Independent AI intelligence Two editions daily · ET
Fervor AI
Menu

AI Trending Briefing · November 8, 2026 · morning edition

The weekend's agent stories are about what agents leave behind, with Apiiro counting 1,122 public Claude Code permission files that hold secrets, LoreKit arguing that memory files need a shared format, and MaxxBench showing several models' published coding scores fall when task requirements change.

Claude CodeApiiroMaxxBenchLoreKitPiAnthropicclaude-codeagent-securityagent-memoryagent-harnessfrontier-models

Trending AI Briefing: Sunday, November 8, 2026 (morning ET)

Sunday is quiet on vendor blogs and loud on Hacker News. The stories climbing the front page share one shape: the record an agent leaves behind outlives the moment anyone checked it. A one-click approval becomes a line in a file that gets committed. A memory note becomes a format nobody else can read. A benchmark score becomes a number people quote after the task it measured has changed. Apiiro's secrets count, LoreKit's memory-format argument and MaxxBench's re-scored coding tasks are three instances, and the system-prompt churn behind "Goodbye Claude, Hello Pi" is a fourth.

What's hottest in AI news right now

Claude Code's "Yes, and don't ask again" saves approved commands word for word, secrets included, and Apiiro found 1,122 public copies of that file holding credentials. The research hit Hacker News on November 7 (about 435 points by 07:15 ET Sunday) through The Hacker News' write-up; secondary coverage dates Apiiro's report to November 5 or 6, and Apiiro's own post would not load from here, so every figure below comes from that coverage. Apiiro found 104,185 copies of .claude/settings.local.json on GitHub; about 1.1% (1,122) held at least one secret, 1,379 distinct secrets in all, including 379 database passwords, 43 SSH logins, 42 GitHub, GitLab and npm tokens, and 23 AWS keys. Counting older file versions, shared settings.json files and saved chat logs (and, per AICoder, 211 forks), the total reaches 2,539 secrets across 1,994 repositories. The catch is in Anthropic's own docs: Claude Code keeps the file out of git by adding it to your global git excludes, not the project's .gitignore, so the protection does not travel with the repo. In 539 of 1,105 traced repositories, a commit co-authored by Claude changed the file. Common scanners missed a lot: gitleaks flagged 564 of the 1,122 files, TruffleHog 643, and 215 slipped past both (Apiiro ran them without their verification step). Apiiro did not test whether the secrets still work. The Hacker News · AICoder · Claude Code settings docs · Apiiro (did not load) · HN

MaxxBench re-scored DeepSWE after changing what the tasks ask for, and many models dropped hard. The post by Gavin Lo and Justin Lo of unLAP is dated October 20 and reached Hacker News on November 7. They altered the instructions or starting code of 89 DeepSWE feature tasks (reference patches grew by a median of 17 lines) and added mutated feature checks. Claude Opus 5.5 moved from 74.2% to 76.4%; DeepSeek V4.1 Flash fell from 74.2% to 55.6% and Gemini 3.8 Flash from 73.8% to 53.4%. Their read: they found models "talking themselves out of following" the changed requirements. The honest catch: the authors built and grade the benchmark themselves, and the paper is still marked "will be posted soon." MaxxBench

LoreKit's Mads Thines argued that agent memory needs a shared format the way tracing needed OpenTelemetry. The November 7 post compares nine families of memory formats (AGENTS.md and its cousins, Anthropic's memory tool, Copilot Memory, Letta, Mem0, LangGraph's store, the MCP memory server, Graphiti/Zep, and LoreKit) and argues that memory lacks what OpenTelemetry's founders agreed on for tracing: a shared data model, naming conventions and a protocol. Its example record starts with spec: agent-memory/0.1, but the post says plainly that "the field names aren't a proposal," so there is no spec yet, only a call for one. Thines builds LoreKit and works on OpenTelemetry at Dash0, and says so. LoreKit blog · mthines/lorekit

