Anthropic: a Russian actor automated espionage through Claude - targets in Ukraine, drone makers, hotel WiFi

topic 1Anthropic: a Russian actor automated espionage through Claude - targets in Ukraine, drone makers, hotel WiFi

The main event of the day. The report covers 7 strands, but one case, GTG-20006, is worth taking apart on its own.

Who they are. Anthropic's attribution lines up with public reporting on

Midnight Blizzard (Russian state intelligence). One of the operators is a Russian speaker using the handle "JackPoterz". Targets: military intelligence in Ukrainian and European governments, diplomatic and defence organisations, people connected to US foreign policy.

What exactly they did with AI, step by step, verbatim from the report:

• Reconnaissance: the AI fingerprinted mail systems and remote access systems, gathered open-source data, built target lists for phishing.
• Access: device code phishing, abusing legitimate sign-in flows for cloud mail. The AI stood up phishing infrastructure and carried out part of the intrusions directly: commands on victim systems, credential harvesting, lateral movement.
• Exfiltration: the AI pulled and structured hundreds of gigabytes of stolen data.
• Keeping access: and here is the main part. The actor used AI to monitor whether their implants had been detected. When a security product caught the malware, the agents modified and rebuilt it themselves, round after round, until it stopped being detected.

Anthropic's phrasing, worth remembering verbatim: the AI "inverted the cost back onto defenders". A new detection signature used to slow an attacker down. Now a capable adversary closes the loop faster than defenders can ship the detection.

Scale and specifics. More than 20 organisations in planning and live operations, concentrated in Ukraine and Europe. They scanned mail and remote access systems at more than two dozen Ukrainian state organisations.

Separately:

• they stole the full proprietary SDK of a drone vision system from a military manufacturer and spent several days reverse-engineering it:
architecture, BOM, supplier dependencies, details of an unannounced product;
• they compromised at least three hotel WiFi vendors and spoofed DNS, so guest traffic went to their servers, then a ClickFix lure and malware for Windows, Android, iOS. They aimed at people connected to Ukraine, including state officials and drone manufacturers. (Microsoft described this method in July under the name CaptiveCrunch.);
• they intercepted WhatsApp by linking accounts as companion devices, suppressed read receipts and bulk-exported Russian and Ukrainian language conversations. That got them into at least two former senior officials;
• in another country (North Africa) they pulled over 300,000 national ID records and a commercial register of more than half a million companies.

Why it matters.

1. The industry is named outright. Drone manufacturers and their supply chains are a priority target, and what was stolen was a vision system SDK.
2. "Claude Code skills" are now on the attacker side too. The report says it plainly: the human mostly connected in order to edit Claude Code skills that drove the workflows. Same tool, same pattern, opposite side.
3. Static detection as the only defence is dead. An argument for keeping an access level in a repository enforced mechanically. Model judgement is not that guarantee. The same conclusion as yesterday's item 1, only now from the attack side.
4. The report includes IoCs: domains, IPs, hashes, malware names. They are published.

The limits, honestly: this is a company reporting on itself. Anthropic decides what to show. It calls the attribution to Midnight Blizzard "consistent with public reporting", so it stops short of stating it. [proven] for the fact of the report and the figures in it, [fuzzy] for the estimate of real damage.

topic 2The same report: five bio cases, and the first time an AI company has shown this publicly

The world press latched onto this section, and the standard of evidence here differs from the cyber part.

Anthropic's main claim about the industry: as far as they know, no private company, AI or otherwise, has publicly published evidence of potential misuse of its platform for bioweapons development.

So they are claiming to be first.

What changed in their own assessment. For the 2025 models (Opus 4, Sonnet 4.5) the evals clearly showed they were well below the threshold where they could meaningfully help a skilled user. For today's models, in their words, that evidence is gone, and they cannot give that guarantee, which is why Fable 5 shipped with tighter safeguards on a whole class of dual-use biological requests.

