ChatGPT
Claude
The AI agent news of November 5 to 12, 2026 was dominated by security, not launches. The week's most important item is a real breach that started in an MCP server, at the German hosting company Mittwald. Two research and release items followed from the same theme, Corelight's finding that "pinned" MCP servers keep changing underneath you, and a six-vulnerability fix across the official reference servers.
Next in importance came Anthropic's Claude Fable 5.2 and Mythos 5.2 on November 9, the MCP project's new six-month release schedule on November 11, and an open identity standard, Agent Name Service, landing at the Linux Foundation on November 10. This post ranks 12 items by importance, adds six smaller ones, and ends with a table of what to act on this week.
Wiring an agent to a creative tool server
Oakgen is our product. Its MCP page lists the clients it supports and what the server exposes, so you can check setup and scope before you build on it.
The week at a glance
| Rank | Item | Date | Publisher | Evidence |
|---|---|---|---|---|
| 1 | MCP server used to breach a hosting provider | Nov 7 | Mittwald | Company's own account |
| 2 | Pinned MCP servers re-resolve dependencies | Nov 10 | Corelight | Vendor lab observation |
| 3 | Six vulnerabilities fixed in reference MCP servers | Nov 11 | MCP servers repo | Release notes |
| 4 | Claude Fable 5.2 and Mythos 5.2 | Nov 9 | Anthropic | Vendor claims |
| 5 | MCP moves to six-month releases | Nov 11 | MCP project | Official post |
| 6 | GPT-6 Cyber | Nov 5 | OpenAI | Vendor claims |
| 7 | Agent Name Service joins the Linux Foundation | Nov 10 | Linux Foundation | Press release |
| 8 | Draft MCP file upload and download extension | Nov 10 | MCP project | Official post, experimental |
| 9 | Businesses and Business Agents in ChatGPT | Nov 10 | OpenAI | Vendor announcement |
| 10 | Gemini 4 Carbon GA and Gemini Omni 1.2 Flash GA | Nov 10, Nov 5 | Release notes | |
| 11 | OpenShell joins the CNCF | Nov 10 | CNCF and NVIDIA | Foundation post |
| 12 | Durable Task extension for Microsoft Agent Framework GA | Nov 9 | Microsoft | Vendor announcement |
Disclosure. Oakgen is our product. This is a news roundup of mostly infrastructure items, and we mention Oakgen only where it fits a creative team's decision.
Who this is for
You build or run agents, MCP servers or AI tooling, or you lead a team that depends on them, and you want one list you can act on instead of ten feeds. If you only have five minutes, read items 1 to 3 and the action table.
How we checked this
On November 12, 2026 we opened the primary page for every item below, meaning the publisher's own blog, release notes, press release or changelog. We used Firecrawl, Exa, Perplexity, Parallel Search and the built-in search together, and treated aggregator and news-site pages as pointers only.
We kept items dated November 5 to 11, 2026. We dropped anything we could not open at its source, and anything dated earlier that circulated again this week. Performance numbers are the publisher's unless we say otherwise. We ran no benchmark and tested no product.
The 12 items, ranked by importance
1. An MCP server was the way in to a hosting provider
November 7, 2026. Mittwald, a German web host. Primary source, plus The Record's report of November 9.
What changed. Mittwald says an attacker first probed a flaw in its MCP server on the evening of October 21 and exploited it on October 27 at 15:03, using a freshly registered account. The company noticed unusual behavior on the morning of November 4, shut the MCP server down, and later examined 56 compromised projects. The Record reports it is unclear whether the flaw was in Mittwald's own code or in open-source MCP libraries. Mittwald says passwords were not read, and its guidance to agencies says access tokens were.
Why it matters. It is the clearest example this year of an AI integration layer becoming the entry point to a control plane, and a token carried its owner's full rights.
The claim that the attacker used AI tools is Mittwald's reading of fast log timing. The Record notes that ordinary scripts also outpace people, and Mittwald offered no other evidence.
2. A pinned MCP server ran 15 different dependency sets
November 10, 2026. Corelight, a network security vendor. Vendor research.
What changed. Corelight's post says one MCP server on an administrator's workstation was configured with a specific release and commit. Over five weeks it ran with 15 different environments, and 23 of its 69 packages changed version, because the one-step launcher uvx re-resolved dependencies from PyPI whenever it rebuilt. Corelight froze five servers, started them 457 times over two weeks, and found identical package lists each time. It found no compromise.
Why it matters. Pinning the server's version does not pin what it loads, and an MCP server often holds an administrator's credentials. The numbers come from one lab workstation, so treat them as an existence proof, not a rate.
