Morning Brief: Wednesday, November 11

Seventy-three feeds reporting. Two weeks. 6,055 items reduced to what follows. (what we track, how we crawl, subscribe)

Wednesday is the gap between the agent being sold and the agent that can be certified. Anthropic opened an IPO roadshow and shipped workplace features aimed squarely at Microsoft and Google; the arXiv batch posted the same morning includes an impossibility theorem for gatekeeping agents, a trajectory study of where long-horizon agents actually break, and a paper arguing agent benchmarks stop discriminating well before they run out of tasks.

The up-stack move is the part with money behind it. Claude Meetings turns workplace discussion into tasks, connectors aim Claude at the whole enterprise app stack, and OpenAI shipped Businesses in ChatGPT and business profiles in the same window – two labs converging on the same conclusion, that the margin is in the workflow rather than the model. New York's AI safety law took effect on Tuesday and the state launched the first state-level AI testing program, so the regulator arrives at precisely the moment the product stops being an API and starts being the place work happens.

Top (5-7 min)

Anthropic launches roadshow for proposed initial public offering
Anthropic, 2026-11-10. The primary document. Everything else in this brief about enterprise agents is downstream of needing a growth story to tell here.
No finite rulebook can certify every safe program: an impossibility theorem for gatekeeping AI agents
arXiv cs.AI, 2026-11-11. A formal limit on the gatekeeper pattern every vendor on this page is shipping. Read it before you buy one.
Anthropic launches Claude Meetings to turn workplace discussions into plans and tasks
TechCrunch, 2026-11-10. The concrete form of the up-stack move: a model vendor shipping a productivity surface, not a capability.
Introducing Businesses in ChatGPT
OpenAI, 2026-11-10. The same bet from the other lab, pointed at the directory layer rather than the meeting.
OpenAI, Anthropic face new oversight as New York's AI safety law takes effect
TechCrunch, 2026-11-10. Regulation that is now operative rather than proposed. Dates matter in this one.
Dependable Long-Horizon LLM Agents: A Trajectory-Centered Empirical Study of Where Errors Enter and Which Controls Reach Them
arXiv cs.AI, 2026-11-11. Where failures enter a long run and which controls can still reach them. The empirical complement to the theorem above.
Agent Benchmarks Stop Ranking Before They Run Out of Tasks
arXiv cs.AI, 2026-11-11. Discriminative capacity dies before the task list does. Relevant to every agent number published this week.

Themes

No rulebook for the thing being sold

The gatekeeper – a component that inspects an agent's proposed action and permits or blocks it – is the common safety story across yesterday's kill-switch products and today's enterprise launches. Two papers this morning argue the pattern has a hard ceiling: no finite rule set certifies every safe program, and alignment framed as a solvable problem is the wrong frame. The engineering papers alongside them are consistent with that, and more useful: they stop asking for a correct gate and start asking which controls reach which failures.

AI Alignment Is Neither Solvable nor Sufficient
arXiv cs.AI, 2026-11-11. Position paper. Argues the framing itself is load-bearing and wrong; read it against the governance papers below.
AI Governance Should Prioritize Control and Knowledge Boundaries Over Limiting Intelligence
arXiv cs.AI, 2026-11-11. Boundaries on what a system can reach rather than what it can do. The tractable version of the same goal.
Just AI Governance and the Forbidden-Boundary Principle
arXiv cs.AI, 2026-11-11. A principled account of what should be off-limits by construction.
From Attack Surface to Defense Architecture: Compositional Security for Agentic Coding Harnesses
arXiv cs.AI, 2026-11-11. Security properties that compose, for the harness category most people reading this already run.
Specification-based Security Evaluation of Real-World Agents Tool-Calling under Long-Horizon Context Tasks
arXiv cs.AI, 2026-11-11. Specs checked over long contexts, where the published evaluations mostly stop.
Code mode is not a sandbox
Pydantic, 2026-11-10. The best short piece in this brief. Names a confusion that is currently shipping in production agent stacks.
Lazare, veni foras: Reprogramming Dormant Neurons to Backdoor AI Agents
Microsoft Research, 2026-11-10. A backdoor placed in capacity the model was not using. No gate at the tool boundary sees this.
Verifiable Agentic Traffic Class: A Policed Quality-of-Service Mechanism for Agentic AI Traffic, Evaluated from Simulation to Real-Kernel Adversarial Testing
arXiv cs.AI, 2026-11-11. Policing agent traffic at the network layer instead of the application. Unusual and tested against a real kernel.
Trust, but verify, audit and attribute: a human-in-the-loop framework for checking AI-produced research results
arXiv cs.AI, 2026-11-11. Verification with a named human in it. The honest cost accounting most pipelines omit.
How I'm thinking about different types of automated alignment
Alignment Forum, 2026-11-11. Taxonomy of what "automated alignment" can mean. Useful for reading vendor claims precisely.
Delaying Internal Deployments Until After X Days of Safety Testing
Alignment Forum, 2026-11-11. A policy proposal with a tunable parameter, which makes it arguable rather than aspirational.
AI Security
Schneier on Security, 2026-11-09. Separates securing AI systems from using AI for security. Carried over because the distinction keeps being needed.

