Eversynced AI Weekly - November 9, 2026

Your Monday briefing on AI that matters for developers.

Issue #19 - November 2 - November 8, 2026.

This Week’s Big Move

Starting December 2, GitHub Actions will block pull_request_target events by default in public repositories unless an Actions event policy allows them (changelog). Private and internal repositories aren’t affected, and neither is Enterprise Server. Two brownouts (short windows where the block is enforced early) come first, on November 9 and November 16 from 16:00 to 18:00 UTC. In those windows, blocked workflows fail; outside them they run with a warning.

The target is the pwn request. A pull_request_target workflow gets the base repository’s secrets, which is safe until the workflow checks out the fork’s code and runs it (GitHub’s guide). If your public repository uses the trigger to label, triage or post checks on fork pull requests, those jobs stop on December 2 unless you act (see What Matters).

GitHub added a second guard in June. Since June 18, actions/checkout v7 refuses to fetch fork code in these workflows unless the step sets allow-unsafe-pr-checkout, and since July 20 floating major tags like @v4 do too. Workflows pinned to a SHA, minor or patch version don’t get the change (changelog). Our read: CI that needs secrets on fork pull requests now has to split into two workflows, one that builds untrusted code without secrets and one that holds the keys, as GitHub Security Lab’s Preventing pwn requests shows.

One call from a past What’s Noise section resolved this week. Kimi K3.1 Pro’s weights landed on Hugging Face as moonshotai/Kimi-K3.1-Pro by Moonshot’s November 4 deadline, under Moonshot’s own license, so issue 18’s advice to wait for the files no longer applies.

Tools & Agent Updates

Claude Code v2.1.317 to v2.1.319 - Three releases from November 3 to 6. v2.1.317 adds onFailure: "block" for Agent SDK hook callbacks, so a callback that fails blocks the action instead of letting it run. v2.1.319 moves MCP tasks (tool calls an MCP server runs as a task) to the background in the terminal and adds permissions.denyInsteadOfPrompting: a tool call that would wait on a permission prompt is denied and the turn continues, in terminal sessions, subagents and teammates.

Claude API message threads - Public beta since November 2. You send the full conversation once, then only the new messages and the previous response’s ID. With threads on by default for most Claude Code users, Anthropic says median time to first token dropped about 35% on 500K to 1M token requests, at the same token usage and rates. A thread expires 5 minutes after its last request, and the docs list threads as not ZDR eligible.

MCP reference servers v2.3.0 - Released November 4. The filesystem server gets --read-only, which serves only read tools, and --confine-roots, which keeps the directories a client offers as Roots inside the ones given on the command line. The fetch server gets an operator host allowlist, --allowed-hosts, and a configurable timeout. Put --read-only, --confine-roots and --allowed-hosts in any config an agent drives.

Cursor live apps - Since November 5, on paid plans with cloud agents enabled, a Cursor cloud agent can take a description, scaffold the web app, spin up a Postgres database if needed, set up authentication behind Cursor SSO, provision hosting and hand back a live link on a domain you pick. Team admins can unpublish any app, so make sure someone holds that role.

Reroute or Refuse

Four changes this week settle what happens when the model or check you asked for goes away:

• Gemini 2.5 Pro - Deprecated November 2. From December 1, requests to gemini-2.5-pro route to gemini-3.8-flash and are billed at its rates. Google lists breaking API changes between the two, including function calling and thought_signature validation, plus thinking_level replacing thinking_budget. Sampling parameters and prefilled model turns are gone.
• Gemini 2.5 Flash - Same date and the same mechanism, but the target is gemini-3.5-flash-lite, billed at Flash-Lite rates, with the same list of breaking changes.
• Gemini Embedding 2 Preview - Rerouted to gemini-embedding-2 on November 6. Google says the new model uses the same API schema, pricing and embedding space, so nothing needs re-indexing.
• Claude Code auto mode - Since v2.1.319 on November 6, with telemetry or feature flags off, including behind LLM gateways, “calls the server can’t check are asked about or denied, with no fallback to the built-in classifier.” Bedrock, Vertex and Foundry are unchanged.

