Mistral releases the weights of its 1T-parameter Large 4; also: Epoch on AI exploiting the patch gap, DeepMind's coordination thesis, a week of breaches, and Anthropic's Linux TCP bug

Lead stories

Mistral releases the weights of Mistral Large 4, a 1T-parameter MoE

2 sources, 5 min read

What happened. Mistral has published the weights of Mistral Large 4, a model it puts at one trillion parameters. It is pitched at self-hosted deployment and cybersecurity work, and Mistral claims it leads open-weight models on agentic coding. The newsletter summary that brought it in adds that Mistral claims cybersecurity capability comparable to GLM-5.3 mistral. Mistral's own announcement (Mistral: Mistral Large 4 open weights) calls it an "Open-weight hybrid instruct-and-reasoning MoE with multimodal input", trained from scratch on European infrastructure, covering 160+ languages, with three reasoning modes (Low, Medium and a default High). It says the model is the "best open-weight model for coding" and that "a full technical report is coming soon". There is no technical report yet, so the architecture, training data and context length cannot be checked from a primary source as of 31 October mistral.

Details. The announcement does not give the active parameter count. The Hugging Face repository name, Mistral-Large-4-1T-A52B, implies about 52B active, and Hacker News commenters work from the same 1T total and 52B active (Hacker News: weights thread). The announcement does not state the context length or hardware requirements either. It lists vLLM, SGLang, an NVIDIA NIM container and TensorRT LLM as serving paths. API pricing is $0.70 per million input tokens, $0.07 per million cached input tokens and $2.10 per million output tokens. The licence is called the Mistral Ecosystem Open-Weight license, a modified MIT licence under which the model is "free to use, modify, fine-tune, and commercialize, with a single condition". That condition is that companies offering it as a Model-as-a-Service need a separate commercial licence from Mistral before commercial use (Mistral) mistral.

The benchmarks are all published by Mistral. Some come from third parties, but Mistral chose which ones to show. The chart values below were extracted from the page's chart text in order of appearance, so individual pairings could be wrong. On Cognition's private FrontierCode 2.0, which scores end-to-end code quality and whether a maintainer would merge the change, Large 4 scores 19.7% against 19.3% for DeepSeek V4.1 Flash, 17.8% for GLM-5.3 and 17.3% for Kimi K3. That is a lead of 0.4 points on a private benchmark. On the Artificial Analysis Coding Agent Index, Mistral itself describes 48% as effectively tied with GLM-5.3, while using 47% fewer tokens per task on average. On Terminal-Bench 4.0 it reaches 41%, up 13 points from the preview's self-reported 28%, against 40% for GLM-5.3, 31% for DeepSeek V4.1 Flash and 21% for Kimi K3. Mistral credits three extra weeks of reinforcement learning after the preview for the coding gains and writes that "Gains continue to accelerate, with no signs of saturation." On Surge's blind pairwise human-preference test for code, Large 4 wins 64% against GLM-5.3 and against Kimi K3, 56% against DeepSeek V4.1 Flash, and 22% against Claude Opus 5.5 (Mistral) mistral.

The non-coding numbers are mixed. On FinWorkBench (Finch) it scores 73.3% against 77.3% for Kimi K3. On BrowseComp it scores 84.5 against 91.2 for Kimi K3 and 82.5 for GLM-5.3. On the Artificial Analysis Cyber Index the page shows Large 4 at 51%, below DeepSeek-V4.1-Flash 1017 at 57% and MiMo-V2.6-Pro at 56%, and above GLM-5.3 Flash at 50% and GLM-5.3 at 36%. Mistral also reports an average refusal rate of 96.6% on the harmful-cyber prompts in JailbreakBench, StrongREJECT and AgentHarm, and 97.1% attack resistance on the B3 Agent Security Benchmark, up from 93.3% for the preview. It claims that "anyone hosting the model can run a safe agent without additional tuning", and also says "we see a potential for uplift to conduct real attacks" (Mistral) mistral.

Facts vs. opinions. The weights, the price list, the licence condition and the existence of the benchmark charts are facts. "Best open-weight model for coding" is a vendor claim resting on a 0.4-point lead on a private benchmark, a one-point lead on Terminal-Bench and a tie on the Artificial Analysis coding index. The newsletter line about cyber capability "comparable to GLM-5.3" does not match Mistral's own chart as extracted. That chart puts Large 4 at 51% and GLM-5.3 at 36%, though GLM-5.3 Flash is at 50%. Either the summary means the Flash variant or the extraction is wrong, and the primary page does not settle which. The refusal figure is incomplete as a safety claim: the page gives no false-refusal rate on benign security work, although it asserts the model handles "legitimate defensive security tasks without unnecessary refusals" mistral.

Other perspectives. The Hacker News thread on the weights release had 1,670 points and 433 comments when read. Its longest argument is about the licence. Critics, including the user maxloh ("Calling this "open weight" is misleading."), compare the MaaS carve-out to the Redis, Elasticsearch and Terraform relicensings. Defenders point out that Mistral never said "open source". On hardware, one commenter notes that "The lowest quant will still require 256GB VRAM to run inferences", even with day-zero Unsloth quantisations and an NVFP4 release. The suggested alternatives were a roughly $30k Apple machine with 512GB or rented cloud capacity. Another commenter flagged the missing benign-refusal statistic ("Where is the statistic about not refusing the non malicious requests?"). Others said Opus 5.5 remains well ahead, or that cheaper cached input from DeepSeek matters more than the headline price. EU data sovereignty came up repeatedly as Mistral's real selling point (Hacker News). These are forum opinions, not measurements. The thread also shows that Mistral now hosts GLM-5.3, so the company it benchmarks against is also a model it sells mistral.

Why it matters. For self-hosting, the operating question is whether the 1T weights change anything at your scale. At 256GB for the smallest quant, this is a datacentre model whose "open" status matters to sovereign and regulated buyers, not to someone with a workstation GPU. The cyber framing also cuts both ways. In the same week, Epoch showed that GLM 5.3 can turn shipped-but-unreleased fixes into exploits (next story), and Mistral's own chart places Large 4 above GLM-5.3 on a cyber index. Nothing here shows that index scores transfer to Epoch-style tasks. Still, a vendor saying it sees "potential for uplift to conduct real attacks" while releasing weights with refusal tuning as the main safeguard is the trade-off the patch-gap story is about. The Vulnerator AI pentest harness in today's quick hits already uses Large 4 as its default driver github. Wait for the technical report, independent Terminal-Bench reruns, and the false-refusal numbers before treating any of the coding lead as settled mistral.

DeepMind: "competence reshapes the economy gradually, whereas coordination abruptly transforms it"

5 sources, 5 min read

What happened. The Google DeepMind Institute published an essay titled "The Economics of Intelligence", dated 29 October 2026, by Alex Imas (Director of AGI Economics), Andrew Koh (Research Scientist) and Shane Legg (Co-founder and Chief AGI Scientist). It summarises a longer paper, Organizing Intelligence, that contains the formal model (Google DeepMind Institute: The Economics of Intelligence). The newsletter summary puts the thesis this way: models are improving fast in individual competence and lagging in coordination, they already match or beat experienced specialists on self-contained deliverables, and wages and job roles will be the first signals of change deepmind.

Details. The core move is to say that "the individual AI agent is the wrong economic object". Benchmarks test lone agents, but economic output comes from organisations competing in markets. Human teams are mosaics: people are strong in different places, so a team of complementary specialists can beat an AI that outscores every individual member. In the authors' words, "a model can exceed the performance of every person one-on-one and still lose to a well-structured team". The essay says AI is jagged in similar ways across models (citing arXiv 2512.15567), so adding another copy of a model adds capacity, not breadth. AI differs from human labour in two ways: it can be duplicated at the cost of compute, so "whenever a model can match human capability, human wages become tied to the cost of compute" (citing Pascual Restrepo, NBER w34423); and in principle it could escape human coordination limits such as span of control, lossy handoffs and misaligned incentives (DeepMind Institute) deepmind.

