AI News Brief 2026-11-14
Claude Fable 5.2, Gemini 4 Hydrogen, Agent-Built AWS Emulator#

This brief gathers AI technology news worth checking today, along with changes in developer tools, open source, infrastructure, and organizations in the AI era. It covers news published from November 7 to November 14.

The keyword for this period is verification. Several companies published, in the same week, how they replace a human reading every line of agent output with tests, merge gates, formal proofs, and solvers, and other posts showed what happens when those safeguards are missing. The items I found most practical are the third and sixth entries under Top News. Microsoft Ignite takes place next week, so it will be covered in the next brief.

Quick Summary#

• Anthropic released Claude Fable 5.2 and Mythos 5.2, cutting prices to $8 input and $40 output per million tokens, but with breaking changes around reusing thinking blocks and the computer use tool.
• Google made Gemini 4 Carbon generally available and launched Gemini 4 Hydrogen, a cheaper execution model, and is now pushing a setup where Carbon plans and Hydrogen writes and verifies within one session.
• AWS released AWS Emulator, which mimics more than 200 AWS services locally, and said “our team hasn’t written or reviewed any of the code.”
• Anthropic shared an internal experiment where 1,000 agents, coordinated only through Git and a shared database, finished formalizing Fermat’s Last Theorem in 28.7 hours.
• Google DeepMind used AlphaProof Code to formally verify the compiled code of Signal’s cryptographic protocol over four weeks, with only 1% of the code flagged for a second human look.
• Amazon moved internal ticket classification from Sonnet 4.6 to a small decision model and cut per-ticket cost by 98%, in the same week Google and Perplexity launched decision models of their own.
• Cursor published its final report on a security incident that began with an access key exposed by a partner, moved through credentials left in agent traces, and ended with a poisoned extension marketplace.
• Git 2.56.1 fixed six vulnerabilities, including one where simply cloning a malicious repository recursively could run code.
• In the second amendment to its IPO filing, Anthropic changed its wording to say it had “made a determination that we have met” its AI R&D capability threshold.
• Secrets saved in Claude Code’s “don’t ask again” allow rules were found in more than 23,000 public repositories.
• A tracker found more than 37,000 AI-reported vulnerabilities but only 217 marked fixed, and PostgreSQL shipped a security release fixing 52 CVEs at once.

Top News#

Claude Fable 5.2 / Mythos 5.2 — Lower Prices, More to Check Before Switching#

• What happened? On November 9, Anthropic released two versions of the same underlying model. Claude Fable 5.2 (claude-fable-5-2), open to everyone, carries stronger cyber and biology safeguards, while Claude Mythos 5.2 is available only to organizations that pass Anthropic’s security and life-sciences verification programs. Pricing dropped to $8 input and $40 output per million tokens, down from $10 and $50 for 5.1, and fast mode, with up to 2.5x faster output, costs $16 and $80. The context window is 1 million tokens, max output is 128k tokens, and it scored 69.9% on FrontierSWE v2, above Opus 5.5 (62.3%).
• Why does it matter? The release notes list several breaking changes. If your code edits the system prompt, tool list, or an earlier message and then sends back a thinking block (the record of the model’s reasoning) from a later turn, the request returns a 400 error, and the computer use tool now accepts only the new computer_toolset_20260801. Thirty-day data retention is required, so accounts under a zero data retention (ZDR) agreement cannot use the models without separate approval.
• Watch point If your agent trims and resends conversation history mid-session, read the migration docs before swapping the model ID. I also plan to look at the model selection guide the official Claude channel published the same week.
• Source: Read the source

Gemini 4 Carbon Goes GA, Gemini 4 Hydrogen Launches — Planning and Execution Go to Different Models#

• What happened? Gemini 4 Carbon, which Google first opened only to security defenders in late October, became available to developers, enterprises, and consumers on November 10. The introductory price is $2 input and $10 output per million tokens, rising to $4 and $20 after November 30. On November 12, Google launched Gemini 4 Hydrogen, a fast execution model priced at $1.50 input and $7.50 output across the full 1-million-token context, which scored 57% on Terminal-Bench 4.1, well above the previous Flash model (18.2%). Google’s agent development tool Antigravity gained an Orchestrator that switches between the two models within one session, and Google says it reached success rates close to Carbon alone while using 24% less quota and finishing 19% faster.
• Why does it matter? The setup where an expensive model handles design and coordination while a cheap model writes and tests code is becoming a model provider’s default rather than one team’s trick. With Carbon’s price doubling in December, deciding which work goes to which model becomes a direct cost question.
• Watch point GitHub Copilot will also retire Gemini 3.8 Flash and Gemini 4 Argon on December 14, replacing them with Hydrogen and Carbon, so update any workflows that pin those models ahead of time.
• Source: Read the source

