Trending AI Briefing: Thursday, November 5, 2026 (morning ET)
The tools that sit between a developer and a fleet of coding agents changed hands overnight. Conductor, the Mac app for running Claude Code and Codex agents side by side, is joining Meta and will switch off its cloud on November 20. OpenAI is acquiring Pierre Computer Company, which builds code storage infrastructure "for machine work." GitHub's agent moved into Apple's own IDE the same day. Two of the biggest AI companies absorbed pieces of the workbench in one day, and anyone whose agent workflow lives inside a startup's cloud just got a two-week clock.
What's hottest in AI news right now
OpenAI says its agents found and exploited 948 Linux kernel paths to root for about $1.2 million. OpenAI's November 4 post, "A thousand fewer paths to root," could not be read from this workspace (openai.com returned a client error), so every figure here comes from secondary coverage. Per those write-ups, an unnamed, unreleased OpenAI cyber model scanned the latest kernel master in mid-October, reproduced 1,724 findings, and ended with 948 root-level (local privilege escalation) results plus generated patches, for $1,213,430 in API credits. Two of the three put the starting pool at 2,308 candidates, and they disagree on what 948 counts: one calls it 948 unique exploits, another 1,169 working exploits across 948 distinct vulnerabilities. The catch is the patch queue: after ten days, those same two report 61 fixes upstream and 43 staged, with about 299 under public discussion. That works out to roughly $1,300 per distinct root bug. Landing the fix still runs at kernel-maintainer speed, and OpenAI is reportedly feeding reports to maintainers gradually and holding back the details of exploitation techniques. AI TL;DR summary · PBX Science · Runtime Wire · OpenAI post (blocked here)
Conductor is joining Meta, and its cloud has about two weeks left. The announcement's timeline starts Wednesday, November 4: no new sign-ups or downloads, free users cannot upgrade, and pro users keep pro features for free. Conductor Cloud goes read-only on Friday, November 13 (you can read and export, but not send new messages) and shuts down on Friday, November 20, when data deletion begins. The local app "will continue to receive new models and critical bug fixes until early 2027," then winds down. Active subscribers get a refund, listed with the November 13 change. Workspaces move to your Mac with right-click, Transfer to local, and Settings, Account, Export data downloads everything. The team says it has never sold or trained on user data and "can't share much yet" about what it is building at Meta. Conductor announcement
OpenAI is acquiring Pierre Computer Company. The deal post went up on November 4, but openai.com refused this workspace's fetches, so terms and plans are unread here; the deal itself rests on OpenAI's post title as listed on Hacker News and an Axios headline. Pierre's own site describes "low level, composable product infrastructure for machine work" and says it is building code.storage, alongside open-source diff and file-tree rendering projects (Diffs, Trees, DiffsHub). Pierre does not describe itself as agent tooling, so this is a reading, not its pitch: alongside Conductor, the big AI companies are reaching for the layer where machine-written code gets stored, diffed and reviewed. OpenAI post (blocked here) · Pierre
GitHub Copilot now runs inside Xcode's built-in coding assistant. The November 4 changelog lists it as a public preview starting with Xcode 27.3 beta, on macOS Tahoe 26.6 or later, set up under Xcode, Settings, Intelligence. All Copilot plans are supported, and the older Copilot for Xcode extension stays available as a separate option. A day earlier GitHub put Copilot into JetBrains Air over the Agent Client Protocol. The agent now goes wherever the IDE owner lets it in. GitHub changelog
Ricursive Intelligence released Ripple-65B Preview, an open-weight dense model aimed at agentic coding. The launch page (no date shown; on Hacker News November 4) claims 80.52 on TerminalBench 2.1, 0.42 points ahead of Reflection Beam 501B and ahead of the other larger open models it lists, from a 65B dense Transformer pretrained on 12 trillion tokens with up to 1M context. The company puts its full R&D cost from scratch at $32M, its own estimate. Weights are on Hugging Face, with Together AI, GMI Cloud and OpenRouter serving it. Honest catch: every number is self-reported, the page states no license, the comparison to Reflection relies on press reports of that lab's compute, and this is a general variant of a model built for chip design. Ricursive
Cloudflare added a "Personal Assistants" category so sites can see and set terms for user-directed agents. The November 4 post adds personal agents as their own class in Security Analytics bot charts, per-agent request counts, and a renamed "AI Crawler and Agent access policies" setting with three options per agent: allow, block on pages with ads, or block. Account Abuse Protection gains views for agent logins and sign-ups, but it is in early access, and the post does not list which agents count as "supported." Cloudflare blog
New tools and features worth actually trying
Microsoft Agent Framework builder skills. Microsoft published development-time skills (November 4) that teach a coding agent how to build with Agent Framework: gh skill install microsoft/agent-framework agent-framework-builder-python@main, or the npx skills add form. Honest tradeoff: @main moves under you, so pin a tag or commit, and your agent must support the Agent Skills format. Microsoft devblog
Locals, if you run several agents against a local model. One locals start serves an OpenAI-, Anthropic- and Ollama-compatible endpoint on port 8321, and locals launch claude wires up Claude Code. Honest tradeoff: a single request runs about as fast as mlx-lm; the speedup only appears with several requests at once, and the project's benchmarks are its own, mostly on an M2 Pro. Locals README
Conductor's Transfer to local, before November 13. Right-click each cloud workspace and transfer it, then run the full export. Honest tradeoff: the local app is also on a timer (early 2027), so this buys months, not a home. Your branches are ordinary git worktrees; the chats are the part that only Conductor holds. Conductor announcement
Copilot in Xcode's assistant. Swift developers on a Copilot plan can pick it as a provider without a third-party extension. Honest tradeoff: it needs the Xcode 27.3 beta and macOS Tahoe 26.6, so it is a test-machine experiment, not a production setup. GitHub changelog
Trending AI repos on GitHub today
Read from Trendshift's daily board at about 07:20 ET; its rankings are momentum scores, and its unlabeled figures disagree with star badges, so star counts below come from cache-busted shields.io badges, which round.