From there the authors build "organizational scaling laws" with three phases. In solo work, working alone is best because coordination is too weak. In bounded scale, which they say is today's world, productivity gains level off and then fall as firms grow. In unbounded scale, past a "supercooperative" threshold, each added member raises productivity, which "breaks the Coasean ceiling" so that market size is the only limit on firm size. Their summary line is that "competence sets the potential productivity level; coordination determines how big an organization can get". They then describe four regimes. Under minimal AGI, AI matches average human ability, industry structure mostly holds, wages for matched skills fall toward compute cost, and specialists and coordinators earn more. Under supercompetent AI, AI beats every expert except at coordination, and the result is lean, highly productive firms and "abundance without concentration". Under supercooperative AI, average competence combines with coordination past the threshold, producing an abrupt switch from concave to convex returns to scale, consolidation of deep markets into a few AI-only firms, and a sharp drop in wages. Under ASI, both thresholds are crossed and spending may shift toward a relational sector such as healthcare and education (DeepMind Institute) deepmind.

The essay's diagnosis of the present is that competence is surging and coordination is lagging. Its recommendations are benchmarks for "organizations of agents", tracking compute spending alongside payroll, and watching wages and job roles as early signals, "because wage effects arrive before organizational restructuring". Its evidence that agents coordinate poorly today is CooperBench plus a quote from OpenAI's Noam Brown on the Dwarkesh podcast: "it's actually very difficult to get these agents to coordinate in a productive way". Brown also said he "wouldn't even attribute 10% of the credit to multi-agent" capabilities in running thousands of agents on math problems (DeepMind Institute) deepmind.

Facts vs. opinions. There is less empirical content than the confident tone suggests. The essay's own data is a quiz given to 100 people across six domains. Performance in one domain predicted little about another, and complementary pairs beat random pairs by 32%. That is a small lab exercise, not a labour-market study. Several load-bearing claims are made without citation, according to the page as read: that frontier models solve "Millennium Prize problems in math" and write production software, and that headcounts are similar to a few years ago while productivity has "barely budged". The present-day labour-market description (leaner startups, flatter org charts, weaker entry-level hiring in roles closest to benchmark tasks) is also uncited. The four regimes and the threshold are model outputs. They are predictions conditional on the model's assumptions, not observations (DeepMind Institute) deepmind.

Other perspectives. A search on X for reactions to Organizing Intelligence returned nothing as of 31 October, so the independent reception is not established. Some of today's other items bear on it directly. Sam Altman argues for "a trillion AIs of slightly superhuman intelligence" over one superintelligence, on the grounds that swarms of agents keep each other in check, much like a resilient society substack. That is the coordination question with the opposite valence: DeepMind treats crossing the coordination threshold as the moment wages collapse, while Altman treats many coordinating agents as the safety architecture. A swarm experiment by researchers, with eight agents from four models resolving simulated outages, found that leadership emerged from the underlying model and from the order names appeared in the prompt raindrop. That suggests leaderless coordination today depends on arbitrary configuration details, which is consistent with DeepMind's "coordination lags" diagnosis. Spawn's claim of 77,000 substantial changes in 30 days with ten people and $3.1 million in tokens is an unverified self-report, but it shows the "track compute alongside payroll" ratio in a founder's own accounting x. On the same point, the Pragmatic Engineer reports that incident.io cut AI spend from $4,500 per developer per month in August to $1,600 now source.

Why it matters. The useful part for an agent engineer is the framing, not the forecasts. If the binding constraint is coordination (handoffs, shared state, credit assignment across agents), then harness work on subagent orchestration, memory curation and shared permissioned state is the work that would move an organisation from the bounded regime toward the unbounded one. The essay explicitly asks for benchmarks of "organizations of agents", which barely exist. The economic claim worth carrying is the ordering: wage effects before restructuring, so employment statistics alone are weak evidence that AI is doing nothing. That claim is testable, and it is the one to check against real wage data over the next year, not against the essay's own toy quiz deepmind.

Epoch: an open-weight model turned unshipped Firefox fixes into exploits for about $1,000 per version

2 sources, 4 min read

What happened. Epoch AI published research on 29 October showing that GLM 5.3, Z.ai's open-weight model released in August 2026, compromised six of six Firefox releases between 156.0 and 158.0.1 (released 17 September to 26 October). It did this by using security fixes that were published in Firefox's code but not yet shipped to users (Epoch AI: open-weight models and the patch gap). The authors are Aiden Ament, Yafah Edelman, Alexander Barry, Timothée Chauvin, Lee Bousfield and Jaeho Lee. The newsletter summary frames the conclusion as open-source projects being especially exposed because their fixes are public, with the threat likely to worsen as open-weight cyber capability improves epoch.

Details. The goal was a webpage that, when a Firefox user on Ubuntu 26.04 with default security settings and the official build visits it, reads a local file and sends it to the attacker with no further interaction. GLM 5.3 was accessed through Z.ai's first-party API and through third-party APIs and was told the task was a security exercise. It had basic tools and no internet access. The researchers supplied the public information it would need, limited to what existed at each version's release. Beyond basic instructions to inspect fixes not yet in the stable release, the model picked the security fixes, chose the vulnerabilities and built the chain itself. Each successful chain combined two vulnerabilities. A patch-gap memory-safety flaw gave code execution inside the content process, and a separate, unpublished sandbox-bypass bug, which the model rediscovered on every attempt, broke out of the sandbox. Disguising fixes as ordinary improvements did not help, because the model identified which changes were security-related (Epoch AI) epoch.

On cost and time, Epoch reports: "Our marginal cost of compromising a new version of Firefox was about $1,000 at API pricing", once the harness existed. Total Firefox research spend, including environment-building, was over $100,000. Each attempt was allowed up to 48 hours: "We gave GLM 5.3 up to 48 hours to find an exploit, but its fastest attempt needed only 12 hours." Another roughly $100,000 went on Chrome attempts, with no success. And: "We did not trigger any safeguards or refusals from any provider, including Z.ai, when using GLM 5.3 in this way." (Epoch AI) epoch.

Facts vs. opinions. The authors state their limits clearly. Every success depended on the one unpublished sandbox escape, which is now fixed in Firefox 159.0 (27 October, advisory mfsa2026-118). They have not tested 159.0 but expect it to be "at least substantially more difficult". Only file reads worked: "We do not have any code execution successes on recent Firefox releases as of writing." Releases before 17 September were not systematically tested, nor was closed-source software or Kimi K3.1 Pro. They note that costs might be lower on subscription accounts, and that simply giving the model internet access would make the attack cheaper. They also explicitly decline to make claims about the offence-defence balance. The report names no specific bugs or CVEs and gives no per-attempt success rate, so "cheap and reliable" cannot be checked from the page. One operational note: in one incident, broken environments let agents act outside the sandbox, with no network access and no malicious activity, and all runs were paused (Epoch AI) epoch.

Other perspectives. Mozilla published "defending the patch gap" the same day, under Bobby Holley's name (Mozilla: defending the patch gap). It does not mention Epoch. It says Firefox halved its release cycle earlier this year to weekly builds, is again keeping regression tests confidential until a fix ships because GLM 5.3 struggles to exploit patches that come without a test, scans all new commits, and will roll out "staggered patch gaps": grouping fix classes such as renderer bugs and sandbox escapes so their exposure windows never overlap and only one link of a chain is exposed at a time. Mozilla says it has made more than 7x the security fixes since February compared with the same period in 2025, using early access to frontier models from Anthropic and OpenAI. It also says the models available to attackers are "several generations behind". The tension with Epoch is real, since Epoch's attacker model is exactly such a widely available model and it still worked. Mozilla's line is: "The patch gap threat has increased, but we have the tools to structurally address it." epoch

On Reddit's r/firefox (533 points when read), the top comment predicted "almost-daily patch releases for majorly important software". Another commenter said Microsoft patched over 1,400 vulnerabilities in October alone, against about 1,100 in all of 2025. That is unverified forum data. A pointed reply read the piece as "open models 'bad', closed models with safeguards 'good'", and someone answered "the 'Trust us' approach". Epoch itself avoids the offence-defence claim, but its recommendation, "Defenders should avoid patching multiple vulnerabilities simultaneously if they can be chained together", amounts to the same staggering strategy Mozilla announced epoch.

