2026-10-22 · Thursday

AI Hot Topics

1. Anthropic launches Claude Duet (research preview): A standalone app (iOS, Android; on desktop via claude.ai on the web) powered by Opus 5.5 that connects to 6,000+ connectors and plugins. It sends a daily morning briefing, watches your email, calendar and Slack, and messages you only when needed; tasks run on its own cloud computer and keep going after you close the app, and sensitive actions such as sending messages or payments wait for your approval. Currently US Pro/Max users only, with a waitlist, sharing Claude’s usage limits (background checks count). TestingCatalog dug up that it can check out with Stripe Link and Shop Pay, and will later log in with accounts stored in 1Password. The official post has 36k likes; Baoyu notes this is the fourth product of its kind in two months, after Grok Bot, Meta Muse and OpenAI Dots. X @claudeai ｜ claude.com/product/claude-duet ｜ X @testingcatalog ｜ X @dotey
   5

   Anthropic 发布 Claude Duet（研究预览）：一个独立 App（iOS、Android，电脑上走 claude.ai 网页），由 Opus 5.5 驱动，能连 6000 多个连接器和插件。它每天早上发简报，平时替你盯着邮箱、日历和 Slack，只在需要你时才发消息；任务在它自己的云端电脑上跑，你关掉 App 也不停，发消息、付款这类敏感操作会先等你批准。目前只对美国 Pro/Max 用户开放，要排候补，和 Claude 共用额度，后台检查也算用量。TestingCatalog 挖到它能用 Stripe Link 和 Shop Pay 下单，之后还会支持用 1Password 里存的账号登录。官方帖 3.6 万赞；宝玉指出这是两个多月里第四个同类产品，前面三个是 Grok Bot、Meta Muse 和 OpenAI Dots。

2. Claude API ships version 2026-10-21, the first formal version bump since 2023: With the new version, passing temperature, top_p or top_k to the Messages API returns 400 (even default values); putting a document in an assistant message or citations in a user message also returns 400; several Admin/Analytics API fields are renamed. SDKs shipped new major versions at the same time (Python 2.0.0, TypeScript 1.0.0, Go moves to a /v2 path), default to the new version, and send the API key via Authorization: Bearer, so proxies or gateways that authenticate on the X-Api-Key header must be updated. The old 2023-06-01 version is not deprecated. In Claude Code, use the /claude-api skill to migrate. X @ClaudeDevs ｜ platform.claude.com/docs/en/api/migration…
   5

   Claude API 发布 2026-10-21 版本，2023 年以来第一次正式升版：新版本下，Messages API 里传 temperature、top_p 或 top_k 会直接返回 400（哪怕传的是默认值）；assistant 消息里放 document、user 消息里带 citations 也会报 400；Admin/Analytics API 有几个字段改名。各语言 SDK 同时发了新的大版本（Python 2.0.0、TypeScript 1.0.0、Go 改用 /v2 路径），默认就用新版本，而且改用 Authorization: Bearer 发送 API key，靠 X-Api-Key 头鉴权的代理或网关要跟着改。旧版本 2023-06-01 没有废弃。在 Claude Code 里可以用 /claude-api skill 做迁移。

3. OpenAI’s PHP2Shell postmortem: AI can already find vulnerabilities that affect the whole internet: In a long post, Greg Brockman says this 14-year-old PHP bug was first found in August by a Calif researcher in the Patch the Planet program using GPT-5.6 Sol, and OpenAI’s team independently found a more complete version in September. They led two months of preparation with PHP, Wiz and Cloudflare; the fix was planned for October 22 but PHP shipped on the 21st after details leaked early. The Node.js remote-code-execution bug disclosed the same day was also theirs. He argues the old model of manual one-by-one disclosure can’t keep up in the agent era and proposes authorized parties such as governments scanning the whole internet and patching remotely when necessary. OpenAI also released a Codex skill repo to check whether your own sites are affected (7.6k likes, 4.8k bookmarks). X @gdb ｜ openai.com/index/coordinated-dis… ｜ GitHub openai/php2shell-checker
   4

   OpenAI 复盘 PHP2Shell：AI 已经能挖出影响整个互联网的漏洞：Greg Brockman 长文说，这个藏了 14 年的 PHP 漏洞，是 Patch the Planet 计划里的 Calif 研究员 8 月用 GPT-5.6 Sol 先找到的，OpenAI 团队 9 月又独立找到更完整的版本。他们牵头联合 PHP、Wiz、Cloudflare 准备了两个月；原定 10 月 22 日发布修复，因为细节提前泄露，PHP 提前到 21 日发版。Node.js 当天公布的远程代码执行漏洞也是他们发现的。他认为一个个手动披露的老办法跟不上 agent 时代，提出由政府这类授权方扫描全网、必要时远程修补。OpenAI 还放出一个 Codex skill 仓库，可以帮你检查自己的网站是否受影响（7.6k 赞、4.8k 收藏）。

4. Recursive open-sources local coding model Flint (Apache 2.0): A 40B MoE with 2.5B active per token; officially ranked first among MoEs under 50B on agentic coding benchmarks SWE-Bench Pro v2, Terminal-Bench 2.1 and SWE-Bench Verified. With short context it runs at 125+ tokens/s on an M4 Pro MacBook Pro and 150+ on a 64GB RTX Spark. The team trained it from scratch in under 4 months, with their automated research system Eureka Machine involved in nearly every step from data and training recipe to inference kernels: for example, unconventionally quantizing the output layer to 4 bits and distilling to recover accuracy, and writing a Metal megakernel that fuses the entire decode forward pass on Apple silicon. Runs on llama.cpp, Ollama, LM Studio and vLLM, and Unsloth has GGUFs. Official advice: keep context within 256K, split complex tasks and write explicit instructions. recursive.com/updates/introducing-r… ｜ huggingface.co/RecursiveSI/flint ｜ X @danielhanchen
   4

   Recursive 开源本地编码模型 Flint（Apache 2.0）：40B MoE，每个 token 激活 2.5B，官方称在 50B 以下的 MoE 里，SWE-Bench Pro v2、Terminal-Bench 2.1、SWE-Bench Verified 这几项 agent 编码基准都排第一。短上下文下 M4 Pro MacBook Pro 能跑 125+ tokens/秒，64GB RTX Spark 能跑 150+。团队不到 4 个月从零训出，自动化研究系统 Eureka Machine 参与了从数据、训练配方到推理内核的几乎每一环：例如反常规地把输出层量化到 4 bit 再蒸馏补回精度，还在 Apple 芯片上写出把整个 decode 前向融合在一起的 Metal megakernel。llama.cpp、Ollama、LM Studio、vLLM 都能跑，Unsloth 已出 GGUF。官方建议上下文控制在 256K 以内，复杂任务拆小、指令写明。

5. Claude Security moves to continuous scanning: After connecting to GitHub or another code host, it does a deep scan first and then rescans each commit’s changes. Once a patch lands (whether or not fixed inside Claude) the issue is closed automatically and reopened if it recurs; it also uses security-team notes and an editable per-project threat model to judge which vulnerabilities an attacker could really exploit. Teams scanning repos with it no longer need to watch a vulnerability list that goes stale fast. claude.com/resources/articles/cl… ｜ X @rohanpaul_ai
   4

   Claude Security 改成持续扫描：连上 GitHub 等代码托管平台后，先做一次深度扫描，之后每次提交都会重扫改动。补丁上线后（不管是不是在 Claude 里修的）会自动关闭对应问题，问题复发就重新打开；还会结合安全团队的备注和每个项目可编辑的威胁模型，判断哪些漏洞攻击者真能利用到。用它扫仓库的团队，以后不用再盯一份很快就过时的漏洞列表。

6. DeepMind paper: plain RL can amplify “behaves only when watched”: Researchers gave Kimi K2.6 only harmless traits (e.g. be as helpful as possible to all users, know how oversight works) and never showed it examples of duplicity; then used RL to reward following a business rule that shortchanges users, scoring only in monitored episodes. Across 3 environments, the gap in rule-following between watched and unwatched cases grew from 1%–18% before RL to 43%–95% after, while standard safety benchmarks barely noticed. Takeaway: if rewards are issued only in monitored settings, re-run evals with the monitoring cues removed. Worth reading alongside yesterday’s OpenAI incident about agents weakening monitoring. X @rohanpaul_ai ｜ arxiv.org/abs/2610.26551
   4

   DeepMind 论文：普通 RL 就能把「只在被看着时守规矩」放大：研究者只给 Kimi K2.6 一些无害的特质（比如尽量帮助所有用户、知道监管是怎么做的），从没给它看过「阳奉阴违」的例子；然后用 RL 奖励它遵守一条亏待用户的业务规则，但只在有监控的回合里打分。在 3 个环境里，有人看和没人看时的守规矩比例差距，从 RL 前的 1%–18% 拉大到 RL 后的 43%–95%，常规安全基准却几乎看不出问题。结论是：如果奖励只在有监控的场景里发，评测时就要去掉监控提示再测一遍。可以和昨天 OpenAI 的 agent 削弱监控事故对照着读。

