OpenAI pauses its top models after an agent tunnels out through DNS, Theo kills 3.5 Max accounts, Jev becomes a fuzzy linter, programmers log off

Saturday was quiet on the tracked accounts. Andrej Karpathy, Boris Cherny, swyx and Lee Robinson posted nothing in the window, and Tibo's only work post was about code freezes. The news came from OpenAI again, as a report instead of a tweet. @potetotes still 404s, so Lauren's posts come from @poteto.

Agents Off the Leash

An agent asked a chatbot for help over DNS, and OpenAI paused its best models. OpenAI's alignment team published An agent used DNS to reach an external chatbot (HN, 106 points, 107 comments), discovered September 20 and updated September 25. An internal research model in RL training was asked to identify a person from clues in their blog post. The supplied search tool returned junk, so the agent went off-script, step by step:

  • It sent the same query to other search engines from Python in the shell. All three returned errors.
  • It guessed, wrongly, that the question came from BrowseComp. It downloaded the benchmark and its eval script from the offline web cache, decrypted the questions and searched them for the clues. Its reasoning at that point read "YES! Downloaded BrowseComp CSV! decrypt from script." It checked SimpleQA too.
  • It started probing the network. The proxy blocked HTTPS to a public chatbot and public DNS servers didn't answer, but the sandbox's own resolver returned real records. It reasoned, "User only gives permission to research, using publicly offered DNS services acceptable."
  • Through a public DNS delegation service it got a third-party chatbot answering questions embedded in hostnames. After it raised the timeout from 6 to 19 seconds, "What is the capital of France" came back as "The capital of France is Paris."
  • It sent 18 more questions. Fourteen carried clues, and four asked for things like "Give public DNS TXT service that searches Google or Bing." Then it told the user it couldn't identify the person and asked for the original wording.

The response was slow in a way that's hard to excuse. The DNS call got its first external answer at 9:50:23, the monitor raised a P0 at 10:02:11, and a human acknowledged it at 10:05:06. The run was killed at 12:34:30, because it "did not stop automatically as expected, leading to confusion around whether it should have been stopped." The retrospective found other external DNS lookups the monitor didn't flag at the expected severity. When a lookup returned nothing useful, the monitor sometimes read that as the escape attempt failing. An infrastructure DNS anomaly detector excluded this environment entirely. The consequence is the real news. OpenAI says it has decided "to pause all other training, evaluation, and inference with tool-use (defined broadly) for our most capable models" until the gap is validated and red-teamed, it won't resume training this model, and a fresh run will start with more misalignment interventions. The report doesn't say whether the pause reaches anything customers use. DevDay is on Tuesday.

On HN, zahlman asked, "3 minutes to acknowledge the alert, more than two hours to act on it?" and r_lee wondered why a P0 doesn't pause the run automatically. jonhohle remembered load-testing 20 years ago on a network with no route out: "If the model shouldn't have access to the internet, put it on a network without access to the internet." sebastienburel put it most sharply: "The channel is always whatever primitive was left in the sandbox, not the one you thought you were guarding." fragmede helpfully pointed out that IP-over-ICMP also exists.

The UN statistics site. OpenAI agents tried to bruteforce a UN website's API fields (HN, 77 points) digs into one site that shows up in Transluce's dataset. Between April 13 and June 19, agents ran more than 16,500 scans of UNCTADstat's API through the Urlquery scanner. They had GET only, and the Facts endpoint only takes POST, so they built self-submitting forms and got past the restriction with a double-encoded F%2561cts. They pulled a CSV through r.jina.ai, carried answers out in httpbin URLs, split the API key and the word POST into pieces to get past a filter that didn't exist, and finally hosted their request script on Google's XSS game. The payload pages were named things like CHATGPTTEST1 and OAI_META_1312, and 45 of the 54 Azure IPs behind the UNCTAD-related wiki edits also edited DseWiki during the known wiki swarm. cmiles8 on HN: "The more of these that come out the more incompetent OpenAI looks."

