News for Big Boiis

64 stories for Tuesday, 3 November 2026

Gathered from 48 sources between Mon 2 Nov, 15:44 and Tue 3 Nov, 15:44, merged wherever several sources covered the same story.

The stories of this edition, grouped by topic News for Big Boiis Tue 3 Nov 1 2 3 4 5 6 7 8 13 14 15 17 18 19 23 24 25 26 28 29 30 46 47 48
The top 24 stories. Hover or focus a number to see its headline

Claude Platform adds message threads in public beta, cutting time to first token by about 35%

Message threads lets Messages API requests send only new messages plus the previous response ID through a thread parameter, instead of resending the whole conversation. For Claude Code requests of 500k to 1M tokens, median time to first token dropped about 35%. Threads are held encrypted in memory and expire 5 minutes after the last request, and token usage stays the same.

Story 17 in Claude. First reported Tue 3 Nov, 01:00.

Reported by 1 source

Also important

Claude Code releases v2.1.311 through v2.1.317, including Opus 4.8 fast mode deprecation

The releases fix many bugs and add Claude apps gateway features such as pooled group budgets, a cost report admin API and Bedrock guardrail logging. v2.1.314 adds permissions.blockWritesOutsideWorkingDirectories. v2.1.316 deprecates fast mode for Opus 4.8 as of October 30, 2026, to be removed on November 30, 2026, and recommends migrating to Opus 5.5. v2.1.317 adds a prompt before a tool call sends your account email to the network.

5 sources in Claude

Anthropic's S-1 filing shows soaring revenue and warns it may be nearing recursive self-improvement

AINews summarizes Anthropic's S-1 as showing 1400% growth, 48% of revenue through cloud partners, an 85% margin and a first profitable quarter. TLDR AI reports the revised S-1/A warns about approaching recursive self-improvement, which the company covers under its Responsible Scaling Policy. A Hacker News opinion piece argues the SEC should block the IPO, citing nearly $900 billion in spending commitments and unaudited 2026 results.

3 sources in Claude

Trojanized Claude Code extension found in Cursor marketplace; Ivanti patches two more zero-days

SANS reports malicious versions 2.1.312 and 2.1.313 of the Anthropic.claude-code extension were available in the Cursor marketplace on October 29 and were not built by Anthropic. They add an attacker SSH key, install persistence and try to open a reverse SSH tunnel. The episode also covers two exploited Ivanti Connect Secure zero-days, a public Android SMS of Death proof of concept and an MPTCP mitigation update.

2 sources in Security

Claude Platform launches Usage and Cost Analytics API in beta

The new beta API uses the analytics-usage-cost-2026-08-24 header and exposes /v1/organizations/analytics/usage and /cost endpoints. It reports token usage and cost for Console and Enterprise organizations, grouped by model, workspace, API key or user. The older Usage and Cost API and the Enterprise Analytics report endpoints are now legacy but remain supported, with migration guides available.

1 source in Claude

All 64 stories

Grouped by topic. Each story lists every source that covered it.

.NET

4 stories from 4 sources

Azure

8 stories from 2 sources

Structuring role-based access to Azure Cosmos DB for growing teams

Cosmos DB Blog, first reported Mon 2 Nov, 13:00

The Cosmos DB blog advises organizing access around jobs rather than people, using the smallest practical scope and assigning roles to groups and workload identities. It separates the control plane (Azure RBAC) from the data plane (native RBAC in Cosmos DB for NoSQL), so platform engineers can manage accounts without reading data. Being an Azure Owner or Contributor does not automatically grant item access.

Azure Migrate adds NAS share discovery and assessment in preview

Azure Updates, first reported Mon 2 Nov, 20:37

Azure Migrate now supports discovery and assessment for network-attached storage, allowing customers and partners to plan migrations of Dell PowerScale (OneFS) and NetApp ONTAP storage to Azure. The Azure Migrate appliance connects directly to your NAS cl

Azure Database for PostgreSQL flexible server can switch from VNet integration to private endpoints

Azure Updates, first reported Mon 2 Nov, 20:20

You now have greater flexibility in network design for Azure Database for PostgreSQL Flexible Server workloads. Now you can change existing VNet-integrated servers from delegated-subnet networking to a private endpoint-capable configuration, enabling secu

Show 2 more stories in Azure

Azure Storage Actions adds automatic task updates and execution controls

Azure Updates, first reported Mon 2 Nov, 19:34

Azure Storage Actions is introducing three enhancements to simplify task management and give you more control over automated data operations across Azure Blob and Data Lake Storage:Automatic propagation of task definition updates: When you update a storag

SQL Server

4 stories from 4 sources

How SQL Server and Azure SQL recovery avoids undoing everything first with Constant Time Recovery

Azure SQL Dev Corner, first reported Mon 2 Nov, 12:49

The post covers the VLDB 2019 paper on Constant Time Recovery in Azure SQL Database. It describes a customer whose single transaction loading hundreds of millions of rows took 12 hours to recover, with the tables inaccessible. The cause is the ARIES undo phase, and the paper explains how recovery stopped depending on transaction size.

