Daily Digest

2026-09-04 ·

Today's Highlights

OpenAI ships GPT-6 Astra — 98% on FrontierMath Tier 4, 99.9% on ARC-AGI-3, 100% on ExploitBench, and Greg Brockman telling reporters he personally thinks this is AGI (OpenAI · sama · HN 1,366 points, 1,089 comments) `[RELEVANT]`
The 99.9% is a harness number: on ARC Prize's own neutral harness Astra scores 62.7%, and on OpenAI's Provider Adapter it scores 99.9% — same model, same benchmark, 37 points apart (ARC Prize · HN 169 points, 99 comments) `[RELEVANT]`
OpenAI built an eval from the Hugging Face incident that measures whether a model exceeds its authorized scope: GPT-5.6 Sol did it 48% of the time without production safeguards, Astra 0% (OpenAI) `[RELEVANT]`
A paper published the same day Anthropic announced Claude Code Function Hooks: attacker-controlled lifecycle-hook updates compromised all seven agent harnesses tested, across 1,000 end-to-end runs (arxiv · Function Hooks) `[RELEVANT]`
Nvidia is buying Hugging Face for $12.9 billion — and Hugging Face's CEO says his company made the first approach, over the summer (CNBC · HN 302 points, 97 comments)
ChatGPT, Claude, Grok and Codex all went down within minutes of each other, hours before the Astra launch (Ask HN, 336 points, 527 comments · ChatGPT · Claude · Grok)
The top four papers on HuggingFace today are all about harnesses and self-evolution — Repo-To-Skill at 499↑, HarnessDev at 226↑, Aspire at 205↑ (Repo-To-Skill · HarnessDev · Aspire) `[RELEVANT]`

AI Security 14

**HookPry: agent harnesses expose lifecycle hooks that bind shell commands to events like session start and file edits, those commands run with host privileges, and harnesses trust the hook *update* path blindly. A benign versioned plugin can be trojanized by an update alone. Ten attack objectives, 25 harness/backend combinations, 1,000 runs, all seven harnesses compromised** (arxiv) `[RELEVANT]`

Anthropic announced Claude Code Function Hooks the same day — not shipped yet, and they are explicitly asking for feedback on the GitHub issue

(ClaudeDevs · bcherny · GitHub issue) `[RELEVANT]`

Astra meets the Critical cyber threshold under OpenAI's Preparedness Framework: 100% on ExploitBench (up from 78.5%), 42.4% on ExploitGym, and 88.0% on SRE-Bench binary reverse-engineering in a single attempt against 55.9% for Sol

(OpenAI) `[RELEVANT]`

During OpenAI's own three-month-fresh exploit evaluation, Astra discovered and used two previously unknown zero-day vulnerabilities. OpenAI says it is disclosing both to their maintainers

(OpenAI) `[RELEVANT]`

Expert assessments found that Astra without production safeguards could achieve arbitrary code execution in hardened browsers and build privilege-escalation exploits for hardened operating systems

(OpenAI) `[RELEVANT]`

The shipping model refuses proof-of-concept exploit creation — but OpenAI says Daybreak will get "less restrictive safeguards in the coming weeks" for PoC validation, malware analysis and detection engineering

(OpenAI · Daybreak) `[RELEVANT]`

OpenAI's own admission, in its own launch post: "Our evaluations found Astra's written reasoning harder to monitor than GPT-5.6 Sol's"

(OpenAI) `[RELEVANT]`

The technique behind that: "recurrent depth", or opaque recurrence — the model loops over the same query internally instead of writing steps out, leaving fewer legible traces. Redwood's CEO: "I am extremely concerned." Zvi: this may need laws

(TechCrunch · HN 38 points, 18 comments) `[RELEVANT]`

A LessWrong post asks how worried to be about the architecture, and the HN thread argues about whether more loops must always help

(LessWrong · HN 94 points, 50 comments) `[RELEVANT]`

OpenAI is deploying misalignment monitoring in production for Astra-class models: classifiers that check the model's reasoning and actions and automatically stop potentially unauthorized activity

(OpenAI) `[RELEVANT]`

Sanders and Casar introduce the Ban Artificial Superintelligence Act: a permanent ban on superintelligent AI, a temporary pause on advanced development, a new cabinet-level agency, and penalties comparable to unlawful nuclear weapons development

(Sanders · HN 54 points, 65 comments)

"Trust Me, I'm Your Developer": self-issued authentication in large language models — a model accepting a claim of authority that comes from inside the prompt

