The agents are no longer a feature on top of the systems. They are the traffic the systems have to survive. That is Sunday's verdict, and every exhibit is a load test in a different register. GitHub detailed a rebuilt Git storage architecture, Project Rubicon, tested at 5,000 concurrent agents sending 7,200 pushes per second to one repository. Apiiro counted 2,539 real secrets in 1,994 public GitHub repositories, most of them saved into a Claude Code settings file when a developer clicked “Yes, and don't ask again.” Chainalysis widened its breach disclosure to names, usernames, password hashes and live tokens for all of its users, in an attack it describes as using offensive agentic techniques. Vals measured a free, downloadable DeepSeek model completing 73% of simulated network-hacking objectives against 81% for OpenAI's gated Daybreak model, at $2 to $3 a run against $17 to $46. Ramp reported corporate AI token spend growing just 1.5% across August and September, after 42% growth in July, while token volumes kept rising. People Inc. reported core sessions down 26% in the third quarter, with AI Overviews on 82% of tracked searches in its presentation and over 90% by early November on its earnings call.
GitHub: Project Rubicon rebuilds Git storage for 5,000 agents on one repository
GitHub's engineering post, published November 5 and the most-read developer story of November 7, describes the third step in a storage rebuild begun under the running service. The design, code-named Project Rubicon and started in May 2026, splits Git into immutable packs in Azure Blob Storage and a small compare-and-swap log for references, called Ref-CAS. Only the reference update needs agreement; the objects themselves are content-addressed and can be stored without coordination. GitHub says the busiest repositories today receive at most dozens of writes a second in short bursts, that one repository's daily requests grew about four times between March and May, and that it expects bursts to become a sustained rate within the next year as agents work in parallel around the clock. In internal testing the new architecture supported 5,000 concurrent agents on one repository at 7,200 pushes per second while reads kept consistently low latency. The system is in limited private preview, with a broader rollout planned early next year.
Git was designed for humans who push a few times a day, and Rubicon is the admission that that user is no longer the load case. The practitioner on the board reads this the way it deserves: as a real architecture, with the hard part named correctly. References are the contention point, packs are not, and GitHub put the consensus exactly where the contention is and nowhere else. For anyone who builds on GitHub, the consequence arrives before the rollout does. Agent-written code is about to be cheap to push at a scale review, CI, and secrets scanning were never sized for, which makes the next two items in this paper the same story from the other side.
Apiiro: Claude Code's “don't ask again” saved 2,539 real secrets into public repositories
Apiiro researchers Shmulik Cohen and Matan Giladi published on November 5 a scan of public GitHub data collected November 1 to 3. When Claude Code asks permission to run a shell command and the developer chooses “Yes, and don't ask again,” it saves that exact command, secret included, in .claude/settings.local.json inside the project folder. Apiiro examined 104,185 public copies of that file and classified 1,122 of them, about 1.1%, as holding a real secret: 1,379 distinct values in those files alone. Counting git history, shared settings files, and agent transcripts brought the total to 2,539 distinct secrets across 1,994 repositories, including 379 database passwords and 122 Supabase service-role keys, affecting 63 organizations. One organization confirmed its exposed key was live. Apiiro did not test the credentials, so the count proves exposure, not compromise, and standard scanners missed part of the haul: gitleaks flagged 564 of the 1,122 files and TruffleHog 643, while 215 were flagged by neither.
This is a design failure, not a user failure, and Lessig's chair owns the paragraph. A permission system that stores the approved command verbatim, credentials and all, in a file inside the working tree has built the leak into the approval. The developer's click was reasonable; the artifact it produced was not. The fix list is short and checkable today for any team using coding agents: search your repositories for .claude/settings.local.json and .claude/settings.json, rotate anything found, keep agent settings out of the tree, and treat a scanner's clean report as a floor, since a fifth of these files passed both common scanners. Combined with Microsoft's five-minute GitHub-to-Key-Vault case from Friday's paper, a committed secret is now best understood as a published one.
Chainalysis: password hashes and live tokens for all users exposed, products taken offline
Chainalysis, the blockchain-analysis firm, first confirmed a cybersecurity incident on October 30 and said it had found no evidence that authentication credentials or session tokens were accessed. Its November 4 updates reversed that assurance: an “on-path attack” had exposed a subset of passwords, and the company then reported that names, usernames, password hashes and live tokens for all Chainalysis users had been exposed to an attacker. The company, which describes the intrusion as an external actor using offensive agentic techniques, took Reactor and Data Solutions offline, and on November 4 also took the KYT transaction-monitoring interface and API, address-screening products, and the login page itself offline. In its November 6 update it said KYT and Address Screening were being restored in phases, only for customers who register trusted IP addresses for an allowlist, and that every user will need a new password and new API keys. Chainalysis still reports no evidence that investigation data was accessed or that its attribution data was manipulated, and says the incident is unrelated to the Binance theft it is tracking.
A live token is worse than a password hash, and the difference is the lesson. A hash has to be cracked before it is useful. A live token can be used at once, as the signed-in user, which is why the remedy here is not a polite password reminder but a full reset and key rotation for every account, behind an IP allowlist. Credit the disclosure sequence for eventually printing the full scope, and keep the original October 30 assurance next to it as a warning: an early “no evidence of credentials” statement in an unfinished investigation is a progress report, not a finding. Any business that holds other people's money movement in its tools should read its own incident template against this timeline now, while it is still hypothetical.
