Claroc’s investigation tried 43,551 app addresses found through public DNS records. Of the 37,571 still online, 35,578 opened without signing in; most held ordinary apps, but some exposed personal or business records.
Claroc found 24 open apps built by the platform company’s own staff, including an internal onboarding plan and advertising proposals. Ars reports those apps stopped opening after its questions, while other users’ apps remained exposed at publication.
The app’s random-looking name sits in its hostname. Passive DNS services can list hostnames that visitors have resolved, so an unguessable-looking name is a poor access control.
Claroc says its test account offered “Anyone with the link” when publishing. Users can instead select invited users or only themselves; the platform disputes that public access is the default for its apps.
Caveat: Claroc’s accessible-app count does not mean every open app held sensitive data, and the disputed default was tested on its own account rather than every account.
(Techmeme · Ars Technica report · Claroc research)
Toptal’s ExpertCrowd-SWE has 100 authored tasks across 87 open-source projects and 11 languages. An agent is a model running a multi-step task with tools; each gets the same task and sandbox but its provider’s own tool interface.
Task authors wrote weighted checks that allow partial credit and include requirements that block an unacceptable change. Reference solutions must pass; unchanged code and inert patches must fail.
Across seven models, Opus 5.5 averaged 67.3% of available grading credit and GPT-6 Astra 63.7%. The paper finds no statistically significant gap between those two scores.
The released dataset contains 24 inspectable tasks with graders and patches. The other 76 tasks remain private to limit training-data contamination.
Caveat: The authors selected tasks for difficulty against current models, and most graders remain private; these scores do not measure unsupervised work on a team’s own repositories.
(arXiv 2611.13246v1 · Toptal ExpertCrowd dataset)
Amazon and Columbia researchers combine a written operating procedure with logged agent runs. They extract conditions and tool inputs from the agent’s explanations, then generate executable rules; a tool may still call a model for a specific subtask.
On 79 procedures from the authors’ production platform, generated workflows completed 93.8% of tasks versus 96.8% for the original agent, at 24% lower cost per task.
On the public τ²-Bench, the uncorrected workflows succeeded on 75.8% of tasks against 80.6% for the agent. They ran in 1.3 seconds per task rather than 170 seconds; repairing workflows against training failures raised another evaluated setup’s success rate.
The method works when steps repeat with learnable conditions. The paper’s full method and comparison include separate public and production settings rather than treating them as interchangeable.
Caveat: The faster workflow initially loses some task success, and its savings depend on repeating sufficiently stable procedures; a new or unusual case still needs review.
(arXiv 2611.14492v1)
Wincon gave 16 models the manual for TIS-100 and 55 puzzles, including eight community challenges. Each model had one timed attempt per puzzle and could test programs in the actual game.
Across models, the study reports 133 new tradeoff points on 18 puzzles, including three outright cycle records. The new-point count requires replay in the game and 100,000 passing simulator tests.
Opus 5.5 and GPT-6 Astra each found new tradeoffs on 11 puzzles and solved all 55. The site says its other ranking measures do not establish a clear overall winner between them.
The methods withhold community solutions and exact records during attempts, while allowing feedback from the game. The cited benchmark snapshot is dated November 3; today’s HN submission is discovery, not a claim of a new launch today.
Caveat: These are constrained puzzle programs with timed tool access, not a measure of maintaining production software or independently reproduced game-development ability.
(HN 75 points · 15 comments · Wincon methods)
The researchers train Qwen3.5 models with 4 billion and 9 billion parameters to write and search persistent files across context replacements. A larger frozen teacher scores the smaller models’ own attempts.
Their test suite spans shopping, coding, research, general and visual tasks. All compared methods get the same 128 test tasks in each area; the paper also tests transfer to network-free coding and terminal-task subsets.
The 9-billion-parameter trained model succeeds on 38.0% of Terminal-Bench 2.1 tasks and 30.1% of SWE-Bench Pro V2 tasks, versus 23.1% on each for the untrained 9-billion-parameter base model.
The full paper compares file operations with specialized memory interfaces and tests whether changing saved content changes later behavior. This studies a trained policy, not a plug-in that automatically improves an existing model.
Caveat: The authors test only two student sizes with one frozen teacher; their results do not show that the training recipe transfers to larger deployed models.
(arXiv 2611.14009v1)
Apple’s rumored Harbor Mac app → UNVERIFIABLE: reporting quotes a leak about a private preview, not released documentation or an app a reader can test; no public launch is established.