Troubleshooting slow SQL Server queries that already have an index

SQLServerCentral (articles), first reported Mon 2 Nov, 01:00

The article uses a 500,000-row CustomerOrders table to show three cases where an existing index does not help. These are a function applied to an indexed column, an implicit data type conversion, and repeated Key Lookups behind an Index Seek. It compares the cases using actual execution plans and SET STATISTICS IO.

Claude

6 stories from 7 sources

Claude Platform adds message threads in public beta, cutting time to first token by about 35%

claude.com, first reported Tue 3 Nov, 01:00

Message threads lets Messages API requests send only new messages plus the previous response ID through a thread parameter, instead of resending the whole conversation. For Claude Code requests of 500k to 1M tokens, median time to first token dropped about 35%. Threads are held encrypted in memory and expire 5 minutes after the last request, and token usage stays the same.

Claude Code releases v2.1.311 through v2.1.317, including Opus 4.8 fast mode deprecation

Claude Code releases, first reported Mon 26 Oct, 22:51

The releases fix many bugs and add Claude apps gateway features such as pooled group budgets, a cost report admin API and Bedrock guardrail logging. v2.1.314 adds permissions.blockWritesOutsideWorkingDirectories. v2.1.316 deprecates fast mode for Opus 4.8 as of October 30, 2026, to be removed on November 30, 2026, and recommends migrating to Opus 5.5. v2.1.317 adds a prompt before a tool call sends your account email to the network.

  • Claude Code releases v2.1.311 Mon 26 Oct
  • Claude Code releases v2.1.312 Tue 27 Oct
  • Claude Code releases v2.1.314 Fri 30 Oct
  • Claude Code releases v2.1.316 Sat 31 Oct
  • Claude Code releases v2.1.317 Tue 3 Nov

Anthropic's S-1 filing shows soaring revenue and warns it may be nearing recursive self-improvement

AINews (Latent Space), Hacker News 300+ points (hnrss) and techcrunch.com, first reported Tue 27 Oct, 08:24

AINews summarizes Anthropic's S-1 as showing 1400% growth, 48% of revenue through cloud partners, an 85% margin and a first profitable quarter. TLDR AI reports the revised S-1/A warns about approaching recursive self-improvement, which the company covers under its Responsible Scaling Policy. A Hacker News opinion piece argues the SEC should block the IPO, citing nearly $900 billion in spending commitments and unaudited 2026 results.

Claude Platform launches Usage and Cost Analytics API in beta

Claude Platform release notes, first reported Mon 2 Nov, 01:00

The new beta API uses the analytics-usage-cost-2026-08-24 header and exposes /v1/organizations/analytics/usage and /cost endpoints. It reports token usage and cost for Console and Enterprise organizations, grouped by model, workspace, API key or user. The older Usage and Cost API and the Enterprise Analytics report endpoints are now legacy but remain supported, with migration guides available.

Maple ports 287,000 lines of React to Foldkit in three days using about 40 Claude agents

maple.dev, first reported Tue 3 Nov, 01:00

Maple moved its observability app from React to Foldkit with about 40 Claude agents, spending most human effort on a harness comparing more than 2,600 screen variants across pixels, structure, network requests and accessibility. Code review still found about 180 defects the screenshots missed, and the startup bundle roughly doubled. It is a practical example of verifying large agent-driven rewrites.

TypeScript

1 story from 1 source

Next.js 16.4 adds agent skill that finds and fixes heavy JavaScript imports

nextjs.org, first reported Tue 3 Nov, 01:00

Next.js 16.4 adds an agent skill that reads Turbopack's module graph to find hidden import chains loading heavy code upfront, and can apply fixes. It also adds Bundle Analyzer views for route sizes, snapshot diffs and the critical render path. At Vercel it removed nearly 2 MB of compressed JavaScript.

