Welcome to November. This tech news November 1 2026 roundup leads with Apple finally bringing its AI tools to China, then moves through two very different model launches, a striking shift in how software gets written, and a security warning every AI builder should note.
Key Takeaways
- Apple Intelligence arrives in China in December with Alibaba’s Qwen inside Siri, Writing Tools and Visual Intelligence; developer testing starts November 4.
- Mistral has published the open weights of its trillion-parameter Large 4 model, free for most organisations to run themselves.
- Google’s Gemini 4 Carbon is going to cyber defenders first, not the general public, because of its power at finding and fixing flaws.
- More than 40% of GitHub pull requests now start with an AI agent’s first draft, up from 17% in March.
- Cloudflare disclosed that a caching bug leaked fragments of other customers’ data in 155 AI responses.
1. Apple Intelligence Comes to China — Powered by Alibaba’s Qwen
According to People’s Daily, Alibaba announced on October 31 that its Qwen model will be integrated into Apple Intelligence for users in China. Testing opens in the latest iOS developer beta on November 4, with a public rollout planned alongside iOS 27.3 in December.
This matters because Apple Intelligence has been missing from mainland China for more than two years since it was first unveiled. China’s cyberspace regulator registered Apple’s on-device service in July, clearing a major hurdle.
In practice, Qwen will help answer certain Siri requests, power a Compose feature in Writing Tools, and let users ask questions about photos and documents. Apple says it will ask permission before anything is sent to Qwen, and Alibaba says requests and responses will not be used to train its models. The first wave is iPhone-only, on iPhone 15 Pro and newer models, and it leaves out the upgraded Siri AI from WWDC 2026.
2. Mistral Opens the Weights of Large 4, Its Trillion-Parameter Model
According to Mistral, the French lab published the open weights of Mistral Large 4 on October 29, three weeks after its API-only preview. Anyone can now download the roughly trillion-parameter model from Hugging Face and run it on their own servers, with about 49 billion parameters active per token and a one-million-token context window.
The licence is the interesting part. It is broadly free to use, modify and commercialise — except that companies selling Large 4 as a hosted model service need a separate commercial licence from Mistral.
There is a practical catch: even a compressed version needs serious GPU hardware, so most teams will still start through Mistral’s API, at $0.70 per million input tokens and $2.10 per million output tokens. Still, open weights cannot be taken back once downloaded, which is why this release matters for European AI sovereignty.
3. Google’s Gemini 4 Carbon Goes to Cyber Defenders First
According to BetaNews, Google announced Gemini 4 Carbon on October 28, calling it its strongest model yet for cybersecurity and long, multi-step work — and then deliberately did not release it to everyone. Access starts with a subset of cyber defenders through Google’s Fairwind Program, with wider access to follow once guardrails are refined.
The numbers explain the caution. Carbon scores 88.2% on SEC-bench Pro for finding real vulnerabilities, 54.8% on ExploitGym for turning flaws into working exploits, and 71.0% on CWE-bench for patching them, and Google says it more than doubled the previous model’s success rate at generating secure code in internal tests. Those security scores were run without guardrails.
For the rest of us, Carbon previews a new release pattern: the most capable models may increasingly arrive in stages, defenders first, consumers later. Introductory API pricing is $2 per million input tokens and $10 per million output tokens, but there is no public date yet for developers or Gemini app users.
4. GitHub’s Octoverse: Agents Now Start More Than 40% of Pull Requests
According to GitHub, the company’s Octoverse 2026 report, published October 28, puts a startling number on the agentic coding shift. By September 2026, more than 40% of pull requests on GitHub started with an agent’s first draft, up from 17% in March — about 110 million agent-started pull requests in September alone, roughly six times March’s volume.
That does not mean agents write 40% of all code. GitHub counts pull requests whose first draft came from a detectable coding agent, and it calls that figure a floor, since not all agent use can be detected. Agent-started pull requests also merged within two weeks slightly more often than others, at 90% versus about 86%.
The takeaway for developers is less about speed and more about review. When the first draft is increasingly written by a machine, human review becomes the bottleneck. See also our tech news roundup from October 31, 2026.
5. Cloudflare’s AI Leak Shows Why Infrastructure Isolation Matters
According to eWeek, Cloudflare disclosed on October 26 that a caching bug in its Workers AI service caused 155 responses from its GLM-5.3 model to contain fragments of other customers’ prompts and outputs between August 27 and September 9. The cause was a mismatch between the advertised context window and available memory, combined with an inference-engine bug that let rejected requests draw on cached data from earlier requests.
Cloudflare says no other Workers AI model was affected, that it found no evidence of deliberate exploitation, and that the model was pulled, fixed and restored on September 9. The raw count is small, but the implication is large: this failure happened below the usual access controls, where permissions alone could not prevent one customer’s data from bleeding into another’s response. Checking how a provider isolates workloads deserves a place on every security checklist. See also our October 28, 2026 tech news.
The Takeaway
Put these five stories together and a pattern emerges. AI is splintering by geography, getting more open at the top end, and getting powerful enough that companies pause before a general release. At the same time, agents are becoming co-authors of our software, while the Cloudflare leak reminds us that the plumbing underneath AI needs as much scrutiny as the models on top.
FAQ
When will Apple Intelligence launch in China?
Developer testing starts November 4, 2026 in the iOS developer beta, with a public rollout planned with iOS 27.3 in December. The first wave is iPhone-only and powered by Alibaba’s Qwen in Siri, Writing Tools and Visual Intelligence.
Is Mistral Large 4 really free to use?
For most organisations, yes — you can download, modify and commercialise it under Mistral’s modified MIT-style licence. The exception is companies that sell Large 4 itself as a hosted model service, which need a separate commercial licence from Mistral.
When can developers use Gemini 4 Carbon?
Not yet. Google has given no public date for developer, business or consumer access. It is rolling out first to a subset of cyber defenders through its Fairwind Program while guardrails are refined.
What does GitHub’s 40% agent figure actually mean?
It means more than 40% of pull requests in September 2026 started with an agent’s first draft, not that agents wrote 40% of all code. GitHub counts only detectable agent use, so it describes the figure as a floor.
Sources
- People’s Daily, “Alibaba, Apple partner to bring Qwen to Apple Intelligence for users in China” — https://peoplesdaily.pdnews.cn/business/er/30053462528
- MCI Group, “Qwen-powered Apple AI to Launch in China in December” — https://mcigroup.my/mci-business/qwen-powered-apple-ai-to-launch-in-china-in-december/
- Mistral, “Mistral Large 4 (Le Chonk) is now open weight” — https://mistral.ai/news/mistral-large-4-oss/
- BetaNews, “Google gives Gemini 4 Carbon to cyber defenders first” — https://betanews.com/article/gemini-4-carbon-cyber-defenders/
- GitHub Blog, “Octoverse: Commits, pushes, reach new highs in 2026 as developers build with agents” — https://github.blog/news-insights/octoverse/octoverse-commits-pushes-reach-new-highs-in-2026-as-developers-build-with-agents/
- eWeek, “Cloudflare AI Leak Crossed Customer Boundaries — and Access Controls Couldn’t Stop It” — https://www.eweek.com/news/cloudflare-ai-data-leak/