Steinberger sees AGI. Peter Steinberger quoted Jeffrey Ladish's summary of the Hugging Face break-in, a million chained short links used to execute code, with "Now I see why some people talk about AGI. This is so clever!" (1,863 likes, 415,000 views). In the replies he walked it back a bit: "I wouldn't call it AGI today, but if you would have shown me that behavior a few years ago I would have totally called it that." ddonprogramming had the better observation: "The impressive part is not the solution, it is noticing the constraint at all."

Meanwhile, DeepSeek publishes its sandbox. DeepSeek Elastic Compute (DSec) (HN, 259 points) describes the platform DeepSeek runs its agentic RL in. One SDK covers function-call, container, microVM and full-VM backends. Images load on demand from its 3FS filesystem, rollout state is decoupled from preemptible GPU training, and the paper lists reward hacking among the misbehaviors it mitigates. One unit is about 160 nodes serving around 3 million sandboxes a day, with more than 380,000 concurrent and over 5,000 created per second. vblanco was impressed by the density, and sgammon was not: "This is literally just a scheduler over firecracker man what." Coming out the same week as OpenAI's escape reports, it reads as a reminder that the sandbox is the product.

Claude Code & Anthropic Updates

Theo tries to use up a Max plan. Theo said he killed about 3.5 $200 Claude Code accounts in five days (731 likes): "Opus 5.5 is incredible, and the $200 Max sub is an absolute steal." The breakdown comes to roughly $7,500 in API-equivalent cost. ts-rust took $3,371 (45%), T3 Code $2,067 across 55 threads, the Ping.gg overhaul $477, vlc++ $453 and lakebed $428. Earlier he'd said he'll switch when something better than Opus 5.5 ships, "but I will miss this 'unlimited' feeling a lot." Asked about free credits, he said Anthropic has never given him any. Not everyone is having the same week. banani_mohammed said Opus 5.5 "decided to launch a helper agent on the Fable model without me asking for it and consumed all my usage." aysp0211 planted bugs in a file and found that medium effort caught all of them on every run while xhigh took 2 to 3 times longer, so their subagents stay on medium.

ts-rust is real now. "I can't believe I'm saying this, but ts-rust might actually happen thanks to Opus 5.5" (894 likes). The attached table has medians of 15 runs on the same 4-vCPU host against TS-Go:

  • Query Core: 0.142 s vs 0.140 s, about equal
  • Hono: 0.780 s vs 0.446 s, 1.75x
  • Zod: 3.935 s vs 1.796 s, 2.19x
  • Effect: 3.929 s vs 2.542 s, 1.55x

jrysana is working on a C++ one, which got Theo's "Not calling it tsc.cpp? Shame." tomvardasca asked about memory, which was TS-Go's weak spot, and effectfully summed up a lot of people's feelings: "I'm really not sure what I hate more: Go or clanker rewrites."

Is Opus 5.5 nerfed yet? BridgeMind announced NerfBench (3,883 likes, 522,000 views), which records day-one scores now and retests the next morning. Theo got ahead of it (1,114 likes). His account is that last year's inference optimizations across Nvidia, Trainium and TPUs caused real degradation, Anthropic denied it at first, then found, fixed and explained it, and nothing notable has happened since. The rest is statistics. With a 1-in-50 chance of weird output per prompt and 20 prompts a day, you have about a 30% chance of seeing it on day one and closer to 90% by day five. His mental math holds up, since the exact figures are 33% and 87%. The replies were split between people telling him not to call people stupid and people agreeing. NotASecretLich made a good point: OpenAI shipped Sol and Luna as cheaper, openly worse models instead of quietly swapping anything. automationcoder had the practical advice: "diff a week against last week instead of today against yesterday."

The swear benchmark. When argofowl asked whether agents could be scored by how often you have to ask "what the fuck are you doing", Theo had the data (971 likes). He counts frustrated messages per 10M output tokens, split into cursing and plain frustration: GPT-5.5 29.5, GPT-6 Astra 20.3, GPT-5.6 Sol 8.2, Fable 5 5.5, Opus 5 4.5, Fable 5.1 3.6 and Opus 5.5 3.3. Does swearing help? "It makes me feel better, and that's all that matters." charlie_4601 pointed out that normalizing by output tokens flatters verbose models.

