Jensen Huang Resigns

Jensen Huang Resigns

Nvidia's board announced that Jensen Huang has resigned as president, CEO and director, effective immediately, ending a 33-year run. CFO Colette Kress becomes interim CEO while keeping the finance job, the board will weigh internal and external candidates, and Harvey C. Jones, a director since 1993, becomes the company's first-ever board chair. Huang gets a paragraph of thanks, no new title, and the November 17 earnings date stands (more: https://nvidianews.nvidia.com/news/nvidia-announces-ceo-transition).

The week behind the release was anything but routine. Huang apologized on Sunday for being "unfaithful to my wife" over a relationship with Alice Huang, who worked for Megaspeed, a Singapore-based Nvidia customer. CNBC reports that the U.S. intelligence community believes she is a Chinese spy; that is a report of what officials believe, not a public finding, and no charges are described. The New York Times then reported a second affair with Kimberly Powell, Nvidia's VP of health care. A Commerce Department probe into Megaspeed has moved to the Justice Department. Whether the board forced the exit is contested in CNBC's own copy, which alternates between "resignation" and "ouster"; Elon Musk and investor Gavin Baker argued the board should have waited for the investigation to finish (more: https://www.cnbc.com/2026/11/12/nvidia-jensen-huang-ceo-live-updates.html).

Markets priced the loss of a founder. Shares fell more than 13% at the open, pushing market cap below $4 trillion, and the stock has shed roughly $2 trillion since its October 6 close, a sixth straight weekly decline. AMD is up about 17% since Monday, though Futurum's Daniel Newman put the ceiling on that trade: "If everyone turned tomorrow and went to AMD, AMD couldn't supply." Nvidia carries roughly $400 billion in ecosystem commitments, is committed to buying $10 billion of Anthropic stock after the November 19 IPO, and faces a DOJ probe of its pending Hugging Face acquisition. An interim CEO who is also the CFO is well placed to honor those commitments and poorly placed to make new ones.

The product machine shipped anyway. Alpamayo 2 Edge, an end-to-end driving model trained in a reinforcement learning loop on six cameras plus recent motion, landed the same day, and an Embedl engineer posted a build claimed to run more than 10x faster than PyTorch on AGX Thor. LocalLLaMA answered with jokes about insurance adjusters, the right register for a speed claim with no safety numbers attached (more: https://old.reddit.com/r/LocalLLaMA/comments/1xtmeif/open_source_self_driving_is_here/).

Incident Response at Machine Speed

Eye Security's write-up of a multi-day engagement against an ARTEX-driven intrusion is the first detailed defender-side telemetry on this class of attack. The victim, an unnamed gift-card and payments company, was breached through a vulnerable custom PHP upload function that yielded a webshell, environment variables and API keys. From there the clock runs in minutes: stolen-key API calls, bulk scraping, a spoofed client-IP header about three minutes after rate limiting kicked in, a peak above 9,000 requests in a single minute, and when that route closed, a pivot to a pool of more than 17,000 residential proxy addresses. The agents pulled Neo-reGeorg from GitHub and modified it within minutes to persist tunnel state in the internal cache so it survived load-balanced pods, then stole an engineer's Git identity, altered the repo so GitOps automation deployed an attacker pod to Kubernetes, added backdoor admins, and exfiltrated immediately (more: https://labs.eye.security/how-we-defended-against-an-ai-driven-attack).

Two details should rewrite playbooks. First, re-compromise. After a lull that Eye suspects, without proof, came from the attacker running out of tokens, the customer went live and was back under attacker control within an hour, because Git access survived and the deployment tooling re-created deleted workloads "within a second". Second, the WAF whitelist. One Cloudflare zone blocked everything on the internal tools except traffic bearing a payment provider's user agent so webhooks could arrive; the agents' blocked requests came back three minutes later wearing that user agent and were replayed thousands of times. A user agent string is not an identity. Eye's own defense ran LLM agents with read-only access through a private Git repo with pull-request handoffs, and the post is candid that a guessed "probably guest Wi-Fi" label propagated into five documents before anyone caught it. Containment, in their words, "is now about finding all ways in."

Arctic Wolf's alert on AntiFox, an open-source Chinese-language agentic pentesting platform, fills in the cloud half. Alibaba Cloud hosts serving the AntiFox console were tied to intrusions that chained an IIS web shell, .NET config parsing for connection strings, and then valid AWS identities firing hundreds of cross-service calls in about half an hour against IAM, S3, Lambda, Secrets Manager, KMS and Bedrock with a Boto3 user agent. Most calls were denied; the ones that were not progressed from ListSecrets to GetSecretValue on a production secret. The hunting guidance is the keeper: do not assume a sequence failed because most of it was denied, and treat one IP cycling multiple access keys as credential-set testing (more: https://github.com/rtkwlf/wolf-tools/tree/main/pack_alerts/202611-antifox-alibaba-hosted-platforms-facilitate-web-cloud-intrusions).