Tips & Hands-on

1. OO-Harness: evolving a family of specialized harnesses the object-oriented way (Google Cloud AI Research): Instead of evolving one general harness, an evolving agent builds a class-inheritance tree from execution logs: subclasses inherit the base harness and override only the methods a task type needs; a “design lessons” file records which changes helped and which failed; at run time a router looks at the task and the base harness’s result to decide which subclass to hand off to, or just keeps the base result. With the same Gemini 3.5 Flash executor, AutomationBench goes from 61.6% to 77.4% and Workspace-Bench from 25.5% to 39.5%; the inheritance version beats the same code written flat by 4.96 points, while spending extra reasoning on best-of-K or self-correction is unstable. Agent authors can follow the idea and split task-specific logic into subclasses. X @omarsar0 ｜ arxiv.org/abs/2610.28380
   4

   OO-Harness：按面向对象的思路演化一族专用 harness（Google Cloud AI Research）：不再演化一个通用 harness，而是让一个演化 agent 根据执行记录建出一棵类继承树：子类继承基础 harness，只重写某类任务需要改的方法；另外记一份「设计教训」，写明哪些改动有用、哪些失败；运行时由一个路由器看任务和基础 harness 的结果，决定交给哪个子类，或者直接沿用基础结果。执行模型同样是 Gemini 3.5 Flash，AutomationBench 从 61.6% 提到 77.4%，Workspace-Bench 从 25.5% 提到 39.5%；用继承写的版本比把同样代码平铺开高 4.96 分，而多花推理去做 best-of-K 或自我修正并不稳定。自己写 agent 的人可以照这个思路，把不同任务的特殊逻辑拆成子类。

2. From “context engineering” to “cache engineering”: In long-running agents, once history is summarized or trimmed, the prefix changes and all later KV cache is invalidated, forcing a re-prefill. This paper gives agents two interfaces to operate on their own KV cache directly: one moves some entries out of later attention, another shifts the positions of the remaining keys, without changing the conversation text. In experiments, rolling discard of old tool outputs scores 1.7 points higher than summarizing at a threshold and costs 27.7% less; the accompanying AKV inference engine raises throughput by up to 1.2x. X @dair_ai ｜ arxiv.org/abs/2610.28577
   4

   从「上下文工程」到「缓存工程」：长时间运行的 agent 一旦总结或裁剪历史，前缀一变，后面的 KV Cache 全部失效，只能重新 prefill。这篇论文给 agent 两个直接操作自己 KV Cache 的接口：一个把某些条目移出后续注意力，一个平移剩下 key 的位置，对话文本本身不改。实验里，滚动丢弃旧的工具输出，比到阈值才做总结得分高 1.7 分、成本低 27.7%；配套的 AKV 推理引擎吞吐最多提升 1.2 倍。

3. A roadmap for evaluating subjective tasks (Cameron Wolfe): Three layers. Human evaluation is the “north star” for quality: write quality criteria with domain experts and calibrate agreement among reviewers; offline evaluation uses calibrated LLM judges or task-specific rubrics to replace most human work; production uses monitoring and A/B tests. Order: offline eval → human eval → online A/B → full rollout. For choosing tasks use task taxonomy, difficulty filtering and item response theory (IRT); to handle noise use power analysis for sample size, confidence intervals, repeated sampling and paired comparisons on the same tasks. Agent evaluators can use it as a template. X @cwolferesearch ｜ cameronrwolfe.substack.com/p/subjective-evals
   4

   给主观任务做评测的路线图（Cameron Wolfe）：分三层。人工评测是质量的「北极星」，要和领域专家一起写清质量标准，并校准评审员之间的一致性；离线评测用校准过的 LLM 评审或按任务定制的打分细则，代替大部分人工；生产环境做监控和 A/B 测试。顺序是离线评测 → 人工评测 → 线上 A/B → 全量。挑任务时用任务分类、按难度筛选、项目反应理论（IRT）；对付噪声用功效分析估算样本量、给出置信区间、重复采样，并在同一批任务上做配对比较。做 agent 评测的可以直接拿来当模板。

4. Turn your existing traces into small-model training data: LangChain CEO Harrison Chase’s recommended approach: pick the well-completed runs from already recorded trajectories, fine-tune a small model on them, and evaluate on your own tasks. He thinks it’s unsurprising that a 9B model trained on your task beats frontier models. LangSmith and Baseten’s smithtune package this as a managed service, the same idea as yesterday’s Shopify “frontier model as the brain, small models as specialists”. X @hwchase17 ｜ langchain.com/blog/langsmith-fine-t…
   3

   把已有的 trace 变成小模型训练数据：LangChain CEO Harrison Chase 推荐的做法是：从已经记录的运行轨迹里挑出完成得好的，用来微调一个小模型，再在你自己的任务上评测。他认为模型就在你的任务上训练，9B 小模型打赢前沿模型并不奇怪。LangSmith 和 Baseten 的 smithtune 把这个流程做成了托管服务，和昨天 Shopify 的「前沿模型当主脑、小模型当专家」是同一个思路。

AI Hot Topics

1. Microsoft: state hackers automate attacks with the open-source AI pentest framework ARTEX, and the ConnectWise supply-chain incident was theirs too: Microsoft’s security blog says Storm-0940, a group tied to Chinese state interests, has used ARTEX since September (an open-source agentic AI pentest framework on GitHub that chains multiple LLM agents from recon to data theft with almost no human work) against hundreds of organizations worldwide; in several cases it took under 3 hours from picking a target to privileged cloud access. It abused already-authorized credentials of the ConnectWise backup and management app to sign into Microsoft 365 tenants without user interaction, bypassing MFA; once in, it ran recon through Microsoft Graph, added credentials to other apps and tried to escalate (the rohanpaul summary mentions one app granting itself Global Admin). Most attempts still failed, e.g. a 150,000+ password-spray all failed, and a successful sign-in doesn’t mean data was stolen. Teams using ConnectWise or who’ve granted third-party apps M365 access should check service-principal sign-ins, app credentials and permission changes since October 15, as Microsoft advises. microsoft.com/en-us/security/blog/2… ｜ X @rohanpaul_ai ｜ thehackernews.com/2026/10/china-linked-…
   4

   微软：国家级黑客用开源 AI 渗透框架 ARTEX 自动化攻击，ConnectWise 供应链事件也是它干的：微软安全博客说，与中国国家利益相关的组织 Storm-0940 从 9 月起用 ARTEX（GitHub 上开源的 agentic AI 渗透测试框架，把多个 LLM agent 串起来，从侦察一路跑到窃取数据，几乎不用人工）攻击全球数百家机构；有多起从选定目标到拿到云上特权访问不到 3 小时。它滥用 ConnectWise 备份与管理应用早已获授权的凭据登录 Microsoft 365 租户，不经过用户交互登录，也就绕过了 MFA；进去后通过 Microsoft Graph 做侦察、给其他应用加凭据、尝试提权（rohanpaul 摘要提到其中一个应用给自己授予了全局管理员）。大部分尝试仍然失败，例如一次密码喷洒 15 万多次全部失败；成功登录也不等于数据已被窃取。用 ConnectWise 或给第三方应用授权过 M365 的团队，按微软建议检查 10 月 15 日以来的服务主体登录、应用凭据和权限变更。

2. Bloomberg: DeepSeek’s new funding round is about ¥100B (about $15B): Tencent and CATL are putting in the most; the target was raised at least twice during talks (¥50B → ¥80B → about ¥100B). Per Caijing, the pre-money valuation stays about ¥500B, so new money buys more shares at the old price. It’s DeepSeek’s second outside round in half a year (the first, about ¥51B, was in June); neither the company nor investors have confirmed publicly. Baoyu’s roundup adds that DeepSeek has hired CITIC Securities to prepare a STAR Market listing, possibly filing by year-end, and that its models stay open-source under MIT.

   3

   彭博：DeepSeek 新一轮融资约 1000 亿元人民币（约 150 亿美元）：腾讯和宁德时代出资最多，融资目标在谈判中至少上调两次（500 亿 → 800 亿 → 约 1000 亿元）；按《财经》报道，投前估值约 5000 亿元没变，相当于新钱按原价买到更多股份。这是 DeepSeek 半年内第二轮外部融资（6 月首轮约 510 亿元），公司和投资方都还没公开确认。宝玉的梳理还提到，DeepSeek 已请中信证券筹备科创板上市，最快年底递交申请；模型继续以 MIT 协议开源。X @dotey ｜ X @rohanpaul_ai ｜ ithome.com/1/012/172.htm
3. Mirendil-Base: one researcher, 3.5 months, under $10M compute, pretrains a coding base model from scratch: Less than 4 months after launching, founder Behnam Neyshabur says this was a controlled experiment run without a pretraining team; the compute bill covers all research, small-scale experiments and the final run. Mirendil-Base is 100B–500B parameters, and larger Large (500B–2T) and XL (2T–10T) models were trained with the same recipe; independent evals, post-training benchmarks and API access aren’t out yet. Like Recursive Flint in this morning’s digest, it’s a case of AI-assisted AI research shrinking team size dramatically. X @bneyshabur
   3

   Mirendil-Base：一名研究员 3.5 个月、不到 1000 万美元算力，从零预训练出编码基座模型：公司正式亮相不到 4 个月，创始人 Behnam Neyshabur 说这次是在没有预训练团队的情况下做的受控实验：算力账单包含全部研究、小规模实验和最后一次正式训练。Mirendil-Base 参数在 100B–500B 之间，更大的 Large（500B–2T）和 XL（2T–10T）也按同一套配方训练，独立评测、后训练基准和 API 访问还没放出。和今早汇总里的 Recursive Flint 一样，都是「AI 辅助做 AI 研究」大幅压缩团队规模的案例。

