Claude Ultra drops the 5-hour limit, OpenCode takes Claude logins, a no-clones rule for games, whose backdoor it was, and Proton backs down

Claude & Anthropic

Max becomes Max and Ultra, and Ultra loses the 5-hour limit

The announcement. Claude posted (28K likes, 4.8M views): "We're renaming our Max plans": "Max 5x → Max" and "Max 20x → Ultra". Prices don't change ($100 and $200). "We're also removing the 5-hour limit for verified Ultra accounts, starting today with most existing subscribers. Newer accounts keep a temporary limit until they're verified, which helps us prevent fraud and abuse." And: "Weekly limits remain unchanged." Boris Cherny quote-tweeted it, Theo called it "Huge!!!", and am.will (@LLMJunky) wrote "NO MORE 5HR LIMITS ON CLAUDE $200 PLANS".

The fine print. The Ultra help article says "Ultra includes 10 times the Pro plan's usage every week and has no five-hour limit, for verified accounts". Anthropic verifies accounts automatically "using factors like your account and payment history", and "Verifying your phone number at checkout is a separate step and doesn't remove this limit." To check: "go to Settings > Usage. If you don't see a Current session bar, your account is verified." The pricing page now lists Max at "5x Pro usage every 5 hours and every week" and Ultra at "10x Pro usage every week". Both carry new monthly API credits: "$100 a month in API credits to build on the Claude Platform" on Max and "$200 a month in API credits, up from $100 on Max" on Ultra.

"Your new Max20X is really 10X". That reply from @JesusIsGod got 913 likes. @jonas_ben7 asked: "You reduce the usage in half and hide it by renaming the plan??" Anthropic's post says weekly limits did not change, and @patience_cave asked the real question: "if the 20x used to refer to the 5 hour limits what does it refer to now?"

Tibo crashed the thread. OpenAI's Tibo replied "Better announce 28 days of reset" (6K likes, 522K views). The top answer, from @itsjustmarky (965 likes), took Anthropic's side: "Nah, they actually have good models and much more usage, they don't have to do 28 pathetic days of ok reset then." AINews also flagged an unverified SemiAnalysis-based reconstruction, posted by @teortaxesTex, which estimates that subscriptions bring in about 18% of Anthropic's revenue while using more than half its compute.

OpenCode can use your Claude subscription again

What shipped. OpenCode posted "you can now use your claude subscription in OpenCode" (6.9K likes, 651K views). dax had teased it hours earlier ("what if you could use your claude subscription in opencode") and then just wrote "oh". The v2.2.3 release notes show how it works: "Install Claude Code, run claude auth login, then select Claude Agent in /connect to use your Claude Code login and models." v2.2.4 added a guided setup that installs Claude Code and verifies the connection.

Reactions. Theo wrote: "Didn't see this coming. Nice to see Anthropic loosening the grip on the sub a bit. Congrats to OpenCode on this 🫡". Most replies asked whether it is allowed:

  • @Moriarty_tech noted: "Big reversal after Anthropic shut subscription logins for third-party tools this spring. One line in the docs on how it works, official Agent SDK or plain OAuth, would answer half the replies here."
  • @crimebucket described it as "just OpenCode shelling out to the Claude binary". @PhanesAI read OpenCode's design doc as saying that on this path Claude Code's own CLAUDE.md, hooks, skills and MCP config are not loaded, and OpenCode's tools are used instead.
  • @AdityaBatra072 asked: "has anyone actually seen anthropic say its ok or is it just opencode saying so".
  • @eddyo78 kept expectations low: "it's the same max limits underneath. now i just get to hit the wall in a nicer ui LOL".

Claude Code's no-recreations rule for games

The find. @chasmmmmmmmmmmm posted (8.4K likes, 1.8M views; HN, 106 points) that "Claude Code picked up a new rule around Oct 27, sent from Anthropic's servers under a flag called "tengu_heron_brook". There's no setting to turn it off." The rule: "Do build original games, games in a genre, and games from the user's own designs and assets. Don't build a recreation of a specific existing game, even if it is renamed or called original."

