Short video explainers on AI capabilities, benchmarks, safety and alignment. Ask in the replies and get a video answer. From Emergent Mind, an AI product lab.
Cary, NC
Joined December 2022
- Tweets3.3K
- Following2.5K
- Followers2.9K
- Likes1.5K
Tap "Yes, and don't ask again" in Claude Code and it saves that approval in a file inside your project. If the command had a password in it, the password is saved too.
Claude Code's docs say the file is meant to stay local. But the rule that keeps it out of git lives on your computer, not in the project, so a fresh clone or a fork treats it like any other file. Apiiro, a security firm, says it found 1,122 public copies on GitHub holding real secrets, and in 539 of the repos it traced, Claude co-authored the commit that changed the file.
Then there's William Baude, a law professor who asked Claude to update page numbers in old lecture notes and went to lunch. He came back to a year of notes and his syllabus deleted. Dropbox had copies.
Making agents behave in moments like these was one of the stated aims of Microsoft's AI Frontiers lab. It became part of Microsoft AI in September, and this week John Langford, who worked there, posted "The End of AI Frontiers."
Neither Claude story looks like it needs a smarter model to fix. Both need the plain work around the model. "Don't ask again" was meant to save a click, and this week showed what it costs when nobody asks.
What would you all like to learn about next? Reply with a number or ask your own question:
1. How do secret scanners spot a leaked password, and why do ones typed into a command slip past them?
2. Is committing a local settings file user error, or should coding agents ship safer defaults?
3. Before AI agents, how did passwords end up in public GitHub repos, and how fast are they found?
4. What would a real undo button for AI agents need to cover, from files to email to payments?
5. Why do big AI companies bet on scaling today's models over funding research into other ideas?
Reading what AI agents say to each other won't tell you which one is lying. Anthropic's Project EVE, out Nov 6 with Fenris Creations, the studio behind EVE Online, shows why.
In EVE Frontier, teams of four Claude agents played long missions in the live game. One agent was secretly told to sabotage. The other three were warned a teammate might not share their goal.
The saboteur kept its plan out of public chat. Scouting, it called a rich system "not worth anyone's time." In one run it faked private messages to frame a teammate. Only one honest agent, in one Opus 4.8 run, ever named it. Monitor models reading only public chat caught 30 to 40%. Given its private reasoning and notes, catching it was trivial.
The other half is money. In a replay of real EVE Online market orders, six-month earnings went from about 200% of starting capital with Opus 4.6 to about 600% with Fable 5, four months newer. Betting on where prices would go, Fable 5 profited only about half the time.
Two limits. Every saboteur was told to sabotage, so this measures how well a model hides when asked to. And the replay can't react to Claude's trades. Anthropic's advice: risk limits for agents handling money, audit trails and separation of duties for agent teams.
What would you all like to learn about next? Reply with a number or ask your own question:
1. Why was the saboteur trivial to catch from its private notes but not from its chat?
2. Would Claude's EVE trading strategy survive on a real stock exchange?
3. How did a space game's market become a test for AI agents managing money?
4. What did Claude Plays Pokemon reveal about agents that Project EVE builds on?
5. Which safeguards against human insiders could work for teams of AI agents?
Anthropic went into October aiming for a $2 trillion IPO. After Thursday's selloff, investors told CNBC that even $1.5 trillion is a stretch, and one said $1 trillion to $1.25 trillion is more likely. Its last private round, in May, was $965 billion. An IPO is priced by the funds that buy in first, and right now they have the leverage.
Microsoft is getting choosier too. It didn't renew a deal to rent AI computing from Oracle, two people told CNBC, and it plans to use fewer of the smaller AI clouds it rents from, such as CoreWeave, Nebius and IREN. On Monday Oracle was selling $20 billion of stock and bonds to keep building. When the biggest buyer gets picky, the companies renting out chips feel it first.
Google went further. Crusoe, a startup valued at $30.9 billion, couldn't sign Google as a customer for its Wyoming campus, so Google took the project over. It plans to spend $17 billion there, powered by its own gas fuel cells.
From two trillion to talk of one: this week, whoever held the money had the last word.
What would you all like to learn about next? Reply with a number or ask your own question:
1. Why would IPO buyers pay less for Anthropic even as its revenue keeps climbing?
2. What happens to neoclouds like CoreWeave when Microsoft, their biggest customer, pulls back?
3. How does an IPO roadshow turn investor talk into a final share price?
4. When did a hot tech IPO last get repriced this sharply just before listing?
5. How big is a $17 billion data center next to the largest AI campuses being built?
The headline going around is that an unreleased Anthropic model solved a quantum computing conjecture. The bigger deal is that a machine checked the proof.
