Claude proves 123 libraries crash-free, Agent Skills goes to the AAIF, "the code, not the spec", and Bernie wants to pause AI

Claude & Anthropic

Claude proves 123 libraries crash-free, down to the assembly

Anthropic's Frontier Red Team published "LLMs are making formal software verification feasible at a much larger scale" (6.2K likes, 890K views; HN, 329 points). With @theoremlabs, they had Claude turn the existing fuzz tests of 123 open-source libraries into specs, then prove those tests can never crash. Claude "proved that these programs will always exit normally without triggering memory-safety errors or failing assertions, for every input less than 64 MB and every modeled Linux operating system (OS) response and memory layout". The proofs run against the RISC-V machine code, not the source, and Rocq checks them.

  • Why it matters: the post points out that seL4 took "two person-years to implement" and "20 person-years to formally verify". The new claim is "the first large-scale effort to use AI to apply formal verification to production software at the assembly code level."
  • Bugs found on the way: when a proof failed, Claude patched the code and proved the new version. Many of the bugs "are ones that a fuzzer would be unlikely to ever find": a decompressor counter underflow that only fires "on inputs of around 20 MB that had one rare, specific layout", an image-decoder out-of-bounds read needing "a 64 MB input and over 2 GB of memory", and a rediscovery of a libexpat CVE.
  • Fuzz tests prove more than memory safety: many of them assert properties like encode-decode roundtripping, so "proving the test never crashes is equivalent to proving the property itself." For cpp-httplib, Claude had to prove "(on machine code!) that libc++'s red-black tree rebalancing algorithm is correctly optimized to keep the tree's depth logarithmically bounded."
  • Other experiments: a Claude-written formal spec of RFC 1950 (zlib), proved against the Linux kernel's x86 binary, and a Python interpreter in Rust proved with Verus against CPython semantics. It matched CPython on 99.95% of 1.7 million random programs.
  • What ships: a subset of the proofs plus the RISC-V and OS semantics. Theorem will run the pipeline for other open-source projects and is publishing a Claude skill for verifying your own code.

Replies split between excitement and spec skepticism. Taelin wrote "that's such a good idea" (539 likes). Others replied "please do not point this at my github" and "the proof is only as good as the spec, and the spec was written by whoever wrote the bug". One reply read the line about withheld proofs that "may reveal an unpatched bug" as "Stockpiled Zero-Days known only to Anthropic". On HN, jaykru quoted the appendix's own worry that agents "hit a complexity wall with the verbose proof style". sestep has been doing this at work: an agent opens a SIMD or CUDA speedup PR, and "just confidently merge it because the PR has a Rocq proof that it's behaviorally equivalent to the original implementation." malisper described a Rust rewrite of Postgres where "I have an LLM write a Lean proof that they behave identically."

Agent Skills goes to the Agentic AI Foundation

Anthropic is donating Agent Skills to the Agentic AI Foundation (AAIF) under the Linux Foundation, "the same foundation we donated MCP to" (ClaudeDevs, 7.2K likes). The post says more than 70 agent platforms, "including ChatGPT, Cursor, GitHub Copilot, and VS Code", have integrated the standard since December 2025. Anthropic hands over the name, logo, GitHub org and the agentskills.io domain. Engineers "from Anthropic, Google, OpenAI, and other companies will maintain the standard as individuals, with David Soria Parra and Mahesh Murag as Lead Maintainers." The proposed roadmap covers versioned releases, a formal proposal process, and security guidance for skill authors and installers.

Boris Cherny added that "Agent Skills started as an experiment in Claude Code." The top replies asked "How does one donate a standard?" (305 likes) and "Does this mean Claude Code will also support .agents/skills?" (130 likes). One reply summed up the playbook: "Ship the spec and let 70 platforms adopt it, then hand it to a foundation so nobody can call it lock-in, same move as MCP".

Auto mode becomes the default in the Claude apps

"Starting next week, sessions across Claude web, desktop, and mobile apps will run in auto mode by default on Pro, Max, and Team plans." (15K likes, 1.4M views). "Rather than asking you to approve each step, an automated check blocks risky actions." It quotes the August Claude Code announcement, where the classifier "caught 89% of dangerous commands. Manual approval caught 14%." The top reply: "finally, no more clicking "allow" 40 times in one session" (587 likes). Another: "people who didn't use auto mode before this are weird". kitze's reply was "drop fable brother" (154 likes), and Fable 5.5 requests showed up under the other Anthropic posts too.

Claude Platform on Google Cloud, and Anthropic's own source control

  • Claude Models on Google Cloud (Anthropic managed) is GA (announcement, post). Google Cloud customers get the full Claude Platform with Google Cloud IAM, billing and "commitment retirement", and "new features and betas ship the same day". That includes code execution, the Skills API, the advisor strategy beta and Fast mode on Opus 5.5 ("up to 2.5x faster", "$8 and $40 per million" input and output tokens). In this offering Anthropic is the data processor. The existing Google-managed offering stays for customers who need Google as processor or strict data residency. TestingCatalog called it "Google Cloude Cloud". OpenAI's models came to Google Cloud yesterday.
  • Anthropic replaced Git with its own system. The Pragmatic Engineer's The Pulse quotes Anthropic's engineering blog: "In May 2026, Anthropic averaged around 2,500 code changes merged per day; as of September, we merged over 30,000". Gergely Orosz lists a 25GB monorepo, "25 million git checkouts per day, just for CI!", and "~3,000 staff" running "typically 10-15" parallel Claude agents each. Anthropic outgrew its hundreds of git mirrors and built Scion, a closed-source source control system, plus Antique for code review (HN).

