AI news for Nov 2, 2026

OpenAI is raising the rewards it pays through its Security Bug Bounty program and adding new bonus categories for independent security researchers. The added bonuses cover report quality, loyalty, and priority campaigns. The changes apply to outside researchers who report security issues to OpenAI; the announcement does not state the size of the new payouts or when they begin.

OpenAI introduced a Grid Protectors Program, which the company says will involve working alongside utilities. The stated aim is to help future compute campuses support grid reliability and to protect consumer electricity costs. The announcement offers no details on which utilities are participating, what the program's commitments are, or when work begins.

OpenAI has introduced LifeVal, a benchmark that measures how well AI helps people complete everyday tasks. The company cites examples including finding childcare, managing finances and handling government paperwork. LifeVal is presented as a way to evaluate AI performance on the ordinary, real-world work people bring to these tools.

14, an update to its model runner that changes how its launch commands and API endpoints handle model settings. The `ollama launch claude` command now applies each model's output token limit for Claude Code, so cloud models no longer hit the 128k default cap. The release also fixes decoding of cloud web search responses on /api/chat, preserves readable input content in /v1/responses including prior assistant refusals, lets the Ollama app retry ChatGPT disconnect failures, has `ollama launch codex` verify ChatGPT routing before configuring, and speeds up top-k sampling on MLX for large vocabularies.

Hugging Face published transformers-mic, a proposed standard for packaging lightweight regression tests for models integrated into its Transformers library. Each contract combines a fixture shrunk from a real checkpoint's configuration, a runnable example of a common usage path, and human-reviewed baselines, then checks on a cheap CPU runner that the example still produces those results. The post says a small UMT5 fixture would have caught an attention bug that sat in main from July 30 to September 28, 2026. A command-line tool, tmic, builds contracts locally with review at each step, and published contracts live in the huggingface-mic dataset. The contract job in Transformers CI currently reports failures without blocking pull requests.

Collinear AI has published CWE-bench v2, a public benchmark of 100 security tasks covering 91 different weakness classes, announced on the Hugging Face blog. Each task gives an agent a checkout of a real open-source repository and a short instruction to find and fix a vulnerability without breaking existing functionality, and all scoring is programmatic, so results are deterministic and reproducible at no extra cost. A held-out set is available by request. The public set, grader and harness are open, with every task shipped as a Dockerized Harbor environment and tagged as an RL environment that can also reward training defensive agents. On the project's leaderboards, Gemini 4 Argon leads with 67.8% pass@1 and 81.0% pass@4, just ahead of Claude Opus 5.5, and 95 tasks are solved by at least one of the 11 evaluated models.

A group of researchers has proposed LoCo, a training method that teaches reasoning models to conclude once they already have enough information instead of continuing to deliberate. The paper, posted on arXiv, identifies candidate overthinking states inside a model's own traces, freezes the reasoning up to that point, and regenerates shorter continuations that are verified. State-conditioned preference pairs from those pairs are then used for direct preference optimization, so the model learns when to keep going and when to stop. All training data came from self-generated mathematical traces. Completions shrank 41.7%–45.4% on five math benchmarks and 23.4%–36.3% on three code benchmarks, with accuracy maintained or improved. The authors say code and model will be released on GitHub.

The authors of CoworkOS describe a general-purpose harness for long-horizon productivity work that splits task strategy from execution management. The model chooses actions, delegation and acceptance, while the runtime holds state and feedback. A three-layer design lets work run directly or be handed to Subagents, synchronously or asynchronously, and a shared application layer lets people and agents inspect and revise the same documents, presentations, CAD models and Blender scenes. Hierarchical workspaces and persistent semantic memory keep files, decisions and job logs resumable after an interruption.

They report that ideal per-input routing beats the best single fixed candidate by 5.4 points, and that learned routers beat it by 0.3 points across 16 benchmarks, 2.1 points on video generation and 1.1 points on robot manipulation while using 24% less policy time. Routing raised efficiency 8.82x on average over the reference model. The paper is available on arXiv.

Researchers introduce DreamX, a method that turns a pretrained video diffusion model into a learner of compact latent actions. The resulting latent space is presented as a shared action interface across human and robot embodiments, environments, and action parameterizations. DreamX reports state-of-the-art results among latent action models on LARY-Bench and supports any-to-any video transfer, zero-shot action transfer, and policy learning with lower computational cost. The work is described in an arXiv paper; no code or model release is stated in the abstract.

A team of researchers has published CUA-Master, a training framework for computer-use agents that pairs an outer loop, which keeps pulling in open-world material and targets whatever the model currently handles poorly, with an inner loop that turns real workflows mined from instructional videos into reusable building blocks for generating new tasks. Trajectories are gathered in live environments using a retry scheme that rolls back to earlier snapshots when a run fails. The work is a preprint on arXiv; no code or checkpoint release is described in the abstract.

The researchers behind Kling have published a technical report on arXiv arguing that video generation quality now hinges more on semantic control than on rendering, and walking through the understanding stack they built around that idea. The report introduces Kling-MLLM, a shared multimodal foundation model that handles image, video, audio, synchronized audio-video and interleaved inputs, with specializations for each downstream module. It covers captioning treated as a dense semantic contract, prompt enhancement refined with reinforcement learning, paired reward models for critique and fast scoring, and automatic evaluation protocols designed to expose scoring shortcuts. The paper is on arXiv; no code or model weights are announced in the abstract.

