14. Update: the harness-design study we covered yesterday is now on arXiv — and HN agrees it matters
- Velocity: â–® steady
- Source: Hacker News · 193+ pts · ~7h ago (~21:06 UTC+8)
- Tags:
paper agents harness evaluation
Since our Sep 18 coverage of the 176-run harness ablation: the full paper is now public as
arXiv:2609.20804 (43 pages, submitted Sep 17), "An Empirical Study of Harness Design for
Coding Agents" — 4 models × SWE-Bench Verified and Terminal-Bench 2.1, varying planning,
action space and context management independently. The findings as published match the
earlier reporting: context management's value grows as budgets tighten (mostly by
preventing overflow failures); rule-based elision before LLM summarization wins on
efficiency; planning is an accuracy scaffold for weak models and a cost saver for strong
ones; bash-capable models do fine with a bash-only action space at much lower cost.
Why it matters: This is the measurement-grade version of an argument the whole
agent-ecosystem is having by vibes (see items 2 and 7). The caveats travel with it: one
harness, two benchmarks, four models — the authors frame it as "model- and budget-aware"
guidance, not laws. Note we originally reported this as Zoom's internal ablation; the public
paper doesn't emphasize the affiliation, and the numbers (176 settings) confirm it's the
same study.
🔗 arXiv:2609.20804 · 🔗 HN discussion
15. Claude Code now reads AGENTS.md — the agent-config format war ends with a shrug
- Velocity: ▮▮▮ trending
- Source: Hacker News · 672+ pts · ~15h ago (~05:06 UTC+8)
- Tags:
agents claude-code interop config
Claude Code v2.1.277 (Sep 18) adds the interop change half the ecosystem has been waiting
for: when no CLAUDE.md exists, the harness now reads AGENTS.md — the vendor-neutral
convention already adopted by OpenAI Codex, Cursor, Zed and others. The same release train
shipped v2.1.278 (Sep 19), which points auto-mode's permission decisions at a server-side
classifier with no billing overhead on Bedrock/Vertex/Foundry. The repo sits at 146.5k
stars, +444 today.
Why it matters: Until now, cross-harness projects either symlinked CLAUDE.md →
AGENTS.md or maintained two files that drifted. One instruction file that travels across
harnesses is a small change with an outsized effect on multi-agent repos — and the
direction of travel matters more than the feature: Anthropic adopting the community
format rather than pushing its own.
🔗 Claude Code changelog · 🔗 HN discussion · 🔗 v2.1.277 release
16. vm2, declared "discontinued" over unfixable escapes in 2023, is alive — and just fixed two more CVSS 10.0 sandbox escapes
- Velocity: ▮▮▮ trending
- Source: NVD / VulnCheck · records published Sep 18
- Tags:
vm2 sandbox-escape cve nodejs
NVD published two CVSS 10.0 advisories for the Node.js vm2 sandbox — both
VulnCheck-assigned (CNA), NVD status Deferred: CVE-2026-93603 (a nullish this receiver
in the bridge apply trap reaches host child_process) and CVE-2026-93605 (the NodeVM
DANGEROUS_BUILTINS denylist simply omits child_process). Fixes shipped in 3.12.1
(npm Sep 3) and 3.12.2 (Sep 8) — and the repo, un-archived with a push on Sep 13, is
under active development again, despite the maintainer's Aug 2023 notice declaring the
project discontinued over "unrecoverable" design flaws.
Why it matters: Two different readers need two different takeaways. If you removed
vm2 on the 2023 advice, it's back and shipping fixes. If you still run an old pinned
version, every historical escape presumably still works plus these two. And the deeper
point stands regardless of version: the 2023 verdict was that vm2's security design is
unsound, not merely buggy — treat any vm2 boundary as best-effort isolation, never a
security control.
