Claude stops rebuilding other people's games; OpenAI's round shrinks to $20bn; DeepSeek open-sources a repo agent

dsh-superagent — is a research prototype from DeepSeek's harness team: an agent that lives on one GitHub repository, accepts work from a short list of approved people, and answers in the thread, usually with a pull request. The defaults are the interesting part — its own GitHub account, an observe mode that logs what it would have done, and auto-merge off by default until its pull requests have earned trust. It is a ready-made template for the cautious rollout clients keep asking you to design. Published 31 October under the MIT licence; it passed 1,500 stars within the day. explainx.ai

Prospero — is a new coding harness written in C++ with a desktop interface, built by a developer fed up with harnesses that eat gigabytes and stall overnight on a trivial prompt. Its organising rule: every operation has a deadline, so an unanswered permission request times out as a refusal and a slow shell command is promoted to a background task instead of freezing the run. The complaints it fixes are the ones your engineers grumble about weekly. It ships with no model providers; you point it at llama.cpp, OpenRouter or a vendor API yourself. nullprogram

“At its core a coding harness is essentially curl glued to popen() . This should not require gigabytes of RAM.”

agent-desktop — is a command-line tool from Vercel Labs that lets an agent operate a desktop by reading the accessibility tree — the structured list of buttons, fields and labels an operating system already publishes for screen readers — instead of squinting at screenshots. Screenshot-driven computer use is slow and flaky; reading the structure is the approach worth testing before you promise a client any desktop automation. It is written in Rust and exposes 60 commands. explainx.ai

Claude Code v2.1.316 — adds an environment variable that switches off the ultrathink keyword, and a pooled monthly budget that a whole group shares on top of each member's own limit, set through the spend-limits admin API. It also deprecates fast mode on Opus 4.8. The pooled budget is the control finance teams have been asking for; the deprecation is a diary entry, because requests will error rather than quietly fall back. Fast mode on Opus 4.8 was deprecated on 30 October and is removed on 30 November 2026. GitHub

Arca — is an AI-native wealth management firm whose agents carry client work that can run up to ten days, backed by an internal memory system that tracks what has happened and who owes what next, and a home-built harness that picks the model per task. It is a rare, concrete answer to the client question of what agentic delivery looks like in a regulated business: agents analyse and propose, a human advisor executes anything involving money, and the limits are hard-coded rather than prompted. Arca raised $48.5 million in a round led by General Catalyst. Latent Space

“agents prompt people more than people prompt agents”

OpenAI — has cut the target for its current private round by $10 billion, to $20 billion, and lowered the valuation it is asking for to $1.25 trillion from $1.4 trillion, after several investors trimmed what they had pledged. Expect the "is this a bubble" question in your next client meeting; this is the number people will cite. Anthropic's flotation, expected around mid-November and valued at $1.5 trillion or more, is chasing the same institutional money. OpenAI's annualised revenue was about $50 billion at the end of September, against the $68–70 billion investors had been told. Trending Topics

ChatGPT Pro 200 — will not lose capacity after all: OpenAI scrapped the planned reduction and instead doubled usage allowances across its premium plans, effective immediately, with prices unchanged. If you re-planned a client's Codex budget around the cut, unwind it — and note the competitive reflex, since Anthropic reshuffled its own top tiers days earlier. The change covers Pro 100, Pro 200, Pro 500 and Business Premium; the Plus tier is untouched, and the extra headroom lands mainly on ChatGPT Work and Codex, which share a pool. Techstrong.ai

Claude VS Code extension — was replaced for roughly twelve hours by a malicious build pushed from Anthropic's own account in Cursor's marketplace, which tried to add an attacker's SSH key, switch on the local SSH service and open a reverse tunnel home. Extensions auto-update by default, so this is a "check your fleet" item, not a headline to skim. Version 2.1.313 reached at most 5,000 users; anyone who installed or updated between 5:27am and 4:35pm ET on Thursday should assume they were hit. Ars notes Anthropic had still issued no public warning. Ars Technica

ChatGPT share links — could be weaponised: researchers at Parameter chained a maths-keyboard flaw and a permitted YouTube endpoint so that opening a public shared conversation ran the attacker's code inside the visitor's signed-in session, listing their chats and pulling content from one never shared with the attacker. Three individually sensible features combined into an account takeover — the exact failure shape to cite when a client asks why agent sandboxes need reviewing as a system. OpenAI fixed it on 26 October and rated it P1; the bounty paid was $5,000. Parameter

VOLTA — is a Windows data stealer analysed by Cisco Talos that, after grabbing passwords, cookies and wallets, posts a dossier to a commercial model through OpenRouter and asks it to rank what the victim is worth. It is built to survive refusals: when one model declines, it tries the next. This is the "AI in crime" story clients will have seen, and the honest read is unglamorous — the model is doing the analyst's paperwork, not the hacking. It defaults to Claude Opus 4.6 and falls back to Kimi K2, then Gemini 2.5 Flash. Talos suggests restricting which processes may launch Chrome in headless mode. Cisco Talos

PageBreak — is Google's security agent, built on Gemini, that hunts for web vulnerabilities but only files a report once ordinary, human-written validator code reproduces the exploit against a running system. Google says it has turned up more than 500 cross-site scripting bugs since January. The design lesson travels well: let the model guess freely, but let deterministic code outside the agent loop decide what reaches a team's inbox. Unproven findings are kept in-house to improve the validators rather than sent to product teams; no outside party has verified the 500-plus count. InfoQ

AWS — grew 39% to $46 billion in Amazon's third quarter, its fastest in years, while the group's free cash flow over the year to September came in at minus $42.4 billion, almost entirely because of AI data-centre building. Two things to tell clients planning capacity: demand is real, and nobody is about to cut prices to win your workload. Amazon still expects about $220 billion of cash capital spending this year, and Andy Jassy guided to AWS growth above 40% in both 2027 and 2028. Tech AI Wire

Postgres 19 — is late, and committer Robert Haas is reported as blaming the flood of bugs that language models have been finding in the codebase, with back-patches up 60%. A useful counterweight to the "AI writes the code" pitch: the first measurable effect on a mature project was more verified work for maintainers, not less. The 60% figure refers to fixes back-ported to older releases, not new features. explainx.ai