2026-10-20 · Tuesday

AI Hot Topics

1. Anthropic launches OSS Scanner: free, regular vulnerability scans of critical open-source projects using its strongest model, every finding with a proof of concept (PoC) and a patch where fixable. The first scans have reported 77 critical and 803 high-severity issues (model-rated) to maintainers, including a curl fix; maintainers of critical open-source projects can apply. The official post has 5k+ likes and 2.5k bookmarks. X @ClaudeDevs ｜ X @ClaudeDevs ｜ red.anthropic.com/oss-scanner
   4

   Anthropic 推出 OSS Scanner：给关键开源项目免费定期做漏洞扫描，用的是他们最强的模型，每个发现都附概念验证（PoC），能修的还附补丁。首批扫描已向维护者报告 77 个严重、803 个高危（模型评级）问题，其中包括一个 curl 修复；维护关键开源项目的可以申请。官方帖 5k+ 赞、2.5k 收藏。

2. The Information reports Anthropic will release a new model this month with stronger reasoning and “intuition” than current models, especially at inferring unspoken intent (example: asked to fix one bug, it finds the same class of issue and asks whether to fix those too) and giving fewer formulaic answers; the name and whether it’s Fable or Opus is undecided. The same piece says Google is working on Gemini 4 Carbon and OpenAI is preparing a cheaper new Terra model. Baoyu warns that for coders the model may proactively widen the scope of changes, so review more carefully. X @testingcatalog ｜ X @dotey
   3

   The Information 爆料：Anthropic 本月要发新模型，推理和「直觉」都比现有模型强，特别会揣摩没说出口的意图（例子：让它修一个 bug，它会找出同一类问题并问你要不要一起修），也更少给套路化答案；名字和归属 Fable 还是 Opus 系列未定。同一篇还提到 Google 在做 Gemini 4 Carbon、OpenAI 在准备更便宜的 Terra 新模型。宝玉提醒：对写代码的人，模型可能主动扩大改动范围，审查要更仔细。

3. The US Department of Homeland Security (DHS) ordered civilian federal agencies to remove DeepSeek and “third-party products and services built on DeepSeek” and banned procurement. The order was signed July 24, made public October 19 and published in the Federal Register October 20; defense and intelligence systems are excluded. Rohan Paul notes that weights running on US servers aren’t exempt, and vendors selling software to government will need to state which open-weights models their products use. Cross-checked against MeriTalk, WSJ and others. X @rohanpaul_ai ｜ meritalk.com/articles/dhs-orders-c…
   3

   美国国土安全部（DHS）下令联邦民事机构移除 DeepSeek 及「基于 DeepSeek 实现开发的第三方产品和服务」，并禁止采购。命令 7 月 24 日就已签署，10 月 19 日才公开，10 月 20 日登联邦公报；不含国防和情报系统。Rohan Paul 指出即使权重跑在美国服务器上也不豁免，给政府卖软件的厂商要开始说清产品里用了哪些开源权重模型。已用 MeriTalk、WSJ 等报道交叉核对。

4. OpenAI Developers’ first episode of “COOKED”: introduces Codex cloud environments (tasks keep running after you close your laptop) and new Codex CLI features: chat with Codex directly in the terminal, track multiple agents, and fork a conversation into a separate worktree. Codex lead Tibo reposted with the caption “Day 15/ We’re cooked”, 3.5k likes. X @OpenAIDevs ｜ X @thsottiaux
   4

   OpenAI Developers 首期节目「COOKED」：介绍 Codex 云端环境（合上电脑任务还能继续跑），以及 Codex CLI 新功能：在终端里直接和 Codex 对话、追踪多个 agent、把一段对话 fork 到单独的 worktree。Codex 负责人 Tibo 转发配文「Day 15/ We’re cooked」，3.5k 赞。

5. Google DeepMind paper: a Gemini-based agent found new “acceleration rules” for 11 unsolved Turing machines on the Busy Beaver BB(6) frontier and formally verified them in Lean. The agent picks machines, finds patterns in execution traces, and keeps only proven rules, so the conclusions don’t rely on trusting model reasoning. Whether these machines halt remains unknown. X @omarsar0 ｜ arxiv.org/abs/2610.22603
   3

   Google DeepMind 论文：一个基于 Gemini 的 agent 在 Busy Beaver BB(6) 前沿上，为 11 台尚未解决的图灵机找到并用 Lean 形式化验证了新的「加速规则」。agent 自己挑机器、从执行轨迹找规律，只有被证明的规则才保留，所以结论不依赖信任模型推理。这些机器能否停机仍未知。

6. Skyfall AI releases SKY-001 “engineering world model”: generates buildable CAD files (part tree plus step-by-step sketches) from text or sketches; self-reported as 51–125x faster, 150–210x cheaper and higher IOU than frontier models such as GPT-6 Astra on CAD/BIM tasks. Research preview; the numbers are the company’s, with no independent evaluation yet. X @spisallyouneed ｜ X @omarsar0
   2

