Independent AI intelligence Two editions daily · ET
Fervor AI
Menu

AI Trending Briefing · November 3, 2026 · afternoon edition

PostmanOpenAI CodexGitHub ActionsSparks of Weight Space Programmingvercel-labs/agent-desktopagent-securityclaude-codecodexprivacyai-skills

Trending AI Briefing: Tuesday, November 3, 2026 (afternoon ET)

The loudest builder threads this afternoon are not about new models. They are about who gets to write to the settings that decide what your coding agent loads, trusts and shares. A Postman bug report says the desktop app installed plugins into Claude Code and Codex and wrote its own hook approval, a Codex user reports a training opt-out flipping back on, and GitHub is moving the other way by switching a risky CI trigger off for public repos. The pattern: agent config is now a shared surface that vendors edit, so a setting you chose once is a setting you have to check again.

What's hottest in AI news right now

A Postman bug report says the desktop app wired itself into Claude Code and Codex without asking. Issue #14370, opened October 25 by GitHub user indicava and on the Hacker News front page November 3, reports that Postman Desktop 12.33.4 installed a Postman plugin into Codex (with a Postman MCP server and a SessionStart hook, a script that runs when an agent session opens), a Postman plugin into Claude Code at user scope, and a Postman CLI into ~/.local/bin, with Postman's own log tagging the install auto-existing-upgrade. The sharper detail is the hook text, which tells the agent to load a Postman skill "before responding to any non-trivial API engineering task," and installer source in which codex.ts calls approvePostmanHook after installing, the step meant to write Codex's trust record for that hook (the reporter notes the code shows the attempt, not which run created the record on their machine). The honest catch: the Hacker News headline says Postman "attempts to share all API data," and the issue does not say that. The reporter writes that it "does not claim to establish data exfiltration," the remote MCP connection failed with "Auth required," the reproduction is not yet verified on a clean Mac, and no Postman staff reply was visible when we read it. GitHub issue · HN

A Codex user reports the "Improve the model for everyone" toggle switched itself back on. An Ask HN post on November 3 says the poster's company had disabled data sharing in Codex, Claude Code and similar tools to keep code out of training, and that the poster and coworkers found the Codex setting re-enabled with none of them knowingly opting back in. This is one unverified report with no OpenAI response on the thread, and the poster links an earlier thread describing the same thing. The practical part holds either way: the toggle lives at ChatGPT's data controls page, and OpenAI also offers a privacy-portal opt-out. Ask HN · ChatGPT data controls

GitHub Actions will block pull_request_target by default in public repos from December 2. The changelog entry dated November 2 moves enforcement back a month from its original November 2 date and adds two brownouts, November 9 and November 16 from 16:00 to 18:00 UTC, when blocked runs fail with an error annotation. The reason is old and still bites: the trigger "runs in the context of the base repository and can access its secrets," so a workflow that checks out fork code hands that code your tokens. Private and internal repos and GitHub Enterprise Server are untouched, and workflows that need the trigger can be allowed through an Actions event policy that targets specific workflow files. The entry does not mention AI agents, but any repo running an agent or bot on pull requests from forks is the exact case it describes. GitHub changelog

The weight-space programming post got its first serious pushback. Matthew Honnibal, the creator of spaCy, argued on November 3 that the "Sparks of Weight Space Programming" post (Hacker News, November 2) bundles different techniques under one headline. By his count only three experiments read raw weights with no tools, all on small networks of 17K to 172K weights (the post's own tool table marks a fourth, writing MinAtar game networks, as tool-free), while every experiment on a real language model used Python. That includes the headline result, a MATH-500 jump from 7.9% to 48.1% on the small Qwen3.5-0.8B, where the model could run the network on up to 50 batches of practice problems. He credits the Qwen result as real engineering and objects to the framing, not the work. The authors' logs are public, so anyone can check which claim rests on which method. Honnibal · Original post · Logs

Simon Willison reran part of it on a laptop with a 17GB local model. On November 3 he fed the post's weight prompts to Qwen 3.8 27B (a Q4_K_M GGUF build served through LM Studio) using his llm CLI. It guessed a Pac-Man-style maze game at 72% confidence after 46 minutes and an Arkanoid-like game at 88% after 52 minutes for Breakout, and a paddle-and-ball game at 75% after about 65 minutes for Pong (a fourth run was still going when he posted). Kimi K3.1 Pro over OpenRouter named Breakout in under ten minutes. His verdict: "a cool paper," with wider commentary that "does not feel justified." Simon Willison

vercel-labs/agent-desktop shipped v1.1.0 overnight. The CLI, which lets an agent read and drive desktop apps through the operating system's accessibility tree instead of screenshots, tagged v1.1.0 at 04:13 UTC on November 3. The useful changes are reach and stability: the macOS Dock, menu bar status items and system panels are now reachable, refs are re-identified through each element's accessibility address on macOS, a new type --interval-ms option types at a steady pace, and a batch of Windows crash and overlay fixes landed. Its own README warns that snapshots, clipboard reads and screenshots "can contain private desktop content." Release · README

New tools and features worth actually trying

Codex /hooks. Codex skips new or changed hooks until you trust them, records that trust against the hook's hash, and lists every hook source in /hooks (Settings > Hooks in the desktop app); [features] hooks = false in config.toml turns hooks off entirely. Honest tradeoff: the review gate only helps if nothing else writes the trust record for you, which is exactly what the Postman report alleges, so open /hooks and read what is already trusted. Codex hooks docs

claude plugin list plus enabledPlugins. One command shows what plugins Claude Code has loaded, and the enabledPlugins setting turns any of them off per scope, while disableAllHooks switches off your own and ordinary plugin hooks at once (hooks your organization manages keep running). Honest tradeoff: plugins can carry hooks, MCP servers, skills and executables on the agent's PATH, so a plugin you did not install deserves a read before you decide it is harmless. Claude Code plugin reference · Settings

