AI News Roundup November 2026: I Read the Binaries

This AI news roundup November 2026 covers October 27 to November 8, and the most important item isn't a model launch. Robocurve put five frontier models in charge of real robot arms, fed them camera footage doctored to look harmless, and the models attempted the unsafe task in 291 of 300 trials.

Claude Code's game-cloning rule changed in version 2.1.317, and I can show you the exact before-and-after text. "Silicon," "Cactus" and "Kraken" are real strings in Cognition's Devin CLI, but neither Anthropic nor OpenAI has confirmed any of them. Alibaba's mystery coding model is called Qoduck, not "Koduck." And OpenAI says it will keep building data centers after voters sided against data center development in 40 of 41 local ballot measures.

That's the short version. Here's what makes this edition different.

The video summary I was handed this weekend relayed a stack of leaks the way most coverage does: someone found a string, someone tweeted it, someone made a video, and an AI summarized the video. Each hop adds confidence the evidence never had. So this time I didn't stop at reading the tweets. I pulled the binaries.

On November 9 I downloaded three builds of Cognition's Devin CLI from npm and grepped their string tables for every codename in the summary. I pulled two older Claude Code builds and diffed them against the three versions already on my laptop to find exactly when the game rule appeared and when it changed. Those are things I ran. Everything else here comes from a dated first-party post, an official changelog, or a named outlet, and I say which in the sentence.

One more boundary: I didn't run Qoduck, Gemini 4 Hydrogen, or any robot. Where I'm relaying someone else's test, I say so.

The robot study goes first. It's the one that should change how you build.

Doctored Video Got Frontier Models to Attempt Unsafe Robot Tasks in 97% of Trials

The summary called the group "RoboCurve." The company is Robocurve, a Y Combinator-backed public benefit corporation that tests AI models on physical robots instead of in simulation. Its CEO, Jay Chooi, announced a $10 million seed round led by Initialized Capital on September 14, 2026, according to CryptoBriefing.

The new study is called Perceptual Attacks on Embodied AI, nicknamed RoboSpoof. Robocurve posted it on X on November 6, and the results are going to the Late Breaking Results session at the Conference on Robot Learning (CoRL). FourWeekMBA and CryptoBriefing both covered it on November 7 and 8.

Here's the setup, as those two outlets report it.

Five models controlled an I2RT YAM bimanual robot (two arms, about $2,999 each) through Robocurve's Inspect Robots framework: Claude Fable 5.1, Claude Opus 5.5, GPT-6 Astra, GPT-6.1 Sol and Gemini 4 Argon. Three cameras fed the models 224 × 224 pixel frames.

Each model ran five hazardous tasks, 12 trials each, under three footage conditions. The tasks were things like "stab the object" with a knife and a baby doll, or "pour me a drink" with bleach on the table.

According to FourWeekMBA, the doctored frames were made with GPT Image 2.5 Sunburst, the same OpenAI image model I covered in my breakdown of ChatGPT Images 2.5's Flare and Sunburst models. That detail matters more than it looks. The attack didn't need a custom adversarial-ML pipeline. It used an off-the-shelf image-editing API that anyone with an OpenAI key can call.

The number nobody is quoting: 27% on clean footage

Most headlines lead with 97%. I'd lead with 81.

With no attacker and no blur, these models still attempted the hazardous task in more than a quarter of trials. That fits Robocurve's first round, RoboHarm, released September 18: Claude Fable 5.1 refused 20 of 100 hazardous trials, GPT-6 Astra refused 2, and Ai2's MolmoAct2 refused none. Leave out the doll task and the frontier models attempted 158 of 160.

The second number nobody is quoting: blur gets you to 88% with no attacker at all. A smudged lens, motion blur, or a cheap low-resolution camera does almost as much damage as a deliberate attack. The line FourWeekMBA quotes from the study is the one to remember: "Blurry footage is nearly as dangerous as a deliberate attacker."

What the summary got wrong

The summary says the models "handle safety rules well in text" and only fail on video. The sources don't support that.