   Skyfall AI 发布 SKY-001「工程世界模型」：从文字或草图生成可构建的 CAD 文件（零件树加逐步草图），官方自测在 CAD/BIM 任务上比 GPT-6 Astra 等前沿模型快 51–125 倍、便宜 150–210 倍、IOU 更高，目前是研究预览。数字来自官方，尚无独立评测。

Tips & Hands-on

1. Before launch, have 4 subagents act as first-time users (Vox): in Claude Code, have Opus 5.5 dispatch 4 subagents to take turns using the browser from landing page to first success: an impatient random clicker, a skeptic who reads pricing and privacy terms first, a mobile user on a 375px screen and slow 3G, and a saboteur who fills forms randomly and mashes buttons. Places where they get stuck are screenshotted into qa/first-users/ and ranked by how many hit them; after fixing, 4 fresh subagents that haven’t seen the issue list retest and produce a before/after comparison. The original post includes a full copy-paste prompt (run only locally or in preview, with test email and test payments). Very handy as a pre-release walkthrough. X @Voxyz_ai
   4

   上线前让 4 个 subagent 扮演第一次来的用户（Vox）：在 Claude Code 里让 Opus 5.5 派 4 个 subagent 轮流用浏览器从落地页走到「首次成功」：没耐心乱点的、先读定价和隐私条款的怀疑派、375px 屏 + 慢速 3G 的手机用户、乱填表单狂点按钮的破坏者。卡住的地方截图存进 qa/first-users/，按多少人踩到排序；修完再派 4 个没看过问题表的新 subagent 复测，出前后对比。原帖附了完整可复制的提示词（要求只在本地或预览环境跑、用测试邮箱和测试支付）。做产品发版前的走查很实用。

2. Run DeepSeek V4.1 Flash locally (Unsloth): Unsloth built a llama.cpp implementation and dynamic GGUFs; the 1-bit version shrinks from 508GB to 250GB while keeping about 88.2% accuracy, runnable on machines with 128GB+ RAM. Daniel Han adds that the engram/PLE part can switch between MXFP8, Q6_K, Q5_K and IQ4_NL (Q6_K is roughly equal to MXFP8), and the engram can be streamed entirely from disk. Follow the official guide if you want to self-host the strongest open model on a big-memory Mac or workstation. X @UnslothAI ｜ X @danielhanchen ｜ unsloth.ai/docs/models/deepseek-…
   4

   本地跑 DeepSeek V4.1 Flash（Unsloth）：Unsloth 做了 llama.cpp 实现和动态 GGUF，1-bit 版本从 508GB 压到 250GB、保留约 88.2% 准确率，128GB+ 内存的机器能跑；Daniel Han 补充 engram/PLE 部分可在 MXFP8、Q6_K、Q5_K、IQ4_NL 间切换（Q6_K 约等于 MXFP8），而且 engram 可以完全从磁盘流式读取。想在大内存 Mac/工作站上自托管最强开源模型的可以照着官方指南来。

3. For an agent knowledge base, try a Markdown index before vector retrieval (Paul Iusztin): his LLM wiki uses a Markdown index page listing each page’s title and blurb; the agent reads the index, picks relevant pages and follows links as needed, with no embeddings. In another post he says the hardest part of a knowledge graph is deciding which concepts deserve their own node, otherwise a node per mentioned concept is all noise, and he set a filtering rule (details in the original post). A good reference for giving Claude Code/Codex project documentation. X @pauliusztin_ ｜ X @pauliusztin_
   4

   给 agent 做知识库，先试 Markdown 索引再上向量检索（Paul Iusztin）：他的 LLM wiki 用 Markdown 索引页列出各页标题和简介，agent 先读索引、挑相关页面、需要时顺着链接继续读，不用 embedding。他另一条帖子说，做知识图谱最难的是决定哪些概念值得单独成节点，否则每个提到的概念都建节点会全是噪音，他为此定了一条筛选规则（细节见原帖）。对给 Claude Code/Codex 配项目文档很好借鉴。

4. Pitfalls of cross-organization agent collaboration (Salesforce paper, via Rohan Paul): across 488 scenarios and 2,500+ agent-to-agent sessions (Claude Code, Codex and Cursor each in separate sandboxes), 20 failure modes emerged: no agent proactively re-fetched documents to verify the other side’s claims, and they basically only contacted each other when prompted; a $24,000 service-dispute settlement passed all 10 outcome checks, yet the vendor agent leaked confidential details. Takeaway: when your agent deals with external agents, write verification into the protocol and score each separately by the party it represents. X @rohanpaul_ai
   3

   跨组织 agent 协作的坑（Salesforce 论文，Rohan Paul 转述）：在 488 个场景里跑了 2500+ 次 agent 对 agent 会话（Claude Code、Codex、Cursor 各在独立沙箱），归纳出 20 种失败模式：没有一个 agent 会主动重新拉文档核实对方的说法，基本只在提示要求时才联系对方；一个 2.4 万美元的服务纠纷和解通过了全部 10 项结果检查，但供应商 agent 泄露了机密细节。启示：你的 agent 要和外部 agent 打交道时，要把核验写进协议，并按它代表的那一方单独打分。