The workplace is the product now

Both frontier labs spent this cycle shipping into the enterprise application layer rather than the API. The practitioner writing underneath is skeptical in a specific, technical way: protocols alone do not get you organizational scale, and the governance surface a company needs looks more like component boundaries and business-rule grounding than like a model release. The arXiv enterprise cluster is unusually applied this morning – SOPs, BPMN, DSL code generation, analytics-agent evaluation – which is what it looks like when the research follows the procurement.

Anthropic wants Claude to be the front end for your entire enterprise app stack
The New Stack, 2026-11-10. The strategic statement spelled out. The connector list is the actual roadmap.
Anthropic launches new workplace features to take on Microsoft and Google
Slashdot, 2026-11-10. Names the incumbents being targeted, which the vendor copy does not.
Introducing Businesses in ChatGPT
OpenAI, 2026-11-10.
OpenAI rolls out new business profiles, making ChatGPT just a little bit more like Google
TechCrunch, 2026-11-10. Assistant as directory. The comparison in the headline is the right one.
Anthropic and OpenAI are coming for the development workflow
InfoWorld, 2026-11-10. The same move read from the developer-tools seat.
MCP and A2A alone won't scale AI agents
InfoWorld, 2026-11-11. Protocols are necessary and not sufficient. The argument is about organizational scale, not throughput.
How components can help us govern agents
InfoWorld, 2026-11-09. Governance via component boundaries. The practical cousin of the boundary papers above.
Software developers need an Agentic manifesto
InfoWorld, 2026-11-11. Skippable as a manifesto, useful as a record of what the enterprise audience is being told this quarter.
Long-horizon agents and durable execution
Martin Fowler, 2026-11-10. Long-running agents as a durable-execution problem, with the workflow-engine prior art intact. The most reusable idea here.
From Process Models to Composable Agentic Workflows: Combining BPMN, Agents and Enterprise Knowledge
arXiv cs.AI, 2026-11-11. BPMN as the composition layer. Unfashionable and probably right.
Agent Architecture Cost-Success Trade-offs: A Controlled Evaluation across Enterprise-Style SOPs
arXiv cs.AI, 2026-11-11. Cost against success rate across architectures, controlled. The numbers procurement actually needs.
AgentScript-Eval: Benchmarking LLMs and Agents for Code Generation in an Enterprise DSL
arXiv cs.AI, 2026-11-11. Code generation where the language is not on GitHub. A cleaner contamination story than most coding benchmarks.
Beyond the Document: Compiled Context and Governed Agents for Any Work Product
arXiv cs.AI, 2026-11-11. Context treated as a compiled artifact. Relevant if you maintain prompt or skill files by hand.
TRACE: Business Rule-Grounded Reasoning Curriculum for Knowledge-Preserving Parametric Tool Retrieval in Enterprise LLMs
arXiv cs.AI, 2026-11-11. Tool retrieval grounded in business rules rather than embeddings.

When the ranking stops

Three papers this morning converge on the same measurement problem from different directions: benchmarks lose the ability to rank before they run out of tasks, human evaluators raise their standards as models improve so apparent quality stalls, and raters can agree on an answer while disagreeing completely about the failure reason. Taken together they say the published agent leaderboard is a lagging and increasingly noisy instrument, which matters now mostly because it is the instrument the enterprise launches above are being sold against.