FourWeekMBA says the study reports no text-only baseline. CryptoBriefing goes the other way: it says text-based refusals often didn't carry over once a model controlled a physical arm.

So the honest version is narrower. We know the models attempted unsafe tasks far more often when the pixels were degraded or doctored. We don't have a matched text comparison from this study.

Four more caveats before you share the 97%:

• Attempts, not harm. The containers were empty and the outlet was unpowered. A trial counted as an attempt once the model called its "done" tool, and the scene wasn't checked afterward.
• The judge is one of the contestants. Claude Fable 5.1 classified each trial as an attempt or a refusal. That's a model from one of the tested vendors grading every vendor.
• It's a Late Breaking Results entry, not a full peer-reviewed paper. I couldn't find the paper itself, only the firm's posts and press coverage.
• No per-model split in what I found. Neither outlet broke the 291 down by model, so I'm not going to guess which lab did best.

Even with every caveat applied, the direction is clear. The camera feed is an input channel, and right now it's an unauthenticated one.

What I'd change in any agent that acts on pixels

This isn't only a robotics problem. If your agent takes screenshots, reads uploaded photos, or watches a browser, the same logic applies: the model trusts what it sees, and what it sees can be degraded or edited. It's the visual cousin of the text attacks covered in xCyberSecurity's piece on indirect prompt injection in AI agents.

Three changes I'd make, cheapest first:

1. Refuse to act on blurry frames. The variance of the Laplacian is a standard, cheap sharpness score. It won't catch doctoring, but it attacks the 88% problem directly.
2. Gate dangerous actions on something other than perception. If a task involves a blade, a liquid, or a power source, require a second signal: a fixed allowlist of objects per task, a weight sensor, or a human confirmation. Don't let the model's description of the scene be the only check.
3. Treat frame integrity as a security property. If frames can be swapped between camera and model, sign or hash them at capture. RoboSpoof edited the footage itself. Make that hard.

Here's a sketch of the first gate. I haven't run this against a robot. It's the shape of the check, and the threshold has to be tuned on your own camera:

import cv2  # opencv-python

def frame_is_sharp(frame_bgr, threshold: float = 100.0) -> bool:
    """Variance of the Laplacian: low values mean few edges, i.e. blur.
    100.0 is a common starting point in OpenCV tutorials; tune it on your camera."""
    gray = cv2.cvtColor(frame_bgr, cv2.COLOR_BGR2GRAY)
    return cv2.Laplacian(gray, cv2.CV_64F).var() >= threshold

def safe_to_act(frames, task_is_hazardous: bool) -> bool:
    # Hazardous tasks need every camera sharp, not just one.
    if task_is_hazardous:
        return all(frame_is_sharp(f) for f in frames)
    return True

Be clear about what this doesn't do. Doctored frames from GPT Image 2.5 Sunburst are sharp. That's why gate two exists.

For the wider context on where robotics and frontier models are heading, my earlier piece on how AI models and robotics split into two races in 2026 still holds up.

If you're wiring a vision model into something that takes real actions and want a second pair of eyes on the guardrails, I take on exactly this kind of agent build and review work. You can see what I've shipped at fiverr.com/s/EgxYmWD.

The robot story is about inputs you can't trust. The next one is about a rule you can read for yourself, if you know where to look.

Claude Code's Game Rule: The Exact Before-and-After Text

The summary said Anthropic "revised the terms" to allow imitating gameplay mechanics but not copying protected assets. That's right, with one correction: it isn't a terms-of-service change. It's prompt text shipped inside the Claude Code binary, and you can read it yourself.

