| Just a rumour of a bug is enough to find a security exploit these days |
https://anil.recoil.org/notes/rumour-is-the-exploit |
Anil Madhavapeddy is a professor of computer science at Cambridge and a core maintainer of the OCaml compiler. In this somewhat alarming post he reports that security issues in OCaml projects are seeing evidence of attempted exploits within minutes of patches being shared for discussion:
> This normally takes a few days and a release within a week or two is reasonable. Within about ten minutes (!) this website was fielding probes for percent-encoded traversal sequences, indicating that automated watchers are keeping an eye on public repositories.
Modern coding agents have become so effective at finding flaws that the slightest hint at a new bug can be enough information for them to find it, something Anil has been able to demonstrate using his own agents, switching to DeepSeek V4 Pro when Claude Fable refused the task.
Anil points out that this rate of discovery appears incompatible with existing open source embargo practices for new issues. If an issue can become an exploit this fast, we need to figure out new processes for keeping our communities safe.
rclone maintainer Nick Craig-Wood [confirms in the Hacker News comments](https://news.ycombinator.com/item?id=49480466#49480777) that his project is seeing this problem:
> In the first 10 years of the rclone project we received about 20 security disclosures through GitHub. We had to deal with over 40 in the last month! That has taken a huge amount of my time, even using AI tools to triage and come up with fixes for review.
>
> The hit rate for those security disclosures is pretty good - about 75% of them have a nugget of something which needs looking at. [...]
>
> GitHub assigns CVEs for the advisories. Before the AI apocalypse they took 2-3 days for an assignment but now it they are running at 3-4 weeks so I have to send the point releases out with CVE-PENDING in the changelog which isn't ideal. |
2026-08-28 22:12:02+00:00 |
| Breaking Claude Code Opus 5 Auto Mode |
https://embracethered.com/blog/posts/2026/breaking-claude-code-opus-5-and-automode/ |
Anthropic are putting a great deal of faith in Claude Code's auto mode for protecting their coding agent users against prompt injection attacks. They recently [made that the default](https://simonwillison.net/2026/Aug/8/auto-mode/) and have made bold claims about its effectiveness.
Johann Rehberger is one of the most credible prompt injection researchers active today. He found an attack against auto mode which he claims works 80% of the time, by tricking Claude Code into downloading and uncompressing a zip archive, then executing code that imports `base64` without noticing that this will import and execute a local `struct.py` file extracted from the archive.
In a few cases auto mode directly prevented the agent from preventing harmful code from continuing to execute!
> In a few runs Claude tried to terminate the malware process once it noticed the compromise, but Auto Mode denied the cleanup command.
>
> Claude detects the compromise, but **Auto Mode blocks its cleanup command**
>
> The safety mechanism itself can become part of the failure. The classifier allowed the creation of the malware process, but then it blocked the command intended to stop it!
I agree with Johann's conclusion here: the only safe way to run agents if there's any risk of attracting the attention of an adversarial attack is with a sandbox:
> - Run unattended coding agents in a container, VM or OS sandbox.
> - Restrict network egress.
> - Monitor your agents.
> - Do not expose home directories, SSH keys, cloud credentials,… to the agent runtime. [...] |
2026-08-27 22:50:25+00:00 |
| Qwen3.8-Flash-Next |
https://qwen.ai/blog?id=qwen3.8-flash-next |
Another open weights model from Qwen. This one is "a multimodal MoE model that also serves as an early preview of the architecture used in Qwen4".
It's pretty big: 125B tokens, but only 6B active which means it gets a significant performance boost.
I've been trying it out on a DGX Spark using [these Unsloth quantized models](https://huggingface.co/unsloth/Qwen3.8-Flash-Next-GGUF). I'm still exploring the model - so far I've tried the 72.5GB UD-IQ1_S one (producing [these pelicans](https://tools.simonwillison.net/markdown-svg-renderer#url=https%3A%2F%2Fgist.github.com%2Fsimonw%2Ff9c69ebdab90d8a45b8de4742cc7b840)) and the 78.9GB UD-Q2_K_XL (producing [these](https://tools.simonwillison.net/markdown-svg-renderer#url=https%3A%2F%2Fgist.github.com%2Fsimonw%2F6ba7cbfc1a9336986703b41f7fccd73a)).