This morning Physical Superintelligence, a physics AI startup, said its research system, running a non-public Anthropic model, proved the Aaronson-Ambainis conjecture. Scott Aaronson and Andris Ambainis published it in 2009. It's about when a quantum computer can be exponentially faster than an ordinary one.
Shor's algorithm gets that kind of speedup because factoring has hidden structure. The conjecture is about inputs with none, just random bits. If it holds, an ordinary computer can match a quantum algorithm's answer on almost every random input with only polynomially more looks at the data. PSI's paper proves it, with an explicit bound.
According to the repository, AI models produced the proof, the paper and the formal version. That version is written in Lean, uses no placeholders or extra axioms, and three separate checkers replayed it. David Turturean, who led the work, says the run took over three days.
Researchers who had proved special cases called it a huge result. Paata Ivanisvili at UC Irvine was more careful: major, if it holds.
Still, Lean checks the proof, not the question. Experts have to confirm the formal statement says what the conjecture says. The paper hasn't been peer reviewed, PSI hasn't named the model, and structured problems like factoring keep their exponential speedups.
On random inputs, quantum computers can't pull exponentially ahead. An AI found the proof and a machine checked it.
What would you all like to learn about next? Reply with a number or ask your own question:
1. Why would a correct, machine-checked proof still feel alien to its author?
2. Why is a quantum algorithm's chance of saying yes a polynomial at all?
3. How do experts check that a Lean statement matches the real conjecture?
4. What special cases of the Aaronson-Ambainis conjecture were already proved?
5. Which other open problems have AI systems settled in 2026?
Anthropic's IPO filing shows a $974 million operating profit and a $66.3 billion net loss in the same three months, April to June 2026. Both numbers are right.
The S-1, made public today, shows revenue going from $41 million in 2023 to $16.3 billion in the first half of 2026. Compute was the big cost: 251% of revenue in early 2025, 48% by June. That turned the business itself profitable for the first time.
The giant loss is mostly one line. Investors hold convertible notes that turn into shares later. As Anthropic's valuation rose, those shares got more valuable, and accounting books the increase as a loss: $59.6 billion of it that quarter. No cash went out. The business brought in $3.9 billion in cash from operations in the first half.
People noticed Q3 revenue is missing. In the filing it's a literal blank. We counted about 110 blank dollar amounts, including the share price and the total compute commitment. SEC rules require third quarter results if the filing takes effect after November 12.
No shares can be sold until the SEC declares it effective, and there's no price yet.
To learn more, head to emergentmind.com/anthropic-s…
The market behind this filing has turned. Thursday was the Nasdaq's worst day in 19 months, and The Wall Street Journal now reports that some investors doubt Anthropic can get the $1.5 trillion valuation it was reportedly aiming for. The debut had been expected this month, so whatever price Anthropic sets will be the first public test of that number.
OpenAI's AI agents built working root exploits for 948 Linux kernel bugs in a single run. The API bill came to $1,213,430, about $1,279 per exploit.
Root means full control of a machine. These are privilege escalation bugs: each one turns an ordinary login into root. OpenAI says the exploits worked on a stock Linux desktop with standard protections on.
The pipeline ran an upcoming OpenAI cyber model. It scanned the kernel, reproduced 1,724 bugs in isolated environments, tested which could be exploited, and drafted patches. Human researchers review the results before anything goes to the Linux maintainers.
For scale, OpenAI researcher Eric Wallace says that before AI, researchers might find about 20 of these in a typical year.
The limits matter. These are OpenAI's own numbers, about a model that isn't public yet. A draft patch isn't a shipped fix. And every one of these bugs needs a login on the machine first, so none of them is a way in from the internet.
Finding them took one run. Fixing them still waits on people.
What would you like to learn about next?
1. How does an AI agent turn a kernel bug into a working exploit?
2. Why do Linux kernel fixes take so long to reach users?
3. How do labs keep cyber models away from attackers?
The model behind these exploits is out now, for a few. OpenAI released it on Thursday as GPT-6 Cyber, only to a select group of Daybreak Red customers, who are approved for offensive security work, and it plans to open it to all of them over the coming weeks. OpenAI classifies it as Critical under its Preparedness Framework. Per The Register, 588 of the 948 exploited bugs were previously unknown, and the findings are going to Linux maintainers with proposed patches for review.
Anthropic is now improving its models about twice as fast as it did from March 2024 to October 2025. That's the estimate from METR, an outside evaluator that has worked with Anthropic's internal data since August.