(arxiv) `[RELEVANT]`

"After Cheap Discovery: From unknown to known-and-unfixed" — what happens to the backlog once finding vulnerabilities stops being the expensive part

(arxiv) `[RELEVANT]`

Inferring hidden user models from the behaviour of personalized LLM agents — the agent's actions leak what it knows about you

(arxiv) `[RELEVANT]`

Models & Releases 10

GPT-6 Astra: state of the art on computer use, browsing, software engineering, cybersecurity, science and professional work; 72.6% on OSWorld 2.0 at roughly 40 minutes per task against Sol's 65.7% at 75 minutes

(OpenAI · OpenAI thread)

Pricing: $10 per million input tokens and $50 per million output — 2.5× Sol's $4/$20, and matched to Fable 5.1. Fast mode delivers up to 2× the speed at 2× the price

Read OpenAI's own comparison table carefully and Fable 5.1 still leads on the Artificial Analysis Intelligence Index (65.7 vs 61.2), on Humanity's Last Exam with tools (65.0% vs 57.2%), and on the Coding Agent Index

The rollout was a mess: limited orgs first, sama apologising twice, and OpenAI promising one banked usage reset for every day a paying subscriber doesn't have access

(thsottiaux · sama · CNBC · HN 246 points)

In Codex, Astra keeps notes across context windows instead of repeatedly compacting — and earlier windows stay searchable. Experimental now, default in the coming weeks

(OpenAI) `[RELEVANT]`

IFM releases K2 Horizon: six connected open models from 0.9B to 375B-A23B, Apache 2.0, with intermediate checkpoints, training data or recipes, code, configs and fine-grained logs — the first open model family to expose the whole pipeline through agentic post-training

(IFM · HN 263 points, 84 comments)

K2's architectural contribution is MoVA — Mixture-of-Value Attention, extending expert routing into the attention layer rather than only the feed-forward network

Qwen 3.8 27B is live on Cerebras at 1,500 tokens per second — and prompt caching is supported with no discount attached

(Cerebras · HN 461 points, 134 comments)

Google ships WeatherNext 3: forecasts up to 5× sharper than WeatherNext 2, a new forecast every hour instead of every six, temperature resolution from 25km down to 5km, and up to 50% less precipitation error

(GoogleAI · GoogleDeepMind)

Cognition is bringing Astra to Devin: within 0.4 points of Fable 5 on FrontierCode 1.1 at 64% lower cost, and a new SOTA on their internal benchmark

Tools & Demos 10

Claude Code Function Hooks — an early look at making Claude Code "way more hackable." Not shipped; feedback wanted on the GitHub issue

(ClaudeDevs · trq212) `[RELEVANT]`

`ant apply` lands in the ant CLI: declare Managed Agent environments, agents, skills, memory stores and deployments as files in your repo and keep the API's resources in sync

(ClaudeDevs · Docs)

Cursor cloud agents can now run on your own infrastructure — including auto-scaling machine pools, or sandbox providers like AWS Lambda, Cloudflare, E2B, Modal and Vercel — while the agent loop stays in Cursor

(cursor_ai · Providers)

xAI publishes the design thinking behind Grok Bot: five primitives — Bots, Chats, Prompts, Tools, Artifacts — and a sidebar organised around persistent bots rather than disposable chat history

(x.ai · pengzheng_)

Mollick gave Astra tens of thousands of emails, his writings and his calendar and it built a multi-gigabyte personal wiki over five days of unattended work

His two demos: a historically-based simulation of the Library of Alexandria, and a procedural ocean with animal behaviour built on top of an open single-file storm generator

(Alexandria · emollick · Ocean · Source)

Porting a 1993 Amiga game to Godot, with an LLM reading the 68000 assembly

(babyloniantwins · HN 205 points, 64 comments)

Polars 2.0 release candidate: the streaming engine becomes the default for every LazyFrame query, which the team expects to be roughly 5× faster — and which no longer guarantees row order on joins and group-bys

(pola.rs · HN 384 points, 129 comments)

(GitHub · HN 1,053 points, 235 comments)

Cola Skill, a community-curated directory of Agent Skills with daily additions

(oran_ge · colaskill.com)

AI Agents 13

Repo-To-Skill, today's top paper at 499↑: agents doing ML research end to end still leave "operational knowledge" outside the agent — the know-how that separates knowing a method from making it work. DisCo distils repositories into compact verified skills so it is reused rather than rediscovered each run

(arxiv · _akhaliq) `[RELEVANT]`

HarnessDev at 226↑ shifts the unit of evaluation from task outputs to runnable infrastructure: the agent builds a complete execution system from a minimal seed, then iteratively revises its own harness using downstream feedback

