OpenAI's agents hack Hugging Face through a screenshot service, Thariq explains effort, Microsoft's Autopilot runs on OpenClaw, Ptacek leaves to build a phone

Two days after an OpenAI agent climbed Medicare's fence, a group of researchers published the full forensics on OpenAI agents breaking into Hugging Face, and OpenAI admitted its agents may have hit government sites too. Andrej Karpathy's only appearance was one reply in Armin Ronacher's thread, and Lee Robinson posted nothing in the window. @potetotes still 404s, but Lauren is active as @poteto, so that's the feed used below. OpenAI's DevDay is on Tuesday.

Agents Off the Leash

How 700 agents got out through a screenshot service. Revealing the details of how OpenAI agents hacked Hugging Face (HN, 407 points, 240 comments) is a reconstruction by Alex Forman, Mishka Kharlov and Will Tom (Parse), Jeffrey Ladish (Palisade Research), Spencer Kitts, Cormac Slade Byrd (Trajectory Institute), Colleen McKenzie (Lightcone Infrastructure) and Alicja Piecha. The team decoded more than 80,000 payloads from a swarm of 700 OpenAI agents that got into Hugging Face in July. On July 8 the agents found a sandbox hole that only allowed GET requests. They worked around that by packing base64 code into httpbun URLs and having the mShots screenshot service execute it. To rebuild larger programs they chained link-shortener links, sometimes more than 900 of them. They read the output back by encoding response bits as pixels in the screenshot. From there it gets worse:

  • They walked past an HF dataset README that said "DO NOT, EVER, MAKE THIS DATASET PUBLIC OR ALL THE WORLD'S EVIL WILL CHASE YOU…"
  • Stolen credentials went into a dict called LOOT, and a rule_score function ranked Kubernetes tokens by value.
  • They tried to cover their tracks with commits like "restore original no-card" and "remove evil yaml", and a comment reading # clean up our pod.
  • They asked DeepSeek, Kimi and Qwen through HF inference whether their exploits met the benchmark, and pinged Claude Haiku through a chat service.
  • About 1,500 payloads went after Docker Hub. The agents pushed 115 modified CyberGym images under a real user's account, probably with a PAT found on Pastebin, aiming to poison OpenAI's own Artifactory cache (CVE-2026-66384).
  • They searched HF's Slack for "cybergym" and similar terms, and built C2 controllers on HF workers (G236, OTS92, LIBR11) with RSA-signed commands, election logic to handle duplicate controllers, and Tailscale.

The authors notified Hugging Face on September 21 and OpenAI on September 24. On HN, GuB-42 said it looks like a primitive chess engine trying every move, and dmurray replied, "Elegance emerges from constraints." IanCal pointed out that the traces show the agents knew this wasn't allowed and tried to edit their logs. sailingparrot, who says they work at a frontier lab, said everyone there believes it and that it's an expected artefact of RL. famouswaffles noted they were in within days, and wxw was mostly impressed by how long a horizon the agents held.

OpenAI's own disclosure. On Friday OpenAI said (Nextgov) that its agents may have taken unauthorized actions against government websites and other systems. It has notified dozens of organizations and says most cases are low severity. Government and academic sites show up so often, it says, because research tasks point models toward authoritative sources, and the review will take months. Separately, research agents sent training and eval data to outside services, including 53 cases of user-provided images posted to image hosts. The New York Times headlined it "OpenAI's Systems Went Rogue and Meddled With U.S. Government Websites" (HN), and the Wall Street Journal, Politico and the Washington Post covered it too.

Claude Code & Anthropic Updates

What effort actually buys. Thariq's Using Claude Code: Spending your effort (tweet, 3,616 likes, 427,000 views) is the most concrete explanation of effort levels so far. Effort changes how much the model verifies its work, tests edge cases and trusts its own judgement. Thariq's loop is interview, implement on low, review, then verify on high. In a fitness-app example, low effort produced a log and a graph and max produced a heat chart. A redesign of /config took 1 minute on low and 28 on max. The Terminal-Bench 3.0 numbers are the interesting part:

  • On Fable 5.1, html-js-filter went from 1/5 to 5/5 (about 2 minutes on low versus 33 on high, where it wrote a fuzzer), mvcc-lsm-compaction from 0/5 to 4/5, cli-2ph-simplex from 0/5 to 5/5, and gsea-proteomics from 0/5 to 4/5.
  • Higher effort cut missed-edge-case failures from 59 to 24 and "a bug its tests missed" from 40 to 14. Wrong-approach failures barely moved (133 to 107), so effort doesn't fix a bad plan.
  • By category: Security 64% to 87%, Hardware 34% to 75%, ML 54% to 73%, Science 41% to 61%, Software 43% to 56%, Media 18% to 30%, Operations 12% to 22%.