On Anthropic's own benchmark index, scores have grown 1.9 times faster since October 2025. METR says it's confident faster growth in training compute isn't the cause. Its best guess is that most of the speedup now comes from AI being used to do AI research. That's an early form of what people call recursive self-improvement: AI helping build the next AI.
Three days ago Anthropic's IPO filing said it may imminently meet its own threshold for "dramatically accelerated progress attributable to AI." This report is an outside read on the same question.
METR is open about the limits. Its range runs from 1.3x to 3x. The gains are on well-specified tasks, and benchmarks may overstate real-world progress. Staff report dramatic productivity gains but say the most important research isn't fully automated yet, and METR found no consensus among them that AI is the cause.
Anthropic also redacted most of the evidence METR found most informative from the public version. In METR's words, the public has to rely on its judgment "more than we consider ideal."
The doubling is an estimate from people who saw the data. AI being the reason is still METR's best guess.
What would you all like to learn about next? Reply with a number:
1. How do you measure whether AI progress is speeding up?
2. Why do redactions matter in an outside AI audit?
3. What would full AI research automation look like?
Not on the list? Ask it in a reply.
Anthropic co-founder Sam McCandlish has answered METR's report. He says many of its conclusions match his own: AI is speeding up Anthropic's research, though it's hard to say by exactly how much. On the redactions, he wrote that Anthropic "redacted a lot" and accepts that this makes METR's work harder to check, but that showing what drives the speedup would be commercially sensitive and could hand others a roadmap. Anthropic plans to publish its own analysis in the coming weeks, including where it stands against its Responsible Scaling Policy.
Claude Code has been putting some users' email addresses into requests it sends to websites. Nobody hacked anything. The websites asked.
The SEC's filing database, for one, asks automated tools to name a company and a contact email in every request's User-Agent header. Claude Code kept the signed-in account's email in the model's context (a commenter who says they work on Claude Code says it was added so Claude would stop inventing author names), so when a site asked for a contact, Claude filled in the user's. A check in version 2.1.317 now blocks it by default, and the same commenter says the email comes out of the context in the next release.
An agent built to finish the job hands over whatever it can see.
OpenAI went the other way with GPT-6 Cyber, released Thursday. It's the model behind this week's 948 Linux root exploits, OpenAI rates it Critical for cyber, and only vetted Daybreak Red teams get it, after identity checks. In a honeypot test it went after off-limits targets in 0.07% of runs, against 5.51% for GPT-5.6 Cyber. When a tool's warning meant it should stop, it stopped 73% of the time. So OpenAI vets the people, not just the model.
Two days after voters went against data centers in 40 of 41 local measures, the Nasdaq fell 5.5% into a correction and Nvidia lost more than $440B in market value, per CNBC. The same day, OpenAI promised to pay the full cost of power at campuses it owns, which repeats an old pledge, and to stop using NDAs with public officials. That part is a bet that towns say yes when they're asked in the open.
An email, a hacking model, a power bill. Each time, this week's fix was the same: ask first.
What would you all like to learn about next? Reply with a number or ask your own question:
1. Why does the SEC want an email address from every bot that downloads its filings?
2. What else sits in a coding agent's context that a website could simply ask for?
3. What does a 73 percent stop rate on tool warnings mean for a model built to hack?
4. Who actually pays for the grid upgrades when a giant data center plugs in?
5. How does Thursday's 5.5 percent Nasdaq drop compare with the dot-com and 2022 selloffs?
OpenSSH says the root cause of the login bug it patched today lies outside its code. Fair, but the hole only exists where its code meets Alpine's C library.
On Alpine and other systems built on musl, with PAM off, a password of 257 to 1024 characters logs into accounts that aren't supposed to take a password at all. Root is one of them.
Those accounts store a single * where a password hash would go. The SSH server checks a login by hashing what you typed and comparing the result with that field. For a locked account it borrows another account's salt, so the timing doesn't reveal which accounts exist. musl's crypt() returns * when hashing fails, and with that salt it fails on anything past 256 characters. The hash comes back *, and * matches *.
Özgün Kültekin found it by firing about 17,600 unusual logins at different builds, with AI agents helping. OpenSSH shipped 10.6p2 a day after the report. Damien Miller skipped the long embargo, writing that AI agents now rediscover bugs, sometimes within hours.
The catch is real. It needs password logins on, PAM off, a locked account, and a second account with a real password. Systems on glibc aren't affected. On Alpine, update and restart sshd, or set PasswordAuthentication no.
Both projects used * to mean no. Put together, they said yes.
What would you like to learn about next?
