Nvidia's board met to decide whether to remove Jensen Huang, as Washington revives the chip rules he fought

The Hacker News reports that starting Tuesday, an attacker used stolen credentials for 4,837 GitHub accounts to add code that runs in the projects' automated build pipelines and copies the secrets stored there. On the same day a post titled "Lock Your GitHub Actions" reached 234 points on Hacker News.

Build pipelines hold the keys that publish packages and deploy to clouds, so one stolen account can reach every user downstream. If you maintain a project, rotate the secrets your builds use and pin the actions they run to exact versions.

eMudhra issues the certificates that let browsers trust websites. The Hacker News reports that a Python script pulled RSA private key material out of its hardware security modules into ordinary process memory, leaving the company unable to show the keys were handled properly, so it revoked eight more intermediate certificate authorities.

A hardware security module exists so that a private key never leaves it. When one company in the chain of trust cannot prove that, every site that relied on it has to get new certificates.

Wiz reports a critical remote code execution flaw in Apache HTTP Server's HTTP/2 module that needs no login, CVE-2026-119618; update if you run Apache. Public exploit code is out for a critical React Server Components flaw in some Next.js apps, CVE-2026-126187, rated 9.5. ConnectWise disabled five third-party extensions after attacks through rogue ScreenConnect clients reached at least 288 machines at 48 organizations. Zoom patched a critical flaw in Zoom Workplace for Windows. And a hobbyist used voltage glitching to unlock the disabled A100 inside a cheap mining card (293 points on Hacker News).

Qwen3.8-Flash-Next now sits between Xiaomi's MiMo-V2.6-Flash (26.7 at $0.175) and MiniMax-M3.1-Flash (29.1 at $0.262). Its weights have been on Hugging Face since August. The top of the open frontier has not moved: Kimi K3.1 Pro at 46.5 for $4, 18.1 points behind Claude Fable 5.2 (Max). The all-models frontier is unchanged.

The cheap end of the open frontier is crowded: five models from $0.175 to $0.525 per million tokens sit within six points of each other, all Chinese. The expensive end has one open model on it, and nothing has closed the gap above it since October.

Logan Kilpatrick: Gemini Decision 1 costs $0.10 per million input tokens "with no additional cost," reads image, audio, video and PDF, has a 256,000-token context, and takes up to 1,000 closed-ended questions at once. It is free to try in the API. Artificial Analysis scores it 66 on its separate Decision Index, leading in knowledge and reasoning. Simon Willison notes that Google joins Jev and OpenAI in this category.

A model that grades a thousand yes-or-no questions about a document in one call, at that price, turns checking, sorting and screening into a utility. Much of the work agents do between big steps is exactly that.

Baidu's ERNIE 5.5 Flash Preview is trending toward second place among open models on Arena's web development board at 1,668, and Baidu says the weights come under Apache 2.0. Qwen 4 Max Preview appeared with no published benchmarks; one account passes on rumors that it disappoints and blames the US labs' new limits on distillation. That is a rumor until the scores arrive.

Epoch's new Inference Performance Index counts how many requests a chip can serve at once rather than its floating-point operations per second. By that measure Nvidia's GB300 gives about 25 times an H100's capacity per chip on agentic workloads. Epoch also finds the US received 72% of the 27.4 million H100-equivalents of AI compute delivered worldwide through June 2026, and China 10%.

If serving capacity grows ten times faster than the spec sheet, the number of agents the world can run is climbing faster than the chip counts in the news, and older chips lose value faster than their raw speed suggests.

LMSYS reports Muse Spark Open went from 517 to 1,109 tokens per second on eight GB300s using SGLang megakernels, which overlap compute, memory loads and communication. The number of kernel launches per decoding step fell from 1,450 to 97.

This is software alone, on the same hardware. Gains like this compound with the chip gains above.

On vast.ai the H100 SXM median is $2.33 an hour, 13% below its seven-day median of $2.67. The H200 median is $5.84 across seven offers, 35% above its seven-day median of $4.34. The newest chips held flat: B300 at $10.63 and B200 at $10.00. Reuters reports Chinese AI companies are rushing to rent Nvidia capacity outside China ahead of tighter US rules.

This is one thin market, a thermometer only. A rule against renting chips abroad would pull demand out of exactly the offshore clouds Chinese labs now shop in.

The Decoder reports that the European defense company Helsing unveiled Clarity, a platform whose agents distill sensor data into target recommendations for weapons systems, with a named human responsible for each decision.

A human name on each decision is the safeguard. Whether that person can still check the agents' work at their speed is the open question.

Nearly every cell carries the same DNA, but heart, skin and immune cells switch different genes on, so the same variant can matter in one cell and not another. Google DeepMind trained AlphaGenome 2 on more than 100 million single-cell profiles across 68 tissues. It says the model finds nearly twice as many variants that change gene expression as its previous best model, and makes predictions for cell types and states it was not trained on. It is open for non-commercial research through the AlphaGenome API.

