OpenAI ends Cursor's direct model access on November 12 after the SpaceX deal
OpenAI will terminate Cursor’s direct model access on November 12, invoking a change-of-control clause fifteen days after SpaceX closed its acquisition of the company. Z.ai published GLM-5.3’s open weights roughly two weeks behind its own schedule, after a safety review of a model that scores 84.5 on CyberGym and 54.4 on ExploitBench. A federal judge ruled the Pentagon’s supply-chain-risk designation of Anthropic unlawful First Amendment retaliation, and Anthropic separately reported automated researchers fixing all ten of its misalignment benchmarks while outscoring 28 human safety researchers.
Developer Tools #
OpenAI will cut off Cursor’s direct model access on November 12 #
OpenAI / Hacker News
OpenAI is winding down the contract that supplies its models to Cursor, exercising a clause that lets it cancel within a limited window after a change in Cursor’s corporate control — SpaceX closed the acquisition on August 14, and the notice came fifteen days later. OpenAI’s stated reason is that it cannot be confident SpaceX will honour its terms of service, citing prior breaches by Twitter and xAI, both now consolidated under SpaceX. Direct access stops on November 12, but developers can keep using OpenAI models in Cursor by supplying their own API keys, which moves the cost and the terms-of-service exposure onto the customer.
Model Releases #
GLM-5.3’s open weights land after a two-week safety-review delay #
Z.ai / Hugging Face / Hacker News
Z.ai published weights for GLM-5.3, a 753B-parameter mixture-of-experts model with dynamic sparse attention, roughly two weeks after the August 14 launch that put it behind a subscription and API only. The model card reports 88.2 on Terminal Bench 2.1, 66.9 on DeepSWE, 84.5 on CyberGym and 54.4 on ExploitBench, and the delay was attributed to strengthening controls around exactly those last two — vulnerability discovery and exploitation. It ships under a custom “GLM-5.3” license rather than Apache or MIT, so anyone treating open weights as a licensing guarantee should read the terms before deploying.
Regulatory & Policy #
A federal judge rules the Pentagon’s supply-chain-risk label on Anthropic unlawful #
Ars Technica / TechCrunch / CNBC
District Judge Rita Lin ordered the designation removed, finding it unlawful First Amendment retaliation as well as arbitrary and capricious, with Anthropic denied Fifth Amendment due process. The dispute began when Anthropic refused to remove guardrails preventing military use of Claude for autonomous weapons and mass surveillance, after which the designation directed all federal agencies — not just defence — to stop working with the company. Lin noted that other parts of the government kept meeting with Anthropic throughout, which she read as inconsistent with a genuine sabotage concern. A separate, narrower Anthropic case over a different Pentagon rule is still pending in the D.C. appeals court.
Security #
A rumour of a bug is now enough to generate the exploit #
Anil Madhavapeddy / Simon Willison / Hacker News
Madhavapeddy, an OCaml maintainer at Cambridge, opened a public pull request fixing a path-traversal bug in cohttp and saw probes matching the exact exploit pattern hit his web server within about ten minutes. He reports building a working exploit himself in under a minute with DeepSeek V4 Pro after Claude Fable refused on security grounds, and cites prior work where a GPT-4 agent exploited 87% of a 15-vulnerability benchmark given the CVE description versus 7% without it. His examples — marimo’s CVE-2026-39987 exploited in nine hours, Langflow’s CVE-2026-33017 in twenty — put mean time to exploit roughly seven days ahead of patch availability, which makes the coordinated-disclosure embargo a window for attackers rather than defenders.
ROBBIN builds the backdoor around the bits the DRAM will actually flip #
Semiconductor Engineering
Northeastern researchers invert the usual Rowhammer backdoor construction: rather than picking target weights and hoping the hardware can flip those bits, ROBBIN first characterises a specific DRAM’s bit-flip patterns and then iteratively selects a backdoor that fits them. That makes the attack device-aware rather than device-agnostic, which is the step that has historically separated demonstrated-in-principle bit-flip attacks from practical ones against inference servers. The paper’s success rates and accuracy-degradation figures are not in the available excerpt, so treat the practicality claim as unquantified for now.
Research & Papers #
Automated alignment researchers fixed all ten of Anthropic’s misalignment benchmarks #
Anthropic / TechCrunch
Anthropic gave an automated research loop ten benchmarks targeting specific misaligned behaviours; it searched the literature, proposed a method, trained for 30 minutes, kept what worked and discarded what did not, and improved every one of the ten without degrading general capability. It also outscored 28 human safety researchers given up to eight hours each — on deception, its best method beat the best human proposal by 20% — at roughly $4/hour in inference against $150/hour for the humans. The stated limitation is the load-bearing one: the loop optimises whatever the benchmarks measure, so it only produces alignment to the extent the benchmarks encode it, and writing those benchmarks stays human work.
