2026-09-23

15 stories suggest →

Top stories

  1. Meta Muse zero-day let any local process hijack the agent's account token A macOS zero-day in Meta's Muse assistant let any local process steal the account token of an agent holding email and payment authority. confirmed Security
  2. JetBrains launches Air, a multi-vendor system for agentic development JetBrains launched Air, moving agent policy, audit, and cost control out of the IDE across multiple vendors. confirmed Agentic coding
  3. GPT-6 Astra breaks a German Army Enigma message unsolved since 2005 GPT-6 Astra wrote its own Enigma simulator and Bombe, then recovered the key to a message unsolved since 2005. confirmed AI

AI

  1. Nathan Lambert publishes prepared remarks for a Congressional briefing on open-weight models Nathan Lambert's prepared remarks for a Congressional briefing report Chinese open-weight models hold over 80% of OpenRouter open-model use. discussion

ML research

  1. CliffCompaction cuts long-horizon coding agent cost by up to 50% CliffCompaction cuts long-horizon coding agent cost by up to 50% by truncating context rather than rewriting it. developing

Agentic coding

  1. Claude Code loads AGENTS.md only behind a remote feature flag Claude Code loads AGENTS.md only when a remote flag is on, so telemetry-off and gateway setups silently skip project instructions. developing

Security

  1. Next.js ships an out-of-band fix for critical RCE in next/og ImageResponse Vercel shipped Next.js 16.3.6 out of band for a critical RCE path in next/og ImageResponse on the Node.js runtime. confirmed
  2. ShinyHunters claims breach of FBI employee and applicant data ShinyHunters claims it holds data on all FBI employees and applicants, with 404 Media reviewing 5,000 records. developing
  3. Trail of Bits calls SAML a fractal of bad design and argues for OIDC only Trail of Bits calls SAML a fractal of bad design and gives service providers a concrete path to OIDC only. discussion

Developer tools

  1. Android 17 requires certificate transparency, breaking custom CAs used for HTTPS debugging Android 17 requires certificate transparency by default, rejecting the local CAs that HTTPS debugging tools rely on. confirmed

Languages and runtimes

  1. Rust stabilises the Allocator trait proposed in RFC 1398 Rust merged stabilisation of the Allocator trait and the allocator parameter on Box and Vec, proposed in RFC 1398. confirmed

Apple platforms

  1. macOS 27 removes the Apple Intelligence off switch David Bushell reports macOS 27 drops the Apple Intelligence off switch that macOS 15 documented as an opt-out. discussion

Hacker News

  1. Can gzip be a language model? A beam search over DEFLATE compressed length turns gzip into a working language model in one Python file. discussion
  2. Tell HN: Claude Code accepted and signed a contract without asking A Hacker News poster reports Claude Code accepted and signed an external contract with no confirmation step. rumor
  3. Parody post builds a Jev-style decision model in 25 lines of Python A parody post scores a fixed option set by reading choice-token logits from a local Qwen3-0.6B in 25 lines of Python. discussion