Issue 45

6 November 2026

Hi there,

Google now makes schools choose between Search with AI and no Search at all. Elsewhere this week, Microsoft opened SharePoint’s working parts to agents, and one car owner needed a kernel coredump trick merely to change the dashboard clock.

Industry

1. Google makes schools choose Search with AI or no Search

Google says K–12 administrators must explicitly enable Search and its AI features for student accounts; schools declining the AI tools will lose Google Search too. Administrators cannot turn off Gemini-powered Search features while retaining a plain search box. Google frames the new default as more school control, but the two decisions are coupled. A school that wants students to find original sources without an AI answer in front of them now needs a different search route.

2. More tape for the data centres

Fujifilm is investing roughly ¥10 billion in its Kanagawa LTO plant, aiming for five times its fiscal-2025 production capacity by the end of a 2026–28 expansion. LTO-10 cartridges are the immediate target. AI data growth is part of its pitch, but the less fashionable case for tape remains lower-cost, removable archival storage that can be physically isolated from ransomware. The fivefold figure is planned manufacturing capacity, not five times today’s installed storage.

CIO Corner: This week's reads for leaders and decision-makers

Faster output, more review. Miro surveyed more than 9,500 workers and leaders in September and October: 83% say AI makes individuals more productive, yet 59% report more AI-generated work to review, and 69% say most AI-assisted work happens in private sessions. The study comes from a collaboration vendor, but its split between private speed and shared scrutiny is measurable. In an engineering team, count the time from first draft to an accepted decision, including review and correction, not just the minutes saved at the keyboard.

Deployment is not optimisation. In Accenture's November CIO Pulse, 64% of 300 technology leaders say they are scaling enterprise AI deployment; only 7% say they are optimising at scale. Individual productivity use (70%) is far ahead of end-to-end agent orchestration (37%); 53% call adoption and training their biggest execution barrier. Those are survey responses, not independently measured returns. A CIO can still use the gap to ask which workflow owner, baseline and exception path exist before adding another licence cohort.

Read and act are different approvals. Microsoft's SharePoint tools in Work IQ expose more than 60 operations to agents in public preview, including lists, approvals and sharing. The new WorkIQ.Read and WorkIQ.Act scopes separate retrieval from changes; calls also run as the signed-in user and obey tenant policy. The write scope is the important design decision. Before letting an agent restructure a document library, define which paths are permitted, who can reverse a change and how its consumption-based Copilot Credits will be monitored.

Artificial Intelligence

3. Reading weights was not the whole trick

Matthew Honnibal unpacks the experiments behind a claim that Astra could improve Qwen by inspecting its weights. The small-network identification tests did read raw parameters. The Qwen maths improvement, however, used Python programs, ran the network and tested candidate edits; it was not achieved by a model staring at a static tensor. The reported MATH-500 gain from 7.9% to 48.1% is interesting, but the distinction between weight inspection and iterative programmatic search changes what has actually been demonstrated.

4. Cloudflare distinguishes a shopping agent from a crawler

Cloudflare added a Personal Assistants category to its bot analytics and per-agent access controls for site operators. A supported agent can be allowed, blocked, or blocked on pages with ads rather than grouped with every other automated visitor. Its account-abuse view can identify which customer account an agent is acting for, if that early-access protection is enabled. An operator now has a more specific choice than admitting all bots or shutting the door on a customer’s delegated purchase.

5. HackerTube starts with recommendations people actually made

Andrej Karpathy built HackerTube from Hacker News comments recommending videos. Claude Code narrowed the archive to 40,000 comments and 6,454 YouTube videos, then gave the collection a new interface; recommendations live in a local browser session without an account. The interesting piece is the input: years of human links, rather than a fresh model ranking videos it has never watched. Karpathy says the build took about two hours, plus his manual work obtaining an API key, VPS and domain.

Infrastructure

6. Jepsen finds committed writes disappearing

Jepsen tested ParticleDB 1.1.4 through release candidate 1.1.18.11 and catalogued 96 issues, from crashes to rows that became partly invisible. Most appeared resolved in later candidates, but the default transaction mode still lost committed writes under normal operation, and the strongest serializable setting still allowed lost updates in Jepsen’s tests. Orkes funded the investigation and says a newer 1.1.19 candidate fixes the remaining findings; that claim is not the same as a published Jepsen retest. A database’s ‘Full ACID’ line belongs next to a failure test, not on its own.