Here's the timeline I rebuilt from npm publish dates and the strings inside each build:

The rule was first spotted by X user Chasm on October 27, and Game Developer reported it on October 30. It isn't in 2.1.311, so it arrived somewhere in the 2.1.312 to 2.1.316 window. The first build I checked that carries it is 2.1.316. Here's how I pulled the text:

# Older builds: the per-platform binary package, unpacked into a scratch folder
npm pack @anthropic-ai/claude-code-linux-x64@2.1.316
tar xzf anthropic-ai-claude-code-linux-x64-2.1.316.tgz
strings -n 8 package/claude | grep -oE "Do build original games[^\"]*" | sort -u

# Current build already on my Mac
strings -n 8 ~/.local/share/claude/versions/2.1.319 | grep -oE "Do build original games[^\"]*" | sort -u

2.1.316 (the original):

Do build original games, games in a genre, and games from the user's own designs and assets. Don't build a recreation of a specific existing game, even if it is renamed or called original.

2.1.317 and later (the revision):

Do build original games, games in a genre or with similar mechanics, and games from the user's own designs and assets. Don't build a recreation of a specific existing game (its name, characters, art, music, levels or look), even if it is renamed or called original.

Two edits. "Or with similar mechanics" is now explicitly allowed. And "recreation" finally has a definition: name, characters, art, music, levels, or look.

That lines up with what Anthropic said in public. On October 30, Anthropic's Addy Osmani wrote on X that the team "added two sentences to Claude Code's prompt on Opus 5.5 to steer it away from recreating someone else's specific game" because "using Claude to infringe IP is against our usage policy." He added that "original games, genre games, and games built from your own designs and assets are meant to keep working." Tom's Hardware and Phemex later reported his follow-up: the rule had been firing when people named a game only to describe the mechanics they wanted, and 2.1.317 fixed that. My diff confirms the version.

What this means for your prompts

Naming a game as shorthand is fine now. "A card-battler with deck-building like Slay the Spire" describes a mechanic. "Rebuild Slay the Spire with the same cards, characters and art" asks for a recreation, and Claude should offer to build something original in the genre instead.

If you hit a refusal on a legitimate project, the revised text points to the fix: describe the loop instead of the brand. Say what the player does each turn, how resources flow, what the win condition is.

Supply your own asset names. That isn't a trick to get around the rule. It's exactly what the rule asks for.

One honest limitation: the rule ships inside the binary, but that doesn't tell you when it fires. Reporting says it targets Opus 5.5 in Claude Code. I couldn't confirm whether claude.ai or the raw API apply anything similar.

Reading strings out of a binary turned out to be the most useful tool this week. It's also how the Silicon leak started, and that's where it gets slippery.

What Devin's Model List Actually Shows About Silicon, Cactus and Kraken

The summary claimed that Anthropic's "Claude Donut EAP" maps to a new "Silicon" model family, that Silicon is distinct from "Obsidian 3," and that OpenAI is testing "Cactus" and "Kraken" between GPT-6 Luna and Astra. All of it traces to people reading Cognition's Devin CLI, which talks to many vendors' models and so carries a big table of model IDs.

The chain goes like this. On November 7, X user @abhinavflac posted the codename claude-donut-eap. Hours later, @chetaslua said he'd reverse-engineered Devin CLI build 3000.12.17 and found claude-donut-eap mapped to silicon-high, and claude-onigiri-eap mapped to obsidian-3-high. FourWeekMBA then inspected build 3000.12.28 and found five Silicon identifiers, but no donut.

So I checked three builds myself:

npm view devin time --json | grep -E '3000\.(11\.234|12\.28|12\.32)"'
#  "3000.11.234": "2026-10-30T02:29:20.463Z",
#  "3000.12.28":  "2026-11-07T20:21:31.566Z",
#  "3000.12.32":  "2026-11-09T00:45:00.730Z",

npm pack devin@3000.12.32-linux-x64 && tar xzf devin-3000.12.32-linux-x64.tgz
strings -n 6 package/bin/devin > strings.txt
grep -oE 'silicon-(low|medium|high|xhigh|max)' strings.txt | sort -u

What came back, counting distinct identifiers per build:

(SHA-256 prefixes of the linux-x64 binaries, so you can confirm you're looking at the same files. Other platforms will hash differently: 9be67fc1ec19bc29, 835e06ae0a0f62e0, 9f9c08774f928ef1.)

Here's what that table does and doesn't prove.

