The AI Wire ●

OpenAI published two documents on November 5: a National Community Compact covering every future compute campus it owns and operates, and a Compute Campus Policy Blueprint asking policymakers to impose comparable rules across the industry. The timing is direct: they land the day after midterm results in which governors promising data-centre pauses won in Texas and Georgia and 33 local limits passed or led.

The compact commits OpenAI to pay the full cost of the electricity it uses and the infrastructure needed to serve its sites, to provide financial assurances protecting other customers if a project is delayed or cancelled, and to publish site-level water and electricity use, construction plans and independent noise studies. It will not require public officials to sign nondisclosure agreements — with narrow exceptions for security and trade secrets — each campus gets a water plan favouring closed-loop or low-water cooling, a local point of contact, early resident engagement and a public progress report every year.

OpenAI points to money already committed as the model: an $80 million package for community priorities in Effingham County, Georgia, including a $4.8 million grant for free school meals for all 14,000 county students and $2 million for a local park, plus a joint $6 million childcare commitment with SB Energy in Pike County, Ohio. For its Project Camellia campus, OpenAI is contracting 3.2 gigawatts from Georgia Power in phases between 2028 and 2032, with the utility able to cut deliveries by up to 1,000 megawatts when the grid strains. The documents build on OpenAI's January Stargate community commitments and its November 2 Grid Protectors launch — and OpenAI itself says voluntary promises are only a starting point.

McGraw Hill announced on November 5 that its trusted K-12 curriculum will be available to its school district customers inside Anthropic's Claude for Teachers, connected through the Model Context Protocol standard. Educators will be able to reach their licensed McGraw Hill resources from Claude to create lesson plans, learning tools and personalised experiences for their students.

McGraw Hill says it is one of the first major K-12 core curriculum providers to connect its proprietary content this way. The integration is described as a beta that districts can apply to join, so its initial scale is limited; TeachFX, the AI instructional-coaching platform McGraw Hill acquired in September, is already part of the Claude for Teachers ecosystem.

Claude for Teachers, introduced by Anthropic in July, gives verified US K-12 educators free access to Claude alongside connectors to evidence-based curricula and other education tools. McGraw Hill has also separately selected Claude as an enterprise AI productivity solution for its own employees.

Tencent released the full version of Hy4 on November 4, adding vision and computer-use capabilities and making the model available through Tencent Cloud and OpenRouter and inside CodeBuddy, WorkBuddy, Yuanbao and ima, Unite.AI reported. The August preview was open-sourced at 770 billion total parameters, 49 billion active and a 1M-token context window; the full release keeps the listed API prices unchanged at $0.834 per million input tokens and $2.501 per million output, with OpenRouter listing a 1,048,576-token context and image input. The weights and a comprehensive system card are planned for a later release, and a cheaper, faster Hy4 Flash is planned after that.

The release's most notable choice is what Tencent left out. Reuters reported that Hy4 was trained with limited cybersecurity data — defensive content only — to reduce its ability to aid cyberattacks: the company filtered out exploit development, reverse engineering and penetration-testing material, keeping defensive proof-of-concept generation and vulnerability patching, and says red-team audits by its Xuanwu and Keen security labs found no elevated risk on tasks like defeating binary obfuscation. Moonshot AI took a similar step with its newest model last month, as Chinese labs follow the US labs in curbing offensive capability.

Tencent reports gains over the preview in instruction following, long-context understanding and long-horizon tasks, and says hallucinations in internal search evaluations fell from 15.76% to 5.45%. It also concedes a gap remains to top proprietary models on research-level mathematics, long-horizon coding and advanced visual question answering. The benchmark claims are company-run and internal; the hosted model, however, is live today, while open weights remain a promise.

AI agents that research and buy products on a shopper's behalf — like Meta's Muse — are posing a conundrum for the big retailers, Reuters reported on November 4: let agents shop your store and you may lose the lucrative advertising brands pay for placement, plus the customer data that fuels it. Morgan Stanley researchers estimated in July that such agents could account for 10% to 20% of US e-commerce spending by 2030.

The two giants have split. Amazon banned Muse from its website in September, saying the agent appeared to have accessed its store without authorisation, capturing and storing customer credentials; Meta declined to comment. Amazon told Reuters this week that third-party agents should operate openly and respect service providers' decisions about whether to participate.

Walmart went the other way, rolling out infrastructure on October 21 to enable third-party agentic commerce and officially partnering with Meta's tool. The split is the shopping-agent question in miniature: the agent works for the shopper, but the store it shops in is an advertising business — and the two models do not obviously fit together.

OpenAI published research on November 4, 'A thousand fewer paths to root,' describing a mid-October run in which an autonomous pipeline built on an upcoming cyber model hunted flaws in the Linux kernel. Scout agents picked 5,034 places to audit — about 2.8 million lines, roughly 7% of the kernel — and the pipeline turned 2,308 candidate findings into 1,724 dynamically reproduced vulnerabilities.

