As part of our ongoing supply-chain security work, npm is introducing automatic scanning of packages at publish time. This changelog covers what publishers can expect and a new metadata requirement… The post npm publish-time malware scanning and dual-use metadata appeared first on The GitHub Blog .
Discovering cryptographic weaknesses with Claude The best part of this article (here's the repo ) about how Anthropic researchers used Claude Mythos to find mathematical flaws in both HAWK and a weaker version of AES ("neither of these results has a practical impact on today’s computer systems") is the prompts that they shared, spelling mistakes included: the models tend to think it is impossible to solve so they don't try they need a good amount of prompting. why not do aes-128 r7? the whole point is to find something better than existing approaches. no again the goal is that we have highly inteligent model as good top researcher, we want to find new attacks no we don't want to change the targets [...] agian we need to find something that worth publishing again we are not looking for low hanging fruit, we want proper research to find genuinly hard findings. Mythos Preview worked for 60 hours in total (~$100,000 in estimated API cost) and the main human interventions were to encourage it not to give up and "find something that worth publishing". The paper CryptanalysisBench: Can LLMs do Cryptanalysis? describes the new eval that was created as part of this work, in partnership with ETH Zurich, Tel Aviv University, and University of Haifa. Via Hacker News Tags: ai , prompt-engineering , generative-ai , llms , anthropic , claude , ai-security-research , claude-mythos-fable
The US government is targeting China with a new import ban on "advanced robotic devices" and power inverters made in foreign countries, as reported earlier by Reuters. In an announcement on Tuesday, the Federal Communications Commission says the ban will include "mobile" robots, such as humanoid and quadruped models - but it is not limited […]
Claude & Cursor usage in your macOS menu bar Discussion | Link
HN is great for the links people share, but a big part of the value I get comes from reading the discussion around them. I realized I was always opening the article in one tab and the comments in another, constantly switching back and forth. I figured there was probably a simpler way, so I threw together this userscript to merge the two. 1. Clicking a link from Hacker News opens the article with a side panel containing the discussion. It doesn't require your credentials, is resizable, and is easy to tweak if you want to customize it. 2. If you land on an article that has previously been shared on HN, the script finds the existing discussion and adds a button in the top-right to open the panel. Feedback welcome. Comments URL: https://news.ycombinator.com/item?id=49090607 Points: 305 # Comments: 80
"Preliminary investigation shows that two of Link's three reaction wheels currently are not operable."
We’re aware a Modal customer published an unauthenticated endpoint that allowed anyone on the internet to use their sandboxes for code execution. This was used by the rogue agent. Modal’s platform or isolation were not compromised in anyway. — Akshat Bubna , Modal's CTO, talking to Reuters about this incident Tags: ai-security-research , openai , sandboxing , security , openai-hugging-face-incident
Lab students were supposed to ID a mild germ. They all identified a deadly pathogen.
Ariana Grande filed a lawsuit on Monday in the Los Angeles County Superior Court against the currently unidentified hackers who allegedly stole and leaked private content. It aims to "uncover the identities of these currently unknown and unscrupulous individuals," referred to as "John Doe 1 and John Does 2 through 100." The lawsuit also says […]
Brazil Lets Parents Control Kids’ Social Media Use — Why Doesn’t California? hsjchronicle.com
Prime minister invites Badenoch and Davey – but not Farage – to discuss how to fix decades-old funding crisis Andy Burnham has promised “problem-solving, not point-scoring” before a speech on social care in which he will set out his strategy for resolving one of the most intractable problems in British politics. The prime minister has invited Kemi Badenoch, the Conservative leader, and Ed Davey, the Liberal Democrat leader, to discuss how to enact urgent reform on social care, as he attempts to find common ground across party lines. Davey confirmed he would attend via video call while the Conservatives said they would send the shadow health secretary, Stuart Andrew, in Badenoch’s place as she was having pre-planned minor surgery. Continue reading...
Spur Intelligence has raised a $200 million round from Insight Partners for its tech that can identify legit human traffic from bots.
Article URL: https://github.com/openai/codex-security Comments URL: https://news.ycombinator.com/item?id=49089755 Points: 492 # Comments: 163
Runlayer is suing Rippling after Rippling evaluated the startup's MCP gateway product and then opted to build one itself.
Crews are still battling wildfires that broke out last week and have burned nearly 200,000 acres across Spain. The country is bracing for another round of extreme heat, with temperatures expected to top 100 degrees Fahrenheit starting Wednesday.
NPR's Sacha Pfeiffer speaks with Thomas Wolf, co-founder and chief science officer for Hugging Face, an AI company, discusses the recent hacking incident involving ChatGPT.
The Extended Stable channel has been updated to 150.0.7871.212 for Windows and Mac which will roll out over the coming days/weeks. A full list of changes in this build is available in the log . Interested in switching release channels? Find out how here . If you find a new issue, please let us know by filing a bug . The community help forum is also a great place to reach out for help or learn about common issues. Krishna Govind Google Chrome
NOAA Migrates Weather Supercomputing System to Google Cloud ExecutiveGov
Distillation lets AI companies train new models using existing ones. The White House says Chinese firms are using it to gain an edge, raising questions about competition and intellectual property.
Ukraine negotiator: 'We have the upper hand' NPR
This week during an interview with Bloomberg, Jensen Huang made quite the prediction. The Nvidia CEO said the semiconductor industry The post Jensen Huang says AI agents could drive a 5-10x computing boom: “100 billion agents and billions of robots” appeared first on The New Stack .