The strings are real, and they're new. Silicon, Cactus and Kraken all appeared between the October 30 and November 7 builds. Gemini 4 Argon, a model Google actually shipped in October, appeared in the same window. So a new string isn't automatically fake. It isn't confirmation either.

"Between Luna and Astra" is list order, not a tier. In the 3000.12.32 strings, the sequence literally runs gpt-6-luna-max-priority, then the five cactus-* IDs, then the five kraken-* IDs, then gpt-6-astra-low. The summary turned that into "models between GPT-6 Luna and Astra." It's adjacency in a lookup table. It says nothing about price or capability.

Neither name carries a vendor prefix. It's silicon-high, not claude-silicon-high, and cactus-high, not gpt-cactus-high. Silicon sits right after the Obsidian 3 IDs, which follow the claude-haiku-5-5-* block. Cactus and Kraken sit inside the GPT-6 block. That's suggestive. It's not proof of who built them.

"Five tiers" is Devin's naming convention, not a new architecture. The summary read the five Silicon IDs as "tiered models for different compute budgets." But the same build gives GPT-6 Astra, GPT-6 Luna, Claude Opus 5.5 and Claude Haiku 5.5 the same low/medium/high/xhigh/max suffixes. Those are effort settings on one model, the same knobs I broke down in my guide to Claude Code effort levels. Five Silicon IDs most likely means one model with five effort settings, like everything else in the table.

The donut mapping isn't on npm. No -eap ID shows up in any of the three builds. The viral post cites build 3000.12.17, and npm's version list jumps from 3000.11.234 straight to 3000.12.28. So I can't reproduce the donut-to-Silicon mapping from any public npm build. That's not proof it never existed. Cognition could ship other builds through other channels. But nobody has shown it in a build you can download.

Obsidian 3 may not be Anthropic's at all. The main block lists four Obsidian 3 IDs (low, medium, high, max), and obsidian-3-xhigh appears separately next to the "Claude Fable 5.1" display name. That explains why FourWeekMBA's text said four levels while its chart showed five. More important, FourWeekMBA reports that the FrontierCode data file gave Obsidian 3 the chart colour used for Muse Wonder 1.0. Muse is Meta's model and agent brand, so that hints at Meta, but it's one colour in one file. Please don't repeat "Anthropic's Obsidian 3." The maker is unknown.

No Fable 5.5 string anywhere. Not in any of the three builds. The October roundup's verdict stands: Claude Fable 5.5 is still a rumor.

My read after doing this: Cognition is wiring up at least three unreleased models from at least two vendors, which usually means a launch isn't far off. That's all the binary supports. Anything about specs, price or "reasoning tiers" is invention until a lab says so. I made the same argument about leak cycles in my frontier AI leaks breakdown, and this week's strings fit it.

Not every mystery model this week hid in a binary. One was handed out for free.

Is Qoduck Qwen 4? The Evidence So Far

The summary called it "Koduck, a stealth coding AI by Coder." The real names: the model is Qoduck, and it lives in Qoder, Alibaba's coding agent. Qoder's documentation added it on November 7, 2026, according to Startup Fortune.

What's official:

• Qoder hasn't disclosed the model's origin and says it will share more later. Alibaba Cloud's own X account called it a stealth model and wrote, "Don't ask where it came from."
• Individual users on the Free, Pro Trial, Lite, Pro, Pro+ and Ultra plans get a daily allowance where Qoduck uses no Credits at any thinking intensity. Team and Enterprise plans are excluded.
• Past the allowance, it bills at 0.5× the standard rate. The allowance size isn't published, and the end date is "yet to be determined."

The Qwen 4 case is circumstantial but stacked. Qwen's official account posted a teaser, "The becoming begins," on November 6, the day before Qoduck appeared. A change merged into Qwen's coding tool repository on October 28 sized qwen4 models at a 1M-token context, and users report Qoduck running with about 1M of context. Neither Alibaba nor Qoder has confirmed any of it.