After variant analysis grouped exploits tracing back to the same flaw, OpenAI counts 948 distinct local privilege-escalation vulnerabilities, each backed by a working exploit — counted only when it produced a root shell on a stock desktop system with standard protections on — and a candidate patch. The whole run cost $1,213,430 in API credits, with exploitation the most expensive stage at $775,929; OpenAI values the haul at $18.9 million to $66.3 million at past bug-bounty contest rates, and puts the model's outright incorrect analysis at 3.1%.

The bounds matter: 948 is a count of distinct flaws with candidate patches, not fixes already on anyone's machine, and the post names no CVE identifiers, kernel versions or subsystems. Ten days after the scan, OpenAI says 61 flaws had already been patched upstream, 43 had patches in staging and 299 were being reported and discussed. The work sits under Patch the Planet, part of OpenAI's Daybreak programme, with human review before anything reaches a maintainer.

OpenAI launched ChatGPT Images 2.6 on November 4, adding native animated GIF creation to ChatGPT and Codex. Users can turn a written prompt or an uploaded photo into a looping GIF, then change its speed, revise individual frames and share the result — a one-step route ChatGPT did not have before.

The release is available globally across all subscription tiers on web, desktop and mobile, and OpenAI says image volume now exceeds 4 billion images a week across ChatGPT, Codex and the API, up from more than 3 billion at the Images 2.5 launch on September 8. Images 2.6 also adds reusable reference images, aimed at keeping a subject consistent across successive edits.

For developers, OpenAI added two API models: GPT-Image-2.6 Flare, positioned for faster generation — RuntimeWire reports output in as little as six seconds and generation about 50% faster — and GPT-Image-2.6 Sunburst, positioned for higher-quality output and consistency across edits. The split mirrors the 2.5 lineup, separating fast draft work from premium production work.

OpenAI announced on November 4 that it will acquire Pierre Computer Company, the small developer-tools startup behind Code Storage, a Git hosting service built for AI apps and coding agents. Code Storage will be integrated into Codex; Pierre's open-source projects will remain open source after the deal closes.

Codex users have already touched Pierre's work: its Trees library powers file browsing in the Codex app and its Diffs library powers change review. Code Storage is used by agent builders including Lovable, Bolt and Amp for code, memory files and documents. Pierre was founded by Jacob Thornton, a co-creator of Bootstrap, and Ian Ownbey, an early Twitter engineer, and raised a $22 million Series A in November 2025.

No price was disclosed, and the deal still needs regulatory approval; until it closes, the two companies remain independent. Axios, which broke the news, framed it as OpenAI going after Microsoft's GitHub — and it landed the same day Meta acquired Conductor, the parallel coding-agent startup, underlining that the coding race has moved from generating code to the infrastructure around it.

Opponents of AI data centres were among the biggest winners of Tuesday's midterm elections, Reuters reported on November 4. In Texas — which GLJ Research estimates holds about a quarter of the US data-centre capacity due online by 2030 — Democrat Gina Hinojosa ousted Governor Greg Abbott after promising a moratorium on new data-centre construction, stricter water and power rules and an end to industry tax breaks; the Associated Press called the race at 11:17pm Eastern, and Hinojosa led 52.8% to 45.7% with about 93.5% of the expected vote counted. In Georgia, where CBRE says Atlanta is the country's most active data-centre construction market, Keisha Lance Bottoms won the governorship on a call for a pause on new builds.

The local votes went the same way. Voters in 10 states faced 41 data-centre measures, Ballotpedia counted — 21 of them in Ohio alone — and by Wednesday 33 measures restricting data centres had passed or were leading, according to Stateline's tracker. In Ohio, Democrat Amy Acton beat Vivek Ramaswamy on a conditional freeze of new approvals unless strict energy and water criteria are met. An NBC exit poll found 56% of voters said AI and data centres were a crucial or major factor in their congressional vote.

The results are still unofficial, and what the new governors can actually do depends on state law and their legislatures — the pledges also differ in strength, from an immediate moratorium in Texas to a temporary pause in Georgia and a conditional freeze in Ohio. But investors told Reuters the breadth of the Democratic wave points to a shifting public mood on AI and a possible slowdown of the construction boom that has been propping up US growth and stock markets. This follows the Wire's November 3 entry on the moratorium pledges that were on the ballot.

Update, midday November 4: the market has started pricing the backlash in. Nasdaq-100 futures fell 0.8% overnight, shares in AI cloud company CoreWeave dropped 7% and Oracle 4% in overnight trading, CNBC reported. The exposure is concentrated exactly where the votes landed: Wells Fargo puts 27% of the gigawatts of planned US data-centre capacity in Texas, 7% in Georgia and 5% each in Ohio and Pennsylvania — and OpenAI, Anthropic, Google, Meta and xAI all need vast new capacity in precisely those kinds of states.

Microsoft has pushed the general rollout of usage-based billing (UBB) models in Copilot back by about a month. In a November 4 update to Message Center post MC1519122, the Frontier preview runs from early to mid-November, but general availability now begins in early December and completes by mid-December — previously it was slated for early to mid-November.

The models arriving under UBB are not minor: GPT-6 Astra and Claude Fable 5.1 will be generally available as usage-billed models in Copilot Chat and in Word, Excel and PowerPoint via the model selector. Microsoft also says users will be able to set the reasoning effort level when using a UBB model in Chat.

