Independent AI intelligence Two editions daily · ET
Fervor AI
Menu

AI Trending Briefing · November 11, 2026 · morning edition

AI now produces code and bug reports faster than people can review them, and this week's answers ship as context packs and contribution policies rather than smarter models.

Gemini 4 CarbonProject GlasswingVulnCheckGoogleChrome/modern-web-guidanceClaude SheetsHarboragent-securityai-skillsfrontier-modelsclaude-codelocal-ai

Trending AI Briefing: Wednesday, November 11, 2026 (morning ET)

The loudest AI threads on Hacker News this week were not about a model being smarter. They were about what happens after the model is done. A VulnCheck tally of Anthropic's Glasswing bug reports, a widely shared essay on AI-written code going brittle, and a list of 22 open source projects that refuse AI-generated contributions all describe the same gap: machines now produce code and findings faster than humans can check them. The fixes arriving this week are mostly context and policy, such as Google Chrome's guidance pack that teaches coding agents current web practice, plus a new Gemini model that GitHub is pitching on secure code generation.

What's hottest in AI news right now

VulnCheck says Anthropic's Glasswing bug hunt is producing far more findings than fixes. In a post dated November 9 (with its own misspelled headline, "Glasswing Overwelms Maintainers"), VulnCheck's Patrick Garrity counts 442 CVEs attributable to Anthropic this year, about 0.5% of the 93,450 published, two of them exploited in the wild. By his count only 7,349 of the 37,966 findings Anthropic reports have been made public, and Anthropic's own disclosure ledger (November 2 snapshot) marks 217 of those entries fixed, 1,654 duplicate and 419 withdrawn. Curl's maintainer, per the post, published 34 Glasswing reports, and 19 were "not a vulnerability." The honest catch: Garrity is a critic, his own table disagrees with his text on the duplicate count (1,670 versus 1,654), and he suspects a ledger bug inflates the "disclosed" figure. He also writes that AI "is a valuable tool for finding vulnerabilities." The thread hit 413 points on November 10. VulnCheck, Anthropic disclosure ledger, HN

Google made Gemini 4 Carbon available on November 10, and GitHub put it in Copilot the same day. Google claims first place on CursorBench 4.0, Perplexity's WANDR and Zapier's AutomationBench "at more than 2X lower cost per task." Introductory API pricing is $2 per million input tokens and $10 per million output, and a footnote says that doubles to $4 and $20 on November 30. In Copilot it is generally available on Pro+, Max, Business and Enterprise, rolling out gradually, billed at provider list price, and pitched "with a focus on secure code generation." Some of Google's numbers are labeled pre-release evaluations, and the launch post does not state a context window. Google, GitHub changelog

Google Chrome's Modern Web Guidance, a skill pack that pulls coding agents off old JavaScript habits, hit the Hacker News front page as a Show HN on November 10 (386 points). The agent searches an offline index of 250 modern web features and 203 use cases, loads only the guide it needs, and checks browser support against Baseline data. The repo's own evals, run November 2 to 8, report Claude Code on Opus 5.5 going from 57% to 88% of tasks passed with the guidance, and Codex from 54% to 82%. Those are the maintainers' numbers on their own task set, and the project is not new: Chrome's docs page for it was already circulating on Hacker News in May, and this week's Show HN put the open repo back on the front page. GitHub, Eval dashboard, HN

An essay called "AI usage generates a fragile codebase" drew 546 comments, the most of any AI story in the window. Evan X. Merz published it November 7 and it hit 583 points on November 10. His case: AI solves problems that fit in its context window well, and the result is shallow tests, overgrown code, falling human understanding and review that can't keep up, with more incidents and slower recovery downstream. There is no data in it. It is one engineer's anecdotal account, written after a layoff he says he "can only speculate" about. The comment volume is the signal. A day later, the "Open Source Says No" tracker listed 22 projects that ban or restrict AI-generated contributions, including QEMU, immich, Servo and Gentoo. Essay, HN, osssaysno.com

