The Stack — November 07, 2026

Daily IT Briefing: Nov 7, 2026

Today's theme is costs coming due. The Alpine SSH flaw now has a name, but its full reach is still unmapped. A hosting provider is rebuilding its cloud from zero. Enterprise AI spending is flattening as price cuts outpace usage growth. Security vendors are paying around 50x revenue to own the AI-agent access problem.

---

Cybersecurity Alpine SSH bypass gets a name: "*sshole"

Follow-up. The mechanism and exposure checklist were covered Nov 6. This item covers only what's new.

• Nickname: The flaw is now being called "sshole." The name refers to the `` password field that musl's `crypt()` error string ends up matching.
• Scope is still officially narrow. Confirmed impact remains limited to specific Alpine Linux configurations. Reporting says other distributions may be affected, but nobody has verified that. Treat any claims of broader impact as unconfirmed until someone publishes a reproduction.
• Why other distros are a reasonable concern: The bug comes from OpenSSH's non-PAM password path running on musl. Any musl-based system that builds sshd without PAM deserves a look. Glibc-based distros with PAM enabled, which covers most mainstream setups, don't share the same `crypt()` error behavior.
• What to do now (unchanged): Set `PasswordAuthentication no` wherever you can, and audit tiny-cloud images (3.18.11–3.24.3). Watch for patched `openssh-server` packages. No CVE assignment has been reported yet.

Beget is rebuilding its cloud after a destructive attack

Russian hosting provider Beget says a cyberattack "destroyed" its cloud infrastructure, and it is rebuilding from scratch.

• Restored so far: the architecture and the management services.
• Next: The first servers should return within 1–2 days, followed by integration and testing.
• Customer data: Customers will get access to surviving backups through the control panel. That wording implies some data didn't survive, but Beget hasn't said how much was lost.
• Threat posture: Beget says it assumes the attackers may still be a risk. It is purging systems and reworking every potential weak point, including components it previously considered safe.
• Caveat: Every detail here comes from the company. There's no independent information yet on attribution, the initial access vector, or how many customers were affected.

Takeaway: This looks like the "backups are the last line" scenario playing out. If your backups sit with the same provider, in the same blast radius, you don't have a recovery plan. Keep at least one off-provider copy.

---

Semiconductors & Policy Congress summons Jensen Huang

Lawmakers have called the Nvidia CEO to answer questions about alleged ties to a person described as a Chinese intelligence asset.

• These are allegations raised by legislators. Neither the asset designation nor the nature of any connection has been publicly established.
• The summons adds to existing US scrutiny of Nvidia's China business and GPU export controls. If the hearing goes forward, expect it to be used as leverage in the broader debate over chip export policy, whatever it finds on the underlying claims.

---

AI OpenAI revises its Model Spec

OpenAI published an updated Model Spec, the document that defines how its models should behave, including instruction priority, refusals and defaults. The Spec first appeared in 2024 and has been revised several times since, so this is an incremental update, not a new initiative. The announcement is framed around "more capable and beneficial AI," but no specifics on what changed were available. Diff it against the previous version before drawing conclusions. The release drew little attention from the developer community.

---

Industry Palo Alto Networks reportedly in talks to buy Clutch Security (~$500M)

• Status: The talks are not finalized. The report rests on a single anonymous source, and neither company commented.
• Terms: about $500M in cash plus milestone payouts.
• What Clutch does: It secures AI agents' access to company systems, which is the machine-identity problem that grows as companies deploy more agents. The startup is three years old. It raised a $20M Series A in January 2025 at an $85M valuation and is reportedly near $10M ARR.
• Multiple: That works out to about 50x ARR. Coverage calls this typical for AI security and points to Upwind reportedly turning down a Datadog offer at about 40x. Treat that as market narrative, not an established benchmark.
• Palo Alto's run: This would be the company's seventh acquisition in its recent dealmaking streak. Others cited include Chronosphere ($2.95B), Console ($500M), Embrace ($325M) and Koi ($231M). One note: Chronosphere was originally announced at about $3.35B, so the lower figure may reflect a different accounting of the deal terms.
• The category is consolidating fast: Cyera bought Oasis Security, a direct Clutch competitor, for $1B. Cisco reportedly acquired Astrix for about $400M. Agent and non-human identity security is becoming a standard platform feature.

