AI Brief, 8 November 2026: the approval file that travels

Saturday is a thin news day and this is a short edition: arXiv announces nothing over the weekend, no frontier lab posted, and the one model that shipped has no downloads at all. What the window does contain is an argument, and it is worth more than most releases.

Apiiro published a scan on 5 November of what coding agents write into the repositories they work in. Its subject is .claude/settings.local.json, the file Claude Code creates at the git root when a user answers "Yes, and don't ask again" to a permission prompt. The approval is stored as an allow rule, and that rule is the literal command string approved, secret included. Apiiro downloaded 104,185 public copies and found a credential in 1,122. The post reached Hacker News on 7 November, and that is the part that is new: Boris Cherny of the Claude Code team replied within half an hour, and what he said is contradicted by Anthropic's own documentation.

The second item is a release almost nobody noticed. Tencent uploaded a five-layer draft model for Alibaba's Qwen3.8-27B at 14:33 UTC on 7 November under Apache 2.0, the only artifact published by any lab inside this window. It reports roughly three times the throughput of plain autoregressive decoding on agent benchmarks, and it settles a question this brief raised on 17 October. A day later it had 19 likes and zero downloads.

Third, Anthropic's 6 November write-up on agent memory carries a table saying more than its headline: a memory store is worth 0.18 to 0.32 of mean reward on a long-horizon database benchmark for five of six models, and almost nothing for the sixth. Telling the agent what to write down makes things worse, in proportion to how capable it is.

• 1,122 of 104,185 public copies of Claude Code's local settings file hold a credential, a rate of 1.08%. Apiiro validated none; one organisation has since confirmed a key was live.
• The file goes into the developer's global git excludes, never the repository's .gitignore, so the protection does not travel to a second machine, a container or a CI checkout. An issue reporting that was filed in November 2025 and auto-closed as stale; no fix has shipped.
• Tencent's DSpine drafter for Qwen3.8-27B, Apache 2.0, 7 November: mean accepted blocks of 4.8 to 5.6 tokens across five agent benchmarks against 3.9 to 4.7 for the incumbent, and 2.7x to 3.8x throughput over autoregressive decoding, all self-reported on unnamed hardware.
• On Anthropic's CL-Bench table, Sonnet 4.6 gains 0.034 from memory against 0.18 to 0.32 for every other model, and a "record only failures" instruction costs Opus 5 0.234 of its gain.

The approval file that travels #

The mechanism is small enough to show. Answering "Yes, and don't ask again" to a Bash prompt appends the approved command verbatim to the permissions allowlist:

{
  "permissions": {
    "allow": [
      "Bash(PGPASSWORD=\"S****\" psql -h <public host> -p **** -U **** -d **** -f 00_extensions.sql)"
    ]
  }
}

The example is Apiiro's own, redacted, and one of 215 files that neither gitleaks nor TruffleHog flags; those scanners caught 564 and 643 of the 1,122. A credential inside a JSON string inside a settings file is not where a secret scanner expects to look.

Why it reaches GitHub is the contested part. Anthropic's settings documentation states that on first write in a repository that does not already ignore it, Claude Code adds **/.claude/settings.local.json to the user's global excludes file, ~/.config/git/ignore or wherever core.excludesFile points. Nothing is written to the repository's own .gitignore, so the exclusion is a property of one developer's machine rather than of the project: a fresh container, a copied folder or a CI checkout has no such rule, and once the file is tracked, ignore rules stop applying at all.

Cherny's reply says the file "is meant to stay local… We automatically gitignore it when Claude creates the file, so in this case the files were manually created and checked in." That does not follow, because a global exclude on one machine cannot prevent a commit from another. Apiiro's author answered that in 539 of the 1,105 repositories a commit co-authored by Claude had touched the file, which is weaker than it sounds: a trailer on a commit that swept the file up under git add . does not show the agent chose to commit it. He also conceded under pressure that "fresh clone" was wrong, and that the exposure path is a new machine or container, a copied folder, or a file already committed.

The behaviour is known rather than discovered. An issue of 11 August 2025 reported plain-text credentials in settings.local.json and was closed as not planned; one of 19 November 2025, titled "Claude Code no longer adds local settings file to .gitignore when it is created", indicates a regression and was marked stale, as was its duplicate. Another, on the VS Code extension writing "always allow" grants into the tracked settings.json, has been open since 1 September 2026. Cherny said Anthropic has not historically done secret scrubbing and is "going to prototype a few" approaches. His other point, that allowlists are legacy and auto mode is now the default path, is fair, and the post never engages with it.