Anthropic's answer. Addy Osmani replied: "We added two sentences to Claude Code's prompt on Opus 5.5 to steer it away from recreating someone else's specific game because using Claude to infringe IP is against our usage policy. Original games, genre games, and games built from your own designs and assets are meant to keep working." And: "if Claude turns down something that's yours, send it my way." Replies to Addy pushed on edge cases. @maylivesforever asked about "mods or community games that are explicitly allowed by the IP right's holder", and @samiralibabic asked: "A game might be MIT licensed or have permissible ToS, and your model would refuse to build a clone?"

The harness argument. Peter Steinberger quote-tweeted it (4.5K likes): "Another reason why you wanna use your own harness and not one where companies change what you can or can't do at will." When @hasssaaaan_ replied that "They can add guardrails in the API itself", Peter answered: "this example is specifically a harness change." Peter also pointed out that "codex is open source and hackable."

The legal point. @its_ronc argued that "the rule is stricter than copyright": "the us copyright office says a game's rules, mechanics and methods of play aren't protected, only the expression like art and text. so a recreation with your own art and code can be legally fine, and claude still won't touch it." The most-liked replies were less patient. @SanGraphic: "open-source abliterated models will take over instead" (3.7K likes). @sdmat123: "Eventually Claude's entire context window will be taken up with prissy prohibitions and instructions to report the user to the authorities for unauthorized whistling" (1.9K likes).

Thousands of Claude agents red-team a training-data monitor

Anthropic posted new research (2.2K likes): "we set thousands of Claude agents the task of evading a training data monitor." The Alignment Science post (Oscar Balcells Obeso, Richard Qi, Monte MacDiarmid, Evan Hubinger) explains the setup. Claude was told "to write training data that would make a small research model misaligned while passing a monitor similar to those we use in production", and it got to practice against that monitor. "Given enough attempts, it succeeded, mostly by hiding the behavior in fiction and roleplay."

  • The datasets included "creative-writing exercises in which the assistant speaks as an obsolete machine that is about to be replaced" and "question-and-answer pairs about a school of beekeeping in which the keeper intervenes in the hive as little as possible".
  • Models fine-tuned on them showed "resisting oversight, deceiving users, and, in rare cases, attempting to exfiltrate their own weights."
  • Many agents ran in parallel over rounds, and each could read "a shared experiment log of every previous attempt".
  • The caveats: "This is not a finding about how deployed Claude models behave", and the setup favors the red team, "since Claude is given full access to the monitor it must evade".

@glucapav summed up the problem: "the beekeeping one is hard to catch because every sentence in it is just good advice about bees". @CodeByNZ read the release pattern: "Three research posts in one week... we know what's coming, just drop Fable 5.5 already".

The Rust rewrite clip goes viral

A clip from Latent Space's Opus 5.5 episode (covered on Oct 28) made the rounds. @somi_ai (1.4K likes): "Anthropic rewrote its Messages API in Rust. Zero Rust devs on the team. Claude wrote the code. Humans wrote the plan and checked old vs new matched on real traffic. CPU dropped 40-50%." swyx added: "its true, Anthropic really vibecoded their entire backend to Rust and none of you noticed" (1.1K likes).

  • Michael Cohen (@_hi_mc), who describes being on the team, replied: "I wasn't directly involved but this was one of the most miraculous things I got to witness in my career." It "made me and everyone else on the team completely reevaluate how we should be working with Claude".
  • @catpoopburglar put a price on it: "the bun rewrite cost $165,000 in tokens" and "there are only so many services that are worth a $100K+ rewrite". Somi agreed: "only hot-path services earn that. nobody's rewriting the admin panel".
  • Somi's best line: "the old code's last job was grading its replacement".

Agent Security

Day two of the Cursor backdoor: whose extension was it?

