All editions
AI News6 items

AI News, Saturday 24 October 2026

1. Patch Node.js and Python now: the Brotli flaw spreads.

Install · A critical bug in Brotli, the compression format most websites use, now affects far more than Node.js. It is CVE-2026-111497, scored 9.2 out of 10, first called Node2Shell on 21 October and renamed HTTP2Shell on 23 October once Python and other tools proved vulnerable. A crafted compressed message can crash an app or, in some cases, run an attacker’s code. In Node.js, the built-in fetch() and express.json() in Express 5 are exposed; in Python, requests, httpx and aiohttp use Brotli automatically when it is installed. Your automations likely call outside APIs, so they count, and Dependabot and pip-audit did not flag the Python packages yet on 23 October. Update Node to 22.23.4, 24.22.1 or 26.12.1, Python brotli to 1.2.1 and Bun to 1.4.4, then rebuild your containers; Node 20 gets no fix. Source · Source 2

2. Corgi, a terminal built for running several agents.

Try · Corgi is a new open source terminal multiplexer shown on Hacker News today. It shows the status of each coding agent at a glance: working, needs you, finished or idle. It works with Claude Code, Codex, Pi and OpenCode on your existing accounts, keeps sessions running in the background like tmux, and lists every file an agent touched in one view. If you run several Claude Code sessions in parallel, this is the missing dashboard. Install it with curl -fsSL https://corgi.computer/install.sh | bash (macOS, Linux, WSL) and try it on your next multi-agent day. Source

3. Kimi K3.1 Pro nearly matches Claude Opus 5.5 at coding.

Try · Moonshot AI, the Chinese lab behind Kimi, released Kimi K3.1 Pro, the top story on Hacker News today. It has a 1 million token context window and comes with a Highspeed version that Moonshot says runs 2 to 3 times faster. On Terminal-Bench 4.0, a coding benchmark, Moonshot reports 65.7%, against 66.4% for Claude Opus 5.5 and 58.2% for GPT-6 Astra. The full open-weight files arrive by 4 November, and Moonshot says it removed cyber-related data from training to limit hacking uses. For clients who want a model they can host themselves, it becomes a serious option. Test it on kimi.ai or through the API as kimi-k3.1-pro. Source · Source 2

4. Claude switches to auto mode by default next week.

Know · Anthropic announced that starting next week, sessions in the Claude web, desktop and mobile apps will run in auto mode by default on Pro, Max and Team plans. Instead of asking you to approve each step, Claude runs on its own and an automated check blocks risky actions. You can switch back to manual approvals at any time. Why it matters: your trainees will see Claude act without asking, so add one slide on this setting to your governance workshops. Source

5. Microsoft’s diagnosis agents beat generalist doctors in Science.

Know · Microsoft published a study in Science on 22 October about MAI-DxO, a system where several AI agents act like a panel of doctors: they question the patient, order tests and debate. On complex cases from the New England Journal of Medicine, it was right 83% of the time, against 36% for generalist doctors using reference materials. It was a simulation, with no specialists in the comparison, and GPT-5 alone already reached 78.9%. Why it matters: it shows clients that most of the gain comes from the model, and the agent setup adds a smaller layer on top. Source · Source 2

6. Dessa, a voice model that never saw text.

Try · Block’s small AI research lab showed Dessa, a speech model trained only on recorded human conversation, with no text and no pretrained model. It is full-duplex: it listens and talks at the same time, says “yeah” while you speak and cuts in at natural moments. It was trained on a single Nvidia GB200 NVL72 system and runs locally on a MacBook Pro M4 Max, faster than real time. A team of 6 researchers built it. Listen to the demo recordings on the page and join the waitlist on dessa.com. Source

Glossary

  • Brotli: a compression format that shrinks web pages and API answers so they travel faster; your apps unpack it without you noticing.
  • Terminal multiplexer: a tool that splits one terminal window into many sessions that keep running even when you close the window.
  • Context window: the amount of text a model can read and keep in mind at once, counted in tokens.
  • Benchmark: a standard test used to compare models on the same tasks.
  • Open-weight: a model whose trained files are published, so anyone can download and run it on their own servers.
  • Full-duplex: a conversation where both sides can speak and listen at the same time, like a phone call.