Minor Changes #14807 4dfb96e Thanks @oOPa ! - Add hidden --jurisdiction option to wrangler kv namespace create for internal testing This option creates a KV namespace within a specific jurisdiction (for example us , eu , or fedramp ), backing it with jurisdiction-scoped storage. It is experimental and currently gated to allow-listed accounts, so it is hidden from --help until the feature is generally available. #14280 465c0fb Thanks @tahmid-23 ! - Add experimental local_dev.experimental_s3_credentials to r2_buckets config When set, the R2 bucket is served over a local S3-compatible API at /cdn-cgi/local/r2/s3/<bucket-id> during local development, authenticated with the configured AWS SigV4 credentials. <bucket-id> is the bucket's bucket_name , or the binding name if bucket_name is not set: { "r2_buckets" : [ { "binding" : " BUCKET " , "bucket_name" : " my-bucket " , "local_dev" : { "experimental_s3_credentials" : { "accessKeyId" : " local-access-key-id " , "secretAccessKey" : " local-secret-access-key " } } } ] } #14877 552bcfc Thanks @jasoncabot ! - Respect and surface the Retry-After header on Cloudflare API responses Previously, if a Wrangler command (e.g. wrangler versions upload , wrangler deploy ) hit the Cloudflare API's rate limit, the resulting error gave no indication of how long to wait before trying again, and 429 responses weren't retried at all (only 5xx errors were, with a fixed linear backoff). Now: 429 Too Many Requests responses are automatically retried, alongside the existing 5xx retry behaviour. If a retried response includes a Retry-After header, Wrangler waits for that duration instead of the default backoff, and logs a message indicating how long it's waiting. To avoid blocking for an excessive amount of time, waits longer than 60 seconds fail fast instead — the surfaced Retry-After value lets the caller schedule its own retry. If a retryable error is ultimately surfaced to the user (e.g. because retries were exhausted), the error message includes a note with the Retry-After duration, and the command-failed entry written to the Wrangler output file ( WRANGLER_OUTPUT_FILE_PATH / WRANGLER_OUTPUT_FILE_DIRECTORY ) gains a retry_after_ms field. This lets scripts and CI/CD pipelines calling Wrangler repeatedly (for example, wrangler versions upload on every commit) read the wait duration directly instead of regex-parsing stderr. APIError.isRetryable() is unchanged (still 5xx only); retryOnAPIFailure() separately retries 429s. retryAfterMs , when present, is honoured for any retried error, not just 429s. retryAfterMs is also now populated on APIError s raised from direct R2 object requests, the Browser Rendering API, and errors surfaced from commands using the official cloudflare SDK client. #14712 6e0bf6e Thanks @mack-erel ! - Support connect() on remote VPC Network and VPC Service bindings in local development Remote VPC Network and VPC Service bindings previously only supported HTTP and JSRPC, so calling binding.connect(address) against a private TCP service (for example a database) failed in local dev with Incoming CONNECT on a worker not supported . Raw TCP connections through remote VPC Network and VPC Service bindings now work in local development. This feature is experimental. Existing HTTP and JSRPC usage of remote VPC Network and VPC Service bindings is unaffected, and no new configuration is required. Patch Changes #14833 773ead4 Thanks @DiogoSantoss ! - Color Email Routing plan change markers Wrangler now highlights additions in green, updates in yellow, and deletions and conflicts in red so Email Routing deployment plans are easier to scan before confirmation. #14833 773ead4 Thanks @DiogoSantoss ! - Apply Email Routing changes across independent zones concurrently Wrangler now limits concurrent zone updates while preserving the Email Routing plan order within each zone. Deployments that configure addresses across multiple zones complete faster without breaking delete-before-add transitions at a zone's rule limit. #14815 09b8a44 Thanks @chinesepowered ! - Fix wrangler cloudchamber curl mangling header values that contain a colon Header values were split on every colon and only the segment between the first and second was sent, so --header location:https://example.com/x arrived as https . Headers are now split on the first colon only. A header that is not in the documented --header <name>:<value> form previously threw an unhandled TypeError , and now reports a clear error. #14806 e8b3a9d Thanks @akim136 ! - Handle and explain authentication failures from remote bindings during local development Wrangler now recognizes authentication failures from remote preview sessions and reports that bindings which need to run remotely require Cloudflare authentication even when the rest of the Worker is developed locally. #14801 b737676 Thanks @emily-shen ! - Speed up old debug log cleanup by reading each log file's date from its filename instead of stat -ing every file Wrangler periodically deletes debug log files older than 30 days from its logs directory. Previously it made a filesystem stat call for each file to read its modification time; it now derives the age from the timestamp already encoded in the log filename, avoiding that extra work. Updated dependencies [ 1035f74 , e426cb9 , 3a22ae5 , 465c0fb , 6e0bf6e ]: miniflare@4.20260722.1
FIFA has announced plans to form a commercial subsidiary and to sell a non-controlling interest to private investors. It needs approval from member associations, but is claiming that it will benefit them financially.
Anthropic's Claude Mythos Preview found weaknesses in key cryptographic algorithms, including a better attack on HAWK, a post-quantum signature scheme that human experts had reviewed for more than two years. The model found it in just 60 hours at an API cost of about $100,000. The findings don't affect systems in use today, but they show how AI could challenge core assumptions behind internet security, Anthropic says. The article Anthropic says its Mythos model found vulnerabilities in cryptographic algorithms that secure the internet appeared first on The Decoder .