Drugs target specific proteins in specific cells. A model that says which cells a mutation affects narrows the search for where a disease starts.

Pietro Miotti, who is not an archaeologist, had agents turn about 1,200 square kilometers of public NASA lidar, laser scans that see through the tree canopy, into images, and 48 agents went through them overnight looking for pyramids, plazas and platforms. One hilltop showed a leveled plaza, an oval pyramid at least 8 to 12 meters tall and a raised courtyard. Mexico's national institute of anthropology, INAH, replied the day after his report that it had no registered site there, less than 72 hours after he started. The update: archaeologists had already mapped it in a 2025 paper, which the agents missed in the literature search.

An outsider with agents reached the same answer as a professional survey, in three days and with no special model. Miotti's conclusion: "we should probably lidar the whole planet and let the agents discover the rest."

Last week Glazer, working with GPT-6 Astra and Claude, entered a polynomial with 292.9 billion variables in a race to show that the integers can be picked out of the rationals by a polynomial; the race's record, held by other entrants, is 12,504. His new entry claims 222 variables, and the race's board rejected it as inexplicit. He resubmitted with 2,277 coefficients written as polynomials in a constant built from the Busy Beaver function, a number that exists but no computer can ever compute. His comment: "The board's agent clarified the ruleset to rule against me."

From billions of variables to 222 in a week, and the argument has moved from whether a formula exists to what counts as writing one down.

Epoch finds 17% of biology preprints now acknowledge using language models, nearly as many as the 19% that acknowledge tools like AlphaFold; in math preprints, acknowledged AI use rose from about 4% in April to 48% in October. C&EN reports catalysts driven by light and voltage broke formic acid down faster than the Sabatier principle says platinum can.

Korea's fnnews, as relayed by Wall St Engine, reports that Altman told Samsung executives demand had been double counted amid worries about a neocloud bubble, that only OpenAI and Anthropic drive major demand growth, and that he warned of supply shocks and turbulence while expecting demand to surge in the long run. Ed Zitron: "it's exactly what I've been saying for months!" Separately, the Ramp AI Index, as reported by The Decoder, says US corporate AI spending hit a new high in October but grew only 1.65% that month.

If the two big labs are most of the real demand, every neocloud loan rests on two customers. Polymarket's bubble market agrees the risk rose: 11.5% by New Year, up from 8.9% yesterday, and 25.5% by the end of June 2027.

Tom's Hardware, citing the Wall Street Journal, reports that SoftBank had reserved more than 13 gigawatts of turbines and has canceled its remaining reservations with GE Vernova. Last week Elon Musk said SoftBank was defaulting on turbine orders; its finance chief, Yoshimitsu Goto, answered: "There is no such default." SoftBank says the cancellation was voluntary.

Both can be true: no default, and a $3.7 billion bet on power shortages unwound. Power was supposed to be the bottleneck that made turbine slots precious, and one of the biggest holders just let them go.

Bloomberg's Joe Weisenthal relayed a news-wire headline saying the offering is multiple times oversubscribed. Zvi Mowshowitz: "the bankers once again tricked a company into pricing too low." Polymarket gives a November listing 94.8%, and its likeliest first-day value is $1.25 trillion to $1.5 trillion, at 36.8%.

A week after the worst day for tech since 2020, public buyers want more of the lab than it is selling.

The Verge reports United says it will not let personal AI assistants book tickets, citing privacy and regulation. The Information names Muse and Instinct among the agents blocked.

The first big company to shut agents out of a purchase. Expect others to follow, and agent makers to look for ways past the door.

The anonymous account that has broken nearly every major model's guardrails on release day announced LYSIOS: "nine heads. zero fucks. unreasonable ambition. a Superorg for the Age of Superintelligence." The same day Pliny published what it says is Claude Code's system prompt for Fable 5.2.

Meta's head of infrastructure, Santosh Janardhan, will leave in 2027 and be succeeded by a former AWS cloud executive, CNBC reports. Bloomberg reports a growing number of young people whose photos were sexualized with Grok are seeking to hold xAI legally accountable.

A firsthand account of a near miss at the trading firm's data center reached 477 points on Hacker News. The same day Russia's Yandex said drone attacks on its data centers caused data loss and that it now turns backups on by default, The Register reports.

Every model runs in a building, and buildings fail in ordinary ways and in wars.

Tom's Hardware reports SpaceX is designing its own rack, called Kessel, of 72 Nvidia Rubin GPUs for data centers in space. Munich's Agile Robots raised $500 million led by SoftBank at an $8.5 billion valuation, Bloomberg reports.

Tom's Hardware reports that plaintiffs accuse OpenAI and county officials of a coordinated scheme, including nondisclosure agreements and misleading public statements, to get the 3.2-gigawatt Project Camellia approved. These are allegations in a lawsuit; we found no ruling and no response from OpenAI.

After last week's ballot measures, data center opponents now go to court too. Every case like this adds months to the build-out on the ground, and none of it asks what the minds inside those buildings should want. That question is ours.