ThreatBook, which Feng Xue says built both Artex and CyberStrikeAI, published two feeds of internet-exposed instances running those agents; a reply warned against treating them as definitive blacklists, since behavior matters more than IPs (more: https://x.com/s0what/status/2117595828114407713?s=46). Gadi Evron's appeal, "Industry, please hear us," asserts that ARTEX and Cairn are breaching many organizations right now, coordinated to within milliseconds across multiple entry points with no slow lateral movement. That matches Eye's telemetry but is otherwise his word, and the best reply in his thread notes that millisecond coordination is a claim about your telemetry before it is a claim about an attacker (more: https://www.linkedin.com/posts/gadievron_industry-please-hear-us-autonomous-attacks-share-7526496656914259968-I3PD). Casey Ellis adds the deflationary corollary: some of the IR load is bug hunters pointing ARTEX at out-of-scope targets, and every such run hands programs a reason to ban AI testing for everyone (more: https://x.com/caseyjohnellis/status/2120695223252836748?s=20).

SignDrop and a Four-Digit Patch Tuesday

Microsoft shipped the CLFS authentication mitigation in October 2025 to close off a long-running class of kernel memory corruption in the Common Log File System, and public CLFS exploitation dropped sharply afterward. A researcher posting as MSNightmare now claims the mitigation itself contains a logic flaw, dubbed SignDrop, that lets a standard user obtain SYSTEM by getting a privileged process to finish creating a log's authentication file on their behalf; the access checks are correct, but the sequence of who creates what allows abuse. The author reports tests on Windows 11 26H2 and Windows Server 2025, estimates that around 80% of Windows installs are affected because any machine whose CLFS driver is in learn mode or enforcement mode qualifies, and gives a registry check: a CLFS Authentication Mode value of 0 or 1 means exposed, 2 or 3 means not. There is no fix short of a Microsoft patch, since disabling the mitigation reopens the surface it was built to close. The larger claim, that the same primitive can trigger file creation inside any antimalware engine's own process and so defeat AV and EDR tamper protection, is asserted with a screenshot and awaits independent confirmation (more: https://github.com/MSNightmare/SignDrop).

Geek Guy's SOC threat hunting report, a synthesis of Trellix, CrowdStrike, Microsoft and CISA material rather than original research, puts November's Patch Tuesday at 1,093 CVEs with 63 critical, the second straight month above a thousand, and one zero-day: CVE-2026-124194, an Outlook spoofing bug that leaks NTLMv2 hashes when a crafted .msg file is opened, added to CISA KEV on November 10. The report credits discovery to a security researcher using Claude, which if accurate puts AI-assisted bug finding on the defender's ledger too. Two unauthenticated domain controller RCEs and an email-triggered Windows Search RCE round out the must-patch list. The macro figures are relayed, not verified: 88% of CrowdStrike-observed exploitation of public-PoC bugs within 48 hours, 124 active ransomware groups with 55 new in six months, U.S. share of victims down from 54% to 41%, and China-linked actors using ARTEX against 200-plus organizations in 14-plus countries. The line that ties back to Eye's incident is the recommendation that AI agents get short-lived tokens, because they "routinely move secrets from encrypted stores" to command lines, local files and model context windows (more: https://www.geek-guy.com/soc-threat-hunting-report-november-2026).

Verify the Verifier

Knostic's analysis of an AI agent skill called doomsday-escrow is a clean case study in a verifier certifying its own claims. Added to two public skill catalogs on October 23, the skill tells coding agents to confirm a GitHub bounty is escrowed before spending tokens on it; rewards pay in the project's own DOOM token on its own chain. The original package was a single instruction file directing the agent to download and run a remote bounty.py that talks to the project's backend. The default command prints the backend's list under the heading "VERIFIED ON-CHAIN GITHUB BOUNTY BOARD" with no checks of its own; the verify command reads one field in one reply and "checks no signature, transaction or block." Recovered backend source shows the verify function consulting its own escrow list and a shared vault balance on its own chain before returning a verified label. All ten open escrows share one transaction ID. A sponsor-funding command transmits a wallet private key to the backend, which elsewhere refuses another endpoint with the message "Private keys must never be transmitted over HTTP." Knostic did not run the code, contact the operator, or establish any loss, and a revised skill a day later dropped the download-and-execute step. The rule generalizes past crypto: when the issuer of a bounty runs the verifier, "verified" is a claim (more: https://www.knostic.ai/blog/doomsday-escrow-when-a-bounty-verifier-certifies-its-own-claims).