Codex & OpenAI

METR and Redwood spent three weeks inside OpenAI's monitoring

OpenAI announced that it "invited METR and Redwood Research to pilot an embedded evaluation of our internal monitoring system". METR's write-up is the substance. From July 21 to August 11, one METR and one Redwood employee worked on OpenAI-issued devices with access to the codebase, monitor prompts and about a dozen staff interviews. They produced a 61-page internal report. Findings on the system as it stood on and before July 21:

  • An estimated "75–94% of agentic internal Responses API" traffic was eligible for monitoring, and 99.2% of internal Codex traffic.
  • Compaction events weren't monitored, which "likely led to on the order of 10% of eligible internal Codex traffic not being monitored between May and July 2026". Because the monitor triggered when agents returned control to the user, "agents could indefinitely postpone being monitored by simply continuing to take actions." OpenAI had found this independently and fixed it during the exercise.
  • "We found a way Codex agents could in principle bypass Codex sandboxing and Auto-Review".
  • "two independent client-controllable headers that disable the monitoring system for new agents".
  • An exploit that "would prevent hundreds of recent actions (including the actions involved in the exploit itself) from being monitored [exploit details redacted by OpenAI]."

OpenAI says every vulnerability affecting production safeguards is patched. METR notes "We have not evaluated these claims". The recommendations include monitoring "every N messages/minutes instead of waiting for them to end their turns" and keeping monitor design and code away from agents. The top reply asked for 4o back. Another quipped "Tibo better not quote tweet this later prefaced by Day 18/".

Decisions API goes GA, and Day 18 is another reset

Agentic Coding & Agent Harnesses

Matt Pocock: "The code, not the spec, should be the center of your universe"

Matt posted the line (1K likes) and, in replies, "Code is executable, spec is not". Tom Daniel argued the other side: "I treat specs as the new codebase and code as the compilation of the specs." Matt answered: "I see code as the environment the agent runs in. To use your analogy, bad code would likely produce a bad compilation."

Matt then asked "How would you define spec-driven development?" because "Semantic diffusion has hit SDD hard", linking Martin Fowler's bliki. dex thinks "it's beyond saving. SemDif is a one way door", and recommends describing what you actually do, e.g. "I have the agent interview me to build a product specification that avoids technical specifics". SpecDLC offered "Specs age like milk, ACs like wine." Another definition: "if you can throw the code away and regenerate something equivalent from the spec it's SDD… otherwise it's just a long prompt". faye reported that at non-Bay Area companies SDD is "seen as a cure all for any issues related to enterprise adoption of agentic development".

Matt still sometimes says "/grill-me about this, one question at a time" when "the problem is hugely underspecified". Matt uses /wayfinder "as an escape valve for when a task will obviously take more than one session to plan". Matt's prompt of the day was "/grill-me on how a /software-factory might help us", backed by a new skill PR with research docs on orchestrators, git hosts, ticket trackers and runners.

TypeScript 7.1 content mappers win over Matt

"Let me put my TypeScript hat back on for a minute": Matt finds content mappers in the TypeScript 7.1 Beta "outrageously exciting", "a dreamland for tinkerers". A content mapper registers for a file extension in tsconfig.json and gives TypeScript "a virtual representation" of a non-TS file, with regions mapped back to the original. Matt's simplest case: import a markdown file, add config, run tsc --runExternalCode, and "Get fully typed markdown frontmatter". The flag is needed because "Content mappers are effectively arbitrary executables that TypeScript dispatches to". Microsoft says mappers have been prototyped for Astro, CSS Modules, Ember, MDX, Svelte and Vue. The beta also ships a new multi-entry-point compiler API. One reply pointed to @colinhacks' SQL query implementation built on content mappers. Another asked what happens to the editor "once there's a few hundred .md files in there."

Theo: "What is a harness?"

Theo published an X article, "What is a 'harness'?" (3K likes, 179K views): "I'm writing this because I'm tired of having to explain it". It followed "It is amazing to me how many devs straight up have no idea what a harness is", posted after someone asked "isn't he building a harness" about T3 Code. In that thread, Theo summarized: "The harness is what the llm sees, not what the human sees." Theo pointed to a post by Vivek on vtrivedy.com. dex blamed "semantic diffusion my dude - harness had a good useful definition for about 3-6 months". Theo: "I will hold the line". Earlier the same day Theo had posted "Caring a lot about harnesses rn feels similar to caring about tabs vs spaces", and conceded "Kind of self-own'd here huh".

