Approved commands are saved word for word in .claude/settings.local.json, passwords included, and 215 of those files slipped past gitleaks and TruffleHog. Search your org today.
GPT-6 Astra met 69.9% of hidden acceptance criteria on average but cleared every one on barely a quarter of tasks. Budget for human cleanup on agent work.
The author reports about 9 to 10 tokens a second on a 16-core Ryzen with a 56.56 GiB checkpoint. Every number is self-reported, so test it on your own box.
Most of his pull requests now come from Claude Code or Codex, so he shows a short human opener and folds the agent's text away. Try it on your next agent PR.
Juggling up to 20 agent threads wore him out, so tickets became markdown files in git with a ranked review page. His goal: a minute per ticket, not twenty.
The roughly 50-person group behind Autogen was folded into Microsoft AI in September, and he left. If you rely on Autogen, watch its maintainer activity.
CVE-2026-19868 hits the SonicOS SSL-VPN service after reports it may have been exploited. If you manage SonicWall firewalls, check the advisory and patch.
The BriefSince about November 5, Outlook.com, Hotmail and Live addresses have refused some mail from ordinary, low-volume senders, with bounces that blame SPF or a missing DMARC record. On November 9 a Microsoft moderator called it an ongoing Exchange service issue under investigation, with no cause or fix date. Many senders say adding a simple DMARC record stopped the bounces, so check every domain you send from today.
Level UpLearn DMARC alignment this week. A message passes DMARC when SPF or DKIM passes for the same domain as the From address. Publish v=DMARC1; p=none on one low-volume domain, read the reports for two weeks, then step up to quarantine. →Microsoft: set up DMARC in Microsoft 365
Caught Up?
Supply chain week: Trigger.dev said an attacker read customer environment variables, two days after a Northflank incident.
Google said stolen AI API keys ran up $100,000 in fraud charges in one day. Lock down and rotate cloud AI keys.
Gemini can train on saved chats, and chats a human reviewed can be kept up to three years. Check your Gemini activity setting.
An Alpine Linux OpenSSH bug let a long password open key-only logins. Attackers started trying it within nine hours.
Claude Code sometimes put the signed-in user's email in web request headers. Anthropic shipped a stopgap check and promised a full fix.