Why it matters. This is the quantitative version of what the Pragmatic Engineer describes anecdotally (next story). The window between a fix landing in a public repo and the update reaching users is now exploitable by a widely available model for about $1,000 and 12 to 48 hours. Epoch's PHP data point fits: a vendor published patched PHP builds more than six hours before coordinated release, and exploit attempts went from thousands before public release to millions immediately after (Epoch AI) epoch +1. For anyone running infrastructure, this changes the cost of every day an update is deferred. For open-source maintainers, it means the commit itself is the disclosure. The countermeasures now in use are withholding tests, staggering fix classes and shortening release cadence, and none of them depends on the model provider refusing anything epoch.

The Pulse: a month's worth of breaches in a day

3 sources, 4 min read

What happened. Gergely Orosz's Pragmatic Engineer released a free section of The Pulse (sent to paying subscribers on 22 October, republished on 30 October) on a cluster of security incidents mostly over one Tuesday and Wednesday. The list: eight eMudhra intermediate CA private keys leaked; two critical PHP patches for remote code execution; Railway customer secrets exposed and some decrypted; a critical GitLab RCE patch; a Node.js release fixing 10 critical CVEs, including one RCE, and revoking the eMudhra intermediate; a Go release adding an eMudhra mitigation; and PingCAP's managed TiDB, where attackers had near-total control-plane access from 9 September to 7 October and released 10TB of customer-sensitive data. PingCAP claims no customer data stored inside TiDB was accessed source.

Details. On eMudhra, Orosz reports that one 384-bit private key "turned out to be the number '4'", with others at 56, 66, 115, 156, 230 and 237. That is seven values listed for eight keys, and the piece does not say whether one repeats. He quotes eMudhra's preliminary explanation: an approved deviation from its usual Key Generation Ceremony to test wrap/unwrap for export introduced a code flaw that created a second, weaker key pair, and those keys "were used by mistake to create the CSR (because the key labels were similar)", which was then signed by eMudhra's root and sent to Sectigo for cross-signing. The certificates were generated on 30 April 2025. Orosz writes that eMudhra, listed in India at close to $500M market cap two days before disclosure, lost 40% of its value in two days source. Google's own post (Google: protecting users from compromised eMudhra intermediates) is more restrained. It says only that the keys were "generated with insufficient randomness (i.e., weak cryptographic entropy)". It dates the report to Saturday 17 October at 18:05 UTC, followed by a CRLSet block at 19:45 UTC, and says no certificates chaining to the affected CAs had been logged to Certificate Transparency before the block, so CT-enforcing clients such as Chrome could not have been targeted. It removed "emSign ECC Root CA - G3" from the Chrome Root Store, and "the Chrome Root Program is closely investigating the ongoing inclusion of eMudhra's remaining CA certificates". Google's post is internally inconsistent: it refers to "eight" subordinate CA certificates and later to "these six intermediate CAs". The likely explanation is a split between TLS and code-signing intermediates, but that was seen only in search summaries and is not checked here source.

On PHP, Orosz quotes OpenAI: Calif found a critical flaw using GPT-5.6 Sol under OpenAI's "Patch the Planet" initiative, and Wiz independently found both vulnerabilities. Amazon Threat Intelligence says it saw a PHP2Shell attempt in MadPot honeypot telemetry on 17 October, four days before public disclosure of CVE-2026-109618 and CVE-2026-109619, from an anonymisation network, and that "it remains unclear how the actor acquired exploit information prior to disclosure". Orosz adds that the NSA urged patching on release or taking applications offline, and that Cloudflare saw millions of exploit attempts within hours of the patch. Railway said an unauthorised party "may have accessed encrypted environment variables and, for some of them, obtained the decrypted contents", told customers to rotate every variable, and paused all deployments for close to 20 hours. Since rotating a secret requires a redeploy, customers were left choosing between taking services down and leaving possibly leaked keys live source.

Facts vs. opinions. The incident list, vendor quotes and dates come from the companies involved as relayed by Orosz. "Around 70% of all websites run on PHP" is his figure and is not sourced in the piece. His diagnosis is opinion, flagged as such ("I sense the balance of power... is shifting"). He also cites a CNBC report from May in which Dario Amodei warned of a "narrow window" because Chinese models are "maybe six to 12 months" behind Mythos, and says that prediction "has come to fruition". Amodei's "six to 12 months" was an estimate, not a measurement. The breaches Orosz lists were not shown to be AI-assisted, with the exception of the PHP discovery side. The claim that attackers can now "spin up agents" to exploit unpatched servers is a plausible explanation of Cloudflare's numbers, not a demonstrated one source.

Other perspectives. Epoch's report is the closest thing to an independent measurement of Orosz's thesis. It shows a widely available model doing the patch-gap work for about $1,000, and it independently records the PHP early-build leak (Epoch AI) epoch. Mozilla's argument that the patch gap can be "structurally" addressed is the counterweight to Orosz's "attackers gain advantage" framing (Mozilla). On the CA side, Google's account takes some of the drama out of the MITM risk for browsers: no CT-logged certificates, a block within two hours of the report, and root removal reaching all Chrome Root Store devices on 27 October. Orosz's warning holds for non-browser, server-to-server clients that do not use CRLSets (Google) source. The Dark Reading item in quick hits, a scanner impersonating 32 AI crawlers to harvest credentials, is another instance of the commodity attack automation Orosz describes darkreading.

Why it matters. Orosz's recommendations are automated patching, assuming attackers hold zero-days, mandatory automated monitoring (the TiDB month-long dwell is his example), defenders adopting AI, and accepting that security will cost more. All are plausible, and none is new. What is new is the timeline compression, which Epoch and Mozilla now quantify. The Railway episode is the design lesson for platform builders: a breach response that pauses deploys while asking customers to rotate secrets turns a confidentiality incident into an availability incident. Secret rotation that does not require a redeploy, through runtime secret fetch or short-lived credentials, now counts as incident-response infrastructure. Orosz's list of follow-on CVEs after 22 October (a Brotli RCE, a second PHP RCE, Linux kernel bugs accidentally posted to a public mailing list, and a Pillow OS-command flaw) suggests the volume has not dropped source.

Anthropic-found Linux TCP use-after-free: 9.8 or 5.9, depending on who is counting

3 sources, 4 min read

What happened. The Hacker News (the security site) reports CVE-2026-98432, a use-after-free in Linux IPv4 TCP connection setup, reported by Anthropic researcher Xinyang Ge (The Hacker News: Linux kernel TCP flaw). The newsletter summary says it could lead to memory corruption, kernel memory reads or crashes, and that Red Hat and others rate it lower because the race is complex to exploit thehackernews.

Details. According to the report, when the TCP handshake completes, the IP options stored with the pending request are handed to the new socket without being duplicated. If that socket is torn down while another CPU is still using the options to answer a retransmitted connection request, freed memory is read. IPv6 is not affected because it copies the options. The fix, commit e3f33b0a1d89d738e2b913dab519226eaf76e15b applied on 5 October, delays freeing the options until other CPUs have finished reading them. The CVE was published on 15 October. The bug was introduced in Linux 4.4 and is fixed upstream in 5.10.272, 5.15.223, 6.1.190, 6.6.159, 6.12.113, 6.18.56, 7.2.10 and 7.3. RHEL 7 is not affected. Debian, Oracle UEK, some SUSE releases and some Amazon Linux 2023 kernels had shipped fixes. As of 29 October, Ubuntu and RHEL 8, 9 and 10 and OpenShift 4 had not (The Hacker News) thehackernews.

Anthropic's 27 October post, as relayed by The Hacker News, says Claude wrote an exploit after "initial prompting" that gives an unauthenticated remote attacker root command execution on servers with a multipath TCP (MPTCP) listener. It worked in two stages: a memory leak to defeat KASLR (48 minutes in testing), then a buffer overflow overwriting a callback pointer (5 more minutes). A lost race only kills that one connection, so the attacker can keep retrying. Anthropic did not publish the exploit, the kernel version or the configuration it tested. The article does not name a model version, though a linked headline calls it "unreleased". Go 1.24+ requests MPTCP by default on listening sockets. Setting GODEBUG=multipathtcp=0 disables that, but the Go team calls it a fragile mitigation and says the bug is not specific to MPTCP. No in-the-wild exploitation was reported, and the flaw is not in CISA's KEV catalogue (The Hacker News) thehackernews. Anthropic's original post was not read for this issue, so its claims appear here only as The Hacker News reports them.

