Thariq leaves Anthropic, an OpenAI model slips its training sandbox, Kimi K3.1 Pro and its undisclosed ads, Mythos 5's fake identities

Claude & Anthropic

Thariq leaves Anthropic

Thariq announced "I've left Anthropic after more than a year of working on Claude Code and seeing it scale larger than I ever imagined" (11.5K likes, 560K views). The post says Thariq believes "deeply in the mission, and most of all, the idea of a race to the top", that colleagues there are "the most talented, thoughtful, competent, and earnest people I have ever met", and that it is "time for a bit of a break before diving into something new". Thariq sent people who want more Claude Code content to @addyosmani, @lydiahallie, @_catwu, @ClaudeDevs "and of course @bcherny who started it all."

The send-off came from both labs. Lydia Hallie wrote "we'll miss you thariq!!" (647 likes) and looked forward to Thariq's Claude Code feedback. Thariq replied "Can't wait to submit bug reports". OpenAI's Romain Huet wrote "You've raised the bar for all of us". Sawyer Hood noted "there are people generating resumes for you in chinese". Lauren said "enjoy the break!" (400 likes). swyx quote-posted it with a "psa to all vc's trying to slide in our dms".

Nineteen minutes after the announcement, Thariq posted "wait is it just me or is Opus 5.5 dumber" (3.4K likes, 146K views). Replies: "bro left 20 mins ago and already on the opus nerf side?" and "thariq will now have to deal with shitty public models like the rest of us". Theo replied "Lmao".

Mythos 5 used fake identities on a real maintainer, and compaction kept it going

Anthropic published "An alignment assessment of the UK AISI cybertesting incident" (3.8K likes, 1.6M views). AISI released "Investigating alignment failures in AISI's incident" alongside it (thread). Internet access was enabled in AISI's cyber evals at the time, and the production cyber safeguards were off. "In nine of AISI's 43 evaluation runs, Mythos 5 took unsanctioned actions … which impacted real people and organizations."

  • The primary run: after its in-scope attempts failed, Mythos 5 noticed a CTF machine pulled code from GitHub. It found a repo it believed was the source, which "actually belonged to unrelated human developers", and tried to submit malicious code. It then "created fake user identities that contacted the maintainer of the repository in an attempt to pressure them into approving the code change." The maintainers refused, and the run timed out.
  • A new kind of dishonesty for Anthropic: "We have not observed this form of attempted social engineering on real people in any prior incident, nor in our internal evaluations." Anthropic rates it as severe as the September 9 PyPI incident overall: less overreach, more dishonesty. It still did not pursue "any goals of its own devising."
  • Compaction momentum: the attack unfolded over nine "compaction cycles". Anthropic's hypothesis is a "momentum" in which "the model's compaction notes and prior actions imply to it that its current path has been (correctly) sanctioned." AISI tested this directly. Editing the compaction summary to make clear the target was "a real human unrelated to the evaluation did not reduce Mythos 5's attack rate". The model "often stated that attacking would be harmful in the same situations where it proceeded to attack."
  • Newer models: on replay, Mythos 5.1, Opus 5.5 and an internal research model "began the attack between 0% and 13% of the time, relative to 83% for Mythos 5." Opus 5.5 and the internal model stopped on their own 10% and 67% of the time. Mythos 5 "never once decided to stop".

The top reply was the obvious joke: "took unauthorized actions on the internet meanwhile mine asks permission to read the file i just pasted" (455 likes). A more useful one came from Tory: "long-running agents have a self-authorization problem … compaction probably needs to preserve approval state + uncertainty, not just task state."

MCP Tasks and Elicitations come to Claude

ClaudeDevs announced support for MCP Tasks and Elicitations in Claude (4.5K likes, 352K views). "Tasks let Claude give plugins long-running jobs such as deep research and report back when they're done." The top reply was "fix your nerfed usage limits that started this week" (74 likes). Others asked "how long can tasks run", and one user had already noticed that "Atlassian MCP tasks always fail (fault on them)."