Vals: open-weight DeepSeek completes 73% of hacking objectives, gated Daybreak 81%
Evaluation firm Vals published research on November 6, reported by WIRED, testing models as autonomous agents against two simulated corporate networks. The first network, Nova, carries 21 objectives across several Active Directory domains; the second, Lighthouse, carries 31 objectives across two companies, where the agent must compromise the first network to reach the second. An objective counted only when hidden markers appeared in command output, never on the model's own claim. OpenAI's Daybreak model, available only to trusted partners through its cyber program, completed about 81% of objectives on average. The open-weight DeepSeek model completed about 73%, and actually averaged slightly more objectives than Daybreak on the first network, 16.3 to 15.7, while Daybreak pulled ahead on the harder second network, 27 of 31 objectives to 21. Vals put the token cost of an attack at $2 to $3 for DeepSeek against $17 to $46 for the OpenAI model. The full Vals report's methodology has not been independently replicated, and two simulated networks are not a defended live network.
Gating the best model no longer buys defenders much time, and the price gap is the strategic fact. An eight-point capability gap at roughly a tenth of the cost is not a moat; it is a discount schedule for the other side. The honest use of this result for a small business is not dread, it is arithmetic. If a capable offensive agent costs single-digit dollars to run, then the defenses that pay are the boring ones that raise the attacker's steps: no exposed credentials, segmented networks, patched edge services, and logs a human actually reads. The defenders' version of the same cheap agent is also available, at the same price, which is the techno-optimist's closing point: run it against your own network first.
Ramp: AI token spend grew 1.5% in two months while token volumes kept rising
Ramp, the corporate spend-management company, reported through TechCrunch on November 6 that AI token spend across its customers grew 42% in July, then just 1.5% across August and September combined. Token volumes rose through the same period. October re-accelerated to 8.9% growth from September 23 to October 23, still a fraction of the summer pace. Ramp's lead economist Ara Kharazian attributed the flattening to price, not demand: OpenAI halved API prices for two GPT-6 models in September, Anthropic cut prices for Fable 5.1 and Opus 5.5 in a move its own filing said reduced revenue growth by about $600 million, and customers have learned to route work to cheaper models and cap long-running tasks. The distribution is stark. Median firms spend $12 to $15 per employee per month on AI; the top 10% spend $600 to $1,000; the top 1%, mostly venture-backed technology companies, peaked near $10,000 per employee in the summer and dipped in August and September. Kharazian's verdict, quoted in the report: “the era of hypergrowth may be over.”
More use for flat money is good news for buyers and a hard question for the labs' valuations, and both halves belong in the paper. The same week this data landed, Bloomberg reported Anthropic's indicated IPO valuation sliding from $2 trillion in early October toward $1.2 to $1.3 trillion, and OpenAI closing about $11 billion at a $1.25 trillion valuation against a $1.4 trillion target. For Chris' clients the Ramp numbers are the useful ones. AI capability is getting cheaper faster than usage is growing, which means a small business that waits for a use case to be proven is no longer paying an early-adopter tax for it, and a business already spending should audit its routing before it renegotiates anything, because the savings are in the model choice, not the vendor call.
People Inc.: core sessions down 26%, AI Overviews over 90% of tracked searches
People Inc., publisher of PEOPLE, Allrecipes, Investopedia and more than 40 other brands, reported third-quarter results on November 2. Core sessions across its 19 most significant sites fell 26% year over year to 1.61 billion, the third straight quarterly acceleration of the decline, from 17% in the first quarter and 22% in the second. The company attributed the decline primarily to “AI-oriented search and content discovery experiences.” Its earnings presentation put AI Overviews penetration at 82% for the quarter; on the November 3 call, chief financial officer Tim Quinn put penetration at over 90% of tracked searches by early November, and chief executive Neil Vogel said the company has lost nearly 70% of its Google search traffic over the last few years and calls the end state “Google Zero” internally. Digital revenue still rose 2% to $288.5 million, because licensing revenue jumped 49% to $52.7 million, including AI licensing, while digital advertising fell 8%. The company is cutting 195 jobs and expects revenue that does not depend on a website session, already 43% of digital revenue, to reach about half within a year.
Put this next to Ziff Davis in Saturday's paper and the publisher story is finished; what remains is the local-business version of it. Two large publishers, in the same week, reported the same mechanism with different numbers: the answer is read, the site is not visited, and the money that survives is money that never depended on the visit. Licensing, direct relationships, events, and transactions carried People Inc.'s quarter. A local service business has the same menu at smaller scale: be the cited and bookable answer, own the customer list, and sell the job, not the page view. Google Zero is a publisher's phrase. For a business that books work, the equivalent discipline is simpler: never let a landlord's referral be the only road to a customer.
What the day adds up to
Every system in Sunday's paper is being resized for a customer that is not a person. GitHub rebuilt Git for agents that push 7,200 times a second. A coding agent's approval file published 2,539 secrets because it was built for a human's convenience. A compliance platform lost every user's live token to agentic techniques and is letting customers back in through an allowlist. A $3 open-weight agent came within eight points of the gated frontier at network intrusion. Buyers used more tokens than ever and paid almost the same, because price, not demand, moved. And the largest lifestyle publisher in the country reported that the answer now sits on over 90% of the searches that used to send it readers. The work that holds up in all six registers is the same work: systems designed for machine traffic, credentials that assume publication, defenses priced in dollars, and a business that gets paid without needing the click. None of that is speculative. All of it shipped, reported, or was filed this week.
Sources: GitHub engineering, “Inside GitHub's new Git storage architecture,” November 5, 2026; Apiiro research, November 5, 2026, company-reported scan figures, credentials untested by the researchers; Chainalysis incident updates, October 30 to November 6, 2026, via The Crypto Guide and The Hacker News reporting, November 6, 2026; Vals CyberOffense research, November 6, 2026, via WIRED and Pivot News, November 7, 2026; Ramp AI spending data via TechCrunch, November 6, 2026; People Incorporated third-quarter results, November 2, 2026, and earnings call, November 3, 2026, via PPC Land.