For a deeper walk-through of the risk, see our MCP supply chain post and the creative team security checklist.
3. Six vulnerabilities fixed across three reference MCP servers
November 11, 2026. modelcontextprotocol/servers repository, release v2.4.0.
What changed. The v2.4.0 release notes say it fixes six vulnerabilities in three servers. Upgrade @modelcontextprotocol/server-filesystem to 2.3.0, and mcp-server-git and mcp-server-fetch to 2026.11.11. Fixes include a symlink race that could return files from outside the allowed directories, the Git server running a program named in a repository's own config on a read-only call, and an IPv6 site-local range treated as public in the fetch server's address guard. The notes say Windows is only partly covered for two of them.
Why it matters. These are the servers most tutorials tell you to install, so the patch applies to a lot of developer machines. The notes also record that server-everything 2.3.0 binds its HTTP transports to loopback by default.
4. Claude Fable 5.2 and Mythos 5.2 launched
November 9, 2026. Anthropic. Vendor claims.
What changed. Anthropic says Fable and Mythos are the same underlying model. Fable carries cybersecurity and biology safeguards and is available to all users. Mythos goes to organizations approved through its verification programs. Both are listed at $8 per million input tokens and $40 per million output tokens, with an optional fast mode at $16 and $80. Anthropic's own table puts FrontierCode 2.0 at 49.1 percent at Xhigh effort, and says Fable 5.2 can act as an orchestrator that delegates to smaller models.
Why it matters. It resets the price and the ceiling for agent work, but Anthropic itself says to start most coding and knowledge tasks on Opus 5.5.
We separated vendor-run from independently measured scores in the benchmarks explainer, compared it in Fable 5.2 vs Opus 5.5 vs GPT-6 Astra, worked out cost per task and collected community reactions. If you are tempted to fan out sub-agents with it, read single agent vs multi-agent first.
5. MCP moves to a six-month release schedule
November 11, 2026. Model Context Protocol project. Official post.
What changed. The MCP blog says specification releases move to a regular six-month schedule, generally the last Tuesday of March and September. The next target is March 30, 2027, version 2027-03-30. Soft freeze is two and a half months before release and Tier 1 SDK betas arrive one and a half months before. Luca Chang joins Den Delimarsky and David Soria Parra as a release manager. The process is written up in SEP-3398.
Why it matters. Maintainers get a calendar they can plan against, and a proposal that is not ready now waits for the next release instead of delaying everyone.
Our planning calendar turns the offsets into dates, and the 2026-07-28 specification explainer covers the revision you are building against today.
6. OpenAI released GPT-6 Cyber to approved defenders only
November 5, 2026. OpenAI. Vendor claims.
What changed. OpenAI says GPT-6 Cyber scores 48.5 percent on its ExploitGym test, up from 32.1 percent for GPT-5.6 Cyber, and that researchers used it to build exploits for 948 Linux kernel vulnerabilities and find 81 new high-severity Firefox vulnerabilities. It is available through the API and Codex to a select group of approved Daybreak Red customers. OpenAI says it classes the model as Critical for cybersecurity under its Preparedness Framework.
Why it matters. Both leading labs now gate their strongest cyber models behind vetted access, which is the pattern to expect.
7. Agent Name Service joins the Linux Foundation
November 10, 2026. Linux Foundation. Press release.
What changed. The Linux Foundation announced that Agent Name Service, an open standard for agent identity, registration and discovery built on DNS, has launched as a Linux Foundation project. The specification has seven documents. It names 11 organizations that contributed to or adopted it, including Cisco, Cloudflare, DigiCert, GoDaddy and Salesforce.
Why it matters. It is a credible candidate for the identity layer that MCP and A2A do not supply, though a press release counts supporters, not production use. See our ANS explainer and who governs what in the AAIF.
8. A draft MCP extension for file uploads and downloads
November 10, 2026. Model Context Protocol project. Official post, experimental.
What changed. The MCP blog describes an optional extension, io.modelcontextprotocol/files, that works with revision 2026-07-28 and later. File bytes travel outside JSON-RPC to an upload or download target, and the model never sees them. There is no reference implementation yet, and the project expects to stabilize it before the end of the year.
Why it matters. Anyone moving large files through agents has been inventing conventions. The draft also warns that an omit target can still send files to an attacker-chosen URL, so hosts should allowlist origins. Details are in our file transfer explainer.
9. ChatGPT gets business profiles and Business Agents
November 10, 2026. OpenAI. Vendor announcement.