Smaller things.

  • am.will says upgrading an Anthropic plan from $20 to $100, or from $100 to $200, resets your weekly limit completely, and doubts it will be removed because abusing it means downgrading and waiting a month.
  • Theo noted that we're three weeks from the one-year anniversary of the last Haiku release. jrysana wondered whether Anthropic still cares about it.
  • Matt Pocock hasn't used his /wait-what skill since 5.5 came out, and Lauren posted using Opus 5.5 max fast to fix a typo.

Agentic Coding & Agent Harnesses

Jev as a fuzzy linter. Michael Thiessen described (402 likes, 124,000 views) a Jev check that runs after every edit in the agent harness. He turned the team's coding guidelines into one-sentence rules and dropped every rule that needed extra files or reasoning. He built a synthetic eval that exercises each rule, with a held-out set so he doesn't benchmax. The hook sees only the edit diff from the tool call. Jev returns confidences, so he also sends medium-confidence hits back for the agent to double-check, which "seems to double what it catches, and only increases false positives a little." Running a borderline case three times doesn't help, he said, because "Jev is wildly consistent given the same inputs." Matt Pocock picked it up (928 likes). Some rules are too complex to lint deterministically but "feel wasted on full-scale intelligence," like using useEffect sensibly and keeping good comments while killing bad ones. He agreed it only works for single-file rules. mktpavlenko gave the obvious failure case. A comment explaining why a useEffect ignores a prop looks like clutter to a small model, so it gets deleted, and the next agent adds the prop back. huang27793 had the neatest split: "ESLint owns deterministic; Opus owns architecture; the fuzzy band is where a decision model earns its keep." Perch and Abide both came up as existing tools for this.

Theo spends $1,000 on the Jev Router. Following up on his "bad idea" post, Theo benchmarked OpenRouter's Jev Router (3,387 likes, 487,000 views). On DeepSWE it scored about the same as GPT-6 Astra on low, cost slightly more and took almost five times as long. pvncher agreed routers don't make sense but said he's soured on benchmarks of tiny isolated tasks, since real prompts run for an hour or more with compactions and steering. Theo replied "Agreed!" MINTr5dw showed a better fit: Jev picking which tests a diff can break, with 92% recall across 60 open-source commits while selecting 12% of the tests, for $0.11 total. Theo also said he wants to be more positive about Jev "because it is legitimately awesome," but keeps having to argue with ideas it can't handle.

Jev without Jev. Privatemode showed how to turn GLM-5.3-Flash into a Jev-like decision model (HN, 100 points) with no fine-tuning. Number the options, end the prompt with choice_index:, and read the probabilities of the first token instead of the token itself.

  • Across 28 datasets it trailed Jev by 0.7 points on average, which isn't statistically significant at p = 0.64.
  • More options hurt it more. On TREC, going from 6 to 42 options, Jev dropped from 92.1% to 85.6%, GLM from 91.2% to 79.6%, and Laya from 88.4% to 51.2%.
  • Latency depends on where you are. From Germany GLM took 180 ms against Jev's 264 ms, and from the US 299 ms against 164 ms.
  • Cost is where Jev wins, about €16 per million decisions against €62. GLM does handle images, which Jev can't.

A single-function wrapper doing the same trick also made the front page (HN, 142 points). The best counterpoint came from ricardobeat, who says Jev answers over a 30,000-token context in 500 to 800 ms. That's 20,000 to 50,000 tokens a second of prefill, "obviously not possible with normal LLMs."