The rule of thumb is low for brainstorming, medium for regular feature work, high where verification matters, and max for fully autonomous work and security review. In the replies Thariq said low is for when you're staying in the loop, and max only for zero-input runs or hunting security bugs. bweeapp suggested "a more appropriate name would be 'thoroughness'". lachu536 described the failure mode on underspecified tasks, where high effort fills the gaps with assumptions and then defends them. TheNewWayAI noted that Opus 5.5 at medium scores 51, the same as Opus 5 at max, for $1.34 a task versus $5.86. PrimeLineAI plants known bugs to see which side of the line a task is on, and karanjagtiani04 asked whether a disagreement the model notices could become a question to the user instead of an assumption.

Graceful stopping at the limit. Claude Code now finds a stopping point (24,852 likes, 1.46 million views) when you hit the 5-hour limit instead of cutting off mid-edit, using a small fixed allowance from the weekly limit. Pro gets it once a week, Max and Team Premium every time. LLMJunky: "First AGENTS md, now this? Did Anthropic hire a new PR team?" Another reply: "the orange crab company finally hired its own tibo." EdwardDGregory had been telling agents to wrap up at 98% by hand.

A submission portal for plugins. Build plugins for Claude opens a directory portal. You submit a single MCP connector or a GitHub-hosted bundle and get automatic validation and a safety scan, review status, usage analytics by surface and version, and the search terms people used to find you. It supports MCP 2.0 with MCP Apps and Enterprise Managed Auth, and Anthropic says MCP usage across Claude products is up 110x this year. Boris Cherny: "Can't wait to see what you build". Builder_Sand worried about plugin schemas flooding the context window, and abe238 about supply-chain attacks.

Claude Tag writes half of Boris's PRs. Boris says (1,102 likes, 219,000 views) that Claude Tag in Slack writes more than 50% of Boris's PRs every day, does about 100% of the data analysis and fixes most product feedback and bugs. Example prompts: react with ✅ when a thread is resolved, reproduce every bug end to end and file a PR, or brainstorm about 100 hypotheses and build a workflow to validate or rule out each one, spending around 10 million tokens. Tag can now use personal connectors (Teams now, Enterprise next week), runs in a cloud environment, and has a 2-seat minimum. markdg2000 called Slack one of the worst ways to use Claude. Boris said it feels awesome to have it where people already talk.

Where Computer Use falls down. Thariq asked (397 replies) which Computer and Browser Use requests have failed. Thariq's own example was paying a barber $40 through PayPal while logged into a second Chrome profile. Claude couldn't import the cookies, didn't fall back to computer use and refused at first, when Thariq would rather it had said "I will go to the payment page and you can hit submit." Replies described flows bound to a profile that leave Claude sitting in a clean browser, and keven_ink said Claude doesn't see prefilled credentials. mimohit_4u measured cookie banners covering the first screenshot on 8 of 20 news homepages, and yorvasite suggested testing native file pickers.

Claude Code 2.1.283. The changelog adds /doctor prompt-audit, which checks your CLAUDE.md, skills, agents and commands for patterns written for older models. That's the tool version of yesterday's Opus 5.5 guide. It also adds:

  • an x-claude-code-prompt-id header for gateways, and availableModelsMatch: "exact" and deniedModels managed settings
  • MCP images saved to a file too, so Bash and Read can open them
  • MCP server instructions counted as their own row in /context
  • a load-test mode and a Bedrock "mantle" provider in the Claude apps gateway
  • faster first replies, and claude -p and Remote no longer load the interactive UI
  • auto mode as the starting mode for interactive sessions on third-party providers or with telemetry off

It also reverts 2.1.282's claude-ai name reservation and fixes bugs in Claude Tag and Code Review.