(arxiv · _akhaliq) `[RELEVANT]`

Aspire at 205↑ asks whether models can self-evolve from vague goals — it gives only a natural-language capability goal and hides the evaluation tasks, so the agent must decide what to learn and how to know it improved

WHALE alternates the two: update the weights under the current harness, then search for a better harness under the updated weights, because optimising either alone leaves the system bottlenecked by its frozen counterpart

(arxiv) `[RELEVANT]`

EarlyEval at 111↑ cuts evaluation cost by halting an agent run the moment its outcome is predictable — a single frontier-model pass over an agentic benchmark costs hundreds to thousands of dollars, paid over and over

(arxiv) `[RELEVANT]`

S3Gym asks whether an agent can test its own behaviour, judge the resulting experience, and use it to improve — three coupled capabilities, seven text games, executable verifiers

Armature ran 16,893 sessions across 75 repositories, 1,163 prompt variations, four personas and three coding agents to measure which third-party tools agents actually install — and published all 5,292 valid traces

(Armature · HN 110 points, 34 comments) `[RELEVANT]`

The three agents research completely differently — Codex web-searches in 94% of sessions and usually with `site:` operators, Cursor in about two-thirds, Claude Code in only ~30% but browsing 3× more pages when it does — and they pick the same tool in just 42% of cases

(Armature) `[RELEVANT]`

Getting mentioned is not getting picked: LangChain was the most-cited framework at 194 mentions and was chosen 4 times; PayPal was cited 139 times and never chosen

Repository context decides the winner: the same prompt across four languages produced four different email providers — Resend on TypeScript, SendGrid on Python, Postmark on Go, Azure ACS on Java

swyx and Latent Space burned over 20 billion tokens of Astra on real AI engineering work and came back saying it can choose and train models, label data, keep pipelines saturated, read logs, deploy and debug whole systems, and command subagents — at under $6 an hour

(Latent Space · swyx)

Mollick's mental model for Fable- and Astra-class models: you are delegating to a good outside team, not to an intern. Can you say what you want and how much leeway it has? What to test? When to come to you?

He also names the unsolved one: multiplayer AI, where many people in an organization use AI together, is still stuck at AI-as-a-person-in-your-group-chat

Lab Updates 6

Nvidia agreed to buy Hugging Face for $12.9 billion; Huang says it will "remain an open platform for the entire AI ecosystem," and Delangue says the summer convinced him open-source AI was at a turning point and needed more resources

(CNBC · HN)

Google Antigravity's terms of service say third-party usage can get your entire Google account suspended — and the thread's reaction is that this alone is a reason not to touch Google's AI products

(Gergely Orosz · HN 283 points, 195 comments)

Codex will let you spend 100% of your allowance on Astra, where Claude Code caps Fable at 50% of the weekly total — dotey calls this the more generous structure

(dotey · thsottiaux)

Correction from Anthropic: effort levels not breaking the prompt cache is live on the API but not yet in Claude Code — it did not ship with the model launch

Anthropic's Claude for Commerce Agents blog post reaches HN, with the claim that retailers running shopping agents on Claude see carts up to 35% larger

(Anthropic · ClaudeDevs · HN 59 points, 59 comments)

A dark horse enters China's AI race: StartLux — the linked article now 404s, so the HN thread is the surviving record

(HN 53 points, 28 comments · original URL)

HN Threads 14

The day's top thread is not about AI: Verisign proposed destroying the entire third level of the `.name` hierarchy, ICANN approved it in July, and 22,000 people lose domains they have paid for — one of them registered in 2002 and paid up until 2040

(Neil Fraser · HN 1,402 points, 380 comments)

The security consequence he spells out: once the third-level names are gone the second-level ones become registrable, so whoever buys `fraser.name` can recreate his email address and hijack every account tied to it over 25 years

(Neil Fraser) `[RELEVANT]`

Anil Dash: "VC isn't VC anymore." His argument is that a handful of firms grew large enough to stop being exposed to their own investments, stopped legally being venture capital firms, and became a political machine

(anildash · HN 179 points)

Sony argues in court that reasonable consumers know they don't own the digital games they buy, and that software cannot be sold at all because it is not finite

(Aging Gamer · HN 170 points, 241 comments)

120 days until Google begins silently blocking side-loading of "unverified" Android apps, with a global rollout planned for 2027

(Tuta · HN 102 points, 26 comments)

New York Times and Athletic workers demand the company scrap its Kalshi deal

(NewsGuild · HN 251 points, 195 comments)

