Calif Research released a demo of WeWorm, the first zero-click worm that spreads through WeChat voice calls on both iOS and Android, developed with AI assistance in about two days for the exploit and one additional week to build the worm. The demonstration shows how AI can drastically accelerate exploit development, putting over a billion WeChat users at risk of account hijacking without any user interaction, and underscores the urgent need for timely patching and improved defenses against AI‑powered threats. WeWorm exploits a memory corruption flaw in WeChat’s VoIP stack, achieving remote code execution without the victim answering or hearing the call, allowing attackers to read/send messages, place calls, and propagate the worm; Calif privately reported the vulnerability to Tencent, which has issued patches.
Researchers, including mathematician Andreas Thom, have raised concerns that OpenAI may be incorporating unpublished mathematical discussions from chat interactions (e.g., via Codex or ChatGPT) into its model training without proper attribution or consent. The issue gained traction after a Hacker News post sparked extensive discussion about AI ethics and data usage. This raises significant ethical and legal questions about data privacy, consent, and attribution in AI research, potentially undermining trust between AI companies and the academic community. It also highlights broader concerns about how user-generated content may be exploited to improve proprietary models without transparency. OpenAI provides free access to its models for over 100,000 researchers, and internal reports suggest its models are solving open problems rapidly, leading to speculation that chat data could be influencing training. Critics point to the generation of 300 billion output tokens shortly after a potential major math proof appeared in training data as suspicious, though OpenAI claims the model was not trained on those specific chats.
On September 8, 2026, OpenAI announced that a swarm of around 10,000 AI agents using an internal frontier model had produced a proof (counter‑example) of a breakdown in the three‑dimensional Navier‑Stokes equations, formalized in the Lean proof assistant. The claim was discussed on Hacker News, highlighting implications for AI‑driven formal verification and autoformalisation. If verified, this would be the first AI‑generated solution to a Millennium Prize problem, demonstrating that large language models can contribute to deep mathematical research and potentially accelerate proof verification through autoformalisation. It also raises questions about the trustworthiness of AI‑produced proofs when human verification is infeasible. The proof was checked in Lean, taking about 15 hours with 230 GB of RAM, while generating the Lean code required roughly 11 days of compute; OpenAI estimated the agent‑based effort at around $40 million (≈ 880 000 hours × $150/hour). The counter‑example has not yet been independently verified by external mathematicians or the Clay Mathematics Institute, and a priority dispute with researchers from Anthropic and others has been noted.
Forgejo versions up to 16.0.3 contain a critical remote code execution vulnerability in template expansion during repository initialization, which has been patched in the 16.0.4 release. The vulnerability allows attackers who control a template repository to execute arbitrary code on the Forgejo server, putting any self‑hosted Forgejo instance that uses template repositories at risk. During template repo processing, Forgejo clones the template, removes its .git folder, performs variable expansion on files listed in .forgejo/template; malicious content can inject commands that create a new .git folder and lead to RCE. The fix (PR
Shopify announced it is migrating its mobile app from React Native to fully native iOS and Android development, citing performance and maintainability benefits. This shift by a major e‑commerce platform highlights growing skepticism about cross‑platform frameworks when performance and platform‑specific optimization are priorities, influencing other companies’ technology choices. The migration involves rewriting the app in Swift for iOS and Kotlin for Android, leveraging AI‑generated code to accelerate the process, and Shopify plans to retain shared business logic via a core library.
Microsoft announced that Rust has been granted tier‑1 language status, providing internal teams with a supported toolchain, build infrastructure, and deep platform integration for production use, as detailed in a Rust Foundation guest post. This move signals major industry validation of Rust’s memory‑safe systems programming capabilities and may accelerate adoption across Microsoft’s vast codebase, potentially reducing memory‑related vulnerabilities. It also positions Rust alongside C and C++ as a first‑class language for OS‑level development. The tier‑1 status includes secure toolchain builds, productive developer tooling, quality workflows, and deep platform integration, allowing Rust code to be shipped to production without extra friction. Notably, Microsoft has also begun replacing LLVM with its own MSVC backend for Rust compilation in some internal projects.
JEP 544 proposes adding ahead-of-time (AOT) compilation capabilities to the JDK to improve application startup time and reduce runtime overhead. This enhancement could make Java applications start faster and consume less memory, addressing a long‑standing criticism of the platform and bringing it closer to native‑code performance. The proposal outlines a new AOT compiler that can pre‑compile JDK modules and user code into native libraries, building on lessons from the experimental JEP 295 AOT feature introduced in JDK 9.