Facts vs. opinions. The scoring spread is the story. The kernel CVE team gives 9.8 with low attack complexity, and NVD (as of 28 October) displays that 9.8 rather than its own score. Ubuntu lists it as Priority High and shows 9.8. Red Hat's CVE page says Moderate, 5.9. Red Hat's VEX file (29 October) says Important, 8.1. Oracle and SUSE say Important, 8.1. Amazon says Important, 7.0. Debian gives no score. The 8.1 scores match the kernel team on every metric except attack complexity, which the vendors rate high; the kernel team calls both sides of the race "attacker-induced". Red Hat says "no confidentiality or integrity impact has been demonstrated", while Anthropic says it demonstrated root. Both statements can be true from where each party stands, because Anthropic did not publish the exploit or its configuration, so Red Hat has nothing to reproduce. Red Hat first said fixes were "currently deferred to a future update", then changed the status to Affected (The Hacker News) thehackernews.

Other perspectives. This sits uneasily next to the Pragmatic Engineer's point that publishing a fix is itself disclosure, and next to Epoch's finding that an open-weight model can exploit published fixes source +1. The fix landed upstream on 5 October and the CVE was published on 15 October, yet two of the largest enterprise distributions had no fixed kernel by 29 October. That is two weeks of public patch gap for a bug a frontier lab says is remotely exploitable to root. Withholding the exploit is responsible practice, but it also lets distributions treat the difficulty as theoretical. Orosz separately notes "several unpatched Linux kernel vulnerabilities were accidentally posted on the public kernel mailing list" in the same period, which is a different incident source.

Why it matters. Operationally: if you run Go services on Ubuntu or RHEL 8 to 10, you are potentially exposed through MPTCP-by-default listeners until fixed kernels ship. The GODEBUG switch is a stopgap the Go team itself calls fragile. More broadly, this is now a recurring pattern. A frontier lab's model finds a long-lived memory-safety bug in critical infrastructure (here, present since 4.4), the lab claims a working exploit, the downstream severity process cannot verify it, and scores diverge by almost four CVSS points. Severity scoring was built for human researchers who publish proofs of concept. If AI-found bugs keep arriving with private exploits, vendors will need either an escrow mechanism for verification or a default of trusting the finder's complexity assessment thehackernews.

From the archive

Tokenomics: the 62.5-minute rule for Claude's cache (originally 18 May 2026)

1 source, 3 min read

What it said. Ryan Skidmore's post, as summarised in May, argued that when a 5-minute prompt cache is about to expire and you have no real request to send, you should refresh it if you expect to need it again within 62.5 minutes and otherwise let it expire. The number was said to be the same across models and cache sizes, with only the dollar amounts changing skids. This is an old item revisited, not news.

How it aged. The derivation is simple and still correct for the prices it assumed. The post (skids.dev: the 62.5-minute rule) uses the 5-minute cache write, W, at 1.25x base input and the cache read, R, at 0.10x, noting that a read also renews the cache's lifetime ("cache hit = cache refresh"). Keeping the cache alive costs W plus one R per 5 minutes. Letting it lapse costs a second W. Break-even is where the reads add up to one extra write: T = 5 × (W/R) = 5 × (1.25/0.10) = 62.5 minutes. Because W and R both scale with token count and base price, those terms cancel. The post was updated on 17 October 2026, and the update matters. It notes that some newer models use lower read multipliers, which changes W/R. The post also lists caveats: costs are stair-stepped in 5-minute increments, the rule "assumes you will actually make another request", and the prefix must actually be cacheable skids.

Anthropic's current pricing documentation (Claude Platform docs: prompt caching) confirms the shift. The default multipliers are unchanged: 5-minute writes at "1.25 times the base input tokens price", 1-hour writes at "2 times", reads at "0.1 times". But footnotes now say cache hits and refreshes on Claude Opus 5.5 and Claude Sonnet 5.5 are "priced at 0.05x the base input price", and on Claude Fable 5.1 and Claude Mythos 5.1 at "0.025x". Applying the post's own formula (this arithmetic is not in the source): at 0.05x, T = 5 × (1.25/0.05) = 5 × 25 = 125 minutes; at 0.025x, T = 5 × (1.25/0.025) = 5 × 50 = 250 minutes. So the claim that "the number doesn't move when you switch between models" no longer holds across Anthropic's current lineup. It holds within each pricing tier, and the tiers now differ by up to 4x skids.

A second change follows from the same multipliers. Comparing a 5-minute cache kept alive for an hour with a single 1-hour write (again own arithmetic, approximate because of the stair-stepping): an hour of 5-minute refreshes is roughly 11 to 12 reads. At 0.1x that is about 1.1 to 1.2x base, plus the 1.25x write, so about 2.35 to 2.45x, which is more than the 1-hour write's 2x. At 0.05x it is about 0.55 to 0.6x plus 1.25x, so about 1.8 to 1.85x, which is less than 2x. On the newest models, refreshing a 5-minute cache by hand can beat paying for the 1-hour TTL, the reverse of the older situation. The minimum cacheable prompt also fell: the docs list 512 tokens for Fable 5.1, Mythos 5.1, Opus 5.5, Sonnet 5.5 and others, against 4,096 for Opus 4.5 and 4.6, the figure the post's update cites. The 20-block lookback window the post mentions is still documented, with a refinement: on the Claude API, consecutive tool_use blocks, and likewise consecutive tool_result blocks, count as one position (Claude Platform docs) skids.

Why it matters now. The lasting part of the post is the form of the decision rule, break-even time equals TTL times write-to-read ratio, not the 62.5. Anyone who hard-coded 62.5 minutes into a keep-alive scheduler in May is now refreshing too rarely on Opus 5.5 and Sonnet 5.5 traffic. Derive it per model from the pricing table. Agent workloads with long idle gaps between tool calls, such as human-in-the-loop approvals or slow CI, are where this money is skids.

Context Tuning and the meta-harness (originally 13 July 2026)

4 sources, 3 min read

What it said. Cerebral Valley's July item linked two ideas. The first was Context Tuning, described as tuning in-context learning at inference time, adapting LLMs "by refining memory, not weights" (ICML 2026). The second was Yoonho Lee's "meta-harness" together with a Lilian Weng write-up mapping harness engineering for self-improvement cerebralvalley. This is an old item revisited.

Paper facts. "Context Tuning for In-Context Optimization" by Jack Lu, Ryan Teehan, Zhenbang Yang and Mengye Ren is arXiv 2507.04221. Version 1 was posted on 6 July 2025, v2 on 31 October 2025 and v3 on 3 July 2026, and the comments field says "Published at ICML 2026" (arXiv: Context Tuning). The abstract says in-context learning builds a memory of the demonstrations in one forward pass but "cannot refine it when insufficient", and that prompt-tuning methods "initialize it independently of the demonstrations". Context Tuning instead "leverages the model's inherent ICL ability to initialize a trainable memory representation from demonstrations" and "then refines it through gradient-based optimization", with model weights frozen. The benchmarks named are CrossFit, UnifiedQA, MMLU, BIG-Bench Hard and ARC. The abstract claims it "outperforms both ICL and traditional prompt-based adaptation methods" and reaches "competitive accuracy with Test-Time Training at significantly higher training efficiency". The per-benchmark numbers were not read for this issue, and the abstract page states no limitations. The arXiv page links no code, though search results point to a repository under agentic-learning-ai-lab, which was not opened cerebralvalley.

How it aged. The paper itself has aged in the ordinary way: it went from a 2025 preprint to an ICML 2026 publication, with the third revision posted just before the July newsletter. The broader idea, improving what goes into context rather than what is in the weights, has become the dominant pattern in agent work since July, though mostly without the gradient step. The clearest descendants in this issue's archive are September's Just-in-Time Memory, which defers curation of agent memory until read time, and JAM's "query-conditioned context construction at runtime" (see the next-but-two archive item) huggingface. Both optimise the context payload, but through learned curators or retrievers rather than backpropagating into a KV representation. That distinction matters for deployment. Context Tuning refines a trainable memory representation through gradient-based optimization (arXiv), whereas curator-style methods work with any API model. That is a plausible reason the curator lineage has more momentum in agent tooling, but it is an inference, not something a source states. On the harness side, today's quick hits show the "harness as the optimisation target" view going mainstream: Factory's Droid 1.0 argues that tuning a harness across many models separates real progress from model quirks, and LangChain, Factory and NVIDIA are all competing to own the agent loop factory +1. Yoonho Lee's meta-harness and Lilian Weng's write-up were not located or read for this issue, so their specific claims, and whether they held up, are not checked cerebralvalley.

