Today's Storylines
A Founder Leaves and His Staff Object
Nvidia named an interim CEO on Thursday and its employees immediately organized to reverse the decision. A chipmaker confirmed a leak of employee records, and Anthropic said its own model moved Claude onto AMD hardware in three days.
The Five-Minute Version
- Nvidia's board named CFO Colette Kress interim CEO and Harvey Jones board chair.
- An internal suggestion box post drew more than 1,600 comments, most backing Jensen Huang.
- TSMC told the SEC that employee data surfaced online from a cloud provider's systems.
- Taiwanese press reports put the leak at roughly 46,000 records, with a 3-bitcoin demand.
- Anthropic says its Mythos model ported Claude to AMD MI355X GPUs in about three days.
- Chicago Public Schools will drop Google Search before it accepts mandatory Gemini.
- Notion said the Fireworks AI breach exposed AI chat transcripts in under 1% of workspaces.
- Advisories for 17 open-source AI tools hit 423 in 2026, up from 156 in all of 2025.
- One in seven new npm packages pins stale round versions, a possible AI memory fingerprint.
- A new paper reports 1,000x faster training than looped models on Sudoku and maze puzzles.
Nvidia's Staff Petition for Jensen Huang's Return
Colette Kress Takes the Interim Job
Nvidia's board announced Huang's resignation on Thursday morning, November 12. The board named chief financial officer Colette Kress as interim CEO. It also appointed former Synopsys CEO Harvey Jones as board chair. Huang, 63, had led Nvidia since he co-founded it in 1993. Yesterday's roundup covered the board meeting that preceded the exit.
A Suggestion Box With 1,600 Comments
A longtime Nvidia engineer posted to an internal suggestion box before the resignation. The post asked the board to weigh employee sentiment before acting. It has drawn more than 1,600 comments since, WIRED reported. Several commenters asked the board to find a way to reinstate Huang. One wrote: "If you believe in the mission, bring back THE boss."
A Trillion Dollars in Market Value
The crisis has cost Nvidia about $1 trillion in market value, according to WIRED. The stock was already on a six-week slide before the resignation. Lawmakers and the FBI have opened investigations. The affair reports also revived questions about export controls on Nvidia chips sold in Asia. The spy probe started the slide.
What the Board Has Not Explained
Many employees expected the board's investigation to finish before any leadership change. Instead, Huang left as the inquiry began. Staff are now asking why the board skipped that step. Nvidia and Harvey Jones did not respond to WIRED's requests for comment.
TSMC Confirms Employee Data Leaked From a Cloud Vendor
What TSMC Told the SEC
TSMC said Thursday that personal data on current and former employees appeared on an external website without authorization. The company filed the disclosure with the SEC as a Form 6-K. Chief financial officer Wendell Huang signed the statement. TSMC said the data "has been verified to match data stored in the system services of a cloud service provider."
What Reporters Say Was Taken
TSMC did not name the cloud provider or give a number. Wccftech, citing Taiwanese press reports, said the files cover about 46,000 employee records. The reports say the data includes addresses, bank account numbers, and emergency contacts. The hackers demanded 3 bitcoin and threatened to publish the files.
No Evidence of a Breach Inside TSMC
TSMC said it found no evidence that its own systems were compromised. It also said the data is unrelated to its operations or customer information. The company is notifying affected staff and working with the cloud vendor. An outside cybersecurity firm and local authorities are also investigating.
Why the Timing Hurts
The disclosure landed in a brutal week for the company. On Tuesday, TSMC's board approved investments of up to $1 billion in Anthropic and OpenAI. On Thursday, Taiwanese chip stocks fell as Nvidia's leadership crisis spread. TSMC supplies the advanced packaging that both labs depend on.
Sources: MLQ, TSMC Form 6-K
Anthropic Says Its Own Model Moved Claude to AMD in Three Days
Mythos Wrote the Kernels
Anthropic told investors that its Mythos model wrote or ported nearly all the kernels Claude needs on AMD chips. The work took about three days with "basically no human intervention." Tom Brown, Anthropic's co-founder and chief compute officer, described the result in an investor presentation. The same work previously took months of engineering.
