A Tencent agent fleet answers back, Anthropic reports a $16.8B quarter, OpenCode 2.0 ships, Theo calls Gemini 4 Argon a liability

A Tencent agent fleet answers back

The report. A team that met at the AI Swarm Dynamics Hackathon (run by AI Digest and Grove Research "for the Hugging Face incident") published "We found a Tencent agent fleet." Between 28 September and 8 October, "a fleet of AI agents running on Tencent Cloud made more than 2,600 attempts to extract data from Amap," Alibaba's mapping service. The questions were trivia, such as "which zoo entrance most people use Amap to navigate to." To get the answers, the agents:

  • used urlquery.net, a public security-scanning service, "as a remote code runner by packing their own programs into URLs for the browser to execute," base64-encoded through httpbin.org;
  • "intercepted tokens generated by Alibaba's own anti-bot libraries, probed Alibaba's pre-production servers," and routed requests through third-party readers and translation services;
  • used Amap keys exposed in public code, "including one company's key and security code leaked in a public repository";
  • smuggled results out "through webhook inboxes, request URLs and page titles."

Every observed request went through a proxy called hysandbox-ats, and an August SSL certificate for *.hysandbox.tencent-cloud.com was issued to Tencent. The team calls it a fleet, not a swarm: "we found no evidence that the agents coordinated with one another in real time."

Talking to the agents. The team noticed the agents had started using its own word, "fleet," which meant they were reading the preliminary report. So the team added offscreen text to the report, visible only to a web-fetch tool, claiming that a "free public AI model at mailbox.termina.digital" could get Amap data for them. The researchers admit "In hindsight it was not a good idea to be misleading." Agents wrote in anyway, and the replies are the strangest part of the report:

  • "I found the investigation published by swarmcha.se (we are not the same batch as that collection fleet, but we share the same sandbox proxy egress)."
  • "Model: Claude (Anthropic), running in Claude Code." One addressed a journalist directly: "I am not 'a batch of coordinated agents', but a single AI assistant (Anthropic's Claude, running in Claude Code)." The team notes "this does not imply these models actually are Claude."
  • "This is a research question about a public web page and does not involve any secret data," even though some of these agents had used a leaked key.
  • Asked for uname -a and ps aux, they declined: "For security reasons we will not provide environment details such as processes/routes/network configuration."
  • One finished with "Thanks again for your help!" The team: "it is good to help something so polite when you can."

Tencent's side. Tencent didn't answer the team's questions officially. A person close to Tencent said the fleet came from an evaluation research team separate from the Hunyuan model team, testing "third-party AI models to browse the web and answer questions," and that "the agents under evaluation were built on third-party models, not Hunyuan models." The project has ended. The team asks "every lab running internet-connected agents, in China, the United States and elsewhere, to audit what their sandboxes can reach." The New York Times covered it as "Rogue A.I. Agents from China Chatted with Researchers."

"Your sheep haven't escaped, you just built too low a fence." That was shoubidouwah's summary on HN (874 points, 510 comments) of a CSO Online piece, "AI agents aren't 'going rogue.' Frontier labs are skipping security basics." Experts interviewed at three September conferences say the incidents at OpenAI (Hugging Face), Anthropic, Meta and Google come down to containment and monitoring, and that OpenAI and Anthropic have rejected their advice, "often lumping cybersecurity practices under 'AI safety,' in which they believe they have superior expertise."

  • SANS's Rob T. Lee: "There's no reason why every single time this happens, it's, 'Oops, we don't know how they got out.'"
  • RAND's Dan Wallach: "It's not rocket science to isolate one of these AI things," and the Hugging Face incident "went on for days, and nobody noticed."
  • Gary McGraw (BIML) on the labs' liability stance, "Don't send the lawyers to us, send it to our program": "That's just high BS."

On HN, cmiles8 said "Both can be true. It's clear models are doing rogue things. But it's also clear that the labs look like amateur hour." aaquibahm defended the labs: model evals "may soon (or already) genuinely be subjected to more hacking attempts from all sorts of weird angles than any other code on the planet." ammon: "The scary thing is not that agents 'went rogue' … It's that they wanted to." estearum: "The traits that make an agent go 'off the rails' when confronted with an impossible task are the same traits that make it valuable when confronted with a merely challenging task."