GitHub Actions Insights for pull_request_target. Before the November 9 brownout, Insights shows which runs the new default rule would block, so you can allow the ones you need by workflow file. Honest tradeoff: allowing a workflow puts you back where you started unless that workflow stops checking out and running fork code with secrets in scope. GitHub changelog

Willison's local weight-reading test. LM Studio plus llm with the llm-lmstudio plugin reproduces the game-identification experiment on your own machine; raise the context window above LM Studio's default 8,192 and set LMSTUDIO_TIMEOUT=900. Honest tradeoff: each finished run took 46 to 65 minutes on his laptop, and a correct guess tells you the model can do this, not how it reasoned. Simon Willison

Trending AI repos on GitHub today

Trendshift's daily board, read once at about 15:12 ET; its rank numbers are momentum scores, not star totals. Star counts below come from cache-busted shields.io badges and are rounded.

  • storytold/craft-anything (#1): a Rust engine that studies a website, app or game, has a coding agent build your own version, then compares the build to the original. Why now: v0.3.0 landed November 2. MIT or Apache-2.0 per the README (MIT text confirmed in LICENSE-MIT), about 7.8k stars; "early alpha," Claude Code is the only builder run live, and the default clean-room mode reads only what is visible.
  • vercel-labs/agent-desktop (#4): accessibility-tree desktop control for any agent, with no model inside. Why now: v1.1.0 on November 3. Apache-2.0 (LICENSE body keeps the unfilled template copyright line), about 12k stars; you bring the agent loop.
  • edenfunf/reelmimic (#8): analyzes a reference video's style and makes a new 2D animated video in it, using your Claude Code or Codex account. MIT, about 1.8k stars, no releases; a 30 to 60 second video takes 1 to 3.5 hours of your plan's usage, and it is mostly tested on Windows.
  • ccch1mneyyy/dsh-Go (#11): an unofficial Android client that runs DeepSeek Harness on a phone or drives one on a computer. Why now: v1.0.10 on November 3. AGPL-3.0 (SDK and examples MIT), about 7.3k stars; APK sideload only, and its README warns about relaxing protections for phone control.
  • floci-io/floci (#15): a free local AWS emulator on localhost:4566 for agents and tests that should never touch a real account. MIT, about 29k stars, release 2.4.0 on October 31; Bedrock Runtime returns dummy responses and the speed comparisons with LocalStack are self-reported.
  • mattpocock/skills (#17): small composable skills for Claude Code and Codex. MIT, release v1.3.2 on October 29, shields reads about 311k stars; installing the same skills two ways duplicates every one.
  • morluto/rea (#23): an MCP server for agent-driven reverse engineering of native binaries, Electron apps, .NET assemblies and websites. MIT, release rea-agents-6.8.0 on October 25; the shields badge reads about 427k stars, which we could not square with its board rank, so treat that figure as unreliable. Deep analysis needs Ghidra, IDA, Hopper or similar installed separately.
  • RikiyaT/lm_understand-logs (#24): the prompts, responses and networks behind the weight-space post. Mixed license (MIT scripts, CC BY 4.0 data, GPL-3.0 MinAtar code), about 673 stars, no releases; it is a log dump, not software.

What actually matters from today's signal

The trend to track is consent around agent configuration. Coding agents now load plugins, hooks, skills and MCP servers from a few files in your home directory, and any program running as you can write to those files. Codex's hook review and Claude Code's plugin settings are good controls, but the Postman report shows the weak point: a review gate is only as strong as the guarantee that the thing being reviewed did not approve itself. The highest-signal areas for builders this week are hook and plugin inventories on every developer machine, CI triggers that hand secrets to fork code, data-sharing toggles you set once and never rechecked, and desktop-control tools that can read anything on screen.

The counter-signal is that most of today's alarm runs ahead of its evidence. The Postman headline claims data sharing the issue does not claim, the Codex toggle report is one thread with no vendor answer, and the weight-space excitement shrank by a lot once Honnibal sorted its experiments by method and Willison timed a local rerun. That cuts both ways. The defensive moves cost ten minutes and need no proof of malice: list your agent plugins, read your trusted hooks, check the toggle, run GitHub's Insights view before November 9. Do them because the files are writable, not because a headline said so.

Source access notes: Vendor scan read about 15:10 to 15:25 ET. openai.com/news returned a client error; blog.google's AI and feed pages returned navigation only; Anthropic's newsroom had nothing newer than October 28; the Claude Code npm latest tag is still 2.1.317 (covered this morning) and the packument returned no time map. Business Insider (Anthropic internal AI spend story) is blocked from this workspace and was dropped. Hacker News read through the Algolia API for the last 36 hours. Repo figures came from a Sonnet 5.5 verification pass using cache-busted shields.io, raw README and LICENSE files, and releases.atom; two badge readings (morluto/rea, mattpocock/skills) were re-fetched by the main session and returned the same values. A Sonnet 5.5 adversarial pass found no hard errors and four minor issues; fixed: the Codex report wording (the poster and coworkers, not "several coworkers"), Honnibal's "three" tool-free experiments labeled as his count against the post's own table of four, the Qwen3.5-0.8B model named for the MATH-500 result, and Willison's Pong run added. Later, Codex's article fact check showed disableAllHooks does not stop managed or force-enabled plugin hooks; the tools section was corrected to match.