Everything that mattered in AI, one page a week.

Cato Networks' threat research team disclosed HashJack, described as the first known indirect prompt injection delivered through a URL fragment — the part of an address after the hash. Because fragments are processed client-side and never sent to servers, they bypass firewalls, server logs and network inspection; when an AI browser assistant ingests the full URL into its reasoning context, it reads attacker instructions in the fragment as page content or user intent. Cato documented six scenarios including callback phishing, credential theft, medical misinformation and, in agentic modes, silent data exfiltration to attacker-controlled endpoints.

Disclosure timelines diverge sharply. Microsoft acknowledged the report in August and fixed Copilot for Edge on October 27; Perplexity applied a Comet fix by November 18, though Comet was the most exposed because its agentic mode would act on the injected instructions automatically. Google triaged the issue in August, then classified the Gemini for Chrome behavior as low severity and won't-fix intended behavior on October 3 — still unresolved when the research published on November 25.

Peter Steinberger released a self-hosted personal agent under the name Warelay, later renamed OpenClaw. The premise was the one that would define the following year: an always-on agent that lives on your own machine or server, holds your messaging accounts, and reaches the tools you already use rather than waiting to be prompted in a chat window.

It is the origin point for the wave this dispatch has tracked since, so it belongs here rather than only in its later milestones. Nothing about the first release looked like an industry event at the time.

Anthropic released Claude Opus 4.5, its third 4.5-series model in two months, scoring 80.9% on SWE-bench Verified — the first model above 80% on that benchmark — plus 59.3% on Terminal-bench 2.0, 66.3% on OSWorld computer use, 62.3% on MCP Atlas and 37.6% on ARC-AGI-2 Verified. API pricing dropped to $5 per million input tokens and $25 per million output tokens, about one-third of Opus 4.1's $15/$75, and Anthropic reports up to 76% fewer tokens at medium effort while matching Sonnet 4.5's best result. Opus 4.5 became the default model for Pro, Max and Enterprise, and shipped under the ASL-3 standard of Anthropic's Responsible Scaling Policy.

Two of the changes matter more to people building agents than the benchmark spread. A new effort parameter exposes the reasoning-compute tradeoff per request, and the long-context rewrite — training changes plus explicit context compression — enabled an endless-chat mode that silently compresses memory when the window fills instead of failing. Anthropic also moved Claude for Chrome out of pilot for Max users and Claude for Excel to Max, Team and Enterprise, its first real push into the browser and spreadsheet surfaces where agentic work actually happens.

Microsoft Research released Fara-7B, a 7 billion parameter native computer-use agent built on Qwen2.5-VL-7B, with 128k context, an MIT license and open weights on Hugging Face and Microsoft Foundry. It scores 73.5% on WebVoyager and 38.4% on Microsoft's new WebTailBench, beating UI-TARS-1.5-7B at 66.4% and OpenAI's computer-use-preview at 70.9% on WebVoyager while averaging roughly 16 steps per task against 41 for UI-TARS. The model was trained over four days in late October on 64 H100s — no reinforcement learning — on 145,000 synthetic web trajectories produced by the FaraGen pipeline at about $1 each, and it perceives the screen purely as screenshots, emitting coordinates for clicks and keystrokes.

Two things make it more than another small model drop. Because nothing but pixels and prompts leaves the device, Microsoft frames it as pixel sovereignty for regulated workloads where the screenshot itself is the sensitive artefact, and it ships a critical-points safeguard that halts the agent for human approval before irreversible actions. It also released WebTailBench, a benchmark of tasks designed to stay valid through November 2025, which addresses the staleness problem that makes most web-agent leaderboards unreproducible. It is an experimental release, not a supported product.

President Trump signed Executive Order 14363 on November 24, published in the Federal Register on Friday November 28, establishing the Genesis Mission — a Department of Energy-led national program to accelerate scientific discovery using AI, explicitly framed against the Manhattan Project. The order directs DOE to build an American Science and Security Platform combining supercomputing with secure cloud, AI models and agents, simulation and design tools, and governed access to federal datasets including proprietary and synthetic data, with classification, supply chain and federal cybersecurity requirements attached.

The deadlines are concrete rather than aspirational: DOE must inventory available computing resources within 90 days, select initial data and model assets, stand up an initial operating capability for at least one national science or technology challenge, and report to the president within a year and annually thereafter. The order also instructs DOE to create standardized collaboration vehicles — cooperative research and development agreements, data-use and model-sharing agreements, plus intellectual property and commercialization policies — for universities and private partners contributing data, compute or research capacity.