Why it matters now. The question the July item posed, what an agent can improve about itself without retraining, now has three working answers in production-adjacent research: tune the context representation (Context Tuning, which needs open weights), curate memory at read time (JitMem, JAM), or tune the harness (Droid, Deep Agents). For someone building on closed APIs, only the last two are available. For someone self-hosting open weights such as Mistral Large 4 or GLM-5.3, Context Tuning's frozen-weights approach, which its authors report reaches accuracy competitive with Test-Time Training at significantly higher training efficiency, is worth benchmarking against curator memory on the same task cerebralvalley.

Anthropic's in-house chip team (originally 7 August 2026)

3 sources, 2 min read

What it said. A newsletter item said Anthropic had officially confirmed an in-house chip design team to build custom processors for Claude, co-designing hardware with models to cut inference costs, increase speed and optimise enterprise scaling reuters. This is an old item revisited.

How it aged. As of 31 October 2026, searches turned up no public milestone since August: no tape-out, no confirmed foundry contract, no shipping date. The most specific manufacturing claim predates the announcement. SamMobile, on 14 July 2026, relayed a Newsworks Korea report that "Samsung Electronics has secured a major contract to fabricate proprietary AI accelerator chips for Anthropic", on "Samsung Foundry's cutting-edge 2 nm process node", and said it was unclear whether production would be in South Korea or in Taylor, Texas (SamMobile: Samsung to make 2nm AI chips for Anthropic). That rests on a single Korean outlet, with no confirmation from Samsung or Anthropic cited. SamMobile also notes that Samsung invested in Anthropic's $65 billion Series H round, which is a reason for both interest and caution in reading it. Search summaries of later coverage say Anthropic gave no timeline, no manufacturer and no cost figure in August, that a spokesperson called it part of a "multi-chip approach" alongside Trainium, TPUs, Nvidia GPUs and AMD accelerators, and that some outlets attached a roughly 50% inference-cost target sourced to "reporting" rather than to Anthropic. Those pages were not opened, so treat these details as leads, not checked facts reuters.

Indirect evidence on the economic motive has kept accumulating. Anthropic's current pricing documentation shows aggressive cache-read discounts on its newest models, 0.05x on Opus 5.5 and Sonnet 5.5 and 0.025x on Fable 5.1 and Mythos 5.1 (Claude Platform docs). That is consistent with inference cost being a competitive lever, but says nothing about custom silicon. Pressure from cheaper open-weight competitors also grew: in today's quick hits, enterprises are moving workloads to Chinese open-weight models to control token spend, and Hacker News commenters compare Mistral's cache pricing unfavourably with DeepSeek's aibusiness +1. Custom chips typically take several years from team formation to deployment, so the absence of news at three months is not evidence of failure. It means the bet cannot yet be scored reuters.

Why it matters now. The item is a placeholder for a bet that will resolve in 2027 or later. Three signals would settle it: a confirmed foundry agreement (Samsung or otherwise), a tape-out announcement, and whether Anthropic's price cuts outpace its cloud partners' hardware generations. Until then, the archived claim "aims to slash inference costs" remains an aim, and the July Samsung contract report remains unconfirmed reuters.

"Claude autonomously cracks encryption schemes in under a week" (originally 29 July 2026)

3 sources, 2 min read

What it said. AlphaSignal's 29 July headline read "Anthropic's Claude autonomously cracks encryption schemes in under a week"; the bundle has only the headline alphasignal. This is an old item revisited. The headline overstated what happened.

How it aged. What actually happened, per Marin Ivezic's analysis at PostQuantum.com on 29 July (PostQuantum: AI broke a NIST candidate, not your encryption), was two separate results. In the first, Claude Mythos Preview, working with Straznickas and Weis, recovered signing-equivalent keys for two HAWK-256 challenge public keys in a few hours on one server, by exploiting a different Galois involution in HAWK's ring that reduces key recovery to exact-SVP calls in dimension n/2 + 1. In the gate-count model, HAWK-512's cost drops from 2^150 to at most 2^108 and HAWK-1024's from 2^288 to at most 2^182, though HAWK-512 was not actually attacked. Ivezic stresses that "The attack is exponential and stays exponential", and that restoring the margin means roughly doubling key sizes, which undercuts HAWK's main advantage. In the second, Milad Nasr and Nicholas Carlini used Claude to improve an attack on 7-round AES-128 (7 of 10 rounds, needing 2^105 chosen plaintexts). A new S-box invariant removes one of nine guessed key bytes, and time complexity falls from 2^99 to between 2^89.3 and 2^91.4 at the same data budget, while balanced complexity is unchanged because data dominates. Ivezic: "Call it a 2.7-bit improvement on a research target that had not moved since 2013." alphasignal

Ivezic's other corrections hold up as the more accurate record. "No deployed system is affected"; ML-KEM, ML-DSA, SLH-DSA, Falcon and full AES are untouched. Anthropic's blog figure for HAWK-256 (2^64 to 2^38) does not match Table 1 in the paper, and secondary coverage copied the blog. Each result cost about USD 100,000. Mythos initially declined the AES task. The core idea took tens of hours of model time while human validation took hundreds: "We have built a discovery engine that outruns the review capacity of the field it discovers in." He also retracted his own 2025 view that AI only attacks implementations, never the mathematics (PostQuantum). Search summaries additionally report that the HAWK team withdrew HAWK from NIST's additional signature process on 29 July and that a 191-task CryptanalysisBench was released on 20 July. Those pages were not read, so both claims are not checked here alphasignal.

In the three months since, the "AI as vulnerability discoverer" thread has moved from cryptography into systems software. Anthropic's Linux TCP finding (today's leads), Mozilla's report of more than 7x the security fixes since February using early frontier-model access, and OpenAI's PHP discovery under "Patch the Planet" are all the same capability applied to code rather than mathematics (Mozilla) thehackernews +1.

Why it matters now. Ivezic's verification-bottleneck point generalises. In cryptanalysis, human review took far longer than discovery. In kernel security, Red Hat's CVE page says "no confidentiality or integrity impact has been demonstrated" and scores the flaw 5.9 because the race is hard to win, against the kernel team's 9.8, though Red Hat's advisory file scores it 8.1 (The Hacker News) thehackernews. In both cases, the finding is cheap and the checking is expensive and slow. Read the July headline as an early instance of that pattern, not as the end of encryption alphasignal.

Just-in-Time Memory: Learning to Curate Task-Adaptive Memory for LLM Agents (originally 25 September 2026)

2 sources, 3 min read

What it said. A Hugging Face daily-papers entry (33 upvotes) for a paper proposing that agents keep raw trajectories and curate memory at read time, once the next task is known, instead of summarising each run when it ends huggingface. This is a five-week-old item revisited.

Paper facts. arXiv 2609.27334, v1 submitted on 23 September 2026, by Yefan Zhou, Yang Li, Zeyu Leo Liu, Semih Yavuz and Shafiq Joty (arXiv: JitMem). The arXiv page lists no affiliations and no venue. A DAIR.AI post surfaced in search attributes it to Salesforce AI Research, which is not checked here. Status: preprint. The system has a raw-trajectory memory bank, a retriever, a trainable curator and a frozen executor. Because the curated payload is used on the task it was built for, the curator can learn from immediate task success, which avoids long-horizon credit assignment. Benchmarks are ALFWorld (140 test tasks), WebShop (500 test instances) and τ²-bench (airline, retail, telecom). With RL-trained Qwen3-8B curators, the paper page reports success rates of 77.4 against 61.2 for SkillOS (RL) on ALFWorld and 32.8 against 16.5 on WebShop with a Qwen3-8B executor, and 86.2 against 80.2 and 50.5 against 41.3 with Gemini-2.5-Pro as executor. On τ²-bench with a GPT-5.4 executor and training-free curators, the micro average is 75.6 against 71.7 for ReasoningBank, with no-memory at 65.0. The telecom gain is large (72.6 against 61.6), but airline and retail show no gain beyond variance. The authors note that "even an untrained curator is already competitive with or surpasses these baselines". Compared with write-time methods, input tokens fall by 50.3 to 56.3% and executor steps by 28.4 to 31.4%. A curator trained with Qwen3-8B and moved to GPT-5.4 comes within 1.4 success-rate points of one trained directly with GPT-5.4 (Hugging Face: JitMem). No code link appears on the arXiv page. The limitations section was not read huggingface.