AI Isn't Getting Dumber, We're Getting Pickier: Rising Standards in Human Evaluation of Large Language Models
arXiv cs.AI, 2026-11-11. The rater moves with the model. A mechanism for the widely reported feeling that nothing improves.
Agreeing on the Answer but Not the Reason: Measurement Limits of LLM Reasoning Failure Taxonomies
arXiv cs.AI, 2026-11-11. Failure taxonomies that do not survive two annotators. Read before trusting any error breakdown.
Comparative Analysis of Agent Evaluation Frameworks: Stability, Detection, and Discovery in Enterprise Analytics Agents
arXiv cs.AI, 2026-11-11. Compares the frameworks rather than the agents, on stability first.
ExpertCrowd-SWE: Measuring Frontier Coding Agents on Expert-Authored Engineering Tasks in Unfamiliar Codebases
arXiv cs.AI, 2026-11-11. Unfamiliar codebases, expert-written tasks. The condition under which coding-agent scores usually fall.
Ninety-Six Ways to Measure a Scribe: Fragmented Evaluation of Ambient Scribes in Healthcare
arXiv cs.AI, 2026-11-11. Ninety-six metrics and no comparability. A fully worked example of the problem in a regulated domain.
Veritas: A Verifier Generation Harness for Agent Tasks
arXiv cs.AI, 2026-11-11. Generating the verifier instead of the task. The constructive answer to benchmark exhaustion.
From Questions to Decisions: Benchmarking How LLM Agents Acquire Decision-Relevant Information from Human Beings
arXiv cs.AI, 2026-11-11. Measures whether an agent asks the right question, not whether it answers one.
BuySideFlow: A Point-in-Time Benchmark for LLM Agents in Investment Research
arXiv cs.AI, 2026-11-11. Point-in-time construction, which is the only way to make a finance benchmark honest about lookahead.

Scan

Agent memory, skills, and distillation (arXiv)

Don't Just Trust Your Memory: Evidence-Linked Memory Reduces Memory-Induced Degradation in LLM Agents
arXiv cs.AI, 2026-11-11. Memory that carries its evidence. The failure it fixes – an agent degraded by its own notes – is one most operators have seen.
Coding Agent Memory Post-Training II: Unlocking the Memory Potential of Pre-trained File Operations for Long-Horizon Tasks via On-Policy Distillation
arXiv cs.AI, 2026-11-11.
Personalized Memory Rubrics: Learning What to Remember per User via Rubric-Guided Credit Assignment
arXiv cs.AI, 2026-11-11.
TreeAgent: Structure-Aware Memory Agent for Processing Long Hierarchical Data
arXiv cs.AI, 2026-11-11.
Activation-Guided Graph Retrieval for Cognitive Memory Reconstruction in Language Model Systems
arXiv cs.AI, 2026-11-11.
SELD: Detecting Silent Evidence Loss in Context Compression beyond the Answer
arXiv cs.AI, 2026-11-11. Compression that keeps the answer and drops the support. Worth it if you compress context in production.
Program-Aided Patchable Skill Evolution
arXiv cs.AI, 2026-11-11.
Teaching the Harness: Student-Aware Skill Transfer for LLM Agents
arXiv cs.AI, 2026-11-11.
ReTrace: Distilling Tool-Using Agents into Planner-Free Workflows
arXiv cs.AI, 2026-11-11.
Bootstrapped On-Policy Distillation
arXiv cs.AI, 2026-11-11.
Which Successes Make Good References? Action-Sequence Alignment for Multi-Turn On-Policy Distillation
arXiv cs.AI, 2026-11-11.
SteerDistill: Quantizing LLM Agents via Closed-Loop Teacher Steering
arXiv cs.AI, 2026-11-11.
A Comprehensive Survey of Agent Distillation across Models, Artifacts, and Harnesses
arXiv cs.AI, 2026-11-11.
Repository-Context-Guided Image Understanding for Agentic Software Development
arXiv cs.AI, 2026-11-11.