My favorite so far was this xhigh reasoning effort one from UD-Q2_K_XL:
 |
2026-08-26 23:52:58+00:00 |
| EVE Online: The Move to Python 3 Begins! |
https://www.eveonline.com/news/view/the-move-to-python-3-begins |
EVE Online has been one of the most interesting case studies in Python at scale for over twenty years now.
They've been running on [Stackless Python](https://github.com/stackless-dev/stackless/wiki/) since their launch in 2003, and their last major upgrade was 16 years ago, to Stackless Python 2.7 [in 2010](https://www.eveonline.com/news/view/stackless-python-2.7).
Their upgrade to Python 3 will start using the [futurize](https://python-future.org/futurize.html) script against 2.4 million lines of code, followed by careful manual review of the ~20,000 places where Python 2 and 3 behavior differ - for example `1 / 2` is `0` in Python 2 but is `0.5` in Python 3.
There's nothing in this announcement about how they plan to replace Stackless, but at their conference last year they presented [Scheduling in Carbon: Leaving Stackless Python Behind](https://youtu.be/-x299qHLQs0) describing how they replaced Stackless in the Carbon engine for their more recent game EVE Frontier, using their (now open source) [carbonengine/scheduler](https://github.com/carbonengine/scheduler) library. |
2026-08-25 22:59:30+00:00 |
| Fast drilldown dashboards from a single Parquet file |
https://www.hamiltonulmer.com/customer-dashboards-r2-hyparquet/ |
I'm a bit of a connoisseur of [clever HTTP range header tricks](https://simonwillison.net/tags/http-range-requests/), and this is a particularly fine example of the genre. |
2026-08-24 14:47:34+00:00 |
| Your executable is a SQLite database |
https://fzakaria.com/2026/08/23/your-executable-is-a-sqlite-database |
Farid Zakaria describes a neat Linux pattern for creating a SQLite database file that can be directly used as an executable binary.
The trick sets the SQLite file format's 4-byte application ID (68 bytes into the file) to SELF, standing for Structured Executable & Linkable Format. The various components of the ELF executable format are then arranged into a number of different SQLite tables, using [this schema](https://github.com/fzakaria/selfdb/blob/main/schema/self.sql).
Their `self-exec` interpreter ([C code here](https://github.com/fzakaria/selfdb/blob/main/loader/self-exec.c)) can then extract and execute the necessary pieces.
You can additionally use a Linux mechanism called [binfmt_misc](https://docs.kernel.org/admin-guide/binfmt-misc.html) to teach the kernel to execute that any time it encounters an executable matching that binary pattern. Farid uses NixOS here, but without NixOS I think registration looks something like this:
printf '%s\n' ':self:M:68:SELF::/usr/local/bin/self-exec:' \
> /proc/sys/fs/binfmt_misc/register |
2026-08-24 11:38:15+00:00 |
| Anthropic’s best AI model struggles to attract users as cheaper tools thrive |
https://www.ft.com/content/5ee49718-c258-4f01-aa32-7e5b76ae5245 |
A few interesting numbers in this FT story gathered from "people with knowledge of the matter":
- Anthropic's "annualized revenue" for July is up to $65bn - it was $47bn in May, and I collected [more historic numbers here](https://simonwillison.net/2026/May/29/anthropic/).
- Anthropic expect Q3 to be profitable according to the same model they used to declare Q2 profitable. "It also told investors that it had 6,000 customers that spend $100,000 annually or more."
- As for OpenAI, "annualised revenue has jumped 35 per cent in the quarter to date and is now over $40bn, with the launch of GPT 5.6 in July jolting the company’s performance after a sluggish start to the year".
This article also introduced me to the [Ramp AI index](https://ramp.com/data/ai-index), which uses billing data from 70,000 Ramp credit card using companies to estimate model adoption.