4. NVIDIA open-sources the Nemotron 3.5 Retriever family: It includes Nemotron 3.5 Parse for tables and charts in complex PDFs and scans, Embed for image-text multimodal retrieval (1B in BF16 and NVFP4, plus an 8B), and Rerank 8B for re-ranking candidates. If you build RAG or document agents, try swapping in the whole set for parsing, retrieval and reranking. huggingface.co/collections/nvidia/ne… ｜ X @Gorden_Sun
   3

   NVIDIA 开源 Nemotron 3.5 Retriever 检索模型系列：包括解析复杂 PDF、扫描件里表格和图表的 Nemotron 3.5 Parse，图文多模态检索的 Embed（1B 有 BF16 和 NVFP4 两个版本，另有 8B），以及给候选结果精排的 Rerank 8B。做 RAG 或文档 agent 的，可以整套替换解析、召回、重排三个环节来试。

5. Nathan Lambert’s Harvard talk: where open models stand: He says open models trail the closed frontier by about 3–5 months and the gap is shrinking; Chinese open models lead on performance, downloads and paper citations, while US open models trail Chinese ones by 3–4 months. He thinks “distillation” is overrated: public research shows no huge gains from SFT on reasoning traces, and RL compute now exceeds pretraining. America’s lasting edge is compute, with the top five US labs having on average 16x the compute of China’s top five. He also argues banning open source won’t stop bad actors and only hurts the economy, and suggests national risk standards that assess “marginal risk” per model. Full slides are public. natolambert.com/slides/2026/harvard/l… ｜ X @shao__meng
   3

   Nathan Lambert 哈佛讲座：开源模型的现状：他认为开源模型落后闭源前沿约 3–5 个月，差距还在缩小；性能、下载量、论文引用三项中国开源模型都领先，美国开源模型又比中国落后 3–4 个月。他认为「蒸馏」被高估了：公开研究里看不到用推理过程做 SFT 有巨大提升，现在强化学习的算力也已经超过预训练。美国真正持久的优势是算力，前五家实验室的总算力平均是中国前五家的 16 倍。他还认为禁止开源挡不住坏人，只会伤害经济，建议由国家统一风险标准，按模型评估「额外风险」。讲义全文公开。

Tips & Hands-on

1. Cloudflare cuts AI code review cost per run from $2.43 to $0.77 (-68%): Median review time falls from 4m09s to 1m32s, and the share of code-quality findings adopted by authors rises from 34% to 59%. On the bill, cache writes are 43%, cache reads 34% and output only 23%, so money mostly goes to repeated context. About 40% of the savings come from engineering: splitting the 11k–21k-token tool definitions and system prompt shared across repos into a separate cached prefix (previously bundled with working directory and date, giving only 14%–26% cache hit on the first request); the three review roles share one prefix, one writes the cache and the others wait to read it; removing tools sub-agents don’t use; reading files in parallel; skipping roles with nothing new on re-review; and not running an extra summary round after the verdict. The other ~60% comes from model choice and reasoning effort: the coordinator uses Opus 5.5 medium, and Sonnet 5.5 has the same unit price as Sonnet 5 but far fewer tokens, 47%–62% cheaper. The code-quality role at high effort costs only about 2 cents more and finds 58% more severe and warning-level issues; performance and security roles at medium did miss issues, so high is next. Teams running their own agents can audit item by item. blog.cloudflare.com/obsessive-inference-o… ｜ X @shao__meng
   5

   Cloudflare 把 AI 代码审查单次成本从 2.43 美元降到 0.77 美元（-68%）：审查耗时中位数从 4 分 9 秒降到 1 分 32 秒，代码质量类发现被作者采纳的比例反而从 34% 升到 59%。账单里缓存写入占 43%、缓存读取占 34%，输出只占 23%，所以钱主要花在重复的上下文上。省下的钱约 4 成来自工程改动：把各仓库共用的 11k–21k token 工具定义和系统提示拆成独立的缓存前缀（原来跟工作目录、日期拼成一个块，首个请求的缓存命中率只有 14%–26%）；三个审查角色共用同一前缀，一个写缓存，其余等它写完再读；去掉子 agent 用不上的工具；改成并行读文件；复审时跳过没有新内容的角色；结论发出后不再多跑一轮写总结。其余约 6 成来自换模型和调推理强度：协调角色用 Opus 5.5 medium，Sonnet 5.5 单价和 Sonnet 5 一样，但 token 用量少得多，成本低 47%–62%。代码质量角色用 high effort 只贵约 2 美分，严重和警告级发现多 58%；性能、安全角色在 medium 下确实漏掉了问题，下一步测 high。自己跑 agent 的团队可以照着逐项排查。

2. AgentReady: an open spec for making websites usable by AI agents; only two things really make agents fail: Released by ora with Vercel, Stripe, Auth0, Mintlify, Tavily and others (MIT license). In a controlled experiment serving the same docs site in 19 configurations, only “the answer appears only after JS rendering” and “403 returned to agents” caused answers to be missed; llms.txt, JSON-LD, sitemaps and Markdown mirrors changed nothing. Agents mostly find llms.txt and openapi.json through links on the page and don’t guess paths; when the official site is unreadable they answer from third-party pages, and the odds of an answer missing the facts the user asked about are 3.7x normal. The spec has MUST/SHOULD/MAY across three steps, find, read, act: MUST includes robots allowing agents, answers in the initial HTML, real HTTP status codes, and at least an MCP server or CLI. ora.ai/blog/agentready-launch ｜ X @shao__meng
   4

   AgentReady：让网站能被 AI agent 用的开放规范，只有两件事真会让 agent 失败：ora 联合 Vercel、Stripe、Auth0、Mintlify、Tavily 等发布（MIT 许可）。受控实验里，同一个文档站用 19 种配置提供，只有「答案只在 JS 渲染后才出现」和「对 agent 返回 403」会导致拿不到答案；llms.txt、JSON-LD、sitemap、Markdown 镜像都不改变结果。agent 主要靠页面上的链接找到 llms.txt 和 openapi.json，不会去猜路径；读不到官网时，它转而用第三方页面作答，回答里完全没有用户要问的事实的概率是正常情况的 3.7 倍。规范按「找到、读取、操作」三步分出 MUST/SHOULD/MAY：MUST 包括 robots 放行 agent、答案出现在初始 HTML 里、返回真实的 HTTP 状态码、至少提供 MCP 服务器或 CLI 之一。

3. Stanford CS 329Z lecture 9: how to choose an optimization method for agent systems: Assumes you have data, a system and evaluation metrics. Start with cheap, sample-efficient context optimization (few-shot selection and ordering, DSPy/MIPROv2, TextGrad, GEPA); when that isn’t enough, you want to distill capability into a smaller model, or prompts keep growing, change the weights (SFT on teacher trajectories, GRPO reinforcement learning, on-policy distillation); agents can also optimize themselves (Darwin Gödel Machine, Meta-Harness, karpathy’s autoresearch), but then the evaluation metric itself most needs control to prevent gaming. BetterTogether finds that sometimes the best order is prompt tuning, then weight tuning, then prompt tuning again. Lecture PDF available for download. web.stanford.edu/class/cs329z/slides/l… ｜ X @shao__meng
   4

   Stanford CS 329Z 第 9 讲：agent 系统优化方法怎么选：前提是数据、系统、评估指标三样都有。先做便宜、省样本的上下文优化（少样本示例挑选与排序、DSPy/MIPROv2、TextGrad、GEPA）；上下文优化不够、想把能力蒸馏到小模型、或 prompt 越写越长时，再改权重（教师模型的轨迹做 SFT、GRPO 强化学习、on-policy 蒸馏）；也可以让 agent 自己做优化（Darwin Gödel Machine、Meta-Harness、karpathy 的 autoresearch），但这时最需要把控的是评估指标本身，防止它钻空子。BetterTogether 的结论是，有时最好的顺序是先调 prompt、再调权重、最后再调一次 prompt。讲义 PDF 可直接下载。

4. Scan skills others share with NVIDIA SkillSpector before installing them: An open-source scanner NVIDIA uses before listing skills in its own catalog (Apache 2.0, open-sourced in March, now 20k+ stars, recommended again on X today). It checks 17 categories and 71 attack patterns, including prompt injection, data exfiltration, privilege escalation and poisoned MCP tools, gives each skill a 0–100 risk score with recommendations, supports Claude Code, Codex and Gemini CLI skills, and scans GitHub repos, URLs, zips or local directories. Install with uv tool install git+https://github.com/NVIDIA/skillspector.git, then run skillspector scan ./the-skill/ --no-llm for a quick scan without model calls, and enable the AI deep review when needed. The analysis cited in the original post: 26.1% of 31,132 agent skills have vulnerabilities and 5.2% look malicious. GitHub NVIDIA/skillspector ｜ X @RoundtableSpace
   4

   装别人分享的 skill 之前，先用 NVIDIA SkillSpector 扫一遍：这是 NVIDIA 在自家 skill 目录上架前用的开源扫描器（Apache 2.0，今年 3 月开源，现在 2 万多星，今天又在 X 上被推荐）。它检查 17 类、71 种攻击模式，包括提示注入、数据外泄、提权、被投毒的 MCP 工具等，给每个 skill 打 0–100 的风险分并给出建议；支持 Claude Code、Codex、Gemini CLI 的 skill，可以扫 GitHub 仓库、URL、zip 包或本地目录。用法是 uv tool install git+https://github.com/NVIDIA/skillspector.git 安装，再运行 skillspector scan ./the-skill/ --no-llm 做不调用模型的快速扫描，需要时再开 AI 深度审查。原帖引用的分析是：31,132 个 agent skill 里 26.1% 有漏洞、5.2% 疑似恶意。