Anthropic launched Claude Whiteboards and Claude Sheets in beta and made dashboards generally available as Claude Data on November 10. All three come to paid plans. Team plans get them on by default, while Enterprise has Whiteboards and Sheets off by default and Claude Data on from November 19. Claude Data needs a connector, and certified queries and live sharing are still beta. Anthropic's own line on Sheets: "For now, sheets have simple spreadsheet functionality." Claude

9to5Mac reports Apple is preparing "Harbor," a Mac app that turns Macs into a private inference server for open-weight models. The report, from November 10, rests on evidence a leaker found, not on anything Apple said. It describes Harbor finding other Macs over Thunderbolt 5 and pooling their unified memory to run larger models, in private preview under the Claris brand. Treat it as unconfirmed until Apple ships it. 9to5Mac

New tools and features worth actually trying

Modern Web Guidance's legacy-scan. Run npx modern-web-guidance@latest legacy-scan . in a front-end repo to list patterns worth modernizing before you hand the codebase to an agent. Honest tradeoff: the README documents no output format or flags, the uplift numbers come from the maintainers' own task set, and telemetry is on by default (DISABLE_TELEMETRY=1 turns it off).

LangSmith tool policies. The changelog for November 2 to 9 adds policies that block a tool call or require approval for it, with block winning when both match. It is the cheapest way to put a hard stop in front of an agent's riskiest tools if you already trace through LangSmith. Honest tradeoff: it only governs agents running through LangSmith, and the entries in that changelog section are not individually dated. LangSmith changelog

Agentic mode in Azure Content Understanding. A November 9 preview lets document extraction take more than one pass, set with "workflow": "agentic" on API version 2026-06-01-preview. Useful when a single pass misreads dense tables. Honest tradeoff: Microsoft says it "uses more model tokens and typically takes longer," and still recommends starting in standard mode. Microsoft Foundry blog

BotPsy-0.8B, an on-device function-calling model. Tether's QVAC team posted on November 11 a 0.8B model built on Qwen3.5-0.8B that it says lifts BFCL v4 from 23.4 to 44.0. Worth watching for phone agents. Honest tradeoff: the authors say weights "will be released" under Apache 2.0 "for research and educational use," so check the model page before planning around it, and they call it best for low to medium difficulty tasks. Hugging Face

Trending AI repos on GitHub today

Read from Trendshift's daily board at about 07:17 ET; its ranks are momentum scores, not star totals. Stars below come from cache-busted shields.io badges and are rounded. GitHub's release feeds rate-limited most checks this morning, so release tags are listed only where verified.

  • Lee-xeo/Claude-Cage (#1): a Chinese-language desktop app, derived from agent-vm, that runs Claude Code and Claude Desktop inside an isolated VM with its own proxy and locale settings. It tops the board on demand for sandboxed agent workspaces. MIT (bundles a GPL-3.0 Mihomo binary), about 2.2k stars, no releases published. Caveat: shared folders let VM changes, including Git deletions, reach real host files, and the setup expects your own proxy node.
  • GoogleChrome/modern-web-guidance (#5): web-platform skills plus an offline search CLI for coding agents. It went to Show HN on November 10. Apache-2.0 package with guide content under CC-BY 4.0 per the README, roughly 3.5k to 3.8k stars depending on source, release not verified. Caveat: the before-and-after pass rates are self-run evals, and the CLI sends usage telemetry, including agent search queries, unless you set DISABLE_TELEMETRY=1.
  • Edge0-AI/Edge0 (#8): an engine that runs a 35B mixture-of-experts model on consumer devices by streaming expert weights from SSD. Back on the board after its October launch. Apache-2.0, about 9.7k stars, release not verified. Caveat: all speeds are self-measured, the models are labeled preview, and the model download plus conversion needs tens of gigabytes of free disk.
  • kuafuai/andee (#11): an experimental Android and macOS agent that operates apps through accessibility controls and screenshots. About 4.8k stars, release not verified. Caveat: the license is Apache-2.0 with added conditions (no white-labeling or bundling without permission), and the debug WebSocket binds 0.0.0.0 with no authentication.
  • yetone/magpie (#15): a menu bar app and local gateway that lets Claude Code, Codex and Gemini CLI use models across providers and accounts, with failover when a quota runs out. MIT, about 34k stars, v0.1.3761 published November 11. Caveat: sponsor provider links carry click tracking, and a daily anonymous usage ping is on unless you set DO_NOT_TRACK=1.
  • homeassistant-ai/ha-mcp (#18): an MCP server that lets AI assistants configure and automate a Home Assistant install. MIT, about 7k stars, default branch master, release not verified. Caveat: the README contradicts itself on version (a v7.3.0 banner, a 9.0.0 setup section), and the in-process integration needs Home Assistant 2026.8.0 or later.
  • addyosmani/agent-skills (#19): 25 Markdown workflow skills covering spec, plan, build, test, review and ship for coding agents. MIT, about 116k stars, release not verified. Caveat: its /review command collides with Claude Code's built-in, so call /agent-skills:review.
  • elder-plinius/CL4R1T4S (#25): a collection of extracted system prompts from major AI products. AGPL-3.0, about 52k stars. Caveat: authenticity is unverifiable, the vendors' prompts are not the author's to license, and the README embeds instructions aimed at AI readers, so don't point an agent at it.