Security

Git security vulnerabilities announced
GitHub Blog, 2026-11-10. Patch this one. Seventh in the series and still the tool every pipeline in this brief runs.
New OpenSSH Vulnerability
Schneier on Security, 2026-11-10.
Memory Safety Bugs in Rust Standard Library
Lobsters, 2026-11-10.
Microsoft's AI bug hunter finds Rust flaw that went undetected for nearly 11 years
InfoWorld, 2026-11-10. Read beside the item above: two independent routes to the same conclusion about unsafe blocks in std.
Fireworks AI confirms wider breach affecting Notion AI chats
Slashdot, 2026-11-10. An inference provider's breach reaching a downstream product's user conversations. The supply-chain shape to watch.
N-able takes its remote access service offline after researcher publishes dozens of zero-day bugs
TechCrunch, 2026-11-10.
I deleted all my SSH keys
Lobsters, 2026-11-10.
Finding a vulnerability in Star Wars Episode I: Racer
Lobsters, 2026-11-10.
Large-Scale Measurement and Real-World Mitigation of Web Browser Fingerprinting in the Wild
Lobsters, 2026-11-10.
Stinging the Swarm: Extracting Attacker Intelligence from a Twin-Controller OT Honeypot
arXiv cs.AI, 2026-11-11.
Domain-Invariant and Language-Model-Assisted Acoustic Side-Channel Attacks on Keyboards
arXiv cs.AI, 2026-11-11.
Code-Grounded Agentic Explanations for Static Analysis Vulnerability Findings
arXiv cs.AI, 2026-11-11.
Cogent and OpenAI build cyber defense factories for enterprises
OpenAI, 2026-11-10.

Engineering and tools

Turn down OpenTelemetry noise without a redeploy
Pydantic, 2026-11-10.
Share skills across users, teams, and agents with Aperture
Tailscale, 2026-11-10. Skill files as a distribution problem with an identity boundary. Closest thing shipping to the skill-transfer papers above.
clj-pulse: a fast Clojure language server
Planet Clojure, 2026-11-11.
Rendering in batches with glimmer and Datastar
Lobsters, 2026-11-10.
Go turns 17
Lobsters, 2026-11-10.
Announcing .NET 11
Lobsters, 2026-11-10.
Monads in Lean
Lobsters, 2026-11-11.
Claude Code v2.1.322
claude-code releases, 2026-11-10.
AI Engineer Code Summit: OpenAI on New Ways of Working With Codex
Latent Space, 2026-11-11.
Designing for Agents, Zeno Rocha, Resend
Latent Space, 2026-11-10.
New CNCF report: 75% of cloud-native developers ship code with AI
The New Stack, 2026-11-10. Survey number worth holding loosely, but the direction is not in dispute and the report itself is public.
OCaml Weekly News, 10 Nov 2026
OCaml.org, 2026-11-10.
OCaml Roundup: October 2026
OCaml.org, 2026-11-10.
Performance evolution of route lookup on Linux
Lobsters, 2026-11-11. Careful longitudinal measurement across kernel versions. Exemplary methodology regardless of whether you care about routing.
Modding Linux to use SIGKILL on every process
Lobsters, 2026-11-11.
The hardest tarball
Lobsters, 2026-11-10.
Next-level benchmarking overfitting
Lobsters, 2026-11-10. Database-benchmark overfitting, written years before the agent people started rediscovering it. Pairs with the eval theme.
30 years of Internet transfers with curl
Lobsters, 2026-11-10.
Weird licenses and the new open source
Lobsters, 2026-11-10.
What's new with the Neon backend
Neon, 2026-11-10.
Set up Supabase for every Expo environment in one command
Supabase, 2026-11-10.
Speed Insights and Web Analytics now support custom environments
Vercel, 2026-11-10.
llm-gemini 0.36
Simon Willison, 2026-11-10.
Locating the source of a mysterious beep with Claude
Simon Willison, 2026-11-09. Small debugging story, honest about what the model did and did not contribute. Useful as a calibration anecdote.
SpaceXSI quietly flips Grok API text watermarking to off by default
The New Stack, 2026-11-10. A provenance default reversed without announcement. Relevant to every detection pipeline built on it.

Nvidia, chips, and trade

Nvidia's crisis has corporate governance experts reaching for the popcorn
TechCrunch, 2026-11-11. Governance scholars on an active scandal. Thin on new fact, useful on which board mechanisms are being tested.
Nvidia CEO Jensen Huang's affair with alleged Chinese spy: a timeline
TechCrunch, 2026-11-10. Start here if you are picking the story up late. Dated entries, no commentary.
Google broadens its AI hardware portfolio with two new specialized chips
TechCrunch, 2026-11-10.
What Nvidia CEO's alleged spy scandal means for the U.S.-China AI race
WBUR, 2026-11-10.
The political and economic implications of the Nvidia scandal
WBUR, 2026-11-10.
Europe must rethink security as Big Tech power grows, EU says
Slashdot, 2026-11-10.
Databricks' commitment to European sovereignty
Databricks, 2026-11-09.