AWS Emulator — An Official Tool Whose Code No Human Wrote or Reviewed#

• What happened? On November 11, AWS released AWS Emulator, which starts from more than 400 AWS API models and mimics more than 200 services offline on your own machine, for free and under the CC0 public domain dedication. The agents work in three teams. One writes customer-scenario tests and confirms they pass against real AWS, one replays those tests against the emulator and files failures as issues, and one makes one fix per issue and passes it through a merge gate (an automated checkpoint a change must pass before joining the main code) covering build, code review, security review, and fidelity to real AWS. In a separate post, Amazon wrote, “Our team hasn’t written or reviewed any of the code,” and behaviors that still differ from real AWS are published in a dedicated folder in the repository.
• Why does it matter? Instead of human review, the project defines “correct” against an external reference, real AWS, and lets tests and gates enforce it. The post frames the engineer’s job as shifting from writing code to designing specs, tests, and merge gates.
• Watch point This approach works when there is a reference you can check answers against mechanically, like real AWS. It is also worth reading next to one of the week’s most discussed community posts, a contrary account arguing that AI usage generates a fragile codebase.
• Source: Read the source

Anthropic — A 1,000-Agent Team Coordinated with Only Git and a Shared Database#

• What happened? On November 9, Anthropic’s developer blog described an experiment in which an early version of Fable 5.2 ran one lead agent and 999 helpers to formalize the proof of Fermat’s Last Theorem in Lean. A September effort, directed by researchers with dozens of agents, took 11 days; this time, with no human direction, it took 28.7 hours, used one-third as many output tokens, and produced a proof one-seventh the length. Instead of dedicated collaboration tools, each agent got its own Git branch and a shared Postgres database with five tables (announcements, assignments, notes, subtasks, and a log of finished work), and about 750 helpers split the hardest theorem into 2,418 tasks up to 10 levels deep.
• Why does it matter? The safety design is specific. Each agent ran in a virtual machine with no network access, and an LLM classifier checked every shell command and file edit before it ran, blocking anything it could not clear (fail-closed); across more than a million tool calls, none met the bar to be blocked. Meanwhile, the helpers initially judged 47 of 60 statements infeasible within budget, and the lead needed 19 automatic time reminders to keep going.
• Watch point The failure log, where a single shared machine hit memory and disk limits at around 100 agents, and the observation that agents give up too early, are especially useful for teams designing multi-agent systems.
• Source: Read the source

AlphaProof Code — Formally Verifying Signal’s Compiled Code#

• What happened? On November 10, Google DeepMind announced AlphaProof Code, in which humans decide what to prove and agents built on Gemini Carbon produce the proofs, and used it to formally verifythe compiled code of the Signal messenger’s cryptographic protocol. Over four weeks it produced more than six million lines of Lean, and the agents flagged only 1% of the codebase for a second human look. When researchers reintroduced two real, previously fixed bugs, the system produced a proof that the buggy version was insecure in both cases, and the verification artifacts have been open-sourced.
• Why does it matter? With agents taking on the labor of writing proofs, formal verification is starting to move from a few research projects to code that actually ships. Google’s developer blog post the same week, Catch Go bugs that fuzzing misses with Gemini and a constraint solver, follows the same pattern: the LLM only translates conditions into formulas, the solver (Z3) makes the call, and go test reproduces each crash, producing bug reports with no false positives.
• Watch point Both posts use the structure “a machine, not an LLM, checks what the LLM wrote.” The Go post is detailed enough to reproduce at no cost, and the author clearly states its limit: failing to find a bug means only “maybe correct.”
• Source: Read the source

Decision Models — A Model That Only Chooses, and a 98% Cost Cut#

• What happened? On November 9, the team behind Strands, Amazon’s open-source agent framework, described moving the job of sorting tickets from one of Amazon’s largest internal ticketing systems into 20 categories from Claude Sonnet 4.6 to a small Gemma 4-based decision model (a model that picks one of a fixed set of options and returns only probabilities). Time per call fell from 4,215 ms to 897 ms, and cost per ticket fell from about $0.0222 to $0.0005. A config switch provided three modes, the old model only, both in parallel, and the new model only, and the team reviewed every case where the two disagreed on real traffic before switching; rolling back takes 45 seconds.
• Why does it matter? The same week, Google launched the Gemini Decisions API, which answers up to 1,000 questions per request with probabilities and calibratedconfidence scores, at $0.10 per million input tokens and $0 for output, and Perplexity released Decider v1.3, an open-weight decision model under the Apache license. The trend is to pull the “choosing” that agents repeat constantly, such as tool selection, routing, and policy checks, out of large generative models.
• Watch point The Amazon post also notes a trap, where merely reordering JSON keys shifted probabilities by up to 0.19, and a limit, since it does not publish accuracy figures. I think the migration procedure of running both models in parallel and reviewing disagreements is the part most worth copying.
• Source: Read the source

