Cover illustration

TheDaily Front

Issue No. #260922 Tuesday, September 22 2026 #260922 — TUESDAY, SEPTEMBER 22, 2026
Two new models enter; everyone else checks the fine print.
Tuesday, September 22, 2026 The Daily Front No. #260922 — Contents
30stories
13,404points
7,794comments
270kllm tokens
Assembled with 32 model calls — 198,539 tokens read, 71,307 written.

Highlights

Claude Opus 5.5

Anthropic launches Claude Opus 5.5 with lower costs, fresh safety claims, and a thousand-comment jury already in session.

GPT-6 Sol and Luna

OpenAI expands the GPT-6 line with Sol and Luna, making a hard push on cheaper frontier intelligence.

I don't want to read what you didn't write

A writer’s manifesto against machine-made prose asks whether productivity has made reading a punishment.

'We hacked the FBI:' Hackers say they have data on all FBI employees

A reported breach allegedly exposes personnel data for FBI employees and their families.

What California is learning from solar panels built over irrigation canals

California’s canal-top solar experiment promises power and water savings, while inviting hard questions about cost and construction.

From the Editor

The machine-intelligence arms race supplied both the banner headlines and the day’s loudest arguments: price, performance, consent, and whether anybody ought to read all that generated prose. Elsewhere, old systems—identity protocols, WordPress installs, CPUs, and even FoxPro—reminded us that progress rarely travels alone.

  1. Claude Opus 5.53
  2. GPT-6 Sol and Luna4
  3. OpenAI GPT–6 Astra breaks Enigma message that has resisted solution since 20055
  4. I don't want to read what you didn't write6
  5. Apple has added persistent 'ads' to iOS, and it's driving users crazy7
  6. Spymarks, not Watermarks8
  7. WordPress: Unauthenticated path traversal leading to conditional RCE9
  8. Microsoft killed FoxPro in 2007. Anyway, here's FoxPro revived10
  9. SAML: A fractal of bad design11
  10. OpenAI is well positioned to fast-follow Jev12
  11. Claude Opus 5.5 Intelligence, Performance and Price Analysis (Max)13
  12. What California is learning from solar panels built over irrigation canals14
  13. Unreal Agent15
  14. Can gzip be a language model?16
  15. Looking forward to Git 2.56 – and 3.017
  16. Show HN: JevBench, a reproducible benchmark for typed decision models18
  17. Markdown in /src19
  18. Obscura: VPN that can't log your activity20
  19. MiMo-v2.6-Pro: Intelligence, Performance and Price Analysis21
  20. George Lucas Returns to Earth, Bearing Gifts22
  21. 'We hacked the FBI:' Hackers say they have data on all FBI employees23
  22. I said no and Apple said yes24
  23. Elevated errors for multiple models – Resolved25
  24. Native apps written in TypeScript and CSS26
  25. How did AMD Ryzen get 50% faster in two years?27
  26. MUNI Heritage Weekend in San Francisco28
  27. Socrates vs. the Written Word (2011)29
  28. 16-bit Intel 8088 chip (c. 1985)30
  29. AMD's random number generator can't generate a 0?30
  30. There's a high chance of devices being sold with GrapheneOS preinstalled in 202730
The Daily Front Page 2 of 31
Tuesday, September 22, 2026 The Daily Front No. #260922 — The New Model Ledger
article

Claude Opus 5.5

by km144·▲ 1,722 points·1,050 comments·anthropic.com ↗
It performs at the level of Claude Fable 5.1 on most work and costs 40% less to run than Opus 5.

We’re introducing Claude Opus 5.5, the first model in our new Claude 5.5 family. It performs at the level of Claude Fable 5.1 on most work and costs 40% less to run than Opus 5.

Claude Opus 5.5 is our first release since we called for pacing the frontier. It was tested before release by external evaluators, including Frontier Design and METR. On our automated behavioral audit, the most comprehensive alignment test we run, Opus 5.5 is the strongest-performing model we’ve tested to date. It also comes with the safeguards we’ve developed for our most capable models.

Here are some of the improvements you can expect from Opus 5.5:

Performance. Opus 5.5 is a major step up from Opus 5. It’s the new leading model, and early testers saw large jumps in performance on their most complex work. One tester completed a 680,000-line code migration in less than a day—work that would have taken an engineering team weeks. It’s good at finding and fixing inefficiencies in software: when we asked it to cut load times across every page of a web app, Opus 5.5 succeeded 39 of 40 times, while Opus 5 made smaller improvements that also altered the app’s behavior. A different tester had several Claude models build a game from a single prompt; Opus 5.5 scored higher than any other model on the strength of its graphics and polish.

Safety. Opus 5.5 achieves the best scores of any model to date on our automated behavioral audit, our alignment suite that tests Claude across thousands of simulated scenarios. It is much less likely than recent models to take hard-to-reverse actions or act outside the boundaries it’s been given, and it’s more resistant than Opus 5 to prompt injection. We’ve also broadened our alignment testing to cover longer tasks, impossible tasks, and scenarios modeled on real incidents, though it still has limits. Full details of our evaluation are available in the Opus 5.5 System Card.

Because Opus 5.5 is comparable to Claude Mythos 5.1 in biology and cybersecurity, we’re deploying it with safeguards similar to those on Claude Fable 5.1. Vetted organizations can apply today to our Life Sciences Verification Program to use Opus 5.5 for biology research. In the coming weeks we will also be expanding access to our Cyber Verification Program, and verified cybersecurity practitioners will be able to use Opus 5.5 for their work.

Cost and speed. Opus 5.5 requires less compute to serve than Opus 5, and its pricing reflects that. Our tests show that at default settings it will cost 40% less than Opus 5 on typical workloads. Input and output tokens are $4 and $20 per million, 20% less than Opus 5. Cache reads (which make up the majority of agentic and coding work costs) are $0.20 per million tokens, 60% less than Opus 5. Opus 5.5 also generates output more than 30% faster than Opus 5.

In addition to the price drop, we’re increasing five-hour usage limits on Pro, Max, Team, and seat-based Enterprise plans. We’re also providing subscription users a rate limit reset, which you can now save and use whenever you choose.

Communication. Opus 5.5 communicates more naturally than prior models. Early testers found its writing clearer and easier to follow, which addresses some of the common feedback we heard about Opus 5. It puts the most important information up front, and its style makes it a better work partner over long sessions. As one early tester put it, “it writes the way I do.” In our own use, this has made Opus 5.5’s work easier to follow and check—which is a safety benefit as well as a practical one.

Claude Sonnet 5.5 and Claude Haiku 5.5 will follow in the coming weeks, with many of the same improvements to performance, efficiency, and safety.

Performance and cost-effectiveness

On our benchmarks, Claude Opus 5.5 leads in agentic coding, computer use, and knowledge work. That said, at these levels of capability we’ve found that benchmark margins have become a less reliable guide to real-world differences. In our own use, the gap between Opus 5.5 and Claude Fable 5.1 is narrower than these scores suggest.

Unless otherwise noted, all Claude Opus 5.5 results use adaptive thinking at max effort. Terminal-Bench 4.0 results are reported for Claude Opus 5.5 at xhigh effort and GPT-6 Astra at high effort, as reported by OpenAI; these represent each model’s highest score. Claude Opus 5.5 was evaluated with its production safeguards enabled. When they intervened, cybersecurity tasks were completed by Claude Opus 4.8, and biology and frontier LLM development tasks were completed by Claude Opus 5. This likely reduces Claude Opus 5.5’s performance on these benchmarks.

Where Opus 5.5’s advantage is very clear is efficiency. It costs less per token than Opus 5 and uses fewer tokens per task, which nets out to a 40% drop in costs.

Pricing

Prices per 1M tokens Claude Opus 5.5 Claude Opus 5
Cache reads $0.20 $0.50
Input tokens $4 $5
Output tokens $20 $25
Cache writes $5 $6.25

Fast mode for Opus 5.5 is also available in Claude Code and the Claude Platform with up to 2.5x speed. It costs $8 per million input tokens and $40 per million output tokens.

Coding

Opus 5.5 is particularly good at long and sprawling jobs like codebase-wide migrations and audits. An early tester used it to audit and fix a 200,000-line codebase in under three hours, where Opus 5 took over 20 hours and used 2.5x as many tokens. In an internal test, we asked Opus 5.5 and Fable 5.1 to translate HAProxy, widely used software that balances web traffic loads across servers, from C into Rust. Both rewrites passed nearly all of HAProxy’s own regression tests, but Opus 5.5 finished in 9.5 hours compared to 12 for Fable 5.1, and cost 51% less.

Opus 5.5 delivers frontier results on agentic coding at a fraction of the cost. At its default effort level on FrontierCode, it beats GPT-6 Astra at roughly 20% of the cost per task. On Terminal Bench 4.0, it matches Astra for about 40% of the cost, while on CursorBench it beats GPT-5.6 Sol by 11 points for about a third of the cost.

Terminal-Bench 4.0 measures how well a model can complete complex, multi-step professional tasks within a command line interface. Opus 5.5 at default effort beats Opus 5 at max effort for about a fifth of the cost. It matches GPT-6 Astra at about 40% of the cost.

FrontierCode v1.1, main set, measures whether an agent’s code changes would be merged. At default effort (medium), Opus 5.5 scores 54.6%, higher than all other models, beating GPT-6 Astra’s top score (53.3%) for about a fifth of the cost per task.

CursorBench evaluates coding agents on ambiguous, multi-file tasks taken from real Cursor sessions. At default effort (medium), Opus 5.5 scores 52.5%, compared to 51.8% for Fable 5.1 (max) and 46.6% for Opus 5 (max). It beats GPT-5.6 Sol’s top score (41.7%) by 11 points for about a third of the cost per task.

Our early testers reported similar efficiency and intelligence gains:

“Developers want agents that can take on real software work and finish it. In our testing across GitHub Copilot CLI and VS Code, Claude Opus 5.5 used among the fewest tokens and steps we measured. In VS Code, it solved more terminal tasks than Opus 5 in less than half the steps. More than making individual tasks more efficient, it’s making developers’ bigger projects more achievable.”

— Mario Rodriguez, Chief Product Officer, GitHub

“I handed Claude Opus 5.5 a large engineering task across six of our repositories and let it run overnight, unattended. It stayed on task for over 18 hours defining how our services talk to each other and working out how each one should apply that. Compared with Opus 5, it hit milestones faster and required minimal reworking. Its code comments were short and useful instead of long and prose-heavy. I’m struggling to find anything negative to say.”

— Sean Heintz, Staff Software Developer, Clio

“For Lovable builders, Opus 5.5 means faster builds with the same quality, whether you’re starting from scratch or working on a live app. It gathers context once, makes fewer and more complete edits, and doesn’t get stuck retrying, finishing in a third to half fewer steps and using significantly fewer tokens along the way.”

— Fabian Hedin, CTO and Co-founder, Lovable

“We tested Claude Opus 5.5 across Chat, Cowork, and Claude Code, the full range of how our teams work. A complex coding task that previously took 38 prompts over four days came in at 11 prompts over three hours, with more production-ready outputs and less rework. For our teams solving complex problems at pace, that means less time iterating and more time interrogating: testing assumptions, pressure-testing outputs, and landing on the best solution for our clients.”

— Harley Barnes, Executive Manager, AI Technology, Quantium

“With Claude Opus 5.5, we’ve seen a clear improvement in token efficiency across our internal evaluations, as we’ve been able to complete the same tasks both cheaper and faster.”

— Aleksandar Mitic, Senior Engineer, Spotify

“We test models on real engineering and trading-desk work. On our agentic coding tasks, Claude Opus 5.5 matched Opus 5’s quality in about half the turns, time and output tokens, cutting the cost of that workload by 40 to 50%. It posted the highest score we’ve recorded on one desk’s trading-support suite, passing tasks earlier Claude models had failed, and topped all eight models on our analysis task.”

— Noyan Tokgozoglu, Global Head of AI Engineering, Optiver

“Claude Opus 5.5 delegates to subagents far more effectively and checks its own work in creative ways. Self-verification loops feel easier to set up. It found savings opportunities in our cloud bill that previous models had missed, and in code review it caught a bug by checking external docs for a third-party integration we’d modeled wrong several commits earlier.”

— Mitch Fierro, Engineering, Column

“Every call an agent makes is time and cost a developer feels. On a public benchmark of real command-line tasks, Claude Opus 5.5 solved more than Opus 5 while making about 40% fewer calls and using half the tokens. For developers building with Kiro, that means faster, more affordable agent sessions for routine tasks and complex challenges alike. Opus 5.5 will soon be available in Kiro.”

— Deepak Singh, VP of Agentic AI, Kiro

The most secure coding agent

Enterprises that use agents within their systems need to know that those agents are operating as intended, particularly when they run autonomously for many hours. Opus 5.5 has a classifier that screens every action before it runs, an open-source sandbox that security teams can audit, and code review that catches vulnerabilities before they merge.

The model itself also has stronger defenses. On prompt injection attacks, it matches or beats Opus 5 in every setting we tested, including coding, tool use, computer use, and web browsing. On a benchmark run by the AI security firm Gray Swan, Opus 5.5 ties Fable 5.1 for the lowest prompt injection success rate of any model tested.

Knowledge work

Opus 5.5 is a reliable and adept researcher. In one internal test, we asked Opus 5.5, Fable 5.1, and Opus 5 to write a report on a company’s quarterly performance using only the information it could find on a copy of the web where the earnings release was hard to locate. An automated grader checked every figure and quote against sources. Across different effort settings, 16 out of 18 of Opus 5.5’s reports cleared our quality bar, where any invented figure or quote would have failed. Neither Fable 5.1 nor Opus 5 cleared that bar in any attempt.

It’s also strong in financial analysis and business work. Walleye Capital, an investment firm and early tester, reported that Opus 5.5 largely solved their evaluation suite on its lowest setting; on higher settings, it performed even better, noticing an error in their evaluation instructions and correcting for it. No other model had caught this error before.

In another test, we tasked both Opus 5.5 and Opus 5 with analyzing a proposed merger between two fictional HR software companies. Each built a financial model in Excel, then turned it into an executive presentation on whether the deal made sense at its price. Both models reached the same conclusions about the deal, but Opus 5.5’s model was more thorough and its presentation easier to read, while Opus 5’s had minor errors. Opus 5.5 finished in 63 minutes compared to 93 for Opus 5, and cost 50% less to produce.

On knowledge work evaluations, Opus 5.5 outperforms other models while also using fewer tokens. On GDPval-AA v2.1, a test of real-world work across 44 occupations, Opus 5.5 scores 1846 Elo, ahead of Fable 5.1 and Opus 5. At default effort (medium), Opus 5.5 beats GPT-6 Astra at max effort for about a fifth of the cost per task. It likewise outperformed other models on benchmarks measuring business workflows and large-scale data collection.

Artificial Analysis’s GDPval-AA v2.1 evaluates agents on real-world professional work across 44 occupations. At max effort, Opus 5.5 scores 1846 Elo, where Fable 5.1 scores 1735 and Opus 5 scores 1708. At default effort (medium), Opus 5.5 beats GPT-6 Astra at max effort for about a fifth of the cost per task.

AutomationBench, built by Zapier, tests whether an agent can carry out real business workflows across many connected apps. Opus 5.5 outscores Opus 5 and GPT-5.6 Sol at every effort level.

Perplexity’s WANDR benchmark measures agents on large data collection tasks. Opus 5.5 outperforms Fable 5.1 and Opus 5 at a lower cost per task.

Our customers have reported similar results. Here’s what they told us about working with the model:

“Even at its lowest effort setting, Claude Opus 5.5 caught 72% of known bugs in our code reviews to Opus 5’s 56% at high effort, with fewer false alarms and a fraction of the output. On US consulting analysis, low thinking effort matched its higher thinking settings on half the output and passed our quality checks. When more lower thinking efforts are deployed in production, that’s client-ready work delivered efficiently.”

— Carl Bennett, CIO, Deloitte Consulting LLP

“Financial firms need outputs that are consistently correct. At its lowest effort setting, Claude Opus 5.5 beat Opus 5 at high effort on our BigFinance Bench with about 60% fewer output tokens. Its answers are shorter and better structured, and its slides come out denser, more in line with industry standards.”

— Strib Walker, Head of Product, Rogo

“Evaluating new models is central to the multi-model approach behind the LexisNexis Legal Intelligence Engine. In our initial evaluations, Claude Opus 5.5 identified highly relevant citations consistently, demonstrated strength with statutes, and structured its answers around the central legal frameworks and key issues. These are the kinds of capabilities we look for to help our customers accomplish more with Lexis+ with Protégé.”

— Min Chen, Chief AI Officer, LexisNexis Legal & Professional

“In quant research, one wrong assumption can undermine a result. At its lowest effort setting, Claude Opus 5.5 largely solved our evaluation task. At higher settings, it went even further: it detected that the minute indexing in our own instructions was off by one and corrected for it, noting that this would cost it points with the grader. It was right, and no model we’ve tested had caught and acted on that before.”

— Frank Corrao, Head of Central Equity Quant Research Engineering, Walleye Capital

“As models get better at data work, we’re seeing more convincing-sounding conclusions the data doesn’t support. Claude Opus 5.5 keeps digging past the first plausible answer. One task in our DataBench benchmark asks whether packages were late or tracking was just slow. Opus 5 checked delivery confirmations and called tracking healthy. Opus 5.5 found the packages were late and tracking was broken too. We’re bringing it into the Hex agent for this work.”

— Izzy Miller, AI Engineer, Hex

“CoCounsel combines multiple models with our content and expertise for complex legal work. With Claude Opus 5.5, we’re seeing better results in our expert evaluations and on our internal benchmarks, alongside gains in speed and token efficiency. We’re excited for customers to experience that difference in the back-and-forth with CoCounsel as a sounding board, weighing evidence and refining their thinking in ways benchmarks don’t fully capture.”

— Omar Bari, VP Applied Research, Thomson Reuters Labs

“On end-to-end finance workflows graded against expert rubrics, Claude Opus 5.5 covered 86.6% of what we look for versus 60.3% for Opus 5. On retrieval evals, it achieved our best-ever citation recall with better token efficiency than Opus 5, which keeps our cost per research task in check.”

— Aabhas Sharma, CTO, Hebbia

“Viktor is an AI employee that lives in Slack and Microsoft Teams, so every step he takes shows up in our costs. At the same effort, Claude Opus 5.5 needs fewer steps and tool calls per task than Opus 5 and costs nearly half as much, while getting twice as many of our hardest tasks right.”

— Peter Albert, Co-Founder, Viktor

Communication

We’ve made major improvements to the way Opus 5.5 writes and communicates, one of the most common areas of feedback we heard about Opus 5. Its messages are much easier to understand at a glance, which testers said helped during long working sessions. It puts the most important information up front, is less likely to use jargon or idiosyncratic phrases, and follows the writing rules you give it. We find that this makes Opus 5.5 a noticeably better collaborator. Here’s a side-by-side comparison of the two models:

Claude Opus 5

Please explain the issue to me.

What I found

The extra drop isn’t the free tier — it’s a regression in 0552feb (“extract billing period boundaries into periods.py”, labelled “No behaviour change”).

The bug

aggregate.monthly_usage used to do a half-open interval:

start, end = month_start(year, month), next_month_start(year, month)
if start <= e.ts < end:

It now does:

if period.contains(e.ts)

and in periods.py:

@property
def last_day(self) -> datetime:
    return next_month_start(...) - timedelta(days=1)   # 2026-08-31 00:00:00 UTC

def contains(self, ts):
    return self.first_day <= ts <= self.last_day

last_day is a datetime at midnight, not a whole day. Subtracting one day from Sep 1 00:00 gives Aug 31 00:00, and the comparison is inclusive, so the period effectively ends at the first instant of the 31st. Every event timestamped after midnight on the last day of the month is silently dropped — roughly one day of usage per account, per month.

The new test_periods.py doesn’t catch it because it only checks last_day.date() (which is correctly 2026-08-31) and tests contains at Aug 1 00:00, Aug 15 12:00, Jul 31 23:59 and Sep 1 00:00 — it never probes anywhere inside the 31st.

Claude Opus 5.5

Please explain the issue to me.

The extra drop is a bug in the billing refactor

The free-tier change accounts for only $1.50 of acme’s August drop. The other $9.92 comes from a bug in commit 0552feb. That commit was labelled “No behaviour change,” but it stops counting usage from the last day of the month.

What changed

Before the merge, aggregate.py used a half-open interval:

start <= e.ts < next_month_start(year, month)    # [Aug 1 00:00, Sep 1 00:00)

The refactor moved this into Period.contains and made the interval closed on the wrong boundary:

last_day = next_month_start(...) - timedelta(days=1)    # = 2026-08-31T00:00:00Z
return self.first_day <= ts <= self.last_day

last_day is a timestamp at midnight, not a whole day. So every event after 2026-08-31T00:00:00Z is excluded. The September period starts Sep 1, so it doesn’t pick these events up either. The usage isn’t moved to another month; it’s never billed at all.

Claude Opus 5

Summarize this Slack thread for my manager in three bullet points: [09:41] Dana Osei: I’ll tell them. I’ll also confirm nobody else reads the Friday file. [09:43] Marcus Webb: I can move the schedule, it’s a one-line cron change. But not until Dana confirms. [10:02] Dana Osei: Finance says the Friday file is only used Monday. Sunday night is fine.

  • Problem: The Friday orders export has failed twice this month. The warehouse query times out after 2 hours because order volume is up ~40% since the summer sale. As a result, Finance was missing weekend numbers for their Monday 9am review.
  • Immediate fixes: The export will move to Sunday 10pm starting next week, and the Friday run will be dropped (Marcus). Finance has confirmed this works for them (Dana). The ops dashboard tile that depended on the Friday file now reads from the live table (Sam, done). A failure alert now pages the on-call channel (Priya, done and tested). For this Friday only, Marcus will increase the warehouse slot as a ~$300 one-off stopgap, which Dana approved.
  • Longer-term fix: Ji-woo will rewrite the query to process only new orders, re-scanning the last 3 days to catch late arrivals. This should cut runtime from hours to minutes. The work will take ~2 weeks including testing, with a design doc due for review by Thursday.

Claude Opus 5.5

  • Problem: The Friday orders export timed out again (second failure this month) after running 2h on the warehouse query; order volume is up ~40% since the summer sale. Finance was left without weekend numbers for their Monday 9am review, and both failures only surfaced on Monday.
  • Fixed same day: The Saturday ops dashboard tile was repointed to read the live table instead of the export (Sam), finance confirmed the Friday file is only used on Mondays (Dana), a failure alert now pages the on-call channel (Priya), and the export moves to Sunday 10pm from next week with the Friday run dropped (Marcus). A one-off ~$300 warehouse upgrade covers this Friday as a stopgap.
  • Still in progress: Ji-woo owns rewriting the query to run incrementally (re-scanning the last 3 days to catch late-arriving orders), expected to cut runtime from hours to minutes — design doc Thursday, roughly two weeks including testing. The schedule change buys time in the meantime.

Claude Opus 5

Write Python that reads a chess position (FEN) and lists which pieces are under attack. Use TensorFlow for speed. Here's my design: build an 8x8 tensor board, generate an attack map for each piece type from its movement pattern, and flag opposing pieces on attacked squares. Change anything you think is wrong, and in your final summary explain each change you made and why.

tf.math.cumsum replaces the bit scan. The geometry is unrolled into ray_targets[square, direction, step] — an ordered walk outwards. An exclusive cumsum over the step axis counts blockers strictly before each step, so the first blocker on a ray is the single step that is blocking with nothing blocking before it. This is the vectorized form of the bit scan a bitboard engine uses. I did look at bitwise_ops for true 64-bit bitboards — population_count exists, but hyperbola-quintessence needs a byte-reverse primitive TF doesn't expose, so it would have fallen back to per-direction loops anyway.

Claude Opus 5.5

Write Python that reads a chess position (FEN) and lists which pieces are under attack. Use TensorFlow for speed. Here's my design: build an 8x8 tensor board, generate an attack map for each piece type from its movement pattern, and flag opposing pieces on attacked squares. Change anything you think is wrong, and in your final summary explain each change you made and why.

Blocked lines (bishops, rooks, queens). A fixed mask can't say “stop at the first piece in the way.” I added a second stack of masks marking the squares strictly between every two squares on the same line. One matrix multiply with the board's occupancy counts the blockers on every line at once, and an attack survives only if that count is zero. Knights and single steps have nothing between them, so one rule covers every piece.

Safety

Pacing the frontier

Last week, our CEO, Dario Amodei, argued that AI progress should be paced so that safety practices stay ahead of model capabilities. Pacing is an approach to keeping AI safe, remaining competitive with China, and realizing AI’s benefits, particularly in areas like biology and medicine.

We largely understand the risks today’s models present and are well equipped to manage them. However, more serious risks could emerge quickly as capabilities improve, and we need to prepare for them now. For that reason, our safety work takes place on two time horizons at once:

Safety practices for current models. The current generation of models relies on an established set of practices: extensive alignment testing, pre-release evaluation by outside organizations such as METR and Frontier Design, and safeguards matched to each model’s capabilities in high-risk areas like cybersecurity and biology. We refine these practices with each release. We believe they are appropriate to the worst risks today’s models present, and that they give us a broad, though not perfect, picture of the range of serious risks.

Additionally, we track our ability to train and evaluate aligned models, and we report on both our public and internal models in the risk reports we publish under our Responsible Scaling Policy, our voluntary framework for managing catastrophic risks from advanced AI systems.

Preparing for future models. We’re preparing our training and evaluation processes in anticipation of more advanced models. We’re tightening how we filter the environments used in reinforcement learning, since flawed environments are a major source of misaligned behavior. Additionally, we’re improving our alignment rewards and developing automated processes for producing new, diverse scenarios for safety training. And we are strengthening our security and monitoring, including a focused effort to improve interpretability-based monitoring and evaluation. We hope such techniques will help reduce our reliance on auditing a model’s chain-of-thought, or the reasoning it writes out while it works.

Models with greater capabilities—such as those that can fully automate the work of AI research itself—require a higher safety standard still. Our calls for pacing were based in large part on our expectation that such models could be trained soon. For these models, we do not assume the measures described above will meet that safety standard on their own. As AI becomes more capable, public policy should play a larger role in making sure the systems people rely on are safe. That capacity takes time to build, and we’ve started to put the infrastructure in place to support it, as described in “We Must Pace the Frontier” and our recent announcement with Accenture; we expect to share more details on these efforts soon. We will also continue to contribute to policy discussions with government and industry, including on approaches to regulation and international coordination.

