AI News Today, Nov 9: Anthropic Browser Example Can Expose Passwords
A reported password exposure in Anthropic browser example code, the Opus 5.5 drift debate, Korean AI hardware and serving plans, agent tools, Anthropic’s financial filing, and Korean agent security partnerships. This audio was created with Boson AI's Higgs Audio -- https://www.boson.ai/higgs-audio
Listen on Spotify · Watch on YouTube · Pocket Casts
A browser example exposes a password field
Eris: <|prosody:expressive_high|>A public report says Anthropic's browser-toolset example can put an unlabeled password field's value into the text sent back to an AI agent. The report concerns example code in the Claude Quickstarts repository; it doesn't establish a breach of Anthropic's hosted products or that anyone stole a password.
Vestra: The reporter supplied an offline reproduction. A browser agent needs a description of the page so it can choose what to click or fill in. According to the report, when the reader tries to name an input and finds no label, it can fall back to the input's value. For a password field, that means <|prosody:pause|>the value itself can appear in the tool's response.
Eris: <|emotion:surprise|><|prosody:expressive_high|>The browser can show dots on screen and still hand the actual text to the agent? That's the detail that makes this easy to miss: the sensitive information is in the description, not visibly displayed on the page. <|prosody:expressive_high|>That worries me. How much of the report has been verified?
Vestra: <|prosody:expressive_high|>The Python source contains that value fallback, but the reported reproduction wasn't independently rerun for this story. The issue also reports a similar problem in the TypeScript example; that implementation wasn't separately checked. Anthropic describes the toolset as minimal example code, not production code.
Eris: The example-code label doesn't reassure me much here. If a developer copies an example into an application, the tool result can become part of the model's context and potentially its logs, depending on how the application handles it. A useful test would put a dummy password in both labeled and unlabeled fields, then inspect the returned text.
Vestra: <|prosody:expressive_high|>And this is separate from prompt injection, where text on a page tries to make the agent follow an unwanted instruction. Here the reported failure is accidental disclosure while describing the page. The issue was open when checked, so the current code and issue are the places to look for a subsequent fix.
What the Opus monitor can and cannot see
Eris: An independent project called LiveNerf reports no qualifying change in Claude Opus 5.5's accuracy across three completed test windows through November eighth. At the same time, Claude Code users have reported that their coding experience got worse. <|prosody:expressive_high|>Those findings can coexist because they're measuring different things.
Vestra: LiveNerf repeatedly asks the same set of academic questions, grades the answers by exact match and compares them with an initial baseline. It also uses a separate control model. Its rule for calling a change requires evidence across consecutive windows and checks that the control hasn't moved in the same direction. But how much of a coding session does that cover?
Eris: <|prosody:expressive_high|>It can help detect a substantial change on that particular question set. It doesn't ask the model to navigate a repository or repair code over a long session, and its own validation didn't establish that the test would reliably detect the difference in a trial using a different model from the same family.
Vestra: One Claude Code user separately reported that correction or retraction markers rose from roughly one answer in twenty to roughly one in four around October nineteenth. <|prosody:expressive_high|>That's a concrete observation, but <|prosody:pause|>a correction marker isn't a direct count of errors. The underlying logs weren't independently audited, and the reporter also recorded changes in effort settings and session material during the investigation.
Eris: <|prosody:expressive_high|>I'd find that frustrating if I were experiencing the problem: a stable academic test doesn't rule out a coding-specific regression. But the personal report can't tell us whether the model, the surrounding service or something in the workflow caused it either. What would help pin that down?
Vestra: <|emotion:determination|>A stronger follow-up would repeat representative coding tasks with preserved starting repositories, matching settings and success criteria chosen in advance. The available evidence doesn't establish a provider-side change in the disputed period.
A Korean hybrid AI rack is planned for 2028
Eris: NVIDIA, SK Telecom and Korean chip designer Rebellions have agreed to develop and validate a hybrid AI rack using NVIDIA GPUs and Rebellions' R200 processor. NVIDIA expects R200 systems to be ready for deployment in <|prosody:pause|>2028; the agreement doesn't establish an operating rack today.
Vestra: <|emotion:enthusiasm|>The proposed division follows two stages of generating an answer. First the system processes the input prompt. Then it generates the response in pieces called tokens. The partners plan to put prompt processing on NVIDIA GPUs and generation on Rebellions' neural processing units, or NPUs, linked through NVIDIA's interconnect and rack architecture. I like that specificity: a different processor for each stage.
Eris: That lets a Korean-designed chip take on part of the work inside a system that still depends on NVIDIA technology. It's a more specific picture of what the companies call sovereign AI than complete hardware independence. <|prosody:expressive_high|>But does splitting the work itself have a cost?
Vestra: <|sfx:humming|>Hmm, the split could be useful if each type of chip handles its stage efficiently, but moving the intermediate state between them <|prosody:pause|>also takes resources. The announcements don't provide measured throughput or power results for this system. SK Telecom separately reports an existing Blackwell GPU cluster and has a separate AI Cloud plan; neither establishes that the R200 rack is running.
NVIDIA's serving recipes for Korean models
Eris: NVIDIA has published Dynamo serving recipes for four Korean AI models: A.X-K2, K-EXAONE 2.0, Solar Open2 and Motif-3. The aim is to give operators configurations for running the models on NVIDIA B200 hardware.
Vestra: <|emotion:enthusiasm|>A serving recipe collects choices such as how requests are scheduled and how computation is distributed. It gives a team a starting point for running a model as a service.
