8 stories from Hacker News — not just headlines, but the breakdown: what's being discussed, which sides there are, what insiders say.
Carbon posts 88.2% on SEC-bench Pro for finding vulnerabilities and 54.8% on ExploitGym for exploiting them, and Google has already priced it at $2 per million input tokens. The catch: it is rolling out through a trusted-partner programme first, with wider release promised "as soon as possible."
A reader who tried Google's own app found no sign of the previous model either.
The top HN threads: facts from the discussions, both sides, insider voices. Email, Telegram, or RSS.
git, curl and python3 on macOS still trust the compromised eMudhra intermediates, a researcher's test page shows, while Safari and apps on Apple's networking stack are protected. Anyone able to sit on the network path could alter a clone or lift a GitHub token.
Apple's own advice is to re-check after every update.
Hidden in a Russian anti-DDoS vendor's script are function names like computeRicinLethalDosageForWaterSupply and a fake "SYSTEM OVERRIDE" briefing, none of it doing anything. It exists to make an LLM balk when someone asks it to deobfuscate the code.
One open-weights model answered the same prompt without complaint.
An interactive chart draws US household wealth to scale, one pixel per $5,000 and one column per percent of households. The top 0.1% is 136,095 households, each shown as a stack of $100 bills.
The thread's first fight was not about the picture but about whether wealth is even the right thing to measure.
On the DAYJOB: Tax benchmark, which hands agents about 30 files per client and grades the finished work, no model clears 11%. Typical failures are missing the one consequential date and assuming a couple is unmarried.
A user who files their own cross-border return with Claude reached much the same verdict.
Emacs began as TECO macros at MIT's AI Lab, and Richard Stallman's decision to ask users to send improvements back led, via commercial resale of the editor, to the GNU Project.
One long-time user now describes his AI assistant as a fairy that can fulfill any wish for his config; another says Claude replaced the editor entirely.
MuPDF before 1.28.5 seeded a drand48-style generator with the current Unix time and read bytes from bits that ignore most of the seed, so timestamps 512 seconds apart give identical keys. The author brute-forces all 512 in about 11 ms of unoptimised Python.
Foxit Reader has a related flaw; already-published PDFs cannot be protected retroactively.
Upgrading to GitLab 19.3.6 on October 22 did not fix CVE-2026-97229 on Alpine's GitLab, an attacker crashed workers eight times on October 21, and the team rebuilt from scratch and reset every password.
Alpine found no evidence the exploit succeeded but says logging gaps mean it cannot rule it out.