What changed. OpenAI introduced Businesses in ChatGPT in beta. In Business Hub, companies claim a profile, add product feeds with pricing and availability, and see aggregate insights. Business Agents, a labeled chat that speaks for a brand, start with eligible US ecommerce and online service businesses. Digiday reports they are free at launch and that businesses cannot bring their own agents. OpenAI says 1.2 billion people use ChatGPT weekly, a figure we did not verify.
Why it matters. Product data you submit is now an input to AI shopping answers, and the agent that represents you runs on OpenAI's terms.
10. Gemini 4 Carbon is generally available, and Omni 1.2 Flash too
November 10 and November 5, 2026. Google. Release notes.
What changed. Google's Gemini API release notes list Gemini 4 Carbon as generally available on November 10, at introductory pricing of $2.00 per million input tokens and $10.00 per million output tokens through November 30, 2026. On November 5 it listed Gemini Omni 1.2 Flash as generally available, with up to 15-second video generation, conversational editing and up to 6 reference images for consistency.
Why it matters. The price window closes in 18 days, and Omni is the item here a video team can try directly.
11. Nvidia's OpenShell joins the CNCF
November 10, 2026. CNCF, contributed by NVIDIA. Foundation post.
What changed. The CNCF welcomed OpenShell as a Sandbox project. It is an open source runtime for securing and governing autonomous agents, adopting Cedar as its policy language. Repositories move to a neutral ai-openshell organization, and the post names core contributors from NVIDIA, Red Hat, Docker and Canonical.
Why it matters. Enforcement outside the agent is the right layer, and it is now vendor-neutral. Sandbox is the CNCF's earliest stage, so treat it as promising, not proven.
12. Durable Task extension for Microsoft Agent Framework is GA
November 9, 2026. Microsoft. Vendor announcement.
What changed. Microsoft's announcement says durable agents keep session state across worker restarts, and durable workflows resume without repeating saved steps and can wait for approvals without holding a worker. It runs in Azure Functions or self-hosted .NET and Python apps.
Why it matters. Human approval steps are where long agent jobs break. See orchestration patterns and the framework comparison.
Six smaller items
| Date | Publisher | What changed | Why it matters |
|---|---|---|---|
| Nov 11 | AWS | Sample pipeline that pushes MCP server tool changes into AWS Agent Registry using CloudTrail, EventBridge and Lambda. Updated records revert to Draft until approved | Shows the review gate a registry can keep even when sync is automatic |
| Nov 10 | Microsoft Security | Microsoft Research says editing fewer than 10 neurons can plant a trigger in an agent model. Microsoft has seen no abuse and says frontier agents can detect the edits | Audit third-party open weights as you would code |
| Nov 10 | Google DeepMind | AlphaProof Code agents formally verified core Signal protocol code in about four weeks, with humans reviewing every specification. DeepMind's claim | Formal verification by agents is becoming practical |
| Nov 10 | IBM | IBM and Microsoft announced Imagine Enterprise, with more than 6,000 agents and assets, aimed at regulated industries | A services-led channel, and the agent count is IBM's claim |
| Nov 11 | Google Open Source Blog | Interview with Kurtis Van Gent on MCP and Agent Skills under the AAIF, describing them as complementary | Useful framing, and see Skills vs MCP |
| Nov 5 | Parallel | Parallel MCP 2.0, a free, keyless web research server with search, fetch and decisions tools | A vendor release, so check what it sends where |
What we dropped
Several seed items failed our date or source test. Uber's MCP Gateway post is dated October 1, 2026, GitLab 19.5 shipped October 15, and Zenity's AgentCorruption disclosure is from October 8. We read a Qwen 4 launch and several security advisories on aggregator pages only, so we left them out. Our own gateway explainer covers Uber and GitLab as background.
What to act on this week
This is the original asset. Effort is our estimate for one team, not a published figure.