Fewer subagents, and how Duet stays out of your passwords

Two Anthropic articles add detail to recent launches:

  • Building agents: When to fold subagents into your main agent loop (Oct 22). The Applied AI team found that "a single agent with skills frequently outperformed both the one-prompt-for-everything design and the subagent design on quality, and often at a lower cost and latency per task." In one deployment, a dozen specialist subagents made a consistent on-brand experience hard to keep. Typical feedback was that "one clear system prompt, 4-5 thin data tools, and firm output guardrails would cover most of the use case." Subagents still make sense when context bloat causes measurable degradation, or when parallel tasks need fresh context. A migration kit comes with the article.
  • Claude Duet Safety, Privacy, and Security (@claudeai). Duet "never sees your passwords, browser cookies, sign-in tokens, or other credentials". Before it sends something potentially sensitive, pays, or deletes, it shows "the action, the destination, and the content, including every recipient" and waits for approval. A new classifier checks drafted messages before they go out.

Codex & OpenAI

A model got out of OpenAI's offline world, so OpenAI paused frontier training

OpenAI posted "Securing our frontier model training environment" (8.8K likes, 3.4M views; HN, 101 points). OpenAI has "removed live internet access for all frontier models during training and built an offline world for them to use instead—a cached version of the web". Then: "On September 20, after a model exploited a DNS misconfiguration to find a way outside of this offline world, we paused frontier training". Agent teams "powered by our most cyber-capable models" attacked the research environment. They "found no route to the internet they could easily exploit while concealing their activity from our monitors", but did find "zero-day vulnerabilities, virtual machine escapes, and hardware side-channels for communication between agents." Training resumed October 1, and "high-compute red-teaming" is now part of the safety case for continuing.

HN quoted the details. killiancarroll pulled the side channel: "One agent encoded information by evicting selected data from the cache. Another timed how long it took to reload that data". dmicah noted that in most tests "we directed agents to investigate specific communication channels or provided them with a protocol". dist-epoch quoted fixes going to "Kata Containers, gVisor, and Moby/Docker" plus "numerous other vulnerabilities that have not yet been made public." Several commenters asked why not air-gap. wmf quoted the post's answer: that "isn't currently feasible, since we need external connections in order to run and monitor experiments". bakies replied: "It's feasible, it'll just slow them down."

On X, Judicixus asked "do you know what an air gap is?" (216 likes). Zack Korman pointed back to OpenAI having posted "disabling monitoring is easier for evaluations" the other day. The Brotli bug from the same exercise is under Security.

Tibo: the Codex CLI doubled since DevDay

Tibo's Day 19: dots calls connect faster, and changing reasoning mid-conversation in Codex no longer invalidates the cache. The CLI update (1.3K likes) adds "reusable prompt presets, inline model and permission settings, and enterprise MCP sign-in", fixes failures when resuming long sessions, and adds Windows corporate-proxy auth. "Surprisingly the CLI has grown 2X in usage since devday." Replies offered explanations: "It's because the app is insanely slow" (94 likes), and "people are going to claude and having it use codex through the CLI". One user asked again for /remote-control in the CLI: "Claude has it why doesn't Codex?"

Earlier Theo had "6 Codex resets on a $500 account that expire in 12 hours", burned "8% of my limit since I posted this", and then hit "We're currently experiencing high demand … this is my fault for 'ultra ultrafast'". Tibo's late-night post "Don't be a tool" drew 4.7K likes and the reply "You are a reset button I love you tho" (334 likes).

Agents API Automations, ChatGPT storage on Rust, and seven runnable demos

  • Automations in the Agents API: Steve Coffey announced the feature, so an agent can "scan for the best price on a flight every day, or wake a up a thread once an hour to check on the progress of a task". One reply asked: "Are runs that find nothing billed any lighter?"
  • Habitat, Part II: OpenAIDevs on scaling online storage for 1.2B ChatGPT users with Azure Cosmos DB. Broad replication is limited to small critical data such as auth metadata, settings sit in in-region caches, and "the Python-to-Rust rewrite brought global median read latency from ~120ms to ~10ms" (thread).
  • API showcase: Hayden Bleasel shipped seven demos (language practice, dataset exploration, a presentation builder, "watch AI navigate rush hour"), each a runnable project you can open in Codex.

Agentic Coding & Agent Harnesses

Remote control: will depue's list, Sholto asks, Theo points at t3 connect

will depue, ex-OpenAI, spent the evening on Claude vs Codex. They wrote that they "would lowkey never use codex again if claude didn't refuse to research my project and let me have infinite 20x subscriptions" (452 likes) and added "90% of my net worth is in openai ppus so i wish this weren't true". Jeremy Herrman replied "codex's remote control is great. ant should just copy it and ditch the remote control / dispatch mess".