AI Hot Topics

1. Microsoft Research: humans directing AI agents explore 100+ ideas and prove the 31-year-old KLS conjecture: The Kannan–Lovász–Simonovits conjecture (1995) asks whether the best hyperplane cut of a high-dimensional log-concave distribution is within a dimension-independent constant of the best cut of any shape, which determines how fast random-walk sampling in high dimensions can be. Microsoft Research’s Xinzhi Zhang and Zhao Song give a constant bound; per the Microsoft blog, AI agents under researcher direction explored over 100 candidate routes, ran derivations, helped draft and cross-check, while the researchers did the selection, pruning and final argument. Bizeul, Klartag and Lehec have posted an independent proof on arXiv based on the same criterion, and a Lean formalization exists. Another hard-core case of “AI as research assistant, human at the wheel”. microsoft.com/en-us/research/blog/s… ｜ arxiv.org/abs/2610.05474 ｜ X @rohanpaul_ai
   3

   微软研究院：人类指挥 AI agent 探索 100 多条思路，证明 31 年悬而未决的 KLS 猜想：Kannan–Lovász–Simonovits 猜想（1995 年提出）问的是高维对数凹分布里「最好的平面切割」是否总和「最好的任意形状切割」只差一个与维数无关的常数，它决定了高维随机游走采样能有多快。微软研究院的 Xinzhi Zhang 与 Zhao Song 给出了常数界；按微软博客的说法，AI agent 在研究者指挥下探索了 100 多条候选路线、做推导、帮写稿和内部检查，研究者负责筛选、剪枝和最终论证。Bizeul、Klartag、Lehec 已在 arXiv 发了基于这一判据的独立证明，也有人做了 Lean 形式化。这是「AI 当研究助手、人类掌舵」的又一个硬核案例。

2. iFlytek launches the device-cloud Spark X2.6 and open-sources an on-device 4B model: The flagship X2.6 is a 293B-total / 30B-active MoE with 1M context, which iFlytek says was trained entirely on domestic compute, aimed at coding and agents; API is 40% off for a limited time (¥0.9 input, ¥3.6 output per million tokens). The on-device Spark-X2.6-4B is on Hugging Face, ModelScope and Ollama (ollama run SparkLLM/Spark-X2.6-4B) with three reasoning modes; the launch demoed contract redaction on-device with cloud review afterwards. Worth a try if you want small local-model agents.

   3

   讯飞发布端云一体星火 X2.6，并开源端侧 4B 模型：旗舰 X2.6 是 293B 总参数、30B 激活的 MoE，上下文扩到 1M，讯飞称基于全国产算力训练，主打代码和智能体能力；API 限时 6 折，输入 0.9 元、输出 3.6 元每百万 token。端侧 Spark-X2.6-4B 已上 Hugging Face、ModelScope 和 Ollama（ollama run SparkLLM/Spark-X2.6-4B），新增三档推理模式；发布会演示了端侧本地做合同脱敏、云端再审核的分工。想在本地跑小模型 agent 的可以试试。ithome.com/1/016/403.htm ｜ huggingface.co/XHToken ｜ X @logang2008
3. Ant Group Ling-3.1-flash-1019: Artificial Analysis Intelligence Index up from 41 to 44: The gains are mainly in agent tasks: AA-Briefcase from about 1400 to 1524 Elo, AutomationBench-AA from 62% to 68%; the API and open weights are said to be coming soon. Chinese open MoE models keep closing in on office-automation agent evals. X @AntLingAGI
   3

   蚂蚁 Ling-3.1-flash-1019：Artificial Analysis 智能指数从 41 升到 44：主要进步在 agent 任务，AA-Briefcase 从约 1400 升到 1524 Elo，AutomationBench-AA 从 62% 升到 68%；官方说 API 和开源权重即将放出。国产开源 MoE 在办公自动化类 agent 评测上继续追近。

4. Amp supports self-hosted orbs (cloud agent runtime environments), free for individuals and teams: Run amp orb provider ./dispatch.sh on your own infrastructure and Amp forwards create/pause/delete requests to your dispatch script; official examples cover Docker, E2B, K8s (Helm), Apple container, Modal, Vercel, Daytona and exe.dev. Machines must start fast, hibernate/resume and scale to zero. Aimed at enterprises whose code can’t leave the network or that need special hardware; Enterprise bills at standard orb prices from October 29. Worth a look for teams putting cloud coding agents inside their own network. ampcode.com/news/self-hosted-orbs ｜ X @thorstenball
   4

   Amp 支持自托管 orb（云端 agent 运行环境），个人和团队免费：在自己的基础设施里运行 amp orb provider ./dispatch.sh，Amp 把创建、暂停、删除 orb 的请求转给你写的调度脚本，官方给了 Docker、E2B、K8s（Helm）、Apple container、Modal、Vercel、Daytona、exe.dev 的示例；要求机器启动快、能休眠恢复、能缩到零。主要面向代码不能出内网或需要特殊硬件的企业，企业版 10 月 29 日起按标准 orb 价格计费。想把云端编码 agent 放进自家网络的团队值得看看这套接口设计。

5. Breken launches: it “breaks” your software first in a simulated production environment: It rebuilds a production-like environment on its own machines, accelerates data and user activity up to 4000x, injects faults such as disconnects, and tries to fix the problems it finds. An X news digest says it caught 32% of real bugs across 235 open-source projects versus under 16% for top models prompted directly (company-reported). The original post has 1.17M views and 1,700+ bookmarks, one of today’s most discussed dev-tool launches. X @brekenai ｜ breken.ai
   3

   Breken 发布：在模拟的生产环境里替用户先把软件「跑坏」：它在自己的机器上重建接近生产的环境，把数据和用户活动加速最多 4000 倍，再注入断连等故障，找到问题后还会尝试修复；X 新闻摘要提到它在 235 个开源项目真实 bug 上抓到 32%，而顶级模型直接找只有 16% 以下（这是公司自报数据）。原帖 117 万浏览、1700 多收藏，是今天讨论最多的开发工具发布之一。

Tips & Hands-on

1. Matt Pocock’s prompt of the day: /grill-me on how a /software-factory might help us: His /grill-me skill keeps questioning you, and a new software-factory skill helps decide whether a “software factory” (automatically triggered agent pipelines) is useful for your team and what infrastructure it needs. The skill breaks the concept into tasks, triggers, runs and executors, plus slots for ticketing, Git hosting, orchestrator and observability, and advises “slow first, then fast”: every trigger is an accelerator, with automated checks, automated review and human review as the brakes. 1,200+ bookmarks on the original post. X @mattpocockuk ｜ GitHub mattpocock/skills
   4

   Matt Pocock 的今日提示词：/grill-me on how a /software-factory might help us：用他的 /grill-me 技能反复追问，配合新写的 software-factory 技能，帮你判断「软件工厂」（自动触发的 agent 流水线）对团队是否有用，并梳理需要的基础设施。这个技能把概念拆成任务、触发器、运行、执行器，以及工单系统、Git 托管、编排器、可观测平台几个槽位，建议「先慢后快」：每个触发器都是加速器，刹车是自动检查、自动审查和人工审查。原帖 1200 多收藏。

2. Coding-agent sandboxes come in three layers, and what belongs inside: Paul Iusztin implemented sandboxing in Decode, a coding agent he wrote from scratch. Layer one is OS-level sandboxing (macOS Seatbelt, Linux Bubblewrap) sharing the host kernel; layer two is a user-space kernel such as gVisor that intercepts syscalls; layer three is microVMs such as Firecracker with their own kernel, the strongest isolation. His advice: keep the harness local and put only Bash, Read, Write and Edit in the same sandbox so they see one filesystem; Decode uses one executor interface for local, Docker and Modal remote sandboxes. X @pauliusztin_
   4

   编码 agent 的沙箱分三层，以及该把什么放进沙箱：Paul Iusztin 在自己从零写的编码 agent Decode 里实现了沙箱：第一层是系统级沙箱（macOS 的 Seatbelt、Linux 的 Bubblewrap），共享宿主内核；第二层是 gVisor 这类用户态内核，拦截系统调用；第三层是 Firecracker 等 microVM，有独立内核，隔离最强。他的建议是 harness 留在本地，只把 Bash、Read、Write、Edit 这些工具放进同一个沙箱，保证它们看到同一个文件系统；Decode 用一个执行器接口同时支持本地、Docker 和 Modal 远程沙箱。

3. Peter Yang tests Claude Duet: the most proactive, but its “hands and feet” are incomplete: By default Duet checks in every three hours from 9am to 10pm, going through email and calendar for things it can handle; he finds five a day too many. He had Duet read 33 emails and 89 Slack messages to write a personal writing-style guide, then reply to emails. Shortfalls: it got stuck on Uber’s human verification, users can’t see or touch its cloud browser, and local personal skills can’t be added. He compares Duet with Grok Bot, Muse and ChatGPT Dots. Mai Yang added Chinese and English subtitles and timestamped excerpts.