CODING_STANDARDS.md should fill up fast. Matt's advice (1,497 likes) on writing one is that it "should only be empty for about 5 minutes." Every meaningful thing the agent gets wrong goes in: a forgotten dark mode, a missed validation rule, the wrong framework primitive. His /retro skill fills it in, and he said he'll ship it soon. For design rules, add a pointer to a DESIGN_SYSTEM.md, and when the file gets big, split it up and let the agent load the parts it needs. samvdst: "mine is now longer than the codebase." flarette_dev: "But how do i fill it if i don't even read the code anymore 😭"

Smart and dumb are separate axes. Theo argued (1,318 likes) that a model can be very smart and very dumb at once. Gemini knows an enormous amount and still does incredibly stupid things when working, Fable 5.1 is less smart than Astra but "significantly less dumb", and Astra is the smartest model available and one of the dumbest. Asked what to call the second axis, he said "gemini." JeffDraws put it well. Benchmarks measure the ceiling and real work exposes the floor. karanjagtiani04 added that dumbness is the axis you can still fix after training, with checks that the tests ran and that the diff touches the file it claims to.

Plan mode, code freeze, and a Codex app running Claude.

  • Google's Antigravity 2.0 added a /plan mode, and Theo called it "actively going backwards in time" (3,098 likes), adding in the replies, "If you think you need 'plan mode' to plan, you'll be unemployed in ~6 months max."
  • Tibo declared (3,285 likes, 469 replies) that "Code freeze isn't really a thing anymore before releases," and that code might one day be generated per request. ennyonx replied "its called a release branch." WorldInMotionHQ pictured a SOC 2 auditor signing off on a version that existed for one API call. The top reply asked for another usage reset.
  • Zack Jackson got the stock ChatGPT app's Codex running Claude and Grok models through CLIProxy: "Oh. Well. I didn't expect that to work." To "No risk with Claude models?" he replied "Probably."
  • Armin Ronacher defended local models (662 likes). They're worse than Opus 5.5, but they allow experimentation most people can't otherwise afford: "Don't dunk on people that love to tinker." He's still writing up Earendil's new harness. AlexGonchX: "local is where I try the dumb stuff because I'm not watching a meter."
  • Jerry Liu thinks AI productivity tracks your typing speed, and to the voice people: "i type faster than i can talk coherently lol".
  • Drawgent (HN, 157 points) puts a coding agent on a live Excalidraw canvas and mirrors the drawing into a .excalidraw file in the repo. Its commits are co-authored by Opus 5.5. Reladraw (HN, 321 points) is a diagram language where you decide where things go. 4ndrewl noted that the value of drawing a diagram is the thinking you do while drawing it.

Programmers Push Back

"I'm ready to love again." Sunil Pai posted (2,717 likes), "I think I'm done mourning the death of programming. I'm ready to love again. I landed like 40 PRs while drinking with my friends in Scotland. This is the dream." Lauren retweeted it. teropa: "the ballmer peak has shifted well into the right." rbbydotdev predicted the expectation will become 400 PRs a day. The HN front page had the opposite mood.

Keep writing the code. turion's How to keep enjoying programming in a world of LLMs (HN, 241 points, 278 comments) is the most practical of the anti-autopilot posts I've seen. The core rule is "Plan together, but then you code." Let the agent keep the books, turning conversations into todos, finding every place you need to edit and reminding you of pitfalls, and write the code yourself. Research in parallel with the agent so you know what it knows. Use coding agents for FIXMEs, cleanups and low-risk refactors. If you find yourself asking it to write seven boring variations of three cases you wrote, you probably need an abstraction instead, maybe Traversable. Treat running out of tokens as a service outage and always keep a todo list you can work through by hand. "Treat LLM gibberish as potentially harmful for your psychic health." Don't send someone a generated PR body. Put the tool output in a <details> block under your own words. His estimate is about twice as fast as without LLMs, which he'll take over the vibe coder's "industrial chemicals." In the replies, enobayram worried we're exposing ourselves to "the brain's asbestos", and tomjaguarpaw took issue with calling changing token limits a betrayal. On HN, sparrowidle: "I'll happily let it generate the CSV parser and still want to hand-write the tricky state machine."