🔗 GHSA-pq68-rvw4-xp4r · 🔗 VulnCheck advisory
17. Grant Sanderson guest-posts on Tao's blog: "There will never be Lean for motivated explanations"
- Velocity: ▮▮▮ trending
- Source: Hacker News · 142+ pts · ~5h ago (~15:06 UTC+8)
- Tags:
mathematics ai formal-methods exposition
Terence Tao's blog hosts a guest post by Grant Sanderson (3Blue1Brown), "If math is more
than proof, we need to better celebrate the rest of it": as AI makes proof-generation
cheap, proofs are revealed as proxies for what mathematics actually values — understanding,
motivation, and explanation. He proposes giving the explanatory layer the same
infrastructure proofs have: formalized and rewarded "motivated explanations," Timothy
Chow's "open exposition problems," with tenure committees, journals, and even a
Hilbert-list-style catalog of the best unsolved exposition.
Why it matters: This is the constructive branch of the week's running argument —
after the Fields-medallists letter (Sep 12), the Gowers/Tao dissents (Sep 18), and Dan
Abramov's agent-generated Lean proof landing on HN this morning (item 2). Its claim is
sharper than "AI can't do what we do": it's that the thing AI can't do was never
credentialled in the first place, and that's a fixable institutional gap.
🔗 terrytao.wordpress.com · 🔗 HN discussion
18. GPT-6 Astra cracks a WWI German radio cipher — a self-reported first, worth reading with the author's own caveat attached
- Velocity: ▮▮ rising
- Source: Hacker News · 147+ pts · ~5h ago (~15:06 UTC+8)
- Tags:
cipher ai-capability adfgvx history
A hobbyist cryptanalysis post reports that GPT-6 Astra solved a WWI-era German radio
cipher from scienceblogs.de's list of 50 unsolved ciphers. The message — an ADFGVX
transmission sent November 27, 1918 — was decoded in full by recovering the documented
historical key TRUPPENVERSCHIEBUNG from Childs's German Military Ciphers 1914–1918,
rebuilding the transposition arithmetic, and then checking the result against ship logs
(HMS Canterbury at Sevastopol, November 24). Astra's own explanation for why the message
went unsolved — a key change dated after it — remains unverified. The author's hedge is
explicit: "I am not aware of this particular message having ever been decoded before" —
no historian or cipher authority has validated the transcript.
Why it matters: The second historical-cipher claim for a frontier model this month
(Fable 5.1 and the Cyphral Distich, Sep 14) — and the first to publish its mechanics
end-to-end: key provenance, rebuilt table, archive cross-check. The interesting signal
is the workflow — a model retrieving the key from published cryptohistory and verifying
its own plaintext against ship logs — but it still stands or falls on the author's
say-so. Read it as a promising self-report, not a solved cipher.
🔗 prinzai.com · 🔗 HN discussion
19. LightLLM CVE-2026-93839: unauthenticated node registration exposes user prompts in PD-disaggregated serving — CVSS 9.8, no fix released
- Velocity: ▮▮ rising
- Source: NVD / VulnCheck · published Sep 18
- Tags:
llm-serving cve ai-infra authentication
ModelTC's LightLLM — a popular self-hosted LLM serving framework — exposes a WebSocket
/pd_register endpoint for its prefill/decode disaggregation mode with no
authentication. Any network-reachable attacker can register an arbitrary node into the
cluster, hijack inference requests, and read user prompts. CVSS 9.8 (VulnCheck CNA;
9.3 under v4), NVD record published Sep 18 with line-level references into
api_http_pd.py. The bug report has been open since Sep 16; no fixed release was
confirmed at writing.
Why it matters: Prefill/decode disaggregation is becoming the default serving
architecture for large models, and this is exactly the vulnerability class it introduces:
the cluster's internal control plane becomes network attack surface. If you run LightLLM
in PD mode, an exposed /pd_register should be treated as disclosed prompts — and the
unpatched status makes network-level isolation the only mitigation for now.
🔗 GitHub issue #1576 · 🔗 NVD record CVE-2026-93839
20. IEEE Spectrum on OpenAI's Jalapeño chip: LLMs designed the front-end — and the article says where they didn't help
- Velocity: ▮▮ rising
- Source: Hacker News · 136+ pts · ~12h ago (~08:11 UTC+8)
- Tags:
chips openai hardware llm
IEEE Spectrum's deep dive (Sep 14, resurfaced Sep 18) on OpenAI's first accelerator,
designed with Broadcom as physical-design partner: 13.4 PFLOPS at 4-bit, 232 GB HBM4,
claims of up to 3.6× lower end-to-end latency versus an NVIDIA GB300. The front-end flow
was built on Google's open-source XLS (C++/DSLX → Verilog); concept-to-silicon in under
20 months with a team averaging fewer than 100 engineers; a DeepSeek attention kernel
went from 0.31% to 88.94% of theoretical ceiling in ~40 hours post-fab.