| Item | Who should care | Action this week | Effort |
|---|---|---|---|
| Mittwald breach | Anyone exposing an MCP server to customers | Rotate tokens issued through the endpoint, scope each token to one user, alert on unusual token use | 0.5 to 2 days |
| Corelight drift | Teams whose assistants launch servers through uvx or npx | List launcher-started servers, freeze the one with the most privilege first | 2 to 4 hours each |
| Servers v2.4.0 | Anyone running the reference filesystem, git or fetch servers | Upgrade to filesystem 2.3.0, git and fetch 2026.11.11 | 30 minutes |
| Fable 5.2 | Teams paying per token for agents | Run 20 of your own tasks against your current model before switching | 1 day |
| MCP release cycle | SDK, server and client maintainers | Put March 30, 2027 and the freeze offsets in the team calendar | 15 minutes |
| GPT-6 Cyber and Mythos 5.2 | Security and vulnerability research teams | Apply for vetted access only if you do this work | 30 minutes |
| Agent Name Service | Identity and platform engineers | Read the specification, do not deploy yet | 1 hour |
| Files extension | Authors of servers with file inputs | Read the draft and comment on its open questions, do not ship on it | 1 hour |
| Businesses in ChatGPT | US ecommerce brands | Check eligibility, claim the profile, review the product feed | 2 to 4 hours |
| Gemini 4 Carbon | Teams on Gemini | Note that introductory pricing ends November 30 | 30 minutes |
| Durable Task GA | .NET and Python agent builders | Pilot it on one approval-heavy workflow | 1 to 2 days |
| AWS registry sync | AgentCore users with a registry | Plan for updated records to need re-approval | 1 hour |
Test your own brief, not a leaderboard
Oakgen is our product. Run one creative brief through Agent Chat and compare the plan, script and generated assets before you commit to a model.
Common mistakes when reading a week like this
Counting a vendor result as a measurement. The GPT-6 Cyber exploit counts, Anthropic's benchmark table and IBM's agent count are the publishers' own. Look for the words "independent" or a third-party name before you repeat a number.
Reading "pinned" as "frozen". Corelight's finding is that a pinned release is not a frozen environment. Check what your launcher resolves at start-up.
Treating a foundation announcement as adoption. A press release lists supporters. It does not tell you who runs the standard in production.
Shipping on an experimental draft. The files extension has no reference implementation. Optional and experimental means read it, not depend on it.
Mistaking gated access for general availability. Mythos 5.2 and GPT-6 Cyber are limited to approved organizations. Gemini 4 Carbon became generally available, so check each launch's access line.
Copying CVE numbers from aggregator lists. We saw several advisory lists this week that we could not tie to a primary record, so we cited only the release notes.
A decision framework
Sort the week by what it asks of you.
Fix now. Items 1 to 3 describe exposure that already exists. If you run MCP servers, this is the only part of the list with a deadline.
Plan for. Items 4, 5 and 10 change cost and calendars. Put dates on them and run a small test.
Watch. Items 6 to 9, 11 and 12 are early or gated. Read the primary page once and revisit when there is a reference implementation or a pilot customer.
What I would do
First, I would upgrade the three reference servers today, since it takes minutes. Second, I would inventory every MCP server our assistants start, and freeze the highest-privilege one using Corelight's steps, with a named owner for re-locking. Third, I would give each server its own scoped, expiring credential. Fourth, I would test Fable 5.2 on 20 real tasks, not trust a leaderboard. The rest I would read and park.
For a creative team, the practical read is narrow. Check which tokens your assistant holds, and who approves a file leaving your machine. Oakgen is our product and exposes an MCP server, but we did not verify that it implements any draft in this roundup, so check its MCP page for current details.
Scope your creative tools before you scale them
Oakgen is our product. Review what its MCP server exposes and which clients it supports, then set the approval steps your team needs.
Frequently asked questions
What was the most important news? The Mittwald breach, because it is a real incident with a real entry point.
Did the MCP spec change? No new version. The project set a calendar and published a draft extension.
Are Fable 5.2 and Mythos 5.2 the same model? Yes per Anthropic, with different safeguards and access.
What should I do about Corelight's research? Freeze one privileged server and assign an owner.
The full answers are in the FAQ block with this post, and the next roundup will cover November 12 onward.
Test several models on one brief
Oakgen is our product. Browse the image, video and audio models it offers and compare outputs on the same brief.
Frequently asked questions
What was the most important AI agent news between November 5 and 12, 2026?
In our ranking it was the Mittwald incident, because it is the one item where an MCP server was the entry point to a real breach. Mittwald, a German hosting company, said on November 7 that an attacker exploited a flaw in its MCP server on October 27, read customer access tokens and reached 56 projects before it noticed on November 4. The Anthropic model launch of November 9 and the MCP six-month release schedule of November 11 are the next two, but they change what you plan, not what is already exposed.
Did the MCP specification change this week?
No new specification version was released. The MCP project announced on November 11, 2026 that releases move to a six-month schedule, generally the last Tuesday of March and September, with the next target March 30, 2027 as version 2027-03-30. On November 10 it also published an experimental draft extension for file uploads and downloads, which works with the existing 2026-07-28 revision and is optional. Nothing in either post requires a change to a server or client today.
Are Claude Fable 5.2 and Mythos 5.2 the same model?