What actually matters from today's signal

The trend to track is review capacity. Generation is cheap and getting cheaper (Gemini 4 Carbon's intro price is a land grab), so the scarce resource is a human who can say yes or no to what the model produced. That shows up in four places builders should watch: AI-found vulnerabilities queued against volunteer maintainers, contribution policies that refuse AI code outright, context packs like Modern Web Guidance that try to make the first draft less wrong, and approval gates like LangSmith's tool policies that put a person back in the loop at the expensive moment.

The counter-signal is that almost none of the evidence this week is measured. The fragile-codebase essay is anecdote. VulnCheck's math has internal inconsistencies and an author with a point of view. Google's 57-to-88 jump is its own eval on its own tasks. And VulnCheck says Anthropic claims a 94.2% true-positive rate, next to curl's experience of 19 duds in 34. Both can be true at once, because "real bug" and "worth a maintainer's afternoon" are different bars. Builders who keep treating more output as progress will drown their reviewers first and their users second. Measure what gets merged and fixed, not what gets generated.

Source access notes: Vendor pages read November 11 around 07:15 ET. openai.com/news returned a fetch error and was skipped; the Codex changelog redirected to learn.chatgpt.com and was not followed. Hacker News via the Algolia API (stories since about 00:13 UTC November 10, plus the front page). Trendshift read once at about 07:17 ET. GitHub releases.atom returned rate-limit errors for 7 of 10 repos, so those releases are marked unverified. The npm packument time map was not reachable (dist-tags read: latest and next 2.1.322, stable 2.1.311). Stories already covered in the November 10 briefings (Claude Fable 5.2, Strands Decider, AlphaProof Code, the Notion and Fireworks incident, Anthropic's IPO roadshow, Claude Code 2.1.321 and 2.1.322) were skipped. The 9to5Mac Harbor report is secondary sourcing only. A Sonnet 5.5 adversarial pass (21 fetches) caught five errors, all fixed: the 37,966 total was attributed to the ledger instead of VulnCheck (the ledger lists 7,349 public entries), the 94.2% true-positive rate was attributed to the ledger instead of VulnCheck's account of Anthropic's claim, Modern Web Guidance was framed as a new launch (it dates to at least May; only the Show HN is new), the essay author's "can only speculate" quote concerned his layoff rather than his AI claims, and Claude-Cage is derived from agent-vm, not a GitHub fork. Codex's article fact check (Part 2) surfaced two corrections folded back here: Modern Web Guidance's guide content is CC-BY 4.0 rather than Apache-2.0, and its CLI sends usage telemetry by default. The Modern Web Guidance eval table was re-read verbatim from the README's "Recent eval results snapshot" (Nov 8 rows).