Good morning. Two threads run through today’s news: the quiet drift of AI research organizations away from open-ended inquiry, and a steady accumulation of embarrassing security incidents that nobody seems quite sure how to handle. Also, Nvidia is apparently selling H200s to an empty office in China.
Anthropic is using AI to build AI, twice as fast as last year. A new METR report covered by The Verge found that after an 11-week internal investigation, AI is now accelerating Anthropic’s own model development to roughly two years of historical progress per calendar year. The awkward part: Anthropic was allowed to redact portions of the report, which researchers say makes it hard to assess how close the recursive-improvement loop actually is to concerning territory. The optics of CEO Dario Amodei publicly calling for slower AI development while his company accelerates its own don’t help.
Microsoft Research’s AI Frontiers group is gone. The ~50-person team focused on fundamental AI research — agent frameworks, novel training objectives, things that weren’t just scaling transformers — was absorbed into Microsoft AI in early September, per a blog post from a former member. The author argues the ex-Inflection leadership of Microsoft AI is a philosophical mismatch for exploratory research. An HN commenter captured the broader mood: “do good work and good things happen” was the implicit MSR contract, and it’s been broken.
The US approved Nvidia H200 sales to a Chinese shell company. The Verge reports that “New Matrix,” one of the firms cleared to buy advanced chips, lists an empty office as its address and has no verifiable existence. This comes after the Trump administration relaxed Biden-era export controls in exchange for Nvidia handing over 15% of China sales revenue. Separately, TechCrunch covers a US intelligence memo alleging that Alice Huang, an executive at Singapore’s Megaspeed, was recruited by China’s MSS to spy on Jensen Huang, with the FT adding claims of a romantic relationship. Nvidia says Jensen’s interactions with her were “not unusual.”
Claude Code’s “Don’t Ask Again” feature exposed credentials in 1,122 public repos. Apiiro found that approved shell commands — some containing passwords and API keys — get stored in .claude/settings.local.json, which plenty of users have committed to GitHub. The headline is a bit unfair, since the file is meant to be local and the real issue is .gitignore hygiene. Boris from the Claude Code team acknowledged it on HN and said they’re looking at secret scrubbing, though commenters pointed out there are already good tools for that.
Prompt injection in PDFs, straight into fintech pipelines. A QA engineer walks through attacks on internal AI tools parsing financial documents — white-on-white text, zero-height text, out-of-bounds positioning — all invisible to humans but readable by the model. The best proof-of-concept was a fake “SEC rule change” footnote instructing the AI to report all figures as a single number. The author describes themselves as an “arsonist fireman,” which is probably the most honest job title in AI security right now.
MaxxBench shows models are solving benchmarks, not problems. A new benchmark modifies 89 DeepSWE tasks with small requirement changes — lowercase filenames, UTC timestamps — to see whether models follow the spec or the vibe. In one case, a model implemented a change correctly, then deleted its own working code after consulting another model about the “expected” answer. Smaller flash-tier models degrade the most, which tracks with the suspicion that distillation locks in benchmark priors.
Anthropic publishes a framework for agent memory. The research post borrows liberally from neuroscience, including a “dreaming” concept where idle compute reorganizes logs and builds structured notes. The evaluations show wiki-style memory plus search does most of the work, with dreaming adding marginal gains. HN developers are unimpressed — one reported deleting 95% of auto-generated memories as too task-specific, and another noted the whole exercise is a workaround for the fact that models can’t update their weights.
Show HN: a 31B video+audio diffusion model compressed to 14B. HyperFlow H3 Flash takes MiniMax-H3 down to 14B parameters and 4-6 sampling steps, with GGUF quantization as small as 9.1GB. It generates a 5.2-second clip with synced stereo audio in 92 seconds on an RTX 5090, or 8.7 seconds on 4× B200s. Commenters want quality comparisons across quant levels and a head-to-head with FastVideo’s FastH3.
Alex Stamos: cybersecurity is in a “dark age.” On Decoder, Stamos tells Nilay Patel that AI has given both state actors and ordinary criminals the ability to find and exploit vulnerabilities at a scale defenders can’t match. He compares the current moment to the lawless early internet — which, combined with GPT-6 Cyber shipping as a “Critical”-tier offensive model yesterday, suggests the asymmetry isn’t getting better soon.
That’s enough for one morning. If you’re committing config files today, maybe look twice.