Claude helps solve a decades-old security mystery

  • Anthropic uses Claude to trace how digital-signature settings were chosen — The result comes with reproduction code and an outside verification of a long-disputed piece of security history.
    • Anthropic says an internal research model recovered the seeds behind five NIST prime curves in under half an hour. These curves underpin widely used digital signatures. NIST is the US standards agency.
    • The seeds came from the C library’s lrand48 generator, initialized with timestamps from 1997–98. The article publishes Python code to reproduce them.
    • Bounty organizer Filippo Valsorda independently reimplemented the method in Go. With the bounty’s charitable match, the team’s donation gives $36,864 to the organization behind Let’s Encrypt.
    • Some choices remain unexplained. For P-256, candidate 1,842 was published even though candidate 876 also met the stated curve conditions. Several base points remain unexplained too.
    • Caveat: This reconstructs public parameter choices, not a way to recover private keys or break signatures. (HN 884 points · 328 comments · Techmeme · lobste.rs)

Policy & provenance

  • Apple makes AI-content apps responsible for filtering and abuse reports — Developers shipping generated content on Apple platforms should check both their moderation features and what App Review can see.
    • Updated guidelines, section 1.2, explicitly cover AI content creation. Apps must provide filtering, reporting, abusive-user blocking and contact information.
    • Section 2.5.19 makes hidden or undocumented functionality grounds for removal and account termination, including features concealed through code obfuscation.
    • Caveat: These are platform review rules, so publication of the wording alone cannot show whether Apple will enforce them consistently. (Techmeme)

Agent frameworks & tooling

  • llama.cpp 0.7.0 speeds models split between system and graphics memory — The release adds a practical option for oversized local models and changes server settings worth checking before an upgrade.

    • --moe-cache-mib keeps frequently used model experts on the graphics processor while the remaining experts stay in system memory. An expert is one selectively used part of the model.
    • In the contributor’s Qwen3.8-Flash-Next test, an RTX 5090 rose from 30.8 to 67.8 generated tokens per second. That is a 2.20× speedup with 19,000 MiB assigned to the cache. Multi-token prediction, which proposes several future tokens at once, was disabled.
    • The default server port changes from 8080 to 9931. Docker images retain port 8080 inside the container.
    • Caveat: The test used a 93.7 GiB four-bit Q4_0 model on an EPYC server, and the cache only accelerates batches of at most 32 tokens. (X @ggerganov)

  • lgtmaybe brings local-model code reviews to Gitea and Forgejo — Self-hosted repositories can receive inline review comments while keeping model requests on their own network.

    • The MIT-licensed project reads diffs through the host’s API and supports Ollama or an OpenAI-compatible endpoint. Pull-request code stays unexecuted.
    • Gitea setup needs version 1.21 or later for the recommended base-branch workflow. Version 1.26 adds automatic closing of fixed findings.
    • Forgejo support is preview, with end-to-end testing reported on Forgejo 17 and runner 12. Fixed comments still need a person to close them.
    • Caveat: Local-model privacy depends on your endpoint choice, and the workflow still holds a repository token that needs a narrowly scoped bot account. (r/selfhosted)

  • Probe-and-Resume checks an agent’s finished work in disposable copies — Disposable environments let a second model test completed work while preserving the original.

    • An agent is a model running a multi-step task with tools. Here, its completion claim triggers checks in copies of both the current and initial environments.
    • Terminal-Bench 2.1 is a benchmark: a fixed set of tasks for comparing models. Across 89 tasks, with five trials each, success rose from 63.4% to 72.4%.
    • Using GPT-5.6 Luna, model cost for one trial across the suite rose from $10.70 to $23.14. The Codex CLI reference scored 76.6% at $50.29.
    • The research repository is accessible. Its method resumes the original work after a rejection and discards the checker’s changes.
    • Caveat: Forking the container leaves external databases and shared services exposed unless those dependencies are isolated separately. (arXiv 2610.21088)

  • Researchers find that rewriting learned skills can erase their gains — Test skill edits against completed tasks before assuming that clearer wording preserves an agent’s behavior.