- stablyai/orca (#20): a desktop app for running several CLI coding agents side by side, each in its own git worktree, with a mobile companion. Why now: v1.4.250 landed November 5, the day after Conductor closed sign-ups. MIT, star figures disagree across sources. Caveat: anonymous usage data is on, and the mobile app needs a relay.
- vercel-labs/agent-desktop (#21): a CLI and C library that lets an agent operate desktop apps through OS accessibility trees and JSON refs. Why now: v1.2.0 on November 5, covering macOS 13+, Windows 10 1809+ and Ubuntu 24.04+. Apache-2.0, about 16k stars. Caveat: four low-level key and mouse commands are listed but refuse to run.
- Generated-Computers/Locals (#19): a local model server for Apple silicon tuned for many concurrent tool-calling agents. Why now: v0.2.2 on November 4. Apache-2.0, roughly 1k stars (the badge read 1.1k, GitHub's page 949). Caveat: install is
curl | sh, and models download on first run despite the "nothing leaves your computer" line. - FareedKhan-dev/kimi-k3-in-c (#17): dependency-free C99 that streams Kimi K3's 2.78-trillion-parameter checkpoint from disk to run on one CPU in as little as 8 GB of RAM. Why now: Kimi K3.1 Pro weights landed this week. Apache-2.0 for the code, about 11k stars, v1.1.0 on October 2. Caveat: speed is measured in seconds per token (26.5 s at 8 GB, 5.6 s at 128 GB), and it needs about 1.7 TB of fast disk.
- N1nEmAn/sapper-v2 (#15): an AI commander that dispatches worker agents through authorized penetration tests and logs findings to a layered fact graph. Why now: the v18-champion build (November 1) froze its competition entry. MIT, with a separate DISCLAIMER.md limiting use to authorized testing, default branch
master, about 1.2k stars. Caveat: the headline scores are the author's own, and the README says qualifier champion while the description says champion. - mattpocock/skills (#13): small, editable agent skills for everyday engineering, usable from Claude Code, Codex, Copilot and Gemini CLI. Why now: v1.3.2 on October 29 and steady skill-adoption momentum. MIT, star figures disagree across sources. Caveat: the README doubles as newsletter promotion.
- ccch1mneyyy/dsh-Go (#6): an unofficial Android client that runs DeepSeek Harness on the phone or drives a desktop instance remotely. Why now: v1.0.11 on November 5. AGPL-3.0, about 11k stars. Caveat: no affiliation with DeepSeek, and analytics are on by default.
What actually matters from today's signal
The trend to track is consolidation of the agent workbench: the app that spawns worktrees, the storage that holds agent-written code, and the IDE panel that hosts the agent. Meta took a parallel-agent app, OpenAI took code infrastructure, and GitHub planted Copilot in both Xcode and JetBrains Air within two days. For builders, the highest-signal areas are portable workspace state (worktrees, setup scripts and skills committed to the repo, not trapped in an app), exportable agent transcripts, open-source workbenches like Orca as a fallback, and local inference sized for several agents at once.
The counter-signal is the kernel run. Everyone is fighting over the room the agents work in while the agents themselves just showed they can produce root exploits faster than upstream can merge fixes. Sixty-one merged patches against hundreds of findings is the number to watch, because the bottleneck has moved from finding bugs to reviewing patches, and nobody bought a company for that this week. If your servers run a kernel you patch quarterly, your exposure changed this week whether or not the details ever go public.
Source access notes: Vendor scan, Hacker News (Algolia, last 36 hours) and Trendshift read between about 07:15 and 07:35 ET. openai.com returned client errors for its news index and both November 4 posts, so the kernel story rests on three secondary write-ups (which disagree on whether 948 counts exploits or vulnerabilities) and the Pierre deal on OpenAI's post title as listed on Hacker News. blog.google and deepmind.google served undated, stale pages; hy.tencent.ai returned an empty app shell, so Tencent Hy4 is not covered. Anthropic's news page had nothing new in the window, x.ai and mistral.ai had nothing since October. The Codex changelog redirected to a different host and was not followed. Ripple-65B's page shows no date; the November 4 date is its Hacker News posting. A Sonnet adversarial pass checked dates, numbers, links and licenses. It caught an overstated per-bug cost (now about $1,300 per distinct vulnerability), kernel figures credited to all three write-ups when only two carry them, a "sixteen-day" clock that is fifteen from today with November 13 as the real cutoff, a Ripple hedge quote not found on the page, a sapper-v2 license line that belonged to its disclaimer file, and a thesis that said "bought" where Conductor's page only says "joining." Repo figures are from cache-busted shields badges, LICENSE files and releases.atom feeds; Trendshift's unlabeled numbers were not used. Codex's article fact check later caught Locals' star count (badge 1.1k vs 949 on GitHub's page); the repo line was corrected. Stories and repos covered in the November 4 briefings (PHP2Shell, Kimi K3.1 Pro weights, Claude Code 2.1.318, agent-autoloop, auto-ontology and others) were skipped.