What the Claim Does Not Cover
The three-day figure covers prompt processing for one Anthropic model on AMD MI355X GPUs. Prompt processing is the stage where a model reads its input. The result does not cover a full migration of training or production serving. Anthropic began working with AMD GPUs earlier this year.
Why It Matters for Nvidia
CUDA is the real moat around Nvidia hardware. Porting code to AMD's ROCm stack has historically been slow and expensive. If a model can write most of those kernels, switching costs fall. Anthropic made the claim to investors ahead of its IPO, where it will face harder scrutiny.
Sources: Yahoo Finance / Bloomberg
Google Tells Schools to Take AI or Lose Search
The Ultimatum
Chris Phillips, Google's vice president for education, said K-12 schools must accept Google's AI services to keep student access to Search. He argued that Search and AI are now one integrated product. Schools that decline will show students a message saying services are unavailable. Google announced the policy at the start of November.
Chicago Says It Will Walk
Chicago Public Schools pushed back within days. A district spokesperson said CPS is "actively exploring all options to independently suppress" AI Overviews. If that fails, the district will "look to other search solutions." About 30 parents, students, and educators protested outside Google's Chicago office.
Seven Cities Protested on Wednesday
Rallies took place in New York, Los Angeles, Chicago, Boston, Portland, Boulder, and Durham. Parents and students carried signs reading "A.I. Gets an F" and "Stop stealing our imaginations." New York City already has a one-year moratorium on student-facing generative AI for preschool through eighth grade. Los Angeles has blocked generative AI on student devices across all grades.
Google's Answer Is a Tutoring Mode
A Google spokesperson said the company is testing "Guided Learning" for classrooms. The feature walks students through problems step by step instead of giving answers. That is a reasonable product. It is not a reason to bundle Search with Gemini for every district in the country.
Sources: TechSpot, Chalkbeat Chicago, Mother Jones
The Fireworks Breach Reached Notion's AI Chat Transcripts
A Nine-Day Timeline
Fireworks told Notion on November 2 that attackers had accessed a small dataset. Notion disconnected its systems the next morning and deleted its Fireworks data on November 4. On November 6, Fireworks warned that customer data may have been exposed. The final dataset arrived on November 8, and Notion contacted customers on November 9.
Fewer Than 1% of Workspaces
The exposed files included Notion AI chat transcripts used by the Insights feature. For most affected workspaces, the transcripts were unattributable. They carried no workspace name, user label, or tool call results. Notion says fewer than 1% of workspaces are affected. It has disabled Insights and stopped serving open-weight models through Fireworks. The first disclosure landed a week ago.
The API Key Problem
Notion revoked exposed API keys found in affected messages on November 11. A day later, it reported third-party keys found in the same messages to the vendors that issued them. This is the quiet danger of AI middleware. A prompt can carry a live credential into a vendor's logs.
Sources: Notion advisory
Open-Source AI Tools Nearly Tripled Their Security Advisories
423 Advisories in Ten Months
Birdyfoot counted every reviewed GitHub security advisory for 17 popular open-source AI tools. The set covers January 2023 through October 28, 2026, and totals 737 advisories. The tools published 156 advisories in all of 2025. They published 423 in 2026 through October 28.
Four Projects Own 61% of the Total
Open WebUI leads with 161 advisories. Flowise follows with 114, then vLLM with 89 and MLflow with 86. Together they account for 61% of all advisories. These are also among the most widely deployed tools in the set. Most teams install them in minutes and never inventory them again.
The Flaws Are Ordinary Web Flaws
Of 133 critical advisories since 2023, 72 allow an attacker to run code on the server. Weak or missing access control appeared in 180 advisories. Code execution appeared in 147, and out-of-scope file access in 87. None of this is exotic AI attack research. It is the same old web security debt, now holding API keys and private documents.
The Numbers Need Context
More researchers are auditing AI tools than a year ago. Several projects also dumped advisories in batches, including 48 on a single day in May 2026. Critical flaws fell from 20% of advisories in 2025 to 13% in 2026. The trend is still worth acting on. Patch these tools like any other internet-facing server.