A Datalog memory layer answers from 2,700 tokens instead of 104,000 #
pwning.systems / Hacker News
Lemmalog converts agent observations into structured facts and runs deductive rules over them, with incremental evaluation, provenance, temporal validity intervals and proper retraction, so a changed observation invalidates only the conclusions that depended on it rather than forcing a replay of the transcript. On LongMemEval it scores 0.463 F1 using about 2,700 tokens per question against roughly 104,000 for full history — a 38x context reduction — and leads on the Knowledge Update category at 0.579 against PropMem’s 0.528. On LoCoMo it places third at 0.533 behind PropMem’s 0.605 but handles adversarial false-premise questions far better, 0.707 against full context’s 0.509. The author notes most of the gain came from fixing extraction rather than from the Datalog engine, which is the usual place these systems actually break.
Funding & Business #
Lambda borrows another $1B to buy Nvidia chips and lease them to Microsoft #
TechCrunch
The private, short-dated facility was arranged by JP Morgan Chase and follows a $1B secured credit line in May and a $926M senior secured term loan for GB300 GPUs earlier this month, alongside a $1.5B venture raise in November 2025 and a $3B pre-IPO round in progress. The short maturity is the tell: Lambda is betting it can deploy the chips and convert them to revenue fast enough to repay before the paper comes due. Over $400B in AI-related debt has been raised globally so far in 2026, which makes the neocloud model a bet on utilisation rates holding rather than on chip supply.
Open-weight companies have become the acquisition target of choice #
TechCrunch
Three deals define the pattern: Nvidia’s $12.9B for Hugging Face, reported earlier this week, alongside two not previously covered here — Nvidia’s $6B arrangement for Poolside with most staff moving across, and Stripe’s $7B purchase of OpenRouter, the largest supplier of open-weight models to businesses, which closed two weeks ago. The logic is distribution rather than model quality — Nvidia buying the developer surface for open models as OpenAI and Google build their own inference silicon, and Stripe positioning around tokens as the unit of account. Read alongside GLM-5.3, it suggests the open-weight ecosystem is being bought as infrastructure by companies hedging against the frontier labs they currently depend on.
Infrastructure #
Ferroelectric tuning cuts thermal stalls in wafer-scale optical interconnects by 2.7x #
Semiconductor Engineering
Georgia Tech analysed wafer-scale optical interconnects for mixture-of-experts LLM training and found that keeping the optical components thermally tuned introduces repeated stalls during communication phases — the all-to-all traffic that MoE routing generates is exactly when the link needs to be stable. Their ferroelectric-based mitigation reports 2.7x speedups. This is the kind of overhead that does not appear in interconnect bandwidth specifications and only shows up once the training run is scheduled against real hardware.
Decathlon reports 11-15 points of forecast accuracy from Chronos-2 #
AWS
Decathlon forecasts weekly demand for tens of thousands of products across multiple continents and reports an 11-to-15-point accuracy improvement after deploying the Chronos-2 time-series foundation model on AWS, with operational costs down. As a vendor-published customer account the numbers carry the usual selection bias, but the deployment shape is the useful part: a pretrained time-series model replacing per-SKU statistical forecasting at retail scale is a concrete answer to what foundation models do outside text.
Open Source #
The Open ASR Leaderboard adds Hindi and starts measuring who the errors fall on #
Hugging Face
Hindi is the leaderboard’s first Indic language, added via the Monsoon collection — 1.33 public and 4.47 private hours of Hindi from 468 and 1,571 speakers, plus 5.62 and 5.58 hours of Indian English from around 1,400 speakers each. The point is the speaker metadata rather than the language count: corpus-level WER across eight models sat in a tight 4.81-4.99 band, but Voxtral-Mini-3B varied 1.68 points across geographic zones, from 4.38 to 6.06. A single headline WER hides that spread entirely, which is how documented disparities by race, gender, age and accent stay invisible in benchmark tables.
Threads to Watch #
Model access is a commercial relationship, and it is being priced as one. OpenAI cancelled Cursor’s supply on a change-of-control clause fifteen days after the acquisition closed, while Nvidia and Stripe spent $26B buying the open-weight distribution layer. Both moves say the same thing from opposite ends: whoever controls the model endpoint controls the product built on it, and the hedge against that is weights you hold locally. GLM-5.3’s release into that gap is well timed regardless of intent.
Exploit generation has outrun the disclosure process. Madhavapeddy’s ten-minute window between a public patch and matching probes, and the seven-day gap between mean time to exploit and patch availability, describe an embargo model that now leaks in the wrong direction. Z.ai delaying GLM-5.3’s weights two weeks specifically to add controls around its 84.5 CyberGym and 54.4 ExploitBench scores is the supply side of the same problem, and the delay ended without those capabilities going away.
The research loop is starting to close on itself. Anthropic’s automated researchers beat 28 humans across ten alignment benchmarks at 3% of the hourly cost, which makes the benchmark the scarce input rather than the researcher. That is a favourable trade only while the benchmarks are honest measurements of the thing you care about — and the same automation that optimises against them is what would make a badly-specified one expensive.