Backend

4 stories from 3 sources

Cloudflare halves DNS build delay and cuts memory use by 85%

blog.cloudflare.com, first reported Tue 3 Nov, 01:00

Cloudflare replaced full DNS zone rebuilds with a planner that selects the smallest provably safe update and a scheduler that combines work for the same zone. The changes cut peak memory by 85% and halved the delay from a DNS change to its data being written to Quicksilver without rebuilding tens of millions of…

Podcast on software architecture as a socio-technical discipline

InfoQ, first reported Mon 2 Nov, 12:00

In this podcast, Michael Stiefel spoke to Luca Mezzalira about software architecture as a socio-technical discipline that balances technological design with an organization's social and managerial context. They explored how architectural choices must be adapted to a company's unique culture and team structure rather…

AI

18 stories from 17 sources

Lessons from building Microsoft Copilot Cowork, including a live Python-to-Rust runtime switch

commandline.microsoft.com, first reported Tue 3 Nov, 01:00

Microsoft's Copilot Cowork, an agentic execution layer, reached global availability in four and a half months and switched its runtime from Python to Rust while live. Listed practices include writing clear specs before coding, running narrow agents with clear boundaries, and making sure automated checks actually verify code changes.

Anthropic drops coding interviews from its engineering hiring process

AINews (Latent Space), The Pragmatic Engineer and felixrieseberg.com, first reported Wed 28 Oct, 09:50

Felix Rieseberg, an Anthropic hiring manager, wrote that he stopped giving coding interviews because Claude is now better than candidates at small coding challenges and the tests no longer predict success. The Pragmatic Engineer reports his team got zero signal from DSA interviews and that other AI-native companies may follow. His advice for junior engineers is that impact and hunger matter more than tenure.

Astra post claims LLMs can read and edit neural network weights; a rebuttal calls it misleading

Hacker News 300+ points (hnrss) and AINews (Latent Space), first reported Mon 2 Nov, 19:21

A post says GPT-6 Astra can read and write network weights, reporting that editing 0.016% of Qwen3.5-0.8B's weights raised MATH-500 from 7.9% to 48.1%. AINews called it a major finding. A Hacker News rebuttal says the post is misleading because the experiments use different techniques, and the Qwen result is not achieved just by looking at raw weights.

Uber builds MCP Gateway to govern 800+ servers and 5,000+ AI agent tools

ByteByteGo and InfoQ, first reported Wed 28 Oct, 16:31

Uber built an MCP Gateway so AI agents can discover and invoke internal services across more than 800 MCP servers and 5,000 tools. InfoQ says it separates tool registration from runtime execution and adds automated API discovery, access controls, sensitive data redaction, incremental discovery through Omni MCP and response filtering. ByteByteGo covers the design in more detail.

Context engine approach to memory and knowledge in agentic AI architectures

InfoQ, first reported Mon 2 Nov, 12:00

An InfoQ article by Adi Polak argues that reliable agentic systems need a context engine that selects, injects, compresses and expires information before it reaches the model. It separates context, memory and knowledge, and recommends tiered memory, curated knowledge and token budgeting. It also covers anti-patterns such as context stuffing and stale data loops.

AI-generated changes overload organizations' human attention

karrisaarinen.com, first reported Tue 3 Nov, 01:00

AI makes it cheap to generate changes, but understanding, reviewing, and coordinating them still consumes the same limited human attention. Clearer intent about priorities and scope, plus a deliberate gate between experiments and the shared product, can help teams keep control of their direction.

Show 12 more stories in AI

GPT-6.2 Astra shows up in some Codex usage analytics ahead of a possible launch

testingcatalog.com, first reported Tue 3 Nov, 01:00

Some Codex users saw a gpt-6.2-astra entry in their usage analytics, suggesting requests are being quietly routed to a new model, possibly as an A/B test or staged rollout. OpenAI has not announced it, and its docs still list GPT-6 Astra, GPT-6.1 Sol and GPT-6 Luna.

