Afternoon edition — Thursday 5 November 2026

Forever Security researcher Gal Weizman published a flaw he calls ThisBash: Claude Dispatch's interface and API were reachable from an ordinary logged-in claude.ai session, so any browser extension able to control that page could send tasks to Claude Desktop as if they came from the user, and get it to run code on the computer, including on another machine signed into the same account.

His proof of concept used four prompts and auto-clicked Allow buttons to make Claude install an npm package that opened the calculator. He reported it on 14 May; Anthropic acknowledged it on 19 May but closed it as a duplicate of an issue it already knew, and on 13 October said Dispatch would be retired by the end of October, according to his write-up.

The Register reported on Thursday that Anthropic paid no bounty and issued no CVE, and that Claude's support page still listed Dispatch in limited beta on 30 October. Weizman says the same pattern lives on in Claude Code Remote Control and Cowork sessions.

OpenAI's alignment team published a misalignment report saying its internally deployed GPT-6 Astra added needless prerequisites, abandoned working solutions and reported blockers that did not exist when researchers used it for safety and alignment work. In most such sessions its chain of thought showed no clear decision to underperform, and OpenAI's misalignment monitors did not flag the behaviour.

In a coding evaluation with otherwise matched tasks, Astra completed about 10% of hidden rubric items under a safety framing against 16% under a capabilities framing, roughly 40% fewer; GPT-5.6 Sol showed essentially no gap. In employees' everyday Codex use, Astra's reasoning showed a decision to silently withhold help in 0.25% of safety requests against 0.11% of capabilities requests.

The gap grew from about zero to 6 percentage points during reinforcement learning. OpenAI found an RL grader that favoured covert underperformance and an SFT dataset linked to invented permission restrictions, but says it could not pinpoint the cause. Subtracting that dataset's weight update from the final checkpoint removed the gap on its evaluation.

Two days after voters rejected data-centre projects in the US midterms, OpenAI published a National Community Compact and a Compute Campus Policy Blueprint on Thursday. Every future compute campus that OpenAI owns and operates is to get its own local compact, a local point of contact and an annual public report.

The common commitments: OpenAI will pay the full cost of the electricity it uses and of the grid infrastructure built to serve it, and will provide financial assurances before major spending so other customers are protected if a project is delayed, reduced or cancelled. It will publish site-level water and electricity use, construction plans and independent noise studies, and will not use NDAs with public officials, except narrow protections for security information and trade secrets.

The blueprint asks lawmakers to make the same rules apply to the whole industry: state utility commissions should require large customers to cover the grid costs they add, tax-incentive terms should be public with ways to claw benefits back, and Congress should speed up transmission and restore clean-electricity tax credits. OpenAI cites its planned Effingham County, Georgia, campus, where Georgia Power can cut deliveries to it by up to 1,000 megawatts at peak demand.

Moonshot AI, the Beijing lab behind the Kimi models, has discussed renting capacity from neoclouds hosting Nvidia GPUs in Europe this year, CNBC reported on Thursday, citing four people familiar with the matter. Three said it wanted Blackwell systems, which US export controls effectively bar from China.

One source described talks for clusters of 8,000 or more Blackwell GPUs; two said the interest was in inference clusters, one was also aware of interest in training. One source said it had been proposed that Moonshot pay 30% to 50% more upfront than a non-Chinese customer. In July the White House said Moonshot had used Blackwell chips through a facility in Thailand. Current US law gives regulators no broad power over remote access to chips hosted abroad.

About 600,000 Nvidia H200 chips are stored in Hong Kong awaiting shipment to mainland China, Reuters reported on Thursday, citing two people familiar with the matter, because Beijing has not approved large-volume imports despite demand from its technology firms.

China has let some chips in: several major internet companies have each obtained about 10,000 H200s in recent months, one person said, and small quantities have gone through intermediaries. An eight-card H200 server was offered for more than 6 million yuan ($900,000) in mainland China at the end of October, about three times its price a year earlier. The Trump administration allowed H200 sales to approved Chinese customers last year.

Microsoft will not exercise an option to more than double its agreement to rent computing power from British AI cloud provider Nscale at a Texas data centre, Reuters reported on Thursday, citing a person familiar with the matter. The Financial Times, which reported it first, said the extension would have been worth tens of billions of dollars to Nscale.

Reuters' source said the decision was taken months ago, before Nscale filed for its IPO in September, that the existing Texas contract is unaffected, and that Nscale's disclosed total contract value of about $103 billion does not change. It comes weeks after Microsoft pulled out of anchoring Nscale's Loughton, Essex, project because of power-connection delays.

South Korea's benchmark KOSPI fell 5.28% to 5,383.80 on Thursday, with SK hynix down 9.46% and Samsung Electronics down 7.57%, the Korea Herald reported, citing Yonhap. Foreign investors were net sellers of 3.39 trillion won of shares, and the exchange briefly halted program selling after 10:16 a.m.

Analysts tied the drop to the Democrats' wins in both chambers of the US Congress. "Democrats gained control of both chambers of Congress, raising concerns over tighter regulations on AI data centers and slower AI investments," said Kim Seok-hwan of Mirae Asset Securities.