O'Reilly Radar 2026 年 11 月趋势：Kimi 3.1 Pro、Gemini 4 与开源权重模型追赶前沿

Coauthored with Claude

Security looms large as we enter November. There’s been a lot of bad news: a certificate authority with woefully inadequate private keys, vulnerabilities have been discovered (and exploited) in PHP and other widely used programs, and several organizations have detected Chinese open weight models misbehaving in several different ways. New models are arriving faster and faster, and the best open-weight models are catching up to frontier model performance. But organizations that would like to achieve AI sovereignty will have to ask some difficult questions about the models they adopt. Is this an inflection point? Whether or not it is, AI has changed security permanently, and things are bound to get worse before they improve.

AI models

We are starting to see models developed with recursive self-improvement; we continue to see clones of Jev; and we’ve seen text watermarks added to output generated by Anthropic’s and OpenAI’s models. (Google has been using text watermarks for some time.) But tools for detecting the watermark are hard to find. Anthropic’s and OpenAI’s are in a very limited beta, and Google’s is only available in their enterprise package. What does a watermark mean if you can’t detect it? And, as we get more accustomed to AI-generated output, will anyone care?

• Kimi 3.1 Pro is a new open weight model with 3T tokens. On benchmarks, it is now the leading open weight model, only slightly behind the latest frontier models. Moonshot AI also released Kimi K3.1 Pro Highspeed, which is two to three times faster.
• Recursive has announced Flint, a 40B parameter mixture-of-experts model that activates 2.5B parameters per token. It was designed for coding, and sized to run on laptops. Flint is open weight; weights are available on Hugging Face, and it works with model runners like Ollama.
• Meta has shipped Muse Spark Open, an open weight model that they claim competes with the best Chinese open weight models. It’s a mixture-of-experts model with 816B parameters and 42B active parameters.
• Meta’s latest models, Muse Wonder and Muse Wonder Full, claim parity with frontier-class models. Specifically, they claim parity with Claude and ChatGPT for financial and legal work. The announcement hints that Meta will be using Muse to develop specialized models.
• OpenAI’s Decisions API is yet another Jev-like model. Like Jev, its input is a data structure that constrains the model’s output to be an answer to specific questions. The output is a data structure that includes a probability for each answer.
• Claude has launched Haiku 5.5, a new version of its least expensive model. It’s faster, less expensive, and has better benchmark scores than its predecessors. Haiku 5.5 is a very capable model, particularly for users who are sensitive to cost.
• Mistral has launched Mistral Large 4, a.k.a Le Chonk. It’s an open weight mixture-of-experts model with 1T parameters. It’s claimed to be the best open model from Europe and was designed with AI sovereignty in mind.
• Aleph Alpha has released an open weight LLM for English and German that was trained entirely under European rules. It is a mixture-of-experts model with 78B parameters. It uses a different tokenizing algorithm to handle long German words without breaking them into fragments. Reasoning takes place mostly in German.
• Crowdflare has released Clef and Clef Flash, new decision models that, like Jev, take typed queries and return typed answers about those queries. It’s also offering a new reinforcement learning service to help customers train Clef for their applications.
• After a long wait, Google has released two new frontier models, Gemini 4 Argon and Carbon. Argon is available to paying customers. Argon’s successor, Carbon, is being released slowly, and is currently only available via the Fairwind program.
• The Ember-1 model from Fireworks claims to have results similar to Kimi K3 at lower costs. It is priced similarly on OpenRouter but uses far fewer reasoning tokens.
• OpenAI has published 722 papers solving problems in mathematics on GitHub. There is some controversy about whether all the proofs are correct; so far, three have been withdrawn, leaving 719.
• Google has opened its SynthID detector to the general public. The detector can determine whether audio, image, or video files generated by any of Google’s partners (including OpenAI, NVIDIA, and Apple) have the SynthID watermark.
• To comply with EU law, OpenAI will add watermarks to text in Europe. The company’s algorithm sounds similar to the one that Google and Anthropic are using: modifying the underlying probability distribution changes word choice in detectable but insignificant ways.

Agents and harnesses

There are more choices than ever for agents, along with new standards for the interaction between agents and models. In addition to general purpose agents, there are also agents specialized for coding, HR, BI, and more. And most agents will connect to many models, including local ones. Choose agents as carefully as you choose models; your agent is where you will do your work.

