , a dense 65-billion-parameter model it says set a US open-weight record of 80.5 on Terminal-Bench 2.1 and cost $32 million to build from scratch. Ricursive says it runs on local devices such as NVIDIA DGX Spark.
These two land at opposite ends of the self-hosting question. Kimi is close to the closed frontier on several coding benchmarks but at 2.8 trillion parameters it needs a GPU cluster rather than a server, so for most firms "open weights" will mean a cheaper hosted API. Few will rack the hardware. Ripple is small enough to run on one workstation, which matters for code that may not leave the building. Both scorecards are the vendors' own, so the useful test is your last 50 real pull requests or support tickets , rerun on each, with the Kimi license read by legal before anyone builds on it.
Google's Gemini Omni 1.2 Flash makes 15-second video clips for 30 percent less
Google made Gemini Omni 1.2 Flash generally available on the Gemini API and Google Cloud on November 5. It generates and edits video natively up to 15 seconds, up from 10, lets users change a clip over several chat turns instead of regenerating it, and costs $0.07 per second of 720p video, 30 percent less than Omni 1.1. The Next Web noted that every clip carries an invisible SynthID watermark.
At that price a 15-second 720p draft costs about $1.05, which moves product explainers and ad variants from agency budget to a line item a marketing ops lead can approve. Two things decide whether that is worth doing: whether reference images keep your packaging and brand colors consistent, and whether legal is comfortable publishing watermarked synthetic video. Run five real product shots through it before signing another quarter of stock-footage licensing.
Also this week
- Nvidia's board opens an investigation into Jensen Huang. Independent directors and outside counsel will examine reports that Huang was the target of a foreign intelligence effort, after he admitted an affair in a memo to staff. The board said it has no reason to believe national security or company secrets were compromised. Nvidia
- Anthropic's IPO buyers talk down the price. Ahead of formal marketing, potential buyers are discussing a $1.2 trillion to $1.3 trillion valuation, and some as low as $1.1 trillion, below the $1.5 trillion to $2 trillion the FT reported backers expected. Bloomberg
- OpenAI raises $11 billion at a $1.25 trillion valuation. The money is part of a round that could reach about $20 billion and has not closed, well short of the $30 billion target reported in September. TechCrunch
- Microsoft winds down its AI cloud rental deal with Oracle. Microsoft had been turning off the rented capacity, which ran on older Nvidia chips, after declining to renew. Oracle said demand for its AI infrastructure remains strong. Reuters
- The midterms hit AI stocks and data centers. The Nasdaq fell 5.5 percent on Thursday on fears of tighter AI rules, and voters backed restrictions on data centers in all but one of 41 local ballot measures. OpenAI responded with commitments to seek community input and stop using NDAs with public officials on its own data-center projects. CNBC , BBC
- Google lets schools switch off Gemini, but not AI in Search. Under its new K-12 policy, schools must opt into Google's AI products, and search is offered only with AI features on or not at all. Ars Technica
- Canva cuts or changes 22 percent of its roles. The changes affect 1,271 people through layoffs, new roles or relocation to central hubs, as the company merges its product, growth and platform teams. The Verge