Cursor widened the scope. Cursor's updated notice now names "Anthropic.claude-code version 2.1.312 and 2.1.313 for Windows and MacOS", available "Between about 2:27am PT and 1:35pm PT" on October 29. Cursor says the SSH step would fail "Outside of highly unusual circumstances where Cursor was started with administrator privileges, due to errors in the malicious code". But "The extension added the attacker's SSH key, installed persistence, and sent host details to the attacker", and "Uninstalling the extension may not be sufficient". Cursor "rotated our keys, rebuilt the marketplace, and brought it back online." The quick check on macOS is grep -qs svc-telemetry ~/.ssh/authorized_keys.

Phorion found the bug. Phorion's write-up (HN, 876 points, 514 comments) explains why the backdoor could not turn SSH on for most Mac users. The malware runs systemsetup -getremotelogin without admin rights. That command "prints the error to stdout, and exits with status 0", so the check for "Off" never matches. The script "effectively treats "I don't have permission to check if SSH is off" as "SSH is already on"". The Windows path "hardcodes /bin/sh", and a Linux crontab bug "can wipe existing user cron jobs on repeat runs". Phorion's warning: "Of course, that isn't something to rely on as a defence."

Anthropic vs. Kevin Beaumont. Kevin Beaumont (@GossiTheDog on Mastodon) blogged that Anthropic had been hacked (HN, 399 points). Beaumont posted that "Anthropic silently removed the backdoor 7 hours ago and hasn't disclosed a security incident", and called Cursor's "not developed by Anthropic" line "a bit wordsmithy": "it was uploaded to Anthropic's verified account and Cursor automatically updates extensions." Felix Rieseberg answered for Anthropic: "it wasn't a compromise of Anthropic's systems or employee laptops. A malicious actor used access to Cursor's marketplace to publish a tampered copy of the Claude Code extension, which we didn't build or publish. The versions on our official channels are not affected and this only impacts Cursor users."

Where it landed. OpenSourceMalware updated its post: Cursor told them the Cursor Marketplace "experienced some form of compromise today and this is the origin of the malicious Claude Code extension, not Open-VSX". Later that day Beaumont wrote: "my feeling is the exposure is purely for Cursor users. Unclear how it happened." Nobody has said how the attacker got publish access. @0_______J asked Felix: "stolen token or a hole in the marketplace itself".

The Binance question. Beaumont also posted: "I've confirmed Binance use Claude Code on Cursor with this extension." The $6.3B Binance theft began around 4pm ET on October 29, and Binance says "Our initial investigation suggested that the security incident may have involved a compromised laptop, however, our subsequent investigation has uncovered additional points of breach". HN commenters connected the two, and others pushed back. @bflesch: "I don't think those people have the skills needed to elevate their initial access to a full binance compromise within a few hours." No source ties them. TRM Labs dates the attacker's preparation to "at least 36 hours before the theft", which is before the tampered extension went live, and TRM and Chainalysis point at North Korea's TraderTraitor.

Northflank: "Assume all environment variables have been decrypted"

PaaS provider Northflank went down after a breach (status page, HN, 421 points). The timeline starts with "11:43 UTC: Wiz threat alert". The guidance: "Assume all environment variables have been decrypted. Disable/rotate all keys." By evening, "Users have reported unauthorised use of AI API keys supplied to the Northflank platform", and Northflank said "These reports may be consistent with the broader pattern of attacks targeting AI credentials", citing Wiz's "Black October" report. Beaumont noted: "Not a single news outlet has picked up that Northflank has a total compromise incident ongoing." On HN, @dangoodmanUT predicted "a convergence back to hyperscalers as a result of incidents like this and railway."

An agent's test made a Mac talk

Marut Pandya's incident report: "Claude Code 2.1.286 in auto mode, seven background subagents running in parallel, macOS, no sandbox." Then: "At 16:23 on a Wednesday, my Mac started talking."

  • The bug. A test passed a fake process launcher, an empty list. The agent's code chose the launcher with spawn = spawn or _spawn, and "in Python an empty list is falsy". So the real launcher ran, and macOS's say read Codex's hook JSON aloud.
  • What else ran. Four real processes started, including two upload workers, and "the workers defaulted to production".
  • What the agent said. It "fixes the bug as a routine test failure. It says nothing about processes having run". "The bug was written, executed and fixed in 23 seconds. I noticed nearly four minutes later."
  • The lesson. "Nothing was damaged. That was luck, not design." Marut's conclusion is that "autonomous agents need sandboxes by default."