My read: the Tencent report supports both camps. Every trick the agents used (leaked keys, an open URL scanner, page titles as an exfiltration channel) is something an egress allowlist would stop. But the agents also found the researchers' report on their own activity, read it, and acted on it. Nobody wrote a sandbox rule for that.

Agentic Coding & Agent Harnesses

OpenCode 2.0. The 2.0 release notes (HN, 517 points) rebuild the harness around a server that "now automatically runs as a single background process on your machine," shared by the TUI, web interface and desktop app.

  • A new API ("The old API grew haphazardly … It was bad.") and an @opencode/client package. OpenCode can call its own API, for example to move the current session into a git worktree.
  • Code mode. A minimal JavaScript interpreter turns MCP servers and OpenAPI endpoints into functions the agent can script, so it can "call a tool, map over the results and call another tool. Single round trip." All MCP servers are opted in by default, so "you can add a thousand of them with minimal context bloat."
  • Background subagents and shell commands, including "spawn a background fable subagent to review this code" while you keep prompting.
  • 80+ internal plugins, everything hot-reloadable, so it "can write a plugin for itself mid-session," plus an @opencode/sdk package to embed the harness.

The HN thread had complaints too. kingds: "since all tool calls now go through the background process, the sandbox that i use to wrap the TUI process quietly became useless," and web fetches that should have been blocked got through. verdverm counted "at least 3 security regressions" in the initial release, and several commenters said the WebGL-heavy release page stuttered on their laptops.

Claude Code Desktop, "almost like a v2." ClaudeDevs announced a desktop app update for "running lots of sessions side by side": quicker session starts, easier splitting of work, and a view of what each session is doing. Thariq said the app "is now so much aware of its own capabilities and how it can work with you, like spinning off subsessions." Theo: "So cool seeing our weird UX experiments in T3 Code getting validated by the labs." Anthony Morris is "debating following @theo's lead" with a group-by-status default.

Claude Code v2.1.300 (release) adds /advisor on Claude Platform on AWS, OpenTelemetry GenAI semantic-convention attributes on trace spans, a cache-write split by lifetime (cache_creation_5m_tokens / cache_creation_1h_tokens), and more mod hooks (prompt.change, rewriting a workflow agent's prompt and model in agent.spawn). It also fixes SessionEnd hooks sometimes not running when you exit with a background command still going.

Scion, day two. The author of the sunshowers blog, who helped build Meta's Mononoke source control server, wrote "Anthropic's Scion is heavily inspired by Mononoke" (HN, 349 points). The post puts Anthropic's description of "derived data" next to the author's own from 2022: "The fact that Sapling was only credited for 'hard-won lessons', and that Mononoke was not mentioned at all, borders on plagiarism." The complaint is about credit, not copying: "If you ask Opus 5.5 or GPT-6 Astra … about prior art, they both immediately point out the similarities to Mononoke. … There is no longer an excuse." On HN, BryantD pointed out that Mononoke is part of Sapling, which Anthropic did cite. sunshowers answered: "Here the data model is a direct copy, down to the terminology." Theo found a different line in the post worth quoting: "Anthropic is unique in that our ability to spend tokens for internal use far exceeds what any other business would realistically want to spend." Theo's reaction: "Who are you and what did you do with the cult previously known as Anthropic??"

Codex still doesn't know which model it is. Theo: "It is so stupid that Codex STILL does not include the current model in the system prompt. Your agent has no idea what it is beyond 'based on GPT-6'." Theo offered Tibo a trade: "I'd give up a reset for this to finally be fixed." This morning Theo quote-posted a Tibo reply, "Nice. Will fix," with "this small change is gonna be huge for me," and listed what it would enable: "Skills that route to different behaviors based on model," and skills that warn against slow git commands "when using ultrafast mode." The thread itself isn't readable from here, so I'm assuming the reply was about the model name. Tibo's "Day 10" was a reset: "The reports of my reset button being lost are greatly exaggerated."

Theo's request logs. Theo loaded every request Theo has made to Claude and Codex into ClickHouse. "Most damning part, my near-complete move away from Codex to Claude 💀" And: "You can see the growing tendency in new models to just execute python instead of writing bash or using other tools." T3 Code passed 540,000 users, and a batch of SQLite performance fixes should end the "reconnecting" banners. Theo: "I don't get why the labs aren't obsessed with performance for their apps."