A reroute keeps the model string working while the model behind it changes. On December 1 a gemini-2.5-pro call reaches a model with breaking API changes, and nothing in your code tells you. Anthropic went the other way twice: auto mode above, and Opus 4.8 fast mode, whose requests “return an error and do not fall back” after November 30 (covered last week). We’d take the error. It shows up the day it happens, while a silent swap surfaces later as a quality drop you have to trace back.

What This Means for You

What Matters

• Find your pull_request_target workflows before the second brownout on November 16. It applies to public repositories only. Check policy insights for runs the rule would block, then keep the block or allow the event in an event policy that targets only the workflow files that need it (changelog). If a workflow doesn’t need secrets, move it to pull_request (guide).
• Change gemini-2.5-pro and gemini-2.5-flash yourself before December 1. Set gemini-3.8-flash or gemini-3.5-flash-lite and run your evals against the breaking changes Google lists, so you pick the day the behavior changes (changelog).
• Check auto mode if Claude Code runs behind an LLM gateway or with telemetry off. Set CLAUDE_CODE_AUTO_MODE_SERVER=0 to keep the built-in classifier (changelog).
• Read Kimi K3.1 Pro’s license before you offer it as a service. Section 2 requires a separate agreement with Moonshot if you or an affiliate run a Model as a Service business and your combined revenue tops $20 million over any 12 consecutive months. Section 4 exempts internal use and use through Moonshot’s own products or certified inference partners (license).

What’s Noise (for now)

• Tencent Hy4 open weights. Tencent announced Hy4 on November 4 and “plans to release model weights and system cards in the coming days.” When we checked on November 9, the tencent org on Hugging Face still had only August’s Hy4-preview repos, not Hy4 itself. Wait for the files and the license.
• GPT-6 Cyber for your team. OpenAI lists gpt-6-cyber at $20 input and $100 output per million tokens (standard short-context prices), but your organization needs Daybreak Red access plus approval for this model. Daybreak Red is one of OpenAI’s approved-access programs for cybersecurity work.

Our Take

Open weights became a line item this week. Revolut told the AI Engineer conference in New York in October that making self-hosted models its default cut its AI coding inference costs by roughly 90%, per The Register. Its AI coding rollout covers roughly 2,000 engineers, and it serves GLM-5.3 on 56 Nvidia B200s. Fifty-six B200s is a procurement decision, and Revolut is big enough to make it.

So for most teams the open question is whether you can run these models, and what the license lets you do once you do. Kimi K3.1 Pro and Mistral Large 4 both require a separate license if you run a Model as a Service business, and only Kimi’s waits until you pass $20 million in revenue. Read the license before the benchmark table, price the GPUs and the on-call rotation, then compare that to your API bill. Without a platform team to run the cluster, the API still wins.

Quick Links

• MCP Inspector 2.14.0 - Fixes three privately reported vulnerabilities, and one of the fixes also lands in the deprecated v1 line as 1.0.4
• Cursor voice chat - Talk to your agents in a realtime call, on Grok Voice, with zero data retention under Privacy Mode
• Vercel Schedules - In public beta, agents and apps create, change or cancel one-time and recurring schedules at runtime without a redeploy
• Copilot in Xcode - Public preview from Xcode 27.3 beta, on macOS Tahoe 26.6 or later
• Gemini multimodal function responses - Tools can now return Office and OpenDocument files, audio and video to the model

Glossary

Pwn request - A privileged workflow that checks out and runs code from an untrusted pull request, handing that code the repository’s secrets. It’s the attack both of GitHub’s new defaults target.

Event policy - A GitHub Actions rule that decides which events may trigger which workflows. Allowing pull_request_target in one is how a repository opts out of the new default.

Time to first token - How long a request waits before the model’s first output token arrives. Message threads cut it by sending only the new part of a conversation.

ZDR - Zero data retention: the provider stores none of your request data after answering. Message threads hold your conversation on the server between turns, and Anthropic’s docs list them as not ZDR eligible.

Model as a Service - The Kimi K3.1 Pro license’s term for giving third parties inference or fine-tuning access, such as through an API, with meaningful control over inputs, parameters or training data. End-user products that embed the model only in specific features or harnesses don’t count, and neither does relaying requests to a model someone else hosts.