AI News Today (Nov 3, 2026): NYT Sues Brave, Anthropic IPO & More

AI news today, November 3, 2026: The New York Times sued Brave over AI scraping, and Anthropic's amended S-1 exposed a $23.29 billion quarterly loss. Saudi Aramco also closed its $2.6 billion Humain deal. Here are the 10 top stories and 5 security stories, each with free, non-paywalled sources.

Key Takeaways

• The New York Times and other publishers sued Brave over AI scraping and paywall bypassing.
• Anthropic's amended S-1 showed $17 billion in quarterly revenue and a $23.29 billion net loss.
• Saudi Aramco paid $2.6 billion for 49% of Humain, with PIF retaining 51%.
• Marvell will buy Lumentum in a $115 billion all-stock AI connectivity deal.
• Langflow 1.0.0 through 1.12.8 has critical flaws; version 1.13.0 fixes them.

1. NYT and Other Publishers Sue Brave Over AI Scraping

The New York Times sued Brave Software on Monday in federal court in Manhattan. The suit accuses the browser maker of scraping its journalism and selling access to AI companies including Anthropic, Perplexity, Mistral, xAI and Cohere. It says Brave built an index of more than 30 billion webpages.

The New York Daily News, Chicago Tribune and Orlando Sentinel filed a similar suit the same day. The Times seeks an injunction and damages. Brave, founded in 2015, has raised about $250 million and did not immediately comment. The complaint also targets Brave's paywall blocker, which it promotes as giving users access to hundreds of top publishers.

Why it matters: The case tests whether a browser that indexes the web can be treated as a distributor of stolen content, not just a search tool.

• Source: New York Times and other outlets sue web browser Brave over alleged content scraping — TechCrunch
• Source: The New York Times sues Brave web browser for AI scraping and bypassing paywalls — The Verge

2. Update: Anthropic's Amended S-1 Shows $23.29B Quarterly Loss

Anthropic's amended S-1, filed Monday, reported about $17 billion in third-quarter revenue, up 1,127% from a year earlier, and a $23.29 billion net loss. The filing also disclosed $895.4 billion in purchase commitments and lease agreements, mostly for compute and infrastructure.

Nine-month revenue reached $33.24 billion, up roughly 1,200%, while the nine-month net loss was $104 billion, mostly from convertible notes and derivatives. Anthropic filed its original prospectus last week, which we covered on October 27.

Why it matters: The amended filing gives investors the first full picture of Anthropic's costs before a listing that could raise around $100 billion.

• Source: Anthropic reports $17 billion in Q3 revenue, purchase commitments of $895.4 billion in revised S-1 — CNBC
• Source: Anthropic grows revenue twelvefold but posts $23 billion loss — The Decoder

3. SpaceX Cuts Grok Bot Limits, Citing Unsustainable Costs

SpaceX cut Grok Bot usage limits over Halloween weekend, with some users seeing usage jump from 50% to 100% overnight. Elon Musk confirmed the change was not a glitch, writing that "the cost of serving Grok Bot was unsustainably high relative to revenue."

Grok Bot shares a quota with Grok and Cursor. SpaceX president Gwynne Shotwell said in early October that the agent had 800,000 paying users per week. Musk had called it his fastest-growing product less than two weeks earlier. He asked one user whether a larger subscription would be too expensive.

Why it matters: Agentic products are expensive to run, and even Musk's fast-growing AI unit is now rationing the flat-rate model it promoted.

• Source: SpaceXSI apparently cuts Grok Bot quotas weeks after Musk called it his fastest-growing product — The Decoder
• Source: Elon Musk throttles Grok Bot limits due to 'unsustainably high' costs — TechCrunch

4. OpenAI Launches Grid Protectors With 1,000 MW Georgia Pledge

OpenAI launched a Grid Protectors Program on Monday, starting at its planned Effingham County, Georgia, campus. The company says it will free up to 1,000 megawatts during extreme weather or emergencies, enough to power about 700,000 homes.

OpenAI has agreed to pay the full infrastructure and electric-service costs for the campus. Georgia Power projects about $950 million in annual customer savings from 2029 across a portfolio that includes the OpenAI project. That includes at least $15 a month for a typical household using 1,000 kilowatt-hours.

Why it matters: Data centers are now negotiating their social license to operate, and flexible demand is becoming part of the deal.

• Source: Introducing the Grid Protectors Program — OpenAI
• Source: OpenAI pitches data center power plants as a way to protect nearby areas — The Verge

5. Aramco Closes $2.6B Deal for 49% of AI Firm Humain

Saudi Aramco closed a deal for a 49% stake in Humain, Saudi Arabia's state-backed AI company. Aramco is contributing about 9.9 billion riyals ($2.6 billion) in cash plus AI, compute and digital assets. PIF keeps 51%.

Humain plans to deploy 3 gigawatts of AI data-center capacity by 2030. Aramco says it has generated $11.3 billion in technology value since 2023, with a significant share from AI.

Why it matters: The deal ties the kingdom's oil revenue to its AI ambitions and gives Aramco a direct stake in the compute buildout.