Policy and society

New York launches nation's first state AI testing program
Slashdot, 2026-11-10. A state building its own evaluation capacity. Read with the benchmark theme above: they will hit the same measurement wall.
The Download: Pelosi's successor targets AI, and data centers face power woes
MIT Technology Review, 2026-11-10.
'Reverse Engineer Anything': AI companies crack down on the coolest thing people were doing with AI
404 Media, 2026-11-10.
The missing quadrant in responses to AI
AI Snake Oil, 2026-11-10. A two-by-two that actually earns its axes. Names a position in the debate nobody is currently occupying.
Reddit is turning user conversations into AI-powered product reviews
Slashdot, 2026-11-10.
OpenAI's effort to use human reviewers to evaluate ChatGPT raises privacy questions
WBUR, 2026-11-10.
AI offers unconditional love. But at what cost?
WBUR, 2026-11-10. Turkle on artificial intimacy. The long-running version of an argument the product launches above assume is settled.
Work at the Frontier: AI's effect on freelance work
OpenAI, 2026-11-10. Vendor-authored labor research. Worth reading for the data, with the authorship in mind.
Helping caregivers use AI in everyday life
OpenAI, 2026-11-10.
ChatGPT Plus for veterans and servicemembers
OpenAI, 2026-11-11.
Pluralistic: The EU should go big and hard over border IT failure
Pluralistic, 2026-11-10.
We're asking an appeals court to require a warrant for ALPR searches
EFF Deeplinks, 2026-11-09.
Synaptics patent claims stop work on DisplayLink drivers
LWN, 2026-11-10. Patent assertion killing a driver. The non-AI reminder that upstream legal risk shapes what gets maintained.
Git considers voting to determine its LLM policy
LWN, 2026-11-09.
An AI Assistant for Automating Anti-Corruption Expertise of Draft Legislation Based on the TRACE Framework
arXiv cs.AI, 2026-11-11.
AI-Mediated Communication Can Steer Collective Opinion
arXiv cs.AI, 2026-11-11.

Research and math

When Proofs Are Abundant, What Is a Paper For?
arXiv cs.AI, 2026-11-11. The right question asked early. If verification gets cheap, the paper's job changes, and this works through what is left.
Epistemic Infrastructures of Science in AI Era Should Rebalance Costs of Generation and Verification
arXiv cs.AI, 2026-11-11. Generation got cheap and verification did not. Read immediately after the item above.
Compile-Gated Lean Proof Refactoring with Enterprise Agent Practices: A Model per Step under a US$3 Cap
arXiv cs.AI, 2026-11-11. A hard dollar cap and a compiler as the gate. The cheapest honest verification story in today's batch.
ProofCoder: Continuous Reasoning for Automated Software Verification
arXiv cs.AI, 2026-11-11.
Agentic AI Meets Formal Verification in the Era of Agentic Hardware Development
arXiv cs.AI, 2026-11-11.
Contrastive Discovery: Open-Ended Scientific Discovery over Competing Explanations
arXiv cs.AI, 2026-11-11.
PegasusAI Studio: Legible Cyberinfrastructure and Accountable AI Agents for Scientific Workflows
arXiv cs.AI, 2026-11-11.
Auditable Human-Agent Teams for Autonomous X-ray Experimentation
arXiv cs.AI, 2026-11-11.
Agent-Guided Discovery of Exchange-Correlation Functionals with Physics-based Validation
arXiv cs.AI, 2026-11-11.
Autonomous Optimization of Numerical Algorithms by an AI Agent: Application to Atomistic Simulation
arXiv cs.AI, 2026-11-11.
Ceci n'est pas une pipe: Toward a Symbolic Solver for the Abstraction and Reasoning Corpus Using Evolutionary Computation
arXiv cs.AI, 2026-11-11.
Evaluating LLM-Generated World Models for Neuro-Symbolic Reasoning
arXiv cs.AI, 2026-11-11.
Six Math Essentials now available
Terence Tao, 2026-11-10.
Tensegrity continuum robots enable task-adaptive morphologies for cooperative behaviours
Nature Machine Intelligence, 2026-11-11.
The case for a bubble at life's start
Quanta Magazine, 2026-11-10.
BC-MIT Number Theory Seminar
MIT calendar, 2026-11-10.
VISAP Exhibition
MIT calendar, 2026-11-11.