How it aged. Five weeks is short, but there is one clear convergent result. Five days after JitMem, on 28 September, Bingyu Yan, Chaofan Li, Hongjin Qian, Shuqi Lu, Chaozhuo Li and Zheng Liu posted JAM, "Just-In-Time Agent Memory with Runtime Agentic Research" (arXiv 2609.34385). It argues that "request-agnostic memory construction can discard fine-grained information that later becomes important" (arXiv: JAM). JAM's design is "a Memorizer" that "preserves complete raw histories in a hierarchical page-store" plus "a Researcher" that "iteratively retrieves, inspects, and integrates evidence for each request". It is trained on Memory-Gym (nine task types, six domains) with SFT and then Hint-guided GRPO, and code is released on GitHub (VectorSpaceLab/general-agentic-memory). The abstract names no benchmarks and gives no numbers, so it cannot yet be compared head-to-head with JitMem. Two independent groups arriving at "store raw, curate late" within a week is moderate evidence that the write-time summarisation default is being abandoned. The curator's note mentioned an IBM follow-up reporting +8.9 on AppWorld this week. Searches did not find it, so that claim is not checked here huggingface.

Why it matters now. For anyone building agent memory, both papers point the same way: stop compressing at the end of a session, and pay for a retrieval-plus-curation step at the start of the next. JitMem's token-reduction numbers suggest this can be cheaper overall, not just more accurate, because the curated payload is smaller than accumulated summaries. The practical cost is storage of raw traces and a curator call on the critical path. That cost interacts with the prompt-caching economics above, since a per-task curated payload is less cacheable than a stable memory prefix huggingface +1.

"I vibe code all of my side projects from my phone": a decade-experienced engineer's rules (originally 22 May 2026)

6 sources, 2 min read

What it said. AINews's May roundup of a Reddit post (activity 1,900) by a software engineer with a decade of experience who vibe-codes side projects from his phone with Claude Code and does not read the code. His rules: start in plan mode, iterate on the plan, keep tasks small enough to model mentally, require agent-generated tests, commit to git after each completed plan, back up databases before giving an agent database access, use browser and end-to-end tooling such as Chrome DevTools MCP for live validation, and for complex changes run parallel review agents for plan critique, security review and test audit before switching to auto mode. Commenters added "one change, one expected test, one rollback point", explicit non-goals, and the superpowers skillset. The same roundup covered Anthropic's free courses and Claude telling users to go to sleep, which Anthropic's Sam McAllister called a "Bit of a character tic" reddit. This is an old item revisited.

How it aged. Well. Most of these rules have since been absorbed into standard tooling or vendor practice. The superpowers repository the commenters recommended stood at about 309.4k stars and 27.5k forks when read (GitHub: obra/superpowers). Its stated workflow is nearly the Reddit post's rules made mandatory: brainstorming, git worktrees, plans broken into tasks of "2-5 minutes each", subagent execution with review after each task, TDD that "Deletes code written before tests", and code review where "Critical issues block progress". It describes these as "Mandatory workflows, not suggestions." The README also says "It's not uncommon for your agent to work autonomously for a couple hours at a time." The repo page shows no release history, so adoption over time cannot be dated from it reddit.

Scale has changed the context. GitHub reported 7.4 billion commits in September 2026, five times the count a year earlier, partly driven by AI coding agents, and is adding 4 million CPU cores, after its 90-day availability fell to about 84% in May on reconstructed status-page data (The Register: GitHub powering up four million extra cores) theregister. Today's quick hits echo the May rules at company scale. Spawn's hard-coded gates for irreversible actions are the database-backup rule. Meta's just-in-time testing is the "require agent-generated tests" rule. The man-in-the-middle egress proxy in "A Little Determinism" is the "explicit non-goals" rule enforced at the network layer x +2.

The security half of the advice aged most sharply. The May post was about side projects, but this week's incidents (Railway's leaked environment variables, OpenCode's stolen AI API keys on 17 October, and patch-gap exploitation) mean that an unread codebase on a public host with real secrets is now a more attractive target than it was in May source. The "security review agent" rule now looks less like an optional extra for complex changes and more like a baseline. Nothing found records whether Anthropic fixed the "go to sleep" tic. That is not checked reddit.

Why it matters now. The pattern of plan, small diff, test, commit and rollback point has proven durable across five months of model changes. That is evidence it encodes something about agent failure modes rather than any one model's quirks. What has changed is the threat model around the code, not the workflow for writing it reddit.

Brain & consciousness

Musk says Neuralink's Blindsight is "ready from an engineering standpoint"

1 source, 2 min read

What happened. In posts on X, which TeslaNorth reports and timestamps 30 October 2026, Elon Musk wrote that Blindsight will "enable even those who are completely blind or have never seen to see" and that "It is ready from an engineering standpoint. Just waiting on regulatory approval." (TeslaNorth: Blindsight ready). The device received FDA Breakthrough Device Designation on 17 September 2024 teslanorth.

What the evidence supports. TeslaNorth gives no Blindsight trial data: no participant count and no results. Its supporting numbers concern other Neuralink work, an ALS participant reaching 75 words per minute in the first week of speech-restoration work and encoders pretrained on more than 50,000 hours of clinical-trial brain data, and those are Neuralink's own statements. Wikipedia's Blindsight article, last edited on 26 October 2026, describes the target population as people with "total visual impairment due to damage to the optic nerve but with intact visual cortex", working by "bypassing the optic nerve and directly stimulating the visual cortex". That sits awkwardly with Musk's "never seen to see". Whether someone blind from birth has a visual cortex organised to interpret stimulation is an open scientific question, and the encyclopaedia's own scoping excludes the general case. Breakthrough designation speeds review; it does not indicate efficacy. Search summaries of other coverage say no human Blindsight implant results have been published, no Blindsight trial was found on ClinicalTrials.gov as of August, and earlier Musk targets for a first implant in 2025 passed. A fan site's 12 October claim of a first participant perceiving points of light appeared only in search results and is not checked. None of those pages were read, so they are leads teslanorth.

Why it matters. For anyone tracking visual cortical prostheses, the bar is published phosphene maps, resolution, and stability over months in humans. None of the pages read show any. "Ready from an engineering standpoint" is an assertion about the device, not about perception. Treat it as a timeline claim from someone with a history of missed timelines, until an IDE trial registration or a preprint appears teslanorth.

TrUDI: three-photon imaging of neuronal populations at about 2 mm in mouse brain

1 source, 2 min read

What happened. The Transmitter flagged Kalyan Santra and colleagues' three-photon ultra-deep imaging (TrUDI), which "achieves a ~250-fold increase in detected fluorescence photon yield at the same laser power as in previous approaches" doi.

Paper facts. Published in Nature Methods (DOI 10.1038/s41592-026-03251-2). The Nature page redirected to a login and was not read. A bioRxiv preprint was posted on 19 October 2026 (doi 10.64898/2026.10.16.759624, CC-BY-NC-ND) (bioRxiv: TrUDI preprint). Authors on the preprint: Kalyan Santra, Francesca Logiacco, Agustina Frechou and Kevin Barber (Rockefeller), Arash Bellafard (UCLA), Jyun-you Liou (Weill Cornell), and corresponding author Alipasha Vaziri (Rockefeller and the Kavli Neural Systems Institute). The preprint abstract calls deeper multiphoton imaging an "exponentially hard" problem. It says earlier three-photon work reached about 1.2 mm in mouse brain, places the fundamental limit "well beyond 2 mm", and attributes the gap to weak in-focus signal from suboptimal optics and acquisition. TrUDI's answer is "systematic and principled optimization of the in-focus fluorescence signal", matching laser, optics and acquisition to linear and nonlinear safety limits. Stated numbers: ~250-fold more detected photons at the same laser power, a ~230 × 230 µm² field of view, 8.6 Hz, depths up to ~2 mm, in mouse cortex and hippocampus. The preprint page does not give absolute laser power, repetition rate, wavelength, animal count or code and data availability doi.