Three caveats belong on the numbers. Apiiro's "real secret" means a value matching a provider format or pointing at a public host, and no credential was tested, so none of the 2,539 it counts is known to be valid. The base rate is buried: 1,122 of 104,185 is one file in ninety-three. And Apiiro sells software that scans for exactly this; its claim that Claude Code is the only agent of sixteen writing approved commands to a project file rests on reading those agents' docs rather than testing them.

For anyone who would rather check than take the number on faith:

# tracked in this repo, now or at any point in its history?
git log --all --oneline -- '**/.claude/settings.local.json'

# and what did those standing approvals capture?
git show HEAD:.claude/settings.local.json 2>/dev/null | jq '.permissions.allow'

A drafter for somebody else's model #

The only lab artifact published inside the window is tencent/Qwen3.8-27B-DSpine-b16: five layers, hidden size 5,120, sliding-window attention over 8,192 tokens, drafting blocks of 16 tokens for a 64-layer target it taps at layers 1, 16, 31, 46 and 61. One safetensors file, Apache 2.0, targeting a model made by a different company.

The method was published in September, as arXiv:2609.36173 by Haohui Zhang and colleagues; what is new is the checkpoint. Ordinary parallel drafting predicts every position in the block in one pass, which is fast but lets the positions disagree, shortening the prefix the target accepts. DSpine keeps the single pass and restores conditioning through depth rather than through time: at every layer, each position's predicted feature is gated and written into its successor's state, so by the final layer position t+2 has been conditioned on what t+1 and t were predicted to be.

On 17 October this brief covered the Qwen3-8B version with a narrow complaint: its paper's +27.8% acceptance gain yielded only +23.3% throughput, and the difference is the drafter's own cost, paid every iteration whether its tokens are accepted or not. The new card publishes end-to-end agent throughput, so that gap can be measured rather than asserted.

Take WorkBuddy Office at low reasoning effort. Against DFlash2, the incumbent drafter, DSpine raises the mean accepted block from 4.24 tokens to 5.63, a gain of 32.8%, while throughput rises from 664.77 to 805.53 tokens per second, a gain of 21.2%. Those two numbers determine the third, because throughput is accepted tokens per iteration over wall-clock per iteration:

$$\text{tok/s}=\frac{a}{\tau }⟹\frac{{\tau }_{\mathrm{DSpine}}}{{\tau }_{\mathrm{DFlash}2}}=\frac{a_{\mathrm{DSpine}}/a_{\mathrm{DFlash}2}}{(\text{tok/s}{)}_{\mathrm{DSpine}}/(\text{tok/s}{)}_{\mathrm{DFlash}2}}$$

where $a$ is the mean accepted block length in tokens and $\tau$ the wall-clock time of one draft-and-verify iteration. Dividing throughput by acceptance length gives iterations per second: 664.77/4.24 = 156.8 for DFlash2 against 805.53/5.63 = 143.1 for DSpine, so an iteration costs 6.38 ms against 6.99 ms. DSpine's iteration is 9.6% slower, and 1.328 ÷ 1.096 = 1.212 recovers the 21.2% exactly. Autoregressive decoding on the same row runs at 4.76 ms per token, so if verifying a 16-token block costs roughly one autoregressive step, the drafters account for about 1.6 ms and 2.2 ms of each iteration. That last figure is an estimate resting on that assumption; the 9.6% is arithmetic on Tencent's own numbers.

Every number here is Tencent's, on hardware the card does not name, and the project's GitHub repository publishes acceptance lengths for the 8B target only, so the card is the sole source. Serving it needs SGLang, a --speculative-algorithm DSPINE flag and a long list of cache settings, a real barrier to casual reproduction. The repository has 47 stars; the checkpoint had 19 likes and no downloads a day later.

Memory, and the models that cannot use it #

Anthropic's engineering team published a write-up on agent memory on 6 November separating four things usually bundled together: the transcript, the notes an agent writes, the structures those notes are organised into such as a wiki, and whatever is preloaded into each session. Its new idea is "dreaming", an offline pass in which the model re-reads transcripts and notes and rewrites them rather than appending. Over 128 such passes on a corpus of roughly 350,000 files, answering from the resulting wiki alone rose from 13% to 48% of graded criteria.