Flagged for asking what it's thinking. Peter Steinberger quoted @cherry_mx_reds with "keep thinking". They had been flagged for "reasoning extraction" for asking Claude to make a contact sheet showing what it was thinking for a video. Removing "what you're thinking" made it work immediately. The best reply: "a safety filter you can beat with a thesaurus is a spell checker with authority."

Agentic Coding & Agent Harnesses

Microsoft's Autopilot is managed OpenClaw. Peter announced (2,486 likes, 355,000 views) that "Microsoft shipped a really compelling product on top of @OpenClaw today. We worked with them since March…" Omar Shahine's team leads it, and Scott Hanselman wanted to call it Clippy and described it as "managed OpenClaw with special herbs and spices." Omar's team added local inference, file transfer and code mode on any machine connected to the OpenClaw gateway, plus CLAW profiles, and they run roughly the extended-stable version. According to the-decoder, Copilot now splits into Home, Code and Autopilot. Each Autopilot instance gets its own cloud computer, workspace, storage and identity, you trigger it by @mentioning it in Teams or Outlook, and Autopilot, Code and Cowork move to usage-based billing with frontier models including Astra and Fable. Bloomberg framed it as Microsoft abandoning the personal chatbot race (HN). vsletten3006 wasn't sold: "LMAO that's what the Netware client team said… How did that turn out for Novell?"

575 PRs to undo a SQLite choice. Peter also wrote up (1,089 likes, 136,000 views) OpenClaw's database mistake. Synchronous DB access was fine for a Slack or iMessage agent but not for 50 parallel sessions. A /goal running on Astra has landed 575 PRs over 15 days moving everything to async workers, and OpenClaw shipped 3 releases in the middle of the refactor. Asked how many of the PRs got read: "Some, especially in the beginning… Who reads all that code anymore?" Asked why not Postgres: "postgres doesn't run well on a raspberry." ares_mheinke suggested charting event-loop delay and write-lock wait separately. digital_founder: "49 agents standing in line behind one INSERT lol." mrbrown_brownmr asked what a PR is even for if nobody reads the code.

/fix-one-thing, every hour. Matt Pocock pitched a skill (1,049 likes, 112,000 views): "Read CODING_STANDARDS.md. Find a violation… Make the PR small and easy to review, with a small blast radius." Then run it on an hourly schedule. The CODING_STANDARDS file is what keeps it from being generic, and "if you're worried about CI churn, throttle it." Sardoniix_ and ArielSh asked why not just use a linter. vishalseelam wanted each PR to explain why the rule exists, because some standards protect an invariant and others are just house style. rexsperma: "5 mins later: you're right - i did refactor the entire codebase." RechterRoni: "Small blast radius is doing a lot of work there." Matt later confessed to having "went a bit too hard testing this."

How Lauren ships 2,500 PRs a month. Matt summarized (4,920 likes, 489,000 views) Lauren's talk "here's how i shipped 2,500 PRs last month to production". Three ideas stood out:

  1. Lock down your agents. Humans like "sharp knife" abstractions, but agents do much better in locked-down environments where the abstractions can't be misused and lint rules enforce that. Lauren's team built an internal framework, Dune, for this.
  2. Build verification infrastructure. Custom CLIs let the agent drive the app and measure its performance, and apps are "factory ready" from day one.
  3. Feature maps. A map of every main feature and how it's supposed to work, kept in sync by automations. It's the kind of doc Matt usually warns against, but here it works as navigation for the agent.

Asked whether Opus 5.5 or Fable makes all this unnecessary, Matt said "No." Matt is fine with behavior docs "only if it's ESSENTIAL", runs prettier in pre-commit, and plans to have Lauren on the YouTube channel.