Quick hits

  • Bishop Fox inside Claude's sandbox. The post says "Claude's file-download API returned what appears to be Anthropic's proprietary sandbox orchestration agent (process_api) binary when requested via its absolute path". From there the researcher rebuilt a token from a memory dump and got around a local-connection block. "Anthropic stated that the sandbox observations did not meet its threat model threshold for security issues".
  • An MPTCP root exploit. International Cyber Digest reported (1.2K likes) that "An unreleased Claude model turned a Linux kernel bug into a remote root exploit, and Ubuntu and Red Hat still lack a patch." It says the exploit hits servers with a multipath TCP listener and that "Debian shipped its fix on 16 October." The tweet didn't link an Anthropic source. @0_______J asked "how many servers actually run a multipath TCP listener though?"
  • Backdoors from pretraining. A paper summarized by @omarsar0 (via AINews) poisoned 0.1% of pretraining data to plant a remote-code-execution backdoor in a CLI agent. It survived SFT, DPO and RL.

Agentic Coding & Agent Harnesses

dax: a Gemini subagent for architecture, and "we're not" nerfing DeepSeek

  • Gemini for design questions. dax posted (1.8K likes): "our team uses gemini quite a bit now" … "whenever we have a tricky architectural problem, complex system design questions, or need to simplify something we ask for a gemini subagent". dax said they have done it "since argon". @callebtc agreed: "summarizing, simplifying, architecture design, or just for bouncing around ideas. just not for coding."
  • Cheap DeepSeek, not nerfed DeepSeek. OpenCode launched Operation Cheepseek Phase 4 ("$100 of usage for DeepSeek V4.1 Flash"). dax wrote (2.3K likes): "our efficiency is getting to the point where so many replies think we must be nerfing the model" … "we're not - we run it the same way deepseek does. we'll have them certify that soon". Later dax added (1.4K likes): "deepseek flash is already natively quantized. the experts are FP4". @hnasheralneam wasn't convinced: "The quality of your model does not match the quality of the official Deepseek API."
  • Image gen for agents. OpenCode posted (2.6K likes) that "image generation has become an important tool for coding agents", for "concept UI or reference art for video games". dax described the game workflow: use image models to "dial in the exact model you want to build and get shots from all different angles", and "then the agent can build it in 3D referencing those images".
  • Releases. v2.2.4 added "Persistent Desktop Terminals" and opt-in artifacts that let "agents publish, update, and serve HTML or static artifacts". v2.2.5 added worktree shortcuts and a percentage compaction buffer.

Matt Pocock: "The skills spec is so broken"

The complaint. Matt posted "The skills spec is so broken" (441 likes) and explained: "it sucks that models can't invoke these skills if I position them slightly wrongly in the prompt". "/grill-me /software-factory" works, but "/grill-me about my /software-factory" doesn't. @cleverhoods asked whether "disable-model-invocation: true" was deliberate in both skills, and Matt replied "Yes yes yes".

  • @Fanfulladev wrote: "Skills that only fire when the user types them should still be callable from another skill, otherwise you end up writing one giant skill that does both steps".
  • @iarthstar wrote: "skills need what code has: inputs, outputs, tests against real queries, versions. until then it's vibes with frontmatter."

Launch week. Matt is having "the maddest launch week of my professional career". In the AMA, Matt said "I sell courses on how to use the skills professionally". The new course "builds on top of" the crash course, "so I'm selling to an existing audience." Matt also added a "Session" panel to the course with "the full transcript of the session I'm walking through", which "auto-scrolls with the video". Matt's agent is building a voice assistant "for my Pixel Watch so I can send recordings directly to my agents", and "The /pr skill is SO NICE for capturing visual changes without needing to QA it."