"Goodbye Claude, Hello Pi" reached Hacker News late on November 7 with a complaint about prompts that change under you. The post is not new (dated September 21, updated November 7), but it climbed past 370 points overnight. Its sharpest numbers: 244 Claude Code releases "this year" at the time of writing, over three quarters of which "changed the system prompt or tool descriptions," and a default Bash tool description of almost 3,000 tokens. The author moved to Pi, the minimal agent harness at pi.dev. The catch: this is one developer's frustration list with no cost data, and the release count is a snapshot from September. caleb.software · pi.dev

Anthropic published how researchers actually use Claude, and the gap is in ideas, not analysis. The November 5 study covers 207,049 consumer-plan research sessions from August 2 to September 30 (128,914 in Claude, 78,135 in Claude Code) plus a survey of 528 scientists. Data analysis takes 33.7% of Claude sessions and 48.1% of Claude Code sessions, against 27.6% of researchers' time; hypothesis generation gets 4.2% and 2.1%, against 7.1% of their time. The catch: consumer-plan sessions only, classified by Anthropic. Anthropic

New tools and features worth actually trying

A history scan for .claude files. Run git log --all -p -- '*.claude/settings.local.json' '*.claude/settings.json' | grep -nE 'Bash\(.*(PASS|TOKEN|KEY|://[^ ]*:[^ ]*@)' in each repo, then git rm --cached .claude/settings.local.json and add the path to the project's .gitignore. Honest tradeoff: deleting the file does not remove it from history or forks, so every secret it ever held needs rotating first, and a grep pattern will miss passwords that don't look like passwords.

Pattern rules instead of exact-command approvals in Claude Code. Approving Bash(npm run:*) once, and putting credentials in variables like $DB_URL, keeps literal secrets out of the saved rule. Honest tradeoff: per the permissions docs, a * matches any text including spaces, so a loose pattern approves more than you meant, and a deny rule like Bash(curl *) does not stop /usr/bin/curl or sh -c 'curl ...'.

Pinky, a phone-control MCP server with a gate the agent cannot click. brew install --cask diygod/tap/pinky, then claude mcp add --scope user pinky -- pinkyctl mcp. Payments, trades and transfers wait for your click in Pinky's window, and silence for 60 seconds counts as no. Honest tradeoff: the README calls it pre-alpha and warns that an agent with shell access can reach the phone through adb and skip every rule. DIYgod/pinky

Phonon 31m for on-device English speech. Gradium's November 5 release is Apache 2.0 and small (the post puts its two models at about 65 MB and 75 MB), with a self-reported 28 ms time to first audio. Honest tradeoff: the five-language Phonon 40m is CC BY-NC, so commercial multilingual use is out, and the leaderboard placings are the vendor's own framing. Hugging Face blog

Trending AI repos on GitHub today

Read from Trendshift's daily board at about 07:15 ET; its card figures are momentum scores, not stars, so star counts below come from cache-busted shields.io reads.

  • qybaihe/bla (#3): a toolkit that plants canaries, decoys and oversized artifacts in your own builds so AI reverse-engineering agents burn tokens and hit limits. Why now: it is the defensive answer to the reverse-engineering agents that trended last week. MIT, about 3.3k stars, release bla-agents-3.1.1 dated November 8. Caveat: its 639x token and 304x cost multipliers are internal estimates, and it skips Ghidra, Frida and LLDB.
  • meta/astryx (#2): Meta's open-source React design system with a CLI built for coding agents as well as people. Why now: back near the top of the board on a steady release cadence. MIT, about 15k stars, v0.7.11 dated November 7. Caveat: still beta, and "no build plugin" sits beside a required @stylexjs/stylex peer dependency.
  • sarpstar/cinecode (#4): a Claude Code and Cursor skill in which the agent writes a film, renders every frame in code, designs the sound and hands back an MP4. MIT, about 1.3k stars, no releases. Caveat: the main README is Turkish (English, Chinese and Japanese versions are linked), narration falls back to the system voice without a Gemini key, and a full Windows render is marked "not yet tried."
  • DIYgod/pinky (#19): lets MCP agents drive a real iPhone or Android phone while approvals run in a gateway the agent cannot touch. Apache-2.0, a few hundred stars (GitHub and shields disagreed, roughly 360 to 410), v2026.1108.14 on November 8. Caveat: pre-alpha, and Android 10 Wi-Fi mode opens adb on port 5555 until the phone restarts.
  • uniquechao/PandaDOS (#22): a self-hosted control plane that turns issues into queued Claude Code and Codex runs with cautious, balanced or automatic approval levels. Apache-2.0, about 630 stars, v2.6.5 dated November 6. Caveat: its own README says browser terminal access equals that account's shell, so never expose port 8802.
  • filtalgo/Filtmall-Shopping-Skill (#18): an agent skill for finding, comparing and buying products, with the user confirming orders and payment. Apache-2.0, about 850 stars, v2.0.2 dated November 7. Caveat: a client for the vendor's hosted service, README in Chinese.
  • Video-Rebirth/hyperflow-h3-flash (Show HN, not on Trendshift): a compressed few-step video and audio model derived from MiniMax-H3, with a GGUF quant that fits 24 GB cards (the INT8 build wants far more system RAM). About 120 stars, no releases. Caveat: the code is mostly Apache-2.0 (ComfyUI nodes are GPL-3.0) but the weights sit under the MiniMax H3 Community License, which per the README excludes the EU, UK, South Korea and the US without MiniMax's authorization.

