Cato Networks' threat research team disclosed HashJack, described as the first known indirect prompt injection delivered through a URL fragment — the part of an address after the hash. Because fragments are processed client-side and never sent to servers, they bypass firewalls, server logs and network inspection; when an AI browser assistant ingests the full URL into its reasoning context, it reads attacker instructions in the fragment as page content or user intent. Cato documented six scenarios including callback phishing, credential theft, medical misinformation and, in agentic modes, silent data exfiltration to attacker-controlled endpoints.

Disclosure timelines diverge sharply. Microsoft acknowledged the report in August and fixed Copilot for Edge on October 27; Perplexity applied a Comet fix by November 18, though Comet was the most exposed because its agentic mode would act on the injected instructions automatically. Google triaged the issue in August, then classified the Gemini for Chrome behavior as low severity and won't-fix intended behavior on October 3 — still unresolved when the research published on November 25.

Peter Steinberger released a self-hosted personal agent under the name Warelay, later renamed OpenClaw. The premise was the one that would define the following year: an always-on agent that lives on your own machine or server, holds your messaging accounts, and reaches the tools you already use rather than waiting to be prompted in a chat window.

It is the origin point for the wave this dispatch has tracked since, so it belongs here rather than only in its later milestones. Nothing about the first release looked like an industry event at the time.

Anthropic released Claude Opus 4.5, its third 4.5-series model in two months, scoring 80.9% on SWE-bench Verified — the first model above 80% on that benchmark — plus 59.3% on Terminal-bench 2.0, 66.3% on OSWorld computer use, 62.3% on MCP Atlas and 37.6% on ARC-AGI-2 Verified. API pricing dropped to $5 per million input tokens and $25 per million output tokens, about one-third of Opus 4.1's $15/$75, and Anthropic reports up to 76% fewer tokens at medium effort while matching Sonnet 4.5's best result. Opus 4.5 became the default model for Pro, Max and Enterprise, and shipped under the ASL-3 standard of Anthropic's Responsible Scaling Policy.

Two of the changes matter more to people building agents than the benchmark spread. A new effort parameter exposes the reasoning-compute tradeoff per request, and the long-context rewrite — training changes plus explicit context compression — enabled an endless-chat mode that silently compresses memory when the window fills instead of failing. Anthropic also moved Claude for Chrome out of pilot for Max users and Claude for Excel to Max, Team and Enterprise, its first real push into the browser and spreadsheet surfaces where agentic work actually happens.

Microsoft Research released Fara-7B, a 7 billion parameter native computer-use agent built on Qwen2.5-VL-7B, with 128k context, an MIT license and open weights on Hugging Face and Microsoft Foundry. It scores 73.5% on WebVoyager and 38.4% on Microsoft's new WebTailBench, beating UI-TARS-1.5-7B at 66.4% and OpenAI's computer-use-preview at 70.9% on WebVoyager while averaging roughly 16 steps per task against 41 for UI-TARS. The model was trained over four days in late October on 64 H100s — no reinforcement learning — on 145,000 synthetic web trajectories produced by the FaraGen pipeline at about $1 each, and it perceives the screen purely as screenshots, emitting coordinates for clicks and keystrokes.

Two things make it more than another small model drop. Because nothing but pixels and prompts leaves the device, Microsoft frames it as pixel sovereignty for regulated workloads where the screenshot itself is the sensitive artefact, and it ships a critical-points safeguard that halts the agent for human approval before irreversible actions. It also released WebTailBench, a benchmark of tasks designed to stay valid through November 2025, which addresses the staleness problem that makes most web-agent leaderboards unreproducible. It is an experimental release, not a supported product.

President Trump signed Executive Order 14363 on November 24, published in the Federal Register on Friday November 28, establishing the Genesis Mission — a Department of Energy-led national program to accelerate scientific discovery using AI, explicitly framed against the Manhattan Project. The order directs DOE to build an American Science and Security Platform combining supercomputing with secure cloud, AI models and agents, simulation and design tools, and governed access to federal datasets including proprietary and synthetic data, with classification, supply chain and federal cybersecurity requirements attached.

The deadlines are concrete rather than aspirational: DOE must inventory available computing resources within 90 days, select initial data and model assets, stand up an initial operating capability for at least one national science or technology challenge, and report to the president within a year and annually thereafter. The order also instructs DOE to create standardized collaboration vehicles — cooperative research and development agreements, data-use and model-sharing agreements, plus intellectual property and commercialization policies — for universities and private partners contributing data, compute or research capacity.