Separately, Microsoft's partner guidance confirms usage-based billing will be enabled by default starting December 1, 2026 for new Microsoft 365 Copilot Business licenses bought through CSP. For organisations budgeting Copilot, the billing model is changing on a schedule that has already moved once.

Meta has paid roughly $1.2 million in bug bounties for its Muse personal AI agent, the company said in a blog post shared by David Singleton and reported by SecurityWeek on November 4. The programme ran privately from April and went public at Muse's September 8 launch; of more than 630 reports received, 64 were valid. Meta pays up to $300,000 per valid report — several times the top rewards it says other leading AI developers advertise — with prompt-injection attacks on a single user worth up to $130,000 and a fleetwide compromise up to $250,000.

The largest award, the full $300,000, was paid four months before launch, while Muse was still in early internal testing: a researcher demonstrated access to conversations and authentication tokens on the pre-release virtual machines Meta staff used to test the product. An authentication check had treated a header added by a local HTTPS proxy as proof a request came from a trusted source, and a system migration added a second proxy layer that let outside requests carry the trusted header too. Meta took the service offline, fixed the bug and stopped treating the local machine as trusted.

Two further $90,000 awards cover the agent-specific risks: a malicious web page that, when Muse was asked to summarise it, mimicked status messages from the agent's browsing tool and got it to execute actions that should have been caught — Meta says its classifiers now catch the attack and 100 variants — and a formatting trick that slipped one-time passcodes past Muse's email redaction filters. A $50,000 award covered an Android flaw that let a malicious app load an attacker's page into a privileged web view, and $1,000 a Mac flaw that could hijack auto-update. For an agent that acts across a user's email, calendar and messaging accounts, the bounty table is a map of what can go wrong.

Meta has acquired Conductor, the Y Combinator startup whose app lets developers run several AI coding agents at once, each in its own isolated copy of a codebase. Axios reported the deal on November 4 and Meta confirmed it to TechCrunch the same day; financial terms were not disclosed.

Conductor ships no model of its own. It orchestrates first-party agents — Claude Code, Codex, Cursor and OpenCode — through one interface, locally on a Mac or in cloud workspaces that can keep working for hours. The company raised a $22 million Series A in March 2026 and says more than 100,000 people use it.

CEO Charlie Holtz and CTO Jackson de Campos join Meta Superintelligence Labs, working with Nat Friedman and Alexandr Wang on what Holtz calls "the next interface" for AI coding, promised for early next year. The current product winds down fast: new sign-ups stopped November 4, Conductor Cloud goes read-only November 13 and shuts down November 20, and the local app loses support in early 2027.

Google launched direct checkout in Canada on November 4, letting shoppers buy products inside the Gemini app and AI Mode in Search without leaving for a separate store website. The first retailers on board are Lululemon, Shoppers Drug Mart, Simons and select Shopify merchants, following earlier rollouts in the United States and Australia.

Payments run through Google Pay using cards and shipping details already saved in Google Wallet, and retailers remain the seller of record. The feature is built on the Universal Commerce Protocol, the open standard Google launched with industry partners earlier this year to give shopping agents, retailers and payment providers a common language.

At launch the Canadian tool is limited to one item at a time, with multi-item carts and price alerts planned to match the US feature set. Google says 59 per cent of Canadian holiday shoppers plan to use an AI tool to help them shop this season, and that over the coming months it will work with retailers on extras such as applying loyalty rewards at checkout.

Apple has reduced employee budgets for AI usage as part of a broader effort to rein in costs, Bloomberg reported on November 4, citing people familiar with the matter, even as the company pushes staff to use AI more. Last month Apple cut the daily AI spending allowance for some engineers to $200 from $300.

Further reductions are being considered: some engineering teams could go to $100 a day, while non-engineering groups that already operate under a $100 daily cap could fall to as little as $25. Employees who need greater access can seek exemptions from senior executives, according to Bloomberg.

The budgets cover AI 'tokens' — the metered units models charge for — across tools including OpenAI's ChatGPT, Anthropic's Claude and Google's Gemini. Apple did not immediately respond to a request for comment, and the figures are Bloomberg's reporting, not an Apple disclosure; the cuts sit inside a wider cost-control drive under Apple's new chief executive.

Anthropic announced on November 4 an expansion of Claude Marketplace, which now lists more than 25 partner agents and products across security, developer infrastructure, creative work and productivity. The catalog is separate from connectors and plugins, which bring outside apps and data into Claude, and from service partners that help companies implement it.

The new listings include Chainguard Harness and Checkmarx One for security, Cyera Agent Guardian and Rubrik Code Guardian for governing Claude deployments and code, and Datadog Agent Observability and Netlify Enterprise for engineering teams. Creative and productivity listings include Runway, Webflow, AirOps, Asana AI Teammates, Glean, monday agents and Zoom Agentic Search.

Eligible enterprise customers can apply part of their committed Anthropic spend to marketplace purchases, covering new purchases and expansions of platforms they already use, so buying does not require a new budget request. Anthropic describes commitment-based buying as a limited preview: organisations use Request to buy or contact their account team to establish eligibility.