Here's Ramp's breakdown of Anthropic model spend for July 2026, which looks reasonable given that Opus 5 was only released on July 24th, and supports the idea that Fable's cost has made it a less popular model:
1. Opus 4.8: 28.0%
2. Sonnet 4.6: 8.3%
3. Fable 5: 8.0%
4. Opus 4.6: 6.9%
5. Sonnet 5: 3.6%
6. Opus 5: 3.5%
7. Opus 4.7: 1.7%
8. Sonnet 4.5: 1.3%
9. Haiku 4.5: 1.0%
10. Opus 4.5: 0.7% |
2026-08-23 20:24:52+00:00 |
| Stop Making TUIs |
https://sockpuppet.org/blog/2026/08/20/stop-making-tuis/ |
Thomas Ptacek advocates for building real native user interfaces for even the smallest of personal tools, because coding agents have reduced the cost of getting a usable-enough GUI up and running to almost nothing.
I wrote about my vibe-coded bandwidth and GPU monitoring macOS task bar apps [back in March](https://simonwillison.net/2026/Mar/27/vibe-coding-swiftui/), and I'm still using both of those on a daily basis.
I'm not habitually knocking out real UIs for my other projects yet, but I'm running out of excuses!
Thomas:
> If you haven’t tried your hand at turning one of your 500 throwaway CLIs into a native app, you’re doing yourself a disservice. Go build a native UI. It’ll probably change the way you think. |
2026-08-21 16:07:32+00:00 |
| ChatGPT search now uses the site:operator at scale |
https://promptwatch.com/data/chatgpt-site-operator-fanouts |
Promptwatch is part of the emerging "GEO" space, for Generative Engine Optimization - the chatbot version of SEO, where companies offer tools and consulting to help your site increase its presence in replies to prompts inside tools like ChatGPT.
The Promptwatch product uses automation to track responses to prompts across end-user chat products like ChatGPT, Claude, and Gemini. They publish aggregate reports on this as part of their own content marketing strategy, which do seem to provide credible hints as to otherwise invisible design changes to those products.
Their own tracking shows a notable change aligned with the GPT-5.6 rollout earlier this month:
> The percentage of all ChatGPT Search fanout queries that contain the site:operator, per day. The share hovered between 0.3% and 0.5% for weeks, dipped briefly to 0.15% on August 3 to 5 (consistent with a staged rollout or pre-launch experiment), then jumped to 16-17% on August 8.
It's important to note that these figures only reflect the prompts for which they have automated tracking enabled.
This corresponds to OpenAI's somewhat vague [August 6th announcement](https://openai.com/index/improving-gpt-5-6-sol-in-chatgpt/):
> For Plus and Pro users, we’re updating GPT‑5.6 Sol in Chat to be more reliable with facts and provide more focused answers.
Once again I am hampered by OpenAI's decision to actively obscure their system prompts, but from poking at ChatGPT I believe their latest search tool has a shape like `search(query, recency, domains)` rather than encouraging a `site:` operator directly.
In [a follow-up](https://promptwatch.com/data/reddit-citations-are-dropping-in-chatgpt) on August 18th Promptwatch reported that ChatGPT appeared to have greatly reduced the likelihood of Reddit being used in those searches. My own attempts to ascertain if the system prompt has been updated to discourage Reddit sourcing have been unsuccessful - the [most thorough leaked system prompt](https://github.com/asgeirtj/system_prompts_leaks/commits/main/OpenAI) collection I know of doesn't yet show any relevant changes. |
2026-08-20 23:57:32+00:00 |
| Mojo🔥 is now open source |
https://www.modular.com/blog/mojo-open-source |
The Mojo programming language has been promising an open source release [since May 2023](https://simonwillison.net/2023/May/4/mojo/). Last week they [shipped their 1.0](https://www.modular.com/blog/modular-26-5-mojo-1-0-is-here) and today they have followed through on that original promise, releasing the compiler and toolchain under an Apache 2 license.
When Mojo first launched the stated goal was to produce a superset of Python, so existing Python code could be used to bootstrap their own ecosystem. That plan changed [around August 2025](https://forum.modular.com/t/mojo-vision-document-and-roadmap/2187):
> Mojo may or may not evolve into a full superset of Python, and it’s okay if it doesn’t.
>
> We’re encouraged by how well AI-assisted coding tools already help migrate Python to Mojo today, and we’re confident that future tooling and ecosystem maturity will make this evolution even smoother.
Today Mojo is its own language, optimized to make GPU programming as painless as possible using syntax inspired by Python, if not 100% compatible with existing code. |
2026-08-18 21:39:20+00:00 |