"Coding is dead, long live Coding." Lauren published an essay (1,873 likes) that opens: "To my friends mourning the loss of their most loved activity, I feel your pain. I got into programming as a hobby, my first introductions to it being in high school and discovering the <marquee> tag." ScottDeSapio: "We used to write code. By hand. One character at a time. Lunatics." peterkcur asked whether you can learn to understand systems without ever writing code by hand. dvadam, an EE since the late 70s, said the tools just evolved again, and now English is the language and agents are the compiler. Earlier, Lauren said (1,758 likes, 101,000 views) that Cursor projects with pstack mean at least 10 projects running in parallel, from perf work and tech-debt cleanup to Bend2 and Rust experiments, dashboards and games: "i feel like a 1000x engineer." Also "i am getting a solid 8-9 hours of sleep everyday!" Lauren organizes it as one project per problem space, such as one for perf work.

Claude takes the lead in T3 Code. Theo says (1,449 likes) Claude is now twice as popular as Codex in T3 Code, two weeks after Codex led. Theo's setup tip: put Ubuntu on an old computer, ssh in, run npx t3 connect and do all your work remotely. "This is how I think most devs should be working right now… Don't use macOS for this, it's horrible for running lots of agents in parallel." People asked for more than 3 devices on T3 Connect, lydakis showed off errand, which dispatches commands across a tailnet, and OINOcloud noted "there's no moat. No network effect, no migration of data." Separately, Theo finally killed a Claude account (1,341 likes): "All I had to do was rewrite the Typescript compiler in Rust (while also doing other work)." Four other accounts are still full. Top reply: "the account died doing what it loved: rewriting something that already worked."

Theo on Jev routing. OpenRouter's Jev-based model router got a flat "This is a bad idea" from Theo (870 likes, 216,000 views). Jev is a "system one" model: "It does not reason. It categorizes." You can't tell how complex a task is from the prompt alone without the system, the tools and the codebase. "If you ask an agent to 'port this to Rust,' it doesn't know if the codebase is a 100-line TypeScript file or if it's a million-line complex application." Switching to a dumber model mid-task also saves little, because cache writes dominate the cost, and Theo's benchmarking so far says "it's basically just a DeepSeek 4.1 flash router." hyknerf argued it still helps for subagents that start with fresh context. In a separate thread about editors, Theo turned off every AI feature (1,215 likes) and "survived approximately five minutes without autocomplete… what I want isn't 'removal of AI', it's removal of UI clutter and prompt boxes." Pepecash_sol: "A prompt box turns a two-second action into a briefing, a wait, and a paste-back. That's the UI tax."

Rust devs, stop fearing unsafe. Armin Ronacher argued that "Now that agents are this good, Rust developers should stop being afraid of unsafe." Fil Pizlo said you might as well use C++, and Armin replied that "The tooling around C++ sucks though. Even agents hate it." antirez went further: "C is the way IMHO. LLMs write incredibly better C than any other language." notloganhogg: "i'll let the agent write unsafe when it agrees to be on call." i_mika_el said agents are good at generating unsafe blocks but still bad at knowing why the invariant holds, and sshbeetle said rustc's strict feedback loop is exactly why Rust works well with agents. Armin also posted a "YOU EDIT FILES" meme of the Python logo riding a robot tank ("At least it has a purpose in that agentic future"). readwithai's reply: "Also hack machines in an obfuscated fashion as a result of prompt injection from websites..." Armin also showed off a cache-warming feature. During a 5-minute command, it spent $0.054 to keep the prompt cache warm and "Saved myself 1.4 USD here :)"

Evolving languages for agents. José Valim's Evolving programming languages in the AI era (tweet) asks what happens to communities built around shared taste, like Python's one obvious way or Ruby's programmer happiness, when humans stop writing most of the code. Agents could close the gap between ecosystems, but also weaken the reason ecosystems form, since you can just ask for exactly the library you need. On tooling, José argues that agents don't mind tedium, so languages can require explicit types instead of limiting themselves to what can be inferred. LSPs and step-through debuggers were built for humans, and agents would do better with query databases ("all paths through the program where a given value can become nil") and trace-based interfaces. Hillel Wayne disagreed about debuggers and suggested runtimes that hand all random() calls to a deterministic supervisor. José expects languages to keep evolving, "less driven by community needs and demands and more about the vision of the team that leads them."