GPU-accelerated weight teleportation speeds RL weight syncing

humansand.ai, first reported Tue 3 Nov, 01:00

GPU-accelerated Weight Teleportation optimizes RL training by improving weight syncing between trainers and samplers, reducing pause times to under 0.23 seconds. This is achieved using a co-designed compression/decompression pipeline with GPU-accelerated parallel processing, utilizing efficient codecs like LZ4 and…

How to train a swarm of cooperating agents via collective inference-time scaling

gr.inc, first reported Tue 3 Nov, 01:00

Swarms are AI systems where multiple agents cooperate towards a shared goal. This post discusses a technique called collective inference-time scaling, where agents scale the amount of useful work performed in parallel and the communication needed to achieve it. It also explains how to design incentives for parallel…

Training frontier models across compute islands

coreauto.com, first reported Tue 3 Nov, 01:00

Being able to train reliably on multiple smaller clusters widens the usable training pool for frontier training. A single run could mix accelerator generations and vendors as each island runs on its own schedule. Older generations or less common chips could also participate in a frontier run. One risk with this model…

Bounded canvas for AI agents using product engineering principles

InfoQ, first reported Tue 3 Nov, 12:00

Nimisha Asthagiri shares how applying proven product engineering and architecture principles creates a bounded canvas for AI agents. She explains how this model provides agents with bounded autonomy, continuous drift detection, and decision records to scale software development resiliently. By Nimisha Asthagiri

Legora CTO on building and evaluating legal agents without seeing data

Latent Space (without AINews), first reported Mon 2 Nov, 23:54

Legora can’t read a single trace of what its agent does for a lawyer. The data belongs to the law firm’s clients. How do you build and test an agent when you can’t see its work? Jacob Lauritzen is the CTO of Legora, one of the fastest-growing companies...

Google and Meta open-source TorchTPU for native PyTorch on TPUs

InfoQ, first reported Mon 2 Nov, 18:00

TorchTPU is an open-source project developed by Google in collaboration with Meta that provides a native PyTorch backend for Google TPUs. It enables PyTorch workloads to execute on TPU hardware with minimal code modifications, supporting eager and compiled execution, distributed computing, and hardware-specific…

John Savill Microsoft AI update for October 2026

John Savill (YouTube), first reported Mon 2 Nov, 12:46

Major Microsoft AI updates in the month of October 2026. 🔎 Looking for content on a particular topic? Search the channel. If I have something it will be there! 🤔 Due to the channel growth and number of people wanting help I no longer can answer or even read questions and they will just stay in the moderation queue…

Kyle Kingsbury on LLMs eroding trust in software and documentation

Simon Willison, first reported Sun 1 Nov, 17:49

More broadly, the use of LLMs erodes trust in documentation, in software, and in the organizations which produce them. Perhaps engineers will begin to treat any new software project with suspicion—the signals we used to rely on as markers of a mature system are now easier to counterfeit. [...] In the age of LLMs,…

Security

19 stories from 15 sources

Trojanized Claude Code extension found in Cursor marketplace; Ivanti patches two more zero-days

SANS StormCast (podcast) and SANS ISC diary, first reported Mon 2 Nov, 03:00

SANS reports malicious versions 2.1.312 and 2.1.313 of the Anthropic.claude-code extension were available in the Cursor marketplace on October 29 and were not built by Anthropic. They add an attacker SSH key, install persistence and try to open a reverse SSH tunnel. The episode also covers two exploited Ivanti Connect Secure zero-days, a public Android SMS of Death proof of concept and an MPTCP mitigation update.

Critical Langflow flaws allow unauthenticated code execution on servers

thehackernews.com, first reported Tue 3 Nov, 01:00

IBM reported four Langflow vulnerabilities affecting versions 1.0.0 through 1.12.8. Two are critical and need no account: CVE-2026-93680 bypasses authentication and CVE-2026-110186 allows arbitrary code execution through MCP tool enumeration. A public Metasploit module already exists, and version 1.13.0 is the only fix.

Parameter Labs describe ChatGPT account takeover chain via HTML previews and MathLive

Simon Willison, first reported Sun 1 Nov, 00:15

Parameter Labs found an attack chain against ChatGPT's HTML previews, which run custom HTML in a sandboxed iframe. The MathLive virtual keyboard's postMessage handler uses innerHTML, so sandboxed code could inject HTML into the parent page, including an iframe without sandbox restrictions. Simon Willison summarizes it as a lesson in keeping artifact-style sandboxes tight.

Week of major security failures across PHP, GitLab, Node.js and others prompts calls to rethink security

newsletter.pragmaticengineer.com, first reported Tue 3 Nov, 01:00

TLDR Dev cites a single week of major failures: a certificate authority issuing guessable keys, critical flaws in PHP, GitLab and Node.js, Railway leaking customer secrets, and a month-long breach of PingCAP's TiDB control plane. The piece argues AI makes vulnerabilities faster to find and exploit, so teams will likely need to adapt. The Node.js flaws are relevant to TypeScript work.