• Source: Saudi Aramco takes 49 percent stake in AI firm Humain with $2.6 billion deal — The Decoder
• Source: PIF and Aramco close HUMAIN transaction to accelerate HUMAIN's global growth — Aramco

6. 29 NHS Trusts Listed as Benefiting Use Little of Palantir

Twenty-nine NHS trusts that NHS England lists as "realising benefits" from Palantir's £330 million federated data platform are not using all or most of the technology. They told researchers the system is not live or they are not using its applications. Medact obtained the responses through more than 100 freedom of information requests.

NHS England said nearly 140 trusts have reported benefits, including some using the platform for back-office data submission. A senior health official called the gap "very misleading." Palantir says its software is helping deliver better care.

Why it matters: Public trust in AI procurement depends on claims that survive scrutiny, and the NHS's flagship data platform is now a test case.

• Source: Palantir AI tech unused or little used by 29 NHS trusts said to be benefiting from it — The Guardian
• Source: NHS Claims Palantir's Tech Helps Hospitals That Are Not Even Using It — Novara Media

7. Wired Finds 400+ AI Apps Hiding Abusive Deepfake Tools

Wired found more than 400 apps and domains, tied to Chinese developers, that pose as everyday tools but load a hidden interface for sexually abusive deepfakes after installation. Some templates included "bedroom rape" and "threatening knife" scenes.

Apple removed 19 apps, including the pet-portrait app Viefur, after Wired asked. Google had already removed most of the apps. Researchers linked the network to a Hong Kong entity, KeLing Technology Limited, which did not respond.

Why it matters: App-store review and age ratings failed to catch a paid, ad-driven network that turned ordinary tools into abuse machinery.

• Source: Hundreds of Mundane AI Apps Are Hiding Sexually Abusive Deepfake Features — Wired
• Source: Hundreds of AI Apps on Google Play and App Store Hid Nudify Tools — AndroidPure

8. WA Facial Recognition Trial Scans 1.38M Faces, Makes 122 Arrests

Western Australia's five-month live facial recognition trial scanned 1,380,882 faces across 100 deployments and 43 locations, leading to 122 arrests and nine incorrect alerts. Police also engaged 146 registered sex offenders and located 10 people for welfare checks.

The state's Office of the Information Commissioner said it was not consulted on the trial's design and warned about mass collection, scope creep and false matches. The surveillance vans have been removed from public deployment while police evaluate the trial.

Why it matters: Real-time biometric policing is moving from pilot to policy question, and the safeguards are being written after deployment.

• Source: Police use facial recognition to scan one million faces in WA trial leading to 122 arrests — The Guardian
• Source: OIC Media Release - WAPOL OLFR Pilot — Government of Western Australia

9. Marvell to Buy Lumentum in $115B All-Stock AI Deal

Marvell agreed to buy Lumentum in an all-stock deal with an implied enterprise value of $115 billion, or about $1,132 per Lumentum share. Lumentum stockholders get 4.5 Marvell shares for each share they own.

Marvell stockholders will own about 67% of the combined company and Lumentum holders about 33%. The deal is expected to close in the first half of 2028 and targets more than $1 billion in annual cost synergies. The companies put the combined total addressable market at $550 billion.

Why it matters: Optical connections are becoming the bottleneck in AI clusters, and the deal bets that owning both electrical and optical layers will matter more than size alone.

• Source: Lumentum CEO touts 'enormous' opportunity in massive AI connectivity deal with Marvell — CNBC
• Source: Marvell and Lumentum to Combine, Creating a Category Leader in AI Connectivity — Marvell

10. 42AI Emerges With $62.5M for Behavioral World Model

Israeli startup 42AI emerged from stealth with $62.5 million in seed funding for a "behavioral world model" that predicts how people will act. It is already working with 10 large brokerages to forecast trading flows.

The company says its model reaches an F1 score of 0.8 to 0.85 for trading direction and volume. It is exploring gaming, fraud prevention and cybersecurity, with robotics as a longer-term goal. Its funding came from the founders and Infinity Group over three years, and it says revenue is above seven figures.

Why it matters: Banks can use behavioral forecasts to manage risk, but the same profiles could widen the information gap between institutions and their customers.

• Source: 42AI comes out of stealth with $62.5M and a world model that can 'predict human behavior' — TechCrunch
• Source: 42AI | Behavioral World Model — 42AI

AI Security: 5 Stories to Know Today

11. Critical Langflow Flaws Allow Unauthenticated Code Execution

IBM disclosed four Langflow flaws, including two critical bugs that let unauthenticated attackers bypass authentication or run arbitrary code. Every release from 1.0.0 through 1.12.8 is affected; the fix is 1.13.0.

The authentication bypass, CVE-2026-93680, is rated 9.8 and already has a Metasploit module that lists tools on unpatched MCP endpoints. IBM says automatic login is on by default in 1.12.8 and turns off in 1.13.0.

Why it matters: Langflow is used to build and expose AI agents, so an unauthenticated path into its MCP tools can hand attackers the same access as the agent.