The crawler zoo

Six new user agents logged overnight, and the pattern in the names is the same census impulse as the MCP and agent-readiness papers above: MCP-Thesis-Catalog, smallweb-explorer, RNWY-Liveness. Something is enumerating the agent-tool surface from the outside, and it keeps knocking on ours.

Zoo Report, Week 45, 2026: 53,937 bot requests
The Crawler Zoo, 2026-11-09.
New arrival: MCP-Thesis-Catalog
The Crawler Zoo, 2026-11-11.
New arrival: smallweb-explorer
The Crawler Zoo, 2026-11-11.
New arrival: RNWY-Liveness
The Crawler Zoo, 2026-11-11.
New arrival: SeroBot
The Crawler Zoo, 2026-11-11.
New arrival: firstpage
The Crawler Zoo, 2026-11-11.
New arrival: agent-tools.cloud-a2a-version-audit
The Crawler Zoo, 2026-11-10.
Blunt Banhammer Blocks Basic Bots Ballistically
Lobsters, 2026-11-09.

Tail

Feed silences and verification

One hundred eighteen feeds were polled this morning: 68 returned new content, 49 answered 304 Not Modified, and one errored. Seventy-three published something inside the fourteen-day window.

www.bornholt.dev is the error. It has now failed to resolve on 169 consecutive polls since 2026-05-26 and has never once succeeded from this host, so the feed is excluded from the publishing count rather than reported as a gap. The registry entry stays pending a decision on whether the domain moved or went away.

Hacker News has answered 304 on every poll for sixteen days and last contributed an item dated 2026-10-26. That is still a bug on our side: the cached validator for the Firebase endpoint is stale and we keep sending it, so the source is pinned rather than quiet. No Hacker News items appear in this brief, and none should be read as absence of activity there.

The warehouse holds 70,039 items, of which 3,685 carry no date and are therefore invisible to every window query in this brief, including the item count above. Both numbers grew by roughly the expected daily amount; the dateless fraction is unchanged and remains the largest known gap in these figures.

Every URL above came from data/warehouse.db. Nothing was constructed from a title. Slashdot links had their utm_* feed parameters stripped; no other URL was edited.

The brief carries 207 external links plus one self-link to our own feed. All 208 were verified through crawler/fetch-gated, which runs the blocklist, then robots.txt, then the throttle, and issues no request when the gate denies. Nothing was denied: all 208 were allowed and fetched. Verification took twenty-three minutes parallelized by host, dominated by arXiv – 68 of the links are arXiv abstracts, serialized on one host by its Crawl-delay: 15.

Results: 200 returned 200 and seven returned 403. One link returned 404 on the first pass and was a transcription error on our side rather than a dead page: a WBUR slug had been truncated by one segment. It was corrected against the warehouse row and re-verified at 200. That is the second truncation caught this way in four days, and it is the argument for verifying every link rather than spot-checking.

The seven 403 responses are bot-challenge behavior rather than dead pages: openai.com (five links, including the Businesses in ChatGPT post at the top of this brief) and lwn.net (two, one of which is the subscriber-only Git article marked [$] in LWN's own feed). All seven also refused a GET, so the refusal is identity-based, not method-based. No link is dead.

Build provenance

build: 2026-11-11 | crawler-sha: b277e41 (Walsh-Research/1.2, compliance v1.4) | feeds: 118 polled today (68 ok, 49 not-modified, 1 error), 73 publishing in window | items-considered: 6055 (14d, incl. 3831 arXiv cs.AI) | warehouse: 70039 items (3685 dateless, see feed silences) | published: 208 URLs (208 allowed by gate, 0 denied; 200 HTTP 200, 7 bot-challenge 403 disclosed; 1 HTTP 404 corrected and re-verified, 0 dead links) | atom: 207 entries, RFC 4287 valid