AI progress — 3 November 2026

The most concrete change for builders today is GitHub’s: from 2 December, Actions will block pull_request_target by default in all public repositories. Workflows that rely on that trigger, including many bots that act on pull requests from forks, will stop unless an explicit policy allows them. Elsewhere the day was mostly papers and legal and funding news, with no major model release in the sources we track.

New models and papers

• Wave Forcing: Towards Speed-of-Light Streaming Video Generation — a paper proposing a method for real-time long-video generation that targets the two forward passes per chunk and the camera drift of chunk-wise autoregressive approaches. Why it matters: if the authors’ claims hold, continuous video streams get cheaper to generate; the abstract excerpt we have does not include the measured numbers.
• Democratizing Robot-Use Agents: A Unified Harness with Open Models — the authors release uni-robot-agent, a harness for robot-use agents built on open-weight models that supports further training; they report a RoboDojo score for an out-of-the-box Qwen3.8-Flash-Next. Why it matters: robot-agent research no longer has to depend on proprietary frontier models, since the harness can be trained on.
• Lost in Recovery: Demystifying Recovery Behavior of Computer-Use Agents via Goal-Oriented Action Replay — a study of how computer-use agents recover from errors in long-horizon tasks, where mistakes accumulate and leave side effects. Why it matters: it targets the failure mode that makes these agents fragile in practice; the authors argue existing remedies are inadequate.

New tools and software

• pull_request_target blocked by default December 2 — from December 2, 2026 GitHub Actions blocks pull_request_target events by default in all public repositories unless an Actions event policy explicitly allows them. Why it matters: public repos, including those running AI-review or triage bots on that trigger, need an explicit policy before that date or the workflows stop running.
• vLLM v0.33.0rc3 — a release candidate of the inference server whose notes list 927 commits and support for new models, including Reflection Beam-1.0 (501B MoE) and Recursive Flint (40B MoE). Why it matters: anyone serving these models on vLLM can test support before the final release; it is an rc, so not for production yet.
• Claude Code v2.1.317 — adds an onFailure: "block" option for Agent SDK hook callbacks, a warning when a new /schedule cloud task picks up connectors you did not ask for, and a prompt before a tool call sends your account email to the network. Why it matters: a failing hook callback can now stop the action instead of silently letting it run, which matters for hooks used as guardrails.

Overall digest

• The New York Times sues Brave over AI scraping — the Times and other publications filed lawsuits alleging unlawful scraping to train AI and letting users bypass paywalls, per The Verge citing Reuters. Why it matters: it is an allegation, not a ruling, but it extends the scraping fight to a browser vendor rather than a model maker.
• Anthropic clamps down on Claude’s AI video game clones — Anthropic updated Claude Code’s system prompt so it will not be used to re-create existing video games, as reported by Tom’s Hardware; making original games is still allowed. Why it matters: it is a vendor-side rule on one tool; Ars Technica argues it will not stop the wider copying.
• Oracle files to sell $20B in new stock and bonds — Oracle filed to raise $20 billion through new stock and bonds to finance its AI buildout. Why it matters: it shows the datacenter buildout is being funded in part with fresh equity and debt, which is what capacity buyers ultimately pay for.