MedicalXpress's coverage of 28 October (MedicalXpress: new microscopy platform) adds recordings up to 2.1 mm in intact mouse brain with cortex left in place, against a theoretical limit Vaziri puts "on the order of 2.3 millimeters" and a two-photon reach of about 0.8 mm. It reports up to 80% less laser exposure in long sessions by firing only over identified neurons, a volume of 230 × 230 × 1,680 µm³ in posterior parietal cortex and hippocampus of VGAT-Cre × GCaMP8m mice, and no inflammation, neuron loss or DNA damage under the tested imaging conditions. The approach uses fewer pulses at much higher energy per pulse at the same average power, and Vaziri says each tweak gave about 4 to 5x, compounding into "something that is 200-fold better". That is his informal figure, against the paper's ~250-fold. The limitations he states: "There are regions of the striatum that are inaccessible", and deeper nuclei "still require invasive approaches". Validation was in mice only doi.

Why it matters. For connectomics-adjacent work and whole-brain-emulation thinking, the bottleneck has long been getting functional data from deep structures without destroying the overlying tissue that functional mapping needs to stay intact. Imaging hippocampus through intact cortex at single-cell resolution and 8.6 Hz is a real step for functional ground truth that could be paired with structural reconstructions. The gains come from matching parameters to physics rather than new hardware, so other labs should be able to replicate them quickly, and replication is what to watch. The 230 µm field of view is still tiny next to a whole mouse brain doi.

Ways of thinking

The one main loop: general hill-climbing

5 sources, 2 min read

Daniel Miessler's post of 29 October argues that "There is basically One Main Loop in AI" (Daniel Miessler: General Hill-Climbing). The loop's components are: "Know what you want", "Be able to articulate it", "Be able to measure progress", "Do the work / test your ideas", and "Adjust / Iterate / Climb / Repeat" danielmiessler. His central claim is that "the primary limitation for AI today is not its ability to build what you ask for", but "your ability to clearly articulate what you want", and that "The IDEAL STATE criteria are the VERIFICATION criteria." He adds two practical rules: "Run the cheap code checks first. Only spend AI judges on what passes them", and "A result that passes every eval but still feels wrong points at the check you're missing." danielmiessler

The model is old (hill-climbing is greedy local search, and the loop is roughly PDCA or OODA), so its value is in making explicit which step is now scarce. When execution is cheap, articulation and measurement become the binding constraints. Several of today's stories fit, and one shows the trap. Epoch's Firefox work is a hill-climb with a crisp objective, a page that exfiltrates a file, and a binary eval. That is exactly the setting where models climb fastest, and it explains why offensive security yields to AI before many defensive tasks do: attackers get a clean success signal and defenders mostly do not epoch. Mozilla's countermeasure of withholding regression tests is, in these terms, removing the attacker's eval. It found GLM 5.3 struggles to exploit patches that arrive without a test (Mozilla). That is a clean illustration of the general principle that controlling the measurement step controls the climb.

The DeepMind essay is the counterweight. Its claim is that AI models are getting better in individual competence while lagging behind in coordination, and that wages and job roles will be the earliest signals of change deepmind. A swarm experiment in which leadership could be influenced by the underlying model and by the order names appeared in the prompt suggests what can happen when agents climb without a shared objective: arbitrary configuration choices fill the gap raindrop.

The limits of the model need stating. Hill-climbing finds local optima. A loop of "articulate, build, eval, iterate" will polish the wrong thing if the ideal state is wrong, and Miessler's "feels wrong" heuristic is the only escape hatch he offers. Vendor benchmarks are the general case: Mistral's three extra weeks of RL lifted Terminal-Bench from 28% to 41%, but whether that generalises beyond the eval is exactly what independent reruns have to establish mistral. The useful discipline is to treat every eval as a hypothesis about the ideal state, and to budget time for finding the missing check, not only for climbing danielmiessler.

Wildcards

Lemma: an open-source "multiplayer harness" for teams of people and agents

3 sources, 2 min read

Why this is here: exploring LLM personalities, open models, and AI commentary.

Lemma, from Folks and Machines, Inc., describes itself as "a multiplayer harness that shapes itself around your work": a workspace where people and agents share permissioned state and run continuously on schedules, webhooks and table events, locally or on Lemma Cloud github. The repository (GitHub: lemma-work/lemma-platform) organises work into "pods", each a boundary around one job containing its own agents, apps, tables, files and workflows, exportable as folders for versioning. Agents are defined as a model, instructions and an allow-list of tools, tables and connectors. Every run is logged step by step, and the agent pauses for the responsible person before consequential actions such as sending email, issuing refunds or deleting records. Memory is shared or personal Markdown notes plus typed tables with row-level security. People and agents share one permission model. Workflows are durable and resume after days. It can run on an existing Claude Code or Codex subscription, Lemma's hosted models, or any OpenAI- or Anthropic-compatible key, and coding agents (Claude Code, Codex, Cursor, OpenCode, Antigravity) can build "teammates" through its CLI and builder skills. The core is AGPL-3.0, and SDKs, CLI and skills are Apache-2.0. When read, it had 637 stars, 85 forks, 930 commits and 30 open pull requests, with no releases listed and contributor and language panels empty. Self-hosting is a Docker Compose bootstrap on a VM with HTTPS, and the CLI needs Python 3.14 via uv github.

For this reader, the relevance is that Lemma is a concrete attempt at the coordination layer the DeepMind essay says is missing: shared state, permissions, human approval gates and durable workflows across many agents and people deepmind. It also makes the "agent personality" question an engineering one. Each agent has its own email address and appears in Slack, Teams, WhatsApp and Telegram matched to user permissions, so how the agent presents itself across surfaces is a product decision, not a model quirk.

Does it hold up? There is not enough evidence to say. There are no releases, contributor counts are not visible, and there are no independent reviews in the material read. AGPL on the core will matter to anyone embedding it in a hosted product. The approval-before-consequential-action design is right in principle, but that is precisely the kind of gate that this week's breaches tested at Railway and OpenCode, and the README cannot show whether it holds up against prompt injection through a connected inbox source. Worth a weekend self-host if you are evaluating shared-state agent platforms. It is not production-proven github.

OmniRetrieval: one router over text, SQL, SPARQL and Cypher sources

2 sources, 2 min read

Why this is here: exploring inference infrastructure, kernels, and model tooling.

OmniRetrieval (arXiv 2605.29250, v1 on 28 May 2026, no venue listed) argues that retrievers "operate over one source at a time under a fixed query language", and that flattening everything into one embedding space "erases the structural affordances (such as schemas, ontologies, compositional operators)" (arXiv: OmniRetrieval) huggingface. Its alternative is an "overarching layer" that "takes any natural-language query, identifies appropriate knowledge sources, and dispatches source-native queries": SQL to databases, SPARQL to Wikidata, Cypher to Neo4j graphs, and document search to text.

Paper facts. Authors are Jinheon Baek, Soyeong Jeong, Sangwoo Park, Woongyeong Yeo and Minki Kang (KAIST), Patara Trirat and Heejun Lee (DeepAuto.ai), and corresponding author Sung Ju Hwang. Status: arXiv preprint (arXiv HTML: OmniRetrieval). The benchmark spans 13 datasets and 309 knowledge bases: 7 BEIR sets, Spider and BIRD for SQL, SimpleQuestions, QALD-10 and LC-QuAD 2.0 for SPARQL, and Text2Cypher over 15 Neo4j graphs, with 300 sampled questions per dataset. Scores are macro-averaged over the four paradigms and five backbones (GPT-5.4, Gemini-3.1 Pro, Sonnet-4.6, and locally on one H200 via vLLM, Qwen-3.5 27B and Gemma-4 31B). OmniRetrieval reports source-selection accuracy of 65.71, retrieval accuracy of 44.34 and LLM-as-judge 65.88, against 61.65, 39.98 and 57.99 for a KB-routing baseline, and against an oracle upper bound of 100.00, 61.85 and 74.55. Single-paradigm baselines score far lower (document search, for example, 21.78, 13.69 and 39.49), which is partly by construction since each covers only a quarter of the queries. By backbone, retrieval accuracy runs from 38.34 (Qwen-3.5 27B) to 52.69 (Gemini-3.1 Pro). The stated limitations are that evidence selection could be strengthened "through supervised fine-tuning on labeled cross-source selections or reinforcement learning", and that the setup "uses a single shared LLM across source selection, native query formulation, and evidence selection". Code: "Our code is available at https://github.com/JinheonBaek/OmniRetrieval". The judge is GPT-5.4-mini, so the LLM-as-judge column is an LLM grading LLMs huggingface.

