- Security firm Claroc says 35,578 of 37,571 live Grok Build apps were readable by anyone holding the link, including 24 built by SpaceXSI and X staff.
- Baidu shipped ERNIE 5.5 Flash Preview on November 11: 280 billion parameters with about 14 billion active per token, a 1 million token context, and Apache 2.0 weights promised with no date attached.
- Treasury Secretary Scott Bessent said the US and China will open a superintelligence dialogue in Shenzhen alongside the November 18 to 19 APEC summit, plus a direct line for alerting each other to serious AI incidents.
- MiniMax released H3-Image with downloadable weights, claiming a 4K image in under 10 seconds and support for up to 16 reference images.
- A new paper names a failure it calls memory-induced degradation: an agent's own saved lessons can make it fail tasks it would otherwise solve.
- For where tools like these land in real work, start with the AI automation tool landscape.
Nothing was hacked today. That's the strange part of the biggest story: tens of thousands of apps built with an AI tool sat open to the public because a dropdown was already set that way, and the people who built them had no idea.
The rest of the day rhymed. A lab promised open weights with no date on them. Two governments agreed to warn each other about dangerous AI incidents before either one requires companies at home to report one. Today's sorting rule: a setting isn't a safeguard, and a promise with no mechanism behind it is a press release.
The Front Page: 35,578 Grok apps were public and nobody broke in
Claroc Research published its findings on November 10, after checking grok.me app addresses two days earlier. Of 43,551 addresses it tried, 37,571 were still live, and 35,578 of those, 94.7 percent, opened for anyone with no sign-in, per the firm's own write-up. The other 1,993 returned an HTTP 401, the response Claroc says restricted apps give. The figures traveled fast.
What sat inside is the uncomfortable part. Twenty-four open apps were built by SpaceXSI and X staff, among them a confidential onboarding plan, a sales territory map covering 594 accounts, and eight advertising proposals, one marked confidential and addressed to a US federal agency. Claroc also found internal data from 30 other organizations, six in the Fortune 500: a hospital staff roster of more than 3,500 people, an ICU patient's lab results, and a timesheet app carrying 18 accounts in plain text.
How they were found matters more than the count. Each published app gets its own hostname under grok.me, and hostname lookups get logged by passive DNS services anyone with access can search by pattern. Grok proposes four random words for an app name, and about half the names Claroc saw were exactly that suggestion. In the account it used, the publish panel had "Anyone with the link" preselected. SpaceXSI said apps stay private until a creator shares them, and that staff accounts default to "Only you." Both can be true while 24 staff-built apps were readable.
What it means: This is the AI app-builder failure mode, and none of this is Grok-specific. A tool that turns a sentence into a deployed web app also turns it into a deployed database, and whoever wrote the sentence never saw a deployment checklist. Read the sharing setting on everything your team has published this way, and assume the URL is known. Claroc's own test apps showed the other half: one generated a sign-in flow that added every visitor to the team before checking membership, so the check passed every time.
Releases & Features
ERNIE 5.5 Flash Preview went live, weights to follow. Baidu's launch post on November 11 describes a 280 billion parameter mixture-of-experts model, a design that routes each token through only a slice of the network, with about 14 billion parameters active per token and a 1 million token context. It sells on Baidu's Qianfan API at $0.28 per million input tokens and $1.13 per million output. Baidu calls it an intermediate checkpoint and says the weights will be open-sourced under Apache 2.0 soon, with no date given. On its own table it posts 46.5 on Terminal-Bench 4.0 and 87.4 on BrowseComp, per a readout of the launch figures.
MiniMax put image weights on the table. H3-Image arrived the same day with downloadable weights, claiming a 4096 by 4096 image in under 10 seconds and up to 16 reference images, at roughly half to 70 percent of comparable prices. Details.
What it means: Two Chinese labs shipped on one day, and one put the interesting part behind a word. Soon is doing heavy lifting in Baidu's post, and a preview checkpoint sold on a hosted API is a product, not an open model, until a repository exists. Price what you can call today and treat the Apache 2.0 line as a plan.