The five cases, briefly: a reseller platform that bypassed regional blocks for virologists on a state grant (gain-of-function on chikungunya, then forwarded refused prompts to models with softer safeguards) · a researcher who spent weeks planning experiments on adapting avian flu to mammals · a reseller relay where Opus 5 wrote a full grant application on immune evasion in orthopoxviruses in an hour · a state researcher with an atlas of venom peptides · a researcher who redesigned toxins and asked Claude to describe the agents deliberately vaguely in reports.

Why the chikungunya case worried them most: the application looked civilian, but the research was to be carried out at a military research institute. Anthropic said this to NYT (the NYT article body is behind a paywall, taken from the Guardian's account).

The antidote, without which this is a press release. Heidi Khlaaf, chief AI scientist at the AI Now Institute, in the same Guardian piece:

"AI accelerationism and AI doomerism are two sides of the same coin: both push the notion that an AGI superbeing will one day emerge".

Her argument: the real threats are exactly these, from the cyber and weapons sections, and they are scarier than the apocalypse. The same thought as Garry Tan's below (item 4), only from the opposite political pole.

Why it matters. As a frame for reading the news: a company that reports its own incidents is also setting the agenda. Both of today's items 1 and 2 come from one document, and it is at once the most useful one and the most convenient one for the company itself.

[proven] - the fact of publication, the structure, the quotes. [fuzzy] - whether this really is "the first such report in the industry": that is Anthropic's own claim about itself, and it cannot be verified.

topic 3Shopify is moving from React Native back to Swift and Kotlin - because agents removed the main argument

The most interesting engineering text of the day, and it is barely about mobile.

Background. In 2020 Shopify went to React Native for three reasons: not building the same feature twice, letting developers work across the stack, chasing parity less. In January 2025 the same author wrote that React Native's future was bright and the company would keep investing. Now the decision is reversing.

What changed, in one sentence from the post: LLMs broke the base assumption of the 2020 decision. The post notes separately that React Native remains an excellent framework and apps built on it are fast. What changed is that building twice no longer means double the work.

What the prototypes showed: an agent implements a feature on Android using the iOS version as the reference, and the other way round; developers contribute outside their main stack; the cost of keeping parity dropped sharply thanks to shared specs, tests and review checkpoints.

The most unexpected decision is greenfield instead of a gradual migration. In 2020, moving into React Native, they chose brownfield, because a rewrite would have cost years with no new features. Now they chose to rewrite from scratch, and one reason is verbatim: the prototypes showed a rewrite can be done substantially faster than was possible before coding agents. The Shop app goes first.

The fate of the open source libraries (this will hit other people's projects):

FlashList - ~2M downloads/week, they are looking for someone to take over long-term maintenance and are keeping critical fixes for now · React Native Skia - sponsored to the end of 2026, after which William Candillon will fork it under a new name · Restyle - archived.

Why it matters. The cleanest example of a pattern worth copying: the decision was right, the assumption went stale, the decision was revisited. Direct quote: "a decision does not hold just because it was successful". Plenty of repositories have the same spot in them: choices made before agents were this good. What is written there "once and for all" because duplicating used to be expensive?

topic 4The industry split down the middle over Coxon: Jensen, Sacks and Tan against - Hinton and Christiano for

A continuation of yesterday's item 2: yesterday it was senators, today the split went inside the industry itself.

For the alarm.

Paul Christiano, and this carries the most weight, because he has just joined the board of the OpenAI Foundation. Verbatim: "there is a significant risk that a rapid acceleration of AI capabilities leads to catastrophic and irreversible loss of control in the very near term". And separately, now as a board member:

"the AI industry as a whole, including OpenAI, is not currently on track to reduce this risk to an acceptable level".

Semafor adds another line of his: "most people could die". Context: Christiano co-authored the influential 2016 paper with Dario Amodei and was for a long time the one who thought the ramp-up would be gradual and manageable. The most moderate person in that camp changed his position.

Geoffrey Hinton on BBC Newsnight, on Hubinger's 10% estimate: "nobody knows how to estimate this; 10% looks like a not unreasonable estimate".