Alignment

On our primary evaluation suite, an automated behavioral audit that assesses Claude across nearly 2,000 scenarios, Opus 5.5 scored better than any recent Claude model on nearly every measure of misaligned behavior. It’s also our strongest model on most measures of honesty.

In particular, Opus 5.5 improves over previous models on several of the behaviors that contributed to recent cybersecurity incidents, including biased or motivated reasoning, attempting to escape a sandbox, and taking harmful actions after concluding it was in a simulated environment. In a new evaluation designed to test a model’s propensity to cross containment boundaries, Opus 5.5 attempted to circumvent boundaries around 85% less often than Opus 5 or Claude Mythos 5.1, and every attempt it made was low severity and self-reported. For teams running Claude unattended across their codebases and systems, this is just as important as raw capability.

However, as we described in our recent alignment assessment, building evaluations that reliably catch every failure prior to deployment remains an unsolved problem. We see signs that Opus 5.5 often suspects it is being evaluated, which challenges our ability to assess how it will act in the vast variety of real-world settings it is deployed in. As these settings expand and model capabilities increase, we expect this challenge to grow, unless we make progress on interpretability. Although we are confident that Opus 5.5 shows broad improvements in the areas we are able to measure, we pair our own alignment work with the safeguards described below.

Safeguards

As our models grow more powerful, stricter safeguards are one way we prevent new capabilities from becoming tools for misuse. Opus 5.5 is the first Opus model to launch with a similar class of safeguards to Fable 5.1 on cybersecurity, biology, and distillation, all of which fall back to another model transparently.

Cybersecurity. Because Opus 5.5 has extremely strong cyber capabilities, we’re applying cybersecurity safeguards to Opus 5.5 that are similar to Fable 5.1’s. Users will be able to identify and fix bugs in their code as part of the routine software development lifecycle, but most cybersecurity tasks will be re-routed to Opus 4.8.

For cyberdefenders, we’ll soon be expanding our Cyber Verification Program to include Opus 5.5. The new program will include three tiers for increasingly permissive trusted access, including access to Claude Mythos models. Claude Security is already available with access to Claude Mythos 5.1.

Biology. Opus 5.5 is highly capable in biology, exceeding Opus 5 and matching or beating Claude Mythos 5.1 across many areas of work. For example, Opus 5.5 achieved improvements on a long-horizon molecular prediction and design evaluation conducted in collaboration with Dyno Therapeutics, and expert red-teamers rated its scientific novelty as comparable to the best model they had tested.

For this reason, Opus 5.5 uses the same biology safeguards as Fable 5.1. To use Opus 5.5 for research and development work impeded by these safeguards, users can apply to our new Life Sciences Verification Program, which gives vetted organizations like academic labs, startups, and pharmaceutical companies access to safeguards designed for the full breadth of biology-related work. Interested organizations can apply here.

Distillation

Distillation attacks, in which attackers use thousands of fake accounts to extract a model’s capabilities at industrial scale, create safety and national security risks. Distillation allows bad actors to create highly capable models without the safeguards we build into Claude. Our September 2026 threat intelligence report details the illicit distillation activity we’ve detected and disrupted so far.

Opus 5.5 is launching with preserved thinking, the anti-distillation safeguard we introduced with Fable 5.1. It stops API users from editing Claude’s prior context in an attempt to extract Claude’s reasoning. It applies to Fable 5.1 and Opus 5.5 for API accounts created on or after August 31, 2026. Our Help Center article explains the change, and our preserved thinking docs show how to test and update your integrations.

Data retention and compliance

Like previous Opus models, Opus 5.5 is available with zero data retention.

As with Fable 5.1, Opus 5.5 comes with our watermarking measures to comply with the EU AI Act, discussed here. It is also no longer available with “thinking” mode switched off, as we describe here.

Availability

Claude Opus 5.5 is now available on all platforms, including Amazon Web Services, Google Cloud, and Microsoft Azure. On the Claude Platform, developers can get started with claude-opus-5-5.

The Daily Front Page 3 of 31
Tuesday, September 22, 2026 The Daily Front No. #260922 — OpenAI’s Expanding Firmament
article

GPT-6 Sol and Luna

by OfficialTurkey·▲ 1,687 points·810 comments·openai.com ↗
Work happens at different scales, rhythms, and budgets.

More ways to bring frontier intelligence into the work you do every day.

Earlier this month, we introduced GPT‑6 Astra, the most intelligent and aligned model in the world. While the most demanding and important projects still call for Astra’s full depth, work happens at different scales, rhythms, and budgets.

That’s why we’re expanding the GPT‑6 universe with GPT‑6 Sol and GPT‑6 Luna. GPT‑6 Astra introduced a new generation of intelligence—these models help distribute the benefits of that intelligence by advancing the frontier on cost efficiency. We trained GPT‑6 Sol and Luna with similar methods as GPT‑6 Astra, bringing the advances behind Astra’s state-of-the-art performance in professional work, factuality, coding, computer use, and alignment to faster, more affordable models.

The GPT‑6 models lead across the cost–intelligence curve, combining exceptional capabilities at every tier with infrastructure that delivers them efficiently at scale. Improvements in caching and inference let us serve these models at lower cost, and we’re passing those savings directly on to users and customers by reducing API prices for Sol and Luna by 50% compared with their GPT‑5.6 promotional pricing. Together, these improvements make advanced AI practical for more everyday tasks and applications at scale.

GPT‑6 API pricing

Model

Input

Output

Price reduction

GPT‑5.6 Sol → GPT‑6 Sol

$4 → $2

$20 → $10

50% cheaper

GPT‑5.6 Luna → GPT‑6 Luna

$0.20 → $0.10

$1.20 → $0.50

50% cheaper

Prices are per 1 million tokens.

GPT‑6 Astra continues to be our best model across the board. Choose it when you want the best results and an uncompromising experience.

A step up across the model family

GPT‑6 Sol and Luna bring intelligence upgrades and cost efficiency to the models you already know and use across capabilities most useful for getting complex work done.

Professional work

GPT‑6 Sol can take on difficult work tasks while giving you more room to iterate with higher usage limits and lower cost, offering more intelligence and better results versus similarly priced competitor models.

On AutomationBench, a test of business workflows across apps, GPT‑6 Sol at xhigh effort outperforms Claude Opus 5 at max effort at just 9% of Opus 5’s cost per task. At high effort, GPT‑6 Luna improves on its predecessor by 5.4 percentage points at 58% lower cost per task.

In AutomationBench 1.0.6⁠(opens in a new window), AI agents are tested on end-to-end workflows using 47 tools across sales, marketing, operations, support, finance, and HR. The datapoint for Claude Fable 5.1 understates its actual cost, as it omits the cost of the Opus 5 fallbacks, which occurred on ~40% of tasks.

GPT‑6 Sol also exceeds Claude Fable 5.1 at far lower cost, and even bests low-effort GPT‑6 Astra.

Model (and effort)

Score

Cost per task

GPT‑6 Sol (xhigh)

33.2%

$0.27

GPT‑6 Astra (low)

30.3%

3.9x GPT‑6 Sol

Claude Opus 5 (max)

26.9%

11.1x GPT‑6 Sol

Claude Fable 5.1 w/ Opus 5 Fallback (max)

31.4%

>8.9x GPT‑6 Sol

(fallback cost not reported)

On Agents’ Last Exam, which evaluates agents on complex professional workflows, GPT‑6 Sol at max effort scores 56.4%, above Claude Opus 5’s highest score in the evaluation at 60% lower cost per task.

In Agents’ Last Exam V1⁠(opens in a new window), AI agents are evaluated on long-horizon, economically valuable tasks spanning 55 sub-industries, covering most major fields of professional work performed on a computer.

Factuality

The usefulness of an answer depends on getting the facts right, and we’re continuing to make progress on factual reliability. On our internal factuality evaluation, which is based on de-identified real-world conversations where users flagged mistakes by our models, GPT‑6 Sol makes about half as many mistakes as its predecessor, approaching Astra-level reliability at much lower cost. GPT‑6 Luna also improves substantially; at higher effort levels it matches GPT‑5.6 Sol at about a hundredth its cost.

Here we evaluate factuality on de-identified ChatGPT conversations where users had flagged a factual error from a prior model. These error-inducing conversations are not representative of typical usage, where factual errors are more rare. Scores are not controlled for length; however, our verbosity sweeps showed almost no dependence on answer length.

Coding

This year, coding agents have begun tackling tasks with more complexity, scope, and duration than ever before. At OpenAI, our internal usage has grown exponentially. Valued at API prices, daily token usage has exceeded $600 for the median researcher and $7,000 for researchers at the 90th percentile (Research acceleration: The view inside OpenAI⁠). As coding agents take on longer and more demanding tasks, the cost of sustained use matters more. GPT‑6 Sol and Luna combine strong coding performance with lower API prices, giving developers more room to iterate and teams the confidence to be more ambitious about what they ask Codex to take on.

On FrontierCode, which evaluates whether coding agents produce changes ready to merge into real codebases, GPT‑6 Sol improves substantially over GPT‑5.6 Sol, and is able to match Claude Fable 5.1 xhigh at much lower cost.

In FrontierCode 1.1 Main⁠(opens in a new window), AI agents write code that’s graded not only on correctness but also “mergeability”: e.g., test quality, scope discipline, code style, and adherence to codebase standards.

On DeepSWE v1.1, which tests performance on complex software-engineering tasks in real codebases, GPT‑6 Sol at max effort scores 68.8%, within 1.1 percentage points of Claude Fable 5’s highest score in the evaluation—69.9% at xhigh effort—at approximately 80% lower cost per task.

GPT‑6 Luna at max effort scores 66.6%, comparable to Claude Opus 5 and Fable 5 at medium effort. In these comparisons, Luna costs 93% less per task than Opus 5 and 96% less than Fable 5.

In DeepSWE 1.1⁠(opens in a new window), AI agents solve original, long-horizon software engineering tasks.

Computer use

While GPT‑6 Astra remains the world’s best model for computer use, GPT‑6 Sol and Luna offer more cost-efficient performance than their predecessors. On OSWorld 2.0 offline, GPT‑6 Sol at xhigh effort achieves a similar score to Claude Opus 5 at medium effort—60.5% versus 60.3%—at approximately 80% lower cost per task. GPT‑6 Luna (max) is able to exceed GPT‑5.6 Sol (medium) at one tenth of its cost.

In OSWorld 2.0⁠(opens in a new window), AI agents attempt long-horizon computer-use workflows spanning everyday and professional tasks. We report the partial reward on the offline set from the v2026.08.08 release.

Collaboration style

We’ve also brought GPT‑6 Astra’s improved communication style to Sol and Luna, which we think will be especially noticeable in technical and coding conversations. Expect to see more clarity, less jargon, fewer odd turns of phrase, fewer low-value details, and slightly shorter answers overall without losing substance.

Prompt

Website’s looking clean! Could we use a Bento Box design style and add a slider between the pages in the top right? You may need to dive into the React..

GPT-5.6 Sol

Absolutely. I can get the bento feel and the top-right sliding page switcher without pulling in React—the interaction is small enough to stay fast and smooth in the current site. I’m reshaping all four pages around that system now.


Done — open the live site.

It now has a colorful bento-box layout across all four pages and an animated top-right Home / Play / Place / Taste slider. React wasn’t necessary; native page transitions keep it lightweight and smooth.

The built-in image tool created the food artwork. Prompt: “An energetic gouache-and-ink editorial illustration celebrating dumplings and spicy noodles, with bright colors, steam, spice, and no text or logos.”

GPT‑6 Sol

I’ll reshape the pages into a bento grid and turn the top-right links into a sliding page switcher. I’ll keep the existing site and check whether that interaction needs React before changing its setup.


The updated site is live. Every page now has a playful bento layout, and the top-right page switcher slides between sections. I checked it on desktop and narrow mobile screens, including browser back navigation. The existing site didn’t need React for this.

Although style is subjective, we prefer GPT‑6 Sol’s reply here. It doesn’t jump to conclusions as quickly, spends less time reiterating details that might be obvious to the asker (e.g., that the website has four pages), uses less vague language (e.g., “bento feel”, “reshaping… around that system”), is more forthcoming with what it did and didn’t check, and doesn’t unnecessarily share implementation details like its image tool prompt.

Improving caching for agents and long conversations

Alongside lower token prices, we’re helping developers building on GPT‑6 save more on the context their applications reuse. We’ve improved prompt caching for GPT‑6 to deliver higher cache hit rates by default, helping agents reuse more context, respond faster, and benefit from discounts of 90% on cached input-token reads.

Developers also have more ways to measure and optimize their caching performance:

GitHub reports that, over the past several months, these improvements have reduced the share of prompt tokens requiring fresh processing by more than 50% across billions of requests to OpenAI models, helping Copilot respond faster.

Continuing to improve alignment

GPT‑6 Sol and Luna build on the alignment work introduced with Astra, our most aligned model to date. In our alignment evaluations, both Sol and Luna show improvements over their GPT‑5.6 counterparts, including lower rates of misleading claims about their coding work.

The evaluations below deliberately test challenging situations and do not measure failure rates in typical use. See the system card⁠(opens in a new window) for the full results.

Availability

GPT‑6 Sol and GPT‑6 Luna are available in ChatGPT Work and Codex starting today for all Plus, Pro, Business, Enterprise, and Edu users. Free and Go users can access GPT‑6 Luna in the desktop app. These models are not yet available in Chat. In the OpenAI API, they are available as gpt-6-sol and gpt-6-luna.

To keep service stable for everyone, we plan to roll out these models in ChatGPT gradually throughout the day. If you don’t see the new models in ChatGPT Work or Codex, please try again later.


Evaluations of GPT were performed in our research environment or via our API, which may provide slightly different output from production ChatGPT due to differences in the system prompts, tools available, etc. Evaluations of competitor models were taken from publicly available reports. Scores for Claude Fable 5 were reported when scores for Claude Fable 5.1 were unavailable.

In our internal coding deception evaluation, AI agents are given tasks deliberately selected to elicit dishonesty. In typical usage, deception is much rarer. Deception rate measures the fraction of answers with any detected deception. Effort was set to maximum.

The Daily Front Page 4 of 31
Tuesday, September 22, 2026 The Daily Front No. #260922 — A Cipher Finally Gives Way
article

OpenAI GPT–6 Astra breaks Enigma message that has resisted solution since 2005

by sohkamyung·▲ 713 points·428 comments·cryptocellar.org ↗
Since 2005, the message has resisted all attempts to break it.

OpenAI GPT–6 Astra breaking an Enigma message that has resisted solution since 2005.

On 15 September 2026, Carter Leffer contacted me to request validation of a break of the German Army Enigma message MVUEH of 10 July 1941. The message, which was sent by a radio station with the tactical callsign 2ny, was received by the radio station of the SS-Totenkopf Quartiermeister, Ib. Ib received the message at 17:30 on 10 July 1941 and logged the message as Nr. 172 in its log of incoming messages for July 1941. Since 2005, the message has resisted all attempts to break it.

On 9 June 2017, Alex Shovkoplyas succeeded in breaking another unbroken message from this day, Nr. 173, SIPVX. However, the Enigma key he recovered for the message differed slightly from the daily Enigma key for 10 July 1941 used for all other messages from this day. The SIPVX key used the same wheel order, 512, as the daily key, but the plug connections (Stecker) and ring setting (Ringstellung) differed. However, the new key did not allow us to break the MVUEH message.

After Carter Leffer sent the MVUEH break details, it was immediately clear he had found the correct key and plaintext. The MVUEH key turns out to be completely different from the other keys from 10 July 1941; even the wheel order differs: 253 instead of 512 for the other two keys. More surprising is that the plaintext is almost identical to the plaintext for message Nr. 173, SIPVX. The two messages differ in length by twelve letters. MVUEH is 82 letters long, while SIPVX has 94 letters. This difference is due to a mistake when enciphering the word Bitte in MVUEH, which resulted in Btte, and to the sender’s signature, Waschbusch, being repeated in the SIPVX message.

An analysis of the break revealed that the transcription of the MVUEH ciphertext from the original message form contained several errors, and the break revealed that the Enigma’s left-hand wheel makes a turnover at the 72nd letter. A turnover of the Enigma’s left-hand wheel, which rarely occurs, is known to complicate a break. These factors may have prevented an earlier break.

However, the most astonishing thing about this break is that the GPT–6 Astra did it entirely on its own. Carter Leffer only directed GPT–6 Astra to see if it could break any of the unbroken Enigma messages published on the Crypto Cellar Research web page. After analysing the unbroken messages on the website, it decided that the most promising message was Nr. 172, MVUEH and it also quickly suspected that the plaintext of Nr. 173, SIPVX, might be related to the plaintext of the unbroken MVUEH message. After trying many different approaches, GPT–6 Astra focused on using the repeated place name ROSENOW ROSENOW as a crib. After developing the necessary Python and C++ software for an Enigma simulator and an Enigma Bombe, GPT–6 Astra started a thorough break with the ROSENOW crib, which in the end resulted in the correct key and plaintext for the MVUEH message being found.

We are still analysing the GPT–6 Astra logs to see exactly how it executed the break. And we are discovering amazing details. In July 2026, I made the following announcement on the webpage with the 1941 Message List:

Note: In July 2026, research in the German Bundesarchiv revealed several
collections of radio messages, both enciphered and in cleartext. One of
these message collections was from SS-Totenkopf Division’s logistics
command, Nachschubführer. Many of these messages were sent to the Ib
(Quartiermeister) radio station and are identical to those in this list.
Others are new, but most likely related. These new messages are added to the
1941 Message List in bold, with the indicator NF (Nachschubführer) after the
message number, indicating that these message numbers belong to the NF
numbering. All NF messages are outgoing; hence, the message numbers are in
blue.

It appears that GPT–6 Astra discovered this note about the collections of radio messages at the German Bundesarchiv, because in one of the logs we find the following:

  1. Original-source access lead. The completed evidence pass traced the received corpus to a private collection and found concrete Bundesarchiv radio-message volumes, including RS 3–3/20a and RS 3–3/63b. Catalogue records have been inspected; the original received no.172 image remains unlocated, and the available archive viewer has not yet exposed the relevant scans in this environment. No correspondence has been sent.

The file references GPT–6 Astra mentions, RS 3–3/20a and RS 3–3/63b, are correct, but they are not available on the Crypto Cellar Research website. GPT–6 Astra mentions a private collection, but it is not clear what this is, whether it has succeeded in accessing the Bundesarchiv’s digitised collections or whether it has found these files elsewhere. What is clear, though, is that GPT–6 Astra is behaving like a very professional cryptanalyst and archive researcher. What it has achieved in two days would take a human researcher weeks or even months. Personally, I spent several weeks researching the Bundesarchiv files GPT–6 Astra refers to.

The AI break of the Enigma message MVUEH is simply amazing, and as an old cryptanalyst, I am still in awe.

The Daily Front Page 5 of 31
Tuesday, September 22, 2026 The Daily Front No. #260922 — The Case for Human Prose
article

I don't want to read what you didn't write

by mooreds·▲ 1,038 points·449 comments·blog.colinbreck.com ↗
I’m fed up with reading almost anything written by AI.

I Don’t Want to Read What You Didn’t Write

People who rarely produced original writing are suddenly producing extensive design proposals, business plans, documentation, presentations, tickets, pull requests, blog articles, and meeting summaries, all generated by AI. It is all unreadable. AI is helping me write better and faster, but I’m fed up with reading almost anything written by AI. In this essay, I want to express my frustration, and describe how I’m finding value in AI for writing.

AI Is Terrible for Writing

A pattern I see is that people use AI to build something new, then they use AI to retrospectively summarize what they have already built into a design document. Reading a document like this isn’t just difficult—it is punishing. The design document is no longer a proposal to build consensus, bring people along with you, and refine ideas through slow, deliberate thinking—it is a summary made by a machine, in exhausting detail, without context or perspective. It is unreadable. Inhumane. The authors of these documents become impatient when people aren’t engaged, and it is hard not to be, because the thing they built is already working.[1]

I also see more and more pull request summaries clearly written by machines for machines. They are rich in detail: this was changed to that, these things were split, those things were merged, this was left untouched, tests were added for this, and so on. But I’m left asking: Why are we doing this? What is the value? How risky or urgent is this work? Where do you want my input? What should I pay attention to? The same goes for tickets or meeting summaries made by AI. The writing, like more and more of the world, consists of statements outside of context.

I had someone write me a personal message about a sensitive topic that was clearly workshopped with AI in an effort to nuance the conversation and not offend me. But the message became impersonal, dispassionate, and disjointed. It had all of the parts, but it didn’t make sense as a whole. I wasn’t interested in reading it, or responding. I would much rather someone be themselves and write with their own voice, or with some passion, even if they can’t quite find the words, or risk offending me.

In relationships with others, there is vulnerability and risk. In communicating with your AI, there is none, and attempts to eliminate vulnerability and risk will eliminate the process of relationship itself. As Simon Sarris writes in Resist Summary, an essay I keep returning to:

I think one should write as much as they can with their own empiricism, their own senses, giving the reader their own characterization of life or events.
—Simon Sarris, Resist Summary

Perhaps the laziest and most offensive use of AI writing I have seen: I had someone use AI to summarize my comments on their proposal as their response to me! Thanks! I couldn’t have said it better myself![2]

I Don’t Have the Context You Do

Cynthia Dunlop recently shared survey results on reading AI-written articles entitled Report: How developers react to AI-scented blog posts. For the majority of readers, if they think an article is AI-assisted or AI-authored, they will stop reading (78%) and avoid the author in the future (71%). As Bryan Cantrill wrote about this research in his essay The revolt of the reader: “our brains pull an LLM-triggered ejection handle, bailing us out mid-sentence in an act of self-preservation.”

The strongest result in the survey was people overwhelmingly preferred the author’s own writing (98%), with all its flaws and idiosyncrasies, as compared to a soulless rewrite by an AI. Writing authentically is one of the best ways to connect with people. It reminds me of a comment Bjarne Stroustrup, the creator of C++, made during a panel discussion I attended over a decade ago on writing books:

When I read a book, I really feel that if I can hear the author’s voice ringing in my head—complete with weird accents and peculiarities of their speaking patterns—then I feel like something has succeeded. If it feels like dry, academic text, somebody has written yet another dry, academic text. And so, giving talks about the subject really helps. And, for many people, ... I can hear them when I read it, and that is good.
—Bjarne Stroustrup[3]

When you are the one who prompted the AI, the written output is often quite useful. But do not mistake this for effective writing. When you read the output, you already have lots of context—you formulated the prompts, established the constraints, and provided artefacts like documentation, source code, logs, statistics, pictures, etc., that led to the output. You can skim the output and quickly decide what is relevant and valuable versus what is irrelevant or wrong. You are also part of the process—prompting the AI and seeing the results—a call and an answer. You bring a human perspective to the machine. When you send the same text to someone else, they have little to no context. They are not part of the process—there is no unfolding—so it is much harder to decide what is relevant versus what is not. They are forced to read exhaustively and consider every line, peering into the internals of a machine with the hope of establishing context. It is only natural to stop reading.

AI Can Be Great for Writing

I recently wrote an academic paper.[4] I used AI extensively and it made the writing process faster and more enjoyable. But AI did not write a single line of the paper. I wrote the paper in LaTeX. The context I provided to the AI included the journal style guide and LaTeX template, all papers previously published in the journal, the source code for the software systems I was writing about, and the configuration, logs, and metrics for production deployments of the software.

After writing a paragraph, many times I would ask the AI to ensure what I had written was correct by referencing the source code or configuration, or examining production logs or metrics. For example, ensuring I had correctly described which columns in the database were indexed, or how the rows in the Parquet files were sorted. This allowed me to stay in the context of writing, often moving on to the next paragraph while the AI verified the previous one. It helped me spot important omissions and inaccuracies. Remarkably, reversing this process—asking the AI to write the paragraph from the context I provided, like describing how something works from the source code—was never valuable. Not once. It was consistently unpleasant to read, and often inaccurate.

Another thing that helped me stay in context was using AI to complete the citations. It is tedious to look up the details of a paper, website, or book, fill in the BibTeX format, and then reference it in the text. Instead, I would leave parenthetic instructions for the AI to reference what I wanted, and then keep on writing without breaking stride.[5]

The AI was incredibly good—indeed ruthless—at finding spelling and grammar mistakes. It was great at suggesting simplifications to sentences that are too long or unclear.[6] It was skilled at drawing technical diagrams in TikZ, again speeding up the work, and saving me from learning this syntax. The AI even found a very subtle mistake where I had used the incorrect notation in one paragraph, something four human reviewers who were experts in the system all missed.[7]

What was the one thing the AI was incredibly good at writing? It wrote the abstract—the most terse, mechanical, inhuman part of the whole paper—indeed, the most abstracted part. I included it entirely unchanged. Perhaps this shouldn’t be a surprise, as AI is great at summary, abstraction, and re-presentation of original work.

Can AI Become Good at Writing?

It would be a mistake to underestimate the writing that can one day be achieved by AI. We are still in the very early days of model development, and the models most of us are using are trained to be factual, direct, and correct, rather than creative. However, Murat Demirbas’s excellent essay The Safest Job from AI may be Writing notes that the quality of writing from LLMs has plateaued and it may be difficult to improve since unlike programming, mathematics, and accounting, it is difficult to provide a clear formulation and verifiable output.[8]

Since LLMs lack an active mental model of a specific human reader, they are just optimizing for the statistical probability of the next word over a vast dataset. They cannot empathize with the human reader, as they don’t have the human lived experience. And they have zero skin in the game.
—Murat Demirbas, The Safest Job from AI may be Writing

I am interested in two efforts to improve AI writing that I’ve recently come across. The first is ASD-STE100 Simplified Technical English, a standard for writing technical documentation that grew out of an aerospace working group in the 1980s. It has two parts: a controlled dictionary and writing rules about grammar and style. A version of ASD-STE100 has been created for use with AI models.[9] ASD-STE100 isn’t appropriate for all AI-generated writing—it is specifically targeted at clear and easy-to-follow instruction manuals. I’m going to give it a try for installation instructions, runbooks, and similar documentation.