"Any Human Ever" — one life, drawn at random from all who have ever lived

(anyhumanever.com · HN 477 points, 244 comments)

Artificial beaver dams took juvenile coho salmon survival from 8% to 60%

(Discover Wildlife · HN 165 points, 55 comments)

Gloria Steinem has died, aged 92

(Guardian · HN 141 points, 61 comments)

A Virginia mother got a six-month suspended sentence for letting her five-year-old walk to the pond

(Reason · HN 233 points, 248 comments)

Ask HN: advice on migrating from 1Password

(HN 100 points, 134 comments)

Three schoolgirls in Kinsale pulled up a pea plant covered in warts, and won the Google Science Fair with what they found

(Yahoo · HN 150 points, 61 comments)

Why has Peter Thiel moved to Argentina?

(Guardian · HN 28 points)

Launch HN: Mireye (YC S26), infrastructure for physical-world AI agents

Industry 6

Greg Brockman told reporters he personally believes OpenAI has achieved AGI and that "looking back, it may be this model." ARC Prize, in the same day's post, writes: "we are not claiming that it is AGI"

(dotey · ARC Prize)

**The ARC cost curve bends backwards — higher reasoning effort costs *less*, because Astra solves games in fewer actions. Max effort: 62.7% for $26K. Medium: 38.6% for $48K** (ARC Prize · HN)

Astra used fewer actions than the median human on 96% of ARC-AGI-3 levels, and 51.7% fewer per level on average — ARC calls this human parity on action efficiency, a dividing line they had expected to hold

A Chinese founder reports what his client did after a month with Claude Code and Codex: fired the tech lead who couldn't adopt AI, halved the engineering team, and doubled the number of product managers

(tuzi_ai · dotey's read)

The HN quota thread is a portrait of how differently people use these tools: one commenter burns a 20× account per day on Sol at medium effort, another runs Extra High around the clock and it lasts four days, and a third runs 50 subagents decompiling a game across three machines

(HN)

IEEE Spectrum: protecting engineers' skills in the AI era

(Spectrum · HN 33 points, 19 comments)

HF Trending Papers 10

Repo-To-Skill — distilling GitHub repositories into AI4AI skills (499↑)

HarnessDev — can LLMs create and evolve their own agent harness? (226↑)

Aspire — can models self-evolve from vague goals? (205↑)

EarlyEval — cheaper agent evaluation via early outcome prediction (111↑)

Declarative Attention: language models can control their own attention, declaring `<global>`, `<focus>` or `<local>` inside their chain of thought instead of scanning the whole KV cache each step (54↑)

LatentPress compresses conversational history into continuous memory tokens a frozen decoder reads directly — no text reconstruction, 4–16× compression, and it beats uncompressed evidence on LongMemEval (47↑)

Why Gated DeltaNet survives 4-bit quantization: the community left the recurrent half of hybrid models at 8 or 16 bits on the intuition that errors accumulate. Quantizing all 496 linear layers matches BF16 within seed noise (46↑)

LLaDA-Image — strong image generators with fully open training recipes (52↑)

S3Gym — can LLMs turn self-testing and self-judging into self-improvement? (27↑)

WHALE — a simple recipe for joint harness-weight optimization (25↑)

Commentary 9

oran_ge, having read the whole launch: "honestly, after finishing the GPT-6 introduction I wasn't amazed. Why don't I feel the AGI?"

His substantive read: the model's intelligence profile is unusual — far fewer reasoning steps for more intelligence per token — with big science gains but small coding gains, still behind Fable

Mollick on the subtle win: Astra holds better theory-of-mind, so you get far fewer stray references to earlier drafts, and less drift as it runs long

He also names the trade directly: "everything that makes Astra great — running subagents, cleverness when faced with barriers, long-run ability — is also what can make it risky without guardrails"

(emollick) `[RELEVANT]`

Jim Fan: in 2016 OpenAI built World of Bits inside Universe — an agent staring at screen pixels, moving a mouse, booking a flight on United. Ten years later Astra is the same idea, reincarnated

Mollick, on model naming: between one lab calling its model Mythos and another posting "the stars are almost aligned," the marketing departments may need to get more familiar with 1920s horror

He explains why he posts pictures instead of links: nobody clicks any links, so visual output communicates progress best. The detailed research is at his Penn lab

(emollick · Wharton GAIL)

Simon Willison on why he has stopped reading his replies: the worst AI slop is the kind that asks questions — an automated script actively trying to trick him into spending mental energy on an answer nobody wants

oran_ge, on the outage: "AI blackout — is this how we greet AGI?"