[Follow-up] Cursor’s Final Security Incident Report — Credentials in Agent Traces Opened the Next Door#

• What happened? On November 13, Cursor published the final account of the malicious Claude Code extension incident in its marketplace, which the October 31 brief covered. An attacker used an access key that Cursor had issued to its inference partner Fireworks, and that Fireworks had exposed, to copy a data-sharing bucket containing 2025 coding agent traces from sessions not in Privacy Mode, and some of those traces held unredacted credentials. With those credentials the attacker reached SaaS tools Cursor uses, support email, and archived non-production repositories, then used another stolen credential to place malicious extensions in the marketplace cache for about 11 hours, where up to 5,000 users may have downloaded them. Cursor moved inference off Fireworks, rotated every internal credential, and added secret scanning across its repositories and data.
• Why does it matter? The traces an agent reads and writes while working easily retain keys and tokens that users pasted in. This incident shows step by step how those traces become an attack path once they are shared with a partner.
• Watch point Cursor’s guidance is that uninstalling the extension alone may not be enough if you installed the affected versions. Teams that store agent logs should treat that storage like a secrets vault.
• Source: Read the source

Six Git Vulnerabilities — Recursively Cloning a Malicious Repository Could Run Code#

• What happened? On November 10, the Git project fixed six vulnerabilities in Git 2.56.1 and backports down to 2.50.2. The most serious, CVE-2026-111760, is a number truncation while handling path length; recursively cloning a malicious repository with its submodules could run attacker-supplied hooks (scripts Git runs automatically on certain actions). The others include path traversal while cloning an empty repository, memory corruption when merging a tag with many signatures, and arbitrary file reads and writes through fast-import.
• Why does it matter? People rarely clone unfamiliar repositories, but agents often clone and merge repositories they have never seen while working. GitHub is already shipping patched Git to github.com, Codespaces, Actions, and the Copilot app.
• Watch point Check the Git version inside the sandbox images and CI runners where your agents run. Updating your local Git is not enough.
• Source: Read the source

[Follow-up] Anthropic’s IPO Filing — “We Have Met This Threshold”#

• What happened? On November 10, Anthropic launched its IPO roadshow and announced plans to list 825 million Class A shares on Nasdaq (ticker ANT) at $70 to $78 per share. The second amended registration statement filed the same day changed the language on the AI R&D capability threshold in its Responsible Scaling Policy (RSP), its internal safety policy: where the first amendment on November 2 said it “may imminently meet” the threshold, the new text says “we made a determination that we have met this threshold based on what we expect from future models and our overall rate of progress, rather than on what we have observed from current models.” It adds that Anthropic is evaluating the implications and “will release further reports in the future.”
• Why does it matter? The RSP is Anthropic’s internal rule requiring stronger security and safety measures once set thresholds are crossed, so this determination could affect how fast future models ship and who can access them. Nothing changes in the API right away.
• Watch point No related report has appeared on the RSP updates page yet. I plan to follow up in the next brief on what additional measures the promised reports include.
• Source: Read the source

Trends to Watch#

Secrets Left Behind by Claude Code’s “Don’t Ask Again”#

• Key points When you choose “Yes, and don’t ask again” for a shell command in Claude Code, the whole command is saved to .claude/settings.local.json as an allow rule, so an API key inside that command is saved in plaintext too. Security firm GitGuardian found 31,088 such secrets across 23,276 public GitHub repositories, 5,343 of which were still valid when detected, plus 613 in Docker Hub images. The causes: local Git ignore settings do not carry over to other clones, and Docker does not respect .gitignore.
• Why read it? A convenience feature meant to reduce permission prompts became a leak path. According to the report, the Claude Code lead acknowledged the issue and is exploring built-in secret scanning.
• Watch point The fastest response is to search your team’s repositories and published images for .claude/settings.local.json and to use environment variables instead of putting keys directly in commands. I checked this blog’s repository first.
• Source: Read the source

Finding Goes Up, Fixing Stays Flat — Seven Months of Tracking AI Vulnerability Discovery#