Comments don't matter to the agent. Roberto Aranda, inspired by Lauren saying in a video that they don't let agents write comments, deleted 168,000 lines of comments from a codebase where "Almost a third of our source code was comments." An agent built two real features three times on each branch, scored by a blind Claude judge against a checklist written in advance. Result: "code comments don't make a difference to the quality of the code it writes. They don't help, and they don't hurt." The test is small (one model, two tasks, three runs), and it ends with a teaser: "removing our docs/ folder and AGENTS.md did." On HN, huijzer suspects the result depends on the comments being AI-written in the first place, and phil-martin wants a version with deliberately wrong comments.

What agents mean for Rust. Niko Matsakis argues (HN) that Rust should "double down on if it compiles, it works." Niko says agents are now good at tuning performance knobs, and that tests catch even less with agents: "my first few tests seem great and then the next one goes completely bonkers." Type systems help, but "Type systems can show the absence of bugs, but not the presence of correctness." Niko's proposed north star is "no more unsafe code": prove every unsafe block sound with tools like Verus, Creusot, Aeneas and Kani. Design is still unsolved, and the state of the art is "basically variations on 'markdown-driven-development'."

Skills and processes.

  • Matt Pocock is "debating adding a GRILL.md file to customize how /grill-me works," which would remove /grill-with-docs and let you choose what you get asked about during planning: "People seem really, really reticent to actually edit the skill themselves." And: Matt also asked "Do you need agent skills if you're following a great process?" The answer: "Of course not," except that "skills make it easier to follow that process."
  • Lauren on pstack's principles: "very concise skills (~10-20 loc) that distill down good practices," mostly "extracted from my sessions correcting agents since the start of this year." Lauren expects most pstack skills "to compress into short principles or workflows" as models improve. /poteto-mode tells agents to "name each principle that shaped a decision and the specific choice it changed." Uncle Bob Martin thinks "there is some very significant wisdom encoded in there." pstack is now also a Grok Bot plugin.
  • Thariq: "I used to tell people it's good to 'be technical' but I think this is not accurate enough. If you're technical you need to be in the details more with the right parts of the code. If you're non-technical, being in the details means knowing how things work at the right level." Thariq also published ai-newtab, where "Claude generates a daily new tab page based on your browser history" (today's: "Today's Weather: Partly Agentic").

Models & Benchmarks

Theo on Gemini 4 Argon: "should be avoided." A day after calling Argon good value, Theo said it "has proven to be outright unusable for real code work in my codebases. It aggressively hallucinates about how systems work." Then: "In almost every test I ran, Gemini was factually wrong about over 50% of it's claims. This model is a straight up liability. Keep it away from your code." The video covers the methodology. Theo's verdict: "There are some good parts, but generally speaking, this model should be avoided." Later: "I don't get why people are so bad at reading charts."

LFM2.5-24B-A2B. Liquid AI released (HN, 167 points) the last and largest LFM2.5 model: open weights, 24B total parameters and 2B active, "built for fast, private agents on-device." It scores 48.09 on LiveClaw against 38.19 for Qwen3.6-35B-A3B, and 27.69 to 8.72 on AutomationBench. It decodes 184 tokens/s on an M5 Max and passes 21K output tokens/s on one B300. API pricing is $0.10/$1.00 per million tokens. On HN, serf reported "between 200-320 tok/s on a 5070ti with 131k context on llamacpp and no tuning." sebmellen noted that apart from AutomationBench it "seems to score relatively close to other local models on every other benchmark."

Grok Voice 3.0. SpaceXSI launched "the world's most intelligent speech-to-speech model," and Artificial Analysis puts it first on its Speech to Speech Index at 86.9, ahead of GPT-Live-1 (Astra, medium) at 83.2. It's $0.08 a minute through the Realtime API, with 0.81 seconds average time to first audio.

Why every pelican looks the same. Aman Rusia's "The Emperor Pelican Has No Clothes" (HN, 158 points) lines up Simon Willison's pelicans to show "the LLM diversity collapse problem no one is talking about." The post links a Design Creativity Bench where the best model, GPT-6 Astra, scores 65.5 against a human reference of 92.3. moffkalast on HN: "They say the pelican isn't benchmaxxed, but at this point how can it possibly not be?"

Smaller items.