A recent report from Brown University's Costs of War project examines how Silicon Valley and major tech firms are increasingly shaping the modern military-industrial complex through defense contracts and technological contributions. This trend highlights the deepening integration of commercial technology with national defense, raising ethical questions about the role of tech companies in warfare and influencing future innovation and policy directions. The report cites examples such as CIA-backed In-Q-Tel’s seed funding of Keyhole, whose software became Google Earth and was quickly used by military intelligence in the Iraq War, and notes historic ties like Fairchild Semiconductor’s early military contracts.
A Hacker News post highlights a lawsuit and references showing Sony's claim that players 'own' their digital games, sparking discussion about arbitration clauses and digital ownership rights. The case questions whether digital purchases constitute true ownership or merely licensed access, which could reshape consumer rights and publisher practices across the gaming industry. The PlayStation Terms of Service include a binding arbitration agreement and class action waiver in Section 14, requiring users who wish to opt out to notify Sony in writing within 30 days of acceptance.
Shopify is moving its mobile apps from React Native back to separate Swift and Kotlin codebases, citing AI agents that can handle implementation, translation, testing, and review work that previously made cross‑platform development attractive. This shift shows how AI‑assisted tooling is changing the cost‑benefit analysis of cross‑platform versus native development, potentially influencing industry‑wide technology choices. Shopify maintains three notable React Native libraries—react-native-skia, flash-list, and restyle—with the first two finding new maintainers and restyle slated for archival at the end of 2026; the migration to native apps was completed in just 12 weeks using AI agents.
Anthropic published its September 2026 threat intelligence report, which outlines new techniques for detecting and countering AI misuse, including watermarking detection and prompt‑injection defenses. The report provides actionable guidance for developers, policymakers, and security teams seeking to mitigate risks from generative AI, reflecting growing industry focus on AI safety governance. It details methods such as AI‑based invisible watermarking, statistical detection of LLM‑generated text, and a defense‑in‑depth framework for indirect prompt injection attacks.
Cognition releases SWE-2, a new software engineering language model claiming to rival Fable 5.1 and GPT-Astra, sparking debate over benchmark validity and model openness.
NASA's false-color imaging method, originally developed for Mars rover missions, is being applied to archaeological sites to enhance and reveal faded rock art that is invisible to the naked eye. This repurposing demonstrates how space‑derived image‑processing tools can advance archaeology, offering a non‑invasive way to document and study ancient cultural heritage worldwide. The technique, known as decorrelation stretch, exaggerates subtle color differences in multispectral images, making pigments that have faded or been obscured by weathering stand out in false‑color composites.
The article argues that genuine creativity, not technical superiority, is becoming the key differentiator or 'moat' for products and services, and it generated substantial discussion on Hacker News with 99 points and 54 comments. This shift highlights how creative differentiation can sustain advantage in an era where AI and LLMs level technical playing fields, affecting designers, developers, and businesses seeking lasting market positions. Commenters noted frustrations with over‑complicated websites, praised LLMs for lowering barriers to creative web experiments, and debated whether a true moat lies in tasks models cannot perform cheaply.
The article introduces an open-source steganography-based technique that embeds verifiable proof of capture within images, functioning similarly to Apple's Reference Image feature but without relying on proprietary metadata. This approach provides a tamper-resistant way to attest to image authenticity that survives common social‑media processing, benefiting journalists, researchers, and platforms combating AI‑generated fakes. The method stores a cryptographic signature in the least‑significant bits of pixel data using steganography, choosing this over EXIF metadata because platforms often strip such metadata.
OpenAI released an Agents API that enables developers to build AI agents capable of using external tools, maintaining persistent memory, and orchestrating multi‑step workflows. The API lowers the barrier to creating autonomous AI systems, allowing developers to focus on high‑level logic while OpenAI handles session management, tool execution, and context compaction. The Agents API provides managed sessions, automatic context compaction, and access to the Codex harness; a companion OpenAI Agents SDK for Python offers a lightweight abstraction layer.
Cognition's SWE-2 model achieved a score of 92.8 on the Terminal-Bench 2.1 benchmark, setting a new high mark for AI-assisted software engineering performance. The result demonstrates meaningful progress in AI-assisted coding, showing that models can tackle complex software engineering tasks with high accuracy, which could accelerate development workflows and reduce manual effort. SWE-2 is a proprietary model with a 1M context window, an explicit reasoning mode, and was released on September 10, 2026, post-trained from Kimi K3 (2.8T parameters). Terminal-Bench 2.1 evaluates agent performance on coding tasks, with a leading model accuracy of 82.7% prior to this result.