OpenAI released GPT-5.1-Codex-Max on 19 November and made it the default across every Codex surface, one day after Gemini 3 Pro. It is OpenAI's first model natively trained to operate across multiple context windows using a process it calls compaction: as a session approaches the window limit the harness prunes history while preserving the important context, takes a fresh window, and repeats until the task is done. OpenAI says internal runs lasted more than 24 hours, and that at medium reasoning effort the model matches GPT-5.1-Codex on SWE-bench Verified while using 30% fewer thinking tokens; the API listing gives it a 400,000-token context window and 128,000 max output tokens.

Reported results are 77.9% on SWE-bench Verified at the new xhigh reasoning setting and 58.1% on Terminal-Bench 2.0, ahead of Gemini 3 Pro's 54.2% on the same grader. Pricing is $1.25 per million input tokens and $10 per million output tokens, unchanged from GPT-5-Codex. The system card leans on product-level mitigations rather than model behavior — agent sandboxing and configurable network access — and states the model is OpenAI's most cyber-capable to date while still below its Preparedness High threshold; it is also the first OpenAI model specifically trained for Windows environments.

Google launched Gemini 3 on 18 November, with Gemini 3 Pro available the same day in the Gemini app, in AI Mode in Search for paid tiers, and for developers in AI Studio, Vertex AI and Gemini CLI, plus third-party surfaces including Cursor, JetBrains and Replit. It became the first model to cross 1500 Elo on LMArena, debuting at 1501, and Google reported a record 37.4 on Humanity's Last Exam against the previous high of 31.64 held by GPT-5 Pro. Google put the Gemini app at 650 million monthly active users and AI Overviews at 2 billion monthly users, and said this was the first time Gemini shipped in Search on day one.

The developer-relevant half of the launch is Google Antigravity, an agentic development platform released alongside the model that reports its own work as artefacts — task lists, execution plans, screenshots and browser recordings — rather than raw tool calls, with an editor view for hands-on work and a manager view for orchestrating several agents at once. Google delayed Gemini 3 Deep Think for extra safety testing. Pricing for Gemini 3 Pro is $2 per million input tokens and $12 per million output for prompts up to 200K tokens.

On 18 November Microsoft and NVIDIA agreed to invest up to $5 billion and up to $10 billion respectively in Anthropic, and Anthropic committed to purchase $30 billion of Azure compute capacity plus additional capacity of up to one gigawatt, running on NVIDIA Grace Blackwell and Vera Rubin systems. The deal makes Claude the only frontier model offered across all three major clouds and keeps Claude inside GitHub Copilot, Microsoft 365 Copilot and Copilot Studio. NVIDIA and Anthropic also established a technology partnership covering chip and model engineering.

The structure is circular and reviewers said so on the day: the companies putting equity into Anthropic are also the suppliers Anthropic is contractually buying compute back from, a pattern business leaders quoted by Reuters flagged as bubble risk. Anthropic was recently valued at $183 billion, has more than 300,000 business and enterprise customers, and has projected an annualized revenue run rate around $26 billion next year. The announcement shared a Tuesday with Gemini 3, so the week's two biggest stories were the model got better and the capital got stranger.

xAI released Grok 4.1 on 17 November after a two-week silent rollout through 1-14 November that pushed early builds into a growing share of live production traffic; blind pairwise evaluations there had users preferring it 64.78% of the time over the previous production model. xAI reports the hallucination rate on sampled real-world information-seeking queries dropping from 12.09% to 4.22%, and the FActScore error rate from 9.89% to 2.97%. Grok 4.1 Thinking took the top slot on LMArena's Text Arena at 1483 Elo with the non-reasoning mode at 1465; the flagship carries a 256K-token context window and xAI has not disclosed parameters or architecture.

It held that position for hours rather than days — Gemini 3 Pro posted 1501 Elo the next day and the lead was gone. The more interesting engineering note is the training method: xAI says it deployed frontier agentic reasoning models as automated reward judges for style, personality and alignment, replacing a large share of the manual annotation pipeline. At launch Grok 4.1 was available on grok.com, X and the mobile apps but not through the public API, which xAI addressed separately with a lower-cost Grok 4.1 Fast model two days later.