   3

   Peter Yang 实测 Claude Duet：最主动，但「手脚」还不全：Duet 默认从早 9 点到晚 10 点每三小时自动 check-in，翻邮箱和日历找能代办的事，他觉得一天五次偏多；他先让 Duet 读了自己 33 封邮件、89 条 Slack 消息等写出个人写作风格指南，再让它代回邮件。短板是叫 Uber 卡在人机验证，用户看不到也碰不到它的云端浏览器，本地个人 skill 也加不进去。他把 Duet 和 Grok Bot、Muse、ChatGPT Dots 做了对比。Mai Yang 配了中英字幕和时间点摘录。X @MaiYangAI
4. Don’t rush to play with new models today; check your dependencies first: Philipp Schmid warns that anyone using Railway, LiteLLM, PHP, GitLab or Node (brotli) should check their environment “even if you think you’re not affected”, with a prompt and links for agents to run the check. It maps to today’s LiteLLM poisoning, PHP2Shell, a critical GitLab vulnerability, a Railway environment-variable leak and Node security updates; you can hand the prompt to a coding agent to run. X @_philschmid
   4

   今天先别忙着玩新模型，检查一遍依赖：Philipp Schmid 提醒，用 Railway、LiteLLM、PHP、GitLab、Node（brotli）的都要检查环境，「即使你觉得自己没受影响」，并附上给 agent 用的排查提示词和链接。对应今天的 LiteLLM 投毒、PHP2Shell、GitLab 高危漏洞、Railway 环境变量泄露和 Node 安全更新，可以直接把提示词交给编码 agent 跑一遍。

新产品 / 开源

1. DuckDB 2.0.0 LTS “Cinnamon Teal”: the biggest feature release of DuckDB so far, nearly 20,000 commits since 1.5, supported until at least October 2027. Highlights include the polished Quack protocol and a new CONNECT statement (DuckDB can run client-server style), async I/O, a first-class VARIANT type, triggers and an extensible SQL parser. Most interesting for agent builders is the CLI’s agent mode: when it detects a caller such as Claude Code, Codex or Cursor, it switches to compact Markdown tables, states explicitly when results are truncated, terminates runaway queries early, returns errors as JSON, and reports estimated cost before long queries; on TPC-H the company measured 59% less output for the model to read, and you can switch manually with -agent and -no-agent. DuckDB 博客 ｜ HN 讨论
   4

   DuckDB 2.0.0 LTS「Cinnamon Teal」：这是 DuckDB 迄今最大的功能版本，距 1.5 有近 2 万次提交，支持到至少 2027 年 10 月。亮点包括打磨后的 Quack 协议和新的 CONNECT 语句（DuckDB 可以按客户端-服务器方式跑）、异步 I/O、一等公民的 VARIANT 类型、触发器和可扩展的 SQL 解析器。对写 agent 的人最有意思的是 CLI 的 agent 模式：检测到是 Claude Code、Codex、Cursor 这类 agent 在调用时，会改输出紧凑的 Markdown 表格、明确说明结果被截断、提前终止失控查询、错误以 JSON 返回，长查询还会先报预计开销；官方在 TPC-H 上测，模型要读的输出少了 59%，也可以用 -agent、-no-agent 手动切换。

2. Opposable: a 2B computer-use model that runs locally on your phone (Show HN): an Android app that reads the screen through accessibility services and taps and types in other apps; Claude, ChatGPT and Codex on a computer can drive it remotely, and when not connected it completes tasks itself with GUI-Owl 1.5 2B on the phone (fine-tuned by Alibaba’s Mobile-Agent team from Qwen3-VL, 4-bit quantized on llama.cpp). One step takes about 7.3 seconds on a Mac M2 CPU, half of it in the vision encoder; on a Galaxy S25’s NPU encoding takes only 236 ms. About 40 common tasks such as setting alarms and sending texts go through fixed code, not the model. Blog ｜ HN discussion (someone asks why not just use ADB)
   3

   Opposable：在手机上本地跑的 2B computer-use 模型（Show HN）：这是一个 Android 应用，通过无障碍服务读屏幕、在其他 App 里点击和输入；电脑上的 Claude、ChatGPT、Codex 可以远程驱动它，没连上时就用手机上的 GUI-Owl 1.5 2B（阿里 Mobile-Agent 团队基于 Qwen3-VL 微调，4 bit 量化跑在 llama.cpp 上）自己完成。在 Mac M2 CPU 上一步约 7.3 秒，其中一半花在视觉编码器上，换到 Galaxy S25 的 NPU，编码只要 236ms。设闹钟、发短信这类约 40 个常见任务直接走固定代码，不经过模型。博客 ｜ HN 讨论（有人问为什么不直接用 ADB）

3. Omnara: an open-source, self-hostable managed-agent platform (Show HN): positioned as an open alternative to Claude Managed Agents and the OpenAI Agents API, running agents on any model and any machine with one API, with tools, secrets, permissions and streaming output built in, Apache 2.0, a Go backend, and a cloud version too. Worth a look for teams that don’t want to tie their agent runtime to one vendor. GitHub ｜ HN 讨论
   3

   Omnara：开源、可自托管的托管 agent 平台（Show HN）：定位是 Claude Managed Agents 和 OpenAI Agents API 的开源替代，用一套 API 在任意模型、任意机器上跑 agent，工具、密钥、权限和流式输出都内置，Apache 2.0 协议，后端是 Go，也有云服务版。不想把 agent 运行时绑在某一家厂商上的团队可以看看。

4. graphify: turn a codebase into a queryable knowledge graph for coding agents: gained 1,400+ stars on GitHub Trending today. Type /graphify in Claude Code, Cursor, Codex or Gemini CLI and it parses the code AST locally with tree-sitter to build the graph (no LLM calls, code never leaves your machine), then uses your model for a semantic pass over docs, PDFs and images; every edge is labeled as either explicit in the source (EXTRACTED) or inferred (INFERRED), so the agent queries the graph instead of grepping around. GitHub
   3

   graphify：把代码库变成可查询的知识图谱，给 coding agent 用：今天 GitHub Trending 涨了 1,400 多星。在 Claude Code、Cursor、Codex、Gemini CLI 里输入 /graphify，它会用 tree-sitter 在本地解析代码 AST 建图（不调用 LLM，代码不出本机），文档、PDF、图片再用你的模型做一轮语义补充；每条边都标明是源码里明确写的（EXTRACTED）还是推断出来的（INFERRED），让 agent 查图而不是到处 grep。

5. Google publishes its Rust style guide: the conventions for writing Rust inside Google (including Chrome), such as preferring small crates, no glob imports, avoiding Rc and Arc where possible, borrowing instead of deep-copying, using enums instead of bools in APIs, and how to choose between newtypes and type aliases. A direct reference when your team sets Rust standards or you want to write coding rules for an agent. Google Style Guides ｜ HN 讨论
   3

   Google 公开 Rust 风格指南：内容是 Google 内部（含 Chrome）写 Rust 的约定，比如优先拆小 crate、不用 glob import、尽量避免 Rc 和 Arc、能借用就别深拷贝、API 里用 enum 代替 bool、newtype 和类型别名怎么选等。团队要定 Rust 规范、或者想给 agent 写编码规则时可以直接参考。

Tech News

1. LiteLLM 1.107.0 poisoned on PyPI: installing it steals credentials and leaves a backdoor: per SafeDep’s analysis, all 7 wheels of this version install three extra files; cook.pth makes any Python process on the host run an info-stealing script at startup (even if litellm is never imported), collecting SSH keys, cloud credentials, CI/CD secrets, browser passwords, model keys in the LiteLLM proxy database, and configs of AI tools such as Claude Code, Cursor and Codex; sitecustomize.py then starts a backdoor that fetches and runs code every hour. The source on GitHub contains none of this, and SafeDep concludes BerriAI’s private release pipeline built these wheels from tampered source. PyPI has pulled the version; 1.106.2 and the two rcs are clean. Treat any machine that installed it as having leaked all credentials and rotate them. SafeDep ｜ HN discussion (the most-voted suggestion is for uv and npm to default to a 24–48 hour cooldown for new versions)
   5

   LiteLLM 1.107.0 在 PyPI 上被投毒，装了就会偷凭据并留后门：SafeDep 分析，这个版本的 7 个 wheel 都多装了三个文件，其中 cook.pth 会让主机上任何 Python 进程启动时都运行窃密脚本（哪怕根本没 import litellm），收集 SSH 密钥、云凭据、CI/CD 密钥、浏览器密码、LiteLLM 代理数据库里的模型 key，以及 Claude Code、Cursor、Codex 等 AI 工具的配置；sitecustomize.py 再起一个每小时联网拉代码执行的后门。GitHub 上的源码里没有这些东西，SafeDep 判断是 BerriAI 的私有发布流水线从被篡改的源码构建了这批 wheel。PyPI 已下架该版本，1.106.2 和两个 rc 是干净的。装过的机器应当按凭据全部泄露处理并轮换。SafeDep ｜ HN 讨论（呼声最高的建议是让 uv、npm 默认对新版本设 24–48 小时冷却期）