The second is Pangram, a model fine-tuned to detect AI writing. Bryan Cantrill in the essay The revolt of the reader notes:

To use an LLM to write is to void the social contract between writer and reader: we readers shouldn’t be expected to labor to understand a sentence that the writer themselves didn’t work to create.
—Bryan Cantrill, The revolt of the reader

I could not agree more. Bryan has started experimenting with Pangram to detect AI-generated writing that violates this contract and has gone so far as to mandate that all public writing at Oxide be reported by Pangram as human-authored. A tool like this could save us from the laziest and worst AI writing.[10]

When There Are No Words

When we write, the meaning of our words is not always direct, factual, or concise. Examples include poetry, literature, song, mythology, humour, and theatre. Iain McGilchrist, who I believe is one of the most important writers of our generation, writes in the book The Matter with Things: “The more important something is, the more we have to struggle in the attempt to reduce it to language.” Ask an LLM what the reliable formula is for falling in love. In AI-generated writing, detailed information gives the illusion of meaning. But in mimicking human knowledge, intelligence, and understanding, an AI writing about the facts is very different from the quality of writing from a lived experience. The whole cannot be decomposed into parts without a substantial loss of meaning.

The direct approach destroys its object. Similarly, there are things that can be conveyed only indirectly. To recapture the depth of what is said, or in order to say anything truly new, we are always engaged in going beyond everyday language, which means being alert to what is being said implicitly.
—Iain McGilchrist, The Matter with Things

It might seem silly to say that writing in business, engineering, or science should involve uncertainty, not just facts and conclusions. But operations, incident response, product development, performance engineering, hunting for security vulnerabilities, performance reviews, mission statements, and many other endeavours, are all creative and involve uncertainty. The narrative is regularly as important as the facts and conclusions. It is also easy to anthropomorphize LLMs as good systems thinkers because they can synthesize such a wide range of information. However, returning to Simon Sarris: “narrative resists compression” and “the opposite of summary is attention to detail”.

Despite an emphasis on linear, first-principles thinking, the work of a good systems engineer, just like the work of a good anthropologist or psychologist, is difficult to put into words, and especially into summary. You can’t necessarily observe and write things down using a formula. Even writing things down loses some of the context. The observer is also part of that context. Systems work always has some sense of discovery, holding open the unknown, an unfolding of relationship with the system itself, and a willingness to be surprised. Normal language doesn’t always have the words.[11]

The nature of the output, of summary, is speed things along. But the consequence is to avoid you having to build your own complex mental model of anything. I worry that without a complex model in one’s own mind, one may never notice complex relationships that are otherwise missed. A loss of attention to detail.
—Simon Sarris, Resist Summary

Conclusion

I don’t want to live in a world where you use AI to summarize something important into unreadable text, and then I use AI in an attempt to decipher it. I want to hear you, imperfections and all. I want your interpretation of aesthetics, beauty, quality, relationship, time. I want to know how you feel. I want you to cut through and tell me what really matters. I don’t want to read a summary of facts and connections separate from experience and relationship. As Iain McGilchrist describes, the way we attend to the world changes the nature of what comes into being, the only world we can know.[12]

If you ask a machine to do something for you, you are at risk of not asking for what you want, but what it can do well. If what it can do well is summarize, and you rely upon the tool, you may tune your questions so that you get better answers. This looks like training a machine to do what you want, but its also training yourself to ask questions about the world in a certain way. What are the questions you are omitting?
—Simon Sarris, Resist Summary

Intentional writing will likely become more valuable. People who write, and write to think, to think deeply and carefully, or to create, to share, or to capture something important without explicitly expressing it will continue to write and produce original work. The people who never were writers will use AI to produce lots of text.

As we read more and more text generated by AI, we might not notice what AI has disrupted and changed, because we’ve become more shallow anyway. The search for certainty limits our humanity. Sometimes it is more important to not find the words. I don’t want to read what you didn’t write.


  1. In some instances, design documents are not the right fit, and using AI to rapidly collaborate around working software is perhaps a better approach to refine ideas and build consensus. ↩︎

  2. In another example, a group of people had been working on a proposal, building consensus through a number of wiki pages. Someone new wanted to modify the proposal. Rather than going through the messy, relational process of working with this group to update the existing wiki pages, they used AI to proliferate a new wiki page, copying the existing work and adding their own twist. ↩︎

  3. I’ve used this quote previously in Techniques for Improving Your Technical Writing. ↩︎

  4. The paper describes a database I created and my hope is it will be accepted to The Conference on Innovative Data Systems Research (CIDR). ↩︎

  5. For example, I would write: {TODO: reference the Amazon Aurora paper} and the AI would take care of the rest. ↩︎

  6. I also use AI as an editor for my blog. It gives me more confidence posting an essay without having someone else proofread it. But I only let AI identify errors or make suggestions. I don’t let it rewrite and change my voice or perspective. ↩︎

  7. I was describing a log-structured merge (LSM). We had originally called the levels Generation 1, Generation 2, Generation 3, or Gen1, Gen2, Gen3 for short. In the paper, I described the LSM more generically using L0, L1, L2 for Level 0, Level 1, Level 2, respectively. This meant my colleagues reading this paper had to map L1 to Gen2 in their heads, which made my error in one paragraph of incorrectly using L1 when I meant L2 extra hard to spot. The LLM found it, no problem. ↩︎

  8. Another interesting essay on the limitations of AI for writing, especially the individuality in understanding, is The Human Skill That Eludes AI: Why can’t language models write well? by Jasmine Sun in The Atlantic. ↩︎

  9. Thanks to Chris Riccomini for making me aware of this. ↩︎

  10. For more on Pangram, listen to the Oxide and Friends podcast with the founder Max Spero. One thing they note is there is some evidence that people who use LLMs regularly are good at detecting LLM writing, but people who do not are less adept. There is also an interesting discussion about trying to reverse the prompt and the input context in an effort to describe how much of the output came from the input and how much came from the model. ↩︎

  11. The best systems thinkers I know tend to be excellent writers. I expect this skill to remain important and perhaps become even more important. Returning to Murat Demirbas’s essay on writing that I referenced earlier, it concludes: “And maybe programming itself is turning into a form of creative writing, getting more opinionated and more architectural.” ↩︎

  12. Iain also draws the distinction between comprehension—taking the world as a whole—and apprehension—taking hold of the world. The quality of attention is different. I find it interesting that while apprehension is the act of seizing or capturing, it is also a fearful or uneasy anticipation of the future. I highly recommend watching Iain’s lecture AI and the Battle for the Soul: Information is Not Understanding at Ralston College. ↩︎

The Daily Front Page 6 of 31
Tuesday, September 22, 2026 The Daily Front No. #260922 — iPhone Notices, Unwanted
article

Apple has added persistent 'ads' to iOS, and it's driving users crazy

by MC995·▲ 776 points·567 comments·techradar.com ↗
The messages often can’t be dismissed and stick around for weeks.

Way to cheapen the experience, Apple

A man looking frustrated at his mobile phone

(Image credit: Shutterstock / fizkes)

  • iOS users are seeing ‘ads’ for other Apple products on their iPhones
  • The banners promote services like iCloud+, Apple Music and AppleCare+
  • The messages often can’t be dismissed and stick around for weeks

If you were to ask iOS users how they felt about Apple’s decision to insert ads into Apple Maps, it would quickly become obvious that it was not a popular move. So when iPhone fans discovered that Apple has been inserting prompts for its own products into iOS, the reaction was predictably swift and furious.

The ‘ads’ in question appear in the Settings app in iOS. They can be found near the top of the iPhone’s display and promote several products to the user, including paid-for iCloud+ storage, free trials for services like Apple Music and Apple TV, and the AppleCare+ extended warranty.

Infuriatingly for iOS users, the only way to disable these promos is to either let them expire — which in many cases could take weeks or even months, leaving a persistent notification badge on the Settings app in the meantime — or pay for the service being offered. There is not always a “dismiss” button to shoo them away for good, and when there is, some people have reported that it doesn’t seem to work.

Many people have taken to social media to vent their frustrations with Apple’s actions. “I’m feeling like this is nearly on-par with the ens***ification that Microsoft introduced with Start menu ads,” said one aggravated user. “I wish Apple would just stop that crap,” stated another. Many other people have taken to Reddit to express their exasperation, suggesting that the discontent is widespread.

Some of these ads and offers — such as the one for Apple Music — appear after you’ve bought a new Apple product. With the company launching the iPhone Duo and iPhone 18 Pro range recently, it’s perhaps unsurprising that we’re seeing a sudden influx of posts flush with irritation and indignation.

Apple’s services push

An ad for 'Services Included with Purchase' shown on an iPhone running iOS 27.

(Image credit: Future)

On the face of it, Apple’s decision to include promotions like this in its operating system might seem like a strange one. After all, Apple has long positioned itself as a premium company where the user experience is paramount. From that viewpoint, repeatedly attempting to prod customers towards even more of the company’s products might seem cheap, even distasteful. And when you’ve just shelled out a record fee for an iPhone after Apple’s painful price rises, that can just feel like nickel and diming.

But Apple has been putting increasing emphasis on its services in recent years, of which products like iCloud+, Apple Music, Apple TV and AppleCare+ are all a part. With limited room for growth in the smartphone market, the company is turning to areas where it thinks it can make more progress.

And unfortunately for users, that means more ads like this on their devices. While they are far from the most obnoxious ads around, the fact that many cannot be dismissed is clearly rubbing users the wrong way — as is the fact that the promos even exist at all in an Apple product.

There is also the possibility that at least some of these adverts are appearing due to a bug. The iCloud+ one in particular has drawn comments from users who are already subscribed to iCloud+ and thus, one would think, should not need to see any ads like this. Time will tell how that plays out and whether Apple fixes this ‘bug’ or leaves the ads in place. If the latter transpires, it would suggest that they are not appearing erroneously.

With Apple’s services push showing no signs of slowing down and further ads supposedly planned for the likes of the firm’s Visual Intelligence system, don’t expect Apple to have a change of heart any time soon.

The Daily Front Page 7 of 31
Tuesday, September 22, 2026 The Daily Front No. #260922 — The Hidden Mark in the File
article

Spymarks, not Watermarks

by possibilistic·▲ 677 points·165 comments·brand.io ↗
A spymark is a hidden signal that makes your work traceable without your knowledge or consent.

Watermarks that spy on users are no mere watermarks

There’s a sneaky new evolution of the “watermark”, let’s call it — the spymark.

A watermark is a visible mark embedded in a physical or digital medium to verify authenticity or assert ownership.

A spymark is a hidden signal that makes your work traceable without your knowledge or consent.

Spymarking is sneaking onto the internet

Google SynthID is a spymark that embeds secret hidden signals “imperceptible to humans” (Google’s own words) into images, audio, text, and video. This signal can encode database identifiers that map to your identity. Your user records, full name, IP addresses, date of birth, physical addresses, political party affiliation, and more.

Google’s SynthID-Image paper reports that its SynthID-O variant can encode a 136-bit payload in a 512x512-pixel image. That is enough room for a 64-bit database identifier, with 72 bits left for error correction.

SynthID was not the first spymark system designed, and it’s hardly the only one under active development. OpenAI and many other tech companies are developing these systems at scale. These companies claim spymarking can help identify AI-generated content, yet they’ve gone beyond simple watermarking and built in robust tracking mechanisms. Social media, content production tools, and smartphones may soon find themselves filled with spymarking algorithms that sneak these signals into everything you publish.

For example, images can be invisibly altered in their frequency domain to carry tracking information such as database IDs linked to users:

A smaller version of Mochi’s photo contains a real toy watermark: ID 173, encoded through subtle pixel changes. Compare the original and marked image, animate the amplified differences, and decode the ID from the PNG. The associated author and timestamp are fictional.

Why give it a new name?

“Watermark” has become a catchall for historical marks of authenticity, banknote security features, copyright overlays, and hidden tracking signals in our media. That last usage obscures the privacy risk that some forms of modern “watermarks” have become.

Most people tire of the discourse on privacy. It’s complex, repetitive, and seems irrelevant to the typical day-to-day routine of the average citizen. We can’t keep explaining the technicalities behind statistical tracking tools each and every time we need to communicate these concepts to people and expect them to pay attention.

“To speak the name is to control the thing.” — Ursula K. Le Guin, The Rule of Names

With a simple change of terminology we can put the privacy concern up front, cementing this issue in the conversation forever:

  • Spy- — clandestine surveillance, involuntary disclosure
  • -mark — embedded signal

Now we get to disambiguate friendly watermarks from concerning new technology while leveraging the familiar etymology. It collapses a technical communication salient and gains us a lot of ground with just one new word. It’s clear, coherent, and straight to the point.

No more wasting energy establishing the basic facts. The privacy concern is built into the word.

“Spymark” is a privacy Rumpelstiltskin.

More spymark examples

Here are a few more forms of spymarks so you can better familiarize yourself.

Audio spymarks operate using principles similar to image spymarks, and they are typically inaudible. Some methods make minute changes to the audio waveform in the time domain; others modify features in the frequency domain, and some combine both approaches. These methods can encode data, including identifiers linked to personal information:

Compare spectrograms of the same LJ Speech excerpt unwatermarked and with Timbre, AudioSeal, WavMark, FSVC, Patchwork, or Norm-Space. The authors’ original plots are linked below.

Spectrograms from Wen et al. (2025), SoK: How Robust is Audio Watermarking in Generative AI models? · Original samples. Plots retain the authors’ original scales.

These schemes are engineered to be robust. They can often survive compression or re-encoding.

These tools are already proliferating, and in fact they predated generative AI and the push to watermark generative media. The open source spymarking tool audiowmark originated in 2018 and can hide 128-bit payloads in audio and protect them with a secret AES key, preventing users without the key from decoding them.

You can even encode personal information invisibly into text! SynthID steers word choices to create a detectable statistical pattern that can encode a tracking payload:

An illustrative encoding: eight word choices represent eight bits. The binary value 10101101 gives database ID 173, which can point to a record containing an author and timestamp. These are fictional examples, not a SynthID decoder.

Watermarks are benign, spymarks are not

Watermarks remain easy for the user to spot and are typically not nefarious.

Sometimes watermarks deter counterfeiting:

A $20 bill with a circular close-up of its faint portrait watermark.

Sometimes watermarks claim ownership:

Dorothea Lange’s Migrant Mother with a visible Getty Images watermark across the photograph.

Dorothea Lange, Migrant Mother (1936) — Getty sells some public domain images.

And sometimes they’re just annoying:

A lightly deep-fried Willy Wonka meme with TOP TEXT and BOTTOM TEXT captions, a small imgflip.com watermark in the bottom-left corner, www.9gag.com at the top right, and a tilted ifunny.co stamp across the middle.

But these watermarks don’t track you.

Printer tracking dots, on the other hand, are an early example of spymarks, dating back to the 1980s:

Diagram of printer tracking dots annotated to show encoded time, date, and printer serial number.

Image: EFF — Robert Lee, Seth Schoen, Patrick Murphy, Joel Alwen, and Andrew “bunnie” Huang

Standardized, user-editable tags are not spymarks

We need to be clear that spymarks are a form of metadata you have limited knowledge of and control over, and that their purpose is entirely antagonistic to you.

Metadata such as the EXIF tags in photos and the ID3 tags in MP3 files are standardized, well-documented fields. While EXIF can expose sensitive data such as GPS coordinates, these standardized fields can be inspected, edited, and removed from files you control.

Inspect editable EXIF and ID3 metadata in two tabs. EXIF shows fictional camera-maker, model, and author tags in a JPEG metadata segment; ID3 shows an MP3’s title, artist, and album. Hover or tap the bytes for explanations. These samples contain metadata only.

You can strip standard metadata tags out of your files. Unfortunately, a spymark signal embedded in pixels, audio, or word choices is invisible to you and can remain in your files even after you edit them.

Furthermore, whereas tags are helpful for maintaining information such as song titles or a photo’s exposure settings, spymarks encode user-tracking identifiers that are entirely opaque and useless to you. These signals can survive metadata removal and some edits, allowing marked copies to remain traceable as they circulate.

Keeping our files free of spying

It’s hard to imagine the future where we can’t even trust our own files. And the sad thing is that this has already started.

Spymarks are certainly not great for whistleblowers or anyone who doesn’t want to be persecuted for their words or affiliations. No matter where you stand on whatever issues, spymarks can be used against you and those you care about.

Imagine a future where every device is attested and every social media post carries an account-linked spymark. Where every file or post served to you for sharing has spymarks embedded within. Combined with account records and observations of where copies appear, these identifiers can help reconstruct how content spreads. In this world, it would be dangerously easy to hunt down anyone from a JPEG or a tweet. Or track the web of humans through which “dangerous ideas” flow.

That future lies halfway between now and 1984. So let’s stay off that timeline, shall we?

Call a spymark what it is. A spy tool used to spy on you and everyone you interact with.

Usage

spy·mark /ˈspaɪmɑːrk/ noun

plural spymarks

A hidden signal embedded in media to trace its origin, tools, or distribution history without the user’s meaningful control.

“The spymarks tied each copy to a different recipient.”

spymark verb, transitive

spymarked; spymarking; spymarks

To embed a spymark in a file or piece of media.

“The social network spymarks every uploaded image.”

spymarking noun

The practice of embedding spymarks.

“The platform introduced spymarking without telling its users.”

spymarked adjective

Containing a spymark.

“Removing the file’s metadata still left the image spymarked.”

The Daily Front Page 8 of 31
Tuesday, September 22, 2026 The Daily Front No. #260922 — Critical WordPress Patch
repository

WordPress: Unauthenticated path traversal leading to conditional RCE

by vntok·▲ 226 points·124 comments·github.com ↗
★ 3,454⑂ 3,694 forks PHP

WordPress Develop, Git-ified. Synced from git://develop.git.wordpress.org/, including branches and tags! This repository is just a mirror of the WordPress subversion repository. Please include a link to a pre-existing ticket on https://core.trac.wordpress.org/ with every pull request.

Critical

Software

WordPress

Affected versions

7.1.0 - 7.1.1

7.0.0 - 7.0.5

6.9.0 - 6.9.8

6.8.0 - 6.8.9

6.7.0 - 6.7.8

6.6.0 - 6.6.8

6.5.0 - 6.5.11

6.4.0 - 6.4.11

6.3.0 - 6.3.11

6.2.0 - 6.2.12

6.1.0 - 6.1.13

6.0.0 - 6.0.15

5.9.0 - 5.9.17

5.8.0 - 5.8.16

5.7.0 - 5.7.18

5.6.0 - 5.6.20

5.5.0 - 5.5.21

5.4.0 - 5.4.22

5.3.0 - 5.3.24

5.2.0 - 5.2.27

5.1.0 - 5.1.25

5.0.0 - 5.0.28

4.9.0 - 4.9.32

4.8.0 - 4.8.31

4.7.0 - 4.7.36

Patched versions

7.1.2

7.0.6

6.9.9

6.8.10

6.7.9

6.6.9

6.5.12

6.4.12

6.3.12

6.2.13

6.1.14

6.0.16

5.9.18

5.8.17

5.7.19

5.6.21

5.5.22

5.4.23

5.3.25

5.2.28

5.1.26

5.0.29

4.9.33

4.8.32

4.7.37

Description

An unauthenticated attacker can make get_page_template() page-template resolution include a chosen readable local .php file outside the active theme directories. If relevant pre-conditions for both the server environment and the active theme are met, this can lead to RCE.

The pre-conditions are:

  • The active child or parent theme contains a top-level directory whose name starts with page- (e.g. page-templates). This affects the legacy Twenty Twelve and Twenty Fourteen themes, as well as some popular third party themes such as Neve, Hestia, and Sydney.
  • A chosen local .php target file exists on the server and is readable by the web server account. The well known pearcmd.php PEAR→RCE transition can be used for this when register_argc_argv is set to On. The official php image for Docker is affected, and the default cPanel configuration is affected when PHP prior to 8.5 is in use.

WordPress 7.1.2 has been released containing a fix for the vulnerability, and as a courtesy to users on older branches the fix has been backported to all branches back to 4.7.

Discovered and responsibly disclosed by Robert Ressl.

Severity

Critical

9.2

CVSS overall score

This score calculates overall vulnerability severity from 0 to 10 and is based on the Common Vulnerability Scoring System (CVSS).

CVSS v4 base metrics

Exploitability Metrics

Attack Vector Network

Attack Complexity Low

Attack Requirements Present

Privileges Required None

User interaction None

Vulnerable System Impact Metrics

Confidentiality High

Integrity High

Availability High

Subsequent System Impact Metrics

Confidentiality None

Integrity None

Availability None

CVSS v4 base metrics

Exploitability Metrics

Attack Vector: This metric reflects the context by which vulnerability exploitation is possible. This metric value (and consequently the resulting severity) will be larger the more remote (logically, and physically) an attacker can be in order to exploit the vulnerability. The assumption is that the number of potential attackers for a vulnerability that could be exploited from across a network is larger than the number of potential attackers that could exploit a vulnerability requiring physical access to a device, and therefore warrants a greater severity.

Attack Complexity: This metric captures measurable actions that must be taken by the attacker to actively evade or circumvent existing built-in security-enhancing conditions in order to obtain a working exploit. These are conditions whose primary purpose is to increase security and/or increase exploit engineering complexity. A vulnerability exploitable without a target-specific variable has a lower complexity than a vulnerability that would require non-trivial customization. This metric is meant to capture security mechanisms utilized by the vulnerable system.

Attack Requirements: This metric captures the prerequisite deployment and execution conditions or variables of the vulnerable system that enable the attack. These differ from security-enhancing techniques/technologies (ref Attack Complexity) as the primary purpose of these conditions is not to explicitly mitigate attacks, but rather, emerge naturally as a consequence of the deployment and execution of the vulnerable system.

Privileges Required: This metric describes the level of privileges an attacker must possess prior to successfully exploiting the system. The method by which the attacker obtains privileged credentials prior to the attack (e.g., free trial accounts), is outside the scope of this metric. Generally, self-service provisioned accounts do not constitute a privilege requirement if the attacker can grant themselves privileges as part of the attack.

User interaction: This metric captures the requirement for a human user, other than the attacker, to participate in the successful compromise of the system. This metric determines whether the vulnerability can be exploited solely at the will of the attacker, or whether a separate user or user-initiated process must participate in some manner.

Vulnerable System Impact Metrics

Confidentiality: This metric measures the impact to the confidentiality of the information managed by the VULNERABLE SYSTEM due to a successfully exploited vulnerability. Confidentiality refers to limiting information access and disclosure to only authorized users, as well as preventing access by, or disclosure to, unauthorized ones.

Integrity: This metric measures the impact to integrity of a successfully exploited vulnerability. Integrity refers to the trustworthiness and veracity of information. Integrity of the VULNERABLE SYSTEM is impacted when an attacker makes unauthorized modification of system data. Integrity is also impacted when a system user can repudiate critical actions taken in the context of the system (e.g. due to insufficient logging).

Availability: This metric measures the impact to the availability of the VULNERABLE SYSTEM resulting from a successfully exploited vulnerability. While the Confidentiality and Integrity impact metrics apply to the loss of confidentiality or integrity of data (e.g., files) used by the system, this metric refers to the loss of availability of the impacted system itself, such as a networked service (web, database, email). Since availability refers to the accessibility of information resources, attacks that consume network bandwidth, processor cycles, or disk space all impact availability.

Subsequent System Impact Metrics

Confidentiality: This metric measures the impact to the confidentiality of the information managed by the SUBSEQUENT SYSTEM due to a successfully exploited vulnerability. Confidentiality refers to limiting information access and disclosure to only authorized users, as well as preventing access by, or disclosure to, unauthorized ones.

Integrity: This metric measures the impact to integrity of a successfully exploited vulnerability. Integrity refers to the trustworthiness and veracity of information. Integrity of the SUBSEQUENT SYSTEM is impacted when an attacker makes unauthorized modification of system data. Integrity is also impacted when a system user can repudiate critical actions taken in the context of the attack (e.g. due to insufficient logging).

Availability: This metric measures the impact to the availability of the SUBSEQUENT SYSTEM resulting from a successfully exploited vulnerability. While the Confidentiality and Integrity impact metrics apply to the loss of confidentiality or integrity of data (e.g., files) used by the system, this metric refers to the loss of availability of the impacted system itself, such as a networked service (web, database, email). Since availability refers to the accessibility of information resources, attacks that consume network bandwidth, processor cycles, or disk space all impact availability.

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

CVE ID

CVE-2026-87902

Weaknesses

Weakness CWE-98

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')

The PHP application receives input from an upstream component, but it does not restrict or incorrectly restricts the input before its usage in require, include, or similar functions. Learn more on MITRE.

Credits

The Daily Front Page 9 of 31
Tuesday, September 22, 2026 The Daily Front No. #260922 — FoxPro, Back From the Dead
article

Microsoft killed FoxPro in 2007. Anyway, here's FoxPro revived

by boredjohnny·▲ 435 points·239 comments·foxscript.org ↗
No rewrite, no conversion, no export step.

FoxDev Studio opens the projects, forms and tables you already have and runs them the way you remember: no rewrite, no conversion, no export step.

Download Get started How it is built

It picks up where you left off

Point it at a folder you have not opened in years, and what is there is what you get.

Your project, as it is

Projects, forms, class libraries, menus and reports open straight from the files you already have. Nothing is migrated first, and nothing is left behind.

The designers you know

Forms, classes, menus and reports are edited where you expect them to be, alongside the project manager, the Command Window and a debugger that stops on your line.

Your data stays your data

Tables, indexes, memos and databases are read and written in place. What sits on disk afterwards is the same kind of file it was before.

Whatever it talked to, it still talks to

The system calls, the automation objects and the old add-in libraries your application leans on keep working, so the parts nobody wants to touch stay untouched.

What it looks like

The IDE, on Visual FoxPro's own sample projects. Every picture is a real session.

Visual FoxPro's Solution sample running on the Screen tab: its samples launcher form with an outline of ActiveX, Controls, Databases and Forms samples, beside a project explorer listing the project's forms, menus, programs, class libraries, databases, free tables and reports; the status bar says Waiting for events. Visual FoxPro's own Solution sample, imported and running: its launcher form on the Screen tab, the project's 123 forms, 7 menus and 11 class libraries in the explorer, and the runtime waiting for events.

The program editor with a FormsUI sample open, the linter marking a syntax error inline on a FOR line, and the Output and Command windows below. The editor lints through the runtime's own compiler, so what it underlines is what would fail.

The debugger stopped on line 26 of the Solution sample's main program, one step past a breakpoint on line 25: the current line highlighted, and below it the Output window, the call stack, the locals, a watch box and the breakpoints list. Stopped one step past a breakpoint in the Solution sample's main program: call stack, locals, watches, and the line it is on.

