Daily 9 for November 3, 2026 collects nine developments announced on November 2 across AI, fintech, crypto, software and tech. Two come from OpenAI, three from Hong Kong FinTech Week, and three are security releases worth acting on this week. Each item links to the company, regulator or project that published it.
1. OpenAI will curb campus power use when the grid is strained
OpenAI launched a Grid Protectors Program, under which its future campuses would reduce electricity demand when local grids are under pressure, and in some places supply power from on-site generation or storage. The pilot is its planned campus in Effingham County, Georgia, where OpenAI says it will pay the full infrastructure and service costs and has agreed up to 1,000 megawatts of flexible demand response with Georgia Power. The campus is still in development, and terms for other sites are not yet set. OpenAI, November 2.
2. OpenAI raises its bug bounty rewards
OpenAI says it is more than quadrupling, on average, the midpoint of its reward ranges for medium, high and critical findings. A critical vulnerability in ChatGPT, Codex or the API Platform can now earn up to $30,000, and exceptional critical findings up to $100,000, or up to $172,000 with the new bonuses. Those bonuses reward high-quality reports, repeat researchers through a five-tier loyalty scheme, and testing of newly launched features in short campaigns. Open reports that have not yet been paid fall under the new ranges. OpenAI, November 2.
3. Hong Kong’s regulator opens a project on AI agents in banking
At Hong Kong FinTech Week, the Hong Kong Monetary Authority launched Project SAGE to let the industry explore agentic finance under a matching governance framework, set up an expert group, and published a discussion paper on banks’ use of agentic AI. It also released a post-quantum cryptography toolkit for banks with the Hong Kong University of Science and Technology, and moved its Ensemble TX tokenization pilot to 24/7 real-value transactions. HKMA press release, November 2. The same release set the FPS link with UnionPay, which we covered separately.
4. Tencent and Mastercard plan QR payments for visitors to China
TenPay Global, Tencent’s cross-border payment arm, and Mastercard signed a memorandum of understanding to explore letting international visitors pay with familiar wallets and issuer apps at QR-enabled merchants in the Chinese mainland. They also plan to widen remittances into the Weixin ecosystem through Mastercard Move and to look at agentic commerce. An MOU is a plan to explore, not a launched service, and no dates were given. TenPay Global and Mastercard announcement, November 2.
5. Sunrate launches a virtual corporate card built for AI agents
Sunrate, a payment and treasury management platform, used Hong Kong FinTech Week to launch Sunrate Agentic Card, a multi-currency virtual commercial card that authorized AI agents can create, use and close on a company’s behalf. Businesses set limits by merchant category, amount, currency, country and validity period, and each action is logged. Sunrate says the card has completed Mastercard Agent Pay certification. The announcement does not give pricing or a list of markets. Sunrate announcement, November 2. Related background: what a virtual card number is.
6. Akash will move its compute marketplace to Solana
Akash, a decentralized marketplace for renting compute, confirmed it will migrate its blockchain infrastructure to Solana over the next 24 months. Governance Proposal 346 passed with 97% of token holders in favor, according to the project. AKT holders will be able to swap their tokens 1:1 for an SPL version through a dedicated portal, and Akash’s marketplace, its AkashML inference service and Homenode are planned to run natively on Solana. Migration dates have not been published yet. Akash announcement, November 2.
7. Traefik patches a memory-exhaustion flaw in recent releases
Traefik released versions 2.11.61 and 3.7.17 to fix a high-severity advisory, GHSA-xv5x-242w-7hf7. An unauthenticated client could send an NTLM or Negotiate Authorization header and make the proxy hold a dedicated backend connection for every client connection, eventually exhausting its memory. Only 2.11.58 to 2.11.60 and 3.7.14 to 3.7.16 are affected; Traefik 3.6 and earlier are not. The team recommends upgrading as soon as possible. Traefik announcement, November 2.
8. FreeRDP 3.33.0 runs in the browser and fixes 13 advisories
FreeRDP 3.33.0, the open-source Remote Desktop Protocol implementation, adds WebAssembly support so a client can run inside a browser, plus experimental UDP for direct connections without a gateway and macOS file clipboard support without FUSE. The release lists 13 GitHub security advisories it fixes. The maintainers say a patch release for remaining regressions will follow soon, so cautious admins may prefer to wait for it while still planning the update. FreeRDP release notes, November 2.
9. Android’s November bulletin fixes a critical remote flaw
Google’s Android Security Bulletin for November says the most severe issue is a critical vulnerability in the Framework component that could allow remote code execution with no user interaction and no extra privileges. Devices on security patch level 2026-11-05 or later are protected against every issue in the bulletin. Source patches reach AOSP within 48 hours of publication, and phone makers ship updates on their own schedules, so check the patch level under Settings. Android Security Bulletin, November 2. Background: what a zero-day vulnerability is.