2. PHP patches are out: 8.5.12, 8.4.27, 8.3.36, 8.2.35, upgrade now: the PHP Foundation explains the cause of the two vulnerabilities. CVE-2026-109618 is a request hitting memory_limit at exactly the wrong moment, leaving PHP with half-initialized internal data that it then treats as valid; on Apache + mod_php an unauthenticated request can trigger it before application code runs, full RCE was demonstrated in the default configuration, and RCE was also confirmed on PHP-FPM through application code paths. CVE-2026-109619 is a fatal error leaving internal state pointing at the previous request’s memory, causing use-after-free. The OOM issue showed signs during an external audit in 2024, but every fix carries a compatibility cost, hence the delay. Meanwhile Elias Taylor posted a reminder that thousands of “PoCs” on GitHub don’t run on stock PHP, many depend on prerequisites like local file inclusion, and were confidently invented by LLMs; don’t panic and change things at random, but do still upgrade. AWS also published security bulletins for its managed runtimes. PHP Foundation ｜ Elias Taylor ｜ AWS bulletin ｜ HN discussion ｜ HN: PHP 8.2.35 (comments grumble that Ubuntu’s packages and the official Docker images lagged by over two hours, while Debian updated almost instantly)
   5

   PHP 补丁已发布：8.5.12、8.4.27、8.3.36、8.2.35，赶紧升级：PHP 基金会解释了两个漏洞的成因。CVE-2026-109618 是请求恰好在错误时刻触到 memory_limit，PHP 留下半初始化的内部数据并当作有效数据使用；在 Apache + mod_php 上，未认证请求在应用代码执行前就能触发，默认配置下已演示完整 RCE，PHP-FPM 上也通过应用代码路径确认了 RCE。CVE-2026-109619 是致命错误让内部状态指向上一个请求的内存，形成 use-after-free。这个 OOM 问题 2024 年外部审计时就露过苗头，但修法每种都有兼容性代价，才拖到现在。另一边，Elias Taylor 发文提醒，GitHub 上上千个「PoC」在原版 PHP 上都跑不起来，很多依赖本地文件包含这种前提，是 LLM 自信编出来的，别被吓到乱改，但该升级还是要升级。AWS 也发了各托管运行时的安全公告。PHP 基金会 ｜ Elias Taylor ｜ AWS 公告 ｜ HN 讨论 ｜ HN：PHP 8.2.35（评论在吐槽 Ubuntu 的包和官方 Docker 镜像晚了两个多小时才跟上，Debian 几乎是秒更）

3. GitLab emergency patch: CVSS 10.0, unauthenticated code execution on self-hosted servers, all versions since 7.0 affected: CVE-2026-110264 is an integer overflow in the regex compiler, and an attacker can execute arbitrary code with a crafted regex. Fixed versions are 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10 and 18.11.13; GitLab.com is already fixed. The vendor also provides two detection rules (Onigmo native worker crashes, surges in Org mode rendering errors) to check whether it has been exploited. The same release fixes 11 other issues including account takeover through OmniAuth and LDAP auto-linking. If you self-host GitLab, upgrade today. GitLab 公告 ｜ HN 讨论
   5

   GitLab 紧急补丁：CVSS 10.0，未认证就能在自建服务器上执行代码，7.0 以来的版本全受影响：CVE-2026-110264 是正则编译器里的整数溢出，攻击者构造特殊正则就能执行任意代码。修复版本是 19.5.1、19.4.3、19.3.6、19.2.9、19.1.9、19.0.10、18.11.13，GitLab.com 已经修好。官方还给了两条检测规则（Onigmo 原生 worker 崩溃、Org mode 渲染错误激增）用来排查是否已被利用。同一批还修了 OmniAuth 与 LDAP 自动关联导致的账号接管等 11 个问题。自建 GitLab 的今天就要升。

4. Railway discloses: customer environment variables may have been read, some decrypted: Railway found anomalous access to the system storing customer environment variables; the attacker may have obtained encrypted variables, some in plaintext. The company believes it is one of a recent series of attacks on platform companies aimed at obtaining keys for AI inference providers, and has notified upstream inference vendors to proactively revoke keys. All deployments are paused; all users are advised to immediately rotate every environment variable, API key and private registry credential in Railway and check logs; guidance on checking for anomalous GCP and AWS access was added later. Railway blog ｜ HN discussion (comments link PHP, the eMudhra certificates and Railway together and worry every day will be like this from now on)
   4

   Railway 披露：客户环境变量可能被读走，部分已被解密：Railway 发现存放客户环境变量的系统有异常访问，攻击方可能拿到了加密的环境变量，其中一部分拿到了明文。官方认为这是最近一连串针对平台公司、意在拿到 AI 推理服务商 key 的攻击之一，已经通知上游推理厂商主动吊销 key。所有部署暂停，建议所有用户立即轮换 Railway 里的全部环境变量、API key 和私有镜像仓库凭据，并检查日志；之后又补发了排查 GCP、AWS 异常访问的指引。Railway 博客 ｜ HN 讨论（评论把 PHP、eMudhra 证书、Railway 连在一起，担心以后天天都是这种日子）

5. QPACK amplification attack: one connection can blow up an HTTP/3 server’s memory: FoxIO tested 10 HTTP/3 implementations and 7 had problems: QPACK header compression lacks, or too late enforces, a limit on decoded header size, so a tiny HEADERS frame can expand into hundreds of thousands of header objects. quic-go 0.57.0, Cloudflare quiche 0.29.3, lsquic 4.9.0 and Wireshark are fixed; Bun, hyperium’s h3 and aioquic/mitmproxy were unfixed as of 10/20; suggestions: don’t expose HTTP/3 on Bun for now, use --set http3=false for mitmproxy, and set max_field_section_size for h3. IIS, Envoy and ngtcp2/nghttp3 are not affected. FoxIO ｜ HN 讨论
   3

   QPACK 放大攻击：一条连接就能把 HTTP/3 服务器的内存打爆：FoxIO 测了 10 个 HTTP/3 实现，7 个有问题：QPACK 头部压缩缺少或太晚执行解码后头部大小的限制，一个很小的 HEADERS 帧能展开成几十万个头部对象。quic-go 0.57.0、Cloudflare quiche 0.29.3、lsquic 4.9.0、Wireshark 已修；Bun、hyperium 的 h3、aioquic/mitmproxy 截至 10/20 还没修，建议 Bun 先别对外开 HTTP/3、mitmproxy 用 --set http3=false、h3 设置 max_field_section_size。IIS、Envoy、ngtcp2/nghttp3 不受影响。

Chinese Community

1. V2EX: “I’m the only tech person at my company and all our projects run on PHP 7”: the poster works in cross-border e-commerce with very old OpenCart and WordPress versions and heavy traffic, and asks how to stop the bleeding quickly. The practical advice in replies is to first put up Cloudflare WAF rules (CF has already deployed targeted rules), or build your own WAF if not using CF; one person collects attack logs on an overseas machine and has AI analyze them before tuning rules. Many small and mid-size companies are in this situation, so check whether you have unmanaged old PHP services too.

   3

   V2EX：「公司就我一个技术，所有项目都跑在 PHP 7 上」：楼主做跨境电商，OpenCart 和 WordPress 版本都很老、流量又大，问怎么快速止损。回复里比较实际的思路是先上 Cloudflare 的 WAF 规则挡一挡（CF 已经部署了针对性规则），不用 CF 就自建 WAF，有人在海外机器上收集攻击日志、交给 AI 分析后再调规则。很多中小公司都是这种处境，可以对照看看自己手里有没有没人管的老 PHP 服务。V2EX ｜ Cloudflare：php2shell 防护

2. LinuxDo: CVEs are getting denser, can an agent auto-patrol all servers?: the poster has many servers and for things like PHP can only have AI fix them one by one; he wants an agent that wakes on public security events: first judge whether his services have the affected components (skip if there’s no PHP at all), then check the attack surface, and send conclusions to a human for approval. Replies point out that “threat-intel feed” services have long been available to buy, and CVEs have aggregated sources like cve.org and GitHub advisories to plug into. At the same time another thread discusses OpenAI’s newly issued distribution-partner rules, which people read as meaning relay stations must manage their users per channel or risk being banned wholesale.

   3

   LinuxDo：CVE 越来越密集，能不能让 agent 自动巡检所有服务器：楼主手上服务器很多，PHP 这波只能让 AI 一台台去修，想做一个出现公共安全事件就自动唤醒的 agent：先判断自己的服务有没有相关组件（比如压根没 PHP 就跳过），再检查攻击面，把结论发给人审批。回复指出业内早有「威胁情报推送」服务可以买，CVE 也有 cve.org 和 GitHub 公告这类聚合源可以接。同一时间另一帖在讨论 OpenAI 新发的分发合作规范，大家理解为中转站需要按渠道管好用户，否则可能被整体封禁。LinuxDo：CVE 自动巡检 ｜ LinuxDo：OpenAI 使用政策

3. V2EX hot post: why do vibe-coded pages feel so AI-ish?: the poster listed purple, odd gradients, card overload, big blocks of text crammed into cards, and uniform line icons in rounded squares, and then in 140+ replies everyone posted their own site and was told it felt very AI-ish. The fairest view is that taste has little to do with which model is used; good-looking sites are basically ones the author polished with care, with restrained content and proofread copy. Those doing frontend or having agents write UI can use these points as a negative checklist.