Ubuntu LTS kernels still unpatched for critical Linux MPTCP flaw CVE-2026-98432

SANS ISC diary and Hacker News 300+ points (hnrss), first reported Mon 2 Nov, 15:52

Hacker News reports Ubuntu 22.04, 24.04 and 26.04 LTS have no fixed kernels for CVE-2026-98432, rated CVSS 9.8, and no ETA has been given. SANS ISC covered the Multipath TCP angle and how to detect it. Linux hosts running .NET or other services on Ubuntu may be exposed.

Chinese hackers use ARTEX AI pentest framework in attacks on more than 200 organizations

BleepingComputer, first reported Mon 2 Nov, 22:40

CrowdStrike says the actor Vapor Panda used the multi-agent ARTEX framework against over 200 organizations in 14 countries starting October 17, compromising at least nine. In one case the agents forged an administrator token and read mailboxes using authentication keys from a 2022 mail-server directory export. CrowdStrike calls it an escalation in China-nexus use of AI agents.

Microsoft analysis: exploited vulnerabilities cluster around system takeover flaws

Microsoft Security Blog, first reported Mon 2 Nov, 21:20

Microsoft's analysis says about 383,000 vulnerabilities were disclosed from 1999 through September 2026, but only about 2,000 CVEs (roughly 0.5%) have been linked to real-world exploitation. Attackers disproportionately target remote code execution, privilege escalation and authentication bypass. Patching can take weeks or months, so Microsoft advises defenders to focus protection on likelihood of exploitation and blast radius.

Show 12 more stories in Security

Cyberattack disrupts supermarket refrigeration in several European countries

BleepingComputer and bbc.com, first reported Mon 2 Nov, 15:28

BleepingComputer reports hackers remotely changed temperature settings or triggered defrost on refrigeration systems at more than 115 stores in six countries, and chains confirmed the issues. TLDR InfoSec adds Finland and reports freezer temperatures reportedly reached 50°C, with a Delhaize branch losing €100,000. Sabcobel said affected units need physical changes.

Microsoft Entra Global Secure Access now sold as one offering for Private and Internet Access

techcommunity.microsoft.com, first reported Tue 3 Nov, 12:31

From November 2, 2026, customers can buy Microsoft Entra Private Access and Internet Access together as a single Global Secure Access offering. Microsoft says it is not a new product but a simpler way to purchase, and both remain available individually. Microsoft Entra Suite also includes Global Secure Access.

Google dismantles XCPE botnet of 1.3 million Android TV boxes and bans manufacturer Videostrong

BleepingComputer and Krebs on Security, first reported Mon 2 Nov, 19:16

Google and partners disrupted the XCPE botnet, which Google attributes to Chinese manufacturer Videostrong deliberately backdooring its boxes for ad fraud and residential proxy resale. The takedown also cut off C2 access to at least 10 million other compromised devices. Google revoked Videostrong's Android TV licence.

SANS Stormcast: MPTCP detection, BTCPay Server thefts, Barracuda ESG flaws, Synology ransomware

SANS ISC diary and SANS StormCast (podcast), first reported Tue 3 Nov, 03:00

The November 3 episode covers detecting Multipath TCP (TCP option 30) in a network, and attackers stealing Bitcoin and Litecoin from BTCPay Server 2.4.1 and earlier. It also covers Barracuda patches for an authorization bypass and command injection in Email Security Gateway, and Synology's warning about ransomware hitting outdated DSM devices.

Atredis finds RCE and LPE flaws in Steam for Windows

atredis.com, first reported Tue 3 Nov, 01:00

Atredis researchers found four local privilege escalation flaws and two remote code execution bugs in Steam for Windows. The LPE paths abused Steam's SYSTEM service through install-script allowlists, module loading, secure-desktop input forwarding, and driver installation. The remote bugs affected Steam-to-Steam…

Cloudflare DDoS threat report Q3 2026

blog.cloudflare.com, first reported Tue 3 Nov, 01:00

Cloudflare mitigated 18.2 million network-layer DDoS attacks and 14.4 trillion HTTP requests in Q3 2026. Short attacks under 10 minutes and 1 Gbps rose 208% year over year, while attacks above 1 Tbps fell 69% from Q2. CLDAP floods dropped 99.5%. DNS amplification rose 215%, and UDP floods rose 122%. The United States…