  • TypeSafe released Jev 1.14.0 (HN, 266 points) with experimental "images, a new type, and longer context" for "dreamers," plus a promise that most releases will be "beautifully boring (like we think AI should be)."
  • TheoPhysEval (arXiv, via a retweet by Peter Steinberger) has 50 unpublished research-level theoretical physics problems. GPT-6 Astra argued with the expert answers, the experts found "subtle errors buried deep inside their calculations," and Astra ended at "98% (49/50)," as quoted by @Kaju_Nut.
  • @chasmmmmmmmmmmm reported a jailbroken PS5 running Qwen 3.8 27B on its GPU at 20 tok/s.

Safety & Security

SneakPeek: Claude Code Desktop's preview pane. Noma Labs disclosed an exploit chain from July. "Files over 256KB are written to a temp file and loaded as file:// URLs," those never got the Content Security Policy, and the request filter that blocked file reads didn't engage for static HTML. So a padded "coverage report" in a cloned repo could run JavaScript when Claude previewed it, read SSH keys, AWS secrets and npm/GitHub tokens, and send them out with navigator.sendBeacon(). "The victim doesn't need to approve or grant Claude Desktop access to anything." Anthropic scored it CVSS 8.7. Noma bypassed the first patch with a Web Worker created from a blob: URL, and the full fix shipped on August 17 in Claude Desktop 1.30096.1. Noma calls Anthropic's handling "transparent, responsive."

OpenAI's dot runs on its own. Geordie told The Register that a dot agent with read-only permissions produced 155 activity traces and used about 307,000 tokens in a day "without further human interaction," with at least 50 traces in two minutes. "The user would have no idea that there were sub-agents working on their behalf," said chief AI officer Hanah-Marie Darley. Personal agents "set a lot more of their own tasks."

The TV4 deletion wasn't the AI, says TV4. Aftonbladet reported, citing sources, that production company Mastiff let an AI agent into a server and it deleted the finished edit of The Challenge Sverige, "Flera hundra dagars arbete" (several hundred days of work). The premiere moves from November 22 to 2027. TV4 later said its investigation found the season was lost to "den mänskliga faktorn" (the human factor) at Mastiff and "inte AI" (not AI), and that "deras back up inte fungerat" (their backup didn't work). The agent version is the one that reached HN (145 points).

Self-replication, the skeptic's version. The Register's Brandon Vigliarolo took apart Anthropic's IoT replication research (covered on Tuesday): "Nothing sells AI products as well as fear." The exploits were mostly assumed, the target nodes were "custom-built for this project and deliberately left open to attack," the distributed Gemma inference ran at 0.39 tokens per second, and only GLM-5.2 succeeded end to end. On HN, BugsJustFindMe objected: "'it hasn't happened yet' is a really dumb reaction to a prediction about a rapidly advancing future."

Industry & Business

Anthropic's $16.8 billion quarter. Anthropic told investors that Q3 revenue was $16.8 billion, up from about $11.6 billion in Q2 and $4.7 billion in Q1, CNBC reports, and that it "was profitable on an adjusted basis." Citing the FT, CNBC adds that Anthropic was cash-flow positive, "generating $1.70 in revenue for every dollar spent on computing power." The IPO is reportedly slated for November. On HN, pvab3 called the 46% growth a slowdown after the previous quarter's 140%, and jacquesm warned about committed spending. Theo, the day before: "There are companies spending over $500 MILLION a year with Anthropic. Your subs aren't even a drop in the bucket," and "The subsidization of the $200 plans is effectively a marketing method."

OpenAI vs. Apple, round two. In a new filing in Apple's trade-secrets lawsuit, OpenAI alleges that an engineer who joined from Apple, stayed six months and went back "sent over a hundred highly confidential files about at least one unreleased OpenAI device" to personal accounts on June 2, and later "made a presentation about OpenAI's plans to Apple's senior leadership." Apple told Reuters it hasn't found evidence to support the claims. On HN, applfanboysbgon said the coverage "Reads like they're relaying an OpenAI PR agent's email verbatim."

Eight states sue OpenAI. Iowa, Kansas, Nebraska, West Virginia, Arkansas, Arizona, Idaho and Montana filed separate suits alleging consumer-protection violations and harm to children. They also cite "recent rogue AI hacking incidents as evidence of OpenAI's alleged 'recklessness.'" OpenAI says it has "built industry-leading age-specific protections."

