AI Coding Live News

On November 5 OpenAI published a National Community Compact for U.S. compute campuses it owns and operates: no NDAs with public officials except narrow security carve-outs, public construction and impact reporting (noise, water, energy), Ratepayer Protection Pledge to pay full electricity and incremental grid costs with stranded-asset assurances, Grid Protector peak curtailment (up to 1,000 MW in Effingham, Georgia), and community investments already listed at $80M in Effingham and $40M in Pike County, Ohio. A PDF of the Compact is on openai.com.

Zoom

On November 3 (US Pacific time), Vercel launched Security Review in public beta. It is a new Vercel Agent capability alongside Code Review and Investigation: once enabled, every push to connected GitHub repositories triggers a diff-only vulnerability review that finishes in seconds. Findings land in the Security dashboard, PR comments and the CLI, and can be fixed with one click by Vercel Agent or pulled into your own coding agent via vercel security vulnerabilities. It is available to Pro and Enterprise teams, and reviews are free until November 10.

Zoom

At Fal.Con Europe in Barcelona on November 3, CrowdStrike said it signed definitive agreements to acquire AI agent observability company Fiddler AI and automated AI security testing company Dreadnode, and launched an AI Kill Switch in Falcon Guardian that can terminate a misbehaving agent, block it from relaunching and cut its enterprise network access. Both deals are expected to close in CrowdStrike's fiscal Q4 FY27, with the products generally available that quarter. CrowdStrike did not disclose prices; CyberScoop, citing the Wall Street Journal, put Fiddler at about $400 million and Dreadnode at about $95 million.

Zoom

On November 2 (US time) OpenAI announced on its website that Dan Driscoll, the 26th Secretary of the U.S. Army, is joining as Senior Counselor for National Security Modernization, a newly created role. He will work with senior leadership and external partners on how advanced AI can strengthen national and cyber security, with a focus on advancing responsible use with U.S. allies, and help internal teams understand the operational needs of security institutions. Reuters, CNBC and Bloomberg Law also reported the hire.

Zoom

On November 2 (US time) OpenAI said it is planning its next internal security sprint and partnering with security firm Cathedral, whose researchers will use OpenAI models alongside OpenAI teams to challenge its defenses. It is also changing its Security Bug Bounty program, more than quadrupling rewards for critical findings; OpenAI's X post says exceptional findings can earn up to $172,000 including bonuses. Per OpenAI, the last sprint dedicated 25% of its product engineers to finding and fixing weaknesses, using Codex to reproduce vulnerabilities and prepare patches, and it has committed $1 billion in subsidized access over six months for frontline defenders.

Zoom

On Nov 2, semiconductor and AI research firm SemiAnalysis released GDPx, a benchmark of agentic capability across 11 domains: chip design, cybersecurity, biology, finance, legal, quant trading, recursive self-improvement (RSI), hardware design, materials science, alignment and software engineering. Its 206 tasks were built by 14 specialist data partners, with SemiAnalysis doing final QA. On the official leaderboard Claude Opus 5.5 leads at 12.0%, followed by Gemini 4 Carbon at 10.9% and GPT-6 Astra at 9.6%; nearly every model scores 0 on finance and legal. SemiAnalysis says safety classifiers drag down Opus 5.5 and GPT-6 Astra, and plans a new version every 3–6 months. All scores are as reported by SemiAnalysis.

Zoom

Security firm Parameter published an exploit chain in which an attacker publishes a malicious conversation through ChatGPT's normal sharing feature; when a signed-in victim opens the /share/ link, the payload runs as chatgpt.com in their session, lists conversations, reads a private chat that was never shared, and sends data out. Parameter reported it through OpenAI's bug bounty on October 18; OpenAI raised it from P2 to P1, fixed it on October 26 and paid a $5,000 bounty. Parameter reports no real-world use, and users do not need to do anything.

Zoom

Cloud security firm Wiz published research on October 30 saying at least nine AI developer platforms disclosed incidents this month: Fireworks AI, Andromeda, Zeabur, Lightning AI, OpenCode, Railway, Warp, CommandCode and Northflank. Attackers hunted stored environment variables, especially keys for paid AI models; Wiz traced two stolen enterprise keys to roughly 800,000 and 1.7 million Amazon Bedrock calls, which it estimates likely ran over $100k at list price in those two cases alone.

Zoom

Microsoft Research, Microsoft Security and UC Berkeley open-sourced TokenEconomizer on GitHub (Apache 2.0, v0.1.0 released October 26), a plugin for Claude Code, Codex, GitHub Copilot CLI and Pi, with experimental opencode support. It learns from earlier sessions in the same repository: micro-skills remember repo facts, tool pruning drops tool definitions that go unused, and a loop guard nudges an agent that is stuck. The paper reports 18.4–30.9% lower mean cost across five agent and model combinations on 277 SWE-Bench tasks (paper figures).

Zoom

Epoch AI reported on Oct 29 that, in a deliberately basic setup emulating an unsophisticated attacker, Z.ai's open-weight GLM 5.3 read security fixes that were public but not yet shipped and autonomously built exploit chains for all six Firefox releases from Sep 17 to Oct 26, letting a single webpage visit read local files. Marginal cost was about $1,000 per version and the fastest run took 12 hours. Mozilla patched a previously undisclosed bug the model also used in Firefox 159.0 on Oct 27.

Zoom

Cognition, the company behind Devin, announced on Oct 29 via its official @cognition account that it is acquiring Corridor. In a post on Cognition's official blog dated 2026.10.28, Corridor co-founders Jack Cable and Ashwin Ramaswami said the team is joining Cognition to take Devin Security to the next level. Corridor, founded almost two years ago, positions itself as the security layer for AI-native teams. Deal terms were not disclosed.

Zoom