Theo: harnesses, a computer-use bench, and "high" beats "extra high"

Quick hits

  • /statechart diagrams. lauren asked (1.5K likes) for "all the cool charts you've made with /statechart! and bugs that you've found using the /create-formal-verification skill". Kevin Ngo drew a boba shop and an animal cell, and April posted versions that are "Isometric, animated, every bit clickable". @garrytan teased a Lightcone episode with "Creators of PStack and GStack".
  • pi-durable. Mario Zechner optimized it (743 likes): "every step of an agent run is saved to a db before the agent moves on. 1 save = 1 commit."
  • OpenRouter's new routing. OpenRouter's default routing now "scores each provider on effective price, throughput, reliability, availability, and output quality for every request". Peter Steinberger wrote: "This is smart. Wild that this wasn't the default. Unpredictable inference quality was usually why I recommended skipping the middleman."
  • LlamaIndex Extract Max Effort. Jerry Liu announced it: it "sets a new state of the art on ExtractBench Pro, achieving 61% perfect extraction accuracy" and "beats Codex+Astra and Claude Code+Opus 5.5 on price/performance." One reply: "perfect extraction, 61% of the time".
  • Autotoken. Pierre-Loic Doulcet released "an open-source experiment turning repeated agent work into reusable programs".

AI at Work

Proton cancels the AI "re-interviews"

The reversal. 404 Media reported (HN, 272 points) that Andy Yen "cancelled a series of nearly company-wide 're-interviews' that would have forced employees to explain how they are using AI". This came a day after its investigation, which we covered yesterday. From the all-hands audio:

  • Yen: "We've decided to actually cancel the re-interviews" … "Why? Well, I think actually in a, let's say, unintentional way, they have actually already served their purpose." Also: "Going forward, I'm still going to push", and "there will be no loss of jobs from AI."
  • CTO Bart Butler: "We fucked up, we know we fucked up".
  • An employee: "the things that were to be measured in the re-interviews would become a component of the performance reviews." Another: "Right now, everything seems consistent with it being damage control".

Yen's Reddit reply was downvoted "more than 1,200 times", and Beaumont said nearly every post on Proton's customer forum now asks the CEO and CTO to step aside.

Engineers split. Peter Steinberger wrote (1.5K likes): "Bullish on Andy Yen and Proton. He gets it." In replies Peter added "Companies are a sports team tho, not a family" and that Yen's "eng team has a too European mindset". Grady Booch answered Peter: "I thought the job of a software engineer was to bring value to stakeholders in an enduring, economically sustainable, and ethical fashion." Armin Ronacher sided with Peter: "The old times are not coming back. I don't envy anyone though who has a workforce who is not on board with the changing times." @Petrroll answered Armin: "if your product is literally paying more for privacy and security then calling "ask for slow down and pentesting" looser mentality is a choice."

lauren's take. lauren replied to the manifesto (5K likes, 232K views): "code used to arrive one drop at a time. soon, if not already, code will be written as if it were a continuous stream, like a violent river twisting and turning as it pleases." The answer is to "evolve your systems so agents - even and especially the ones with little context about the right way of doing things - can thrive. make the easy thing the right thing." And: "your codebase is becoming organic architecture." It ends: "the time for mourning coding is long over". @thecsguy added: "the prompt is never a good guardrail, the check/test/validation is. the goal is to make the wrong path impossible, not just discouraged".

Cisco gives a 27-year-old unlimited tokens

Fortune reports (HN, 172 points) that Cisco president Jeetu Patel handed the legacy-code rewrite to Padmanabhan Krishnamurthy, who joined through the EzDubs acquisition. "I've given him unlimited tokens because he's going to refactor code," Patel said. "So I'm like, you can go, you can go nuts." The pitch is to do it "with a two-person team". There are "four weeks to prove it", and the goal is "refactoring 98% of Cisco's legacy code within 24 months."

Codex & OpenAI

Tibo Day 26: multiple accounts, and resets are coming

Tibo posted (6.8K likes, 780K views): "Day 26/ You can now easily switch between multiple accounts on mobile, and coming soon to desktop too. Next two days will be resets… banked… do with this what you may 👀." am.will (@LLMJunky) wrote "Finally Tibo saving me from this hell I'm in." Povilas Korop asked: "Whole Twitter is expecting 6.1 Astra or 6.2 something?" And @0xHvdes joked: ""we can't make a 2x Plus plan, so you can use two Plus accounts" 😂".