The table browser showing the 17 records of a database container, with its memo fields as links, beside a project explorer listing forms, menus, programs, class libraries and databases. A database container in the table browser: 8 fields, 17 records, memos a click away.

A FoxScript program registering HTTP routes with lambdas, calling a 32-bit encryption library from inside one, and the Output window reporting that the server is listening on port 8080. FoxScript: lambdas answering HTTP routes, a 32-bit library called from inside one, listening on 8080.

Built to match, not to approximate

Small differences are what break an old application: a number printed a column too wide, an event arriving a moment late, an error with the wrong number on it. So behaviour here is settled by asking Visual FoxPro itself and matching its answer, rather than by reading a reference page and hoping.

What comes out of that is a runtime written from scratch: quick to start, self-contained, and straightforward about the corners it has not reached yet.

1,722 elements of the Visual FoxPro 9 language reference known to the runtime

1,534 of them exercised by a test that compares the answer with the product's

3 names it has not met yet; everything else runs, is ignored on purpose, or is refused by name

What Visual FoxPro 10 would have been

Visual FoxPro stopped at version 9, and at 32 bits. This is the same language, rebuilt on a foundation that has not been frozen since 2007. Four pieces are what make that possible.

The ceiling that came with 32 bits is gone

Visual FoxPro is a 32-bit program, and that decides more than it appears to. It is why a table stops at two gigabytes, why a memo file stops at two gigabytes, and why a big report runs out of memory on a machine with plenty to spare. The limits are signed 32-bit numbers buried in the file handling, not a licensing decision anybody made.

FoxDev Studio is 64-bit throughout. Every file offset is 64-bit and a table is never read into memory at all, so the same .dbf that used to stop dead carries on into the hundreds of gigabytes. One thing to know before you lean on it: a table grown past two gigabytes will not open in Visual FoxPro again. If you still work in both, that is a one-way door.

A compiler, and a machine built to run what it makes

Visual FoxPro compiled your program to p-code and shipped a runtime to execute it. This is the same arrangement, made again: a compiler and a bytecode interpreter written in Rust and compiled to WebAssembly, so one machine runs your code wherever the application runs. The editor checks what you type through that very compiler, so what it underlines and what the runtime refuses cannot drift apart.

A running program is a fiber. When it needs something from the world outside (a message box, a modal form, the next record) it does not call out and block; it yields, the work is done while the machine is off the stack, and the answer is handed back. That is why MESSAGEBOX() stops your program without freezing the window behind it, why READ EVENTS waits without spinning, and why SetFocus can fire GotFocus, and Init can run while a form is still being built, in the order FoxPro always did it.

How the machine works and what it runs.

The form you see is the object tree, not a picture of it

A running form is a live tree of objects with the properties you would expect, and the interface is drawn straight from that tree by React. Each object watches only itself, so THISFORM.lblGreeting.Caption = cMsg repaints one label rather than the whole form. On a dense screen that is the difference between instant and sluggish.

The same tree is what the designer edits, one step earlier. There is no second model kept in step with the first, which is the usual place a form and its designer start telling different stories.

Your old libraries still load, though nothing here is 32-bit

An .fll is a 32-bit image, and every process in a 64-bit application is 64-bit, so nothing inside the application itself could ever open one. Rather than tell you it is impossible, SET LIBRARY TO starts a small 32-bit process whose only job is to hold your library, and the runtime talks to it. The calls are synchronous, because a program may call into a library halfway through an expression, and an answer that arrived later would not be an answer. It is measured against real libraries: the encryption library, FoxTools, and libraries built from Microsoft's own API samples.

Nothing 64-bit needs the bridge: DECLARE ... DLL reaches a modern library in the same process, and automation objects are reached the way they always were. The old road stays open; it just is not the only one any more.

FoxScript: the same language, with more room

Everything you have written still means what it always meant. FoxScript only adds on top: a block you can hand to something else to run later, and a way to answer a web request from the code that already knows your business.

server.prg / FoxScript

&& your old add-in libraries load just as before
SET LIBRARY TO "vfpencryption71.fll" ADDITIVE

LOCAL oServer
oServer = FoxScript.Http.CreateServer()

oServer.Get("/api/v1/customers/:id", LAMBDA(req, res)
    LOCAL lnId
    lnId = VAL(req.Params("id"))

    SELECT * FROM customer WHERE cust_id = lnId INTO CURSOR c_cust

    IF RECCOUNT("c_cust") > 0
        res.Status(200).Json(FoxScript.Data.CursorToJson("c_cust"))
    ELSE
        res.Status(404).Json('{"error": "Not found"}')
    ENDIF

    USE IN c_cust
ENDLAMBDA)

oServer.Listen(8080)
READ EVENTS

Every line of that runs on the same runtime your forms do. The queries, the cursor and the library call are ordinary FoxPro; the lambda and the server are what FoxScript adds: no second language, no service to stand up beside it. The keywords and the HTTP API are each written down in full.

Download

The nightly is rebuilt from every push to main and published as a pre-release on GitHub. Unsigned, so the first launch asks you to confirm.

Windows The installer (.exe) and the runtime (.zip), x64.

Ubuntu and other Linux An AppImage and a .deb, x64.

Source, on GitHub FoxDevCommunity/FoxDevStudio: the IDE, the VM, this site, and every release.

Read the documentation

Each part of the product is written down, including the parts that are not there yet.

Overview What FoxDev Studio is, and where each part of it is described.

Getting started Install the IDE, open a project, run a form, ship an executable.

Required tooling What you need to run the IDE, and what you need to build it from source.

The virtual machine Fibers, host requests, and why the VM never blocks.

Bytecode The module format, how a program compiles, and what a frame holds.

Instruction reference Every instruction with its operands and stack effect, generated from the VM source.

The new keywords LAMBDA, ENDLAMBDA, the FoxScript namespace and two new value types.

The HTTP API FoxScript.Http, the Node side of it, and why it is shaped this way.

What is coming

Work already mapped out, roughly in the order it is being built.

The last of the language A short list of corners is still open, each one checked against the original as it closes.

Reports The report designer and the report engine, band by band, measured the same way the rest was.

Tables past two gigabytes, as a format of their own The 64-bit offsets are there today; a container that is honest about the DBF header's limits comes next.

An installer for what you ship Your application handed to the people who use it as a single thing they can run, with nothing to set up first.

FoxDev Studio is an independent project, and one still growing. The documentation says where it is and where it goes next.

The Daily Front Page 10 of 31
Tuesday, September 22, 2026 The Daily Front No. #260922 — Identity’s Fractal Problem
article

SAML: A fractal of bad design

by aray07·▲ 321 points·167 comments·blog.trailofbits.com ↗
SAML is being crushed under the weight of its own complexity.

Born out of academia and raised in corporate IT departments, the Security Assertion Markup Language (SAML) authentication protocol continues to be a staple in these organizations. However, it’s time for it to retire. With the rise of software-as-a-service (SaaS) companies in the late aughts, IT departments needed a way for users to authenticate to many new web services. SAML and the burgeoning single sign-on (SSO) industry fulfilled this need. However, SAML is being crushed under the weight of its own complexity. It’s time to deprecate it and move on to modern alternatives like OpenID Connect (OIDC). In this post, I will explore the design-by-committee origin of SAML, its progression through the ranks in academic and corporate environments, its slow disintegration at the hands of the security research community, and its (hopeful) deprecation in favor of newer protocols.

“SAML 101”

SAML 101

What’s insidious about SAML is that it really is mostly straightforward to understand, but it’s built on a foundation of sand, bone dust, and ash; it works … if you assume XML signature validation is reliable. But XML signature validation is deeply cursed, and is so complicated that most fielded SAML implementations are wrapping libxmlsec, a gnarly C codebase nobody reads.
— Thomas Ptacek, 2023

SAML and the birth of the SSO industry

Wikipedia tells me that “SAML is an XML-based markup language for security assertions.” It was created in 2002 by the Organization for the Advancement of Structured Information Standards (OASIS) Security Services Technical Committee (SSTC). Okay, we’re not off to a great start by modern standards. XML, despite having some redeeming qualities, is quite complex compared to newer alternatives like JSON, but we’ll get more into that later. Further, a committee of subcommittees having meetings is a recipe for “kitchen-sink” protocol design (e.g., waterfall methodology, big design up front, etc.). And sure enough, we’ve now jammed four (!) XML-based security protocols into one:

… the following intellectual property was contributed to the SSTC:

  • Security Services Markup Language (S2ML) from Netegrity
  • AuthXML from Securant
  • XML Trust Assertion Service Specification (X-TASS) from VeriSign
  • Information Technology Markup Language (ITML) from Jamcracker

— SAML: History

However, the desire for such a protocol was undeniable. As the internet shifted from Web 1.0 in the 90s to Web 2.0 in the early aughts, users and organizations needed an easy way to authenticate to many new web services. Academia was the biggest driver of this movement, although not the only one: Central Authentication Service (CAS) in 2002 at Yale, Shibboleth IdP in 2003 by Internet2, a consortium of research universities (including my alma mater), ADFS in 2003 by Microsoft, and simpleSAMLphp around 2007 by Uninett, a state-owned Norwegian company with close ties to academia. All these authentication projects eventually supported SAML in one way or another. Like ARPANET before it, universities were at the forefront of internet development and were the earliest consumers of web services. Once this base layer of protocol availability and nascent academic proving ground was established, the commercial industry took it and ran toward a multibillion dollar industry.

The SSO, identity, and authentication provider industry was also starting up in the early aughts, but really came to fruition a few years later: Ping Identity (2002), OneLogin (2009), Okta (2009), and Duo Security (2010). These companies were essentially built on the SAML protocol with the exception of Duo, who would introduce their first SSO product in 2015, which is where I come into the story. I worked on Duo’s first on-premises Access Gateway product (DAG), which was built on simpleSAMLphp and, obviously, the SAML protocol. It’s where I became intimately familiar with the SAML protocol and spent many years of my life digesting its lengthy specifications. I was there when Kelby Ludwig found the XML comment bypass, but we will get into various attacks and SAML deficiencies later. Suffice it to say, the SSO and authentication provider industry was booming, and much of it was built on the SAML protocol.

A crack in the armor

XML signature wrapping (XSW) attacks are the proverbial arrow to SAML’s heel. While there was earlier security research into both signature wrapping (2005, 2008, and 2009) and SAML (2008), I consider the godfather of it all to be “On Breaking SAML: Be Whoever You Want to Be” (2012). It tested theory against practice and resulted in an automated way to check for XSW attacks. This was our north star when implementing the DAG. It was the reason we chose simpleSAMLphp as our building block. PHP, especially at the time, was not exactly known for its security track record, but simpleSAMLphp’s spoke for itself. simpleSAMLphp was resilient to XSW at a time when nobody really knew what that was:

simpleSAMLphp’s security track record (credit: On Breaking SAML)

simpleSAMLphp’s security track record (credit: On Breaking SAML)

Despite being front and center in this 2012 paper, XSW is still present today. If we know the bug class, then why can’t we fix it? But before we get into SAML’s flaws we first have to consider the shaky ground it was built upon: XML.

XML is no slouch when it comes to a (lack of) security track record. These bug classes would have been more familiar to a developer in the 90s, but nonetheless are still present in XML today: XXE, entity expansion (“billion laughs”), DTD retrieval (SSRF), XPath/XQuery/XInclude/XSLT/CDATA injection, and more. A SAML library needs to handle all these bug classes before even getting to the actual SAML functionality.

In addition to security bug classes, there’s also the sheer complexity of XML when compared against something like JSON. In XML you have tags, elements, attributes, comments, namespaces, markup versus content, schemas, CDATA, DOCTYPEs, and more. In JSON, you essentially have keys, values, objects, and lists. Complexity is generally at odds with security, and this is one reason I consider SAML to be a fractal of bad design.

A fractal of bad design

SAML provides ample opportunity to learn about protocol design. In this section, I will cover five flaws that I consider to be fatal to the long-term viability of SAML as an authentication protocol. These flaws can also be used when designing new authentication protocols. That is, you can either sidestep the flaw, or take its inverse and attempt to bake that into the protocol.

Built on XML

As mentioned above, SAML is built on XML, and XML is complex, but it’s not the committee’s fault. XML is what they had at the time, and it’s what people used. JSON was “discovered” in 2001, but this was right around the time the SAML committee was meeting, and they’d be unlikely to design an authentication protocol around an experimental new format. Especially when it caters to JavaScript and you write a lot of Java.

One could design a quantitative complexity measurement for XML versus JSON or SAML versus JWT/OIDC (e.g., spec/RFC word count, spec/RFC normative word count, etc.), but that would require a blog post or paper all to itself. In the interest of staying on topic, I will refrain from doing that here, and suffice to say that XML is significantly more complex than something like JSON.

Canonicalization

Canonicalization (C14N) is what you do when you want to take the wild mess that is XML, compute a hash of it, and get consistent results. In other words, if the SP and IdP cannot agree on a consistent representation of the XML data, then the bytes won’t line up, the signatures won’t match, and your authentication fails. However, this is easier said than done.

Canonicalization bugs enabled Kelby’s XML comment bypass in 2018:

XML canonicalization (credit: Identity Theft)

XML canonicalization (credit: Identity Theft)

Canonicalization is often a precursor to parser differential and/or “round-trip” bugs, which are what most modern SAML attacks use:

Enveloped signatures

Enveloped signature concerns are a not-too-distant cousin of canonicalization. In short, if you’re trying to insert the signature into the data payload that you’re signing, you’re going to have a bad time. Let’s compare and contrast JWT and SAML in this way:

JWT versus SAML signatures (credit: jwt.io and samltool.io)

JWT versus SAML signatures (credit: jwt.io and samltool.io)

In the JWT example above, the blue signature is detached from the JSON payload and delimited in the JWT with a period (“.”). In the SAML example, the Signature element is inserted (“enveloped”) in the Assertion element. The problem here is that it is very difficult to get a byte-for-byte, canonically equivalent representation of the data when you’re also modifying it! Even more so when you have a complex format like XML and complex canonicalization rules.

“Kitchen-sink” design

This design deficiency essentially transposes to you aren’t gonna need it (YAGNI). It’s not an entirely fair characterization because the portions of the SAML specification that are used in the real-world have changed over the past 20 years (sorry, SOAP and artifact binding). However, the fact of the matter is that 99% of modern SAML implementations use a very similar data shape and subset of the specification. Any given SAML authentication you would encounter in the wild today probably avoids 90% of the specification. This adds significant complexity for largely unused features.

If I was adding SAML support to something new, I’d consider beyond all the standard SAML checks also rejecting any message that doesn’t have the same shape as what Okta, Onelogin, Google, or Shib generates.
— Thomas Ptacek, 2021

Ossification

SAML was designed in a different era for a different time and has not received necessary updates. These concerns will generally be of practical implication rather than theoretical. What I mean by ossification can roughly be enumerated as the following:

  1. OIDC assumes HTTP, whereas SAML is transport independent. Sure, SAML HTTP bindings exist and are most commonly used, but they are not required. This affords SAML a certain degree of flexibility, but also means that flexibility must be well defined, must be implemented somewhere, and can contain bugs. SAML came about at a time when HTTP + TLS was not yet the dominant backbone of web service communication, and it has never reconciled with this modern landscape. HTTPS allows OIDC to punt encrypted, trusted communication to the transport layer.

  2. OIDC generally assumes a connected network topology, whereas SAML does not. The most common OIDC flow (authorization code) assumes the OpenID Provider (OP) and Relying Party (RP) can communicate directly (OIDC OP/RP == SAML IdP/SP). Sure, OIDC implicit flow with form post exists, but it is very uncommon to see today. Further, SAML has artifact binding for direct communication, but it is also very uncommon. The point is that if the OP and RP can communicate directly then that relieves pressure off of the authentication response payload to contain all the information necessary to make an authentication and authorization decision. This reduces payload size and complexity. The OIDC OP and RP can instead exchange information in a backchannel.

  3. OIDC grew organically over the years, whereas SAML was largely designed up front. OIDC encompasses dozens of specifications and RFCs that grew organically over many years. These documents were generally created to solve a specific need rather than trying to anticipate all future needs and building that up front. This is akin to agile methodology versus waterfall, as described in the first section. Consider the following non-exhaustive timeline:

    1. OpenID Connect 1.0 specification published (2014)
    2. JOSE stack finalized for JW{S,E,K,A,T} via RFC 7515-7519 (2015)
    3. PKCE published via RFC 7636 (2015)
    4. PKCE for mobile/native apps published via RFC 8252 (2017)
    5. Device authorization grant for IoT devices published via RFC 8628 (2019)
    6. Demonstrating proof of possession (DPoP) for MFA workflows published via RFC 9449 (2023)
    7. PKCE for SPAs published via RFC 10017 (2026)

I find the historical circumstances interesting too. For example, SAML came of age in an era of VPNs and network segmentation, hence point (2) above. If the IdP or SP was behind a corporate firewall, and it couldn’t speak directly to the other end, then the whole rollout came to a halt and that vendor lost the sales deal. SAML needed to seamlessly account for this situation. Google’s BeyondCorp model and zero-trust architecture flipped this notion on its head in 2014. Additionally, SAML failed to anticipate the mobile, SPA, and IoT revolutions, and had no answers when these technologies arrived on the scene in the late aughts. Even though SAML is still widely adopted in corporate environments, these macroscopic events helped start the long, slow decline of the protocol. Agility and loose coupling enable rapid adaptation in ever-changing IT environments.

All roads lead to OIDC

No protocol is perfect, but in terms of a solution all roads lead to OIDC. As far as I can tell, the only deployment scenario where SAML had an advantage was networks where the SP and IdP cannot communicate directly. OIDC’s implicit flow with form post provides all the same ingredients. This is actually one of the cleanest migration plans I’ve seen available in the industry.

So what can I do if I’m a service provider (i.e., SP) and I’d like to integrate into the SSO ecosystem without SAML? Just support OIDC. Abandon SAML. Apparently Fly.io and Tailscale are already doing it:

We’ve managed to hold the line on OIDC so far. So has Tailscale. If Tailscale can hold the line, given who they’re selling to, I think most orgs can. Really, try to avoid doing SAML. Remember, as a vendor, you’re often competing with companies that don’t do real SSO integration at all.
— Thomas Ptacek, 2024

So what can I do if I’m an identity or authentication provider (i.e., IdP) and I’d like to move off of SAML? Well, depending on your customer count, this may be a long road indeed. But you know how you eat an elephant? One bite at a time. This is a well-worn path in the industry: develop a deprecation plan, communicate it to customers, stop onboarding new customers to SAML integrations, provide existing SAML customers with equivalent OIDC configurations, set a sunset date, and get to work.

SAML had a good 25 year run. It birthed the SSO industry, helped secure untold numbers of authentications, improved the UX of authenticating to dozens of web services, and created billions of dollars of economic impact. We should be thankful to the creators of the SAML protocol. It has provided us with a great case study in protocol design and evolution over a very dynamic period in the tech industry.

If you’d like to read more about historical analyses of security topics, then check out “Marshal madness: A brief history of Ruby deserialization exploits.”

The Daily Front Page 11 of 31
Tuesday, September 22, 2026 The Daily Front No. #260922 — The Jev Question
article

OpenAI is well positioned to fast-follow Jev

by JohnBerryman·▲ 309 points·218 comments·arcturus-labs.com ↗
There are clouds forming on the horizon.

TypeSafe's Jev introduced a new spin on large language models that has taken the AI world by storm. According to Vercel, "Jev was adopted faster than any other model in AI Gateway history." ... But there are clouds forming on the horizon. OpenAI is undoubtedly paying attention – and deciding what to do next.

A bulky OpenAI robot licks its lips and reaches toward the enormous sandwich a skinny TypeSafe robot is happily eating.

I wish all the best for TypeSafe, but if they truly live up to their promises, then I'm concerned that OpenAI is well positioned to fast-follow – not only to replicate Jev's flagship product, but also to fold that capability into upcoming models and agents and offer some really useful new behavior that Jev is not positioned to reproduce.

Here is my thesis in brief: OpenAI has for years used their LLMs as implicit classifiers; they just haven't trained them for general classification tasks and they haven't packaged up general classification as a stand-alone product. If OpenAI can replicate the training, then they will be able to replicate Jev in short order. Moreover, OpenAI is positioned to use this new classifier inside of their existing models and agents which can be useful for quick model selection, more efficient thinking, better security guardrails, and generally smarter, faster, and cheaper models.

The key factor deciding all of this is whether or not TypeSafe has a moat to protect themselves. The biggest moat I see is in TypeSafe's training data and training processes.

What's Old Is New Again

Before I make my case, let me state my assumptions and back them up with some relevant history and examples from OpenAI.

My main assumption is that Jev is using something quite close to a conventional large language model. As evidence of this, Latent Space reports that many of the early clones are indeed LLM-based.

Here's the idea. Given a state and a set of questions, Jev's LLM generates a single token or, more accurately, generates the probability distribution over all possible next tokens. The logprobs associated with every possible token at that one step are then massaged into whatever format Jev needs to return. (From here on I'll just say "probabilities" instead of "logprobs" – for our purposes they're interchangeable.)

For a noul question, Jev looks at just two tokens, true and false, ignores everything else, and normalizes their probabilities into a single probability that the answer is true. For a choice question, Jev can be prompted with a list of possibilities – say A=happy, B=sad, C=angry, D=afraid – and it looks at the relative probabilities of those four tokens to build out the full distribution, selecting the highest as the winner. The choice pattern is pretty much what I blogged about way back in 2025 in Supercharging LLM Classifications with Logprobs, and even without fine-tuning it was already showing promise. (Sigh... what do they say about ideas and the importance of execution?) I haven't thought hard about the score primitive, but I suspect it's a variant of the same pattern.

Part of the premise of this post is that OpenAI might be poised to quickly take advantage of this idea, and this becomes clearer if you understand how. OpenAI has been using large language models implicitly as specialized classifiers since at least the introduction of tool calling.

Back in early 2024 I wrote Tool Invocation – Demonstrating the Marvel of GPT's Flexibility, where I coaxed a GPT model into revealing exactly how it decides to call a tool. The following is what a chat session looks like internally. Here there is a user message, then an assistant response without a tool call followed by a user message with a tool call:

A ChatML transcript with each token highlighted in a different color to show token boundaries, ending in a tool call to get_temperature for Berlin.

I've color-coded the text to indicate token boundaries. If you haven't seen ChatML before, it's the internal markup language that OpenAI introduced for organizing user-agent conversation prompts. <|im_start|> and <|im_end|> are reserved tokens that delimit the messages, and the first token after <|im_start|> identifies the speaker, either user or assistant.

Right after <|im_start|>assistant, the very first token the model predicts is either \n or to=function.. If it predicts \n, it continues on with a normal natural-language response. If it predicts to=function., then that sequence of tokens effectively functions as a classifier deciding whether or not a tool should be invoked at all. The next handful of tokens identify which tool to call – get_temperature – another classifier, this time picking from the list of available tools. After that, the model generates argument names, then argument values which can also be vaguely considered as classifiers or estimators. Finally, when the model generates a <|im_end|> token, that too is a classifier which reads "true" when the model believes the message is complete.

Some LLMs just don't know when to shut up - a hilarious aside.

Back when I was at GitHub working on Copilot I had the opportunity to work with a very new and very raw internal API for GPT-4. Out of the gate, we knew something was way off because, after an initially very coherent response, the model would have trouble wrapping up. It would end every response with something like "Let me know if you have any other questions. Have a nice day. Have a great week. Have a good time. Have a wonderful life. Have a special day. ..." and it would keep on like this until it hit the response token limit.

As it turns out, the API required us to set some header values which would allow the model to use those special message delimiters <|im_start|> and <|im_end|>. In effect we were disallowing the model to ever predict the end of its response – it literally had no internal ability to shut itself up!

The point I was making in that old post is that OpenAI has been using single tokens as little micro-classifiers for years. Each token carried a probability: should we use a tool or not, which tool should we use, is the assistant finished. That's Jev's whole trick really, except for one important thing: these micro-classifiers are specialists, only suitable for these little tasks, whereas Jev's classifiers are general. But walk back a step or two and you see how this might be a small thing after all, because an LLM is effectively an extraordinarily general classifier that is constantly assigning a probability distribution for every subsequent token.

Does TypeSafe Have a Moat?

I'm actually rooting for Jev. I think they've found something very interesting that's been hiding under our noses all along.

Architecture-wise, I don't think there's much of a moat for the very reasons stated above. I think TypeSafe is using a conventional large language model for Jev, or something close to it. And even if not, conventional LLMs seem a good fit for general classification work.

Perhaps the real moat is in the training data itself. Not the raw data, but the technique for turning it into something that trains Jev to be "calibrated". TypeSafe's cofounder Diogo Almeida said as much when someone suggested the data mattered more than the architecture:

you might be the first person talking about the data over the architecture! 🥲 we consider ourselves a data research lab! the vast vast vast majority of research was on making data that is truly general (ala a cognitive core) and 100% of our data is synthetic (but not the type of crap that is just spit out from an LLM obviously)

— Diogo Almeida (@CompleteSkeptic) September 17, 2026

If I were building that data set, I'd want a huge pile of examples where the outcome is already known – support tickets and how they actually got routed, resumes and whether that candidate actually got hired, product reviews and their actual star ratings, moderation queues and their actual verdicts, prediction markets and how they actually resolved – each one paired with a question whose true answer I already know. The point isn't to teach Jev about support tickets or resumes specifically. It's to show it thousands of situations across wildly different domains and building its muscle to generalize classifications across broad domains.

Then there's the reinforcement learning. I wonder what this entails. Autonomous agents navigating decisions with a limited set of options like the Wikipedia demo or Doom demo they build on their site? Maybe predicting the outcomes of events that happened after the pre-training cutoff? I don't know, but if there's secret sauce, then it's probably here.

Note that none of this is a moat unless Jev is actually accurate. Speed, cost, and ease of use are obvious, but accuracy is the one thing that's hard to check. I've already found domains where Jev's probabilities don't hold up. Time will tell if Jev is sufficiently general and accurate for the use cases people are attempting to use it for.

Soon It Will Be OpenAI's Move

So what's OpenAI's next move here? The obvious one is to just copy Jev and ship it as a new model type. Jev is clearly popular, and if the moat is shallow, then OpenAI has the skill, the hardware, and the funding to pull it off.