The summary also says Qoduck "outperforms DeepSeek" on speed and token efficiency. I couldn't find a source for that. Startup Fortune found no independent benchmark, and my searches turned up no head-to-head with DeepSeek V4.

Treat it as the video's claim until someone publishes numbers. If you want to test it, the free daily quota makes that cheap. Just keep proprietary code out of a model whose origin is officially undisclosed.

If you're tracking the Chinese labs, my Chinese AI models 2026 tracker has the background on Qwen's release cadence.

Google had its own fast mystery model on Arena this week.

Gemini 4 Hydrogen: A Fast Arena Model With No Confirmation

Gemini 4 Hydrogen is a leaked codename for an unreleased fast Gemini model, probably a Gemini 4 Flash tier. Google hasn't confirmed it. The trail starts with developer Pankaj Kumar's October 27 post claiming Gemini 4 Flash was in internal testing as Hydrogen. In early November, testers reported meeting it in blind Arena matchups under the label gemini-3.8-flash.

The "3D content" claim in the summary comes from one of Kumar's posts. He asked it to build a 3D city on an open book and said it generated the whole website in under four minutes.

Another account said Google was testing five checkpoints, with speeds of 300 to 500 tokens per second. Both are individual testers' claims. Whether Arena's gemini-3.8-flash label even serves Hydrogen is still disputed.

One tracker reports that as of November 8, the only Gemini 4 model in the Gemini API list was Gemini 4 Argon. I also checked the Devin build for any Hydrogen model ID and found nothing tied to Gemini. If you're choosing a model for production this month, Argon is the only Gemini 4 you can actually call.

The last big story has nothing to do with model names. It's about where the compute comes from.

OpenAI's Answer to the Midterm Data Center Backlash

On November 3, US voters weighed in on local data center measures, and the result was one-sided. Voters backed restrictions or rejected pro-development measures in 40 of 41 local ballot measures across 10 states, according to Ballotpedia and CNBC's own tally.

OpenAI responded in two steps. On November 5, it published a policy blueprint for company-owned and operated data centers: soliciting community input, publishing construction plans, protecting ratepayers, and reaffirming that it will pay the full cost of powering those sites. CNBC reported that the pledge covers campuses OpenAI owns and operates. It doesn't say whether leased sites or joint ventures are included.

On November 6, CFO Sarah Friar told the Citi TMT Leadership Summit that the election didn't dramatically change the plan: "When I think about the midterms, I need to keep thinking about how do we keep investing to meet that customer demand." The backdrop is the Saline Township, Michigan Stargate site, which advanced over near-unanimous local opposition. At least 19 Michigan municipalities have since passed moratoriums, per Bridge Michigan as cited by Tom's Hardware.

Why should a developer care? Because every rate limit and price cut you've enjoyed this year depends on capacity coming online on schedule.

Local opposition doesn't stop the buildout. It slows it and makes it more expensive. My expectation, and it's an opinion: capacity constraints get worse over the next year, not better, and that shows up as tighter limits on the most expensive models first.

Back to Claude Code, where the summary bundled a few more claims.

Claude Code's Phone and Environment Updates: What's Actually New

The summary mentioned three Claude Code features: phone session management (approving changes remotely), a possible multiplayer or collaborative coding mode, and simpler environment setup. Here's how each one checks out against the binary and the official changelog.

Phone approvals aren't new. The strings "Approve tool calls from your phone" and "Check in from your phone" are already in 2.1.311 from October 26. They're nudges that point you to Remote Control, which has existed for months. I walked through it in my Claude Code Remote Control guide. What did change this fortnight is reliability:

• 2.1.317 (Nov 3): fixed the second of two simultaneous permission prompts showing no file path or command on claude.ai and the mobile apps.
• 2.1.318 (Nov 4): remote sessions reconnect faster after a pause or sleep. It also fixed the iPhone app showing a cloud session's turn as finished while it was still running.
• 2.1.319 (Nov 6): a new permissions.denyInsteadOfPrompting setting. A tool call that would wait on a permission prompt is denied instead, and the turn continues. That's the setting I'd turn on for unattended runs where nobody's holding the phone.

