2026-11-05

Go has announced a new JSON API centered on encoding/json/v2, a redesign of how the standard library handles JSON, according to the Go blog. The naming casts it as a successor to the existing encoding/json package rather than a separate third-party library. The announcement as supplied does not detail release timing, specific version numbers, or backward-compatibility guarantees, so those remain unconfirmed.

OpenAI says its autonomous vulnerability-research pipeline dynamically reproduced 1,724 Linux kernel vulnerabilities in a single October 2026 scan and generated 948 working local privilege-escalation \(LPE\) exploits that let an unprivileged local user obtain root, plus 291 information-leak proof-of-concepts. The company put total API cost at $1,213,430, or about $1,279 per successful LPE exploit, and cites roughly $359 as the lower marginal development cost; it also says at least 10 exploitation techniques were confirmed novel by third-party experts, including new cache-spraying objects, page grooming, data-only arbitrary-write escalation, and arbitrary type confusion. These figures are OpenAI&\x27;s own account, and the post does not say how many of the flaws were previously known, already patched, or reported upstream.

Tencent has released Hy4, an open-weight foundation model, with open-sourced HyCell and HyPDE models for single-cell representation and physical-field modeling. For game development, Tencent says it worked with its Interactive Entertainment Group to curate training data and evaluations covering feature implementation, gameplay logic, state tracking, and asset pipelines, and adapted Hy4 for Unreal Engine, Unity, and Godot plus multiplayer development. The release acknowledges a gap between Hy4 and top proprietary models on internal benchmarks for research-level mathematics, long-horizon coding, model self-improvement, and advanced visual question answering, and says it will continue scaling pre-training and post-training.

Anthropic has published a technical specification and code for FlashProve, a cryptographic system intended to prove that a given LLM output was produced by a specified model and set of weights. The approach calls for providers to publish a model fingerprint that can be matched against outputs without disclosing the weights, and Anthropic says verification can run locally. The company describes the research as ongoing and says it has no deployment plan; the stated goals include detecting model substitution and checking third-party claims about which model performed a task.

Moonshot AI has published open weights for Kimi K3.1 Pro on Hugging Face, the first model in its K3.1 series. The model is natively multimodal and agent-oriented, with 2.8 trillion total parameters, 104 billion active parameters, and roughly 1 million tokens of context; the weights are released in MXFP4 quantization. Moonshot also offers an API through platform.kimi.ai under the kimi-k3.1-pro identifier, compatible with OpenAI and Anthropic interfaces. The supplied material does not include verified benchmark results.

RunAnywhere open-sourced an AWS Trainium2 inference engine for GLM-5.3-Flash, a 320B Mixture-of-Experts model with a 1M-token context, that serves the model on one trn2.48xlarge and rewrites each layer half as a single NKI kernel, or each whole layer for sparse-attention layers. On the same layout, a batch-8 decode step fell from 32.2 ms in the 17 October build to 24.2 ms on 1 November; the author attributes the gap to long chains of small vector-engine instructions at about 153 ns fixed cost each, HBM writes at every kernel boundary, and 125 cross-chip collectives per step. The remaining 24.2 ms includes a 6.1 ms memory floor, 10.0 ms of engines busy beyond it, 4.6 ms of waits inside kernels, and 2.8 ms of exposed collectives. An approximation remains in sparse-attention prefill on 1.2% of selections, shifting next-token log-probabilities by 0.012 to 0.021 nats on average and changing the top token at 3 of 448 positions; no task-level evaluation has been run on this build.

An IEEE Spectrum article argues that AI-assisted vulnerability discovery is exposing decades of accumulated technical debt in software and forcing organizations to remediate it. The piece is an argument about software maintenance and security practice, not the announcement of a specific tool, version, or independently measured result, and the supplied material provides no remediation figures. It is aimed at software engineers and security teams facing a larger volume of vulnerability fixes.

A technical post profiling Huginn-style looped transformers on a B200 reports that sharing one set of recurrent weights saves storage but, by itself, does not prevent the GPU from rereading those weights from HBM at every iteration. In a synthetic chain of eight matmuls, one shared 72 MiB weight ran 24% faster than eight identical copies and read almost nothing from HBM; at 288 MiB, which exceeds L2, the advantage disappeared. In the full Huginn Core teaching implementation with random weights, eight iterations took roughly eight times as long and read about eight times as much HBM data as one. The author links the code and raw Nsight Compute data and asks whether persistent kernels could keep recurrent weights on chip across iterations.

The Information reported that Huawei has told some customers its next-generation flagship AI chip, Ascend 960DT, will rely mainly on Samsung and SK Hynix HBM and that those customers must source the memory themselves because Chinese HBM capacity is insufficient. The report also describes HBM being shipped into mainland China soldered to low-performance processors and declared under processor codes via Hong Kong, then removed; a Shenzhen chip broker cited by the report said a single HBM3E unit now costs about $4,000, up from a few hundred dollars a year earlier. These details are secondhand, and the smuggling and pricing claims were not independently verified in the supplied material.

Apple says it will begin checking iCloud content shared through “anyone with the link” links for harmful material starting with iOS, iPadOS, macOS, and visionOS 27.3. Content shared only with specified people is not covered, according to the report. If content is judged harmful, Apple reserves the right to move, refuse, modify, or delete it, and may restrict or disable accounts that upload harmful material and refer cases to law enforcement when necessary.

Oracle reportedly canceled a five-year AI chip lease with Tencent worth about $7 billion after US officials raised concerns about the deal, according to a Financial Times report cited by Seeking Alpha. The arrangement would have given Tencent access to roughly 100,000 advanced AI chips through Oracle data centers in Southeast Asia.