What actually matters from today's signal

Track the leftovers. The clearest trend this weekend is that the dangerous part of agent work is no longer the live session, where someone is watching, but the files that session writes and nobody re-reads: saved permission rules, memory notes, generated configs, the commit trailer that says Claude co-authored it. Four places deserve a builder's attention this week. Audit every .claude/, .cursor/ and .gemini/ directory in your org's history the way you would audit .env. Prefer pattern approvals over literal ones. Treat a memory store's file format as a lock-in decision, because there is no portable standard yet and LoreKit's post admits it. And re-run any benchmark you rely on with one requirement changed before you trust a vendor's leaderboard number.

The counter-signal is how little of this is new. The Apiiro numbers rest on a behavior Anthropic documents; a bug report about it (anthropics/claude-code#5544) was closed by a bot as "not planned," per The Hacker News. The Pi post is seven weeks old. MaxxBench is three weeks old. What changed is attention, and attention fades by Tuesday. The risk is that teams patch the one file in the headline and miss the pattern: any agent feature that turns a click into a persisted string will eventually leak whatever was in the string.

Source access notes: Vendor pages, Hacker News (Algolia, last 36 hours and front page) and Trendshift were read from about 07:10 to 07:20 ET through fetch agents, because neither the workspace shell nor the Mac shell could reach them. apiiro.com and openai.com/news/ returned client errors; Apiiro figures come from The Hacker News (November 7) and AICoder, which agree on every number but differ on the report date (November 5 versus 6). OpenAI's RSS feed listed a November 6 Hacktron security partnership and a November 6 BioBasicsBench paper, but neither page loaded, so both are left out. blog.google and deepmind.google served stale, undated listings. Mistral Studio, GPT-6 Cyber, Anthropic's agent-memory post, Codex CLI 0.167.0, Copilot's cron automations and Foundry Local were covered in the November 6 and 7 briefings and are not repeated. GitHub releases.atom feeds returned server errors, so release tags and dates come from each repo's releases page, which shows no year; 2026 is inferred from neighboring releases. Claude Code's latest npm tag is still 2.1.319 (published 00:58 UTC November 6). A Sonnet 5.5 adversarial pass checked the draft and caught eleven issues, all fixed: LoreKit's argument was overstated as a three-layer proposal, two Hacker News point counts were unsupported or drifting, a MaxxBench paraphrase went past the quoted text, the thesis implied every model's score fell (Opus 5.5 rose), an invented scanner caveat, a Phonon model size the post does not assign, and wrong caveats on cinecode and hyperflow-h3-flash. Trendshift ranks were not re-verified. Codex's article check later reached Apiiro's original post, which confirms the figures above and that the scanners ran without verification (restored after the adversarial pass had cut it as unsupported); it also found GitHub showing about 357 stars for Pinky against shields' 413, so the repo line now gives a range.