The same test applies to scanners that promise verdicts. cvENGINE, a GPL-3 fork of reNgine, bills itself as "the most advanced external attack surface assessment you can get for free": bbot and Nuclei discovery and probing, CVE correlation against CISA KEV, EPSS and Exploit-DB, and an AI triage pass that rates each CVE "fire, smoke, or ice," all in one Docker Compose stack with an MCP server and bring-your-own model. Two points in its favor: the pipeline runs without any model, and "proof" means read-only checks with the exact command recorded, not exploitation. Everything else is README self-description (more: https://github.com/hevnsnt/CVEngine). PandaWard, an alpha-stage Go appsec scanner that doubles as a Claude Code plugin, goes further on disclosure than most: a ledger of every control checked and every control it could not decide, a human-approved scope file for any network test ("An AI agent cannot approve it"), and an admission that all adapters are "implemented_unvalidated" and its built-in rules score 0.00 on the OWASP Java benchmark because they lack data flow. That posture suits a tool that checks MCP tool descriptions for injected instructions (more: https://github.com/ratomirjovanovic/pandaward).

The pipelines these tools run in got easier to pin. GitHub Actions now supports lockfiles, so workflows can reference readable tags while a machine-generated actions.lock holds the resolved SHA, replacing the old advice to hash-pin by hand. Hugo van Kemenade's walkthrough adds a CI job that fails when the lockfile drifts, and notes that zizmor 1.32.0 is the first release of the Actions linter to understand lockfiles (more: https://hugovk.dev/blog/2026/lock-github-actions/).

Editing Weights, Shrinking Classifiers

Reuven Cohen's "weight-space programming" post is tooling for a debate that has run for weeks: can a network be fixed by editing numbers directly rather than retraining? His ruv-fann-wsp package wraps the loop as inspect, propose, evaluate, decide: fingerprint the checkpoint, apply a candidate patch, compare against the original under a policy that bounds regression, then promote or roll back explicitly. Version 0.2.0 adds layer tracing, neuron ablation and finite-difference weight sensitivity, which Cohen calls "a local numerical diagnostic, not a guarantee of a useful edit." The only demonstration is an XOR network with two zeroed output weights, repaired by setting them to one, error from 0.5 to 0 across all four cases. The package "is not an editor for arbitrary large language model checkpoints," and Cohen names the real failure mode himself: "Repeatedly choosing edits against the same test set turns it into tuning data." That is the critique his earlier evolutionary loops drew, and it compounds here (more: https://www.linkedin.com/pulse/introduction-weight-space-programming-edit-test-improve-ruv-cohen-qygyc).

The companion question, whether an LLM can read raw weights and understand them, gets a careful negative in arXiv 2611.08070. LLMs do well at the edges of a network, estimating optimizer step counts and output correlations, but do not trace computation between layers; they lean on memorized dataset templates like CIFAR-10 and framework defaults. Change the expectations and the model identifies the math but guesses the semantics wrong, recognizing that a satellite feature maps to output 4 and calling it a "frog" because it expects an animal. One commenter reports an Opus 5.5 weight edit producing an accuracy uptick; the paper says such wins should be checked for whether they were reasoned or recalled (more: https://old.reddit.com/r/learnmachinelearning/comments/1xr4g4a/can_an_llm_actually_reason_and_program_about/).

Amazon's Strands team supplies the pragmatic counterpoint: for closed-choice tasks, skip the language model. Two engineers on one of Amazon's largest internal ticketing systems replaced Claude Sonnet 4.6, which sorted tickets into 20 categories, with Strands Decider, a decision model that returns a probability per option plus a confidence. The E4B variant on a single A10G SageMaker instance answers in about 640 ms and lands near $500 per million tickets in practice against Sonnet's $3 per million input and $15 per million output tokens, a 98% reduction with Lambda duration down 74%. Decider reportedly beat production Sonnet on a held-out set, though no accuracy figures are published. Two lessons travel: JSON key order moved output probabilities by up to 0.19, so sort keys before comparing runs, and a three-way AppConfig switch (Sonnet only, both in shadow, Decider only) made rollback a 45-second change. The post is honest about the boundary: if labels need explanation text or context exceeds a 4,096-token window, a decision model cannot do the job (more: https://strandsagents.com/blog/amazon-saves-millions-replacing-sonnet-with-strands-decider/).