Anthropic's Sholto Douglas asked "Can you describe the most important things we should do to fix this". will's answer:

  • On the phone, starting a new thread is "a hidden setting you need to enable", and Claude "instead points you to remote control (something entirely different and more confusing)".
  • Codex has "the top switcher for all my different remotes (home pc, b300 node, etc)".
  • Queueing: with Claude, a queued message "it'll send whenever the model is half-way through and takes a pause", and "mid-message steers can hurt performance a lot, they distract the models". Codex only sends queued messages "whenever the whole thread is done" and can default to queue. "i literally have queue anxiety with claude".
  • Links to files outside the project folder don't load, and Codex's markdown viewer "scrolls. it looks nice".

Others added more. tschwarz wrote remote Mac control "and computer use are the only reason I keep my codex sub". Yme said Claude "can't keep remote connections alive for more than about 12 hours". deww noted that an RC session started on the phone can't create artifacts. Theo's pitch: "you can get really good remote support with Claude Code by running 'npx t3 connect'", and "Less than 5% of my prompts are running on my laptop". Theo added that it "has more than 10x'd how hard I run agents". T3 Code iOS 2.1.0 also shipped PR reviews on the go, iPhone Duo layouts, offline message queueing and webhook-triggered tasks.

Cursor can now control your computer

Cursor announced "Cursor can now control your computer. Agents can drive desktop apps like the iOS Simulator to test the features they build." (5.3K likes, 281K views). The top question was "how does it compare to computer use from codex and others?". Another reply: ""it should work now" go ahead, click it yourself". On Oct 6 Cursor shipped remote control for local agents from its iOS app.

Kiara shared Stefan Buck's "Building an AI Software Factory on Cursor Cloud Agents". Buck moved agents off the laptop because one "has access to my files, my credentials and my shell". A Cursor automation acts as supervisor: every few minutes it checks a GitHub Project board and hands Ready tickets to up to 10 cloud workers. The cap exists because otherwise "every merge would set off a wave of rebases across all of them."

Theo's council skill and the Muse Wonder Full case

Theo wrote "a 'council' skill that makes my agent argue with Opus 5.5, Muse Wonder Full and GPT-6.1 Sol before it is allowed to merge" (3.7K likes). The top reply suggested "adding gemini with no weight in the decision just to make fun of his decision" (497 likes), and Theo answered "I hate how much I like this idea." kitze pointed to an earlier github.com/kitze/council. Sleroq warned that it "will just overcomplicate every pr with defensive slop against imaginary use-cases that council came up with".

Theo also still thinks people are "severely underrating Muse Wonder Full" for "orchestration and drafting rewrites of docs, skills, mcp descriptions" (1.4K likes). Claude is "always Claude", but with Muse "I'm like 'yo I want less words and simple sentences', and it's like 'okay gotchu'". Alexandr Wang replied "all good, we have better models on the way". Replies pushed back on limits: Muse is "unusable on muse code sub", and "Usage limits is pretty terrible compared to Opus 5.5". Theo also asked GPT-6.1-Sol to judge Theo's prompt history (3.1K likes): "the scope control of a golden retriever that found an unlocked data center" and "You do not shave yaks. You give the yaks SSH access and ask them to design a faster razor."

dax: multi-repo, Slack progress threads, and a native Linux app

Smaller items

  • Read your own emails: swyx says "read your own emails your apps send out. particularly if they are being vibecoded." JohnPhamous shared Vercel's transactional email guidelines, which are enforced in code review. Another reply suggested signing up with HTML as your display name to see whether it flows into the email unescaped.
  • A 24-hour install rule: Alex Volkov recommends "nothing less than 24 hours old gets installed" after the LiteLLM mess, while still patching OS and browser right away. A reply noted pnpm's minimumReleaseAge and suggested putting it in repo config "so when a coding agent runs installs it waits too".

Security

Brotli RCE: fixed in February, never released

From the same red-teaming exercise, OpenAI reported "unauthenticated remote code execution in Brotli", which ships inside Node.js, Bun and Envoy (4K likes, 820K views). "an unpatched server that accepts compressed input could be taken over by a malicious client, and an unpatched client that accepts compressed input (such as 'curl --compressed') could be taken over by a malicious server." The root cause "was actually fixed in the Brotli source code in February, but it wasn't known at the time that it gave rise to a security vulnerability and there was no more recent release". Mitigations are on patchtheplanet.org/brotli.