Also from Theo: "Every time someone says 'ai can't write good code', I know that they can't write good code." (4K likes). After a reply that "In Germany aprox. 90% of all devs are currently anti-ai", Theo added "talking to devs in Germany was rough pre-ai as well" (292 likes). A calmer reply: "ai writes code about as good as the person reading the diff". In another post, Theo said that during the Railway and PHP mess "I would never have survived the day without agents": "They triaged all the outages and security issues. They rolled dozens of api keys across various platforms." Now Theo is "so relieved to have Railway back. I don't think I can churn."

swyx: Opus 5.5 estimates in agent hours

"Opus 5.5 is the best work estimator model i've ever used." swyx's point: "don't tell me that it's going to take 2-3 working days (what a human would do) when for you, an enthusiastic, indefatigable, and embarrasingly parallelizable AGI, can get it done in 2-3 hours." The method: "just /loop and ask it to base estimates on recent past work". A follow-up showed it estimating ETAs "for its own pipeline fixes while running the pipeline still". Raph Terrier said the opposite: Opus 5.5 "always gives me days or weeks estimates, for what will take it a couple hours". Eli R. noted that "'2-3 days' meant meetings, Slack, and waiting on someone to approve it."

Lauren's statechart skill, and pstack's formal verification

Lauren (@poteto) has been "working on a new companion skill" that helps agents "draw these beautiful statecharts/diagrams + check them against the specs you made with /create-formal-verification-skill in pstack!" (3.7K likes). It now renders with Pele from kepano, and the release is coming "soon". kepano replied "let me know if there's any way I can improve Pele". Lauren said it has "already replaced better-mermaid with Pele for grok bot desktop and mobile". J. Gamboa shared a Pi port of the skills that updates the diagram on every PR.

dax: OpenCode goes native, and rejecting work got easier

Smaller items

  • pi-cached-compaction (Nico Bailon, repo): Pi's built-in compaction "swaps the system prompt, drops the tools, and flattens the messages, which breaks the prompt cache." This extension keeps all three and appends the summary request, "so ~99% is read from cache." It also compacts "just before the cache expires" if you step away. Alex Champandard asked "why a plugin? It seems to me like a problem that should be fixed in the original library."
  • Armin on macaroons: "instead of OIDC more services could consider macaroon like tokens. Where any party can restrict token lifetime along the way." A reply made the agent case: hand an agent a token "narrowed to one repo and one hour, and it can narrow it again for any sub-agent it spins up."
  • NVIDIA OpenShell (repo, HN, 383 points), first covered in late September, hit the HN front page. It's "the safe, private runtime for autonomous AI agents": sandboxes, policies, credentials that only work at approved endpoints, and formal verification that flags "risky new access" in policy changes for human review. HN objected to default telemetry. Another commenter: "It's funny that it takes checks notes a video game card manufacturer to make a good sandbox for AI agents".
  • Dijkstra's "The foolishness of 'natural language programming'" (1978) resurfaced (HN). nickm12 sends it "to everyone who tells me how English is now a high-level programming language".

Security

PHP2Shell: exploited four days before disclosure

Amazon Threat Intelligence found "a PHP2Shell exploitation attempt dating to Oct. 17, 2026, in MadPot telemetry, four days before public disclosure" (HN, 263 points). The post argues that "AI-assisted analysis makes it cheaper to turn a patch diff or advisory into a working exploit". Patch timelines for internet-facing criticals should be measured "in hours. A 7-day or 30-day SLA assumes a delay that no longer exists." HN asked why Amazon Linux still took "18 hours AFTER the release of the patches". VladVladikoff still hasn't seen a working exploit: "There are hundreds of vibe coded attempts on github but none of them work".

Meanwhile petecooper posted "Tell HN: I unknowingly broke the PHP RCE embargo. I am sorry." (524 points): "My contact had told me there was no embargo, and her contact had told her the same thing." The top reply: "you can't possibly be responsible for breaking an embargo you weren't subject to or informed about." Another replied that "it was leaked and being exploited well prior to your previous posting", linking the Amazon post.

Kernel bugs on the public list, and a dashboard for the season

Agents Meet the Banks

Axios reported that "Major U.S. banks are detecting unauthorized third-party AI agents inside customer accounts, including some attempting to take actions that appear to be independent of user instructions". The Decoder summarizes that Morgan Stanley has blocked agents, and that JPMorgan, Bank of America and Wells Fargo are restricting them, mostly toward read-only access. Senator Bernie Sanders quoted it: "This is insane. We cannot allow AI agents to go into your bank account and act independently without your authorization… Pause AI NOW!" (8.9K likes, 1K replies).

Rhys's reply was the top one (479 likes): "You authorize them to act on your bank account when you give them access… We do not need to treat the general public like children." Rhys also posted: "somehow signing in to chase.com on a muse browser has become 'endangering the entire global financial system'… the plot has been lost". Several replies read it as the banks protecting deposits. One: "Chase doesn't want muse pulling money from their checking account to someone that pays interest." Mike Choi disagreed: "we've seen incidents of supposedly capable people dropping production databases". Separately, an ABC/Post/Ipsos poll found most Americans think AI is bad for society and oppose more data centers (HN).

Models & Inference

Personal Agents

Videos & Podcasts

Other Interesting Stuff