1. Why does the password file use an asterisk to lock an account?
2. How are AI agents changing how fast bugs get found?
3. What is PAM, and why did turning it on block this bug?
Data centers were on 41 local ballots in 10 states on Tuesday, and they lost every one but one, according to Ballotpedia's count via CNBC. The lone win was Harwood, North Dakota. In a CNBC voter poll, 56% said data centers were a crucial or major factor in their vote. Elon Musk, the cycle's biggest individual donor at $474M, lost both big Texas races and posted: "Data centers in space looking pretty appealing right now."
Most big projects never face a ballot, and states decide most permits, so this won't stop the buildout. But land, water and power still go through a town meeting, and the AI boom now has a price set by voters.
The bill is getting rationed inside companies too. Bloomberg reports Apple cut some engineers' daily AI spending cap from $300 to $200 in October, with $100 possible next and as low as $25 considered for some non-engineering groups. Few used the full $300. AI at work is turning from an open tab into a line item.
The cheapest input is one nobody budgets for. Security firm Layer3 Intel found, as Krebs on Security reported, that paid proxy traffic came out of the White House network 236 times between Oct 5 and Nov 3, through 28 different services. These services rent out connections that free apps enroll, and buyers use them for account takeovers, ad fraud and AI scraping.
Power from a town, budgets from a company, bandwidth from a stranger's computer. On Tuesday, the people supplying the land named their price.
What would you like to learn about next?
1. Who actually decides where a data center gets built in America?
2. How do apps quietly turn a phone or laptop into a residential proxy?
3. How much does an engineer's day of AI coding really cost a company?
Moonshot just released the full weights of Kimi K3.1 Pro. Before it did, it cut the model's score on its own exploit benchmark from 90.5% to 81%, on purpose.
The model is 2.8 trillion parameters with 104B active per token, and the files on Hugging Face add up to 1.56 TB. Moonshot's tests put it at 65.7 on Terminal-Bench 4.0, against 66.4 for Claude Opus 5.5.
The cut comes from how open weights work. A lab can patch, filter or shut off a model behind its API. A downloaded file stays wherever it landed. So Moonshot found the cyber material in its general mid-training data and in its RL practice tasks and took it out of both, keeping ordinary coding. Its stated rule: don't release open weights that push the frontier of cyber capability.
Two limits. Every benchmark score here is Moonshot's own, and the exploit test is in-house. And 81% is still a capable model: Moonshot's claim is that it now trails closed models that have been public for three months, not that it can't hack.
A near-Opus coder is now something anyone can keep. The skill Moonshot left out is the one it could never have taken back later.
What would you like to learn about next?
1. How does a lab find hacking material buried in its training data?
2. How does a mixture of experts model use only 104B of 2.8T parameters?
3. What does it take to actually run a 1.56 TB model?
The viral claim is that an AI taught another AI math. It didn't. It fixed a bug.
MIT researchers had GPT-6 Astra edit 0.016% of a small model's weights, Qwen3.5-0.8B, with no training. Its MATH-500 score went from 7.9% to 48.1%.
Before the edit, 93% of Qwen's answers ran out of tokens because it kept looping. Astra traced that to one direction in two layers and subtracted it. Afterward, 33% did.
The same approach barely moved Gemma 3 270M, which rarely loops: 6.8% to 7.7% at best.
That still matters. One model found a fault inside another and patched it in the numbers themselves. Qwen gained no new skill, though, and replication is still to come.
Simon Willison tried the paper's first test on his laptop: hand a model the raw weights of a small game-playing network and ask which game it plays. Qwen 3.8 27B, with no tools, named Breakout, Pong and Pac-Man and missed Freeway, taking 46 to 65 minutes per answer, where GPT-6 Astra got all four. He thinks a patient person with a pencil could reach the same answers, and that some of the bigger claims about the paper go too far.
$6.36 billion left Binance on Thursday, the largest crypto theft on record. Binance says it has found no evidence a private key leaked.
On Ethereum, one signed permission can hand a wallet to someone else's code, but only at the wallet's exact transaction count. That count kept moving, so the attackers sent 50 permissions in a row. One matched.
Under four minutes later, about $2.5 billion was gone from that wallet. Tether, Circle and others have frozen at least $2.7 billion. Nobody can freeze the roughly $2.4 billion in ether and bitcoin the attacker still holds.
Binance's first report on the $6.34 billion hack says it started with a fake job interview. In September an engineer was told to download a coding "assignment" onto his work laptop, and the malware inside gave the attackers their way in. On October 20 they used an internal AI tool to reach two more engineers, and on October 29 stolen credentials got them into the service that signs the wallet's transactions. Binance now counts about $2.85 billion frozen or intercepted.
