Scan connected GitHub pushes for security flaws

Check code changes for missing access controls

Vercel Security Review entered public beta on November 2, scanning every push to connected GitHub repositories, including direct production-branch pushes. Your coding agent can pull findings through the CLI, or you can give Vercel Agent permission to validate and push fixes.

• Reviews inspect changed code and its surroundings, trace how it can be reached, and check existing protections before reporting vulnerabilities.
• You can write plain-language policies, such as requiring customer-data endpoints to check that the requester owns the data.
• The beta is available to Pro and Enterprise teams. Security reviews are free until November 10, 2026; fixes made with Vercel Agent are billed at the Vercel Agent rate.

What it means Try it if you ship a GitHub-connected Vercel app. Enable it in Vercel Agent Settings and start with a policy covering access to customer data.

Source: vercel.com

Siri AI previews custom actions across your app

Apple’s November 3 developer preview lets any app expose custom actions to Siri AI through App Intents. That moves beyond predefined action categories: developers can teach Siri to carry out tasks such as checking deliveries or placing orders.

• New skills let you combine several app actions into one experience for complex requests.
• Siri AI can surface any entity in the Spotlight semantic index, rather than only entities matching an existing schema.
• Access starts in the 27.3 operating-system betas. Customer shipping follows in a few months, with App Store submissions opening in spring.

What it means Try the preview if you build an Apple-platform app with useful customer actions. Start by exposing one existing task before combining actions into a skill.

Source: developer.apple.com

Let a small model handle agent-memory judgments

Hindsight released three open-weight memory models and hosted inference on November 3. Its decision model handles questions such as whether a fact is new or evidence is sufficient, leaving the text-writing work to an LLM.

• In Hindsight’s system evaluations, adding the decision model reduced LLM calls from 4.5 to 3.1 per case. Decision requests took 167 ms at the median; the LLM calls they replaced took 1 to 7 seconds at the median, depending on the model.
• The hosted Playground includes editable examples and exports requests as code. New accounts receive $5 in credit, and the models can also run outside Hindsight.
• Cost fell for five of seven tested LLMs, but rose for the two cheapest because the decision model added more cost than it removed.

What it means Try it if your memory system repeatedly asks an LLM small yes-or-no questions. Start with the Playground’s decision example before changing your writing model.

Source: hindsight.vectorize.io

Quick hits

• Anthropic released FlashProve, an open-source prototype for proving which model produced a response, though generating proofs still carries substantial inference overhead.
• SemiAnalysis launched GDPx, a benchmark using rich work environments across selected high-value domains; its best model scores 12%, with safety refusals affecting some results.
• Cohere expanded Model Vault to third-party open models on managed, dedicated infrastructure, including encrypted vaults, with GPU-hour pricing and an OpenAI-compatible API.
• HeyGen Voice Turbo is free on OpenRouter until November 30, with no credits needed, 39 languages, and up to 5,000 characters per request.