• Key points Vulnerability intelligence firm VulnCheck tracked Anthropic’s open-source security project Glasswing for seven months and found 37,966 reports in Anthropic’s ledger, 217 marked fixed, and 2 CVEs confirmed as exploited. As of September, Claude rated 91.5% of its reports critical or high, while maintainers rated 51.3% that way, and in curl, 19 of 34 published reports were judged not to be vulnerabilities. The same week, PostgreSQL shipped a security release fixing 52 CVEs and more than 140 bugs at once.
• Why read it? This is the numbers version of the Postgres 19 delay story from the previous brief. AI finds issues faster, but deciding whether they are real and fixing them still falls on human maintainers.
• Watch point As a post from a vulnerability intelligence firm, it may carry its own perspective, but it names its sources, Anthropic’s ledger and maintainer ratings, which makes it easy to cross-check. PostgreSQL 14 has reached its final release, and GIN indexes and others may need reindexing after the update.
• Source: Read the source

Fold Away Agent-Written Text and Lead with One Human Paragraph#

• Key points Simon Willison noted that PR descriptions written by Claude Code or Codex are accurate but so long that reviewers do not want to read them. He proposes putting only a short, human-written or human-approved paragraph on purpose at the top, wrapping the agent’s description in a collapsed <details> block, and labeling the summary line with the model and effort, such as “Claude Opus 5.5 Medium.” The same week, attendees of the AI Engineer Code Summit published the No AI Slop Manifesto, defining slop as “when we put less effort into producing something than we ask the consumer to spend understanding it.”
• Why read it? The manifesto commits to disclosing when an agent wrote something, having humans check the parts that matter, fixing linters and guardrails when the same mistake recurs, and not measuring performance by lines of code, PRs merged, or tokens spent. It signals that team norms for handling agent output are starting to be written down.
• Watch point Both are rules you can apply tomorrow. I plan to adapt Simon Willison’s format for commit messages in this blog’s repository.
• Source: Read the source

Putting GitHub Actions Lockfiles into Practice#

• Key points CPython core developer Hugo van Kemenade wrote up how to apply GitHub Actions workflow lockfiles, generally available since late October, to a real project. gh actions-lock replaces commit-hash pins with readable version tags plus a .github/workflows/actions.lock file, Renovate or Dependabot keep it updated, CI checks it with --verify, and zizmor v1.32.0 or later lints it.
• Why read it? Because tags can later be moved to point at different code, the advice until now was to pin to hard-to-read hashes. Lockfiles give you readability and pinning together, and alongside the default blocking of pull_request_target from the previous brief, they form the basics of CI supply chain defense.
• Watch point The post links real PRs applied to Pillow and CPython, so anyone running a public repository can follow along.
• Source: Read the source

Anthropic’s Guide to Designing Safety Evaluations#

• Key points On November 13, Anthropic’s engineering blog laid out how to design, run, and report safety evaluations. The same Fable 5.1 model differed by as much as 34 percentage points in appropriate response rate between the API and claude.ai, and on a self-harm evaluation one line of system prompt moved the rate from 60% to 94%. Minimum sample sizes are 100 items for multi-turn evaluations and 1,000 for single-turn ones, and the post recommends fixing metrics and pass thresholds before looking at results.
• Why read it? Teams using LLM-as-judge evaluations can take its checklist as is: validate the grader against human labels with a chance-corrected agreement measure (Cohen’s kappa), and re-grade with the order of pairwise comparisons flipped.
• Watch point The measurement that a single setting can move scores by more than 30 percentage points is a reason to ask “under what configuration was this measured?” every time you look at a model comparison table.
• Source: Read the source

YouTube Brief#

Fable 5.2: The Self-Improvement Loop Keeps Loopin'#

• Channel: AI Explained
• Key points A walkthrough of the 264-page Fable 5.2 system card and the report from external evaluator METR. It covers the large one-year jump on the Remote Labor Index, which measures how much remote work a model can take over, and a cost-adjusted comparison with Gemini 4 Carbon, while also pointing out that the model is still weak on common-sense questions and that there were cases where it said “I’ll start now” and then did nothing.
• Why watch? Good for readers who want a quick tour of a new model’s limits beyond benchmark numbers, along with the debate over accelerating AI research.
• Video: Watch the video

Building the Claude API for the Frontier#

• Channel: Claude
• Key points Two Claude Platform engineers explain how they decide what goes into and out of the Messages API. They cover why extended thinking became adaptive thinking, the change that keeps the prompt cacheintact when you change effort or the system prompt mid-conversation, and why prompt caching is the first cost-saving step they recommend to customers.
• Why watch? Useful for developers who want to understand, from an API designer’s perspective, why Fable 5.2’s breaking changes look the way they do.
• Video: Watch the video