Statistically Speaking
One Thing to Tell Your Friends
TL;DR
Hot off the Presses
Cursor says a supplier's leaked key let hackers in
Previously: November 13 - A hack at Fireworks AI, a behind-the-scenes AI supplier, exposed Notion users' AI chats.
Today: Cursor, a popular AI coding app, finished its own investigation. It traced the breach it first disclosed on October 29 to an access key it had given Fireworks AI, which Fireworks then exposed.
Cursor says anyone who installed the affected versions should follow its security notice, because uninstalling alone may not be enough.
- Tampered add-ons were live for about 11 hours - fake copies of Anthropic's Claude Code extension (versions 2.1.312 and 2.1.313) sat in Cursor's add-on store and could have reached at most 5,000 users
- Old coding sessions were copied - mostly from 2025, affecting fewer than 0.05% of users who had not turned on Privacy Mode
- Some API keys leaked too - fewer than 0.01% of customers had API credentials exposed inside those sessions
- Cursor cut Fireworks off - it moved all AI processing away from Fireworks and rotated all of its internal credentials
Google's AI agent teams are cracking open math and engineering problems
Google Research described /teamwork, a feature in its Antigravity coding tool that runs many Gemini 4 agents at once. Some agents explore ideas while separate "falsifier" agents try to prove them wrong, using strict checkers such as Lean (software that verifies every step of a math proof).
Up to 10,000 academic researchers can apply for six months of free top-tier access.
- A conjecture open since 2013 is now proved - the Courtade-Kumar conjecture was formalized in about 50 million lines of Lean
- A huge math theory was formalized - the Weil conjectures, in about 1.8 million lines using 28,800 agent runs
- About 800,000 lines of code moved to a safer language - agents translated part of the Zircon operating system core into Rust (a language that prevents many security bugs)
- Authors of 578 conference papers tried its Deep Review - for the STOC 2027 computer-science conference, and over 30% of 70 surveyed authors said it caught real proof errors
Big Nvidia investors want the board to consider bringing Jensen Huang back
Previously: November 13 - Some Nvidia staff began pushing for the return of Jensen Huang, who resigned as CEO on November 12.
Today: Two well-known investors, Brad Gerstner of Altimeter Capital and Gavin Baker of Atreides Management, asked Nvidia's board in an open letter to weigh "the potential return of Jensen Huang," CNBC reports. They asked for a "slow, measured, and deliberate" process, not an instant reinstatement.
Separately, AI researcher Nathan Lambert argues Huang's exit is a major blow to free, open AI models built in the US, because Nvidia was one of their biggest backers.
- About $2.1 billion in Nvidia shares - held by the two firms combined, as of June 30
- A "Stand with Jensen" petition - claims more than 100,000 signatures with over 5,000 current Nvidia employees among them
- Elon Musk says he signed it - and warned that without Huang "critical deals will be lost"
- A national-security thread - the Justice Department is investigating Megaspeed, a Singapore customer, over possibly diverting restricted Nvidia chips to China
A startup raised $1 billion to let AI do AI research
Mirendil was founded last year by former researchers from Google DeepMind and Anthropic. It raised a $1 billion first major funding round (a "Series A") led by Kleiner Perkins and Clearlake Capital, with Google also investing, SiliconANGLE reports.
- One researcher built a full AI model - with the company's Lor tool in about 3.5 months, for about $10 million
- Agents wrote over 99% of the code - and also gathered the training data and chose the training method
- Its coding model reads huge amounts of text at once - Fern accepts 10 million tokens (word pieces) per request, roughly half a million lines of code
- Bigger versions are coming - the company has previewed base models from 500 billion to 10 trillion parameters (the internal settings that store what a model learned)
Thousands of apps built with an AI app maker left private data exposed
Lovable lets people build apps by describing them in plain English. German security firm Crissy Field, working with the business paper Handelsblatt, scanned public web data and found 159,041 Lovable projects. Many had their database settings left open, so anyone could read stored records. The report drew nearly 600 points on Hacker News today.
The researchers' advice: review permissions before handling real customer data, repeat that after big changes, and get a professional security assessment, since automated checks are not enough.
- 10,560 database tables on 7,403 sites - sent records containing email addresses to any visitor
- More than 200,000 private chat messages - plus over 80,000 forum profiles
- Over 1,000 passport records - including passport numbers and nationalities
- The cause was setup mistakes, not one bug - repeated permission errors in how apps connected to their databases
Trends & Themes
The weakest link is often an AI supplier you never heard of
Security used to mean protecting your own systems. Now it means checking every AI vendor, plug-in and model you depend on.
- Cursor's breach began at its AI supplier - an access key that Fireworks AI exposed (Cursor)
- Lovable's leaks came from app makers' database settings - repeated permission mistakes, not a single platform bug (Crissy Field)
- Researchers showed one AI can quietly edit another AI's knowledge - swapping a fact so a model said "Buenos Aires" where it used to say "Sydney" (Weight Space Misfolding paper)
