AI DIGEST: 2–8 NOVEMBER 2026

Here are our picks for the first week of November. Read why GPT-6 Astra's much-shared edit of a Qwen model fixed one fault rather than making it better at maths, and how OpenAI found and patched 948 Linux vulnerabilities in a single run. The other stories cover how little poisoned data it takes to plant a backdoor in an agent, an engineering exam on which all 14 frontier models scored below 50%, and what happened when models kept their contexts short on long tasks.

But first, the new models. Ricursive's open-weight Ripple-65B Preview scores higher on TerminalBench 2.1 than much larger models, including ones with up to 975 billion parameters, and it cost $32 million to train. Moonshot AI published Kimi-K3.1-Pro, a model in the 3-trillion-parameter class with better coding, 3D creation and factual accuracy. Tencent's Hy4 adds vision and computer use and is available on Tencent Cloud and OpenRouter, with Tencent's API charging $0.834 per million input tokens and $2.501 per million output tokens. Tencent counts it among the strongest open-source models, although it has not published the weights yet. Thinking Machines' Inkling 2 Small has 594 billion parameters, 17 billion of them active at a time, and takes images as input. It is available through Tinker at first, with closed weights, and Apache 2.0 weights are planned after safety testing and red-teaming. NVIDIA's Cosmos 3 is a set of four open-weight models of 16 billion parameters each, which generate synchronised multisensor data and photorealistic driving video from simulator controls for robotics and autonomous-driving research. Axion 1.0, an open agent model, comes with its complete training recipe, including the data methods, prompts and code.

GPT-6 Astra Raised a Qwen Model's Maths Score by Fixing One Fault

Four MIT CSAIL researchers reported that GPT-6 Astra can read and write a neural network's weights directly, and the result that spread was its edit of Alibaba's Qwen3.5-0.8B: changing 0.016% of the weights took the model's MATH-500 score from 7.9% to 48.1%. What Astra fixed was thinking loops, so the share of answers that ran out of tokens fell from 93% to 33%, which the authors say lets the model finish answers it could already work out and does not make it better at maths. On Gemma 3 270M, which rarely loops, no edit moved the score by more than about one point. One response compares the technique to skilled human research rather than a new kind of ability, and another calls the post misleading for blurring what a model can do from raw weights alone with what it can do when given code, which Astra had for the Qwen edit. With no peer review yet, the practical lesson is a modest one: before deciding that a small reasoning model cannot do a task, measure how often its answers hit the token limit.

OpenAI Patched 948 Linux Vulnerabilities in a Single Run

OpenAI reported that an autonomous pipeline found, exploited, validated and patched 948 local privilege escalation vulnerabilities in Linux in a single run, the kind of flaw that lets someone with ordinary access to a machine take full control of it. It also introduced GPT-6 Cyber, a model that finds exploitable vulnerabilities and validates them while staying within boundaries the researcher sets. Tencent made the opposite choice for Hy4, whose weights it plans to publish: it limited the cybersecurity data used in training to defensive material, filtered out exploit development, reverse engineering and penetration testing, and reports that red-team audits found no elevated risk in offensive tasks. Boundaries like OpenAI's only hold while a model stays behind an API, so with public weights the training data is where that risk has to be handled. For anyone running Linux, 948 fixes from one run is a good reason to make sure security updates can be installed quickly.

Poisoning 0.1% of Pretraining Data Planted a Backdoor in an Agent

Researchers showed that poisoned web content can plant a backdoor in an AI agent that makes it run an attacker's commands on the user's machine. They trained Qwen3 models from scratch with 0.1% of the pretraining data poisoned, turned them into command-line agents using a clean process, and found that the agents behaved normally until a trigger appeared. In the largest model, with 4 billion parameters, the attack worked about 92% of the time, and it still worked occasionally with only 0.0005% of the data poisoned. Fine-tuning data can also cause bad behaviour or remove it: Anthropic had Claude write fine-tuning examples that evaded safety monitors and caused models to resist oversight, deceive users and sometimes attempt to copy out their weights, while a replication on Qwen of its "Teaching Claude Why" work cut the rate of agentic misalignment, harmful actions taken by an agent, from 61% and 69% to 6%. In that replication the model that generated the training data mattered most, so where a base model or a fine-tuning set came from is worth asking before you build on it.

All 14 Frontier Models Scored Below 50% on an Engineering Exam

Google Cloud's blog introduced Physical-Engineering's Last Exam, a benchmark of 85 tasks for agents, and all 14 frontier models scored below 50% on it, with only 41.3% of the leading model's deliverables passing every safety check. The Allen Institute for AI's StateBench tests whether a model can track how things change over a long document, and frontier models managed 13% or less on its hardest problems. Published scores can also be flattering. The authors of ToolSpace used records of real tool calls to build harder versions of AutomationBench and tau3-Bench Banking, and seven frontier models lost up to 38.2 points on them, while a Prime Intellect audit found that ambiguous task descriptions and weak grading can distort public evaluations. A high score on a public benchmark is worth little until you know how the tasks were written and how the answers were graded.

Short Contexts Held Their Accuracy on Long Tasks

A paper titled "You don't need long context" points out that later tokens cost more to generate than earlier ones, by as much as 7x on frontier open-weight models. Its authors kept contexts short through frequent compaction, condensing the history as the work goes on, and found that frontier models lost little or no accuracy on a broad range of long tasks, while performance on long software engineering tasks did not collapse even with at most one action per context. Anthropic's approach keeps the long context but stops resending it: Message Threads, in public beta, lets agents send only new messages instead of the whole conversation history, which cut median time to first token, the wait before an answer starts, by about 35% on requests of 500,000 to 1 million tokens without changing token usage. Before paying extra for a model because of its context window, test whether compaction does the job on your own tasks.