The Stack — November 11, 2026

Daily IT Briefing

Today's theme is proof versus promise. DeepMind machine-checked the security of Signal's real compiled code, while most of Google's own Gemini 4 Carbon claims are still self-reported. Anthropic's IPO filing puts hard numbers behind a trillion-dollar story. Several incidents trace back to trust nobody verified: an AI agent allowed to push without asking, a vendor holding chat logs, and cloud customers who assumed someone else had backups.

---

Lead: "*sshole" SSH flaw is now exploited in the wild

Follow-up. The mechanism, affected Alpine tiny-cloud images and mitigations were covered Nov 6–7. This item covers only what's new.

• What changed: The SSH access flaw is now being actively exploited. It is described as a serious threat to Internet security.
• What's still missing: Today's report gives no CVE, no list of affected versions and no patch status.
• Confirmed impact so far has been limited to specific Alpine Linux (musl, non-PAM sshd) configurations.
• "Serious threat to Internet security" is a broader framing than anything verified. Exploitation in the wild doesn't by itself mean the flaw reaches beyond Alpine.
• Why it still deserves urgency: Alpine is common in cloud images, containers and embedded devices. Those systems are often internet-facing and rarely patched.
• What to do today:
• Set `PasswordAuthentication no` wherever possible.
• Inventory any Alpine or musl hosts exposing sshd.
• Check auth logs for unexpected successful logins.
• Apply patched `openssh-server` packages as soon as vendor advisories confirm them.

---

AI / ML DeepMind's AlphaProof Code formally verifies Signal's implementation

DeepMind says its new multi-agent verification framework proved key security properties of the compiled code behind the Signal protocol, not just the protocol's design. Signal's protocol also underpins Google Messages.

• What was proven: Properties include message protection both before and after a temporary device compromise, known as forward and post-compromise security.
• How it worked:
• Humans and models translated Signal's security goals into formal specifications, and a human reviewed every specification.
• Agents running on Gemini 4 Carbon generated more than 6M lines of Lean proofs.
• About 1% of the work was flagged for human review. Lean machine-checked the rest.
• The bug test: Researchers reintroduced two previously fixed real bugs into an isolated copy of the code. The system produced machine-checked proofs that those versions were insecure. This is a meaningful check that the specifications have teeth.
• Speed: Roughly four weeks, versus years for expert teams.
• What's being released: The verification artifacts and a technical paper are being open-sourced. Signal staff gave feedback on the methodology.
• Caveats:
• "First-ever" is DeepMind's framing. Signal's design has been formally analyzed before. Verifying the implementation at this scale is the real novelty.
• A proof only guarantees what the specification says. Independent review of the released specifications is what will decide how much this result is worth.

Google releases Gemini 4 Carbon

Carbon is Google's new top-tier model for long-horizon agentic work, hard coding and debugging, security research and scientific reasoning. Google still recommends the recently released Gemini 4 Argon for most tasks, because Carbon spends more tokens.

Access and pricing

• Available through the Gemini API (AI Studio) and Gemini for business at an introductory $2 / $10 per million input/output tokens, the same price as Argon.
• Rolling out to Google AI Ultra subscribers in the Gemini app, AI Mode in Search, and Antigravity.
• Cybersecurity defenders have had access for two weeks through Google's "Fairwind Program."

Agent tooling

• A preview of `/swarm` in Antigravity turns one prompt into a coordinated team of agents.
• Carbon takes the reasoning-heavy roles, such as architecture and auditing, while cheaper models and adversarial verifiers handle the rest.

Google's claims

• Benchmarks:
• #1 on CursorBench 4.0, WANDR and AutomationBench, at more than 2x lower cost per task than the next-best external model.
• #2 on the new Multimodal Knowledge Agent (MKA) benchmark co-launched with Artificial Analysis.
• Security:
• Leads SEC-bench Pro, ExploitGym and CWE-bench v1.
• On Google's internal Project Fortify benchmark: 100% scanning recall and 95% triage precision.
• Google's vulnerability team confirmed two critical bugs in a popular open-source project. Disclosure is pending.
• Wiz reports finding 0-days in two major SaaS providers in under two hours.
• Science: Google reports a 40x average increase in protein homologs found across seven low-homolog CASP17 families. Broader benchmarking is still underway.
• Safety:
• Per-attempt breach rate under adaptive red-teaming of 0.8%, versus 3.1% for Argon.
• No new universal jailbreaks found in 132 hours of external testing.
• 0% attack success on Gray Swan's prompt-injection benchmark. Google still concedes prompt-injection robustness needs work.

How to read it

• Almost every number is vendor-reported, and several come from internal or partner-co-developed benchmarks.
• The cost comparisons depend on which competitors Google chose.
• The offensive-security results also cut both ways. A model that finds SaaS 0-days in hours is useful to attackers as well as defenders. That makes the gated Fairwind access and the red-team results worth independent scrutiny.

---

Industry Anthropic sets IPO terms: up to ~$1.4T valuation

Follow-up. The mid-November Nasdaq plan was flagged Nov 8. Today brings the actual terms.

The offering

• 825M Class A shares at $70–78, raising $57.75–64.35B. Underwriters, including Goldman Sachs and Morgan Stanley, can buy up to 123.75M more.
• Listing on Nasdaq as "ANT", reportedly around Nov 19. Up to 20% of the offering is expected to go to retail investors.
• A separate $26B private placement of non-voting Class N shares at the IPO price goes to AMD, Broadcom, Google, Micron, Microsoft, Nvidia and TSMC. Google and Nvidia are putting in $10B each.
• Estimated net proceeds: $84.6–93.7B.