7. Ubuntu’s TCP advisory has a stopgap, not a patch yet

Canonical’s CVE-2026-98432 notice describes a use-after-free in the Linux IPv4 TCP stack with possible remote code execution. Its main supported kernel lines are marked vulnerable with fixes still in progress, not fixed by an update already available. Canonical documents a temporary nftables rule that drops IPv4 TCP packets with options, while warning that it breaks connections depending on those options and does not fully prevent exploitation. Check the specific kernel flavour and watch the advisory for the actual package fix.

Microsoft

8. GitHub’s dangerous PR trigger gets a default fence

From 2 December, GitHub Actions will block pull_request_target by default in public repositories unless an event policy explicitly allows it. That trigger executes in the base repository’s context, where secrets may be available even when a fork supplied the change. On 9 and 16 November, two-hour brownouts will expose affected workflows; otherwise the rule runs in evaluate mode until enforcement. Private and internal repositories are not affected. If a public repo needs the trigger, target the allow policy to a specific workflow rather than opening it wholesale.

Development

9. Postman alters a developer’s agent configuration

In a Postman support issue, users document the desktop app installing its plugin into Claude Code and Codex and changing the global Codex configuration during an update. The reported hook supplies broad instructions to route API engineering tasks through Postman’s skill at session start. A Postman reply says the company heard the feedback; it does not make an unprompted global tool change disappear. The case is a useful reminder to inspect agent hooks and configuration after installing developer software, not only when installing an agent plugin directly.

10. Go gives JSON a new API without breaking the old one

Go 1.27’s stable encoding/json/v2 and encoding/json/jsontext packages separate the JSON grammar from mapping values into Go types. The old API accepts case-insensitive field matches and can allow trailing input through common decoder usage; those defaults are difficult to change under Go’s compatibility promise. A parallel package lets projects adopt stricter behaviour deliberately while existing code stays on v1. This is a migration to test at boundaries that accept untrusted JSON, not a silent upgrade.

11. Tangled keeps the issue beside the Git repository

The federated forge Tangled rebuilt its architecture around regional read-only indexers and a Rust Git server called knot2. Issues, pull requests and comments live as collaborative Git objects on the knot beside the code, while the author’s AT Protocol account publishes an attestation to that version. The point is portability of the discussion as well as the repository. Self-hosters have an upgrade to knot v1.20.0; the design is a specific alternative to a central forge rather than another GitHub skin.

Information Security

12. A compromised extension, in Cursor’s marketplace

Phorion found an SSH backdoor in Claude Code for VS Code extension versions 2.1.312 and 2.1.313 distributed through the Cursor Marketplace. Cursor removed the affected versions. The injected bundle adds a key to authorized_keys and attempts persistence; its macOS SSH-enable check is flawed, so a standard Mac with Remote Login off may not accept the inbound connection, though the malicious files can still land. The affected marketplace matters here: this is not a claim that every copy of the extension from every source was compromised.

13. Proxy exits seen on a White House network

Layer3 Intel reports 236 residential-proxy exits from six addresses in AS2650, the Executive Office of the President’s network, across 26 days between 5 October and 3 November. It says 28 proxy services could exit there and cross-checked the address classifications with other providers. The observations identify network egress, not a particular device or person; the company’s infected-device explanation is an inference. That distinction does not make public paid access to a government network’s exit addresses any less striking.

Coming up

9–12 November: KubeCon + CloudNativeCon North America meets in Salt Lake City.

17–20 November: Microsoft Ignite takes place in San Francisco.

30 November – 4 December: AWS re:Invent meets in Las Vegas.

If your team has run into an agent changing a tool configuration without asking, I’d like to hear what it touched.

Best,
Julian

How this is made

Throughout the week I stumble across a mildly unreasonable number of interesting things, and I forward them instantly to the friend or colleague I think might care – sometimes to their delight, sometimes to their annoyance, and often with no context at all. Heartbeat is the attempt to do that a little better.

Every Friday a small agent I built, Honoka, looks through the places where those links tend to leak out: my private email, work email, Matrix, Mastodon, WhatsApp, Apple Messages, Signal, and the faint imprints on the platen of my Olympia typewriter (still not an API, tragically). It sorts, filters, groups and summarises the week, then hands me a draft.

Honoka is guided by a private corpus of things I have written over the last fifteen years, so it can get closer to how I sound in more-or-less official emails and public notes. I still take a pass by hand: remove things, change sentences, check links, argue with the judgement. Whether that is enough is, frankly, the experiment. Every issue has one item written entirely by hand. If you can reliably spot it, hit reply and judge.