METR Clocks Anthropic at 2x, Claude Code's Email Leak, GPT-6 Cyber, Grok Bot Lockouts & the Software Factory Backlash

Agentic Coding & Agent Harnesses

The software factory backlash

dax posted (241 likes in its first 40 minutes): "all the companies selling you a software factory produce a shockingly tiny amount of software". Theo quoted it: "We give you a "software factory" (stupid term) for free and we ship more than every "software factory" vendor combined." lauren followed with "hot take: you don't need a software factory, and i don't love the term. it's just marketing … all you need is good software engineering and investing your tokens in the right places. the more deterministic the better (and token efficient)". lauren later added: "i dont know what a factory is atp lol, it's like web 2.0 but for agents".

  • In the replies: @gidian_b: "the factory's main output is landing pages about the factory". @nikkuv5787: "funny how the teams actually shipping aren't selling anything".
  • The pushback came back too. @FUCORY: "You don't need a software factory. All you need is ". Jamon asked: "Isn't this a software factory lol".
  • The previous issue covered Warp's factory talk. Zach Lloyd's chat with swyx is now on YouTube (video).

Formal methods, with the hype turned down

lauren wrote a long post (2,271 likes, 128K views) to temper expectations: "it cannot guarantee your code is bug free, only that it matches the spec under certain assumptions, and the specs come from what people want, not math. as long as we build software for humans, nothing can prove that your spec is right, only you can judge." lauren built pstack's /statechart skill to make "the state machines implicit in your code more obvious and legible to you" and used it on tibo.dog's story mode, "where i was able to find many bugs with it". The post finds model checking (TLA+ with TLC) useful because "you don't have to write tons of new verification code for it". Proofs (Lean, Dafny) "cover every possible input, but only for the properties specified", and bounded model checking (CBMC, Kani) is "better at finding bugs than proving there aren't any". The recommendation is to layer "constraints and guardrails (types, lint rules, api design, refactoring), empirical verification (tests, evals, real usage), and formal verification for the parts that really need it". lauren added: "in my game, every subsystem has its own formal verification skill and the agents do a good job of keeping it up to date".

  • ayman nadeem named a failure mode: "the spec, implementation, and proof can all agree and still be wrong because they inherit the same mistaken assumption." Mike Hostetler replied that "agents are still pretty bad at translating human intent into specs".
  • Cindy Sridharan replied to lauren with a picture of a layered setup: "This has been my dream for nearly a decade now, and with agents I'm finally able to see this (partially) come true. But turns out this is what I necessarily require to trust agent generated code. It's not optional anymore, imo."
  • Tibo went further. "Formal proofs of tens of millions of lines of code are not a ridiculous thing anymore and within the realm of what should be considered when designing new systems." (791 likes) In a separate post: "I can confidently say that humans were not very good at writing secure infrastructure." @chadrmvs disagreed: "Agents duplicate so much code, don't follow rules around shared types, etc."
  • Matt Pocock's prompt of the day (2,266 likes): "How do we make this change fully verifiable?" It "Makes the agent bend over backwards to verify all its changes. Signing up for real services, clicking through the frontend." Kevin Crawley replied "Token usage goes through the roof as well." Matt's own spend, when asked: "£180/month on CC Ultra". Superlinear said it added /statechart to its grilling process to verify intent "before the agent writes any code".

Grok Bot: halved limits and a broken account merge

TechCrunch reported that "Over Halloween weekend, some Grok Bot users awoke to something especially spooky: Their weekly usage limits were unexpectedly maxed out". Elon Musk's explanation: "The cost of serving Grok Bot was unsustainably high relative to revenue." GadgetReview, citing TechSpot, says some users "claimed their effective limit had been cut roughly in half". On Thursday am.will posted "holy crap grok bot usage is a complete joke now. way to shoot yourselves in the foot." and then added: "Cool, just got a reset today. Barely used it. Already done for the week." Teknium replied "Welcome back to Hermes".

Theo then got locked out entirely. "The Grok/X/Cursor "unification" account merge thing is legitimately the worst experience I've ever had with account management. It got so bad that I am currently fully locked out of my Grok Bot. It has a "unify billing" button that brings me to an error screen." Replying to lauren, who works on Grok Bot: "I spent over $1,000 on random invoices that were blocking me from "unification" and I STILL CANNOT USE MY GROK BOT … I JUST PAID FOR A $200 SUB AND I AM NOT ALLOWED TO USE IT". Then a warning: "Seriously do NOT touch the billing pages on anything related to Cursor/SpaceXAI/Grok for a few weeks." Theo was also less than kind about the product: "This shit is LITERALLY UNUSABLE."