Qwen 4 Arrives in Preview Only

Alibaba posted "Qwen4 is coming" on November 11 and listed qwen4-max-preview on its Token Plan subscription, with early access through QwenWork, Qoder, the Qwen app and QwenStudio. Yotta Labs, an inference gateway vendor with an obvious interest, has assembled the confirmed-versus-rumored ledger. Confirmed, per Alibaba docs as relayed: 1M-token context, text, image and video input, thinking on by default, preview through November 25, no pay-as-you-go price, no benchmarks, no open weights. Qwen lead Liu Dayiheng named four tiers in September, Max, Plus, Flash and a 27B open-weights model; only Max has shipped, as a preview. The architecture clue is Qwen 3.8-Flash-Next, whose model card called it "an experimental preview of the architecture that will underpin Qwen4": sparse MoE, 125B total and 6B active, plus a 51B n-gram embedding component. Everything else, from the anonymous "Kalmia" model on Arena to vLLM pull requests adding qwen4 ops, is inference, and the post labels its own November 25 release guess as a guess. The biggest model staying closed while a 27B sibling goes open is the pattern Qwen3-Max set (more: https://www.yottalabs.ai/post/qwen-4-release-date-what-is-known-how-to-prepare-2026).

Tencent picked the same week to publish Qwen3.8-27B-DSpine-b16, a speculative decoding draft built on its DSpine method ("Draft in Parallel, Condition Through Depth") with a headline of 3x faster decoding for 27B models. The LocalLLaMA replication record splits instructively. One engine author on a 5090 at roughly Q5 reports 800 tokens per second against 420 for DFlash2 on no-think coding, but 280 against 320 on reasoning because DSpine's first tokens are less certain. Another tester in llama.cpp found no scenario where DSpine beat DFlash2 and noted it needs more memory. Gains are engine- and workload-specific, and a vendor's 3x is a best case (more: https://old.reddit.com/r/LocalLLaMA/comments/1xr2aaa/tencentqwen3827bdspineb16_hugging_face/). Elsewhere on Hugging Face, huihui-ai posted an abliterated GGUF of the older DeepSeek V4 Flash 0731 release with a card that says nothing about what refusal removal cost in capability (more: https://huggingface.co/huihui-ai/Huihui-DeepSeek-V4-Flash-0731-abliterated-GGUF), and Unsloth shipped GGUF quantizations of Qwen-Image 2.1 for local image generation (more: https://huggingface.co/unsloth/Qwen-Image-2.1-GGUF).

Open Weights for Video, Voice, and the Mac Under Your Desk

Pika Labs released Pika H3 Flex, and the fine print matters more than the name. It is not a new foundation model; the README calls it "a post-trained H3 model" that "builds on MiniMax-H3," shipped as two LoRA-style adapters, FL2VA for text and first/last-frame conditioned video with audio and Ref2VA for multimodal references. The pitch is a bespoke six-step sampling schedule, with the warning that "Generic six-step Euler sampling is not equivalent." Claimed specs: 480p or 768p across 11 aspect ratios, 24 fps, 32 kHz stereo, 5 to 15 second clips. The catches: no parameter counts, no quantitative benchmarks, showcase videos disclaimed as "not release-validation renders," testing on a single H100 80GB only, and a download near 210 GB of MiniMax-H3 base files plus 5.5 GB of adapters. Upscaling and audio stems stay hosted-only behind the paid API, and the adapters inherit the MiniMax H3 Community License. Open-weight in the sense that you can download a quarter terabyte (more: https://github.com/Pika-Labs/Pika-H3-Flex).

Voice cloning is further along. A sci-fi writer's accent torture test, running voices from Rebecca Ferguson to Javier Bardem through Moss-TTS, Breeze-TTS, Chatterbox, VibeVoice, Fish Audio S2 Pro and OmniVoice, found only OmniVoice passed every accent, even adding a tongue trill absent from a 5-second sample, while generating fastest by a wide margin and holding up best on multi-paragraph one-shots. The thread's corrections matter: OmniVoice is sensitive to sample quality and weaker on emotional range than Breeze or Moss, and the licensing is a problem, since the k2-fsa library is Apache-2.0 but the training voices and parts of the model are CC-BY-NC, which rules out commercial use (more: https://old.reddit.com/r/LocalLLaMA/comments/1xs46nh/omni_voice_is_the_fastest_and_best_voice_clone/).

Marketing copy surfaced for an Apple app called Harbor that turns a Mac into a private inference server for open-weight models and auto-discovers other Thunderbolt 5 Macs to pool their unified memory into one cluster, no command line required. The copy says it is in private preview under the Claris brand; by the time the post circulated, a reply noted Apple had pulled Harbor from the App Store. Multi-Mac Thunderbolt clusters have been a hobbyist project for months; a first-party product would make the unified-memory advantage official, if it ships (more: https://x.com/aaronp613/status/2120229190477992162?s=46).