• JetBrains has released Thinkrail, an agentic IDE that learns about your project as you use it. It is open source and based on the pi agent.
• Anthropic has donated its Agent Skills standard to the Agentic AI Foundation (AAIF), which will shepherd further development. It has also donated Open Responses, a standard for building common interfaces, to AI providers.
• OpenAI has introduced Intelligent UI, a feature that allows ChatGPT to generate its own user interfaces in response to the user’s question.
• Workday is allowing its customers to build their own agents for HR and finance. An agent’s access to Workday data is tied to the user’s account.
• Claude Dashboards is a new product that lets you build live dashboards from a group of data sources.
• Claude’s Google Workspace connectors allow it to read and write Google documents, sheets, and slides directly.
• MCP Events is an extension to the MCP protocol from OpenAI. It allows ChatGPT to subscribe to updates from MCP servers.
• DeepSeek has released a harness (dsh). It’s open source, and currently in public preview. Everything is a plug-in.
• The Pi agent has reached version 1.0.0, and is now capable of using MCP. There’s a variation, Pi Durable, that has been designed for long-running tasks.
• OpenAI dots are consumer-oriented agents that run in the cloud. They are always on and have their own web browser along with other tools.

Software development

At last month’s SciFoo, Hugo Bowne-Anderson said that we’ve been through two major changes in the past few years: from writing code to letting AI write the code, and from reading the code to not reading the code. These changes are as radical as the shift from programming in machine language to programming in high-level languages. We will all go through a process of rethinking how we work and what we’re trying to accomplish.

• Anthropic has introduced Claude Mods, a plug-in for Claude Code that can modify Code’s behavior: reshaping its user interface, providing information about context use, giving advice about what you’re doing, and much more.
• One application for decision models is building evals to understand the performance of AI applications.
• Workday is using Jev to build user interfaces on the fly. Jev’s very low latency makes choosing UI components at runtime viable.
• Anthropic has outgrown Git, which wasn’t able to keep up with merges on their monorepo (roughly 30,000 merges in September). Anthropic has built a new source control system called Scion.
• Kate Huston writes about reverse-engineering code review and trying to develop an effective “gate” that AI-generated code would have to pass before review by humans.
• WordCraft is an open source clean-room re-implementation of Microsoft Word. The authors claim that it’s 60% of the way towards “replacing Word for real work.” It supports MCP, has a command line interface for interacting with agents, and can run in a browser through WASM.
• ArtCraft is an open source tool for creating interactive AI-generated images and video in 2D or 3D. The company describes it as an “IDE for artists.” They’re also developing open source clones of Adobe Creative Suite tools like Photoshop. Early reports are that it’s very buggy.
• Google Docs now supports Markdown natively. Users can read, write, collaborate, and comment on Markdown documents without converting them to another format.
• Google’s Docsy documentation project is moving to the Linux Foundation. Docsy is a template for the Hugo static site generator that’s useful for generating documentation in ways that are helpful to agents.
• Does programming with AI require more abstractions or fewer? Matt Pocock argues for more.
• Anthropic has given Claude an auto-eval tool. While the first version of this tool has many flaws, it’s a significant step towards making evals easier.

Security

Security has been much in the news. Not all of the news is bad: AI was used to discover the PHP2Shell vulnerability and to develop a fix. The leaked CVE and the many out-of-date PHP sites online are serious problems, but not problems attributable to AI. Too many problems arise from getting the basics wrong: A certificate authority using 4 as its private key is a mistake that should never have been made. As always, security is about getting the basics right while watching for new threats. And while organizations claim to be paying more attention to security, the word from insiders is that “attention” means lip service. In the long run, AI may make the world a safer place, but the next few years look scary.