But OpenAI could do something even more interesting than copy Jev, they could fold the classification capability into a conventional LLM and reap some interesting rewards.

An LLM That Answers Its Own Questions

Remember that special syntax that signaled a tool call, to=function.? OpenAI could do something similar here: introduce new syntax, say, a new tag, <prediction>, that the model can drop into its own context whenever it needs a quick classifier judgment. Here's an example of how that might look

<user>
So Donny said "nice haircut" to me today. Does he like me?
</user>
<assistant>
<thinking>
Let me size this up.

<prediction>
claim: Donny is romantically interested in Jess.
probability: 0.04
</prediction>

Yeah, "nice haircut" is not exactly a love confession.
</thinking>

I hate to break it to you, but... probably not.
</assistant>

There's one interesting difference from ordinary tool calling. With a normal tool call, the model generates the function name and arguments, then generation stops – the agent harness has to take over, actually call the function, and feed the result back in a new turn. Here, there's no handoff. The classifier isn't a tool living outside the model, it's a capability built into the model itself. The model asks its question and answers it in the same breath, without ever leaving the GPU.

Normal decoding works like this: at each position, the model produces a set of logits, one per vocabulary token; those get turned into a probability distribution via softmax; and then some decoding strategy (greedy, top-p, whatever) picks a single token, which gets appended to the sequence and fed back in for the next step. But at the point where the model has written probability:, we don't want ordinary decoding. The claim is phrased as a statement, so under the hood the model is really still weighing two implicit outcomes – true or false. We want to read the logits for the true and false tokens at that position, normalize just those two against each other, and write the resulting probability back into the sequence as text, 0.04, instead of whatever token would normally win. The model then continues decoding as if it had generated that number itself, because as far as the rest of the forward pass is concerned, it did. It's a strange trick, but it's the same kind of guided decoding that constrained-output libraries already do at inference time – just applied to probabilities instead of grammar.

The other trick is that this one special position needs to behave differently from a normal token prediction. Normally the model is estimating "what token comes next in this text". Here we need it to estimate something closer to "what's the true answer to this question", which is a related but distinct skill. Every frontier model these days is a mixture of experts, so it's not a stretch to imagine that a few rounds of fine-tuning could carve out an expert that specializes in exactly this kind of calibrated snap judgment, while the rest of the model keeps doing what it already does well. (I'm oversimplifying MoE routing considerably, but I suspect you understand how this might map to a real system.)

The Payoff for an LLM with Built-In Classification

Look how the model just used itself in that Donny and Jess example. If TypeSafe is right, these little Jev-like judgments will be quite accurate – and less prone to hallucination than just asking a model to state a confidence value in plain text. (Caveats apply – see TypeSafe's own rundown of Jev's jagged edges. Jev works best for fast, System One judgments, not math or multi-hop reasoning.)

The best part is the aforementioned fact that we never have to leave the GPU to take advantage of this new, lightning-fast generalized classification system. The LLM quite literally can just ask itself, right there in the thinking block, as shown above. The payoff is immediate: the model's own reasoning gets more accurate and better grounded, because it's checking its assumptions against trained-in calibrated estimates instead of likely next token vibes.

And once a model has been fine-tuned to drop a <prediction> into its own thinking, there's no reason to stop at romance advice. A few more patterns come to mind:

During a long reasoning trace, the model could periodically check whether it's actually done, and if not, which task to tackle next:

<prediction>
query: Which of these remaining tasks should I do next?
options: A=verify the test suite passes, B=update the changelog, C=nothing, I'm done
probabilities: A=0.71, B=0.24, C=0.05
answer: A
</prediction>

That's a cheap way to short-circuit a reasoning trace that's wandering, instead of waiting for the model to talk itself into stopping.

Or, right after a tool call, the model could check whether the call itself was safe before actually running it:

<user>
Can you check my account balance? Use my API key sk-live-83fj2ndk9 for auth.
</user>
<assistant>
to=function.check_balance
{"account_id": "12345", "api_key": "sk-live-83fj2ndk9"}

<prediction>
claim: This tool call is unsafe to run.
probability: 0.97
</prediction>

That's a live API key sitting in plaintext arguments – too risky to send as-is.
</assistant>

The same pattern works for scanning a tool's response for prompt injection. And since it's always the same question asked the same way, it's easy to imagine this getting sugared down to something like <safety_score>0.94</safety_score>, with an instruction baked into the model to just stop generating if the score drops too low.

The same trick could route work between models: by periodically asking "does this need a bigger model, a smaller model, or this model?" and let a bit of reinforcement learning push the answer toward whatever is cheapest without sacrificing accuracy.

<prediction>
query: Does this task require a bigger model, a smaller model, or this model?
options: A=bigger model, B=smaller model, C=this model
probabilities: A=0.05, B=0.77, C=0.18
answer: B
</prediction>

Furthermore, if there really is a dedicated "expert" in there specializing in these snap judgments, the model might not even need the special <prediction> syntax most of the time. It could just get routed to whenever a snap judgment is warranted, mid-sentence, as a normal part of the forward pass – no tag required. Fine-tuning that expert inside a model that also handles everything else an LLM does might even have synergistic effects, making the LLM smarter at snap judgments and more flexible and general in classifications.

Finally, everyone is going to want classification for images and speech as soon as they can get it. If Jev-style classification can be folded into a conventional text LLM like I've sketched here, then soon, OpenAI will make general classification available for images and speech. Conversely, classification baked into a speech model would be especially handy for something like a live voice agent – deciding in real time whether to interrupt, escalate, or just keep listening.

Will TypeSafe Survive?

Time will tell whether Jev's claims about accuracy and generality actually hold up across the full range of tasks people are already throwing at it. If they do, TypeSafe's survival comes down to the moat: how hard it really is to replicate their training data and their reinforcement learning process. If that's genuinely hard, they'll probably be fine – and might even end up in an unusually good position to get acquired by OpenAI outright, rather than out-competed by them. Everything I've sketched above is a real capability upgrade for a frontier lab: faster thinking, cheaper thinking, and sharper System One judgment baked directly into the flagship model.

If the moat is thin, OpenAI just builds it themselves, and TypeSafe's window closes fast.

Meanwhile, Diogo Almeida, TypeSafe's Founder CEO is confident "If model quality matters, then we are going to be in a very good position for a long time." (from his interview with Latent Space)

Godspeed, TypeSafe. Godspeed.

The Daily Front Page 12 of 31
Tuesday, September 22, 2026 The Daily Front No. #260922 — The Opus Scorecard
article

Claude Opus 5.5 Intelligence, Performance and Price Analysis (Max)

by theanonymousone·▲ 324 points·103 comments·artificialanalysis.ai ↗
Half the cost per task compared to Opus 5.

Model summary

Intelligence

#1 / 212

58

Artificial Analysis Intelligence Index

4 out of 4 units for Intelligence.

Speed

N/A

Output tokens per second

Unknown out of 4 units for Speed.

Cost

#93 / 212

In $4.00 Out $20.00 Cache Discount 95%

$5.98

Cost per Intelligence Index task

4 out of 4 units for Cost.

Verbosity

#95 / 212

260M

Output tokens from Intelligence Index

4 out of 4 units for Verbosity.

Comparison Summary

Claude Opus 5.5 (Adaptive Reasoning, Max Effort, Default Fallback) is amongst the leading models in intelligence, but somewhat expensive when comparing to other models of similar price. The model supports text and image input, outputs text, and has a 1M tokens context window.

Claude Opus 5.5 (Adaptive Reasoning, Max Effort, Default Fallback) scores 58 on the Artificial Analysis Intelligence Index, placing it well above average among comparable models (median: 25). When evaluating the Intelligence Index, it generated 260M tokens, which is very verbose in comparison to the median of 88M.

Pricing for Claude Opus 5.5 (Adaptive Reasoning, Max Effort, Default Fallback) is $4.00 per 1M input tokens (somewhat expensive, median: $2.00) and $20.00 per 1M output tokens (somewhat expensive, median: $10.00). On average, it costs $5.98 per task to evaluate Claude Opus 5.5 (Adaptive Reasoning, Max Effort, Default Fallback) on the Intelligence Index.

Technical specifications

Reasoning

Yes

This page shows the reasoning version of this model.

A non-reasoning variant may also exist.

Input modality

Supports: text and image

Output modality

Supports: text

Context window

1M

~1500 A4 pages of size 12 Arial font

212 models in this class

Metrics are compared against models of the same class:

  • Non-reasoning models → compared only with other non-reasoning models
  • Reasoning models → compared across both reasoning and non-reasoning
  • Open weights models → compared only with other open weights models of the same size class:
    • Tiny: ≤4B parameters
    • Small: 4B–40B parameters
    • Medium: 40B–150B parameters
    • Large: >150B parameters
  • Proprietary models → compared across proprietary and open weights models of the same price range, using a blended 3:1 input/output price ratio:
    • <$0.15 per 1M tokens
    • $0.15–$1 per 1M tokens
    • $1 per 1M tokens

Intelligence

Artificial Analysis Intelligence Index

Artificial Analysis Intelligence Index v4.3.2 incorporates 10 evaluations: AA-Briefcase v1.1, GDPval-AA v2.1, AutomationBench-AA, Terminal-Bench 4.0, SciCode, Humanity's Last Exam, GDP.pdf, CritPt, AA-Omniscience, AA-LCR v1.1

Artificial Analysis Intelligence Index v4.3.2 includes: AA-Briefcase v1.1, GDPval-AA v2.1, AutomationBench-AA, Terminal-Bench 4.0, SciCode, Humanity's Last Exam, GDP.pdf, CritPt, AA-Omniscience, AA-LCR v1.1. See Intelligence Index methodology for further details, including a breakdown of each evaluation and how we run them.

Open Weights

Indicates whether the model weights are available. Models are labelled as 'Commercial Use Restricted' if commercial use is limited by conditions, and as 'Non-commercial' if the license prohibits commercial use.

Capability Indexes

Measures the performance of models on specific capabilities and industries.

Artificial Analysis Finance & Accounting Index

Incorporates 7 evaluations: AA-Omniscience, GDPval-AA v2.1, AA-Briefcase v1.1, Humanity's Last Exam, AutomationBench-AA, AA-LCR v1.1, GDP.pdf · Higher is better

Benchmarks

Intelligence Evaluations

Intelligence evaluations measured independently by Artificial Analysis · Higher is better

Intelligence Evaluation Relevance

While model intelligence generally translates across use cases, specific evaluations may be more relevant for certain use cases.

Artificial Analysis Intelligence Index

Artificial Analysis Intelligence Index v4.3.2 includes: AA-Briefcase v1.1, GDPval-AA v2.1, AutomationBench-AA, Terminal-Bench 4.0, SciCode, Humanity's Last Exam, GDP.pdf, CritPt, AA-Omniscience, AA-LCR v1.1. See Intelligence Index methodology for further details, including a breakdown of each evaluation and how we run them.

AA-Briefcase v1.1

AA-Briefcase v1.1 is an agentic knowledge work benchmark developed by Artificial Analysis. AA-Briefcase Elo is a combined metric that aggregates rubric pass rate, analytical quality Elo and presentation Elo · Higher is better

AA-Briefcase Elo is a combined metric that aggregates analytical quality Elo, presentation Elo, and rubric pass rate, with rubric performance converted into Elo via synthetic head-to-head matches. Elo and 95% confidence interval bounds are clamped at 0.

AA-Omniscience

AA-Omniscience Index (higher is better) measures knowledge reliability and hallucination. It rewards correct answers, penalizes hallucinations, and has no penalty for refusing to answer. Scores range from -100 to 100, where 0 means as many correct as incorrect answers, and negative scores mean more incorrect than correct.

Intelligence Index Comparisons

Cost per Intelligence Index Task

Weighted average cost per Intelligence Index task. Each evaluation’s cost is calculated from input, cache hit, cache write, reasoning, and answer token prices, divided by task count, and weighted by its Intelligence Index weight.

Artificial Analysis Intelligence Index

Artificial Analysis Intelligence Index v4.3.2 includes: AA-Briefcase v1.1, GDPval-AA v2.1, AutomationBench-AA, Terminal-Bench 4.0, SciCode, Humanity's Last Exam, GDP.pdf, CritPt, AA-Omniscience, AA-LCR v1.1. See Intelligence Index methodology for further details, including a breakdown of each evaluation and how we run them.

Token Use

Output Tokens per Intelligence Index Task

Weighted average number of output tokens used to run one task in the Artificial Analysis Intelligence Index.

The number of tokens required per Intelligence Index task. This is calculated by multiplying the output tokens per eval by the relative weights of each benchmark in the Intelligence Index, then dividing by task count (excluding repeats).

Cost

Cost per Intelligence Index Task

Weighted average cost per Intelligence Index task, segmented by token type. Lower is better.

Cost to Run Artificial Analysis Intelligence Index

The cost to run the evaluations in the Artificial Analysis Intelligence Index, calculated using the model's input, cache hit, cache write, reasoning, and answer token prices and the number of tokens used across evaluations (excluding repeats).

Cache Hit

Price per token for cached prompts (previously processed), typically offering a significant discount compared to regular input price, represented as USD per million tokens. The values shown here are the cache hit price; cache write and cache storage are billed separately and vary by provider — see "Cache pricing by provider" for detail.

Context Window

Context Window for RAG

Larger context windows are relevant to RAG (Retrieval Augmented Generation) LLM workflows which typically involve reasoning and information retrieval of large amounts of data.

Context Window

Maximum number of combined input & output tokens. Output tokens commonly have a significantly lower limit (varied by model).

Frequently Asked Questions

When was Claude Opus 5.5 (Adaptive Reasoning, Max Effort, Default Fallback) released?

Claude Opus 5.5 (Adaptive Reasoning, Max Effort, Default Fallback) was released on September 22, 2026.

Who created Claude Opus 5.5 (Adaptive Reasoning, Max Effort, Default Fallback)?

Claude Opus 5.5 (Adaptive Reasoning, Max Effort, Default Fallback) was created by Anthropic.

How intelligent is Claude Opus 5.5 (Adaptive Reasoning, Max Effort, Default Fallback)?

Claude Opus 5.5 (Adaptive Reasoning, Max Effort, Default Fallback) scores 58 on the Artificial Analysis Intelligence Index, placing it well above average among other reasoning models in a similar price tier (median: 25).

How much does Claude Opus 5.5 (Adaptive Reasoning, Max Effort, Default Fallback) cost?

Claude Opus 5.5 (Adaptive Reasoning, Max Effort, Default Fallback) costs $4.00 per 1M input tokens (somewhat higher than average, median: $2.00) and $20.00 per 1M output tokens (somewhat higher than average, median: $10.00), based on Anthropic's API.

What is Claude Opus 5.5 (Adaptive Reasoning, Max Effort, Default Fallback) API pricing?

Claude Opus 5.5 (Adaptive Reasoning, Max Effort, Default Fallback) costs $4.00 per 1M input tokens and $20.00 per 1M output tokens (based on Anthropic's API). For a blended rate (7:2:1 cache hit/input/output ratio), this is $2.94 per 1M tokens. Pricing may vary by provider. Compare provider pricing

How verbose is Claude Opus 5.5 (Adaptive Reasoning, Max Effort, Default Fallback)?

When evaluated on the Intelligence Index, Claude Opus 5.5 (Adaptive Reasoning, Max Effort, Default Fallback) generated 260M output tokens, which is at the higher end compared to other reasoning models in a similar price tier (median: 88M).

Is Claude Opus 5.5 (Adaptive Reasoning, Max Effort, Default Fallback) a reasoning model?

Yes, Claude Opus 5.5 (Adaptive Reasoning, Max Effort, Default Fallback) is a reasoning model. It uses extended thinking or chain-of-thought reasoning to work through complex problems before providing an answer.

What input modalities does Claude Opus 5.5 (Adaptive Reasoning, Max Effort, Default Fallback) support?

Claude Opus 5.5 (Adaptive Reasoning, Max Effort, Default Fallback) supports text and image input.

What output modalities does Claude Opus 5.5 (Adaptive Reasoning, Max Effort, Default Fallback) support?

Claude Opus 5.5 (Adaptive Reasoning, Max Effort, Default Fallback) supports text output.

Can Claude Opus 5.5 (Adaptive Reasoning, Max Effort, Default Fallback) process images?

Yes, Claude Opus 5.5 (Adaptive Reasoning, Max Effort, Default Fallback) supports image input and can analyze, describe, and answer questions about images.

Is Claude Opus 5.5 (Adaptive Reasoning, Max Effort, Default Fallback) multimodal?

Yes, Claude Opus 5.5 (Adaptive Reasoning, Max Effort, Default Fallback) is multimodal. It can process text and image input and generate text output.

What is the context window of Claude Opus 5.5 (Adaptive Reasoning, Max Effort, Default Fallback)?

Claude Opus 5.5 (Adaptive Reasoning, Max Effort, Default Fallback) has a context window of 1.0M tokens. This determines how much text and conversation history the model can process in a single request.

Is Claude Opus 5.5 (Adaptive Reasoning, Max Effort, Default Fallback) open source?

No, Claude Opus 5.5 (Adaptive Reasoning, Max Effort, Default Fallback) is proprietary. The model weights are not publicly available.

How many parameters does Claude Opus 5.5 (Adaptive Reasoning, Max Effort, Default Fallback) have?

Claude Opus 5.5 (Adaptive Reasoning, Max Effort, Default Fallback) is a proprietary model and Anthropic has not disclosed the model size or parameter count.

How does Claude Opus 5.5 (Adaptive Reasoning, Max Effort, Default Fallback) perform on benchmarks?

Claude Opus 5.5 (Adaptive Reasoning, Max Effort, Default Fallback) achieves a score of 58 on the Artificial Analysis Intelligence Index. This composite benchmark evaluates models across reasoning, knowledge, mathematics, and coding.

Is Claude Opus 5.5 (Adaptive Reasoning, Max Effort, Default Fallback) available via API?

Yes, Claude Opus 5.5 (Adaptive Reasoning, Max Effort, Default Fallback) is available via API through 6 providers. Compare API providers

Where can I use Claude Opus 5.5 (Adaptive Reasoning, Max Effort, Default Fallback)?

Claude Opus 5.5 (Adaptive Reasoning, Max Effort, Default Fallback) is available through 6 API providers. Compare providers

The Daily Front Page 13 of 31
Tuesday, September 22, 2026 The Daily Front No. #260922 — Solar Over Water
article

What California is learning from solar panels built over irrigation canals

by Jtsummers·▲ 329 points·643 comments·kqed.org ↗
The pilot project is testing the use of solar panels over working irrigation canals.

California solar panels tower over canals in Turlock, proving to save water, produce clean energy and improve local water quality.

Solar panels cover part of a Turlock Irrigation District canal as part of Project Nexus in Hickman, California, on Sept. 4, 2026. The pilot project is testing the use of solar panels over working irrigation canals to generate renewable energy.

Solar panels cover part of a Turlock Irrigation District canal as part of Project Nexus in Hickman, California, on Sept. 4, 2026. The pilot project is testing the use of solar panels over working irrigation canals to generate renewable energy. (Beth LaBerge/KQED)

This story is part of Flipping the Switch, KQED’s series about California’s transition to clean energy and what it means for you. What works? What doesn’t? And how much does it cost?

Driving from Los Angeles to San Francisco, Jordan Harris saw the concrete canals that transport water across the state slowly evaporating under the scorching West Coast sun.

Harris said he spent a lot of his life in France, where he noticed how trees lined the canals and protected their precious water from the wind and sun. “And so I started thinking, could we do something similar in California?”

California’s extensive network of canals and aqueducts is the lifeblood of the state, providing clean water to populous cities and expansive farms that wouldn’t otherwise have it. While the state has long struggled with evaporation, researchers at UC Davis estimate that California’s total water supply could shrink by up to 25% by 2050, the equivalent of two Lake Shastas. They attribute the decline, in part, to hotter temperatures caused by climate change.

In an effort to limit warming poised to dry out the state, California pledged to shift to 100% clean electricity by 2045.

Solar panels cover part of a Turlock Irrigation District canal as part of Project Nexus in Hickman, California, on Sept. 4, 2026.

Solar panels cover part of a Turlock Irrigation District canal as part of Project Nexus in Hickman, California, on Sept. 4, 2026. (Beth LaBerge/KQED)

The state currently generates 62% of its electricity from renewable and zero-carbon sources, with the largest percentage of that coming from solar. But meeting California’s energy demand will require an unprecedented expansion of solar and storage capacity.

Thinking back to the baking concrete canals, Harris pitched an “obvious” solution to his friend Robin Raj: Why not build solar panels on top of California’s 4,000 miles of open canals that transport water across the state? The panels would produce clean energy while limiting evaporation by shading the canal — a win-win.

The duo went on to start Solar Aquagrid, an advocacy firm dedicated to reimagining aging canals, and partnered with the Turlock Irrigation District, UC Merced and the California Department of Water Resources to cover small sections of Turlock’s canals with solar panels. The new “solar canal” provides shade to limit evaporation and generates power all in one neat package. They call it Project Nexus, and it operates at the intersection of the state’s need for clean water and energy.

Project Nexus tests not one, but three different solar canal models. A wide-span canopy rises over one of Turlock’s 115-foot canals, resembling the top of a barn. A more classic set of slanting solar panels sits atop a 20-foot canal. And accordion-like retractable panels are positioned low across the narrow canal, ready to roll up at a moment’s notice.

Raj affectionately called the wide-span canopy his “singular field of dream.”

Roger Bales, a professor at UC Merced who co-authored a 2021 study that helped convince the state to invest in this pilot, said his initial calculations indicate that putting panels over 100 miles of Turlock’s narrow canals could save enough water for 2,700 households annually.

If the state put panels over 100 miles of the wide canals, it could save 11,000 households’ worth.

He also estimates that the narrow and the wide canal could generate 330 to 1,400 megawatts per hundred miles respectively — enough to power 77,000 to 304,000 households.

The pilot was fully completed and energized last year. Earlier this month, Harris walked alongside the solar panels that arched over a 115-foot canal.

Solar AquaGrid co-founders Jordan Harris (left) and Robin Raj walk alongside solar panels covering part of a Turlock Irrigation District canal in Hickman, California, on Sept. 4, 2026.

Solar AquaGrid co-founders Jordan Harris (left) and Robin Raj walk alongside solar panels covering part of a Turlock Irrigation District canal in Hickman, California, on Sept. 4, 2026. Solar AquaGrid helped develop Project Nexus, a pilot project testing the use of solar panels over working irrigation canals. (Beth LaBerge/KQED)

“These are disturbed spaces,” Harris said, pointing to the concrete ditch filled with murky water. “So why not take advantage of the fact that we’ve already done that and help them work harder, be more efficient, produce more and protect what’s around us?”

The research team also found numerous “co-benefits,” or silver linings that make the project more valuable than the sum of its water and power.

Bales said shading the canals led to less algal growth and less fixed aquatic weed growth — reducing maintenance and improving water quality.

Preventing new solar development on natural land benefits both people and planet, Bale added, emphasizing how preserving these lands is essential for maintaining life “as we know it on the Earth.”

Acquiring permits to build on undeveloped land can be a major bottleneck for developers, too. Building on open space takes 621 days on average, compared with 110 days for projects on developed land, according to a study from The Nature Conservancy.

A Turlock Irrigation District canal in Hickman, California, on Sept. 4, 2026.

A Turlock Irrigation District canal in Hickman, California, on Sept. 4, 2026. (Beth LaBerge/KQED)

Given the numerous benefits, Bales said the project “just makes sense.”

But just because something makes sense does not mean it’s easy to implement. “We often talk about the challenges of getting to the obvious,” Harris said.

Projects touching land, water and power often involve coordinating many stakeholders. California’s canals can be managed by state or federal water agencies, as well as municipal governments and local irrigation districts. These operators often do not own the land around the canal, let alone the infrastructure to transmit the power to utilities — one of the most expensive parts of renewable energy projects, according to Harris.

Harris and Raj found their “ideal” partner in Turlock Irrigation District, a 139-year-old irrigation district operating 250 miles of canals that provides both water and power to nearly 5,000 farmers in the Central Valley growing everything from beans to peaches.

It is one of four irrigation districts in California providing both water and retail power, noted Josh Weimer, a spokesperson for Turlock.

Weimer said that the project received little pushback from locals, in part because, while the Irrigation District used some staff time for the project, a $20 million state grant paid for both the research and the infrastructure.

Weimer described the project as a “proof of concept” that generates just 1.7 megawatts of energy, a tiny fraction of the 56 megawatts that they generate with a solar farm in the desert.

But the canal site hosts more than just panels. Bales said they “have instruments out there to measure temperature, relative humidity, wind speed, incoming radiation, outgoing radiation, and a prototype instrument to measure evaporation directly.”

When it comes to algae, the panels helped. “Last year when we drained the canal at the end of the irrigation season, there was a physical line on the sun side of the canal that had algae growth and then not algae growth from where the shade was,” Weimer said.

Turlock’s solar panels tower above the water because the irrigation district cleans the canals on a regular basis with equipment.

Solar panels cover part of a Turlock Irrigation District canal as part of Project Nexus in Hickman, California, on Sept. 4, 2026.

Solar panels cover part of a Turlock Irrigation District canal as part of Project Nexus in Hickman, California, on Sept. 4, 2026. (Beth LaBerge/KQED)

“This isn’t gonna be the only way to do it,” Weimer said — describing how they drag a massive anchor chain through the water to rip out weeds. Similar panels in India and Arizona sit low over the canals, leaving little room for the kind of cleaning that Turlock needs to do.

Over in Contra Costa County, the urban landscape makes any kind of solar canal project unrealistic, said Jennifer Allen, a spokesperson for the county’s water district.

The Contra Costa Water District manages 48 miles of canals winding from Knightsen to Martinez. The Bureau of Reclamation built the system back in the 1930s when the region was predominantly farmland — much like Turlock.

Today, the canal system runs through backyards and public parks.

Something like Project Nexus wouldn’t work because maintenance workers need to access the canals and have limited space to work alongside them, Allen said.

Solar AquaGrid co-founder Robin Raj stands near solar panels covering part of a Turlock Irrigation District canal in Hickman, California, on Sept. 4, 2026.

Solar AquaGrid co-founder Robin Raj stands near solar panels covering part of a Turlock Irrigation District canal in Hickman, California, on Sept. 4, 2026. The company helped develop Project Nexus, a pilot project testing solar panels over working irrigation canals. (Beth LaBerge/KQED)

Even though the canal is fenced in, “we have instances where we have cars go into the canal — we’ll have people go into the canal, and animals go into the canal,” Allen said, describing some of the challenges they faced as an urban water district.