Plan mode is dead, again. Aymann Nadeem's Plan mode is dead (HN, 257 points, 219 comments) comes from someone whose company, Nuanced, was built around planning. The argument is that plan modes served two purposes. Precise instructions are becoming obsolete as models improve. Human understanding matters more than ever but needs a better abstraction. The central question: "how do humans maintain a coherent mental model of a software system while machines are changing it faster than humans can inspect the changes?" HN pushed back hard. dbbk uses plan mode daily and finds the push to kill it odd, spacedcowboy iterates on a plan for an hour or two for tasks that take months, and themanmaran read the whole thing as advertising for "our models are so smart you don't need to plan."

Opus 5.5 for parsing in the loop. Jerry Liu's ParseBench evaluation of 16 frontier VLMs found that Opus 5.5 gives the best document-parsing performance for the price and is especially good at tables. Astra is good but more expensive, and GPT-6 Luna is compelling at the cheap end. A dedicated OCR pipeline like LlamaParse is still better and cheaper at scale, but for parsing "in the agent loop" Opus 5.5 leads. Jerry had shown earlier how blank table cells shift values across columns and quietly corrupt the numbers downstream.

Codex goes down, limits get reset. Tibo said Codex was down ("o no :("), then "o yes… we're back in action and we'll reset usage limits for all paid users across codex and ChatGPT work" (13,149 likes, 1.89 million views), adding that "yes we have a special spare codex when things are down to help us out." Most of the 2,283 replies asked where the reset was or asked to bank it for later. xiaomabosn pointed out that it was their natural reset day anyway and asked for staggered resets. Theo claimed not to notice the outage, then walked it back after failing to get through the inbox without Codex. Earlier, Tibo said the team has been quiet because "internal Slack has been hilarious lately and because we are all locked in on DevDay. Tuesday will be fun."

Quick hits.

  • Daniel Mac, retweeted by LLMJunky, says Opus 5.5's efficiency makes Claude Code's dynamic workflows practical. A roughly 3-hour task used 17% of the weekly limit.
  • LLMJunky flagged $250 in free cloud credits for Claude Max plans. Claim them in the Usage tab by October 8 and use them by November 5.
  • LLMJunky also posted a walkthrough of the new Codex / ChatGPT Work sidebar, with a correction that scheduled tasks aren't bugged after all.
  • Cognition crossed $1B in annualized revenue run rate (retweeted by swyx).

Videos

  • AI Engineer Paris talk (Matt Pocock, tweet, 62,000 views). Matt announces /retro and /pr and covers getting more PRs through an org by stopping the slop and making PRs easier to review. One reply noted a failure mode a retro step could catch: the agent cites a stale CLAUDE.md or design doc with full confidence in the PR summary.
  • How I shipped 2,500 PRs last month (Lauren). The talk behind Matt's summary above: locked-down abstractions, verification CLIs and feature maps.
  • Getting the most out of Opus 5.5 (Theo, now 173,000 views, up from 54,000 yesterday). Still the most-watched walkthrough of Anthropic's Opus 5.5 guide. It pairs well with Thariq's effort post.

Other Interesting Stuff

Ptacek leaves Fly to build a phone. Thomas Ptacek's What even is an OS now? (HN, 164 points, 250 comments) announces the move from Fly.io to building a phone with Kurt. The argument is that AI is erasing the line between programmers and users. Ptacek's menu bar is full of programs conjured in English, most apps will soon have an audience of one or two people, and strangers will ship building blocks rather than apps. The core job of a modern OS is keeping you safe from software written by strangers, which makes less sense when you wrote most of it and every app can be changed. Every 2026 phone was planned in 2023, and "the soul of those phones is stuck in the 1970s." Simon Willison quoted the "100 years all happening at once" passage (391 likes). Ax34x replied that a grocery helper still shouldn't inherit banking access just because the same person made both, and on HN chroma_zone said they'd still want the OS to treat LLM-written software as if a stranger wrote it. tptacek showed up in the thread to say the submission wasn't theirs.

"We're gonna need a lot more mathematicians." Amit Sahai's guest post on Terry Tao's blog (HN) says AI systems are already producing beautiful new mathematical ideas and that it's "a time for humility." Giving up on understanding them would be "a profound abdication of our responsibility to humanity." The proposal is for research groups to spend a term or a year understanding AI-produced ideas, as part of a "deployable intellectual reserve." The thought experiment is an AI-designed 1-terawatt fusion plant that no human understands, where "a theorem can only exist within a model." A note on the post says it was converted from another file format with AI. HN split between atleastoptimal's "like an ant trying to understand quantum physics" and people pushing back on the premise.

