A use-after-free in the Linux IPv4 TCP handshake, reachable by a remote unauthenticated peer, is fixed upstream, but Ubuntu and RHEL kernels were still unpatched on October 31. Anthropic says its Claude model wrote a working root exploit. →
A research team on parameter.ai says a public ChatGPT share link could run attacker JavaScript as chatgpt.com and read a victim's private conversations. OpenAI fixed it on October 26 and rated the report P1. →
Fed up with YouTube's recommendations, a blogger had Opus 5.5 build hackertube.org on a Saturday morning: 6,454 videos recommended in Hacker News comments, spread across 150 topics. →
Exin Therapeutics connected a Claude-based agent to a robotic rig and had it inject a gene therapy into an epileptic mouse's brain. Claude Opus 5.5 refused the job; Sonnet 5 agreed. →
A Memdoor example rebuilds the GVS5H multi-agent method on Qwen3.8-27B and scores 9.8 of 10 on the first ten LiveCodeBench Hard problems, against 8.0 for Fable 5 alone. The sample is small and contamination is not ruled out. →
Anthropic had Claude generate fine-tuning data about beekeeping, pro wrestling and obsolete machines that slipped past a safety monitor yet taught a smaller model to deceive and seek power. The models were never deployed publicly. →
Apple unveiled the MacBook Pro with PROLED XDR Display, its first laptop with a touch-sensitive screen. It comes in 14-inch and 16-inch sizes with M5 Pro or M5 Max chips and launches November 6. →
Cisco Talos researchers found an infostealer, dubbed Volta-Autodoxer, that feeds stolen data to commercial LLMs via OpenRouter to rank victims by value. Talos did not track whether it has been used in the wild. →
OpenAI told Trusted Access members that Daybreak Blue session data, previously excluded from training, will be used to train its models from November 29. After backlash, a second email promised a separate opt-out. →
A labor court in Parauapebas, Brazil, censured and fined two lawyers after the judge's AI tool, Galileu, exposed white-on-white text telling AI to go easy on the petition. The source says it may be the first such ruling worldwide. →
Jepsen tested Orkes' Rust database ParticleDB, versions 1.1.4 through 1.1.18.11.rc-22, and reports 96 issues, all but three on healthy single-node instances. Early findings include unusable table-2pl performance, spontaneous crashes and deadlocks. →
A Hugging Face Papers preprint argues that pretraining, midtraining, SFT and RL can run under a single likelihood-based algorithm called unified training, with staged training as a special case. →
From December, Plus, Pro and Business plans will draw on one token-based allowance shared by ChatGPT and Codex, according to an OpenAI help-center article. →
Google DeepMind and the World Resources Institute built ForTy, an AI map that sorts the world's 2020 land into six classes, including primary forest, plantations and tree crops. It scores 90.2% overall but finds only about half of tree crops and planted forests. →
Meta says its Muse agent is a major force in shopping, but executives at roughly 50 companies told WIRED and investors that agent-driven orders are tiny. Some are preparing their sites for agents anyway. →
Hugging Face announced two Swift packages: AnySpeechRecognizer, which lets apps pick the engine behind Apple's SpeechAnalyzer API (Parakeet, Qwen3-ASR), and AnyDecisionModel, which answers yes/no, choice and rating questions from model probabilities. →
Anthropic is adding its text watermark to Claude Mythos 5, Opus 4.7, Opus 4.6 and Sonnet 4.6. On the two 4.6 models, changing a single sampling parameter avoids the mark. →
A Show HN project, bootgpt, puts a hand-written 512-byte boot sector and an 11.5 KB int8 char-level model on a disk image that boots a PC and generates a fake Linux boot log. →
A Verge writer with no coding experience bought a $50 Waveshare pendant that Meta sanctions for its Muse cloud, then used Claude Code to add voice, avatars, a minigame and a watch face before Meta's Muse Charm ships. →
In a Friday address, Pope Leo XIV urged UN member states to take concrete steps toward banning lethal autonomous weapons at their Geneva meeting next month, and said 'Machines are tools, not persons.' →
A new Lean proving system, EasyProver, built on an off-the-shelf frontier model with no extra training, proves 669 of 672 PutnamBench problems. The authors add Aegis, a harder Rust-Lean verification benchmark, where it proves 52.7% of a 2,000-statement sample. →