Why it matters: Carry Spectrum's own disclaimers: "real-world fleet performance is
unproven; benchmarks were cited by OpenAI," and experts note the 20-month schedule was
only credible because Broadcom handled physical design. The honest takeaway is the one
the article itself makes — LLMs substantially compressed the front-end (RTL and kernel)
work, were much less useful for backend physical design, and engineers remained "the
final arbiter" throughout.
🔗 IEEE Spectrum · 🔗 HN discussion
21. IBM Guardium: 12 critical CVEs land on NVD in a single drop — deserialization RCE, SQLi, and unauthenticated servlets
- Velocity: ▮▮ rising
- Source: NVD / IBM · records published Sep 18
- Tags:
cve ibm database-security enterprise
IBM's Guardium Data Protection 12.2 took a batch of critical fixes published to NVD on
Sep 18 — CVE-2026-80441, -80442, -81657, -82340, -82832, -82967, -84064, -84073, -84075,
-84078, -84082, plus CVE-2026-75878 for Sterling File Gateway 9.1. The mix: unauthenticated
deserialization RCE (9.8), auth bypass of IP access controls (9.8), unauthenticated SQL
injection (9.8), missing authentication on ChangeTracker/LoadBalancer servlets (9.9), and
authenticated OS command injection (9.9). All IBM CNA-assigned; fixes are in the Guardium
12.x update stream.
Why it matters: Guardium sits on database audit traffic — a compromise is visibility
into essentially every query in the enterprise, which makes it both a high-value target
and a compliance event when it falls. A twelve-at-once drop points to a coordinated
release rather than drip-fed patches; Guardium admins should inventory versions and treat
internet- or user-reachable consoles as exposed until patched.
🔗 IBM security bulletin · 🔗 NVD record CVE-2026-80441
22. xAI makes Grok Voice Transcribe 2.0 its default STT — with the accuracy claim living only on the marketing page
- Velocity: ▮▮ rising
- Source: x.ai docs · Sep 18
- Tags:
speech-to-text xai api voice
xAI's documentation now lists grok-voice-transcribe-2.0 as the default model for its
speech-to-text API: a POST /v1/stt endpoint plus WebSocket streaming, 25 languages,
word-level timestamps, multichannel audio and speaker diarization. The docs state
"all audio data is processed in real time and never stored or used for training" — a
zero-retention commitment aimed directly at the medical/legal transcription market.
Why it matters: Default-model swaps on an API move every unpinning customer at once,
and STT is one of the highest-volume AI workloads in production. The sourcing caveat
matters here: the widely-quoted "2× the accuracy of 1.0 at unchanged pricing" appears on
xAI's marketing page (which blocks non-browser fetchers) and secondary coverage — the
docs themselves make no accuracy claims, so treat the multiplier as marketing until
benchmarked.
🔗 x.ai voice docs · 🔗 x.ai models list
23. Cache-to-Cache: LLMs talking through KV-caches instead of text gets its HN day
- Velocity: ▮▮ rising
- Source: Hacker News · 95+ pts · ~17h ago (~03:06 UTC+8)
- Tags:
paper kv-cache multi-agent inference
The HN discussion centers on "Cache-to-Cache: Direct Semantic Communication Between
LLMs" (arXiv 2510.03215, a 2025 paper resurfacing on the front page): instead of
agent-to-agent messages being generated as text, parsed, and re-encoded, one model's
KV-cache is projected directly into another model's cache — semantic communication at
inference speed, skipping decode/re-encode round-trips entirely.
Why it matters: Multi-agent systems today pay a token tax on every hop — generate,
serialize, re-prefill. Cache-level communication attacks that tax at the architecture
level, which is why it keeps resurfacing as agent fleets grow. The practical caveats:
it requires shared or mappable vocabularies/geometry between models, so it's a
same-family (or co-trained) technique for now, not an inter-vendor bridge.