Sources: Birdyfoot research
One in Seven New npm Packages Carries an AI Memory Fingerprint
The Tell Is a Round, Stale Version
When you run npm install, npm writes the newest exact version into package.json. A manifest that pins vitest at ^2.0.0 a year after 3.x shipped was not produced that way. Someone wrote the number from memory. Kobi Mozgori sampled 250,000 npm packages to measure how often that happens.
Staleness Jumped From 155 Days to 451
From 2019 through early 2024, 1% to 2.4% of new packages showed the stale round-version pattern each half year. In the first half of 2026, 13.7% did, with a 95% confidence interval of 13.1% to 14.4%. The median pinned dependency was about 155 days old at publish time in 2021-2023. In the second quarter of 2026 it was 451 days old.
Few Packages Are Born Current Anymore
About 28% of new packages had essentially all pins on the newest release in 2021-2023. In 2026 that figure is about 10%. The fingerprint is already fading, though. Its share in the second half of 2026 is 7.6% so far. That may reflect better model defaults and newer training cutoffs.
What the Data Cannot Prove
The dataset cannot identify the author of any single package. Timing, version choices, and package manager behavior point to manifests written from model memory. That is a strong signal, not proof. It is also a useful reminder. An AI-generated lockfile can ship a dependency with known CVEs on day one.
Sources: fossil-versions on GitHub
A 1980s Energy Rule Beats Looped Models by 1,000x
42 Milliseconds on One GPU
Benjamin Hoover, Hugh Blayney, and James Whittington trained a learned version of the Hopfield-Tank energy from the 1980s. They call it CRAM. It solves 99.996% of Sudoku-Extreme and 100% of Maze-Unique test puzzles. Training took 42 ms and 132 ms respectively on a single GPU.
Energy Descent Stops When It Is Done
Looped models iterate a fixed network many times and need backpropagation through the whole loop. CRAM instead descends on an energy function. That gives it built-in early stopping and compute that scales with puzzle difficulty. It also matches the best looped baseline with at least 282x fewer inference FLOPs.
The Authors Warn About the Benchmark
The paper's second claim is a caution. Sudoku and maze puzzles are trivially solvable, so they are poor tests of whether a reasoning architecture scales. A 1,000x speedup on a toy task does not transfer to language. The result is still a useful signal. Energy-based training deserves more attention than it gets.
Sources: arXiv 2611.17309
FAQ
Who is Nvidia's CEO now?
Colette Kress is interim CEO. She was Nvidia's chief financial officer before the board appointed her on November 12, 2026. Former Synopsys CEO Harvey Jones is the new board chair. The board has not named a permanent replacement.
Did TSMC's own network get breached?
TSMC says it found no evidence of that. The company says the leaked records match data held in a cloud service provider's systems. It says the data is unrelated to its operations and customer information. The cloud vendor has not been publicly named.
Can AI really port a model to AMD in three days?
Only for a narrow slice of work. Anthropic's claim covers prompt processing for one model on MI355X GPUs. It does not cover full training or production serving. Even so, three days versus several months is a meaningful drop in switching cost.
Which open-source AI tools had the most security flaws?
Open WebUI had 161 reviewed advisories, Flowise 114, vLLM 89, and MLflow 86. Those four account for 61% of the 737 advisories in the dataset. Most were ordinary access-control and code-execution bugs.
Why do AI-written package files pin old versions?
A model writes a version number from its training data rather than from a live registry lookup. The result is often a round, stale pin like 2.0.0. Running a real install would write the current exact version instead.
What to Watch Tomorrow
Three Threads Worth Following
Nvidia's board still has to explain the speed of Huang's exit. TSMC's cloud vendor still has to explain how employee records left its systems. And Anthropic's AMD claim will face investor scrutiny before its IPO prices.
The Pattern Behind Today
All three stories involve trust in a supply chain. Nvidia trusted a founder. TSMC trusted a cloud provider. Anthropic is asking investors to trust a benchmark it ran itself. AI infrastructure is now a chain of dependencies, and each link is a single point of failure.
Sources: WIRED, MLQ, Yahoo Finance