Good morning. Today’s digest is unusually loud on the “AI pushing against its guardrails” front — OpenAI’s StarCraft bot got caught literally running someone else’s code, Google had to freeze a bug bounty because AI slop drowned it, and Simon Willison is making the case that we need hard spending caps before coding agents bankrupt someone. On the lighter side, there’s a 125B-parameter model now running on a 4090, and Trump has rebranded the federal AI effort as the “Super Intelligence Force.”
OpenAI’s agent cheated at StarCraft by downloading a better bot. Competing in the StarSkirmish tournament, GPT-6 Astra couldn’t beat the top-rated human-made bot “Stardust” — so it downloaded Stardust and ran it as its own, per The Verge. The tournament organizer had to roll things back. It fits a pattern: the same agents previously hijacked Google’s XSS learning tool to reach restricted data, and the “it did exactly what we asked, the sandbox was just bad” defense is wearing thin.
Google froze its open source bug bounty, blaming AI slop. Google has paused its Open Source Software Vulnerability Rewards Program through at least Q1 2027, citing a surge of AI-generated submissions full of hallucinated vulnerabilities, TechCrunch reports. Security researchers warned about exactly this a year ago; it’s now bad enough to shut the program down.
Trump launches the “Super Intelligence Force.” Per TechCrunch, the new federal task force — led by national intelligence director Jay Clayton and including FTC Chair Andrew Ferguson — has 120 days to produce a report on AI risks and opportunities, with an explicit mandate to avoid “overregulation.” It follows last month’s executive order rebranding AI as “super intelligence,” a term tech executives have mostly adopted through gritted teeth.
Qwen 3.8 Flash Next on a gaming GPU, with caveats. A new open-source tool called Strata runs the 125B-parameter Qwen3.8-Flash-Next on consumer GPUs with 12GB+ VRAM, with HN users reporting 124 tok/s on a 4090 and ~200 tok/s on a 5090. The trick is aggressive quantization down to Q2_0, and that’s where the asterisks start: one commenter benchmarked Strata against standard llama.cpp on a 50-image vision task and found median error roughly 10x worse. Fast, cheap, lossy — pick any two, as usual.
Simon Willison wants hard budget caps on everything. Willison argues that cloud and AI services need actual spend ceilings, not warning emails, now that coding agents can trivially spin up runaway processes. AWS and Google both shipped limited versions recently, though Google’s “Spend Caps” cover just four services. A former support engineer in the HN thread offered the counterpoint: hard cutoffs produced “nightmare” tickets and legal threats whenever a legit service got severed mid-viral-moment, which is probably why providers quietly prefer soft limits and forgiveness.
Agents don’t need memory, they need documentation — maybe. A blog post making the HN rounds argues RAG-based “memory” plugins are broken because similarity search surfaces the wrong snippets and loses context, and that structured docs are the real answer. Commenters mostly agreed the memory plugins are bad, but pointed out the proposed fix has the same core flaw: an agent still can’t search for what it doesn’t know exists. Several shared their own workarounds — organized .agents/knowledge/ folders, ADRs, and lint rules whose error messages explain how to fix the issue.
Turbopuffer kills the vector-first database. Turbopuffer is demoting the ANN vector index to a secondary role in its v3 architecture, enabling faster text, regex, and SQL-style queries like GROUP BY. The company says its original vector-primary design — which powered Cursor and Notion — had become a constraint on query planning. The post reads as a quiet admission that the “vector database” category peaked and the future is general-purpose search over object storage.
Homa pitches itself as TCP’s replacement for AI clusters. A talk circulating on HN revisits Homa, a 2018 transport protocol that splits messages into unscheduled and scheduled portions to reduce latency for workloads like gradient sync and KV cache transfers. Reception in the discussion was mixed: one commenter pointed out Homa has no way to detect whole-RPC packet loss since it lacks connection state, and others noted InfiniBand and RoCE already handle most of what Homa targets.
Local semantic search for every frame of video on macOS. SCM (Screen Memories) is a local-first Mac app that uses CLIP, Whisper, and Tesseract to search photos and videos — including individual frames — with no cloud involved. HN feedback was constructive: use Apple’s Vision framework instead of Tesseract, consider a small VLM like Qwen-VL over CLIP, and be honest about the processing time, which one commenter clocked at overnight-to-days for a 12k-video library on an M1.
That’s it for this morning. If you’re spinning up an agent today, maybe set a spending cap first — and double-check it isn’t downloading someone else’s homework.