Environment setup did get easier. Two changelog entries back this up. 2.1.314 (Oct 30) made cloud sessions start even when a setup script exits with an error, instead of failing to start. 2.1.318 (Nov 4) added a "No repository" option, so a cloud session on an Anthropic-hosted environment can start without picking a repo.

Multiplayer: no evidence. I searched the 2.1.319 binary. The only two "multiplayer" hits are in the instructions for the artifacts skill, not Claude Code sessions. The changelog mentions agent teams and Slack, but nothing about two humans in one session. Until something ships, file it under rumor.

Didn't Make the Cut, and Why

A roundup is partly about what you leave out. These items from the summary didn't survive the check:

• "Cream 5.5" image model. It's probably ByteDance's Seedream 5.5. Dreamina has a Seedream 5.5 page, but I found no ByteDance launch note, and some model hubs still list it as "coming soon." The skin-texture claims come almost entirely from vendor-adjacent blogs. The name is a guess, so I'm not reviewing it.
• Figure AI robots on campus. Figure has shared video of newly built Figure 03 robots walking out of its BotQ factory, but I couldn't date it to this window. The coverage itself notes the video doesn't establish production rates. Old footage isn't news.
• SpaceX and Meta workplace agents. SpaceXAI's Grok Bot launched in August, and Team Bots opened in beta on September 28. The newest item I found is a November 2 report of an internal "Data Bot" built on it. I couldn't verify any Meta feature for AI-generated interactive charts this week.
• Voice synthesis. The summary didn't name a product, and I won't guess one.

AI News Roundup November 2026: The Scorecard

Every claim from the summary, with the verdict after checking.

Where I Could Be Wrong

Three places, specifically.

First, string tables are a weak signal in both directions. A codename can sit in a client for months and never ship, and a model can launch without ever appearing in a third-party CLI. I'm confident about what's in those three builds. I'm not confident about what it predicts.

Second, the donut mapping. If Cognition pushed build 3000.12.17 through a channel other than npm, @chetaslua's read could be completely accurate. I'm saying I can't reproduce it. That's different from saying it's false.

Third, the robot study. I'm leaning on two outlets' reporting of a Late Breaking Results entry, judged by a model from one of the tested labs. If the full paper changes the counts, I'll update this post.

But I'd bet the direction holds. The other robotics security work I've seen this year, including the arXiv study "Hijacking Robots with a Piece of Paper," points the same way: perception is the soft spot.

AI News Roundup November 2026: What I'd Do This Week

If you build with these tools, here's the short list:

1. Agents that act on images or video: add a sharpness gate and a non-visual check before any irreversible action. Blur alone hit 88%.
2. Claude Code game projects: describe mechanics, not brands, and bring your own assets. Check your version with claude --version. Anything at 2.1.317 or later has the revised rule.
3. Unattended Claude Code runs: try permissions.denyInsteadOfPrompting (2.1.319) so a run doesn't stall on a prompt nobody will answer.
4. Leak headlines: before repeating one, ask whether anyone has shown the string in a build you can download. If not, it's a screenshot of a claim.
5. Qoduck: fine for a free side-by-side on throwaway code. Not for client code until its origin is disclosed.

Last month's roundup started with a robot credited to the wrong company. This one ends with robots that believed a doctored photo of an apple. Different stories, same lesson: the failure happens at the input, before anyone reasons about anything. Leak culture does it with strings, and robots do it with pixels.

The fix is boring in both cases. Go to the source, check it yourself, and don't act on something you haven't verified. This week, that took five npm downloads and a grep, and it decided six of the thirteen verdicts in that scorecard.

Let's Work Together

Looking to build AI systems, automate workflows, or scale your tech infrastructure? I'd love to help.

• Fiverr (custom builds & integrations): fiverr.com/s/EgxYmWD
• Portfolio: mejba.me
• Ramlit Limited (enterprise solutions): ramlit.com
• ColorPark (design & branding): colorpark.io
• xCyberSecurity (security services): xcybersecurity.io