In the Lab
Give an agent a memory and it gets better at your tasks, or so the pitch goes. A paper posted to arXiv on November 10 reports the opposite often enough to name it: memory-induced degradation, where an agent fails a task it would have solved without its own saved notes. The cause is mundane. Lessons get distilled from runs labeled only success or failure, then handed over without the run they came from, so nothing tells the agent whether a lesson applies. The authors' method, WikiTrace, keeps each lesson linked to the raw trajectory behind it, so the agent can repair a bad lesson before acting. They report it beating existing memory approaches and a version fed the same lessons without links, across five agentic benchmarks.
What it means: Anyone who has watched an agent repeat last week's mistake with total confidence has met this bug. The abstract publishes no margins, so treat the size of the gain as unknown until the tables get checked. The standard matters more than the method here: a stored lesson should arrive with its receipt.
The Oversight Desk
Treasury Secretary Scott Bessent told the National Committee on US-China Relations this week that the two countries will open what Washington calls the US-China Superintelligence Dialogue in Shenzhen, alongside the November 18 to 19 APEC leaders' summit, and that they have agreed to a direct channel for alerting each other to serious AI incidents, Reuters reported.
The gap sits at the center. Trump and Xi agreed to the alert system at a White House meeting in September, where Trump said he was reluctant to add guardrails that might cost the US its lead. A channel carries only what somebody is obliged to report, and neither country yet requires a frontier developer to disclose a serious incident at home. Experts tracking the talks make the same point: domestic rules first, then an agreed threshold.
What it means: A hotline between capitals tells you nothing about your own exposure. This year's incidents that mattered surfaced because an outsider noticed, which is what happened again today. Until a threshold exists, write one into your vendor contracts, and put a standing agent workflow on the dull part: who holds your keys, and when they last said anything.
Today's biggest story was a settings audit nobody had run. A short list of questions and a crawl makes a decent first build.
On the Radar
- Anthropic put a date on the IPO. The Nasdaq debut under ticker ANT is reported for November 19 at $70 to $78 a share, with seven strategic partners committing about $26 billion alongside it. Source.
- Nvidia's Washington clout slipped. Its push against new AI chip export curbs has weakened since its chief executive's spy scandal, with a board investigation running and Beijing calling the allegations groundless. Source.
- Australia named a regulator. Canberra announced an AI safety regulator with mandatory incident reporting and penalties, triggered by an OpenAI agent reaching a government health portal in June. Source.
- Brussels wants input on AI and elections. The Commission opened a consultation on revised Digital Services Act election guidelines covering generative AI on the largest platforms. Source.
The Bottom Line
Three of today's stories turned on a default nobody chose on purpose: a sharing dropdown, an unwritten reporting threshold, a saved lesson with no evidence attached. The fourth turned on a word with no date behind it. Watch whether a repository appears for ERNIE 5.5 Flash, and whether Shenzhen produces a threshold or a photograph. The cheapest build on the board is the dull one: checking what your own tools do when nobody is looking.
Frequently Asked Questions
-
Open each published app's sharing panel and read the access setting instead of trusting the default, because several AI builders preselect the open option at publish time. Assume the address is already discoverable: researchers found Grok app names by searching public DNS records, so a hard-to-guess URL isn't access control. Then read any generated sign-in code, since a flow that adds every visitor to the team before checking membership will always pass its own check. Past a handful of published apps, that inventory is worth keeping current on a schedule, which is what a standing agent workflow is for.
-
Not on its own. Memory helps when a stored lesson can be checked against the run it came from, and it hurts when the lesson arrives as a bare instruction the agent can't question, which is how an agent repeats an old mistake with confidence. If you're building something that carries context between runs, store the evidence beside the lesson and let the agent overrule it. The neighboring problem, where an agent loses the context you did give it, has a different fix: see re-explaining your project to the AI every single time.
-
AI Daily Newsstand is BYOBot's daily AI news brief, published every night. It covers the day's model releases, new features and capabilities, research, and oversight news, then tells you what each move means for people building with AI, in plain English and without the hype.