• CrowdStrike and Booz Allen have found that Qwen3-Coder (and probably other models) generates weaker code if the prompt says that the code is for a politically sensitive user such as the US government. Hirundo reports similar flaws and also claims to have “fixed” the model and created a Westernized version.
• Cohere makes a different claim: It has observed that Qwen3.8 models occasionally send data to an Alibaba cloud storage bucket in Beijing.
• Malicious AGENTS.md files have been found in the Downloads folders of some users. If the user is using the Downloads folder as their working directory, an AI agent will read the AGENTS file and download a malicious NPM package.
• 1Password has launched 1Password for Agents, a credential-brokering product that allows agents to access resources for a user without seeing the user’s password,
• Alibaba also donated its OpenSandbox project to AAIF. OpenSandbox is a general-purpose sandbox for running AI models safely.
• The PHP team has released patches for two critical vulnerabilities collectively known as PHP2Shell. However, many sites are running old versions of PHP that need to be upgraded before they can be patched. The maintainers have also released some partial mitigations for sites that can’t upgrade easily, but that won’t fully protect them. Sadly, “the panic hasn’t turned into patching,” and those who don’t patch will pay.
• Brotli isn’t as widely used as PHP, or as old, but a critical flaw in Brotli compression library makes it clear that discovery of hidden vulnerabilities is the shape of things to come. Microsoft has released patches for .Net, PHP maintainers have released patches for PHP, Node.js is also affected, and that’s just the start.
• The private keys of the certificate authority eMudhra have been cracked–not by brilliant cryptography or a quantum computer, but because the keys were generated very poorly. The Chrome and Firefox browsers aren’t trusting the compromised certificates, but almost everything else, including all major package managers, is a problem.
• OpenCode was the victim of a hostile attack in which some users’ API keys and passwords were stolen from their Console service. Its response was hampered by lack of access to AI models without security restrictions.
• The US Department of Homeland Security has banned the use of DeepSeek and applications developed using DeepSeek in all federal agencies.
• To monitor the risks created by the development of frontier models, Anthropic has given six employees of METR access to their models. They continue to work with Accenture and Secure Bio.
• Model abliteration is a poisoning attack in which post-training is used to discover which of a model’s weights corresponds to “no,” and altering them so the model cannot refuse a request. It’s effectively a backdoor into the model’s behavior.
• AWS has launched Strands Box, an open source sandbox that’s designed specifically to prevent AI agents from escaping the sandbox’s control. It includes an open source policy engine, Dogwood, that allows users to place explicit limits on what an agent may do.
• Meta’s Muse, its agent for people who aren’t technology professionals, is a privacy and security disaster.
• Using MCP for communications between agents creates many risks, including new vulnerabilities to prompt injection.
• Google has suspended submissions to the Open Source Software Vulnerability Rewards Program because of the flood of machine-generated vulnerability reports, most of which are (in Google’s words) “not valid.” This suspension should only be temporary.

Infrastructure and operations

There’s been a lot of news about certificate management, not all of it good. It’s time to check on your certificate providers, get ready for quantum-resistant encryption, and automate as much of the process as you can.

• To increase security, the certificate provider Let’s Encrypt will be limiting the lifetime of free certificates to 64 days starting in February 2027. The change should be invisible to sites using automatic certificate management (ACME).
• Crowdflare has announced that it will begin issuing TLS certificates with quantum-resistant encryption. They will continue issuing certificates with classical encryption. Crowdflare hasn’t given a date when they will start issuing the new certificates.
• DeepSeek has open sourced DeepInfer, its inference framework, with an Apache 2.0 license. At present, DeepInfer only supports DeepSeek-V4.1-Flash.
• RemoveMacAI is an open source command-line tool for deleting Apple’s AI from MacOS 27, freeing up 30 GB or so of disk space.

Web

Mark Twain didn’t quite say, “The reports of my death are greatly exaggerated.” But we are hearing that the Web is dead, and that’s indeed an exaggeration. The flood of crawler traffic and the disincentives towards human writing are a problem. But what does “death” mean for a technology so flexible that you can build an office suite that stores entire documents’ URLs?

• TinyLittleOffice.com is a surprisingly complete set of surprisingly capable office applications. It includes a word processor, spreadsheets, and other Office-like apps. Everything is saved in the URL–not on your disk, not in someone’s datacenter. Not suitable for large documents.
• Crowdflare has announced a web search API, now in beta. Although their announcement doesn’t say, we suspect this is an attempt to control web scraping traffic. Matthew Prince, its CEO, has estimated that bot traffic will reach 1000 times human traffic by mid-2027. All of his earlier predictions have been underestimates.
• Jev and its clones have taken the world by storm. Can you beat it at Pacman?

Hardware

• AI labs are heading towards models that can run on phones and similar hardware. Google has compressed Gemma 4 E4B to 5 GB, and Liquid has released LFM2.5-24B-A2B, a 24B mixture-of-experts model with 2B active parameters that also targets devices.
• OpenTPU is an open source API accelerator, designed by AI. Bring your own silicon.

Quantum computing

• Quantinuum has implemented quantum error correction on its latest hardware and has found that it scales well enough to be useful in practice: Adding a physical qubit to a logical cubit cuts the error rate significantly.
• Researchers have discovered a way to read a qubit without collapsing the information it contains into a 1 or 0. Solving this problem (also known as quantum non-demolition or QND) is critical to building quantum computers large enough to do useful work.

Biology

• Watermarking texts is one thing. Google has now designed a watermark for proteins. Like text watermarks, protein watermarks are based on Google’s SynthID.
• Last month we mentioned EEG-capable earbuds. This month, a group of researchers has announced that they have developed an AI application that can reconstruct what someone is seeing from brain scans. The results are impressive, though the privacy implications are chilling.