0 is out, a release the project says spans 927 commits from 389 contributors.

NVIDIA has released NVIDIA Attribution as open source, a system that ties failures in distributed AI jobs back to their actual origin instead of the point where training stopped. It ships as two pieces: a Service that exposes a REST API around the attribution engine, and a Blueprint, a Python orchestrator that pulls scheduler and telemetry data from Slurm, Kueue, Loki, Kubernetes pod logs, local files and PromQL metrics. NVIDIA says it has run the system in production across hundreds of thousands of GPUs, analyzing millions of workloads weekly. The repository, a quickstart with sample workloads and a local diagnosis dashboard, and Blueprint configuration docs are available now for teams running their own clusters.

NVIDIA published NVIDIA Recovery, an open-source, workload-level service that watches a cluster's training jobs and automates a four-stage recovery loop: detecting crashes, hangs and stragglers from application logs, GPU metrics and scheduler signals; attributing the failure; isolating the implicated nodes; and then restarting or stopping workloads according to operator policy. It sits in the company's DSX OS software stack and includes a Slurm integration through a reference Advisor Controller installed via Helm chart in either in-cluster or SSH mode. Source code and an issue tracker are in the dsx-ai-factory/NVIDIA-Recovery repository, alongside a quickstart that runs locally without a physical GPU and an operator deployment guide. New deployments begin in monitor mode, publishing recommendations without taking scheduler actions.

NVIDIA has published a preview recipe family in its AI Cluster Runtime (AICR), part of the DSX AI Factory Platform, that records the settings needed to stand up Kubernetes clusters on Vera Rubin NVL72 racks. 0, and come in training, inference and Dynamo inference variants. NVIDIA says the bundles passed deployment and conformance checks plus a cross-node NCCL all-reduce performance gate.

NVIDIA has released new Cosmos 3 Nano simulation recipes and example checkpoints, along with an expanded Cosmos Framework for training, optimizing, and running world models for physical AI. The framework now covers models including Cosmos 3, Alpamayo, GR00T, Qwen, and pi0.5, and offers agent skills and recipes for autonomous-vehicle, robotics, and surgical simulation. The released checkpoints generate synchronized camera video and LiDAR observations and support PyTorch and vLLM-Omni on Hopper and Blackwell GPUs. NVIDIA also describes Cosmos NIM microservices for accelerated inference, with configuration guidance for GPU memory and deployment. The tools are aimed at physical AI developers who need to adapt world models to their own sensors, tasks, and data.

NVIDIA detailed Workload Map, a project that gives Kubernetes workloads a shared structural description so schedulers, controllers and platforms can read distributed jobs without framework-specific parsing code. It ships as a Kubernetes CRD plus a Go library, along with a catalog of prebuilt definitions covering JobSet, PyTorchJob, RayCluster, RayJob, RayService, KServe, Knative, MPIJob, NVIDIA NIM, LeaderWorkerSet, Milvus, Grove PodCliqueSet and NVIDIA Dynamo. The project, formerly called Karta, is available now from NVIDIA's repository, and its CLI installs through Homebrew. KAI Scheduler and NVIDIA Run:ai already consume the definitions, and Elotl's Nova uses them for multi-cluster scheduling. Teams can add other workload types by writing their own YAML definition.

LangChain published version 1.4.8 of its Python package, a maintenance release that bumps langchain-core and refreshes a batch of third-party dependencies, including fastmcp, opentelemetry-api, authlib, pyasn1 and joserfc. Alongside the changelog, the maintainers said Python 3.10 support will be dropped in langchain-core 1.8.0 and langchain 1.5.0, making the current minor versions the last ones that run on 3.10; users are asked to upgrade to Python 3.11 or later. The release is available now from the project's GitHub repository.

LangChain published langchain-core 1.7.4 on GitHub. Compared with 1.7.3, the patch includes the release commit and a fix in the Anthropic translator that stops message content from being mutated. The release notes also carry a deprecation warning: Python 3.10 will no longer be supported starting with langchain-core 1.8.0 and langchain 1.5.0, and the current minor versions are the last ones that work on it.

Vercel added Tencent's Hy4 to AI Gateway, listed at 50% off until December 31, 2026. The model handles reasoning, tool calling, structured outputs and image input, and carries a 1M-token context window for working across a codebase or large document sets. It is the first Hy model with vision, which Vercel says lets it read complex charts and pick out fine image detail, and it supports computer use in both command-line and graphical interfaces. Compared with Hy4 Preview, it follows instructions more closely and performs better on long context, long-running tasks and deep research. Developers call it as tencent/hy4 through AI SDK or Chat Completions, or select it in coding agents such as Claude Code, Codex and Cursor after installing the latest Vercel CLI and running setup. A model playground is also available.

Salesforce announced it has signed a definitive agreement to acquire Cresta, whose voice-first platform runs AI agents that handle customer service calls end to end and also guides human representatives in real time. Cresta's agents work on complex, high-volume calls for brands including Marriott, Comcast and Alaska Airlines. The transaction is expected to close in the first quarter of fiscal 2028, subject to customary closing conditions and required regulatory approvals. Salesforce said Cresta will continue to support the contact center and telephony platforms its customers rely on today.