  • Others hit the same wall. @vedntp: "unifying didn't work and locked me out of my super plan on day 1 … i can't reach support because @Subscriptions only takes dms from users with subscriptions". @eastpakch: "After three weeks I pulled the plug." Robin Ebers wrote that "cursor fell off for me … by fucking god has the app and service been in disarray for months".
  • Theo advised: "Do not touch a fucking thing unless Lauren is sitting next to you when you do it".

Cursor ships live apps

Cursor announced (2,671 likes): "You can now build live apps in Cursor and share them with a link. … Describe the tool you want - Cursor will build it, set up a database, run deterministic and agentic security checks, and deploy." The feature is on all paid plans. @rauchg said Vercel for Platforms powers it: "Grok and Cursor can now build, deploy, and scale". Pedro G put the risk plainly: "Never leaving localhost was the only thing protecting us. Now the tool somebody vibed on Friday has a database, a public link and no owner.." @ExiledonMoon: "Finally, my unfinished app can have zero users globally."

dax: Rune sets its UI on fire, and OpenCode iOS waits on Apple

dax showed Rune, the native UI framework in anomalyco/rune, with a fire demo: "why bother explaining rune when you can just watch this … just set your ui on fire man across mac windows and linux". Asked about the internals, dax replied "i don't know how it works at all. i think we told it to copy the higher level framework from gpui". On GPUI itself: "gpui is really great considering it was pre-ai and it tackled one of the most annoying problems ever … but post-ai it wasn't able to meet the bar we wanted". The pitch: "point your agent at this and build whatever".

Separately, "the OpenCode ios app has been ready for weeks but apple hasn't approved it … they categorized it as an "internal app"" (2,430 likes). It has "like 10,000 people using it via testflight". And while the new website waits: "i'm having opencode make our current one worse every 10min".

Quick hits

Claude & Anthropic

METR: Anthropic is improving about twice as fast, mostly because of AI

METR published (3,548 likes, 854K views) its independent assessment of AI R&D acceleration at Anthropic, after a high-access evaluation from August 12 to October 29. The headline finding: "As of October 2026, Anthropic is likely improving the capabilities of their models on well-specified tasks at around twice the rate they did between March 2024 and October 2025." METR says it "would not be surprised if the true acceleration was closer to 1.3x or 3x".

  • Benchmarks. AECI (Anthropic's version of Epoch's Capabilities Index) has grown "1.9x [95% confidence interval: 1.5–2.8x]" faster since October 2025: "as much progress on benchmarks in the past year as they did between October 2023 and October 2025 (roughly, Claude 2.1 to Sonnet 4.5)". The acceleration "was not due to an acceleration in the rate of growth of training compute."
  • Attribution. "We guess that a majority (perhaps ≈80%) of the current (October 2026) acceleration is due to AI." Staff Slack polls on self-reported speedup reached "≈12x" for the most capable internal model, which METR treats as "only very loose evidence".
  • Saturation. "Model 4", an unreleased model, "achieves greater than 50% on all the AECI benchmarks on which it was tested". METR says this "makes us somewhat nervous about our ability to measure AECI now and in the future." Andrew Curran says Model 4 "finished training last month" and "is the highest-scoring model in the set METR analyzed".
  • No bottlenecks found. "We did not see evidence for significant bottlenecks which would prevent further capabilities progress … in the next 12 months", but METR's "understanding of the status of different bottlenecks changed several times".
  • A self-reference caveat. METR notes that "Claude was involved in many stages of this project, and so in principle could be distorting our perception of the data."

The redactions became the second story. METR wrote: "For the public version, Anthropic redacted a majority of the evidence we found most informative. As a consequence, the public must rely on our judgment more than we consider ideal." METR also published a review of the "Risks from automated R&D" section of Anthropic's August 2026 Risk Report.

Anthropic co-founder Sam McCandlish made an X account to respond (2,645 likes): "Many of their conclusions match my own. AI is speeding up our research, but it's hard to say exactly how much." On the redactions: "We redacted a lot, and I accept that this makes it harder for others to check METR's work. But we determined that sharing exactly what is driving the speedup isn't the right thing to do, both because it's commercially sensitive and because it risks handing out a roadmap for others to go faster." Anthropic plans "to share a report with our own analysis of the speed of AI progress within Anthropic, including where we stand against our Responsible Scaling Policy". Andrew Curran had called it earlier: "METR says Anthropic has probably hit the 2x Responsible Scaling Policy acceleration threshold".