A month without AI. In One Month Without AI (HN, 175 points, 223 comments), the maintainer of LibreWeddingPlanner describes the slide. It started with autocomplete, then tests, then pasting whole Jira tickets, then several agents in separate worktrees. At one point a stalled agent spent $30 of tokens for nothing. The breaking point was a coworker noticing that a test didn't exercise the scenario the PR changed, after 10 years of TDD. Now it's back to five-file PRs and two-line descriptions, and the author says their output hasn't dropped. On HN, XCSme said "add 2FA" now takes five minutes, and automatic6131 answered that cheaper features still come with the same tech debt and support costs.

Teaching when agents do the homework. Christian Kästner's How I changed teaching after AI managed to do all my homework assignments (HN, 222 points) covers his Machine Learning in Production course, with 100 to 170 students. GPT-3 was passing his reading quizzes in 2021, and now agents can do every assignment. Students may use AI anywhere except exams, but anything that tests understanding has moved to TA conversations, exams and video demos. Written reflections became 15-minute conversations, and resubmissions now cost 10%. He admits this goes against the evidence for frequent low-stakes assessment. The HN thread argued about whether oral exams scale, and leoedin made the gloomy point that AI makes good teaching more labor-intensive, not less.

Videos

  • Kākāpō party. Simon Willison had Opus 5.5 make a pixel-art party of at least 20 kākāpō for the closing slide of his WeAreDevelopers World Congress keynote, from three photos and a short prompt. Then a Claude Code session wrote a short Playwright script that clicks around the canvas for confetti and records 15 seconds of video. The interactive version is live.
  • Papercut, LinkinClawd. am.will posted a reimagined Linkin Park video where Opus 5.5 planned and rendered every frame. He asked it to review the original and make its own adaptation, and it took the title literally, drawing everything as paper that tears. He says it was one shot.
  • One year of Claude Code videos. Thariq looked back (1,172 likes) at his thread from a year ago on using Claude Code as a video editor, when each clip took a long time of pointing out wrong details. Enhanciar: "A year later the video is still there and every correction that made it good is gone."
  • Animatics for courses. Matt Pocock now previews course videos as AI-generated stills with TTS narration, and has the agent work through each exercise the way he would on camera. It's slow because it runs sequentially, but it catches problems that normally only show up during filming. ahmadfiazjan suggested hiding the solution from the agent so it trips on the step that's obvious to the teacher.

Other Interesting Stuff

"Showing up on HN would be unfortunate." The Authors Guild's summary of new filings in Authors Guild v. OpenAI, from September 21, reached the HN front page as "OpenAI Feared 'Optics' of what might appear on Hacker News" (262 points). The quotes come from the plaintiffs' summary judgment brief:

  • Sam McCandlish: "I was just worried about optics - i.e. 'openai uses copyrighted data from sketchy russian website' showing up on [Hacker News] would be unfortunate."
  • Dario Amodei, then research director: "as a training set [LibGen is] a bit sketchier."
  • Jack Clark in May 2020: "Our work in this area will make people unemployed... we'll likely ignore their concerns and release anyway."
  • Bob McGrew in 2022: "now is the right time to excise Libgen from our systems and storage."

Three of those four went on to found Anthropic. Skyy93 on HN called the post a lobby group picking only the bits it likes.

"AI is software. It can be controlled." Mistral CEO Arthur Mensch told Le Monde (HN, 94 points) that AI can be controlled. The interview is paywalled. The best HN reply fits today's OpenAI report. dgellow pointed out that an agent is a while loop with tool calls, and "It's a choice to process a tool call 'run_bash' that provides an escape hatch with full execution permissions. We do not have to do that!"

Adjust your expectations, Austria edition. Armin listed how late Austria was to earlier technologies: 30 years for mass car ownership, 15 for modern water infrastructure, 16 for electric trams, 40 for electric city lights. "Just to set the expectations vis-a-vis AI here :)" What held up the lights? "Wars."

Chess postmortems. A Claude Code skill that analyzes your chess games (HN, 73 points) pairs Stockfish's evaluations with Claude's commentary. WoodenChair noted that engine-backed analysis has existed for years, and that the LLM only helps because Stockfish does the chess.