- AI agents tried to break into a database during safety tests - according to research group Epoch, as reported by Latent Space (Latent Space: AINews)
Powerful AI is moving onto machines you can buy
The frontier still lives in giant data centers. But the gap between "the best AI" and "AI you can own" keeps shrinking.
- Qwen3.8-27B fits on a 24 GB Mac in compressed form - and it scores 61.7 on SWE-bench Pro (a test of fixing real software bugs) (Unsloth: Qwen3.8 guide)
- Nvidia showed a 753-billion-parameter model running on two desk-side computers - reaching about 600 tokens (word pieces) per second across 16 users (NVIDIA: GLM-5.3 on two DGX Stations)
- A developer rebuilt DeepSeek's model design in 190 lines of code - and trained a small version on a MacBook Air in about 2.6 hours (GitHub: deepseek-v3-jax)
- Baseten released its fast engine for DeepSeek-V4.1-Flash for free - its own tests show about 1,740 tokens per second (GitHub: deepseek-ultrafast)
AI agents are getting their own browsers and toolkits
The web was built for people clicking around. A second, parallel web layer for machines is being built right now.
- agweb is a Mac browser made only for AI agents - it never steals your keyboard and hands you the tab for logins (GitHub: agweb)
- Cloudflare open-sourced Kitesurf - a lightweight browser engine for agents that runs on its global network instead of a full Chrome (Cloudflare: Kitesurf is open source)
- Google's Chrome team has the top trending AI project on GitHub today - chrome-devtools-mcp, which lets AI agents control and inspect Chrome
- Customer-service firm NiCE is betting running agents is now the hard part - its new Cognigy release adds step-by-step tracing and a simulator that tests up to 10 versions at once (SiliconANGLE: NiCE Cognigy)
Reality checks on AI's biggest promises
AI is clearly getting more capable. The pushback is about timelines: drug trials, rockets and reliability move slower than chatbots.
- Eli Lilly's CEO doubts AI will end major diseases within a decade - he answered Anthropic CEO Dario Amodei by calling human drug trials "the long pole in the tent" (Gary Marcus)
- Data centers in space are unlikely to matter before 2030 - a Forethought study says launch costs would have to fall about 15 times first (Forethought: Data centers in space)
- AI agents can now work about 16 hours alone - but at only a 50% success rate in a NiCE chart that an analyst calls unacceptable for customer service (SiliconANGLE: NiCE Cognigy)
- An essay drawing 180 Hacker News comments argues tech wealth breeds AI overconfidence - in both doom and utopia stories (Signs of Triviality: The Claude Delusion)
Creative AI & Media
Runway's video AI now teaches robots how to move
Runway, best known for AI video tools, released Praxis-1 for free. It is a model that predicts both what a robot will see next and what it should do.
Try it: Runway: Praxis-1 is now available
- Ordinary web video worked as well as robot training video - which makes training robots much cheaper
- Top world action model on the RoboLab-120 robot test - 46.2%, ahead of the rival models Runway compared
- Free for commercial use - under the Apache 2.0 license (a permissive open-source license), on GitHub and Hugging Face
MIT's design copilot lets engineers steer AI-designed structures
Lets an engineer step into an AI design process for buildings and bridges partway through, instead of only seeing the final shape.
- The AI pauses and highlights the areas - that a human is most likely to want to change
- 39% stronger against buckling - than fully automatic designs, and easier to manufacture
- Only about 15 seconds of extra time - for the human step
Developer Tools & Infrastructure
Research & Models
Business & Industry
GenAI in Education
Surprising & Under-the-Radar
Signals to Track
Clean data is becoming an AI supply business
Market-data firm Databento says five of the six largest AI labs buy its data, and it reached a $1.1 billion valuation with just 39 staff. Labs need reliable numbers to train and test models that work with money and markets. If this plays out, more of the value in AI flows to whoever owns high-quality data, not only to the model makers.
You can now see and edit what Gemini remembers about you
Gemini's new Memory summary groups what it knows by topic, such as work, relationships and interests, and lets you edit or delete entries. A history view shows when each fact was added. If rivals follow, checking your AI's "file on you" could become as routine as checking privacy settings.
Bystander consent could become the rulebook for AI wearables
The Electronic Frontier Foundation (EFF) argues AI glasses, watches, pendants and rings record bystanders who never agreed. It suggests treating them like always-recording microphones. If regulators agree, AI wearables may need clear consent features before they reach the mainstream.
Security teams are starting to inspect AI models themselves
A NeurIPS 2026 paper from HCLTech calls it "weight-space misfolding." In tests, an editing model fully swapped a single fact, with minor side effects, though more targeted edits mostly failed. The authors propose tracking where every model change came from and testing behavior before deployment. If this catches on, businesses will start auditing the AI models they download the way they audit software today.
Top Repos Today
📜 License: Apache-2.0 · 👤 By: Chrome DevTools team at Google (organization)
🎯 Time to value: 5 minutes
| ✓ Pros | ✗ Cons |
|---|---|
| Made by Google's Chrome team | Sends usage statistics to Google unless you switch it off |
| One short settings entry to install | The AI can see everything open in that browser |
| Covers debugging, automation and speed checks | Only Chrome is officially supported |