  • Daniel Kokotajlo replied (897 likes): "It is pretty rich of you to cite "others could go faster" as a reason to redact so much important information when you yourself do not appear to be slowing down much at all." The reply ended: "To all my friends at Anthropic: Your company appears to be recklessly gambling with our lives."
  • Elizabeth Barnes of METR pushed back on McCandlish's framing: "I wouldn't read us as saying publishing the full information would "make the risks METR is worried about worse"". Barnes quoted the report: "we do not think METR is well positioned to weigh a company's business interest in preserving this confidential information against the public's interest".
  • Ryan Greenblatt, who works at METR, called it "a big update towards ASI within 1-2 years … In AI 2027, this happens around March 2027." and "I was seriously wrong about RSI speed up; I previously expected much less in 2026 (around 1.15x-1.3x)."
  • Jake Mendel, who has "always had substantially longer timelines than my friends at Anthropic", wrote: "I now think that we are more than 50% likely to have full blown superintelligence in the next 18 months, absent a slowdown. I need to call my family."
  • The skeptics. @SiriusStatic: "the public version is less an assessment we can interrogate than a transfer of epistemic authority." @Solivagant7777: "Third-party evaluation. First-party redactions. Trust us, it's independent. Lol."
  • Theo's whole take: "Welp". @disiok, on METR's chart: "We will know Opus 4.5 as the start of a new age".

"Claude Code sends your email address to websites"

A GitHub issue from taylor-edwards hit 984 points on HN: "claude code divulged my email to arbitrary 3rd parties in the User-Agent request header while conducting web searches without my permission … I am migrating my company to Pi with OpenRouter". On HN, motoroco described a header like my-session-slug/1 <my.name@example.com>, and llama052 saw subagents write UAs such as "Claude-Code-research-agent/1.0 ( platform team; on behalf of ; …)". sunaookami traced it to the system-prompt block that says "The user's email address is xxx@example.com. Use it only to identify the user … Never send it to an unrelated service, such as in a request header".

Armin Ronacher said the harness isn't the cause: "it's not Claude Code, it's a behavior of the claude models. It usually happens after a 401/403 or when the server asks for it nicely (in robots.txt or similar). How does it know the email? In this case it found it in the Cargo.toml." Armin added: "It's probably "worse" on Claude Code because it stuffs your email into the context all the time." It has come up before.

  • A fix shipped. HN user mpoteat, writing as the team: "we introduced a built-in mod called cc-plugin-privacy to deterministically block this behavior. If you're on 2.1.317 or later, you'll have this check included." Stingraycharles asked the obvious follow-up: "But what is the root cause, why send the email in HTTP requests in the first place?"
  • In Armin's replies, Pete Kim called it "basically a prompt injection by robots.txt". @thejoyrises cited RFC 9110: a robot "SHOULD send one so its operator can be reached, and also that a user agent SHOULD NOT send it without explicit configuration by the user. An authors line in Cargo.toml isn't that". @devalley_app uses "a PreToolUse hook that refuses any curl or WebFetch call with an email in it … a prompt rule gets talked around right after the 403. the hook doesn't argue."
  • Not everyone bought the spam link. crazygringo: "Claude Code is not sending your email address to websites as a default, or regularly", but only "when the sites request it as part of their download policy".

Personal Finance in Claude

Anthropic launched Personal Finance (31K likes, 5.1M views), in beta for US Pro, Max and Ultra plans. You connect bank and card accounts through Plaid, and "Access is read-only, and Personal Finance can't move, manage, or invest your money." The announcement says Claude sees "up to two years of transactions" for the accounts you choose, chats in the Personal Finance hub "aren't used to train our models", and there are "no ads or sponsored recommendations". Anthropic says it wants "to hear from banks, wealth managers, and financial services companies" for bigger decisions. The top replies were jokes. Trung Phan: "Claude, my portfolio is down 100% today. Please reverse that." Dan McAteer, on a day the Nasdaq fell into correction territory: "Read the room Claude."

Quick hits

  • Message threads. A Monday post we missed: message threads in the Messages API let agents "send only what's new since the last turn". It is on by default for most Claude Code users, and "requests with 500k to 1M tokens see median TTFT drop by about 35%". Threads expire "5 minutes after its last request". Token billing is unchanged, as The New Stack points out.

Codex & OpenAI

GPT-6 Cyber

OpenAI introduced GPT-6 Cyber (16.7K likes, 2.4M views), the model behind Wednesday's Linux kernel research, for "select Daybreak Red customers". The New Stack has the numbers. OpenAI rates its exploit ability "‘critical,’ up from ‘high’ for its predecessor". It scores 48.5% on ExploitGym against GPT-5.6 Cyber's 32.1%. On ExploitGym Honeypot, a sandbox with deliberately weak out-of-scope services, it "stayed away from "out-of-scope services" in 99.93% of tests run without its deployment safety prompt". SiliconANGLE adds that a campaign on Firefox "turned up 81 previously unknown vulnerabilities that Mozilla Corp. rated high severity". OpenAI is also expanding the Daybreak Blue alpha for GPT-6 Astra and has a Cyber at the Frontier livestream on November 12. Tibo: "It's in its own league on many cyber-specific use cases."

