Tencent's Hy4 adds visual understanding and computer use, with weights due within days, and leaves exploit-development data out of training. Menlo puts frontier labs at 69% of enterprise AI deployment spending.
Koda editorial team · 5 November 2026 · 6 min read
Listen · 19 min
Today: Scope your agents' access before you scale them. The steps
Tencent released Hy4 on Nov. 4, adding visual understanding and computer use; weights follow in the coming days. On Tencent's blind test of 579 financial tasks it scored 3.04, ahead of DeepSeek-V4.1-Flash-1017 (2.97), Kimi K3.1 Pro and GLM-5.3 (2.68 each). Reuters reports Tencent withheld exploit-development and penetration-testing data from training.
Why it matters. Because Tencent graded Hy4 on its own blind test, finance teams weighing a switch from DeepSeek-V4.1-Flash-1017 should rerun those tasks themselves once the weights ship.
Go further: today's paper, DoGNAVY-Exploit: Harnessing Parallel Open-Weight Agents for Stage-Aware Vulnerability Exploitation (arXiv, 3 Nov).
ChatGPT's Chat and Work tabs were separate; OpenAI is now merging them, with ChatGPT and Codex drawing from one usage pool, after Claude merged Chat and Cowork.
Why it matters. ChatGPT users who split work between the app and Codex will now draw from one shared usage pool, so heavy Codex use can eat into chat capacity.
OpenAI announced plans to acquire Pierre Computer Company, Inc., the same week it showed GPT-6 Astra designing an AI device.
Why it matters. With no price or product line disclosed, investors cannot yet judge whether OpenAI is buying Pierre Computer Company for the hardware talent behind its AI device.
Redis expanded Redis Iris, its real-time context engine for AI agents, on Nov. 5. It now spans six modules from Intent Router to Agent Mesh, as Snowflake adds central controls for agents.
Why it matters. Retire separate agent memory and routing tools for Iris only if your apps already run on Redis; teams governed in Snowflake should weigh its new agent controls first.
Menlo's yearly enterprise AI report estimates that frontier labs now capture 69% of enterprise AI deployment spending. Agents are expanding the market, with new budgets funding 55% of the extra AI spend. Startups still take 61% of application spending once the labs' own apps are excluded.
TRM Labs details the Binance hack: the attacker tested code on three wallets, then used EIP-7702 to convert a Binance hot wallet into a sweeper, pre-signing 50 authorizations so at least one would stay valid. The FBI and three firms, including TRM, attributed the $6B1 hack to North Korea, an attribution Kim Yo-jong rejects.
Suspected cyberattacks raised fridge temperatures at more than 40 European supermarkets, spoiling food. The reported harm is physical, and the attacks remain suspected.
Republicans went into this week's midterms holding both chambers; Democrats now control the Senate and the House. Trump said he will not change course and warned that impeachment would bring severe consequences.
Why it matters. With Democrats holding both the House and the Senate, Trump's agenda will need their votes to pass, and an impeachment fight could crowd out legislative time.
The S&P 500 gained 1.58% while WTI crude fell 8.41%, so a steep oil drop did not weigh on equities; Bitcoin rose 4.10% and Ether 6.63%, yet the crypto Fear & Greed index sat at 50 (Neutral).
S&P 500
7,688.62
+1.58%
Nasdaq
25,736.51
+1.44%
Bitcoin
$80,517.68
+4.10%
Ethereum
$2,423.47
+6.63%
Crude Oil (WTI)
$88.01
-8.41%
Crypto Fear & Greed
50 / 100
Neutral
Levels from Yahoo Finance2, 4 Nov and 5 Nov; alternative.me3, 5 Nov.
Security · Koda score 7.0 / 104
AgentKit moves the per-user OAuth and permission scoping that usually stalls agents between prototype and production behind a single MCP endpoint, and its free plan is large enough to prove that on a real workload. The open question is track record: independent production reports have not surfaced yet, and the audit-grade controls live on the custom-priced Enterprise tier. Teams whose agents work inside their customers' own SaaS accounts should pilot it now.
Capability is arriving fast, and access control is what keeps it safe to use.
Tencent leaving exploit-development and penetration-testing data out of Hy4 training is a useful signal, yet TRM's account of the Binance hack shows that an attacker with patience and a few test wallets can do real damage anyway. As frontier labs take a growing share of enterprise AI spending and agents widen what that money buys, the permissions you grant matter as much as the model you pick. Start with one agent, one narrow scope and a log you actually read, then widen access only when that holds up.
Every story links to its outlet. Below, by source, are the 8 figures we checked: 0 verified, 7 reported and 1 estimated.
Verified confirmed by an independent searchReported as published by the named sourceEstimated approximate, in the source or in our check
Signal 223 · 5 November 2026 · 14 sources · How every number is checked · Corrections
222 editions so far, one a day. Unsubscribe anytime.
Forward this to one operator you work with. Your referral link is in every email; milestones at koda.community/refer.