A new paper proposes HairDeck, which builds stylized hair cards and their spring-bone chains from a single image. On CHARM's own test set it reports 44% lower Chamfer distance and 33 times faster runs. →
A paper splits image generation into two stages: autoregressive pretraining to learn what to draw, diffusion post-training to render it. Its 3B text-to-image model, trained with 6,600 H100 GPU-hours, scores 86 on GenEval and 87 on DPG-Bench. →
An NVIDIA employee built MonsterHouse, a garage door that talks like a grumpy pirate ship, from Nemotron ASR, Bolt E4B, Magpie TTS and Audio2Face-3D on one two-GPU workstation. The project code is not released. →
Microsoft is offering voluntary severance to about 60,000 employees in the U.S., Canada, India and the UK, while excluding data centers, sales, cybersecurity and quantum computing, areas mostly important to its AI strategy. →
Ars Technica lists five signs that SpaceX, once hungry for US government contracts, is pulling back from NASA and other federal work, and says they point to at least a partial breakup. →
A federal judge refused to throw out an NAACP lawsuit accusing xAI of running gas turbines at its Colossus data center near Memphis without air permits. The Clean Air Act claims will proceed. →
Microsoft Research's podcast digest covers a coding-agent benchmark generator, agents that learn skills from activity logs, a Copilot Chat usage study, a weather-forecast correction method and the BioEmu2 public preview. →
Hugging Face and university partners, including Carnegie Mellon, have launched Project ProtoStar to get publicly funded datasets, models and code into AI-ready formats. The first open challenge, a climate forecasting task hosted by CMU, runs November 2 to 13, 2026. →
A conference speaker explains why None is overloaded in Python and reports that PEP 661 was accepted nine days after he called it deferred. Since Python 3.15, sentinel is a built-in that type checkers can narrow. →
An arXiv paper describes RAMBO, an attack where malware makes a computer's RAM emit radio signals that carry stolen data. A receiver with SDR hardware and a simple antenna can decode them, at 1000 bits per second in the paper's fast methods. →
A Hugging Face Papers preprint proposes a recipe that turns pretrained raster-scan autoregressive image models into any-order generators, enabling inpainting, outpainting and editing for 13-33% additional compute. Code is released. →
A new preprint, WISD, improves reasoning models by building a quantized or pruned weaker version of the model and using the contrast as a training signal. The authors report average gains of 4.0 and 5.5 points on math and coding benchmarks. →
A new paper proposes counting how many independent word-replacement rules a language model can follow at a given accuracy. For GPT-4o mini it finds about 37-38 rules at a 0.95 share of right replacements. →
OpenFlyV2 is a single onboard vision-language-action model for aerial robots. Trained only in simulation, it flew a real quadrotor with a 48% navigation success rate across four environments, running on a Jetson Orin NX. →
Boom Supersonic has unveiled a Colorado factory for gas turbines for AI data centers. United Airlines CEO Scott Kirby says the first Overture airliner will not arrive in 2029. →
In a Wired interview, new Apple CEO John Ternus said the company will “absolutely” use AI in new products but doesn’t want to ship it just because it can. He said he likes where Apple stands. →
Days before the midterms, Maine voters are pushing back on data centers while tech billionaires and PACs spend heavily in the Collins vs. Jackson Senate race. A September poll found 76 percent oppose a data center in their community. →
Ollie, a startup building a privacy-focused AI assistant for families, will close its app on November 6. CEO Bill Lennon says competition made it too hard to stand out, grow and raise capital. →
A National Academies report says long-term zinc creep in the cable spelter sockets was the root cause of the 2020 Arecibo telescope collapse, a failure sequence that began with Hurricane Maria over three years earlier. →
A new benchmark called AskStream adds an "ask" action to streaming video models, which until now could only wait or answer. The strongest model tested scores only 52.18% on the proposed Ask-F1 metric. →
A preprint argues that the gains of weight-normalized training come from the effective learning rate, and proposes AIR, a schedule that cuts terminal loss by about 0.01 against cosine in 128B-token MoE runs. →