---

AI Market Enterprise AI spend is flattening while usage keeps rising

Corporate-card data from Ramp shows a gap opening between token volume and token spend:

• Spend growth: Spending grew only 1.5% across August–September, compared with 42% month-over-month in July. Spending picked up again in October, rising 8.9% from Sep 23 to Oct 23. Volumes kept climbing throughout.
• Per-employee monthly spend:

| Tier | Monthly spend per employee |

|---|---|

| Top 1% of firms | just under their summer peak of ~$10K |

| Top 10% | $600–$1,000 |

| Median | $12–$15 |

• Reasons given:
• Price cuts: OpenAI halved API prices for GPT-6 Sol and Luna. Anthropic cut pricing on Fable 5.1 and Opus 5.5 and says this reduced its revenue growth by about $600M.
• Enterprise discounts.
• Cheap open models from Meta, Nvidia, and Chinese and US open-model providers.
• Model routers such as Jev that send simple tasks to cheaper models.
• Companies imposing internal budgets and default settings to control costs.
• Concentration risk: AI spend is concentrated among VC-backed tech firms, so a slowdown could hit many of them at once.
• Caveats:
• The data covers Ramp's customer base, not the whole market.
• The economist interpreting it, Ara Kharazian, writes a series called "Cracks in the AI Thesis," so his skeptical lens is openly stated.
• Valuation context (reported):
• Anthropic's potential IPO valuation has reportedly fallen from about $2T in early October to $1.2–1.3T, and it may receive a high-yield credit rating.
• OpenAI reportedly lowered its proposed valuation from $1.4T to $1.25T and trimmed its fundraising target by about $10B.
• What's next: Personal agents from OpenAI, SpaceXAI, Meta and startups like Instinct are being pitched as the next growth driver after coding agents. Kharazian doubts they'll be productive enough to bring back hypergrowth.

Takeaway for engineering teams: Routing and model tiering are now mainstream ways to control costs. If you aren't sending easy calls to cheaper models, you're likely paying more than your peers.

Google: schools can turn off Gemini, but not AI in Search

Schools can disable the Gemini assistant while keeping Google Search. However, the AI-powered features inside Search cannot be turned off. Critics argue these aren't the choices schools want, but that's an editorial judgment, since no data on schools' preferences was presented. The hard fact is that any school using Google Search gets AI search features, whether it wants them or not. Districts with AI-restriction policies should check whether those policies technically cover Search.

Anthropic study: how researchers actually use Claude

This is vendor research about the vendor's own tools, written by Anthropic economists. The methodology is detailed, but keep the source in mind.

Data

• 207,049 consumer-plan sessions from Aug 2 to Sep 30, 2026: about 129K from Chat/Cowork and about 78K from Claude Code, plus a supplemental sample from Claude Science.
• An LLM classifier sorted sessions into 7,262 research tasks across 34 fields. Anthropic says only category labels were kept.

Usage by field

• Formal sciences lead in use relative to researcher headcount. Medicine and lab-based physical sciences trail.
• Computer science makes up 4.3% of researchers but 32.7% of Claude Code sessions.
• AI/ML makes up 1.2% of researchers but 15.2% of Claude Code sessions.

Usage by task

• Data analysis is the largest category: 33.7% of Claude sessions and 48.1% of Claude Code sessions, versus 27.6% of researcher time.
• Writing is 32% of sessions, versus 16% of researcher time.
• Ideation and data gathering are underused relative to the time researchers spend on them, even though surveyed scientists rank them as the most important tasks for discovery.
• On Claude Science, ideation roughly doubles to about 8% of sessions.

Usage tracks capability

• The authors built an LLM-judged capability score using pairwise comparisons ranked with a Bradley–Terry model, the method behind Elo-style ratings.
• Tasks in the top 20% by this score get 2–4x more use than researcher time would predict.
• The scores correlate with how well a task suits reinforcement learning (r = 0.78).
• Caveat: Both the capability scores and the time estimates are LLM-generated, so some correlations may reflect how one model family judges tasks.

Acceleration scenarios (illustrative, not forecasts)

| Scenario | Assumption | Projected output gain |

|---|---|---|

| 1 | Wide adoption of current tools | ~1.35x (arts) to ~2x (CS, statistics) |

| 2 | AI fully automates 75% of non-physical research steps | ~8x in CS; 2–3x in bench sciences |

| 3 | AI fully automates 100% of non-physical research steps | 15–16x in low-physical fields; 3–4x in biology/chemistry |

• In Scenario 3, physical lab work becomes the bottleneck for bench sciences.
• The results depend heavily on assumed costs of $30/hour for AI versus $95/hour for a researcher. The authors say halving AI costs would roughly double the ceiling in fields without physical bottlenecks.

Survey of 528 scientists

• Respondents were self-selected active AI adopters, mostly in the life and health sciences, which likely skews expectations upward.
• About 40% expect AI to run full research projects autonomously by 2030, rising to 64% by 2035. 16% say never.

Risks the authors acknowledge

• Adoption lagging behind capability.
• A flood of papers that outpaces verification.
• Weaker human oversight of research.
• Biosecurity concerns.
• Effects on researcher job satisfaction.

Treat with caution: The report's introduction cites a "potential proof" of a Millennium Prize problem and progress on Erdős problems. Those claims come largely from AI labs' own posts and remain unverified by independent mathematicians.