The Daily Tech Brief: Nov 8, 2026

Sunday is not quiet. Here is today’s tech news, tldr.

Claude Code’s “don’t ask again” leaked 2,539 secrets to public GitHub

When you pick “Yes, and don’t ask again” in Claude Code, it saves the full approved command, verbatim, to .claude/settings.local.json. Passwords, API keys, tokens, all of it. Claude Code never adds that file to your project’s .gitignore.

Apiiro scanned public GitHub and found 104,185 copies of the file. About 1.1% of them, 1,122 copies, hold at least one secret. Count shared settings files, git history, and saved agent chat logs and the total hits 2,539 secrets across 1,994 repos: 379 database passwords, 23 AWS keys, 43 SSH logins, GitHub and npm tokens.

Half of those files sat on a default branch for at least 217 days. Deleting the file does not fix it, because it lives on in history and forks. The only real fix is rotating everything.

Of the 16 coding agents Apiiro compared, Claude Code is the only one confirmed to save the full approved command into a project file by default. I run Claude Code every day. If you do too, check your repos today.

Source and reporting

Microsoft killed its AI Frontiers research group

John Langford, the Microsoft Research veteran behind Vowpal Wabbit, posted “The End of AI Frontiers” on November 6. The roughly 50-person group he helped found in 2023, the team behind the Autogen multi-agent framework and the Fara computer-use agent, got folded into Microsoft AI in early September and is now finished.

His reason: the ex-Inflection leadership running Microsoft AI believes in scaling and is “aggressively not research.” Work like Next Latent and the Full Bandwidth Transformer could not get seriously considered. Langford is leaving Microsoft too.

Research orgs are cheap to kill and expensive to rebuild. Microsoft just traded the team that built Autogen for more headroom on the scaling curve.

Source

Every Mac ships an undocumented family-member classifier

A writeup from Eighth Rank (Dario Pasquini and Michał Bazyli) shows every Mac since macOS 13 in 2022 ships a pair of daemons whose job is building a personal knowledge graph about you and the people around you. It runs an XGBoost kinship classifier with predicates like “has mother,” “has father,” and “spouse.”

None of this is documented. It is on by default, on your machine, inferring your family tree from your contacts, photos, and calendar.

Source

Your iPhone keeps a 100,000-word grey list

The Guardian reports that researcher Derik Kauffman found a hard-coded table inside iOS holding more than 100,000 words and phrases Apple’s predictive text refuses to complete. Drugs and sexual terms, sure. Also “Trayvon Martin,” “Kashmir dispute,” “male chauvinist pig,” “Dictator Trump,” and, in a moment of corporate self-protection, “iMessage isn’t working.”

Swipe-typing trips on the list. “United Ireland” comes out as “United Iceland.” Kauffman called it a “light-touch form of censorship.” Apple’s response: the keyboard is designed to avoid offensive suggestions, and you can always type the words yourself.

Your phone has opinions about which phrases exist, and it will not show you the list.

Source

OpenAI’s model disproved a 1998 math conjecture

Cade Metz reports in the NYT that an OpenAI model produced a natural-language disproof of the Exponential Time Hypothesis, a conjecture Russell Impagliazzo co-proposed in 1998. Impagliazzo called it “shocking news.” A separate Anthropic proof exists too. Both passed machine checks and are now under human expert review, including by MIT’s Ryan Williams.

Machine-checked is not human-accepted, so treat it as probable, not settled. If it holds, the long-run fallout touches chip design and current encryption assumptions. Years away, but real.

Source

Discord dumped Electron, and it shows

Discord co-founder and CTO Stanislav Vishnevskiy posted a side-by-side of the current Electron client and the new Rust client, called Discord Phoenix. The Rust app had the friends list loaded before Electron got past its loading screen. 290.2MB of RAM with two accounts signed in, roughly 70% less than the Electron build.

Windows apps spent a decade shipping a browser with every install. Discord just showed the way back.

Source

Anthropic’s agents now “dream”

Anthropic’s November 6 research post breaks agent memory into layers. Claude writes salient memory notes during sessions. Stronger models like Opus 5.5 judge what counts as salient. Then “dreaming” consolidates the knowledge while the agent is idle, the first public description of how Anthropic consolidates agent memory offline.

Useful, and a little unsettling. Your agent does homework while you sleep now. What it decides to remember is the new attack surface.

Source

The through-line: defaults

Every story today is about defaults. Claude Code defaults to saving your secrets in a file it never gitignores. macOS defaults to mapping your family. iOS defaults to a list of phrases your keyboard pretends do not exist. Microsoft defaults to scaling over research. Agents default to remembering, and now to consolidating while idle.

Defaults are decisions someone else made for you. Read your settings files. Gitignore your agent state. Own your stack, or someone else’s roadmap owns it for you.

Written from live sources on Nov 8, 2026: the Hacker News front page and the primary reports linked inline.