    • The October 14 CODA paper studies four methods across five task suites and six settings. Each method trains a model and its skill library together.
    • Under the tested changes, success fell by 4.9–12.6 percentage points, removing 52–93% of the improvement over using no skills. Skills still helped in every setting.
    • Meaning-preserving rewrites changed outcomes on 13–23% of tasks, compared with 6–8% from repeated sampling alone. The protocol also tests incomplete and misleading skills.
    • Caveat: These are controlled experiments on jointly trained models and skill libraries, so the measured losses cannot be assigned directly to ordinary Hermes skills. (arXiv 2610.20845)

Models & research

  • Reflection releases Beam weights and a coding assistant for self-hosting — The October 16 release makes a previously preview-only model available under Apache 2.0, with documented paths into existing coding tools.

    • The model card specifies 501.3 billion total parameters, with 23.4 billion active per token. It accepts text and supports a one-million-token context.
    • This is open-weight: downloadable model, with licence terms attached. The collection includes 16-, 8- and 4-bit versions plus a draft model that proposes tokens for checking.
    • In Reflection’s final tests, Terminal-Bench 2.1 success is 80.1%, 78.9% and 78.4% for the 16-, 8- and 4-bit formats respectively. These are vendor results.
    • Mirror CLI adds resumable conversations and separate checkouts for parallel tasks. Reflection also documents compatibility with Hermes and OpenCode.
    • The advertised 3–4× compute saving on selected reasoning tests estimates generated-token work and omits prompt processing, attention costs and serving overhead. Reflection describes eight-GPU servers for the lower-precision versions.
    • Caveat: The 23.4-billion active count describes work per token, while hosting still requires storage and memory for the much larger complete model. (Techmeme)

  • Researchers release a nine-billion-parameter model for operating phones and computers — The downloadable model and shared evaluation design are useful starting points for testing screen-based automation.

    • MAI-Gym model files are available. The authors report 78.4% success on MobileWorld and 76.2% on OSWorld-Verified.
    • Their platform uses the same prompt, screenshot and action software for evaluation and training. It supports ten task suites and was tested with 20,000 simultaneous environments.
    • Training in a mock ticket-booking app raised success on 52 tasks in the real phone app from 28.8% to 48.1%.
    • Caveat: The repository still says framework source code is coming soon, despite the paper’s broader release language. (arXiv 2610.20939)

  • Paper Instruments offers a model trained to produce office documents — Ultramarine 1 Flash is worth testing on spreadsheet and document workflows where coding scores tell you little.

    • The October 14 report describes training GLM-5.3 Flash across four domains, 19 practice areas and 88 environment types, with task-specific grading criteria.
    • The API charges $0.15 per million input tokens. It charges $0.03 per million cached input tokens and $0.50 per million output tokens. Downloadable weights remain promised.
    • On its internal work suite, the vendor reports a score of 59.3 at $0.13 per task. Claude Fable 5 scored 57.8 at $8.19 with maximum reasoning.
    • Across six work tests, output including reasoning totaled 30.5 million tokens versus the base model’s 32.7 million. The vendor reports a 6.5% reduction.
    • Caveat: The headline cost comparison comes from the vendor’s internal task suite, whose model-graded results need checking against your own completed documents. (HN 256 points · 78 comments)

Industry

  • Anthropic reports fewer junior hires as automated work expands — Its internal study makes human review capacity and changing hiring criteria concrete questions for teams adopting coding assistants.
    • The share of junior technical hires fell from 27% to 9%. Junior staff’s share of technical employment fell from 21% to 14%, while technical hiring still grew in absolute terms.
    • The study follows 192 engineers adopting coding agents against 74 non-adopters, and includes 17 employee interviews. Adoption was voluntary.
    • By August, interactive agent runtime was six times estimated employee work hours. Agent time excludes waits over 30 minutes, while human hours assume a 40-hour week.
    • Code commits per engineer rose fivefold over six months. Commits measure output volume, while removals and reversals supply only partial checks of code quality.
    • Caveat: This observational study covers one fast-growing AI company, so it cannot isolate AI’s causal effect or establish economy-wide job losses. (Techmeme)
All gathered items - what was cut and why (6)