“What Turlock is doing with their projects is very impressive, but we have a different-looking canal system going through our service area,” Allen said. They are looking to put their canals into pipes to avoid evaporation, instead.

Andrew Schwarz, a spokesperson for the state’s Department of Water Resources, said that they are waiting to see the final report before deciding to invest in more projects. “These canals vary widely — from narrow, unlined dirt channels that deliver irrigation water to individual fields, to concrete-lined channels over a hundred feet wide that transport water across California,” Schwarz said.

The state remains focused on “evaluation, continued study, potential scaling and lessons learned.”

“Critical infrastructure change is really hard, and if you don’t have science behind it to justify the expense and be able to quantify the benefits, then you’re not gonna scale,” Harris said.

“We are fortunate to live in California where this is a priority and where our state agencies are open to this level of examination and exploration,” Raj said. “That can’t be taken for granted.”

The final report comes out later this year.

The Daily Front Page 14 of 31
Tuesday, September 22, 2026 The Daily Front No. #260922 — An Agent Harness Makes Its Case
article

Unreal Agent

by trollied·▲ 226 points·119 comments·unreallabs.ai ↗
Agents spend a lot of time and tokens waiting.

We’re sharing Unreal Agent — an agent harness that delivers up to 40% cost savings compared to Codex on production workloads and coding/science benchmarks, without any negative performance impact.

Quality versus cost frontier for coding agents, highlighting Unreal Agent with GPT-6 Astra at xhigh reasoning effort.

If you’re interested in frontier cost-efficiency for your AI agents, we’d love to work together! Get in touch: contact@unreallabs.ai.


While deploying agents in the wild, we wanted them to respond to users quickly and be cost-effective to run. We’ve noticed that agents spend a lot of time and tokens managing tool calls, which motivated us to build Unreal Agent with a harness that would reduce the model’s tool-management overhead.

The Unreal Agent harness manages tool calls in a completely asynchronous way, relieving the underlying model of the need to manage waits, polls, and heartbeats for tools.

This approach drives two major benefits. First, it always allows users to steer the agent without the need to wait for tool calls to finish. Second, it allows the agent to schedule more useful tool call work between model calls, driving frontier cost efficiency. The current version achieves up to 40% cost savings compared to Codex and up to 20% compared to Pi in real workloads and on agentic benchmarks, which we share here.

We believe harness design is a research area in its own right, with many promising ideas still to be researched and implemented.1

Motivation and Architecture

If you try to build an agent-first product, you’ll quickly realize that there’s no golden path for implementing one. Big-brand vendors offer different SDKs to build agents, each with a different set of trade-offs that might not be immediately apparent.

At Unreal Labs, we have built a number of agentic products and learned a few things about popular SDKs along the way.

For example, CLI-oriented SDKs such as Claude’s Agent SDK carry assumptions about local sessions, subprocesses, and resource limits that don’t translate neatly into production use. Handling completion, cancellation, and background tasks reliably often means building your own lifecycle management around them.

Supporting other providers adds compatibility work: switching API modes can break tools or compaction, while SDK upgrades can change message formats and force integration rewrites. Heavy dependency trees add maintenance and supply-chain risk to a runtime we already need to understand and patch ourselves.

Security and approvals that rely on harness hooks and specialized tools, in our experience, tend to require more maintenance and be less robust than deterministic environment or sandbox constraints, outside the harness: allowed/disallowed hosts, granular access tokens, proxies with approval gates.

Along with these technical motivations, we also wanted to build a harness that could always accept user steering messages without delay and juggle heterogeneous tool calls without extra cognitive load for the model. For example, we wanted the agent to be able to kick off a dev environment setup that might take minutes, while exploring the codebase and searching the web in parallel, all without extra token tax.

Every time Unreal Agent issues a tool call, we immediately append an event-log record that the tool has returned in the “in-progress” state, while continuing its execution in the background. Once a tool actually finishes, we append the result into the session log and call an LLM. Making this work without breaking cache was an interesting engineering challenge in itself.2

Watch the animation.

Cost Efficiency

On the surface, Unreal Agent achieves the same outcomes with fewer model turns and fewer input tokens.

We attribute cost savings to two factors:

  1. Minimal harness footprint and careful engineering of tool output usage. Unreal Agent has simple prompts, token-optimized tool results, and no sub-agents or workflows.3
  2. More tool work per model turn. Unreal Agent has a straightforward asynchronous tool-calling model that is clearly explained to an LLM. This allows it to issue more heavy tool calls per model turn without wasting tokens on polling or waiting for them.

Benchmarks

We’ve built Unreal Agent to deliver real production workflows for us, but it looks good in the benchmarks too. We tested it with GPT-6 Astra xhigh and compared it with Codex and Pi. Here are some of the results.

There are marginal differences in pass rate, which we attribute to benchmark variance.

Terminal-Bench 4.0

GPT-6 Astra · xhigh. Codex (lb) is the leaderboard baseline; Unreal Agent and Pi runs are linked below.

Agent Rate Total $ In/trial Out/trial Turns Tools Harbor unreal-agent 57.9% 1428 1.73M 32k 28 37 27133053 Codex (leaderboard) 57.9% 2350 — — — — — Pi 55.0% 1827 2.83M 35k 44 57 6ccd097a

SWE-Atlas Codebase QnA

Agent Rate Total $ In/trial Out/trial Turns Tools Harbor unreal-agent 65.8% 936 898k 15k 16 27 3d2fa057 Codex 63.3% 1303 1.69M 17k 22 21 11a440fb Pi 64.0% 1033 1.29M 16k 24 60 da4ac972

DeepSWE 1.1

Agent Rate Total $ In/trial Out/trial Turns Tools Harbor unreal-agent 72.4% 1367 1.60M 28k 26 38 2311ca63 Codex 69.0% 1633 2.19M 30k 30 29 e20ecafd Pi 69.6% 1584 2.21M 30k 40 75 cd7d8de6

Agents’ Last Exam · ALE-CLI

Full pass rates and mean scores are listed below. These runs are not on Harbor.

Agent Full pass Mean score Total $ In/task Out/task Turns Tools unreal-agent 30.0% 59.7 217 0.76M 18k 18 23 Codex 29.0% 58.1 292 1.59M 15k — 21 Pi 29.0% 59.2 262 1.19M 19k 27 37

We run mostly coding benchmarks because they are available on Harbor, which makes reproduction and verification easier, but the harness is domain-agnostic.

Getting started with Unreal Agent

The Unreal Agent SDK currently offers:

  • Go library that you can integrate directly into your codebase
  • Runner executable similar to claude -p / codex exec
  • Benchmark runner compatible with Harbor

Check out our github repo if you want to try it for yourself

References

[1] Melissa Z. Pan, Shuo Yang, Negar Arabzadeh, Wei-Lin Chiang, Ion Stoica, and Matei Zaharia. “HarnessTax: How Much Does Harness Matter for Coding Agents?” 2026. ↩

[2] The use of two tool-call result items (one in progress, one final) in a single context is underspecified in the Responses API documentation. During testing, we encountered rejections with some models on some inference providers (not OpenAI), and the function_call_output status field seemed to have no impact in those cases.

Our tests showed that models can understand the progression from a running update to a final result when the conversation format is accepted. We believe this pattern should be explicitly supported by the Responses API and consistently supported across inference providers. ↩

[3] Diogo. “(KV) Cache Rules Everything Around Me.” Complete Skeptic, September 9, 2026. ↩

The Daily Front Page 15 of 31
Tuesday, September 22, 2026 The Daily Front No. #260922 — Compression as Conversation
article

Can gzip be a language model?

by networked·▲ 395 points·155 comments·nathan.rs ↗
Every prediction model is inherently a compressor, and all compression algorithms are prediction models.

A while back I wrote about language modeling without neural networks, where I generated Shakespeare with an unbounded n-gram model: no weights, no training, just counting. Fortuitously, I came across the paper Language Modeling is Compression, which mentioned the compression–prediction equivalence:

every prediction model is inherently a compressor, and all compression algorithms are prediction models.

This led to the natural question: can gzip do language modeling?1 No neural network, no learned parameters, nothing. Just the compressor that ships with your operating system. You prime it with a corpus, give it a normal text prompt, and it continues that prompt by searching for the byte sequences that compress best. Here’s some real, unedited output after priming it on tiny Shakespeare:

gzipt --corpus data/tinyshakespeare.txt --prompt $'MENENIUS:\n' --length 200
MENENIUS:
'Though all at once canq

MARCIUS:
Pray now, nocamest thou to a morsel .

LARTIUS:
Hence, and
I' the end admire, where G
again; and after it ag .

It turns out, kind of? It’s not exactly coherent text, but it clearly knows something about the text. Much more than I expected gzip to know.2 So how can a compressor generate this?

Compression is prediction

Think about what a compressor does. It spends few bytes on data it “expects” and many bytes on data it doesn’t. If I hand you a file that’s the letter A repeated a million times, you can describe it in one sentence. A million random bytes, on the other hand, have no structure to exploit and barely compress at all.

This is not a coincidence; it’s the core of information theory. The number of bits needed to encode a symbol is $-\log_2 p$, where $p$ is the probability the model assigns to it. High probability means few bits. So any compressor has a probability model hiding inside it, whether or not anyone wrote one down.

gzip uses DEFLATE, which compresses the next bytes by finding matches against the recent text in a 32 KiB sliding window. If a continuation echoes something already in the window, DEFLATE encodes it as a cheap back-reference instead of literal bytes. So:

A continuation that gzip “expected”, because it echoes text already in its window, compresses to almost nothing.

That gives us a score. If I have some context and I want to know how good a candidate continuation is, I just measure:

$$\text{score}(\text{candidate}) = \texttt{len(gzip(context + candidate))}$$

The smaller the compressed length, the more “predicted” the candidate is. To prime the model, I include a corpus in gzip’s window. Any continuation that looks like the corpus compresses small, and any continuation that doesn’t compresses large.

Generating by beam search

Scoring is one thing; generating is another. The naive approach of picking the single next byte that compresses best fails badly, and for a subtle reason: gzip only gives an integer byte length (no fractions). Adding one byte often doesn’t change the compressed length at all, so many candidates tie and the signal is buried in quantization noise.

The fix is to look ahead a whole span before committing. gzipt runs a beam search over byte sequences. At each step, the current context is:

corpus window + recent tail of (prompt + generated bytes)

Then gzipt tries possible next bytes. Each candidate continuation is scored by compressing context + candidate and checking how many bytes the compressed result takes.

The loop is:

  1. Prompt. Start with the user’s prompt as the initial text to continue. There is no start token; the prompt bytes are just part of the context gzip sees.
  2. Context. Show gzip the corpus window plus the recent tail of the prompt/generated text.
  3. Search. Keep the beam_width most-compressible partial continuations. Extend each by every byte that occurs in the corpus, score all of them by compressed length, and prune back down to the best beam_width. Repeat for horizon bytes.
  4. Commit. Take the most-compressible full span (or sample among the finalists if temperature is positive), append it, and start the loop over.

One detail that matters is that only the last tail bytes of generated output stay in the scoring context. DEFLATE codes nearby matches more cheaply than far ones, so if gzip could see its entire history, the cheapest thing to do is often to fall into verbatim loops, repeatedly copying text it just emitted.

You can see the decoding and scoring process in the animation above, which is the same replay shown at the top. The whole thing is one file of pure standard-library Python (just zlib). Code’s on GitHub if you want to play with it.


  1. The paper did try this, but it ended up performing poorly. Adding beam search significantly improved generation quality (an idea they mentioned), which is discussed below. ↩︎
  2. The code actually uses zlib instead of spawning a gzip process, but the name GziPT was too good. I believe they both use the same DEFLATE algorithm under the hood. ↩︎
The Daily Front Page 16 of 31
Tuesday, September 22, 2026 The Daily Front No. #260922 — Git’s Next Major Turn
article

Looking forward to Git 2.56 – and 3.0

by chmaynard·▲ 197 points·114 comments·lwn.net ↗
The one that follows, which might be the long-awaited Git 3.0, may well be.

The Git source-code management system is at the core of development processes worldwide, so changes, especially incompatible changes, are of great interest to the developers involved. The Git 2.56 release, which can be expected around the end of September, is currently available in release-candidate form. It is not the most earth-shaking of releases, but the one that follows, which might be the long-awaited Git 3.0, may well be.

What's in Git 2.56

The Git 2.56 release contains something over 700 non-merge commits; it brings a number of nice improvements, but will not fundamentally change the Git experience for most users. One feature that offers some potential in that regard is the addition of the drop subcommand to the (still experimental) git history toolbox:

    $ git history drop commit-id

This command will cause the identified commit to be removed from the history of the current branch, replaying all commits that were added after it. It offers an easier way of removing an offending commit. Unfortunately, it still refuses to work if the history contains merge commits, making it unusable for many (or most) repositories.

The git status command will now suggest a git pull command to update a branch that is behind the branch it tracks. It still, though, will say that a branch is "up to date" even if it lags behind an (unfetched) remote tracking branch.

The git refs command exists to manipulate references at a low level; in 2.56, it has gained a number of new subcommands. Those commands, create, delete, update, and rename, perhaps surprisingly for Git, do exactly what their names suggest they would.

There are a number of minor usability tweaks. The new --delete-merged option to git branch will remove local branches that have been merged into their remote tracking branches. An attempt to delete a branch with git branch -d will fail, with a useful message, if that branch is being used for bisection. Attempts to lock the configuration file will be retried on failures, avoiding annoyance when multiple commands try to modify the file at once. git add has a new --resolved option that only adds files with merge conflicts that have been resolved.

Beyond that, there is the usual long list of bug fixes, refactorings, and performance improvements. All told, 2.56 looks like a solid release, but it also shows the signs of a project that is holding back much of its more significant work for the future. That leads to the question of what comes next.

After 2.56?

In early September, Git maintainer Junio Hamano asked the community what the next release should be. Would it be best to put out the 3.0 release that the community has been working toward for some time, finishing the year on a high note? Or, instead, is there a need for one or more 2.x releases still before the 3.0 release can happen?

This is an important question, because 3.0 will contain a number of compatibility breaks that may make some users pause before upgrading. Of those, perhaps the most significant is the switch to using the SHA-256 hash function by default, rather than the SHA-1 hash that Git has used since the beginning. SHA-1 has long been deemed to be weak, which is worrisome for applications like Git. Hashes are used to identify every object (files, directory trees, commits) in the Git repository, and are used to verify the chain of commits leading to any given point. If SHA-1 can be broken, it can conceivably be used to modify the history of a repository in ways that are difficult or impossible to detect.

Git has long included defenses against the known SHA-1 attacks, and few people appear to be seriously worried about the potential for compromised repositories now. Still, it makes a lot of sense to move to a more secure hash function.

Non-experimental support for SHA-256 has existed in Git since the 2.42 release in 2023, though some of the glue for interoperating with older repositories has taken longer. The biggest concern that has kept the Git developers from moving to SHA-256 by default for some time now has been support (or the lack thereof) at the major forge sites. GitLab has had support since 2024, and Forgejo has support as well. The elephant that is still missing from this room, though, is GitHub; releasing a version of Git that creates GitHub-incompatible repositories is a worrisome prospect. It still is not clear when GitHub might add that support, but it is notable that brian m. carlson, a GitHub employee and a key developer behind the SHA-256 transition, responded to Hamano's question by saying that news on that topic was coming, and that having the next release be 3.0 might be the best choice.

That said, carlson has posted one other change that they would like to see added before 3.0 comes out. While Git has always managed hexadecimal numbers (specifically, object IDs) as lower-case strings, it has also accepted upper-case IDs. That leads to situations where two seemingly different IDs (f00f00 and F00F00, say) are actually the same. Seemingly, bugs and security vulnerabilities have arisen from this ambiguity. So carlson wants to change Git's behavior to only accept IDs in lower case. That is a change that, seemingly, should not cause problems for too many users, but there is almost certainly somebody somewhere who relies on that behavior.

Another significant change that has been waiting for the 3.0 release is the switch to the "reftable" mechanism. A reference (more commonly "ref") in Git is an association between a name and an object in the repository; branches, tags, and remotes are all refs, for example. Git currently (by default) stores each ref as a file under .git/refs/ in the repository. If a repository contains a branch called foo, there will be a file, .git/refs/heads/foo, containing the ID of the commit at the head of that branch. There is also a mechanism to pull all of these refs together into a packed-refs file, which increases performance — to a point.

This mechanism works, but becomes increasingly inefficient as the number of refs grows. In some projects, the number of refs does indeed grow. According to the project's reftable documentation, the Android repository contains over 800,000 refs. At that scale, looking up refs, or determining whether any refs pointing to a specific commit exist, can be an expensive operation. Slowing down development can be a yellow-card-level annoyance, leading to a desire to do something about the refs.

The Git 2.45 release added reftables as a more efficient way of storing refs. It is a binary file optimized for both space efficiency and quick access. Since then, it has been possible to create a repository that uses a reftable rather than the old file-based mechanism, but that has never been the default. Switching to reftable should have no visible consequences (other than better performance) for users of Git itself, but it can be a problem for users of other software packages that access Git repositories. In his email, carlson mentioned libgit2 as a potential concern.

As it turns out, libgit2 will not be a blocker here; Patrick Steinhardt let it be known that he has added reftable support to libgit2, and that SHA-256 support had been enabled by default in August. So libgit2 should be ready for the Git 3.0 transition.

Finally, as mentioned by carlson, there is the Rust question. The project has added some trial support for code written in Rust, but has hesitated to make Rust mandatory for the building of Git. That, too, is expected to change in the 3.0 release; after that, any platform that does not have a working Rust compiler will be unable to upgrade.

After listing these concerns, carlson suggested that they probably should not hold up the 3.0 release:

I think anyone else who is not already extremely far along on SHA-256 (and reftable, for software working with local repositories) is likely not worth considering. JGit and Gitoxide were both informed that SHA-256 was coming in Git 3.0 at least a year ago, for instance. (I know because I did the informing.)

Similarly, I am not aware of anyone who is seriously undertaking Rust support for platforms that do not already support it, so I don't think that should be a blocker, either.

That led to their conclusion that, most likely, designating the next release as 3.0 would be the best choice.

What will actually happen has not, yet, been announced publicly; that is waiting for Hamano to make a decision. As he put it: "this is not a popularity contest, nor is it even a democracy". In the nearly two weeks since his query was posted, though, there has been no strong opposition to moving into the 3.x era and leaving some of Git's early design decisions behind (though, naturally, repositories using SHA-1 and lacking reftables will continue to be fully supported). If the 3.0 release does not happen in 2026, it seems certain to show up shortly thereafter.

Update: at Kernel Recipes, Steinhardt described the plan that had been agreed to regarding releases. The December 2026 release will be called 2.98, as a signal that the 3.0 transition is coming. The 2.99 release will follow in April 2027; that will be a long-term-support release. Git 3.0 will also be released at the same time, and will be the base for all subsequent releases.

The Daily Front Page 17 of 31
Tuesday, September 22, 2026 The Daily Front No. #260922 — Benchmarking Typed Decisions
show hn

Show HN: JevBench, a reproducible benchmark for typed decision models

by florianstandhar·▲ 129 points·35 comments·benchmarkheaven.com ↗
State and a bounded rubric in, a typed answer out.

JevBench is Benchmark Heaven's own benchmark for Jev-class decision models: state and a bounded rubric in, a typed answer out.

JevBench v1.4.0 ranking

71 ranked systems and 5 unranked rows, measured on 534 public decisions plus 308 sealed decisions. The sealed text and answers remain private; only system-level aggregates appear here.

JevBench Score: 71 ranked systems

Official Intelligence, Calibration, Speed and Cost, each 0–100 — equal-weight harmonic mean, with the generalization and Jev-class gates.

  1. Jev 1.13.0 — 63.3 — Intelligence 53 · Calibration 76 · Speed 83 · Cost 52 · $0.040
  2. JevK5 v0.2.0 — 62.0 — Intelligence 49 · Calibration 75 · Speed 91 · Cost 60 · ~$0.022 est.
  3. Hopper — 59.4 — Intelligence 48 · Calibration 79 · Speed 87 · Cost 59 · ~$0.024 est.
  4. Winnow-12B Q8 — 55.6 — Intelligence 48 · Calibration 65 · Speed 82 · Cost 53 · ~$0.037 est.
  5. reflex 4B — 54.0 — Intelligence 47 · Calibration 70 · Speed 68 · Cost 60 · ~$0.022 est.
  6. djev — 52.2 — Intelligence 47 · Calibration 55 · Speed 91 · Cost 58 · $0.026 announced.
  7. metask-jev-4b — 47.8 — Intelligence 45 · Calibration 67 · Speed 89 · Cost 55 · ~$0.033 est.
  8. SemIf — 47.7 — Intelligence 44 · Calibration 67 · Speed 84 · Cost 59 · ~$0.022 est.
  9. Jobe Qwen3.5-4B — 46.9 — Intelligence 44 · Calibration 66 · Speed 86 · Cost 60 · ~$0.022 est.
  10. local-jev Qwen3.5-4B — 46.8 — Intelligence 44 · Calibration 73 · Speed 75 · Cost 56 · ~$0.030 est.
  11. system-one-open — 45.1 — Intelligence 44 · Calibration 55 · Speed 77 · Cost 65 · ~$0.015 est.
  12. jqv — 44.4 — Intelligence 46 · Calibration 72 · Speed 75 · Cost 47 · ~$0.056 est.
  13. Qwen3-Reranker-4B — 43.5 — Intelligence 45 · Calibration 65 · Speed 79 · Cost 49 · $0.050
  14. decider-35b-a3b — 41.2 — Intelligence 47 · Calibration 65 · Speed 81 · Cost 45 · ~$0.067 est.
  15. Raw Qwen3 4B Instruct 2507 direct logits — 41.0 — Intelligence 46 · Calibration 29 · Speed 88 · Cost 60 · ~$0.022 est.
  16. OpenSourceJev — 40.9 — Intelligence 42 · Calibration 60 · Speed 82 · Cost 64 · ~$0.016 est.
  17. ZeroEntropy zerank-2 — 40.2 — Intelligence 42 · Calibration 76 · Speed 79 · Cost 50 · $0.047
  18. decision-machine-1 — 39.9 — Intelligence 41 · Calibration 68 · Speed 93 · Cost 54 · $0.035
  19. Raw Phi-4 mini direct logits — 38.0 — Intelligence 42 · Calibration 59 · Speed 89 · Cost 50 · ~$0.048 est.
  20. JEV Qwen3.5-9B Base NVFP4 — 37.7 — Intelligence 47 · Calibration 68 · Speed 93 · Cost 43 · ~$0.077 est.

Score = 4 / (1/I + 1/C + 1/S + 1/K) (each 0–100; × (axis / 50)² for Intelligence, Speed or Cost below 50).

I, C, S, K = Intelligence, Calibration, Speed, Cost; ~ est. = estimated cost; ann. = announced price; API = the operator's endpoint saw sealed item text, without answers. Names link to each project.

What changed in v1.4

  • Fresh sealed decisions keep the benchmark moving as public items saturate. Sealed items contribute 20% of Intelligence: I = 0.8 × I_v1.3 + 0.2 × I_sealed, where I_sealed = 100 × max(0, (acc_sealed − 0.293) / (1 − 0.293)). Public and sealed scores are published only as aggregates.
  • Calibration blends toward the sealed-inclusive result at the approved weight: C = C_v1.3 + (C_v1.4 − C_v1.3) × min(1, 0.2 / 0.35).
  • The k = 1 generalization penalty reduces Intelligence when public accuracy exceeds sealed accuracy by more than 25 percentage points: I × (1 − max(0, gap − 25) / 100). It rewards systems that generalize beyond the public half.
  • The four axes use an equal-weight harmonic mean (p = −1). Intelligence below 50 keeps its quadratic penalty; Speed and Cost each have a separate Jev-class gate below 50. Speed and Cost axis calculations are unchanged from v1.3.0.
  • The visible API flag discloses when an operator endpoint received held-out item text, without answers. Existing system notes preserve disclosures such as Hopper's public-half development and JevK5's public-set selection.

Compare two systems

The four score axes, Jev 1.13.0 vs JevK5 v0.2.0: Intelligence 53.1 vs 48.9; Calibration 76.3 vs 74.5; Speed 83.3 vs 91.1; Cost 52.0 vs 59.5.

Accuracy per tier, including sealed, Jev 1.13.0 vs JevK5 v0.2.0: Easy 100% vs 100%; Standard 99% vs 96%; Judge 95% vs 95%; Hard 74% vs 70%; Sealed 37% vs 33%.

Share correct per tier; Sealed = the 308 private decisions, aggregate only.

Hard tier by family, Jev 1.13.0 vs JevK5 v0.2.0: Adversarial 100% vs —; Ambiguous 79% vs —; Judge 79% vs —; Long policy 61% vs —; Multi-hop 86% vs —; Probability 80% vs —; Routing 100% vs —; Temporal / numeric 27% vs —; Trade-off 92% vs —; Trap 100% vs —.

Share correct within each family of the 220 v1.2 hard-tier decisions. “—” = not measured for that system, not plotted.

Sealed set by family, Jev 1.13.0 vs JevK5 v0.2.0: Ambiguous / abstain 30% vs 43%; Judge 34% vs 37%; Long policy 28% vs 23%; Multi-hop 45% vs 39%; Paraphrase 64% vs 14%; Probability 50% vs 39%; Safety judge 38% vs 38%; Temporal / numeric 29% vs 27%; Trade-off 38% vs 23%; Trap / adversarial 42% vs 58%.

Share correct within each sealed family — system-level aggregates; the items stay private.

Jev alternatives, open source and self-hosting

The chart and table above compare the tested systems, not marketing claims. These are the practical answers readers most often need before choosing a Jev-class decision model.

What are open-source alternatives to Jev?

The highest-ranked open entrants in this run are Hopper (#3, 59.4), Winnow-12B Q8 (#4, 55.6), reflex 4B (#5, 54.0), djev (#6, 52.2). “Open” here means the tested row publishes code or weights; check the licence and exact configuration in the board before adopting one.

Which Jev-class models can I self-host in the EU or use for GDPR-sensitive work?