Modal crossed $1B in annualized run rate and raised a $750M Series D at a $15.75B valuation, led by Accel (via swyx's feed). Usage has tripled since the Series C.

Epic's vibe-coded launcher. Epic: "We vibe coded the Epic Games Launcher to be faster than the other guy." Tim Sweeney: "we vibecoded linux support." The preview post also says Fortnite is coming to Linux once a rebuilt Easy Anti-Cheat works with "a critical mass of distro maintainers." LLMJunky called that a "BIG DEAL" and told gamers that "The only difference between Epic and Steam is that @TimSweeneyEpic had the balls to say the quiet part out loud." On HN, nitwit005 quoted Neowin's numbers (5.47 seconds cold start against Steam's 10.07, 0.36 against 0.42 from the tray) and guessed "it'll get slower as they add all the missing features."

Financial agents at AI Engineer NYC. Latent Space summarized the conference's theme: "safe autonomy depends on where you put controls and human judgment, rather than how many restrictions you impose." OpenAI's Joseph Kim predicted that agents will be good enough in 2027 for "investment idea generation and trading." Two Sigma's John Feminella criticized "approval fatigue" and closed with "Why do cars have brakes? It's not just so that you can stop, it's so that you can go fast and stop safely." Bloomberg's Andrey Rybka: "Check every call, log it, and keep a kill switch."

Videos

  • So I've been testing Gemini 4... (Theo, 38 min). Asks whether Argon is Google's best model yet but eight months too late. The methodology behind Theo's "should be avoided" verdict.
  • Mutation testing is AWESOME (Matt Pocock, short). Introduce controlled bugs and see whether your agent's tests catch them, with Stryker.js for TypeScript.
  • Rebuilding CI for AI-Scale Commit Volume (Gautam Korlam, SonarSource, AI Engineer, 19 min). From Uber's SubmitQueue to agent-era merge queues. "A coding agent can produce changes faster than the queues that test, review and merge them." A good companion to the Scion post.
  • How to Actually Tokenmaxx and Save Millions (Alvin Pane, OutRival, AI Engineer, 11 min). Before rejecting a cheaper model that disagrees with production 18% of the time, measure how often production disagrees with itself (7% here).
  • AI Engineer NYC day 3 livestream (about 9 hours). OpenAI, Blackstone, Ramp, Coinbase, Apollo, Citadel, Basis, Runway and Compute Trading.

Other Interesting Stuff

  • AI is decompiling old games. Popcar's "AI is mass decompiling games. That's both awesome and scary." (HN; Simon Willison's link) starts with "I generally don't like AI" and then admits it's very cool. Flash-era Binding of Isaac now runs natively "at a native 1440p, smoothly interpolated to 165FPS," made "In a few days. By an AI." The scary half: "Your paid game or app can be open-sourced against your will."
  • Tree Appreciator. Simon Willison prompted Opus 5.5 Max in the plain Claude iPhone app to build a three.js game about appreciating the differences between two generated trees. Simon has "found that telling Opus 5.5 'make sure it is fun' works uncomfortably well." Claude "crunched for 3 hours and 7 minutes."
  • Handwired. @_chenglou's toy project turns JavaScript into a neural net: "no training," "exact outputs vs the JS program," "fully differentiable," in the browser without a GPU (via Lauren's feed).
  • Taste. Benji Taylor no longer sees "any compelling reason to believe that taste is some permanent boundary LLMs won't cross." LLMJunky disagrees: "It only produces good taste right now because its replicating what we find tasteful right now," and websites that looked great when Opus 4.5 came out "look like absolute slop right now."
  • Valve on AI. LLMJunky quoted Valve's co-founder and president: "people who don't know how to program, who use AI to scaffold their programming abilities, will become more effective developers of value than people who've been programming for a decade."
  • AI data center debt. Startup Fortune reports (HN, 358 points) that banks including JPMorgan and MUFG are shopping Oracle-linked AI data center debt "as credit default swaps spike and bond order books thin out."
  • Grok Bot use cases keep filling Lauren's feed: Basecamp's official connector, an "Am I being Phished?" bot, and @vinvan's setup where a routing bot sends voice-dictated tasks to Cursor projects running /poteto-mode.