Valuation

• About $1.404T fully diluted at the top of the range.
• That is up from $965B in May, but below the roughly $2T reportedly targeted earlier and the ~$1.5T investor talk noted last week.
• For comparison, OpenAI was reportedly valued at $1.25T after its recent raise.

What the filing reveals

| Metric | Figure |

|---|---|

| Run-rate revenue (end of Oct) | $81B, up ~$10B in one month |

| Q3 revenue / 9-month revenue | $17B / $33.2B |

| 9-month net loss | $104B |

| Compute and infrastructure commitments | $900.9B |

| Cash and short-term investments | ~$132B |

Governance

• Anthropic is a public benefit corporation. Founders' Class F shares carry 50.1% of voting power, and the Long-Term Benefit Trust elects a board majority.
• Public shareholders will therefore have little influence.

Other notable details

• Seven co-founders are each selling about 3.4M shares, worth roughly $250M apiece at the midpoint.
• The filing uses "superintelligence (SI)" interchangeably with "AI." It cites a September executive order directing federal agencies to adopt that term, which may signal positioning toward the administration.

Takeaway

• Revenue growth is steep. But the nine-month loss is roughly 3x nine-month revenue, and compute commitments approach $1T. No breakdown of the loss was given.
• The buyers in the private placement are largely Anthropic's own suppliers. That circularity matters when judging how independent the demand for this deal is.

---

Security: AI tooling and the supply chain Claude Code reportedly committing secrets to public GitHub repos

• The report: Claude Code is reportedly pushing passwords and API keys into public repositories.
• The apparent trigger: The "Do not ask again" permission option. Once a user selects it, later actions such as committing and pushing files with credentials can run without confirmation.
• What's unknown: How widespread this is, and whether it's a tool flaw, a user configuration problem or both. Anthropic's response wasn't included in today's reporting.
• What to do:
• Don't grant blanket approval for `git push` or other network-facing actions.
• Keep `.env` and credential files in `.gitignore`.
• Enable GitHub push protection and secret scanning, and add a pre-commit scanner such as gitleaks or trufflehog.
• Rotate any key that has ever been in a public repo, even if the commit was later removed.

Fireworks AI breach exposes some Notion AI chat transcripts

What happened

• A security incident at Fireworks AI, an AI inference provider, affected fewer than 1% of Notion workspaces.
• The exposed data came from Notion's "Insights" feature, which classifies how customers use AI.
• What Notion says the data contains: Chat transcripts with no user, workspace or company labels, and no tool-call results such as page content.
• What it can still contain: Anything users typed into the chat itself, which may include sensitive material.

Timeline

• Notion cut all connections to Fireworks and deleted its data there by Nov 3.
• Fireworks notified customers of possible data access on Nov 6 and confirmed the dataset on Nov 8.
• Notion acted on its own suspicions before Fireworks' formal notice.

Notion's response

• Insights is disabled.
• Notion no longer serves open-weight models through Fireworks.
• Training experiments on opt-in LEAP data have been halted.

For affected customers

• Owners can review the exposed data on a "Security incident review" page inside Notion.
• Enterprise owners also get a CSV with user attribution added. That attribution was not part of the leak.
• Action: Rotate any credentials pasted into Notion AI during the affected window.

Caveat: The scope figures come from Notion. Fireworks' own disclosures may show broader impact across its other customers.

Pattern: Both incidents above are cases of AI tooling widening the attack surface quietly, through auto-approved agent actions in one case and an inference subprocessor holding chat logs in the other.

---

Infrastructure Google adds two TPU 8 variants

These are new variants in the eighth-generation TPU family Google launched in April, not a new product line.

• TPU 8tx: Co-designed with AMD and based on the TPU 8t.
• Targets confidential training and inference, with hardware isolation of data and model weights while they're in use.
• A custom inference network lets it run reasoning alongside training. One example is distilling small models on proprietary data without moving that data between devices.
• TPU 8i Max: Two TPU 8i inference chips in one package, doubling memory, compute and bandwidth to support longer contexts at query time.
• Context: This fits the broader push by hyperscalers and AI labs to build their own silicon and reduce dependence on Nvidia.
• Some coverage linked the launch to Nvidia's current CEO controversy (covered yesterday). There's no demonstrated connection between that and Google's chip roadmap, so treat the link as editorial framing.

Yandex Cloud recovers 97% of customer data after drone strikes

What happened

• Drones struck Yandex data centers in Sasovo (Oct 8), Kaluga (Oct 9) and Vladimir (Oct 11).
• Yandex's own services and third-party services on its cloud were disrupted. Most were restored by late October.

Recovery figures (company-reported, not independently verified)

• 97.16% of customer data has been restored.
• 2.84% is permanently lost, because of critical hardware damage and because the affected customers had no backups.
• Yandex says customers who used its backup tools lost nothing.

Changes Yandex is making

• Backups are now enabled by default on new VMs. Customers can opt out.
• Compute is being spread across new, independent sites in different regions of Russia, with more sites planned.

Takeaways

• Together with last week's Beget rebuild after a destructive cyberattack, this is a second Russian provider showing that a whole site can be lost, whether through cyberattack or physical attack.
• Replicas in the same region and data on a single provider aren't backups. Keep at least one copy in another region and, ideally, with another provider.