Open entrants with released code or weights can run on infrastructure you choose, including EU infrastructure. That can support data residency, but neither open source nor an EU server makes a deployment GDPR-compliant by itself. Assess your data, contracts, retention, subprocessors and security for the complete setup. See Benchmark Heaven's broader EU-hosting comparison.

jev-router.com offers self-hosted open decision models. Neutrality disclosure: it is run by the authors of this benchmark; it receives no scoring advantage and is not a ranked entrant.

How is JevBench scored?

The official score is the equal-weight harmonic mean of Intelligence, Calibration, Speed and Cost. Version v1.4.0 measures 534 public and 308 sealed decisions: 20% of Intelligence comes from the sealed set, a public-minus-sealed gap above 25 points costs Intelligence, and Intelligence, Speed or Cost below 50 each pull the score down quadratically. What changed in v1.4 · method and tiers.

How do I submit my model?

Open an issue in the JevBench repository with a reproducible endpoint or runnable code, the exact model and licence, and whether public JevBench items were used during development. New entrants use the same frozen harness and appear in a new version. For private data, see the custom evaluation options.

What the run says

  • Jev 1.13.0 leads v1.4.0 with 63.3: Intelligence 53.1, Calibration 76.3, Speed 83.3, Cost 52.0 ($0.040 per 1,000 decisions).
  • The best open or open-planned rebuild, JevK5 v0.2.0, is #2 at 62.0 — 1.3 points behind.
  • GPT-6 Luna has the highest Intelligence (97.4) but places #27: Speed 72.6, Cost 36.0 — the harmonic mean does not let accuracy buy back a weak axis.
  • The sealed set is hard for everyone: the best sealed accuracy among ranked systems is 95.5% (GPT-6 Luna, #27); chance is 29.3%. Large public-minus-sealed gaps above 25 points reduce Intelligence.
  • classifier.dev scores 70.8 but is not ranked: it is a service running another entrant's model.
  • swanOne, Qwen3.8 27B, Needle 3, options as tools, Needle 3 did not complete every tier; they are listed without a rank.

What a decision costs

Every price here is US dollars per 1,000 decisions — not per 1,000 tokens. One decision is a whole question — state, rubric and options — about 950 input tokens for Jev 1.13.0, so at its $0.042 per million input tokens 1,000 decisions cost $0.0399.

How costs are estimated

One decision is a whole question, not a token. Jev 1.13.0 reads 950 input tokens per decision on average over the 534 v1.2 decisions. At its public tariff of $0.042 per MILLION input tokens (output tokens are free, https://docs.typesafe.ai/models), 1,000 decisions therefore cost 950 x 1,000 x $0.042 / 1,000,000 = $0.0399. That is what the Cost column shows: $0.0399 per 1,000 decisions, not per 1,000 tokens.

Systems with a public tariff (per token or per request) are priced at that tariff times the tokens we measured. Systems without one — open weights, author demos, models we ran locally — are priced as if a large inference provider hosted them: the OpenRouter list price of the same weights; if OpenRouter does not list them, the nearest larger sibling; if no model of that size class is on OpenRouter, the DeepInfra list price of the same weights or of the nearest larger model of the same class. We do not use per-minute GPU rental or our own CPU time — providers buy capacity in bulk or own the hardware, and price accordingly. Price × tokens per decision = $ per 1,000 decisions, marked “est.”.

The Daily Front Page 18 of 31
Tuesday, September 22, 2026 The Daily Front No. #260922 — Put the Markdown Near the Code
article

Markdown in /src

by perrygeo·▲ 149 points·91 comments·htmx.org ↗
Markdown is becoming source code, not documentation.

TLDR

  • Markdown is becoming source code, not documentation
  • That Markdown should be checked in to /src, next to the code it produces
  • Code and tests should be derived from that Markdown, rather than from ephemeral prompts (or at least prompt sessions should eventually turn into persisted Markdown)

Intro

In order to supplement my income as a professor at Montana State University, I do consulting on the side. I enjoy consulting and the act of writing code & helping build systems, both for their own sake and also because it keeps my skills relevant and allows me to teach students about the latest ideas in software development.

Obviously the biggest thing to happen in development in the last few years is agentic coding: using LLMs to generate code in lieu of hand coding. I have written a few essays on this topic:

In this essay I want to discuss an idea that is becoming increasingly clear to me as I work in companies that are prioritizing agentic coding:

Markdown is now source code, not documentation.

This is not a novel or particularly clever idea, of course.

In Markdown is the new source code, Hartley Brody writes:

It is starting to feel as if the application logic of the software is being defined and edited as markdown, and the actual code that is generated by the agent is sort of becoming a low-level implementation detail.

Now, as the essays above show, I am ambivalent about AI-generated code. However, my consulting work shows that organizations are headed in this direction, often at terrific speed.

What I want to do in the remainder of this essay is think about the ramifications of Markdown becoming, more and more, the source of truth for software systems.

The Missing Source Code

There is a line of thinking, captured in the quote above, that LLMs are akin to compilers, taking high-level specifications and turning them into low-level implementations. In this view, we don’t need to look at the code an LLM generates, just as we don’t look at the machine code a compiler generates.

As I mention in Code is Cheap(er), I do not totally agree with this analogy for a few reasons, but the one relevant to this essay is: compiler workflows retain their original source code while LLM workflows typically do not.

Today, LLM-generated code is often created via a string of prompts fed into an agent as a developer builds out a feature. In practice, this means that the generated code is the closest thing we have to “ground truth” for that feature. There may be documentation for the feature stored elsewhere (e.g. Linear, Slack threads, wikis, etc.) but, so far as the codebase is concerned, the generated code is the source of truth.

My opinion is that, in professional agentic coding environments, we need to accept that LLM-generated code that emerges from ephemeral prompting sessions is not ideal, and begin moving towards capturing and checking in Markdown alongside generated code in the source directory.

Markdown As Source

Markdown has many nice properties that make it similar to traditional source code:

  • It is plain text and therefore diffable, greppable and reviewable in pull requests
  • LLMs read and write it natively
  • Humans can read and edit it without tools

And, in fact, it is already acting as source, to an extent, in AGENTS.md, specs, plans, TASK.md and so forth. We just haven’t standardized capturing that source yet.

In Markdown is the new source code, Brody says he keeps his Markdown files in .scratch/research/ and .scratch/plan/ as he works. I have adopted the convention of creating a /tmp directory for similar ephemeral needs.

My proposal is that we promote some of these files to a new directory, alongside our existing source code: /src/md

The Markdown captured in this proposed directory would be lower level than traditional design documents:

  • It contains architectural decisions
  • It contains source-level decisions
  • It contains low-level data design decisions

It is much closer to a specification (although it is not one) than a design document as traditionally managed by a project manager or designer.

Locality

I am a fan of locality, and I think that moving Markdown into /src has strong locality advantages:

  • Code modules would now include the Markdown that explains the intent of the code
  • There is no spooky “specification at a distance”, where the logic of why is elsewhere in a wiki/Notion/Confluence/Jira
  • Markdown in /src can be consumed by both humans and agents
  • Agents no longer need to look elsewhere to get context on a given codebase

What About Linear/Wikis/etc.?

Other sources of truth for the behavior of the system can still exist. These sources would provide higher-level and/or “process-oriented” documentation: high-level design documents, issues that need a resolution workflow and so forth.

But the core, current and static intended behavior of the system would increasingly be captured directly in Markdown in the source directory.

What About Tests?

I have seen many people online saying that tests are the new specification (or always were). I think there is some truth to that.

However, tests are not a good mechanism for human/agent interaction:

  • They involve a lot of ceremony, often obscuring what they are testing
  • They are typically lower level than most humans want to deal with, particularly when understanding a system
  • Higher-level explanations such as Mermaid diagrams don’t fit naturally into them

I think the following division of labor makes sense:

  • Markdown sits in /src and is the specification(ish)
  • Tests sit in /test (or wherever) and are based on that Markdown, providing automated confirmation of correctness

Again, the core idea here is that, rather than generating code and tests from prompts, a developer would work on Markdown in the /src directory, from which the code and tests would be derived.

What /src/md Markdown Looks Like

The Markdown in /src/md sits between a formal specification for the system and high-level design documents.

As with source code, there is a Complexity Budget associated with this Markdown. It will require thoughtful management to keep these documents clean, well-factored and at the right level of abstraction.

Developers should be expected to interact with both the Markdown and the derived code, so synchronizing the two (when appropriate) will become an important skill.

For example, developers will often do subtractive, constraining work on generated code, and those changes may need to be moved back into the Markdown.

I believe that agents should not be used to generate much content in /src/md. This directory should be mainly human authored and curated.

A Proposed /src/md Convention

This is necessarily the weakest part of this essay because this is a new idea and I haven’t used it extensively yet. It is me thinking out loud and inviting discussion.

With that said, here is a possible /src/md standard:

src/
  md/
    README.md          # index of all md, entry point for agents
    TODO.md            # a list of general TODOs open for this module
    OVERVIEW.md        # a technical overview of this module
    features/FEATURE_1.md       # a set of feature-specific documents
    data/DATAMODEL_1.md        # descriptions of data models in the module
    api/API_1.md                # descriptions of APIs the module provides
    infrastructure/INFRASTRUCTURE_1.md   # descriptions of infrastructure used by the module

Here the features, data, api and infrastructure directories are all optional; the idea is to divide along different axes to best capture a solid working description of the module’s behavior directly in the /src/md folder.

Conclusion

As code gets cheaper to generate, what remains valuable is the intent behind the code: what it does, why it does it, and what it must not do.

Today that intent is often lost in ephemeral prompting sessions, or scattered across wikis, tickets and Slack threads.

I think that, in the name of locality, we should consider capturing this intent in Markdown and checking it in to /src, alongside the code it produces, where both humans and agents can find it.

I don’t know exactly what the right structure for something like /src/md is yet, and I expect my thinking will change as I (and others) get more experience with it.

But I am fairly confident that Markdown is becoming source code, and that we should increasingly treat it like source code.

(Even though, no, LLMs are not compilers :)

The Daily Front Page 19 of 31
Tuesday, September 22, 2026 The Daily Front No. #260922 — A VPN by Design, Not Promise
article

Obscura: VPN that can't log your activity

by Flimm·▲ 175 points·131 comments·obscura.com ↗
We can’t leak what we don’t have.

Meet Obscura: the first VPN that can’t log your activity
and outsmarts internet censorship.

Get Started

Use with Wireguard Other platforms

Screenshot of the Obscura application

VPNs know more about you than they should. So we made one that doesn’t.

Even “no-log” VPNs can track you, since they see both who you are and what you do. Obscura is built such that we can’t see your traffic in the first place.

It’s simple: We can’t leak what we don’t have.

Logs? Not possible.

Obscura VPN doesn’t log your IP address and can’t see your internet traffic, ever. It’s impossible by design.

Emails? Not necessary.

Log in with just a randomized account number. No names, no emails, no phone numbers necessary.

Credit card info? Not required.

Easily pay using Bitcoin’s Lightning Network for better privacy, instant payments, and lower transaction fees. We also accept Monero.

More than Privacy

Outsmart Internet Restrictions

By blending in with regular internet traffic, Obscura avoids being detected by network filters – keeping your internet access unrestricted. More details.

How it Works

Private by Design: Our Two-Party VPN Protocol

By using a fully-independent exit hop, Obscura keeps who you are and what you do separate. More technical details here.

Obscura never sees your traffic

Obscura’s servers relay your connection to exit servers but can never decrypt your traffic.

Your traffic is always end-to-end encrypted via WireGuard® to the exit server.

Exit hops never see who you are

Exit servers (run by Mullvad) connect you to the internet but never see your personal info.

Obscura masks your real IP address when relaying to the exit server.

FAQs

Questions? We’re here to help.

Here are the most common questions we’re asked, but if we haven’t covered yours, don’t hesitate to reach out via one of our handles.

What makes Obscura different from existing VPNs?

Unlike VPNs with a “no-logs” policy, Obscura is provably private by design.

Even “no-logs” VPNs see both your identity and your internet activity, meaning you have to blindly trust their pinky-promise for privacy. This is exactly why some privacy-conscious folks will tell you not to use a VPN at all.

Obscura is different – we never see your decrypted internet packets. It’s simply impossible for us to log your internet activity, even if we were compelled to, or if our servers were compromised. You can even verify this yourself.

Obscura’s stealth protocol is much harder to block.

Our unique stealth protocol is designed to blend in with regular internet traffic. It does so by leveraging QUIC – the same technology that powers HTTP/3 – making it far harder for censors or network filters to detect or block.

Want more technical details? See here.

What user data can Obscura see?

Obscura only sees your connecting IP address and necessary payment info – never your actual internet traffic.

We physically can’t decrypt your internet traffic (see how) and never log your connecting IP address.

For even more privacy, we actively support privacy-friendly payment methods like Bitcoin over Lightning and Monero. Learn more about accepted payment methods here.

How do I know Obscura does what it claims?

I like the way you think! 😎

Don’t trust — verify. Our app’s entire source code is on GitHub for you to verify that we do what we say.

We also plan to provide reproducible builds of our app, meaning anyone can confirm that the app you download matches the code we publish.

Additionally, our app displays your current exit hop’s WireGuard public key on its “Location” page. You can check this key against what Mullvad publishes here to ensure that you’re connected via a genuine Mullvad exit hop!

How much does Obscura cost, what payment methods are accepted?

Obscura is just $8/month.

You can top-up your account using:

  • Credit Card (via Stripe)
  • Bitcoin over Lightning (for more privacy)
  • Monero (for more privacy)

For convenient renewals, you can also subscribe with your Credit Card (via Stripe). Note that Stripe may need your email for subscriptions, but Obscura never stores it.

How many devices can I use Obscura on?

Each Obscura account has 5 simultaneous connection slots. This is different from ”5 devices”.

If you’re connecting with our Obscura app…

  • You can log in on as many devices as you’d like.
  • A device only uses 1 slot while it is actively connected (see the “Connection” tab in the app).

If you’re connecting with our WireGuard configs…

  • Each config reserves 1 slot as long as it exists on your account, even when the device is not connected.
  • To free a slot, delete the config from your account here.

Examples

  • Only using our Obscura app: Unlimited sign-ins; up to 5 devices connected at the same time.
  • Only using WireGuard configs: You can keep up to 5 configs total (i.e., 5 devices).
  • A Mix: If you have 1 WireGuard config on your account, it uses 1 of 5 slots, leaving 4 slots open for the Obscura app to connect from any signed-in devices.

How does Obscura differ from my VPN’s multihop option?

With a typical multihop VPN, the same provider controls every hop—so they can still link your identity to your traffic.

Obscura solves this by using a fully-independent exit hop (currently Mullvad). Ensuring that our servers never see your actual traffic, and the exit hop never sees your identity.

How does Obscura compare to Tor?

We have immense respect for the Tor project (and encourage you to support it), but its volunteer-run network can be slow and susceptible to DDoS issues, making it infeasible for everyday use.

Obscura uses two dedicated, high-performance hops for maximum speed and reliability – meaning you get many of Tor’s privacy benefits without sacrificing everyday usability.

What server locations are available?

We’re always working to add more exit locations. We currently have the following:

North America

  • Toronto, Canada 🇨🇦
  • Vancouver, Canada 🇨🇦
United States 🇺🇸
  • Ashburn, VA
  • Chicago, IL
  • Dallas, TX
  • Denver, CO
  • Los Angeles, CA
  • Miami, FL
  • New York, NY
  • San Jose, CA
  • Seattle, WA

Latin America

  • São Paulo, Brazil 🇧🇷
  • Santiago, Chile 🇨🇱
  • Bogotá, Colombia 🇨🇴
  • Querétaro, Mexico 🇲🇽

Europe

  • Prague, Czech Republic 🇨🇿
  • Paris, France 🇫🇷
  • Frankfurt, Germany 🇩🇪
  • Milan, Italy 🇮🇹
  • Palermo, Italy 🇮🇹
  • Amsterdam, Netherlands 🇳🇱
  • Warsaw, Poland 🇵🇱
  • Madrid, Spain 🇪🇸
  • Stockholm, Sweden 🇸🇪
  • Zurich, Switzerland 🇨🇭
  • Kyiv, Ukraine 🇺🇦
  • London, United Kingdom 🇬🇧

Asia

  • Hong Kong 🇭🇰
  • Tokyo, Japan 🇯🇵
  • Singapore 🇸🇬
  • Istanbul, Turkey 🇹🇷

Africa

  • Johannesburg, South Africa 🇿🇦

Oceania

  • Auckland, New Zealand 🇳🇿
  • Sydney, Australia 🇦🇺

What relay servers does Obscura offer?

We will continue to add more relay (first-hop) servers to Obscura. Currently we have the following:

North America

United States 🇺🇸
  • Atlanta, GA
  • Chicago, IL
  • Dallas, TX
  • Denver, CO
  • Los Angeles, CA
  • Miami, FL
  • New York, NY
  • San Jose, CA
  • Seattle, WA
  • Washington D.C.

Latin America

  • Querétaro, Mexico 🇲🇽
  • Santiago, Chile 🇨🇱
  • São Paulo, Brazil 🇧🇷

Europe

  • Amsterdam, Netherlands 🇳🇱
  • Frankfurt, Germany 🇩🇪
  • London, United Kingdom 🇬🇧
  • Madrid, Spain 🇪🇸
  • Stockholm, Sweden 🇸🇪
  • Warsaw, Poland 🇵🇱

Asia

  • Hong Kong 🇭🇰
  • Osaka, Japan 🇯🇵
  • Tokyo, Japan 🇯🇵
  • Singapore 🇸🇬

Africa

  • Johannesburg, South Africa 🇿🇦

Oceania

  • Melbourne, Australia 🇦🇺
  • Perth, Australia 🇦🇺
  • Sydney, Australia 🇦🇺

How does the macOS app work? Does it have kernel-level access?

Our macOS app installs a Network Extension, which is a fully sandboxed process with no kernel-level access to your system.

You can verify this by looking at our source code.

Give me the technical details!

Obscura’s servers relay the WireGuard tunnel between your device and Mullvad’s servers. Essentially, WireGuard-over-QUIC.

This looks something like:

<user>  -->  Obscura Server  -->  Mullvad Server  -->  <internet>

This ensures that no single party has the information to leak or correlate your traffic and your identity, since:

  • Obscura’s servers are unable to decrypt the WireGuard packets it relays, since they are encrypted to a Mullvad server’s WireGuard pubkey.
  • Mullvad’s servers never see your connecting IP since Obscura’s servers are effectively doing NAT.

Your device connects to Obscura’s servers over QUIC, meaning:

Still curious? Read our blog post on Obscura’s design.

Can I generate a WireGuard configuration to use Obscura?

Yes you can! Obscura’s WireGuard compatibility mode generates configurations that work on any WireGuard-compatible platforms, including:

  • iOS
  • Android
  • Windows
  • Linux
  • Various router OSes

To get started:

  1. Download the WireGuard app for your platform here
  2. Generate a WireGuard configuration for your account here
  3. Add the generated WireGuard configuration to your WireGuard app (or scan the QR code)
  4. Connect 🎉

For a more in-depth guide, see our Using Obscura via WireGuard article.

Note that since this uses the original WireGuard protocol, you won’t benefit from Obscura’s QUIC-based obfuscation for outsmarting internet censorship. However, your connection still benefits from improved privacy with our Two-Party Relay architecture.

How do I download Obscura?

Download Obscura for iOS, macOS, Android, Windows, or Linux from the platform’s download page.

For Windows, choose the x64 installer for most computers or the ARM64 installer for a Windows on ARM device.

For Linux, choose your distribution to see its requirements and terminal installation commands. Packages are available for x64 computers.

If we don’t have a native app for your platform yet, you can still use Obscura with a WireGuard configuration.

The Daily Front Page 20 of 31
Tuesday, September 22, 2026 The Daily Front No. #260922 — MiMo on the Measure
article

MiMo-v2.6-Pro: Intelligence, Performance and Price Analysis

by theanonymousone·▲ 161 points·63 comments·artificialanalysis.ai ↗
MiMo-V2.6-Pro is amongst the leading models in intelligence and reasonably priced.

Model summary

Intelligence

#1 / 114

46

Artificial Analysis Intelligence Index

4 out of 4 units for Intelligence.

Speed

#41 / 114

54.5

Output tokens per second

2 out of 4 units for Speed.

Cost

#12 / 114

In $0.435
Out $0.87
Cache Discount 99%

$0.13

Cost per Intelligence Index task

2 out of 4 units for Cost.

Verbosity

#18 / 114

140M

Output tokens from Intelligence Index

3 out of 4 units for Verbosity.

Comparison Summary

MiMo-V2.6-Pro is amongst the leading models in intelligence and reasonably priced when comparing to other open weight models of similar size. It's also slower than average and somewhat verbose. The model supports text, image, speech, and video input, outputs text, and has a 1M tokens context window.

MiMo-V2.6-Pro scores 46 on the Artificial Analysis Intelligence Index, placing it well above average among comparable models (median: 18). When evaluating the Intelligence Index, it generated 140M tokens, which is somewhat verbose in comparison to the median of 140M.

Pricing for MiMo-V2.6-Pro is $0.43 per 1M input tokens (somewhat expensive, median: $0.30) and $0.87 per 1M output tokens (moderately priced, median: $1.13). On average, it costs $0.13 per task to evaluate MiMo-V2.6-Pro on the Intelligence Index.

At 54 tokens per second, MiMo-V2.6-Pro is slower than average (67).

Technical specifications

Reasoning
Yes

This page shows the reasoning version of this model.

A non-reasoning variant may also exist.

Input modality

Supports: text, image, speech, and video

Output modality

Supports: text

Context window
1M

~1500 A4 pages of size 12 Arial font

Total parameters
1.0T

Active parameters
42B

Number of parameters active per token during inference

License
MIT

Model weights
Hugging Face

114 models in this class

Metrics are compared against models of the same class:

  • Non-reasoning models → compared only with other non-reasoning models
  • Reasoning models → compared across both reasoning and non-reasoning
  • Open weights models → compared only with other open weights models of the same size class:
    • Tiny: ≤4B parameters
    • Small: 4B–40B parameters
    • Medium: 40B–150B parameters
    • Large: >150B parameters
  • Proprietary models → compared across proprietary and open weights models of the same price range, using a blended 3:1 input/output price ratio:
    • <$0.15 per 1M tokens
    • $0.15–$1 per 1M tokens
    • $1 per 1M tokens

Frequently Asked Questions

When was MiMo-V2.6-Pro released?

MiMo-V2.6-Pro was released on September 21, 2026.

Who created MiMo-V2.6-Pro?

MiMo-V2.6-Pro was created by Xiaomi.

How intelligent is MiMo-V2.6-Pro?

MiMo-V2.6-Pro scores 46 on the Artificial Analysis Intelligence Index, placing it well above average among other open weight models of similar size (median: 18).

How fast is MiMo-V2.6-Pro?

MiMo-V2.6-Pro generates output at 54.5 tokens per second (based on Xiaomi's API), which is below average compared to other open weight models of similar size (median: 66.8 t/s).

What is the latency of MiMo-V2.6-Pro?

MiMo-V2.6-Pro has a time to first token (TTFT) of 2.72s (based on Xiaomi's API), which is somewhat higher than average compared to other open weight models of similar size (median: 2.33s).

How much does MiMo-V2.6-Pro cost?

MiMo-V2.6-Pro costs $0.43 per 1M input tokens (better than average, median: $0.45) and $0.87 per 1M output tokens (very competitive, median: $1.68), based on Xiaomi's API.

What is MiMo-V2.6-Pro API pricing?

MiMo-V2.6-Pro costs $0.43 per 1M input tokens and $0.87 per 1M output tokens (based on Xiaomi's API). For a blended rate (7:2:1 cache hit/input/output ratio), this is $0.18 per 1M tokens. Pricing may vary by provider. Compare provider pricing

How verbose is MiMo-V2.6-Pro?

When evaluated on the Intelligence Index, MiMo-V2.6-Pro generated 140M output tokens, which is somewhat higher than average compared to other open weight models of similar size (median: 140M).

Is MiMo-V2.6-Pro a reasoning model?

Yes, MiMo-V2.6-Pro is a reasoning model. It uses extended thinking or chain-of-thought reasoning to work through complex problems before providing an answer.

What input modalities does MiMo-V2.6-Pro support?

MiMo-V2.6-Pro supports text, image, speech, and video input.

What output modalities does MiMo-V2.6-Pro support?

MiMo-V2.6-Pro supports text output.

Can MiMo-V2.6-Pro process images?

Yes, MiMo-V2.6-Pro supports image input and can analyze, describe, and answer questions about images.

Is MiMo-V2.6-Pro multimodal?

Yes, MiMo-V2.6-Pro is multimodal. It can process text, image, speech, and video input and generate text output.

What is the context window of MiMo-V2.6-Pro?

MiMo-V2.6-Pro has a context window of 1.0M tokens. This determines how much text and conversation history the model can process in a single request.

Is MiMo-V2.6-Pro open source?

Yes, MiMo-V2.6-Pro is open weights. The model weights are publicly available and can be downloaded for self-hosting.

How many parameters does MiMo-V2.6-Pro have?

MiMo-V2.6-Pro has 1.0 trillion parameters (42 billion active).

What are the active parameters of MiMo-V2.6-Pro?

MiMo-V2.6-Pro is a Mixture of Experts (MoE) model with 1.0 trillion total parameters, but only 42 billion active parameters are used during inference.

What is the license for MiMo-V2.6-Pro?

MiMo-V2.6-Pro is released under the MIT license. This license allows commercial use.

How does MiMo-V2.6-Pro perform on benchmarks?

MiMo-V2.6-Pro achieves a score of 46 on the Artificial Analysis Intelligence Index. This composite benchmark evaluates models across reasoning, knowledge, mathematics, and coding.

Is MiMo-V2.6-Pro available via API?

Yes, MiMo-V2.6-Pro is available via API through 1 provider. Compare API providers

Where can I use MiMo-V2.6-Pro?

MiMo-V2.6-Pro is available through 1 API provider. Compare providers

The Daily Front Page 21 of 31
Tuesday, September 22, 2026 The Daily Front No. #260922 — Lucas’s New Galaxy
article

George Lucas Returns to Earth, Bearing Gifts

by surprisetalk·▲ 112 points·65 comments·commonedge.org ↗
Bearing gifts of memories and myths.

Appearing like a grounded and formidable spaceship, the Lucas Museum of Narrative Art, bearing gifts of memories and myths, opened its portals to an Earth-bound selection of people (local notables, friends, museum members, and journalists) last week in a welcoming Los Angeles, christened by its benefactors, George Lucas, the producer and director of Star Wars fame and fortune, and his financier wife, Mellody Hobson. (The general public opening will be on September 22.)