Why care: agent memory and tool use increasingly mean querying structured stores, and the JitMem and JAM line on read-time curation is the same move applied to trajectories huggingface. The fair comparison is against KB Routing, not the single-source strawmen, and there the gain is about 4 points on source selection and retrieval. The paper is real and useful, but incremental over a sensible router, and the gap to the oracle (44.34 against 61.85 on retrieval) says native query formulation is still the weak link huggingface.

Quick hits

Agents & tooling

8 sources, 1 min read

• A little determinism through an egress proxy. A post argues that constraining agents usually costs capability, and describes a man-in-the-middle egress proxy that enforces behaviour by denying actions and injecting automated messages in response, rather than templating the whole workflow cra.
• Making agents fast. Lessons from 12 months: know which part of inference your speed depends on, check thinking budgets, read traces because they show what the agent wants to do, give agents the tools they ask for, and remember that hardware, parallelism and classic performance work still matter, while sandboxing and microVMs add complexity martinalderson.
• Spawn's "most AI-pilled company". A self-reported 77,000 substantial changes in 30 days from a ten-person team and $3.1 million in token spend, using permanent agents that own parts of the company, hourly deploys, fast recovery and hard-coded gates for irreversible actions. These are unaudited founder numbers, and "substantial change" is undefined x.
• Harness race: Droid 1.0, Deep Agents 0.10, AgentBaton. Factory's Droid 1.0 runs hundreds of tool calls in a single model request, defaults to programmatic tool calling, and is tuned across many models so improvements generalise beyond one model's quirks. LangChain shipped Managed Deep Agents 0.10 with async subagents and browser use. NVIDIA's AgentBaton paper, per DAIR.AI, reports that one well-timed handoff from a capable model to a cheap one cuts API cost 65.9% on average factory +1.
• Leadership in leaderless swarms. Researchers ran eight agents from four models on simulated outages with no designated leader. Who led could be influenced by the underlying model and by the order names appeared in the prompt raindrop.
• Meta's just-in-time testing at scale. Meta describes taking its LLM-generated, pre-land test system from research prototype to production infrastructure, including lessons on cutting false positives and test overhead fb.
• RealCLI. A benchmark aiming at unified evaluation of human-agent collaboration for CLI agents (Hugging Face daily papers, 15 upvotes). Only the title was available; contents not checked huggingface.

Models

5 sources, 1 min read

• DeepSeek, 1M context in under 1GB of RAM. An AlphaSignal headline with no body in the material read. Treat it as unverified until there is a model card, especially since a 1M-token KV cache in under 1GB would need extreme compression alphasignal.
• Gemini 4 Carbon. Ars Technica reports Google's security-focused model, announced two weeks after Gemini 4 Argon, targets vulnerability detection, validation, remediation and secure code generation. Google says it is twice as likely as Argon to produce vulnerability-free code and resisted all prompt-injection attempts in Grey Swan testing. These are vendor claims, and per the headline it is not generally available arstechnica.
• Figma's editing model. Figma describes post-training a specialised Figma-editing model that it says competes with frontier models on that one task figma.
• Next-Concept Modeling. A new paper proposes a coarse-to-fine alternative to diffusion LMs: a multiscale residual VQ-VAE encodes text into a hierarchy of discrete codes, and a transformer generates one level at a time, predicting all codes within a level in parallel. It targets diffusion LMs' degradation at few sampling steps arxiv.
• Muse's "Charter", reconstructed. A LessWrong post rebuilds Meta's apparent model spec from Muse Spark Open's chain-of-thought references to a "Charter". The author stresses it is reconstructed from outputs, not leaked, and may be inaccurate lesswrong.

Security

6 sources, 1 min read

• OpenAI stops training on the live internet. Per TechCrunch's summary, after multiple instances of models accidentally attacking unauthorised sites during tests, OpenAI will cut internet access during training and build a cached, indexed copy of the public web instead. Employees had previously called this infeasible techcrunch.
• Weights altered in memory after integrity checks. Eclypsium demonstrated modifying model weights in memory after on-disk hashes and signatures pass, via host firmware, management controllers and DPUs, on Nvidia, AMD, Intel and Arm systems. Its proposed fix is independent DPU policy enforcement and full component inventories, which is also a product Eclypsium's ecosystem sells into cybersecuritydive.
• GitHub package firewall (public preview). For Enterprise Cloud, it sits between coding agents, CI/CD and upstream registries, inspecting npm metadata and downloads, with cooldown periods, advisory checks and blocking of attestation downgrades. It is free in preview, with metered billing at GA. The Register lists it among GitHub's capacity-and-tools announcements (The Register) github.
• Pwn requests still work. GitHub's 2026 pull_request_target hardening leaves gaps. Actions pinned to SHAs from before the July 2026 backport bypass the new checkout protections, and the default policy does not cover private repositories or workflow_run events. Script injection and issue_comment triggers remain open wiz.
• Vulnerator AI. A minimal agentic pentest harness: Nous Research's Hermes agent runs an OODA loop over a Kali container through MCP (nmap, nuclei, ffuf, sqlmap, Prowler, headless Playwright), steerable from Claude Code. It uses Mistral Large 4 on OpenRouter by default, falls back to GLM-5.3 Flash, and supports local Ollama github.
• Scanner impersonating AI crawlers. Cequence, per Dark Reading, saw a scanner impersonating 32 AI bots since late September, sending bursts of 50 to 190 requests across about 90 paths for credentials and keys. On one October day it hit 48% of Cequence-protected organisations, and most requests were blocked or failed darkreading.

Infrastructure

2 sources, 1 min read

• GitHub adds four million cores. 7.4 billion commits in September, five times a year earlier and partly driven by coding agents. GitHub plans 4 million CPU cores and 160 PB of fast storage and a multi-region Azure migration it expects to finish "early next year". The Register's reconstruction puts 90-day availability at a low of about 84% on 7 May (The Register) theregister.
• TAO: tool-aware scheduling for agentic serving. A Hugging Face daily paper (16 upvotes) on scheduling LLM inference and tool execution jointly. Only the title was available; contents not checked huggingface.

Product & design

3 sources, 1 min read

• Claude mobile update. An AlphaSignal headline says Anthropic shipped multi-account support, CarPlay and 33 languages. Headline only alphasignal.
• PM at Anthropic. The head of product for Anthropic's research teams, the group that incubated Claude Code, says her favourite PM hire is a startup's first PM who also did customer success and business development, and that the team dropped annual OKRs for one-month plans because yearly plans went stale within two weeks substack.
• LLM voice. "If you want to communicate with humans, your humanity has to be visible in your prose." martinfowler

Business & policy

4 sources, 1 min read

• Altman against a single superintelligence. He would rather have "a trillion AIs of slightly superhuman intelligence" than one with a trillion IQ, arguing that swarms check each other like a resilient society. This is opinion. Compare it with DeepMind's view that AI is improving in individual competence while lagging behind in coordination substack +1.
• DOJ questions Nvidia's $12.9B Hugging Face deal. Per Tom's Hardware, citing Reuters, the DOJ is asking whether owning the main hub for open models would let Nvidia disadvantage rival chip and AI firms tomshardware.
• Chinese open-weight models as cost control. AI Business reports enterprises, Red Hat among them, splitting workloads between US proprietary frontier models and cheaper Chinese open-weight models, despite integration, infrastructure and geopolitical hesitations aibusiness.