AI & Tech News Digest — November 5, 2026

AI NewsTop 5

• OpenAI Agrees to Acquire Pierre Computer — Codex Gets Its Own Git Storage Layer (Nov 4)

  OpenAIHN, 216 points

  Pierre builds Code Storage, a programmable storage layer built on Git, plus the open-source Trees, Diffs, and Highlights libraries — and Trees and Diffs already run inside the Codex app, so OpenAI is buying a supplier it already depended on. No price was disclosed and the deal hasn’t closed (regulatory approval pending); existing Code Storage customers — Lovable, Bolt, Amp, Poke, Anything, Parahelp — keep service, and the open-source projects stay open. Context from two days earlier: OpenAI disclosed Pando, its in-house Git backend that cut median push latency nearly fivefold and handles close to a petabyte of Git data a day. Agent-written code volume is breaking generic Git-hosting assumptions; watch what gets open-sourced from this before you redesign your own agent code storage.

• Meta Acquires Conductor, the Mac App for Running Parallel Coding Agents (Nov 4)

  ConductorTechCrunchHN, 151 points

  Conductor — founded in 2024, launched July 2025 — let developers run Claude Code and Codex agents in parallel workspaces on macOS, with git worktrees and a shared UI doing the coordination. Terms are undisclosed, Conductor Cloud shuts November 20, and the team says the app winds down “over the next weeks” per changelog 0.93.0; the 169-comment HN thread is mostly mourning plus do-it-yourself worktree recipes. Two coding-agent acquisitions in one day (see Pierre above) say the layer between model and repository is now strategic real estate. If you depended on Conductor, budget a migration weekend — the pattern it sold is reproducible with git worktrees and your agent CLI of choice.

• Kimi K3.1 Pro Weights Land on Hugging Face — the Nov 4 Promise, Kept (Nov 4)

  Hugging FaceHN, 432 points

  Moonshot released the full open weights of K3.1 Pro on schedule: the 2.8T-parameter, 1M-context MoE that scored 65.7% on Terminal-Bench 4.0 at its October 23 launch, with cyber-related data stripped from training before the open release. The 432-point HN thread is already full of local-rig math, and the launch-week warning stands: K3-class MoE ran around 4 tok/s on 768 GB DDR5 boxes, so this is a multi-GPU or very-large-RAM project, not a 24 GB-card download. If you benchmark open weights before routing coding agents to them, the files are live — go measure.

• Tencent Ships Hunyuan Hy4: 770B MoE With Vision and Computer Use — API First, Weights Later (Nov 4)

  TencentHN, 212 points

  The full Hy4 release follows October’s preview: a 770B mixture-of-experts model and the first in the Hunyuan line with both vision and computer use — operating GUIs and command lines, with specialized training on software like Blender and CAD. API pricing is ¥6 per million input tokens, ¥18 per million output, ¥0.30 for cache hits, half-price on Tencent Cloud TokenHub through December 31, and free CodeBuddy usage through November 15. Two honesty notes: the weights are promised “open-sourced soon” but are not out — several roundups already mislabeled this an open-weight release — and Tencent’s own Hy-BioExperimentBench score is 30.4/100, which the company calls a significant gap to frontier. If you evaluate computer-use agents, Hy4 is a credible non-US option on the pricing sheet, rented rather than owned until weights ship.

• Ripple-65B Preview: a 65B Dense Model Claims US Open-Weight SOTA on Agentic Coding (Nov 4)

  RicursiveHugging FaceHN, 262 points

  Ricursive Intelligence’s first model is a 65B dense transformer pretrained from scratch on roughly 12T tokens for agentic coding, reporting 80.52 on TerminalBench 2.1 — claimed as US open-weight state of the art, ahead of significantly larger domestic models including Muse. The caveat is in the framing: “US open-weight” is a small sub-category, and much of the HN thread spent its energy on exactly that qualifier. The practical part survives the skepticism: a 65B dense model is a realistic target for a dual-GPU or 48 GB-class quantized rig, so run it through your own task suite before trusting any benchmark.

Also tracked: xAI turns on invisible text watermarking across seven Grok API models on November 7 — no request parameter, just an x-watermark response header, admin-only opt-out — and Anthropic extended Claude text watermarking to four more models on November 3; both cite the EU AI Act — AI Tools Recap.