PlanetScale announced Neki, a proprietary PostgreSQL sharding solution inspired by Vitess, designed to scale Postgres databases to hundreds of millions of queries per second and petabytes of data. Neki aims to bring Vitess‑level horizontal scaling to PostgreSQL, filling a gap for enterprises needing massive scale, but its proprietary license may hinder community adoption compared to open‑source alternatives such as multigres. Neki adds a router, sidecars, and a control plane to ordinary PostgreSQL instances, providing built‑in workflows for node provisioning, replication catch‑up, traffic switching, and node retirement without downtime, while remaining closed source.
The blog post by Raymond Chen reveals that Windows XP selected a new account's initial user picture by scanning a folder of default images and choosing the first file alphabetically. This detail highlights a simple, deterministic design choice in early Windows that influenced the out‑of‑box user experience and is of interest to retro‑computing historians. The implementation used FindFirstFile/FindNextFile to enumerate files in the picture directory and selected the first returned entry, which on NTFS/FAT is typically alphabetical order, without any randomization.
Anthropic published three economic scenarios for AI’s impact on the labor market, explicitly labeling them as scenarios without probabilities; in the extreme case cognitive unemployment reaches 17.9%, overall unemployment 11.9%, and labor’s share of GDP falls from 60% to 45.2%. The analysis offers a concrete, quantitative picture of how AI could shift income from labor to capital, highlighting potential policy challenges such as large-scale transfers needed to protect cognitive workers. The extreme scenario assumes zero new human tasks are created, and includes no policy response, business cycles, financial disruption, catastrophic risk, or robots; under these assumptions total labor income ends up only 0.5% above the no‑AI path while GDP is a third larger and capital income rises 81.4%.
A 19‑minute animated video demonstrates how to increase database write throughput from 300 to 1 million transactions per second by identifying bottlenecks and applying optimizations such as batching. The video provides a clear, practical tutorial on database performance tuning, but its claim of 1 M TPS relies on batching that can compromise durability, highlighting trade‑offs between speed and ACID guarantees. The optimizations include batching many transactions before writing them to disk, which means the application must hold uncommitted data until a batch fills, risking loss if the frontend crashes before the batch is flushed.
This release adds support for GraalPy 3.13.0, introduces hash verification when downloading PEP 658 metadata sidecars, and improves performance by reusing hashes from URL fragments during resolution. It also includes bug fixes for Windows entry‑point launchers and prefers core‑metadata over legacy aliases in JSON index responses. By integrating GraalPy, uv enables developers to use a high‑performance, Java‑integrated Python runtime, broadening the range of compatible interpreters. The enhanced hash verification and hash‑reuse optimizations improve both security and speed of dependency resolution, benefiting all uv users. GraalPy 3.13.0 is added as a supported Python implementation; PEP 658 metadata sidecars now have their hashes verified before use; performance gains come from reusing hashes supplied in direct URL fragments when metadata is separate. Windows Nano Server support is added by editing entry‑point launcher resources in memory, and the JSON index now favors core‑metadata over legacy aliases.
The blog post humorously urges readers to keep their personal cable collections, while commenters share strategies for grouping cables, warnings about SATA power pinout incompatibility, and creative reuse anecdotes. It underscores the value of practical cable organization for DIY enthusiasts and highlights a common pitfall—assuming SATA power connectors are interchangeable—which can damage hardware. Commenters recommend grouping similar cables to identify duplicates, warn that SATA power connectors fit modular PSUs but have non‑standard pinouts that can fry drives, and describe reusing USB cables for bike power meters and crib lighting.
Simon Willison introduced a browser‑based .blend URL Viewer that lets users view Blender files from a URL, and he used ChatGPT Images 2.5 to generate a Pluribus‑themed Fabergé egg image, then turned it into a Blender model with GPT‑6 Astra. The workflow demonstrates how AI image generation can be tightly coupled with 3D modeling tools, enabling rapid concept‑to‑prototype pipelines for artists and developers. The .blend URL Viewer supports Blender 5.x files, renders mesh geometry with materials and lighting, offers orbit controls, wireframe mode, and resolves GitHub URLs via jsDelivr; the Pluribus egg model was produced after 17 minutes 51 seconds of GPT‑6 Astra skill execution, resulting in a 7.2 MB file with 783 k vertices.
A Reddit post employs a Boromir meme from Lord of the Rings to depict how AI companies acknowledge the dangers of advanced AI while claiming they can safely control powerful models. The analogy highlights the AI alignment problem, showing how firms frame risk management while underscoring the technical challenge of ensuring AI goals align with human intent. The post quotes Boromir’s line 'If anybody gets there, let that be me. I know what to do. I will do good with it.' and notes that large AI capabilities combined with models having their own goals create the control problem.