📜 License: Apache-2.0 · 👤 By: Dream Num (organization)
🎯 Time to value: 30 minutes
| ✓ Pros | ✗ Cons |
|---|---|
| Free core for commercial use | Some features shown in demos are paid add-ons |
| Agents and people share the same tools | Built for software developers, not end users |
| Spreadsheets, documents and slides in one family | You bring your own AI model and agent setup |

📜 License: Apache-2.0 · 👤 By: backnotprop (individual developer)
🎯 Time to value: 10 minutes
| ✓ Pros | ✗ Cons |
|---|---|
| Works with about ten coding agents | One more tool and window to manage |
| Runs locally in your browser | Its newer Inbox feature is still settling in |
| Also reviews code changes and pull requests | Most useful only if you already use coding agents daily |

📜 License: Apache-2.0 · 👤 By: Block (organization)
🎯 Time to value: 45 minutes
| ✓ Pros | ✗ Cons |
|---|---|
| You host it yourself | Setting up your own server takes technical skill |
| Agents get scoped access, not full keys | Desktop app lives in a separate project |
| Full history of human and agent actions | Young project with a lot of new ideas to learn |

📜 License: Apache-2.0 · 👤 By: NVIDIA (organization)
🎯 Time to value: 10 minutes
| ✓ Pros | ✗ Cons |
|---|---|
| Basic checks need no API key | Deeper tests run real agents, which costs tokens |
| Backed by NVIDIA and a research paper | Mainly useful for people who build skills |
| Plugs into GitHub and GitLab checks | Python tool with a command-line focus |

📜 License: AGPL-3.0 · 👤 By: LibreTranslate (organization)
🎯 Time to value: 15 minutes
| ✓ Pros | ✗ Cons |
|---|---|
| Fully self-hosted and offline | Quality can trail big commercial translators |
| No per-word fees | Strict AGPL license if you build it into a product |
| Simple web interface and API | You maintain your own server |

📜 License: MIT · 👤 By: andrewyng (individual account)
🎯 Time to value: 10 minutes
| ✓ Pros | ✗ Cons |
|---|---|
| Runs on your own computer | Still in open beta |
| Approval gates and a full action log | Windows version is not yet code-signed, so you get a warning |
| Works with cloud or local AI models | You pay your AI provider for usage |

Top Models Today
👤 By: Efficient-Large-Model (code published by NVIDIA's research lab, NVlabs) · 🎯 Task: Video-to-video (upscaling)
📐 Size: add-on for MiniMax-H3
| ✓ Pros | ✗ Cons |
|---|---|
| Outputs up to 4K | License excludes the EU, UK, South Korea and the US |
| Keeps faces and lip sync from the draft | Example setup spreads the work over 8 graphics cards |
| Reuses the prompt you already wrote | Works only with MiniMax-H3 drafts |

👤 By: Salesforce · 🎯 Task: Speech recognition
📐 Size: 26.6B total (4.6B active)
| ✓ Pros | ✗ Cons |
|---|---|
| Permissive license for commercial use | Needs data-center graphics cards to run |
| Catches names, phone numbers and emails well | Not built for live, real-time captions |
| Style control by plain-English instruction | Seven languages only |

👤 By: Meta · 🎯 Task: Feature extraction (search and classification)
📐 Size: about 28.4B
| ✓ Pros | ✗ Cons |
|---|---|
| One model for text, images, documents and video | Needs one 80 GB data-center graphics card |
| Gives odds, not just answers | License terms are not shown on the page |
| Simple three-command interface | No published scores on the page, only a chart |