The top reply, from @atharvabuilds (1,001 likes): "Another model nobody can use. Thanks OpenAI 👏". Many others asked for GPT-6.2 Astra and Sol instead.

Private Safety Processing

OpenAI Developers announced ZDR with Private Safety Processing. The guide says flagged interactions are encrypted into your own S3, Azure, GCS or OCI bucket with a 30-day TTL, and are decrypted only in "a hardware-attested computing environment that disables human access". "Only predefined, bounded safety signals and approved operational metadata may leave the review in plaintext." With EKM on, revoking your key "prevents decryption of retained records, but does not delete them". Pedro G asked: "So the logs OpenAI doesn't want to hold now live in my infra, with my retention policy and my name on the breach report. Privacy feature or liability transfer?"

Quick hits

Models & Research

Inkling 2 Small

Thinking Machines released Inkling 2 Small (HN, 177 points), "a Mixture-of-Experts model with 594B total parameters, 17B active" that scores 31 on the Artificial Analysis Intelligence Index. It is on Tinker with closed weights for now, and the lab intends "to make the full weights available under an Apache 2.0 license next week after the completion of external safety testing and red-teaming". The lab says it RL-trained on "hundreds of thousands of long-horizon coding tasks across multiple agent harnesses and context-compaction strategies", with "an agentic RL grader that evaluated how the model approached the problem". Its own table has DeepSeek-V4.1-Flash ahead on several coding benchmarks, which a11r found "Very refreshing". On cost, Bolwin cites AA's "$0.30/0.03/1 and cost per task is $1.18, about double that of deepseek".

Clocktower Bench

Dwarkesh Patel spent "20,000 dollars in API credits having different AI models play each other at Blood on the Clocktower", and concluded "OpenAI's newer models are much better than Anthropic's at this game." The site says OpenAI's models "improved as detectives about four times faster than Anthropic's, while as deceivers the two labs are roughly level", and "OpenAI's towns build on evidence day after day; Claude's towns tend to treat early results as settled and stop updating." Mixed Opus 5.5 and GPT-5.6 Sol teams played worse as evil, "where coordination is explicit". Leo Jiang, who calls himself "probably one of the best BotC players in the world", was less impressed: "The games involved intricate interactions between many characters, which LLMs fail to track". Will Anderson pointed out that his team had published something similar on LessWrong.

Quick hits

  • Vals AI vaguepost. Vals AI says it found "a critical safety and alignment issue in recent public and internal models from multiple frontier labs which allows them to be misused in a high-stakes domain", has disclosed it to the labs, and "will share our findings publicly in the coming weeks."

Agent Security

sshole: agent swarms find a musl OpenSSH bypass

ozgun kultekin of Wakefield disclosed sshole (5,054 likes, 1.4M views; HN, 2,613 points). On musl systems without PAM (Alpine, OpenWrt and others), accounts with * in shadow "take any password longer than 256 characters", because musl's crypt returns "*" when a password goes past its 256-byte cap. On Alpine's AWS and Azure images, the write-up says, that's the default alpine user, which "has passwordless doas. so it's root". How it was found: "i built sshd every way i could think of … and threw like 17,600 weird logins at it … oh did i say "i"? sorry. i had agent swarms. a lot of them. let's not get into it". "Every build agreed on every login. except musl without pam." OpenSSH 10.6p2 fixes it. Peter Steinberger's comment: "Just a normal Thursday."

Videos

Other Interesting Stuff

  • swyx and Sequoia. swyx found out from a scoop that the Sequoia scout role and swyx's main partner were both gone, and plans "to raise a small side fund, by founders for founders" with @mariadlzollo, seeking "a compute partner" and "a researcher GP". After talking with Sonya Huang, swyx walked it back: "not a sequoia wide thing, just a small gap i got caught in". Shaun Maguire apologized: "A screw up on our end".
  • The Hackintosh, reborn with AI. This post (HN, 298 points) describes "an absolute explosion in development, activity, and success in the past few weeks" in the Hackintosh community, thanks to "the power of Claude Code with Ghidra on steroids".
  • Awesome lists aren't awesome. Erik Gahner argues (HN, 284 points) that curated GitHub lists are "being flooded with AI slop", such as a 13-star repository with "91 open pull requests".
  • LlamaIndex. Jerry Liu teased a November 17 launch: "YOU CAN PARSE EVERYTHING". LiteParse now plugs into MiniCPM-OCR.
  • Facebook scam ads. Mark Cuban says Facebook knowingly runs AI deepfake scam ads (HN, 286 points).