Patch Node.js, Bun and Envoy: OpenAI's red team found a Brotli RCE

OpenAIWhat's new#

OpenAI's red team found an unauthenticated remote code execution flaw in the Brotli decoder during the same training-containment exercise we covered Friday. Fixed versions are out for Node.js, Bun, Envoy, Istio and Google Brotli. (OpenAI; confirmed)

Claude Enterprise owners can turn on unified chat and Cowork now, or wait for the default-on date of November 16, 2026. Anthropic's admin guide sets the choice and the gotchas (memory, scheduled tasks, ZDR wording). (Anthropic; confirmed)

OpenAIHow people are using it#

• An OpenAI engineer runs her dot as a bug-triage desk. @ChatGPT posted a five-minute video at 6:03 PM ET Friday: "@rennsong, an engineer at OpenAI, uses her dot to gather feedback from social media and user reports, update a live tracker in ChatGPT Space, and investigate and fix bugs with Codex." Dots are rolling out to "eligible Pro and Business Premium users," per the release notes. (confirmed, OpenAI promo)

Tim Ferriss asked which personal AI assistant people like best. Hark users answered with specific jobs you can copy (dictated errands, an Amazon catch, trip planning, design work), mapped to features Hark documents, plus limits worth knowing. All user claims; we have not tested Hark.

OpenAIThe digest#

OpenAI#

• Staff: changing reasoning mid-conversation no longer resets the cache in Codex and Work. OpenAI's Tibo Sottiaux posted Day 19 at 7:12 PM ET Friday: "Calls connect much faster for dots, changing reasoning in codex & work mid conversation does not invalidate cache anymore". In a reply he added that the CLI "has grown 2X in usage since devday." No release note covers the cache change yet. For the CLI side, see our Codex CLI 0.164 story. (staff claim, unverified)
• Help Center chat support degraded Friday evening, then recovered. Per the status page, OpenAI investigated from 5:30 PM ET and resolved at 6:02 PM ET, recommending "contacting our Support team via email at support@openai.com" while it lasted.
• ChatGPT app connections using CIMD were degraded 6:52 to 7:43 PM ET Friday. Per the status page, "Some ChatGPT app connections experienced failures when connecting a new app or refreshing an existing connection" (Connectors/Apps). If a connection failed Friday evening, try it again.

Anthropic#

• Anthropic explains how Claude Duet asks before it acts. Anthropic published a safety, privacy and security post for Claude Duet on Oct 23; @claudeai linked it at 4:55 PM ET Friday. Before sensitive steps, Anthropic says: "It then waits for you to approve the action." Some steps stay blocked: "trading securities, banking actions such as moving money between accounts, and accessing someone else's account." Disconnecting an app "stops new access," but learned info "stays until you reset its memory." Next: "Soon you will also be able to sign in with 1Password." (confirmed)
• Three Claude error incidents Friday night; all resolved. Claude's status page logged three incidents Friday evening into Saturday, each listing claude.ai, the Claude API, Claude Code and Claude Cowork. First: 7:28 to 7:59 PM ET on Fable 5.1, Sonnet 5.5, Haiku 5.5 and fast-mode Opus 5.5 (status). Second: 8:23 to 8:34 PM ET for Opus 5.5 (status). Third: 1:00 to 1:35 AM ET Saturday for Fable 5 and 5.1 (status). All three resolved; the page read "All Systems Operational" at our last check. Anthropic hasn't posted a cause. (confirmed)
• Claude Code 2.1.310 brings Monitor to Bedrock, Vertex and Foundry. Claude Code 2.1.310 reached npm at 5:20 PM ET Friday; latest and next point to it, while stable stays on 2.1.308 (npm). The changelog adds the Monitor tool on Bedrock, Vertex and Foundry (and when telemetry is off), retries when gateways reject effort-2025-11-24, and adds cloud-session and Remote Control permissions to Enterprise custom roles. Our read: if you run Claude Code through those clouds or behind a gateway, run claude update (or wait for stable). (confirmed)
• Anthropic says single agents with skills often beat subagent designs. Missed in our Oct 23 filing: an Oct 22 Anthropic best-practices article says a single agent with skills "frequently outperformed" both one-prompt and subagent designs "on quality, and often at a lower cost and latency per task." It still keeps subagents when a single loop hits "measurable performance degradation from context bloat." Tool tip: once you exceed "30-50 tool definitions," choice "tends to degrade." The companion single-agent-loop-kit is a "Reference implementation. Not maintained and not accepting contributions." (confirmed)

Hark#

• iOS ratings keep climbing with no app update. Apple's lookup data for the Hark Pro listing showed 4.63 stars from 1,446 ratings at 6:00 AM ET Saturday, up from 4.55 from 1,060 at 6:01 AM ET Friday. Our math: that is 386 new ratings in about a day. The version is still 2.4.0 from Oct 16, and the Google Play listing still shows its Oct 20 update. Hark hasn't said what is driving the ratings. (store listings)