• Source: Critical Langflow Flaws Could Let Unauthenticated Attackers Run Code on Servers — The Hacker News
• Source: Security Bulletin: Langflow OSS is affected by multiple vulnerabilities — IBM

12. Suspected AI Scripts Power SysGoRAT Linux Espionage Campaign

Unit 42 detailed a campaign against government Linux servers that used suspected AI-generated PHP and shell scripts to maintain access and steal mailboxes. The activity ran from October 2025 to April 2026 and is tracked as CL-UNK-1211.

The attackers deployed SysGoRAT, a Go backdoor that connects over WebSocket and supports seven command types, plus web shells and in-memory reverse shells. They also tried to delete logs and disguise the operation as a red-team exercise.

Why it matters: AI-assisted scripting shortens the path from initial access to a working intrusion, even for actors who are not elite developers.

• Source: Government Linux Servers Targeted With SysGoRAT and Suspected AI-Generated Scripts — The Hacker News
• Source: AI-Powered Espionage Campaign Targets Government Linux Infrastructure — Unit 42

13. Google Dismantles XCPE Botnet Across 1.3 Million TV Boxes

Google dismantled the XCPE botnet, which infected more than 1.3 million Android TV boxes with a backdoor built into firmware. Google attributes the operation with high confidence to Chinese manufacturer Videostrong.

Google took down command-and-control servers for more than a dozen malware families, cutting access to at least 10 million additional devices. It also revoked Videostrong's Android TV license and banned the company from certified devices. The backdoor remains on infected boxes, and owners cannot remove it themselves.

Why it matters: Firmware-level backdoors survive factory resets, so the remedy is to remove the vendor, not just the malware.

• Source: Google disrupts million-device XCPE Android malware botnet, bans TV box maker — BleepingComputer
• Source: Google Disrupts 1.3 Million-Device Android Botnet, Says TV Box Maker Sold Criminal Access — The Hacker News

14. Freezer Attacks Hit More Than 115 European Supermarkets

A cyberattack disrupted refrigeration at more than 115 supermarkets in Belgium, the Netherlands, Sweden, Luxembourg, Ireland and Estonia. Attackers remotely changed temperature settings, shut down freezers or started defrost cycles.

The Record reported a second wave in recent weeks and said Belgium's cyber agency is concerned about the rising number of incidents, partly because of targeted AI use. The agency does not know whether AI was used in this attack, and no group has claimed responsibility.

Why it matters: Internet-exposed controllers for basic equipment remain soft targets, and AI is making the search for them faster.

• Source: Hackers disrupt refrigeration systems at European supermarkets — BleepingComputer
• Source: Second wave of suspected cyberattacks hits supermarket freezers across Europe — The Record

15. Ivanti Patches Two More Connect Secure Zero-Days

Ivanti patched two more Connect Secure zero-days, CVE-2026-111357 and CVE-2026-118527, which attackers chained with CVE-2026-104935 since at least October 1. CISA added both to its Known Exploited Vulnerabilities catalog on October 30.

CVE-2026-111357 is a high-severity privilege escalation flaw; CVE-2026-118527 lets authenticated attackers upload files. Shadowserver tracks more than 5,000 internet-exposed Connect Secure instances, and CISA's due date for one flaw passed Monday.

Why it matters: Edge appliances remain a favorite entry point, and a chain that needs no malware can sit inside a network for weeks.

• Source: Ivanti patches two more Connect Secure zero-days chained in attacks — BleepingComputer
• Source: Known Exploited Vulnerabilities Catalog — CISA

More AI Stories Worth Reading

• South Korea's 2027 budget rises 12.8% to 820.9 trillion won, with 21.3 trillion won for chips, physical AI and AI data centers. — CNBC
• OpenAI signed four Abu Dhabi agreements on energy, government and investment as it seeks up to $20 billion in new funding. — CNBC
• Ryanair is weighing pay freezes, smaller crews and more AI to offset a €2 billion fuel-cost increase. — The Guardian
• AI search is useful for simple or broad queries, but traditional search wins for precision, breaking news and high-stakes topics. — Wired

Related Reading on Kill The AI

• OpenAI capped paid ChatGPT accounts, National Grid planned Britain's largest substation, and JPMorgan blocked AI agents.
• OpenAI raised $11 billion, AI labs backed a robots.txt opt-out, and a Claude agent injected a mouse brain.
• Google's satellite ran Gemma 4 in orbit, AWS grew 39%, and AI stocks sold off.
• Our data review of the AI boom's first eight weeks, from capex and chips to layoffs.

Methodology & Sources

Compiled November 3, 2026, using multi-source research. Linked outlets: TechCrunch, The Verge, CNBC, The Decoder, OpenAI, Aramco, The Guardian, Novara Media, Wired and AndroidPure. Also linked: the Government of Western Australia, Marvell, 42AI, The Hacker News, IBM, Unit 42, BleepingComputer, The Record and CISA. All sources are free; no paywalls. Details are as reported at compilation time.

Frequently asked questions