Developer & DevOps NewsTop 5

• encoding/json/v2 Is Stable: Go Ships Its JSON Do-Over in Go 1.27 (Nov 4)

  Go blogblog index

  The package that arrived as an experiment in Go 1.25 is now stable and generally available, alongside the low-level encoding/json/jsontext for streaming-level control. v2 brings stricter defaults — it reports errors that v1 silently accepted — and v1 remains available, so unmigrated code keeps compiling while new code can start clean. The 258-point HN thread is mostly migration war stories and API-design debates. You don’t have to move today, but budget a diff review wherever your code depends on v1’s lax parsing, and start new packages on v2.

• Debian Patches apt: a MITM Can Swap a Package After Verification and Get Root (Nov 4)

  Debian DSA-6607-1HN, 140 points

  Max Justicz found that apt can merge two different package downloads after an HTTP redirect gives them the same URI; combined with improper file handling when resuming an HTTP download, a man-in-the-middle can replace a package after verification and execute arbitrary code as root (CVE-2026-109518). Fixed in apt 3.0.4 on trixie, published November 4, with several out-of-bounds access issues fixed in the same update. The exposure window is any apt traffic over plain HTTP or on flaky links that resume. Patch apt everywhere today and treat HTTP-based repo mirrors as hostile until they’re gone.

• Xen Discloses XSA-523: a Guest Could Read and Write Any Domain’s Memory — Bugs Found by Claude (Nov 3)

  Xen advisoryXCP-ng blog

  CVE-2026-102703 and CVE-2026-102704 live in the grant-copy path: batched copies within a page reuse permission checks, and in some cases Xen fails to recheck when it should — giving a malicious guest arbitrary read/write on other VMs, including dom0. Xen 4.6 and later are affected; patches exist for unstable through 4.19.x, 4.18.x, and 4.17.x, and nothing for 4.6–4.16, which left security support in December 2024. The Xen Project credited Anthropic — the flaws were found using Claude, then validated by Stephan Lipp of Ada Logics — and no in-the-wild exploitation is known. Patch and reboot Xen hosts this week; still running 4.16 or older is now an upgrade project, not a note.

• US Voters Roundly Reject Data-Center Ballot Measures in the Midterms (Nov 4)

  SemaforTom’s HardwareHN, 322 points

  Alongside Tuesday’s midterms, roughly 45 data-center-related measures hit local ballots, and Tom’s Hardware counts them as comprehensively defeated; Semafor’s 648-comment HN thread argues through the energy prices and tax abatements behind the votes. Data-center siting has moved from PR problem to political constraint — power, zoning, and local tax deals now get referendum-tested. If your capacity plan assumes cheap new buildout in specific regions, add “local ballot” to the risk register.

• Qualcomm’s Cloud AI 100 Ultra: 128GB of Memory on a 150W PCIe Card (Nov 4)

  QualcommHN, 126 points

  The product brief puts the Cloud AI 100 Ultra at 150W TDP, 870 TOPS INT8, 128 GB of on-card LPDDR4x at 548 GB/s, plus 576 MB of on-die SRAM in a standard PCIe form factor. The number that matters is capacity per watt: 128 GB at 150W targets inference serving where memory, not compute, is the binding constraint and HBM cards are overkill or over budget. Qualcomm doesn’t publish a full supported-precision list on the brief, so benchmark before you buy — but the 150W envelope is a real option where rack power decides how many accelerators you can fit.

Also tracked: Honeycomb shipped Personal and Team AI SRE agents into early access — investigation agents that work your telemetry directly — AI Agent Store weekly.

Self-Hosting & HomelabTop 4

• XCP-ng 8.3 LTS Gets Its November Security Batch: Xen Fix, sudo Privilege Escalations, Kernel, Microcode (Nov 3)

  XCP-ng blog

  The first November roll for 8.3 LTS syncs the XSA-523 Xen fix (the grant-copy bug in section 2), updates sudo to 1.9.17p2 with fixes for three privilege escalations plus one more vulnerability, and carries kernel and intel-microcode updates. Every part of it needs a reboot, so this is a rolling-reboot week for your pool, not a quiet yum update. If you run XCP-ng in any production-adjacent capacity, schedule the restarts before the weekend.

• quiet-md: a Native, Local-First Notes App in Rust That Speaks Feishu/Lark (trending this week)

  GitHub

  762★ in four days for a macOS/Windows notes app built on Rust and GPUI — Zed’s UI toolkit — MIT-licensed, with local-first storage and import/export compatibility with Feishu/Lark DocxXML, the format that keeps whole companies locked into their chat-suite docs. It’s young (71 forks, 18 open issues), so treat it as an eval rather than a migration target. The compatibility layer is the part worth reading if your notes are hostage to a vendor format.