Anthropic's launch page of November 9, 2026 says they are the same underlying model. Fable 5.2 carries cybersecurity and biology safeguards and is available to all users, and Mythos 5.2 is available to organizations approved through Anthropic's Cyber Verification Program and Life Sciences Verification Program. Anthropic lists $8 per million input tokens and $40 per million output tokens for both. The benchmark scores are Anthropic's own unless a row in our benchmarks post says an outside party ran it.
What should I do about the MCP supply chain research from Corelight?
Find out how your assistants launch MCP servers. Corelight reported on November 10, 2026 that one server pinned to a single release and commit ran with 15 different dependency sets over five weeks, because the one-step launcher re-resolved its dependencies. Its fix is to pin to a commit, install from a hash-pinned lock file into a dedicated environment, launch the installed server directly and turn off startup update checks. Corelight also says someone must own re-locking on a schedule, or the frozen environment simply ages.
Which news items from the week are only vendor claims?
Most performance numbers. Anthropic's benchmark table, OpenAI's GPT-6 Cyber results (ExploitGym 48.5 percent, 948 Linux exploits, 81 Firefox vulnerabilities), DeepMind's Signal verification timeline, IBM and Microsoft's 6,000 agents and assets, and Parallel's description of its own MCP server are all reported by the publisher about its own work. Corelight's counts come from its own lab observation of one workstation. Mittwald's suggestion that the attacker used AI tools is the company's interpretation of its logs.
Why did some items from the seed lists not make it into this roundup?
We only kept items whose primary page we opened and whose date falls inside the window. Uber's MCP Gateway engineering post is dated October 1, 2026, GitLab 19.5 shipped on October 15, and Zenity's AgentCorruption disclosure is from October 8, so they are background, not this week's news. Items we found only on aggregator or press-release mirror sites, such as a Qwen 4 launch, were dropped because we did not open a primary page for them.
Does any of this week's news affect a creative team using AI image and video tools?
Three items do. Google made Gemini Omni 1.2 Flash, a video generation and editing model, generally available on November 5. OpenAI opened Businesses in ChatGPT, where verified product feeds feed AI shopping answers, on November 10. And the Mittwald breach is a reminder to scope every token an assistant uses to a creative tool. Oakgen is our product, and we did not verify that it supports any of the new MCP drafts mentioned here.
Sources
- Mittwald, Sicherheitsvorfall am MCP-Server, Nov 7 2026 (read 2026-11-12)
- The Record, Alleged AI-aided cyberattack exploits assistant interface to breach German web host, Nov 9 2026 (read 2026-11-12)
- Corelight, The Supply-Chain Risk Hiding in Your MCP Servers, Nov 10 2026 (read 2026-11-12)
- modelcontextprotocol/servers, v2.4.0 release notes, Nov 11 2026 (read 2026-11-12)
- Anthropic, Introducing Claude Fable 5.2 and Claude Mythos 5.2, Nov 9 2026 (read 2026-11-12)
- Model Context Protocol blog, A More Predictable Release Cycle for MCP, Nov 11 2026 (read 2026-11-12)
- Model Context Protocol, SEP-3398 Release Cycle Updates (read 2026-11-12)
- Model Context Protocol blog, Exploring File Uploads and Downloads in MCP, Nov 10 2026 (read 2026-11-12)
- OpenAI, GPT-6 Cyber, Nov 5 2026 (read 2026-11-12)
- Linux Foundation, Welcomes Agent Name Service, Nov 10 2026 (read 2026-11-12)
- OpenAI, Introducing Businesses in ChatGPT, Nov 10 2026 (read 2026-11-12)
- Digiday, OpenAI's new business agents give brands a free way into the conversation, Nov 10 2026 (read 2026-11-12)
- Google, Gemini API release notes, entries of Nov 5 and Nov 10 2026 (read 2026-11-12)
- CNCF, Welcoming OpenShell to the CNCF, Nov 10 2026 (read 2026-11-12)
- Microsoft Community Hub, Durable Task extension for Microsoft Agent Framework is now Generally Available, Nov 9 2026 (read 2026-11-12)
- AWS Machine Learning Blog, Automating AWS Agent Registry updates with push-based architecture, Nov 11 2026 (read 2026-11-12)
- Microsoft Security Blog, Detecting sleeper agents hiding in AI model neurons, Nov 10 2026 (read 2026-11-12)
- Google DeepMind, Introducing AlphaProof Code, Nov 10 2026 (read 2026-11-12)
- IBM Newsroom, IBM and Microsoft announce a new AI agent platform, Nov 10 2026 (read 2026-11-12)
- Parallel, Introducing Parallel MCP 2.0, Nov 5 2026 (read 2026-11-12)
- Google Open Source Blog, Scaling AI agents with open standards, Nov 11 2026 (read 2026-11-12)