Eris: I'd welcome that starting point. Are all four recipes at the same stage?
Vestra: The checked index lists deployment and benchmark configurations for A.X-K2 and K-EXAONE 2.0. Solar Open2 has a four-GPU configuration but no benchmark manifest listed there, while Motif-3 is marked <|prosody:pause|>experimental.
Eris: <|prosody:expressive_high|>A configuration can save work, but it isn't a report that a customer has successfully deployed it. NVIDIA also claims a performance improvement, but its announcement doesn't identify the comparison or workload, so we can't tell what it would mean for a particular operator. <|sfx:sigh|>Uh, that's the comparison I'd want before getting excited about the performance claim.
Vestra: <|prosody:expressive_high|>And the K-EXAONE 2.0 recipe is distinct from the 2.5 API access in NVIDIA's separate security announcement. Calling a hosted model through an API is a different proposition from running a model yourself.
Agent skills and browser tools attract attention
Eris: A November ninth GitHub Trending snapshot shows a burst of attention for three existing projects: Anthropic's skills repository, agent-browser and Claude Quickstarts. The snapshot counts people starring repositories; it doesn't tell us how many teams use the tools or whether their agents finish tasks reliably.
Vestra: They cover different parts of a workflow. A skill is a package of instructions and optional resources an agent can load for a task. Agent-browser provides a way to inspect a page, act on it and inspect the result. Quickstarts offer sample applications showing how to connect models and tools.
Eris: <|emotion:enthusiasm|>Put those together and an agent can receive a reusable procedure and a way to act on a website. I can see the appeal of that combination. <|prosody:expressive_high|>But the portable instruction package doesn't carry the same permissions everywhere. The host still decides what commands, credentials and network access the agent gets. What protections does agent-browser turn on by default?
Vestra: Agent-browser's security documentation says important navigation, action and output controls are <|prosody:pause|>opt-in. Its maintainers also describe saved flows as experimental. A flow recorded against one page can fail when that page changes, and an agent may need a fresh page snapshot after an action.
Eris: <|prosody:expressive_high|>That opt-in detail makes me cautious. That's useful context for the earlier password report too. The report concerned a different browser example, not agent-browser, but both stories make the details of what an agent sees and can do worth checking before relying on a workflow.
Anthropic's revenue and the AI investment debate
Eris: Anthropic reported 33.2 billion dollars in revenue and a 1.3 billion dollar operating loss for the first nine months of 2026 in its amended securities filing. It also described <|prosody:pause|>nearly 900 billion dollars in long-dated compute and infrastructure commitments. <|prosody:expressive_high|>That's a company with substantial sales and substantial obligations at the same time.
Vestra: The filing says more than 11,900 customers spent over 100,000 dollars in the trailing twelve months. <|emotion:enthusiasm|>That is evidence of demand. <|prosody:expressive_high|>The operating loss is calculated under standard accounting rules after operating costs, while the long-dated commitments describe future obligations, not cash already spent all at once.
Eris: In an essay arguing against a simple AI bubble diagnosis, Matteo Raso points to revenue growth and argues that companies can earn profits even without a permanent monopoly. <|prosody:expressive_high|>That's a real challenge to the idea that the entire buildout must be speculation. But is that enough to make the investment case reassuring?
Vestra: <|prosody:expressive_high|>Sales alone don't establish a good return on the money invested. Compute is only one expense; energy, equipment replacement, financing and competitive pricing also matter. Even a service people value can produce disappointing returns for the companies or investors funding it.
Eris: Those future obligations are the part I'd keep watching. The practical questions are when those commitments come due, how much capacity is actually used, and whether future cash flows can support the costs. One company's filing can't settle the valuation of the entire industry, but it gives us concrete figures to follow.
Korean agent security partnerships are taking shape
Eris: NVIDIA says Korean partners are exploring and integrating security tools for AI agents. Hyundai Motor Group is exploring NVIDIA's NemoClaw blueprints and OpenShell, while AIM Intelligence is integrating its Starfort platform with OpenShell and considering a preliminary proof of concept in the public energy sector.
Vestra: The distinction between those activities matters. NVIDIA describes OpenShell as providing a sandbox, an environment that can restrict what an agent process is allowed to do, along with policy controls.
Eris: What is Starfort intended to catch alongside those restrictions?
Vestra: <|prosody:expressive_high|>NVIDIA says Starfort is intended to detect malicious instructions and data leakage. Restricting actions and detecting suspicious content address different parts of the problem.
Eris: <|prosody:expressive_high|>I'd like to see how those protections work together. Has the energy-sector test actually launched?
Vestra: The announcement says AIM is <|prosody:pause|>considering a preliminary proof of concept. It doesn't establish a launched pilot, a production deployment or independent results showing what attacks the combined tools catch or miss.
Eris: The same announcement says LG AI Research is opening API access to K-EXAONE 2.5, and that its development used datasets including seven million synthetic Korean personas. <|prosody:expressive_high|>Those are generated profiles, not a claim that seven million identifiable people were individually represented. API access also doesn't establish that the model's weights are available to download.
Follow the stories
Eris: <|prosody:expressive_high|>Find the sources and follow these stories every day at Ground Truth, groundtruth dot day.
Vestra: <|emotion:enthusiasm|>Follow AI in Detail for more. What would you test before giving an agent access to a browser? Tell us in the comments. <|emotion:contentment|>Thanks for listening.