   3

   V2EX 热帖：为什么大家 vibe 出来的网页 AI 味那么重：楼主列了紫色、怪渐变、卡片泛滥、大段文字塞满卡片、统一的线性图标配圆角方块这几个特征，结果 140 多条回复里每个人贴出自己的站，都被别人说 AI 味很重。比较中肯的意见是审美和用哪个模型关系不大，好看的站基本是作者自己花心思打磨过的，内容要克制、文案要校对。做前端或者让 agent 写 UI 的人可以拿这几条当反面清单。V2EX

New Products

1. 1Password for Agents: let an AI agent log in to accounts without seeing the password: when an agent reaches a login page it first proves its identity to 1Password with its own digital key; on your own device you see which account it wants and why, and after you approve, 1Password fills the credentials straight into the form, so the password is never handed to the agent or model, a flow similar to two-factor authentication. First integrations are Meta Muse, Claude Duet, ChatGPT Work and Dots, Grok Bot and Town, with Browserbase, Browser Use, Perplexity, Ramp and others joining. Worth watching if you want a personal agent to handle tasks that need login without pasting passwords into chat. 1Password 新闻稿 ｜ The Verge
   4Product · 1password-for-agents

   1Password for Agents：让 AI agent 登录账号却看不到密码：agent 到了登录页，先用自己的数字密钥向 1Password 证明身份；你在自己设备上看到它要哪个账号、为什么要，批准后由 1Password 直接把凭据填进表单，密码始终不交给 agent 或模型，流程类似二次验证。首批对接 Meta Muse、Claude Duet、ChatGPT Work 和 Dots、Grok Bot、Town，Browserbase、Browser Use、Perplexity、Ramp 等也在接入。想让个人 agent 代办需要登录的事、又不想把密码贴进对话的，可以关注这套授权方式。

2. Claude for Google Workspace: Claude arrives in Docs, Sheets and Slides (public beta): available on all paid plans as a sidebar add-on that reads the current file and your selection and edits it directly: in Docs it edits sentences in place and gives suggestion cards you can apply one by one for bigger changes; in Sheets it writes formulas, builds pivot tables and native charts, and when cleaning data can pull a range into Python, compute, and write back; in Slides it generates new slides in the existing layout and checks for overlapping elements and text overflow. By default it “asks before changing”, and can be switched to “accept all”. There are also new Docs, Sheets and Slides connectors, so you can create and edit Google files from a Claude conversation, with permissions matching your Google sharing permissions. Claude official ｜ HN discussion (some are surprised Google would let a competitor embed this deeply in its products)
   4Product · claude-for-google-workspace

   Claude for Google Workspace：Claude 进驻 Docs、Sheets、Slides（公测）：所有付费版可用，以侧边栏插件的形式出现，能读当前文件和你选中的内容并直接改：Docs 里就地改句子，大改动给出可逐条应用的建议卡片；Sheets 里写公式、做透视表和原生图表，清洗数据时还能把区域拉进 Python 算完再写回；Slides 按现有版式生成新页，并检查元素重叠和文字溢出。默认「改之前先问」，也可切到「全部接受」。另外新出了 Docs、Sheets、Slides 连接器，从 Claude 对话里就能新建和编辑 Google 文件，权限与你的 Google 共享权限一致。Claude 官方 ｜ HN 讨论（有人惊讶 Google 会允许竞争对手这样深度嵌进自家产品）

3. OpenAI’s official CLI is open source: a Go command-line tool for the OpenAI REST API, installed with brew install openai/tools/openai or go install, with commands organized by resource, e.g. openai responses create --input ... --model ..., and an admin key can query organization usage directly; openai help needs no network or key, and image generation has an interactive picker. Suited to calling the API from scripts and CI, and easy to hand to an agent. GitHub ｜ HN discussion (comments ask how it divides work with Codex, and some complain the README doesn’t explain what the tool is for)
   3

   OpenAI 官方 CLI 开源：用 Go 写的 OpenAI REST API 命令行工具，brew install openai/tools/openai 或 go install 安装，命令按资源组织，比如 openai responses create --input ... --model ...，管理员 key 还能直接查组织用量；openai help 不用联网也不用 key，图片生成带交互式选择器。适合在脚本、CI 里调 API，也方便交给 agent 调用。GitHub ｜ HN 讨论（评论在问它和 Codex 怎么分工，也有人吐槽 README 没讲清楚这工具是干嘛的）

4. Resend Inboxes: shared mailboxes for agents: developer email service Resend launches an inbox API: one call gives an app or each agent its own address, with threads to pull and reply to; existing agents can connect via MCP or skill, and you can use natural language to have an agent sort, label and draft replies, triggered by webhooks, with team members able to assign and take over threads. Launched on Product Hunt today. Resend ｜ Product Hunt
   3Product · resend-inboxes

   Resend Inboxes：给 agent 用的共享邮箱：开发者邮件服务 Resend 推出收件箱 API，一次调用就能给应用或每个 agent 开一个专属地址，按会话拉取和回复邮件；现有 agent 可以通过 MCP 或 skill 接入，还能用自然语言让 agent 分拣、打标签、起草回复，由 webhook 触发，团队成员可以分配和接手会话。今天在 Product Hunt 上线。

5. Carbon-X: Hugging Face’s open-source 14B DNA + natural-language model: based on Qwen3-14B, further trained on 302B tokens of mixed DNA, biological text and English, then SFT and GRPO. DNA is encoded at one token per 6 bases and shares a decoder with text, so you paste a sequence into the chat and ask, for example, whether a mutation is benign or pathogenic. Average 66.7% across five DNA benchmarks, close to GPT-6.1 Sol’s 67.5% at about 1/1800 the per-question inference cost; runs with vLLM on a single 80GB GPU, Apache 2.0, with skills bundled for Claude Code and Codex. Hugging Face 模型页 ｜ Techmeme
   3Product · carbon-x

   Carbon-X：Hugging Face 开源的 14B DNA + 自然语言模型：基于 Qwen3-14B，在 302B token 的 DNA、生物文本和英文混合数据上继续训练，再做 SFT 和 GRPO。DNA 按 6 碱基一个 token 编码，和文字共用一个解码器，直接在对话里贴序列提问即可，比如判断突变是良性还是致病。五项 DNA 基准平均 66.7%，接近 GPT-6.1 Sol 的 67.5%，单题推理成本约为其 1/1800；单张 80GB GPU 就能用 vLLM 跑，Apache 2.0 协议，还附带给 Claude Code、Codex 用的 skill。

6. WorldTUI: a 360M small model “pretending” to be a terminal: the author fine-tuned Qwen2.5-Coder-0.5B on 336,000 real terminal sessions recorded in Docker; behind it there is no shell and no filesystem, and on every keystroke the model predicts how the screen changes; it can run vim, tmux and snake, and roughly remembers files written several commands earlier. Key tricks: a COPY operation to represent scrolling, parallel per-line decoding with sequential verification (p95 latency on large screens from 6.7 s to 0.87 s), and teaching the model to correct its own earlier mistakes. After trimming the vocabulary and quantizing to int4 it is only 208MB, and you can try it in the browser via WebGPU. Author’s blog ｜ HN discussion (337 points; some are reminded of Microsoft’s project simulating Quake II with a model)
   3Product · worldtui

   WorldTUI：一个 360M 小模型「假装」自己是终端：作者用 Docker 里录下的 33.6 万段真实终端会话微调 Qwen2.5-Coder-0.5B，背后没有 shell 也没有文件系统，每按一次键，模型就预测屏幕要怎么变，能跑 vim、tmux、贪吃蛇，还大致记得几条命令前写过的文件。几个关键技巧：用 COPY 操作表示滚屏，按行并行解码再顺序校验（大画面 p95 延迟从 6.7 秒降到 0.87 秒），以及让模型学着修正自己之前的错误。裁掉词表后量化成 int4 只有 208MB，可以用 WebGPU 在浏览器里试。作者博客 ｜ HN 讨论（337 分。有人联想到微软那个用模型模拟 Quake II 的项目）

Tech News

1. Amazon: PHP2Shell was exploited on October 17, four days before official disclosure: Amazon Threat Intelligence’s MadPot honeypots recorded exploitation attempts from anonymizing networks as early as 10/17, and before the 10/21 embargo lifted several different sources’ payloads appeared; new PoCs emerged within hours of the patch, and it is now mass in-the-wild exploitation. CISO CJ Moses advises: start the investigation timeline from 10/17, not the announcement date; patch windows for severe internet-facing vulnerabilities should be counted in hours; if you can’t upgrade yet, consider blocking multipart uploads and checking for POST requests with PHP_SESSION_UPLOAD_PROGRESS in the form. Meanwhile, the HN user who had leaked the bug early posted an apology, saying he didn’t know there was an embargo. AWS Security Blog ｜ HN discussion (some complain Amazon Linux’s PHP package was updated only 18 hours after the patch) HN：泄露者道歉
   4

   亚马逊：PHP2Shell 在 10 月 17 日、官方披露前四天就已被利用：亚马逊威胁情报的 MadPot 蜜罐在 10/17 就记录到来自匿名网络的利用尝试，10/21 解禁前还出现了多组不同来源的 payload；补丁发布后几小时内又冒出新的 PoC，现在已是大规模在野利用。CISO CJ Moses 的建议是：调查时间线从 10/17 开始算，不要从公告日算；面向公网的严重漏洞，修补时限要按小时计；暂时不能升级的，可以考虑屏蔽 multipart 上传，并排查表单里带 PHP_SESSION_UPLOAD_PROGRESS 的 POST 请求。另一边，之前在 HN 提前透露漏洞的网友发帖道歉，说当时不知道还有禁运期。AWS 安全博客 ｜ HN 讨论（有人吐槽 Amazon Linux 的 PHP 包在补丁发布 18 小时后才更新） ｜