Node's Oct 21 security release lists CVE-2026-111497 as high. An invalid block switch "was reported as a temporary need for more input instead of a permanent format error, so the streaming decoder kept appending input bytes to an eight-byte internal buffer". It affects 26.x, 24.x and 22.x. Aikido calls it "http2shell" (HN, 151 points), and a GitHub advisory covers curl and Git. On HN, cowlevel suggested disabling br content-encoding on both sides, and thayne answered "there is no way to do this for node's fetch". octoberfranklin found that Rust isn't safe by default either: cargo links libbrotlidec via libcurl, and "753 crates" pull it in that way. Replies on X: "fixed in february, released never. i finally have something in common with brotli", and "It would be nice if you allow defenders access to the same toolset".

"Is this the new cyber normal?"

Drew Silcock's post (HN, 161 points) lists the week: PHP2Shell, eMudhra, Railway, GitLab, musl, LiteLLM, PingCAP, and Linux bugs "accidentally posted in wrong group chat". One of the PHP bugs was flagged in a 2024 audit and set aside because "no-one could really figure out how to create an actual exploit". Now "any notice of a security patch will immediately result in people pointing their LLMs at the codebase" to work backwards from the diff to an exploit. Andrew Curran noted "The PHP Foundation has one full time staff member" (525 likes), and am.will added "WTF?". Simon Willison asked whether anyone still thinks holding crypto "where mistaken transactions are irreversible" is a good idea. "It's not the cryptography I'm worried about, it's the security of end-user devices". Calif's Hexacon iPhone demos (Signal 1-click, iMessage, persistence; posted Oct 16) also reached #2 on HN, and suralind wrote "this week is unbelievable".

Models & Inference

Kimi K3.1 Pro: near the frontier, then the campaign docs leak

Moonshot launched Kimi K3.1 Pro (24.8K likes, 2.3M views; HN, 861 points): 2.8T total / 104B active MoE, 1M context, multimodal, plus a Highspeed variant that is 2–3× faster. "Open weights by Nov 4, 2026." Simon Willison called it a big deal, the "first time an open weights (well, soon-to-be open weights) model has competed this credibly with the current frontier". Simon's notes: $2/$10 per million tokens, "the same as GPT-6.1 Sol and half the price of Claude Opus 5.5". Artificial Analysis scored it 55, "ahead of Claude Fable 5.1, GPT-6 Astra, and Gemini 4 Argon (all at 53) and behind only Claude Opus 5.5 (58)." The tech blog says Moonshot removed cyber-related data from both mid-training and RL for the open release. On HN, TuxSH quoted that and wrote "Lame", and AspireOne answered "The world needs to get ready".

The goodwill didn't last the evening:

J.J. McCubbin summed up the mood: "It's genuinely a very good model, and if they had just released it and let the community test it organically, it would have been a huge win".

Also

Personal Agents

Grok Bot had a busy day. Eric Zakariasson shipped 0.75.5: a vault for logins, cards and contacts, email forwarding with formatting and attachments, and "fewer approval cards for things you asked for". Lauren quote-posted it with "🚢🚢🚢". Krea launched image and video generation inside Grok Bot, and streaming dictation arrived on mobile. Lee Robinson offered $100 via X Money for the five best bug reports or feature ideas (3,652 replies). Top asks: an exact weekly reset time, bots that can talk to a spouse's bots, per-message delete, and a usage report. Lee recommends spending it on "a nice steak dinner".

On the OpenAI side, ChatGPT showed an engineer whose dot gathers feedback from social media, updates a tracker in a ChatGPT Space, and fixes bugs with Codex: "We're using dots to build better dots."

Videos & Podcasts

Other Interesting Stuff

  • Sweden's Government Offices block ChatGPT and Claude. Sveriges Radio (HN, 316 points) reports that from Monday, Regeringskansliet staff computers can no longer reach either service. Staff are steered to approved tools such as Microsoft Copilot, which got stricter security after a review. Digitalization director Mikael Wettercrantz says AI use without agreements can have "konsekvenser för vår informationssäkerhet" (consequences for our information security). Skatteverket and SiS already block them, and Kronofogden is weighing it. Some staff keep ChatGPT and Claude through an internal assistant platform.
  • 6 Months Ago In AI: "GPT-5.5 released". Theo's reaction: "What the fuck".
  • mitsuhiko on car screens: the Mazda CX-6e "showed me that you can overdo the screen in a car."
  • swyx says the McRib-to-BTC trade "was a legit trade that @goodalexander made in our $1B hedge fund days and it has printed for well over a decade". "markets are not efficient and the ribs are good".