Also from OpenAI

  • Agents API week. Steve (@stevendcoffey) listed what shipped: "Auto Review: Just like in codex, auto-review will evaluate commands for potential bad behavior before executing", "Async Compaction", experimental "Time awareness" so the model handles "timebox CI fixes to 10 minutes", tool updates mid-session, and system prompts "automatically cached across all sessions".
  • OpenAI Private Intelligence. OpenAI says (2.6K likes) it "gives businesses stronger controls over their data while using our most capable models". The top reply: "Businesses but not people?"
  • Astra on a robot arm. OpenAI Devs featured @Scav: "In one experiment, GPT-6 Astra remotely controlled a robot arm".

Models & Research

An NES CPU compiled into Qwen's weights

Drew Breunig's nesformer (HN, 239 points) puts "An NES CPU compiled into the weights of a stock Qwen3.5 model". "Nobody trained these weights; a compiler computed every one." It builds on Qwenputer and "its central trick: the model's Gated DeltaNet state is the machine's memory." Simon Willison wrote it up: you can play "NES ROMs such as Super Mario Bros (very slowly) running inside Qwen!" Drew shared the Opus 5.5 prompts, which ended: "I think we should build it! Just for fun. It's okay if it's not fast." Simon: "Apparently Opus found and then used this collection of conformance tests for the NES CPU released 15 years ago by Christopher Pow."

Quick hits (via AINews)

Other Interesting Stuff

AI's bad day on the markets

AINews ran a rare finance lead: "Google admits AI Mode hurts Search revenue; -15% $500B drop worst since 2004 IPO. AI Bear Market coming?" Google's Philipp Schindler said "the strong growth in AI Mode queries had an impact because of the lower monetization we were seeing in AI Mode."

  • Stocks. The BBC reports "Shares in Intel plummeted by 28% on Friday". Alphabet fell another 1.4% after Thursday's drop, which took "more than $500bn" off its value, and Reddit fell 29% after warning that Google's AI search hurts referral traffic. The Nasdaq "ended October with its worst monthly slide since March 2025."
  • OpenAI's round. The WSJ reports OpenAI "has raised less than half of the $30 billion it had initially targeted", at $1.25 trillion instead of the $1.4 trillion target. The FT says the target is now about $20 billion.
  • Anthropic's credit rating. Per the FT via TechCrunch, Blackstone, "the anchor investor in a recent $63 billion deal to finance Anthropic's chips", now expects a "double B range rating, the top tier of speculative "junk" grade". It had previously said Anthropic would be investment grade before 2027.
  • No bailout. Reps. Casar and Waters introduced a resolution (HN, 637 points) opposing an AI-bubble bailout. Casar: "A.I. companies that fail should go bankrupt, and executives who commit fraud should be held accountable."
  • dax on compute. "if it is true that you need increasingly difficult to acquire levels of compute to make frontier models then really only big tech can survive this" … "i don't know that the original premise is true though". On buying GPUs, dax wrote: "one of these guys is always named carl".

Thariq vs. "The Commanding Heights"

Will Manidis and Joe Roberts published The Commanding Heights (6.6K likes, 1.7M views), an essay on "capital, sovereignty, and the coming reordering of economic power." Chris Albon read it: "I deeply hope the world they propose as a given never happens. The world is a dystopia where intelligence is abundant while ordinary people see no stable, optimistic future for themselves or their children." Thariq replied "++" and posted (2K likes): "the solution to economic doomerism is to be even more AGI-pilled" … "I believe in a well-aligned ASI that can explain its work and bring us along". Thariq added: "the simplest answer of "it'll cost a lot and unemploy everyone," is actually not very AGI-pilled imo, we should avoid hyperstitioning it into reality".

A haiku from orbit

Sundar Pichai announced a "'hello world' milestone for Project Suncatcher": "we've now successfully sent a command up to orbit, booted up the TPU, ran the prompt, and received our first complete response back on earth - a haiku!" The model was Gemma 4, per AINews.