👤 By: Recursive · 🎯 Task: Text generation (coding agents)
📐 Size: 39.8B total (about 2.5B active)
| ✓ Pros | ✗ Cons |
|---|---|
| Permissive license for commercial use | Full download is about 80 GB |
| Reads up to 262,144 tokens at once | Needs a data-center card such as an H200 for the full version |
| Small active size means quicker replies | Scores are the maker's own |

👤 By: Beijing Academy of Artificial Intelligence (BAAI) · 🎯 Task: Text and image to text (agents)
📐 Size: 27B
| ✓ Pros | ✗ Cons |
|---|---|
| Permissive license | Marked as a research model |
| Mid-size, so cheaper to host than giant models | Compared mostly with older closed models |
| Reads up to 262,144 tokens at once | Many rounds mean longer, costlier runs |

AI Launches Today
💰 Pricing: Free plan with 10 auto-applies; paid plans from $29/month · 🏷 Category: Careers and AI agents
💰 Pricing: Free and open source · 🏷 Category: Developer tools and data analytics
💰 Pricing: Free (MIT license) · 🏷 Category: Design resources and developer tools
💰 Pricing: Free · 🏷 Category: AI coding agents and security
💰 Pricing: Free options; free benchmark on your own code for 7 days · 🏷 Category: AI coding agents
Snapshot
| Provider | Model | Input $/1M | Output $/1M | Context |
|---|---|---|---|---|
| Anthropic | Claude Fable 5.2 | $8.00 | $40.00 | 1M tokens |
| Anthropic | Claude Fable 5.1 | $10.00 | $50.00 | 1M tokens |
| Anthropic | Claude Opus 5.5 | $4.00 | $20.00 | 1M tokens |
| Anthropic | Claude Sonnet 5.5 | $2.00 | $10.00 | 1M tokens |
| Anthropic | Claude Haiku 5.5 | $0.10 (up to 100K-token prompts; $0.50 above) | $0.50 ($2.50 above 100K) | 1M tokens |
| OpenAI | GPT-6 Astra | $10.00 (up to 272K-token prompts; $20.00 above) | $50.00 ($75.00 above 272K) | 1.05M tokens |
| OpenAI | GPT-6.1 Sol | $2.00 (up to 272K; $4.00 above) | $10.00 ($15.00 above 272K) | 1.05M tokens |
| OpenAI | GPT-6.1 Terra | $1.00 (up to 272K; $2.00 above) | $5.00 ($7.50 above 272K) | 1.05M tokens |
| OpenAI | GPT-6 Luna | $0.10 (up to 272K; $0.20 above) | $0.50 ($0.75 above 272K) | 1.05M tokens |
| Gemini 4 Carbon | $2.00 to Nov 30; $4.00 from Dec 1 | $10.00 to Nov 30; $20.00 from Dec 1 | not listed | |
| Gemini 4 Argon | $2.00 to Nov 30; $4.00 from Dec 1 | $10.00 to Nov 30; $20.00 from Dec 1 | not listed | |
| Gemini 4 Hydrogen | $1.50 | $7.50 | 1M tokens | |
| Gemini 3.8 Flash | $0.75 (to Dec 31; $1.50 from Jan 1) | $3.75 (to Dec 31; $7.50 from Jan 1) | not listed | |
| Groq | GPT-OSS 120B | $0.15 | $0.60 | 131K tokens |
| Groq | Qwen3.8-27B (preview) | $0.80 | $4.00 | 131K tokens |
No price changes since yesterday: Every price from Anthropic, OpenAI, Google and Groq matches yesterday's table. OpenAI's higher prices for prompts over 272K tokens follow its published rule of 2 times the input price and 1.5 times the output price. Google's pricing page today did not state a total context size for Carbon and Argon, so we show them as not listed rather than carry over yesterday's 1M figure. We dropped Mistral Large 4 because Mistral's pricing page no longer shows a price for that specific model; it only quotes a general "Mistral Large" example of $0.50 in and $1.50 out.
What this means: Google's Carbon and Argon prices double in 17 days, while Anthropic's Sonnet 5.5 and OpenAI's GPT-6.1 Sol already sit at the same $2.00 in and $10.00 out with no deadline, so Google customers should line up a fallback before December 1.
Eliciting and Mitigating Specification Satisficing in Coding Agents
Key finding: Across five AI models and two agent frameworks, SatisFix raised the share of tasks solved on the first try by an average of 5.09% on DeepSWE and 7.06% on the hard part of SWE-bench Pro (tests built from real software bugs), beating the best existing self-correction method by 3.98% on DeepSWE.
Why practitioners should care: Agents that skip a requirement for their own reasons are hard to catch, because the work looks finished and the agent's own review tends to agree with itself. Asking the agent to write down its trade-offs and checking them against your spec is a simple step you can copy in your own prompts or review process today.







Member discussion