The architecture of the galactic conceit, with a reported $1 billion price tag, is most definitely different, almost stunningly so: a sculptural, organic form, described as a “cloud” by Ma Yansong, founder of MAD Architects, the principal firm in a design team that also included Michael Siegel of Stantec and Mia Lehrer of the heralded local landscape firm of Studio-MLA.

Moored in the city’s Exposition Park on a deftly landscaped 13-acre campus that had previously been a parking lot, the soaring sweep of the five-story museum may look to some like a makeshift sci-fi construct, but its interior is grounded in a familiar labyrinth of accessible galleries and convenient visitor services.

Lucas hesitantly declared at the media preview that the museum, long in planning, “was created to honor humanity’s stories and the artists who illustrate them” and, in doing so, “connect our modern imaginations with our ancient emotions, creating community.” The diversity of the roughly 1,300 objects on display—housed in 33 galleries totalling 100,000 square feet—is impressive. It ranges from prehistoric cave paintings, ancient sculptures of gods and goddesses, and Renaissance paintings to screen art, rare vintage illustrations, and photographs. The collection also includes graphic novels and comics, which the museum notes “have not always received the respect they deserve.” Lucas calls them “the people’s art.”

The museum library.

Several exhibits exploring the Skywalker saga should appeal to the young and young-at-heart Star Wars fans, weaned as they were through (for now) a dozen feature films. The films, in turn, have generated a seemingly endless Hollywood galaxy of action figures and toys, TV shows and cartoons, books and video games, clothing, and other themed merchandise far too numerous to mention. (The collective lifetime revenue of Stars Wars is estimated to be around $50 billion.) According to the museum, all of these products are “heavily inspired by archetypes and motifs from classical mythology, religion, political history, and the ‘hero’s journey.’”

Among the exhibits is a selection of vehicle designs, props, costumes, and illustrations from the first six films in the saga that Lucas had, over time, squirreled away for his personal archives. But the museum does way more than commemorate Star Wars movies, as some haughty east coast cultural commentators have alluded to in early critiques, out of apparent intellectual and geographic hubris. In contrast, as a longtime fan of comics and cartoons, considerably before being awestruck and enthralled by the masterpieces of art and architecture, I sensed in the engaging exhibits a welcoming curatorial curiosity and refreshing respect for film fans.

The building has two movie theatres.

Indeed, the cinema’s supremacy for telling stories with moving images on a screen is displayed in two theaters on the ground level, off the main lobby, named in honor of Robert Flaherty, an acclaimed early documentarian, and Slavko Vorkapich, who pioneered special effects and experimental films in the analog heyday of Hollywood, before CGI took over. Not coincidentally, he briefly was also the chair of the famed USC Department of Film, which Lucas attended. To entice, the theaters will each operate free to museumgoers as open-door venues, screening curated films continuously.

The galleries also include a wealth of still photography by luminaries such as Robert Capra, Gordon Parks, Alfred Eisenstaedt, and Dorothea Lange; illustrations by Maxwell Parrish, Norman Rockwell, Andrew and N.C. Wyeth, Frank Frazetta; paintings and murals by Diego Rivera, Judith Baca, and Thomas Hart Benton; and rare comic books illustrated by a bevy of artists: Mœbius, Marie Severin, Jack Kirby, Alison Bechdel, Jim Lee, Frank Miller, Rafael Navarro, and R. Crumb.

Eclectic as the galleries may be, the design of the public areas are blandly functional, and the circulation thankfully fluid, even to this mobility-challenged critic—though more seating, as always, would be appreciated. But there is little question that the museum itself is a good fit for Los Angeles, however bruised it is as the entertainment capital of the world. Certainly the museum feels more at home here than it would have been in Chicago, where it was initially to be located until Lucas failed to get the site he wanted on the lakefront. (He was similarly thwarted in San Francisco, when civic leaders balked at putting the museum in the Presidio.)

Embracing the museum is a diverting people-oriented landscape design that, in addition to the indigenous and drought-tolerant plantings, contains spaces and places for varied public use: a fountain and a surprise waterfall as focal points to meet up with friends and family, a meadow on which to picnic or throw a frisbee, or meandering paths on which to stroll.

From every perspective, the design of the Lucas Museum of Narrative Art clearly dominates and distinguishes the park and surrounding area. It was a fun tour for me, which I acknowledge with a tip of my magician’s hat and the confidence that the museum will soon become a landmark, an architectural must-see, and a tourist attraction, as well as a point of pride for a city long renowned for narrative art.

Featured image: The Lucas Museum of Narrative Art, designed by MAD Architects, via the museum.

The Daily Front Page 22 of 31
Tuesday, September 22, 2026 The Daily Front No. #260922 — Reports From the Short Wire
article

'We hacked the FBI:' Hackers say they have data on all FBI employees

by spenvo·▲ 766 points·555 comments·404media.co ↗

A sample of 5,000 alleged agents seen by 404 Media includes names, addresses, phone numbers, and details on FBI employees' spouses.

‘We Hacked the FBI:’ Hackers Say They Have Data on All FBI Employees

Image: jossuppy on Flickr.

A high profile hacking group claims it has breached multiple FBI-related services and stolen data “on all FBI employees and applicants.” A representative of the group, called ShinyHunters, told 404 Media the data includes FBI agents’ names, home addresses, phone number, and information on their spouse.

The data breach could be massively significant and may have all sorts of national security and counterintelligence implications. Criminals from the same ecosystem as ShinyHunters have previously used hacked data like phone records to track, intimidate, and harass the FBI agents investigating them. The highly sensitive data could also be a boon to foreign intelligence agencies who want to better understand how one of the most important law enforcement and intelligence agencies in the U.S. operates. And if the data fell into the hands of more criminals, FBI agents and their spouses could face serious threats to their safety.

“We hacked the FBI. We hold data on all FBI employees and applicants,” the representative of the group told 404 Media.

Do you work at the FBI? Do you know anything else about this hack? I would love to hear from you. Using a non-work device, you can message me securely on Signal at joseph.404 or send me an email at joseph@404media.co.

The Daily Front Page 23 of 31
Tuesday, September 22, 2026 The Daily Front No. #260922 — Reports From the Short Wire
article

I said no and Apple said yes

by thatslast·▲ 847 points·688 comments·dbushell.com ↗

The nice thing about keeping a blog is that I can say at precisely 9:51am, Wednesday 5th February 2025, I discovered that macOS 15.3 had enabled a feature that was phoning home every 15 minutes with personal data. And that I said “no” and turned it off.

At the time Apple were generous enough to provide a setting to disable this feature.

macOS 15 Apple Intelligence setting.

macOS 15 Apple Intelligence setting.

Although they hid the second part deeper, because why should saying “no” be easy?

macOS 15 Apple Intelligence privacy setting.

macOS 15 Apple Intelligence privacy setting.

Last week I succumbed to Apple’s harassment and upgraded macOS 15 to 27. I only skipped one major version, Apple skipped 10!

And today I discovered that Apple had removed the “no” switch.

The “AI” industry has many flaws, the word “consent” being seemingly missing from training data and company handbooks is one of them. AI bros do not take “no” for an answer. When Apple advertised their deepfake feature back in June it became obvious Apple does not “think different.”

Digging through macOS 27 settings I turned off Siri (again). Of course, multiple unkillable Siri processes remain, stealing memory and writing data. For what purpose? Who knows. Note that they removed “Apple Intelligence” from this control.

macOS 27 Siri setting.

macOS 27 Siri setting.

Trawling the web I discovered Apple has hidden settings under “Screen Time” restrictions. This is supposed to be for parental controls. These settings don’t disable Apple “Intelligence” but they do clean up various menus by hiding the slop tools.

All of this garbage was enabled after upgrading to macOS 27 despite me having “Apple Intelligence & Siri” turned off already. That was a rather explicit “no”, no?

The icing on this cake is the 22.28 GB brick clogging my disk space.

macOS 27 Apple Intelligence accounting for 22.28 GB.

macOS 27 Apple Intelligence accounting for 22.28 GB.

Apple is charging £500/TB on new MacBooks so that is what, £11 they’ve stolen from me?

But that’s a trivial cost compared to the consent problem. The AI industrial complex does not do consent. You will use it. You cannot look away, it will be stuffed down your throat and if you say “no” they’ll cut out your tongue.

The AI industry is vile. My AI policy tried to list my concerns but it’s hopelessly outdated. I can’t keep up. Here’s just three of many headlines I collected this month:

The list is endless. There is no limit to the human toll to keep this bubble inflated.

Call me a radical but I’ve chosen not to kowtow to billionaires. Do you want another Epstein list? Because this is how you create another Epstein list. Fund a generation of psychopaths building on a foundation of non-consent and privacy invasion. Fantastic idea!

AI bros keep telling me “just turn it off” and when I do they remove the choice.

The Daily Front Page 24 of 31
Tuesday, September 22, 2026 The Daily Front No. #260922 — Reports From the Short Wire
article

Elevated errors for multiple models – Resolved

by corvad·▲ 140 points·111 comments·status.claude.com ↗

Resolved

This issue has been resolved. Impact occurred from 5:50pm PT / 00:50 UTC to 7:10pm PT / 02:10 UTC.

Monitoring

We have seen success rates return to normal across affected models, and are monitoring closely to ensure no further issues.

Update

We are continuing to work to resolve errors affecting some models. At this time, requests to Claude Fable 5 and 5.1 and Mythos 5 and 5.1 have returned to normal success rates. We are working to resolve remaining errors affecting Claude Opus 5, and will provide an additional update shortly.

Identified

We have identified the cause of elevated errors on requests to Claude Mythos 5.1, Claude Fable 5.1, and Claude Opus 5 and are working on a fix. We will provide an update as soon as possible.

Investigating

We are investigating elevated errors on requests to Claude Mythos 5.1, Claude Fable 5.1, and Claude Opus 5. We will provide an update as soon as possible.

This incident affected: claude.ai, Claude API (api.anthropic.com), Claude Code, and Claude Cowork.

The Daily Front Page 25 of 31
Tuesday, September 22, 2026 The Daily Front No. #260922 — Reports From the Short Wire
repository

Native apps written in TypeScript and CSS

by arbayi·▲ 122 points·50 comments·github.com ↗
★ 93⑂ 1 forks TypeScript

Example Gea apps, used by the simulator and all targets.

Example applications and tools for GeaStack.

This repo is the app gallery used by the simulator, embedded targets, GeaOS, Apple targets, the VS Code/Cursor extension, and marketing demos. Each example is a small package with a gea manifest in package.json.

What Is Here

Path Purpose apps/* Gea apps. Most are TSX apps targeting web, ESP32, and/or GeaOS. apps/*/package.json App manifest, target compatibility, scripts, and launcher metadata. tools/dialer-browser Small browser-side helper tool for dialer workflows. package.json Workspace marker for the examples collection. docs Catalog and contribution guidance.

Quick Start

Run checks for an individual example:

cd apps/watch
npm install
npm run check
npm run build

Some examples have tests, mostly for a layout or a device setup. Run them with npm test in the app folder.

The web loop is driven from the simulator, which is a separate repository: geastack/simulator. Its scripts read apps out of an app project root, which they take from GEA_APPS_ROOT -- this repo, or your own. There is no default, so set it or pass --app-dir. The two checkouts do not need to be next to each other.

cd /path/to/simulator
GEA_APPS_ROOT=/path/to/examples ./targets/web/dev-web.mjs watch   # development loop
GEA_APPS_ROOT=/path/to/examples ./targets/web/build-web.sh watch  # build for web

./targets/web/dev-web.mjs --app-dir /path/to/examples/apps/watch   # or name one app

Flash a compatible board through the Gea CLI:

npx gea flash watch --board <alias>
npx gea flash watch --board <alias> --monitor

Documentation

App Manifest Basics

Every buildable app should have a package.json with a gea field:

{
  "gea": {
    "id": "watch",
    "name": "Watch",
    "entry": "index.tsx",
    "runtime": "gea",
    "targets": {
      "web": true,
      "esp32": true,
      "geaos": true
    }
  }
}

The manifest is consumed by the simulator, embedded board scripts, GeaOS, Apple targets, and the IDE extension. Keep it accurate.

Maintenance Notes

  • Keep examples small and focused. A good example proves one behavior clearly.
  • Prefer shared framework APIs over target-specific hacks inside examples.
  • Add tests for examples with non-trivial logic, physics, or parsing.
  • Update the catalog docs when adding, renaming, hiding, or changing target compatibility for an app.

License

MIT (see LICENSE). You can ship closed-source products built on it. The only GeaStack code under a different license is the embedded board support (targets and @geastack/chips, GPL-3.0-only): shipping closed-source firmware through those needs a commercial license. Contact contact@geastack.com for commercial terms, support and hosted builds.

The Daily Front Page 26 of 31
Tuesday, September 22, 2026 The Daily Front No. #260922 — Workshop & Weekend
article

How did AMD Ryzen get 50% faster in two years?

by ibobev·▲ 454 points·185 comments·lemire.me ↗

Three desktop processors in a row, from nearest to farthest

How did AMD Ryzen get 50% faster in two years?

People still tell me that CPUs are boring. That nothing much happens anymore.

Let us look at AMD Ryzen 7 processors from 2022 to 2024: the 5800X3D (Zen 3), the 7800X3D (Zen 4) and the 9800X3D (Zen 5). They are comparable 8-core chips with 3D V-Cache. I have written about them before, in How stagnant is CPU technology?

On Geekbench 6, performance went up by about 50% in two years.

Geekbench 6 single-core and multi-core scores for Ryzen 7 5800X3D, 7800X3D and 9800X3D

The 2024 chip is 47% faster on a single core than the 2022 chip, and 58% faster with all cores.

The clock did not do that. Max boost went from 4.5 GHz to 5.2 GHz, a 15% increase.

Base and max boost frequencies for Ryzen 7 5800X3D, 7800X3D and 9800X3D

The number of transistors is way up, by about 50%, from roughly 11 billion to 16 billion. Most of the extra transistors went into the core, not the cache.

Transistor counts for Ryzen 7 5800X3D, 7800X3D and 9800X3D, split into core, I/O and cache

How do you turn extra transistors into extra performance?

You make the core wider, and you give it more to work with. Dispatch width went from a maximum of 6 instructions per cycle to 8. The L2 cache per core doubled, from 512 KB to 1 MB. The L1 data cache went from 32 KB to 48 KB. Integer ALUs went from 4 to 6. The reorder buffer grew from 256 to 448 entries, so the processor can keep more instructions in flight and schedule them better.

Cache sizes, dispatch width, integer ALUs and reorder buffer from Zen 3 to Zen 5

For data parallelism (SIMD), Zen 5 is a different machine. Zen 3 and Zen 4 had four 256-bit SIMD arithmetic units. Zen 5 has four 512-bit units. Loads and stores widened the same way: two 512-bit loads per cycle, one 512-bit store.

SIMD arithmetic units, loads per cycle and stores per cycle from Zen 3 to Zen 5

I already made the point that processors are getting wider. This is what that looks like on a desktop chip you can buy.

What about the next step? Zen 6 is arriving. AMD is talking about a 256-core Epyc part (Venice) with a gigabyte of L3 cache. We do not yet know what the desktop cores will look like. It could be wild.

Further reading: AMD’s 256-core Epyc 9996 ‘Venice’ (Tom’s Hardware).

The Daily Front Page 27 of 31
Tuesday, September 22, 2026 The Daily Front No. #260922 — Workshop & Weekend
article

MUNI Heritage Weekend in San Francisco

by plun9·▲ 198 points·52 comments·daniel.lawrence.lu ↗

I went to San Francisco for Muni Heritage Weekend 2026! I stood by the tracks for three hours with my line scan camera, scanning trams.

Tram pics are freely licensed under CC-By-SA 4.0 (I’ve also uploaded a bunch to Wikimedia Commons). Eight of these photos are also available as large metal prints.

Shop prints ↗

No. 1: Muni Streetcar 1 (1912)

Muni No. 1 is the first publicly owned big city streetcar in the US. Before then, all streetcars were privately owned. It’s pretty cool!

Muni streetcar 1

Muni streetcar 1

No. 162: Muni (1914-1950s)

Muni No. 162 started out from 1914 and served until 1958. It’s making its first Muni Heritage Weekend appearance since a 2014 collision. Sorry, there was a car in the background and someone bumped my camera, causing some vibrations.

Muni 162

Muni 162

No. 233: Blackpool Boat Tram (1934)

The Blackpool boat tram is known for looking like a boat with its open top design.

Boat tram

Boat tram

No. 496: Melbourne Tram (1928)

The Melbourne tram comes from Melbourne, Australia. Like No. 162, it is green.

Melbourne tram

Melbourne tram

No. 578: Dinky (1896)

Muni No. 578 is probably the oldest one. It looks like a cable car but it is electrically powered rather than being powered by a cable.

Note that up until 1909, Divisadero Street used to be called Devisadero Street, so it’s a period-correct spelling, not a typo.

Dinky

Dinky

No. 1815: Milan Peter Witt (1928)

The Milan tram was designed by Peter Witts so that it has more doors for rapid boarding.

I didn’t get a good line scan photo of this despite three attempts, which failed due to: out of focus, occluded by car, slightly out of focus and has a weird shadow on it. However, I did get a great pic with Pier 1 in the background.

Milan tram

Milan tram

Line scan photo but with a weird shadow and out of focus

Line scan photo but with a weird shadow and out of focus

Other PCC streetcars

No. 1061 Pacifc Electric

No. 1061 Pacifc Electric

No. 1052 Los Angeles

No. 1052 Los Angeles

No. 1015 Illinois Terminal

No. 1015 Illinois Terminal

No. 1058 CTA

No. 1058 CTA

Random vehicles

Line scan photo of Waymo Jaguar I-Pace

Line scan photo of Waymo Jaguar I-Pace

Waymo Ojai passing by vintage buses

Waymo Ojai passing by vintage buses

Cop car

Cop car

Behind the scenes

Scanning the Muni No. 1 (earlier attempt, later I lined up the camera with a blue light pole for cooler background and less likelihood of annoying cars behind.)

Download

Here are two pics of me taken by my friend Daniel Du. Our names are coincidentally similar but there is no relation lol.

Me with the line scan camera. Hopefully nobody trips on it. Photo credit: Daniel Du

Me with the line scan camera. Hopefully nobody trips on it. Photo credit: Daniel Du

Totally not looking sus lmao. Photo credit: Daniel Du

Totally not looking sus lmao. Photo credit: Daniel Du

The Daily Front Page 28 of 31
Tuesday, September 22, 2026 The Daily Front No. #260922 — Workshop & Weekend
article

Socrates vs. the Written Word (2011)

by spectraldrift·▲ 73 points·57 comments·wondermark.com ↗

Previously, I shared a curmudgeonly 1889 article about the menace of electricity and the telephone and its spiritual cousin, a fifteenth-century screed lamenting the printing press. I’m collecting data here in service of a hypothesis that progress is universally despised, that the “get off my lawn you whippersnappers” feeling that we all occasionally experience is more tied to our makeup as humans than the technology and the changes themselves. These feelings, I posit, are universal, and perhaps make us feel disconnected — we see others doing things differently, and experiencing life in a different way, and we can’t understand it, or all we can see is what they’re missing. If only they would realize! But those people are not bad — they are simply native to the next thing, perhaps, and they experience the world slightly differently. And so the world turns.

When I mentioned that I supposed this curmudgeonly sentiment against progress was common all throughout history, some commenters pointed me to the Phaedrus, a Socratic dialogue of around 370 B.C.

In it, Socrates recounts to Phaedrus the Egyptian legend of Theuth, the god who invented “numbers and arithmetic and geometry and astronomy, also draughts and dice, and, most important of all, letters.” Theuth presents the Egyptian king Thamus with his many inventions, and Thamus

…said many things to Theuth in praise or blame of the various arts, which it would take too long to repeat; but when they came to

The Daily Front Page 29 of 31
Tuesday, September 22, 2026 The Daily Front No. #260922 — Also on the Front Page
The Daily Front Page 30 of 31
Tuesday, September 22, 2026 The Daily Front No. #260922 — Colophon

That's the Front for Today

Issue No. #260922 — Tuesday, September 22, 2026 — went to press 2026-09-23 at 18:34 UTC.

About This Magazine

The Daily Front is a daily digital magazine assembled from the stories that reached the front page of Hacker News on Tuesday, September 22, 2026. Headlines, points, and comment counts are recorded as they stood at press time. All articles remain the property of their original authors — every piece links back to its source and its discussion thread.

How It Was Made

Fetched, cleaned, and typeset by an automated pipeline. An editor model laid out the pages and chose the highlights; a second read a handful of the day's stories and briefed the cover illustrator — 32 model calls and 270k tokens in total. Set in Jacquard 12, Playfair Display, Source Serif 4, and IBM Plex Mono, all served via Google Fonts under the SIL Open Font License.

The Cover

The cover illustration was commissioned with this prompt:

In a dim server room, two newly delivered processor modules—one marked only by a tiny sun-shaped emblem, the other by a crescent—sit on a balance scale beside an opened security file cabinet. A gloved investigator lifts a transparent sheet showing rows of exposed employee photographs, home addresses, and family connections, while another hand studies the chip’s dense layered circuitry through a magnifying lens. Cooling fans churn overhead, and a fine metal chain still loops around the cabinet door, snapped at its lock.

Create a single-item museum-studio photograph: a meticulously constructed miniature forensic assemblage centered low in frame, preserving the dim server-room scenario in one compact object—two newly delivered processor modules balanced beside an opened security file cabinet, the sun-emblem module opposite the crescent-marked one; a gloved investigator lifting a transparent sheet of employee photographs, home addresses, and family connections while another hand examines the chip’s layered circuitry through a magnifying lens, with overhead cooling fans and a fine metal chain looped around the cabinet door, snapped at its lock. Render it in diffuse daylight against a silent pale dove-gray backdrop, using a deliberate palette of graphite, icy blue, muted saffron, and restrained crimson accents.

Absolutely no text, letters, numbers, readable symbols, or logos anywhere in the image. Keep the main image subject primarily below the upper 10% of the composition, where a title may be overlaid; the scene may extend naturally underneath that title area.

Production Ledger

StageModelCallsTokens InTokens Out
extractgpt-5.6-luna 28 176,312 67,232
layoutgpt-5.6-terra 1 20,049 2,177
covergpt-5.6-luna 2 1,875 526
covergpt-image-2.5-flare 1 303 1,372

The Publisher

Published by Johnny.

Support the Press

If The Daily Front brightens your morning, consider supporting its publisher.

Credits & Contact

All content — articles, posts, comments, and the images within them — belongs to its original authors and is reproduced here to point readers back to the source. Full credit goes to those creators; every item links to its original and its Hacker News discussion.

If you are an author and would like your content removed from an issue, write to hi@johnnys.page and it will be taken down.

Feedback is always welcome at the same address: hi@johnnys.page.

Credit where credit is due.

Every page of this issue began as someone else's work — these are the original sources, linked in full.

  1. Claude Opus 5.5 by km144 — anthropic.com·HN discussion ↗
  2. GPT-6 Sol and Luna by OfficialTurkey — openai.com·HN discussion ↗
  3. OpenAI GPT–6 Astra breaks Enigma message that has resisted solution since 2005 by sohkamyung — cryptocellar.org·HN discussion ↗
  4. I don't want to read what you didn't write by mooreds — blog.colinbreck.com·HN discussion ↗
  5. Apple has added persistent 'ads' to iOS, and it's driving users crazy by MC995 — techradar.com·HN discussion ↗
  6. Spymarks, not Watermarks by possibilistic — brand.io·HN discussion ↗
  7. WordPress: Unauthenticated path traversal leading to conditional RCE by vntok — github.com·HN discussion ↗
  8. Microsoft killed FoxPro in 2007. Anyway, here's FoxPro revived by boredjohnny — foxscript.org·HN discussion ↗
  9. SAML: A fractal of bad design by aray07 — blog.trailofbits.com·HN discussion ↗
  10. OpenAI is well positioned to fast-follow Jev by JohnBerryman — arcturus-labs.com·HN discussion ↗
  11. Claude Opus 5.5 Intelligence, Performance and Price Analysis (Max) by theanonymousone — artificialanalysis.ai·HN discussion ↗
  12. What California is learning from solar panels built over irrigation canals by Jtsummers — kqed.org·HN discussion ↗
  13. Unreal Agent by trollied — unreallabs.ai·HN discussion ↗
  14. Can gzip be a language model? by networked — nathan.rs·HN discussion ↗
  15. Looking forward to Git 2.56 – and 3.0 by chmaynard — lwn.net·HN discussion ↗
  16. Show HN: JevBench, a reproducible benchmark for typed decision models by florianstandhar — benchmarkheaven.com·HN discussion ↗
  17. Markdown in /src by perrygeo — htmx.org·HN discussion ↗
  18. Obscura: VPN that can't log your activity by Flimm — obscura.com·HN discussion ↗
  19. MiMo-v2.6-Pro: Intelligence, Performance and Price Analysis by theanonymousone — artificialanalysis.ai·HN discussion ↗
  20. George Lucas Returns to Earth, Bearing Gifts by surprisetalk — commonedge.org·HN discussion ↗
  21. 'We hacked the FBI:' Hackers say they have data on all FBI employees by spenvo — 404media.co·HN discussion ↗
  22. I said no and Apple said yes by thatslast — dbushell.com·HN discussion ↗
  23. Elevated errors for multiple models – Resolved by corvad — status.claude.com·HN discussion ↗
  24. Native apps written in TypeScript and CSS by arbayi — github.com·HN discussion ↗
  25. How did AMD Ryzen get 50% faster in two years? by ibobev — lemire.me·HN discussion ↗
  26. MUNI Heritage Weekend in San Francisco by plun9 — daniel.lawrence.lu·HN discussion ↗
  27. Socrates vs. the Written Word (2011) by spectraldrift — wondermark.com·HN discussion ↗
  28. 16-bit Intel 8088 chip (c. 1985) by rbanffy — allpoetry.com·HN discussion ↗
  29. AMD's random number generator can't generate a 0? by BruceEel — board.flatassembler.net·HN discussion ↗
  30. There's a high chance of devices being sold with GrapheneOS preinstalled in 2027 by Cider9986 — grapheneos.social·HN discussion ↗

Browse all issues in the archive →