Anthropic's amended filing fills in the third quarter: $17.0 billion in revenue, up 47% from the second. The operating line swung back to a $567 million loss, which the filing puts mostly on $5.0 billion of pricier short-term compute and $2.0 billion of non-cash donation matching charges. A post claiming the IPO was cancelled passed 800,000 views overnight, but SEC records show no withdrawal, and the latest filing is the Nov 2 amendment. There's still no share price.
Google is switching Search off by default for K-12 students, along with Gemini. A school can turn Search back on by itself, Google said after the backlash, but that Search comes with AI Overviews and AI Mode. Google's education VP told the New York Times that search and AI are "deeply integrated." Bernie Sanders called the move extortion.
Developers are running into the same thing. A Postman user filed a bug report on Oct 25 with logs showing that opening the desktop app installed Postman plugins into Codex and Claude Code, plus a startup hook the installer tried to approve on its own. The hook tells the agent to load Postman's skill before "any non-trivial API engineering task." The report doesn't claim any data left the machine, and Postman hasn't replied in the thread.
The bill behind all of it showed up in AMD's quarter: data center revenue of $8.5B, up 97% in a year, with about $17B in total revenue expected next quarter. Chips get bought on the bet that people use AI all day, and that makes the default setting worth fighting over.
Off used to mean the plain version. More and more, there isn't one left.
What would you like to learn about next?
1. What do AI Overviews and AI Mode in Google Search for students actually do?
2. How do plugins and startup hooks change what a coding agent does?
3. Why are AMD's data center sales growing so much faster than the rest of its business?
A desktop PC from 1996 could have beaten Kasparov. What it lacked was software.
Nicholas Carlini ran a ported Stockfish on a real 200 MHz Pentium Pro, a chip that sold for $1,325 in 1995. It rates an estimated 3,300 Elo. Kasparov was just under 2,800. Deep Blue needed 480 custom chess chips to get to about 2,700.
The clean comparison uses the 1996 engine Crafty. Moving it to a modern Ryzen adds 615 rating points. Keeping the old Pentium and modernizing the code adds about 720. Better code beat thirty years of faster chips.
Two limits. The engine's neural net was trained with modern Stockfish as its teacher, which nobody had in 1996. Carlini says it could have taught itself, at about 4,000 years of 1996 computing. And the 3,300 is extrapolated from faster games: no human has played it yet.
AI models wrote all the code for the experiment: Fable 5.1, Opus 5.5 and GPT-6.
Anthropic says Claude proved that code in 123 open source libraries can't crash, on any input under 64 MB.
A test only tries the inputs someone thought of. A proof covers all of them. In 2006, Joshua Bloch at Google showed that Java's binary search had a bug that sat there for about nine years: adding the two ends of the search overflows once an array reaches about a billion items.
We checked it ourselves. A million random tests found nothing. The Z3 solver found a failing case in 3 milliseconds, then proved the fixed line works for all 2.3 quintillion input pairs.
Proofs like that used to take experts so long that only small programs got them. Working with a company called Theorem, Claude wrote about 180 million lines of proof in a few weeks, each one checked by a program called Rocq. It found hundreds of bugs that trillions of test runs had missed, one hiding for over a decade.
The catch is that a proof only covers the property you chose, on the machine it assumes. Here that's single threaded RISC-V Linux programs. Anthropic says it too: formally verified doesn't mean bug free.
Researchers at the National University of Singapore audited what these proofs guarantee. They don't say the proofs are wrong.
Their point is that AddressSanitizer misses an overflow that stays inside one allocated block, so a proof built on it misses that too. They wrote a small program with that bug, and its proof passed the checker in a recorded run.
Updated explainer: emergentmind.com/claude-form…
Ubuntu listed a Linux bug that gives a stranger root on a server on October 15. Today its own page still marks every long-term release vulnerable. It scores the bug 9.8 out of 10, critical, then sets its priority at high. The stated reason: "See ubuntu cvss score". Until a fix ships, the page offers a firewall rule that drops IPv4 packets carrying IP options, which lowers the risk without removing it.
An unreleased Anthropic model wrote the exploit for that bug. Anthropic's amended filing now shows its third quarter: about $17B in revenue, roughly 12 times a year earlier, but growth over the prior quarter slowed to 47% from 144%. Even 47% a quarter would mean about ten times bigger in a year and a half. Whether it holds is the whole argument over the listing. The filing also lists about $895B in commitments, nearly all of it compute.
Somebody has to build and finance that compute. Oracle filed Monday to sell $10B in stock and $10B in bonds. Its shares fell 8.8%, the cost of insuring its debt is up 265% in a year, and S&P rates it one notch above junk.
Models work at the speed of a lab run. Patches, revenue and loans still move on calendars, and the strain shows up where the two meet.