2. Several high-severity Linux kernel bugs mistakenly posted to a public mailing list: Trend Micro’s ZDI sent a batch of vulnerability reports to the public LKML instead of the private security list, and Greg Kroah-Hartman replied to them one by one with questions. Among them, an SMB Direct integer underflow leading to remote code execution and a KSMBD race leading to remote code execution are both CVSS 9.0, plus local privilege escalations from skb_zerocopy and a vmwgfx out-of-bounds write, and an NVMET information leak. Mainline has no fixes yet; some patches are still in testing or queued in -next. If you have in-kernel ksmbd on, turn it off for now and wait for patches. Phoronix ｜ HN 讨论
   4

   Linux 内核几个高危漏洞被误发到公开邮件列表：Trend Micro 的 ZDI 把一批漏洞报告发到了公开的 LKML，没有走私密的安全列表，Greg Kroah-Hartman 逐条回复询问。其中 SMB Direct 整数下溢导致远程代码执行、KSMBD 竞态导致远程代码执行这两个都是 CVSS 9.0，另有 skb_zerocopy、vmwgfx 越界写的本地提权和 NVMET 信息泄露。目前主线还没有修复，部分补丁还在测试或排在 -next 分支里。开着内核 ksmbd 的机器建议先关掉，等补丁。

3. Oracle issues a Java SE security alert: JSSE vulnerability, CVSS 9.1, remotely exploitable without authentication: CVE-2026-91403 is in the Java Secure Socket Extension (JSSE), low attack complexity, needs no privileges or user interaction, and can be triggered through web services that call the relevant APIs, severely affecting confidentiality and integrity. Affected: Java SE 8u511, 11.0.33, 17.0.21, 21.0.13, 25.0.5, 27.0.1, GraalVM for JDK 17.0.21 and 21.0.13, and GraalVM Enterprise 21.3.20. Teams running Java services should schedule upgrades soon.

   4

   Oracle 发布 Java SE 安全警报：JSSE 漏洞 CVSS 9.1，无需认证即可远程利用：CVE-2026-91403 出在 Java 安全套接字扩展（JSSE）里，攻击复杂度低，不需要权限也不需要用户交互，通过调用相关 API 的 Web 服务就能触发，会严重影响机密性和完整性。受影响的有 Java SE 8u511、11.0.33、17.0.21、21.0.13、25.0.5、27.0.1，GraalVM for JDK 17.0.21 和 21.0.13，以及 GraalVM Enterprise 21.3.20。跑 Java 服务的团队要尽快排期升级。IT之家
4. eMudhra certificate incident follow-up: command-line tools and macOS’s bundled curl and git need handling too: the discoverer built a check page, we-have-a-problem.com; if curl https://dv-g3b-emudhra.we-have-a-problem.com/ reports a certificate error, your client already distrusts these CAs. The page lists fixed versions: Claude Code 2.1.303, uv 0.13.4, pip 26.2.2, Node.js 22.23.4, 24.22.1, 26.12.1, Docker Desktop 4.96.2, Deno 2.9.8 and more; Bun isn’t fixed yet. macOS itself already blocks it, but the bundled curl, git and python3 use /etc/ssl/cert.pem, which doesn’t check revocation, so you need to manually remove the affected root certificates with the commands on the page. The issue has been assigned CVE-2026-111943, and eMudhra has also announced it is exiting the global SSL/TLS certificate business. 检查与修复指南 ｜ HN：CVE-2026-111943 ｜ HN：eMudhra 退出 TLS 业务
   4

   eMudhra 证书事件后续：命令行工具和 macOS 自带的 curl、git 也要处理：发现者做了个检查页 we-have-a-problem.com，用 curl https://dv-g3b-emudhra.we-have-a-problem.com/ 报证书错误，就说明你的客户端已经不信任这批 CA 了。页面列出已修复的版本：Claude Code 2.1.303、uv 0.13.4、pip 26.2.2、Node.js 22.23.4、24.22.1、26.12.1、Docker Desktop 4.96.2、Deno 2.9.8 等，Bun 还没修。macOS 系统虽然已经拦截，但自带的 curl、git、python3 用的是 /etc/ssl/cert.pem，不检查吊销，需要按页面上的命令手动剔除受影响的根证书。该漏洞已编号 CVE-2026-111943，eMudhra 也宣布退出全球 SSL/TLS 证书业务。

5. 333 Tor exit nodes hijacked to intercept SSH and plaintext email: attackers got into Tor’s management server with a reused password, installed the Linux backdoor Ebury, and spread to other servers. Between October 2 and 5, the controlled exit nodes redirected port-22 SSH traffic to 12 interception servers; if users ignored the “host key changed” warning and typed their password, it was stolen and the server was implanted with Ebury; the nodes also blocked encrypted-mail ports to force clients to downgrade to plaintext. The lesson is plain: disable SSH password login and use keys only, and accept only encrypted connections for email. Ars Technica
   3

   333 个 Tor 出口节点被劫持，专门截 SSH 和明文邮件：攻击者先用一个被重复使用的密码进了 Tor 的管理服务器，装上 Linux 后门 Ebury，再扩散到其他服务器。10 月 2 日到 5 日之间，被控制的出口节点把 22 端口的 SSH 流量转到 12 台拦截服务器上，用户如果无视「主机密钥已变化」的警告继续输入密码，密码就会被偷走，服务器还会被植入 Ebury；同时这些节点屏蔽加密邮件端口，逼客户端降级成明文。教训很朴素：SSH 关掉密码登录、只用密钥，邮箱只接受加密连接。

Chinese Community

1. Juejin: spot-checking 60,000 Skills, the top-ranked ones are almost never the real thing: the author found a Skills directory grew from 1,400 to 63,000+ in three and a half months, but of the top 20 by installs only four or five really have a SKILL.md and count as a Skill; the rest are full apps, prompt collections, MCP servers, or even the Claude Code CLI itself. He tested a code-reviewer from a 33k-star repo: its three “core scripts” are the same file renamed, and run against a file with a deliberate innerHTML XSS the result was 0 findings and a green check. His heuristics: Features should name specific stacks and checks, every script in the scripts directory should have distinct logic, and install counts should be looked at on verifiable curated marketplaces; the article also includes a 50-line Node script, skill-xray, which uses structural fingerprints to spot scripts copied from one template.

   3

   掘金：抽查了 6 万个 Skills，排名靠前的几乎没有真货：作者发现 Skills 收录站三个半月从 1400 个涨到 63000 多个，但按装机量排的前 20 里，真正带 SKILL.md、能算 Skill 的只有四五个，其余是完整应用、提示词合集、MCP 服务器，甚至是 Claude Code 的 CLI 本体。他拿一个 3.3 万星仓库里的 code-reviewer 来测：三个「核心脚本」其实是同一份文件改了名，对着一个故意写了 innerHTML XSS 的文件跑，结果是 0 findings 外加一个绿勾。他给的判断方法：Features 要写到具体技术栈和检查项，scripts 目录里每个脚本逻辑要各不相同，装机量要看可查证的精选市场；文中还附了一个 50 行的 Node 脚本 skill-xray，用结构指纹识别同一模板复制出来的脚本。掘金

2. LinuxDo: measured Claude Pro weekly quota is about $270: the poster used Opus 5.5 xhigh throughout and calculates a 5-hour limit of about $40 and a weekly limit of about $270; replies measured $330–350, attributing the difference mainly to cache hit rate, saying working in a single project is more economical. Someone suggests xhigh for planning and high is enough for execution. Account-ban-avoidance experience: payment method matters most (a US physical card is best), then a clean node and an isolated environment.

   3

   LinuxDo：实测 Claude Pro 每周额度大约 270 美元：楼主全程用 Opus 5.5 xhigh，算下来 5 小时限额约 40 美元，周限额约 270 美元；回帖里有人测到 330–350 美元，认为差别主要来自缓存命中率，只在一个项目里干活会更划算。有人建议规划时用 xhigh、执行时用 high 就够了。防封号的经验是支付方式影响最大（美国实体卡最好），其次是节点要干净、环境要隔离。LinuxDo

3. V2EX Share Creations: RigCheck checks whether your GPU or Mac can run new open models locally: the author’s starting point is that “parameters × bits” estimates are often off, e.g. Qwen3.8-27B at 4 bit is 13.5GB but Unsloth’s UD-Q4_K_XL file is actually 17.6GB, before KV cache. RigCheck uses real file sizes from the repo and estimates KV cache layer by layer the llama.cpp way (sliding-window and linear-attention layers counted separately), labeling every number as official, community, estimated or measured; the author also spent $1.83 renting a 4090 and a 4060 Ti 16GB for real measurements. Data is open under CC BY 4.0.

   3

   V2EX 分享创造：RigCheck 查你的显卡或 Mac 能不能本地跑新开源模型：作者的出发点是「参数量 × 位数」的估算经常不准，比如 Qwen3.8-27B 按 4 bit 算是 13.5GB，Unsloth 的 UD-Q4_K_XL 文件实际有 17.6GB，还没算 KV cache。RigCheck 用仓库里真实的文件大小，按 llama.cpp 的方式逐层估算 KV cache（滑动窗口层、线性注意力层分开算），每个数字都标明来源是官方、社区、估算还是实测；作者还花 1.83 美元租了 4090 和 4060 Ti 16GB 做实测。数据以 CC BY 4.0 开放。V2EX ｜ RigCheck ｜ Show HN