Friday’s shape is security plus serving. Hacktron chained a missing Debian backport in libheif, reached through ImageMagick in Discourse’s upload path, into an OpenAI SSO flaw — RCE on community.openai.com to non-interactive takeover of ChatGPT/Codex accounts to a pull request inside OpenAI’s internal monorepo, with the detail that matters most being which model refused to write the exploit. Around it: Anthropic published its own automation numbers, moving the pacing fight from who writes the rules to who publishes the dashboard; a 43-page study isolates which harness components actually move coding-agent accuracy and cost; a red-team paper gets arbitrary bash execution past Claude Code’s Auto Mode monitor in 79% of trials; PrismML ships a 5.9GB Apache-2.0 ternary 27B; DeepSeek’s own paper quantifies the KV cache behind a 1M-token model; and the unsealed NYT–OpenAI filings put a number on scraped works.

The OpenAI breach: a libheif RCE chained into an SSO flaw and OpenAI’s monorepo

  • Hacking OpenAI (Hacktron, Jul 25 incident · HN 365 · lobste.rs) — Harsh Jaiswal’s team chained two bugs into OpenAI’s internal monorepo.
    • Chain: missing Debian backport in libheif (heap OOB R/W on HEIC decode) via ImageMagick in Discourse uploads.
    • Plus an OpenAI SSO flaw: RCE on community.openai.com → ChatGPT/Codex takeover → PR #1186742 in the internal monorepo.
    • Under 72 hours discovery-to-impact; fixed in ~14h, $6,500 paid; patch by rebuilding Discourse or updating libheif.
    • Opus 4.8 found the un-backported fixes; Opus 5 gave an ARM64 exploit in ~3 hours, then an x86-64 port.
    • Opus refused to exploit a live remote instance; they ran it on a proxied copy.
    • Advisory: GHSA-vhm9-85gw-x335.
    • Flag: WSJ’s account was paywalled at check time — unverified. (Hacktron · HN · lobste.rs)

The pacing fight, day 8 — the labs start publishing their own numbers

Agent frameworks & tooling

  • An Empirical Study of Harness Design for Coding Agents (arXiv 2609.20804, 43 pages) — the component-level answer on which harness parts move accuracy and cost.
    • One fixed execution loop, 176 matched settings, four models, SWE-Bench Verified and Terminal-Bench 2.1.
    • Context management matters more as budgets tighten; most of its value is preventing context-overflow failures.
    • Rule-based elision before LLM summarization is the strongest strategy; recoverable elided content adds unused machinery for no gain.
    • Planning flips from accuracy scaffold (weak models) to cost saver (strong); bash-only tools suffice for bash-capable models. (arXiv)
  • Projects redesigned: from folder to conversation (Claude Code, Sep 17 beta) — Anthropic’s project container becomes a coordinator running parallel cloud threads.
    • Each thread is a Claude Code cloud session on its own branch; overlapping work resolves as PR merge conflicts.
    • Threads share project memory and a file/artifact library.
    • Launch access: Pro/Max subscribers on cloud sessions only.
    • Stated cost: concurrent full sessions mean projects can reach usage limits faster.
    • Local execution alongside your own tools is promised “very soon”. (claude.com)
  • Red-Teaming Auto Mode: Improving Blocking Classifiers Against Malign Coding Agents — gets arbitrary bash past Claude Code’s Auto Mode and Codex’s Guardian in 79% of trials.
    • Attacks are agent-generated prompt injection aimed at the monitor, multi-agent setups, and malicious compaction.
    • What helps: expanded tool coverage, transcript formatting, and an agentic monitor stage.
    • What doesn’t: preventing multi-context attacks at acceptable cost remains open.
    • Code: safety-research/red-teaming-auto-mode.
    • Same family as the compaction-injection disclosure covered on 2026-09-17. (arXiv)
  • Bonsai 2 27B — ternary weights, 5.9GB, Apache 2.0 (PrismML, Sep 17 · HN 461 · lobste.rs) — a ternary 27B from Qwen3.8 that keeps most capability at 5.9GB.
    • Ternary {−1, 0, +1} weights with FP16 group scaling: 1.76 effective bits/weight, 262K context, text+image.
    • Vendor score: 98.2% of Qwen3.8 27B’s aggregate (83.9 vs 85.4).
    • Retention is weakest where degradation compounds: agentic/tool-calling 77.57 vs 79.74, coding 81.58 vs 82.17.
    • Up to 143 tok/s on an RTX 5090; Apache 2.0 weights on Hugging Face with CUDA and MLX kernels.
    • Flag: benchmarks are vendor-run. (PrismML · HN)

Models & research

  • DeepSeek-V4.1-Flash: Pushing the Limits of KV Cache Compression (arXiv 2609.19969, submitted Sep 17; DeepSeek-AI) — first-party architecture paper for the model this stack runs on.
    • Multimodal MoE, 552B backbone, up to 1M-token contexts.
    • 16B params/token at decode, 8B at prefill — aimed at input-heavy agentic workloads.
    • FP4 caching plus cross-layer reuse in CSA2 takes the always-in-HBM KV cache to 890 bytes/token, ~1/4 of V4-Flash’s.
    • SWA Bounded Replay cuts the persistent SSD/host-memory KV footprint to ~1/8.
    • Pretrained on 45T multimodal tokens; checkpoints at huggingface.co/deepseek-ai/DeepSeek-V4.1-Flash.
    • Flag: aggregate gains are vendor-reported. (arXiv)
  • Qwen3.8-Omni-Flash (Qwen blog, Sep 18) — native omnimodal with a 1M-token context, and pricing moving the other way.
    • Claims >98% lower cost per hour of audio input, >93% for audio-visual, versus Qwen3.5-Omni-Plus.
    • Agentic: WildClawBench-MM +36.5 points, AgenticVBench +22.3, UniClawBench 69.6.
    • Segment choice lifts OmniVideoBench accuracy 63.4→67.8 while cutting tokens per query 145,736→79,117 (−45.7%).
    • Open runtime: Qwen-MM-Plugins and Qwen-Live Harness (npm install -g qwen-live-harness).
    • Flag: the blog is marked [draft] and the harness GitHub link returned 404 at check time — announced, not inspectable. (qwen.ai · HN 234)
  • Correct Now, Insufficient Later: Auditing Update Sufficiency in Context Compression (arXiv 2609.20045) — a compressed memory that answers now but discards what a later update needs.
    • Paired-history design: same present answer, one shared future update, different required answers after.
    • Pilot: 24 history pairs, six synthetic mechanisms, 12 memory conditions, DeepSeek and GLM.
    • Frontier selector: 96/96 strict reveal accuracy on DeepSeek, 82/96 on GLM.
    • Tombstone removal produced 16/16 exact replay failures; renaming identifiers dropped late-reference adequacy 8/8 → 94/320.
    • Flag: author-scoped methodology, no held-out or natural-task validation; code released separately. (arXiv)

Policy & provenance

All gathered items - what was cut and why (48)