Five of the six gain between 0.18 and 0.32. Sonnet 4.6 gains 0.034, ending below where Opus 4.7 ends despite starting above where it starts. Writing useful notes and reading them back is a capability in its own right, not continuous with whatever else the benchmark measures.

The companion result has a design consequence. Instructing the agent to record only its failures cost Opus 5 0.234 of its memory gain, Opus 4.7 0.150, and Sonnet 4.6 0.020: the penalty for prescribing what to remember scales with how capable the model is, inverting the instinct that stronger models need tighter scaffolding. The Pokémon run has the same shape, Sonnet 3.7 writing 413 memory files across 225 folders for one badge while Fable 5 wrote nine and earned four. These are Anthropic's own evaluations of its own models, with no evaluation data or prompts released.

Also notable #

• A video-and-audio diffusion model advertised as "31B compressed to 14B" was uploaded on 6 November and reached Hacker News on the 7th. HyperFlow H3 Flash drops 3 of MiniMax-H3's 50 blocks, factorises 102 linear layers to low rank, applies rotated W8A8 INT8 across 180 more, and samples in six steps with no classifier-free guidance: a 5.2-second 1344x768 clip in 36 seconds on one H200. Two things the headline hides. MiniMax's card says about 13B of the base model's 33B parameters sit in AdaLN branches that "do not need to be loaded for inference-only deployment", and the shipped configs show that collapsing those, not pruning, accounts for most of the drop; the speed comes from six forward passes instead of forty-nine. And there is no quality measurement of any kind, which three commenters raised and nobody answered. The weights carry MiniMax's community licence, excluding the EU, UK, Korea and the US.
• Microsoft's AI Frontiers group has been wound down, according to John Langford, who founded it and posted on 6 November: the roughly fifty-person group behind Autogen and the Fara computer-use agent was merged into Microsoft AI in September, the new leadership favours scaling over research, and he has left with his team. Microsoft's research site confirms only the reorganisation, so the dissolution is self-reported by a departing founder.
• Vals AI scanned 2,655 benchmark runs of Inkling 2 Small and published on 6 November: 50 contain profanity, 316 instances, two runaway runs accounting for 241. The finding underneath is a base-rate lesson. 46 of 48 graded runs with swearing failed, but 75% of graded runs failed anyway and 96% of failed runs contain no expletives, so the signal is near-useless as a predictor.
• Nvidia's China exposure drew two reports on 7 November, both resting on documents rather than published sources: The Verge found empty offices at addresses registered to Commerce-approved H200 buyers, and TechCrunch reported a memo alleging a Megaspeed executive was recruited to spy on Nvidia's chief executive.
• No release landed in the window from vLLM, SGLang, Ollama, transformers, PyTorch or TensorRT-LLM; llama.cpp's six overnight tags are nightlies, not releases.

What to watch #

• Whether Anthropic changes the default rather than the advice. The fix is small and testable: write the ignore rule into the repository rather than the developer's global excludes, or refuse to store a credential-shaped value. The oldest issue describing the behaviour is fifteen months old, so watch the changelog, not the thread.
• Whether anyone runs DSpine's 27B checkpoint who did not train it. The weights are Apache 2.0 and a single file, so an outside measurement costs one GPU and an afternoon, and would be the first independent number on any DSpine checkpoint. The figure worth more than throughput is acceptance length at temperature 1 on a task the drafter was not tuned for.
• Inkling 2 Small's Apache-2.0 weights, flagged here on the 6th and again yesterday, fall due this coming week on Thinking Machines' own wording. Nothing has appeared under thinkingmachines since July, so the benchmark scans now appearing all describe a model only its API serves.
• Still open: Ryan Williams, Russell Impagliazzo and Mohan Paturi, who agreed on 26 October to organise the independent examination of the Exponential Time Hypothesis manuscript, have published no assessment, and the gap between the bound its Lean file proves and the one its abstract claims still stands. The placebo control asked for on the 3rd has not been run, Nanbeige4.3-33B still has no independent score, Cursor no account of how the tampered extension reached its marketplace, and no decision-model vendor a fail-open rate, asked here since 10 October and now twenty-nine days.