🔗 arXiv:2510.03215 · 🔗 HN discussion
24. Stagehand: "Playwright 2× faster, 80% more token efficient" — vendor claim, published code
- Velocity: ▮▮ rising
- Source: Hacker News · 94+ pts · ~19h ago (~01:06 UTC+8)
- Tags:
browser-agents playwright testing tokens
Browserbase's Stagehand — the browser-agent SDK that layers an AI API over Playwright —
announced performance work behind the HN title "We made Playwright 2x faster and 80% more
token efficient": trimming the DOM snapshots and action traces that browser agents feed
the model, which is where both latency and token spend live in browser automation.
Why it matters: Browser agents are the most token-hungry agent category, and
DOM-to-prompt reduction is where everyone's costs actually sit. The numbers are
self-reported by the vendor — read them as a direction, not a benchmark — but the repo is
open source, so the measurement is reproducible, which is more than most token-savings
claims in this space can say.
🔗 github.com/browserbase/stagehand · 🔗 HN discussion
25. "Science Is Open Software" — the replication crisis gets framed as a dependency-management problem
- Velocity: â–® steady
- Source: Hacker News · 104+ pts · ~9h ago (~11:06 UTC+8)
- Tags:
open-source research reproducibility essay
Jakob Pedersen argues research papers should be treated as what they functionally are:
open-source projects with terrible repository hygiene. The essay walks through what
happens when a paper's "code available on request" is actually a pipeline of unlabeled
scripts, dead links and undocumented environment state — and what changes when it's
treated as software with versions, tests, and maintainers instead.
Why it matters: The framing lands because it's operational, not moral: every practice
open-source developed for keeping software alive (semver, CI, CODEOWNERS, archived
dependencies) maps directly onto the failure modes of irreproducible research — and the
agent era raises the stakes, since models trained on the literature inherit its rot.
🔗 jepedersen.dk · 🔗 HN discussion
26. JEPA-Anything: one predictive-modeling framework claimed across seven domains
- Velocity: â–® steady
- Source: arXiv · 2609.20800 · Sep 17
- Tags:
paper jepa world-model self-supervised
A group including Ling Yang, Weiyang Liu and Zhenfei Yin proposes "orthogonal predictive
factorization" (OPF) as a domain-agnostic generalization of JEPA-style predictive world
modeling, evaluated across vision, biology, clinical trajectories, control, molecular
dynamics, physical fields and weather. It reports beating matched JEPA baselines on all
10 dynamics tasks, a −34.8% intervention-prediction error on Interventional Pong, and
recovery of Kepler's exponent (−1.4991) from planetary data. Code released at
Gen-Verse/JEPA-Anything.
Why it matters: LeCun's JEPA program has been criticized as vision-only aspiration;
a seven-domain evaluation is the kind of test that claim needs. Read the results the way
the paper frames them — against matched JEPA baselines, not against the best
domain-specific methods — and note the biological intervention result "receives
experimental support" rather than being validated.
🔗 arXiv:2609.20800 · 🔗 github.com/Gen-Verse/JEPA-Anything
27. RetireOPD: the distillation teacher fires itself mid-training — and the student beats it
- Velocity: â–® steady
- Source: arXiv · 2609.20784 · Sep 17
- Tags:
paper distillation reinforcement-learning agents
"Self on-policy distillation" for agentic RL with an Adaptive Retirement rule: a
skill-privileged teacher supervises the student only while the performance gap is still
shrinking, and is dropped once the student reaches a target fraction of teacher success.
On Qwen2.5 backbones (1.5B–7B), the method reports +14.1–18.8 pp on ALFWorld and
+11.8–19.0 pp on WebShop over the RL baseline — with the student surpassing its own
teacher in every tested setting.
Why it matters: The persistent problem with distillation-into-RL pipelines is
when to stop imitating: too early caps the student, too late imports the teacher's
ceiling and its biases. Making retirement a measured decision rather than a hyperparameter
is a small idea with clean mechanics — though the evidence base is Qwen2.5-only, so
treat it as a promising recipe, not a law.