• personal-data-deletor: Opt-Out Requests to 970 Data Brokers, Locally and Free (Nov 3)

  GitHub

  600★ in two days for a portable Windows tool that sends deletion requests to about 970 data brokers — no account, no server, nothing runs anywhere but your machine, built around CCPA-style opt-out rights. It’s JavaScript, MIT-licensed, and verified only by its README so far. Even as a one-off run it undercuts the $100+/year deletion-subscription route; audit what it sends before you let it send anything.

• Mocktastic: a From-Scratch C++ Meshtastic Client for ESP32 (Nov 4)

  GitHubHN

  A custom Meshtastic implementation in C++ targeting the Arduino IDE and the LilyGo T3 v1.6.1 ESP32 board, MIT-licensed — 22★, but it made the HN front page region via Show HN. It’s a learning-grade rebuild of the LoRa mesh firmware stack, not a drop-in replacement for the official client. If you run Meshtastic nodes, this is a good codebase to read to understand what the firmware actually does on airtime — and a base if you want custom node behavior.

Trending GitHub RepositoriesTop 10, last 7 days

Hacker News Top Stories

1. AI is forcing us to pay off 40 years of technical debt(1,130 points, 656 comments)

   IEEE Spectrumdiscussion

   Dina Genkina’s PHP2Shell follow-up argues the AI security wave isn’t inventing new bug classes so much as forcing payment — all at once — on four decades of C-string-era debt nobody would fund fixing. The CVEs made October’s front pages; this is the why-it-matters piece, with the best-numbered argument thread of the week.

2. Residential proxies detected on White House network(850 points, 271 comments)

   Layer3 Inteldiscussion

   Layer3’s telemetry found White House network infrastructure touching residential-proxy pools 236 times in 30 days across 28 public proxy services. The thread doubles as a seminar on why IP-reputation blocking is dying and what replaces it — the same problem you face filtering bots on your own services.

3. A thousand fewer paths to root(236 points, 132 comments)

   OpenAIdiscussion

   OpenAI’s security team describes the internal hardening effort behind the title, landing the same week as its Cathedral Systems security partnership and a Reuters investigation into years of internal security warnings. Read it as a vendor showing its work, with the usual trust-our-numbers caveat attached.

4. Ask HN: What’s your current AI agentic setup?(221 points, 224 comments)

   discussion

   A structured census — subscriptions, models, harnesses, orchestration, agent platforms — answered by 220+ people running everything from stock Claude Code to self-built swarms. The most useful thread of the day for calibrating what “normal” agent setups actually look like.

5. Insects don’t swarm at LED lights(212 points, 114 comments)

   Birds Outside My Windowdiscussion

   New research overturns the “moths mistake LEDs for the moon” story: insects tilt their backs to keep the brightest light overhead stable, which traps them in loops around artificial lights. Pure biology — and a clean reminder that inherited explanations deserve re-testing, in entomology and in your runbooks.

6. Progress on provable inference for large language models(197 points, 87 comments)

   Anthropicdiscussion

   Anthropic’s cryptographic-proofs research: verify a response genuinely came from the claimed model without exposing weights; the companion FlashProve repo is trending in section 4. Experimental, with no production plans announced — but the third-party-verification use case is why it matters beyond the lab.

7. Images 2.6(195 points, 134 comments)

   OpenAIdiscussion

   OpenAI’s image-stack update across ChatGPT, Codex, and the API: faster generation, native animated-GIF creation with per-frame editing, better detail preservation across edits, and new API controls — recaps also cite SVG export and reusable reference images. The thread argues about artifact quality; the API controls are the part worth an hour of testing.

Also tracked: “Everything is an AI scam now” (133 points) — davidralphlewis.co.uk | discussion.

Reddit HighlightsTop 5

• r/LocalLLaMA — Ricursive Intelligence Ripple-65B-Preview: new dense American open-weights model

  Thread

  The local crowd starts the quant math on a 65B dense model immediately; pair the thread with the benchmark claims in section 1.

• r/technology — Residential Proxies Detected on White House

  Thread

  Same Layer3 story as section 5, with comments that work as a checklist for auditing proxy traffic on your own networks.

• r/sysadmin — What’s Changing in Microsoft 365 This November

  Thread

  SharePoint one-time-passcode authentication for external sharing retires fully by end of November; the thread lists what breaks and what to reconfigure first.

• r/conductorbuild — Conductor is Joining Meta

  Thread

  Users of the parallel-agent Mac app react to the acquisition and shutdown timeline; the comments hold the worktree DIY recipes worth saving.

• r/ChatGPT — Introducing Images 2.6

  Thread

  First user reactions to GIF generation and edit fidelity, with sample prompts worth stealing for your own tests.