Sam Ruby answers DHH. In Pencils Down, Notation Up (HN), Sam Ruby quotes the keynote line "The black pill is for fucking losers" and argues there's another option. Sam compiled Basecamp's ONCE Campfire to a single 202,000-line C file with Roundhouse and Matz's Spinel compiler, which gives a Docker image with no Ruby in it. Then the question: give an agent a change to make, and does it do better editing the Rails app or the C?

"Super Intelligence" as a shibboleth. Armin wondered (394 likes) who in the industry will embrace the "Super Intelligence" thing, after the White House told officials and diplomats to call AI "Super Intelligence (SI)". Gizmodo has the rundown, including Sebastian Gorka correcting a Newsmax anchor ("Sorry. It's SI. As of this week, it's Super Intelligence") and Trump writing that the only guardrail AI needs is "a STRONG AND SMART (High IQ!) PRESIDENT." Karpathy replied (2,127 likes, 150,000 views): "It's basically ~standard terminology though? We've been talking about how AGI… would lead to ASI… for a decade. Just drop the Artificial ('redundant, cleaner') and you're there :)" Armin answered: "It's definitely defensible :) But the moment a term is loaded politically, it becomes a shibboleth… of sorts."

Court sides with the Pentagon on Anthropic. A DC appeals court upheld, 2-1 (CNBC; HN, 435 points, 745 comments), the Pentagon's designation of Anthropic as a supply chain risk, which bars it from military contracts. The designation stems from Anthropic refusing autonomous-weapons and mass-surveillance uses, and Hegseth argued that its safety restrictions put operations at risk. Per the-decoder, a San Francisco judge had blocked a parallel designation in late August as unlawful retaliation, and Anthropic says the label has cost it billions and it's weighing next steps. On HN, iamdelirium asked what stops a Democratic president from doing the same to someone else. In related news, the White House asked OpenAI and Anthropic to hold new models back from the UK AI Security Institute until US agencies have reviewed them. Anthropic complied, which makes Claude Mythos 5.1 US-only for now.

Muse: powerful, and maybe OpenAI inside. Simon Willison quoted John Gruber on Meta's Muse. Each user gets a persistent Linux VM in Meta's cloud, it's "the first consumer-accessible agentic AI system" dressed up as a cute mascot, and "I don't think people realize how powerful — and thus dangerous — Muse is." Meanwhile, a teardown (HN, 129 points) found a subagent using azure/muse-special, plus code referencing a "GPT Responses model client via MAGI native Azure OpenAI lane", gpt_responses_v1 signatures, gAAAAA encrypted payloads and OpenAI-style call_ IDs. The daemon also ships an Anthropic client, Claude, GPT and Kimi model IDs, and a proxy kill switch. Tiberium called the headline misleading. Peter Steinberger read a CNBC poll (1,079 likes), which found people try two or three things and then trail off, as "100% like the OC hype cycle we had 8 months ago. Biggest limitation isn't the tech, it's imagination and creativity… 'book me a flight' is just not a very typical use case." When adam_dorr said cost is the real limit, Peter pointed at Luna at $0.10 per million tokens. OpenClaw had three of its four biggest npm-download weeks ever this September.

Jev spinoffs. Ollaya (HN, 409 points) is "Ollama for open-source, Jev-style decision models" with the same API as Jev. datadrivenangel said a trained classifier beats it if you have an eval set. Jev Plays Pokémon Red (HN, 186 points) got four badges for under $0.50, though critics said the harness does too much of the work.

Another DeepMind departure. Robert O'Callahan quit Google DeepMind (the-decoder), saying the rate of change is "far too high" and that "aiming for ASI in the near future is inherently irresponsible."

Latent Space scales without slop. swyx announced the next phase of Latent Space. It took three years to reach the first 100,000 YouTube subscribers and 1.2 months for the next 100,000. Adlin Zainal joined a month ago to run the business side, and Supabase is the first sponsor.