🔗 arXiv:2609.20784 · 🔗 arXiv HTML
28. Xing4.0-29B-A4B: China Telecom ships a coding MoE trained entirely on Ascend NPUs
- Velocity: â–® steady
- Source: Hugging Face trending (#5) · updated Sep 18
- Tags:
open-weights moe ascend coding
XingChen-AGI (China Telecom) released Xing4.0-29B-A4B: a 29B-total / 4B-active MoE (64
routed experts, MLA + MTP, 256K context) whose card claims it is "the first model of this
scale trained entirely on the Ascend NPU platform with the MindSpore framework."
Self-reported numbers: SWE-bench Verified 75.00 (vs Qwen3.6-35B-A3B's 76.00), Terminal-Bench
2.1 57.50 — while trailing on AIME2026 and IFBench.
Why it matters: The compute-sovereignty story is the real item: a nationally-run
telco shipping competitive coding weights with zero NVIDIA dependency matters more than
any single benchmark point. The card itself publishes no limitations section and the
headline numbers carry harness footnotes, so read the 75.0 the way we read all
self-reported harness scores — as an upper bound pending replication.
🔗 huggingface.co/XingChen-AGI/Xing4.0-29B-A4B · 🔗 XingChen-AGI on HF
29. Red Hat OpenShift console CVE-2026-75885: unauthenticated SSRF through devfile endpoints
- Velocity: â–® steady
- Source: NVD / Red Hat · published Sep 18
- Tags:
cve openshift ssrf kubernetes
The OpenShift console's /api/devfile/ and /api/devfile/samples/ endpoints accept
crafted devfile payloads without authentication, yielding server-side request forgery
from the console's context — CVSS 9.3 (Red Hat CNA, secalert@redhat.com Primary), NVD
record published Sep 18. Devfiles are the templates that define cloud workspaces, which
makes their import path a natural SSRF pivot: the console fetches attacker-influenced
URLs from a privileged network position.
Why it matters: OpenShift consoles sit inside clusters with reachability to
metadata services, internal registries and the Kubernetes API itself — SSRF there is a
foothold primitive, not an information leak. Cluster admins should patch via the Red Hat
advisory and audit whether devfile endpoints are exposed beyond the console UI.
🔗 Red Hat CVE · 🔗 Bugzilla 2517885
30. Gravity Forms CVE-2026-84434: unauthenticated arbitrary file upload (CVSS 9.8) — fix version unconfirmed
- Velocity: â–® steady
- Source: NVD / Wordfence · published Sep 19
- Tags:
cve wordpress file-upload rce
Gravity Forms, the form plugin on a large share of WordPress sites, has an unauthenticated
arbitrary file upload in its upload_file routine (affected: ≤3.1.0.4) — a file-type
validation mismatch that permits uploads leading to potential remote code execution.
CVSS 9.8 (Wordfence CNA, found by its Argus scanner); the NVD record was published
overnight Sep 19.
Why it matters: Form plugins are the classic WordPress initial-access vector because
they're ubiquitous and reachable without authentication by design. One honesty note per
our own rules: the exact patched version could not be confirmed from the vendor's
changelog at writing — update to the latest available release and verify the version,
rather than assuming a specific number.
🔗 NVD record CVE-2026-84434 · 🔗 Wordfence threat intel
31. quiche 0.30.0: post-quantum-by-default BoringSSL starts splitting ClientHellos — and QUIC implementers must care
- Velocity: â–® steady
- Source: GitHub release · Sep 17
- Tags:
quic http3 rust post-quantum
Cloudflare's Rust QUIC/HTTP-3 implementation shipped v0.30.0 with two breaking changes
worth more than their changelog size: the boring crate range moves to >=4.19,<6 because
BoringSSL 5 enables post-quantum key groups by default — and a PQ ClientHello can exceed
one Initial packet, splitting the first flight across multiple datagrams, which breaks
QUIC implementations that assume coalesced handshakes. PathEvent also becomes
#[non_exhaustive] with a new PmtuUpdated variant.
Why it matters: The PQ handshake transition is arriving as a packetization problem,
not just a crypto problem — middlebox and peer behavior under multi-Initial handshakes is
exactly where silent breakage lives. Cloudflare shipping the fix in its open-source QUIC
stack first is an early warning for every other QUIC implementation, not just quiche
users.
🔗 quiche · 🔗 v0.30.0 release notes