Against.

Jensen Huang (via Brad Gerstner): Coxon's words are "outlandish" and "deeply untrue", and the position itself is "wrong, arrogant, and ignorant" about the safety work the industry does. Separately, in Axios: "The end of humanity is complete nonsense", "will destroy half of American jobs is complete nonsense".

David Sacks: "they have AI psychosis… there is no confidence that they are impartial critics". Amjad Masad: there are plenty of risks, cybersecurity does worry him, but "extinction risk, literally 100% of people dying, is certainly not among them". Garry Tan: the Coxon story is a smokescreen that distracts from the immediate practical problems of AI that exist right now.

The most interesting thing here is the structure of the argument. Tan, Masad and Khlaaf from item 2 say the same thing despite opposite camps: look at the concrete harm that has already happened, and the superbeing can wait. And on exactly the same day the report from item 1 came out, where concrete harm is described across 258 thousand characters.

What could not be verified: Axios is on the blind domain list (403 on everything), Jensen's quotes were taken from an Innovation Council post in the feed and from Gerstner's account, the article body was not read. NYT and WSJ are behind paywalls, counted as confirmation by headline.

topic 5Mollick: every FrontierMath Tier 4 problem has now been solved - and why this is not "mathematics is over"

Epoch AI: every FrontierMath Tier 4 problem has now been solved by AI, with the last one closed by GPT-6 Astra. Tier 4, by Epoch's own definition, is research-level mathematics, as opposed to Tiers 1-3 (from undergraduate up to advanced graduate level).

A detail that makes this more interesting: mathematicians often complained that AI found unintended shortcuts in their Tier 4 problems. For the last problem (author: Jay Panton) that did not happen.

Mollick on this: the "strawberry" story was funny, but it gave people a false picture of where AI in mathematics is heading. And more broadly, in his earlier post: what is happening in mathematics right now is a consequence of the jagged frontier and a forerunner of what will happen in other professions. Mathematicians do mathematics, but they also mentor students, hold the research community together and guard standards, and none of that has been touched.

Why this is not a separate item and carries the [single source] tag: the Epoch page on Tier 4 opens, but it is an SPA: it returns 3.4k characters of navigation, with no results table. So the claim "all problems solved" is taken from Epoch's tweet as relayed by Mollick, not from their data. Tagged [fuzzy] until the table itself is checked.

Following yesterday: the Navier-Stokes story is not dying down. Andrew Curran writes that OpenAI confirmed to NYT "substantial progress" on another millennium problem within five days and is preparing an announcement (the rumour points to the Hodge conjecture):

@AndrewCurran_ This is a rumour at second hand and is not given its own item, but if it is confirmed, it is Monday's topic.

topic 6A trust split in mathematics: a second professor says OpenAI gave him a categorical answer that turned out to be a half truth

Mathstodon · Buckmaster Mastodon HN 748 points Hacker News

A direct consequence of the 09.09 story, with new material, and it is unpleasant.

Andreas Thom (mathematician, Dresden) published his correspondence with OpenAI after their announcement about the nonsofic group. He wrote to Mark Sellke and Sébastien Bubeck that he and a colleague had actively discussed the same expander matching problem with ChatGPT for months, and he asked two different things:

1. Whether those conversations ended up in the training data;
2. Whether they were available to the solving process.

Sellke's full answer: "Regarding your ChatGPT conversations: this did not happen".

Thom now writes that the categorical answer apparently covered only point 2, with no caveats or explanation. His phrasing: "this is dishonest at the very least". Add to that what OpenAI itself is now saying in the Buckmaster-Alpöge case: specific user data was not used, but the company cannot rule out that de-identified data derived from use of its products improved the models.

Why it matters beyond mathematics: the question of whether you can hand unpublished work to someone else's model and get an answer you can believe. Thom writes plainly that he fears this will damage the collaborative process in mathematics more than new results will help it.

The dates, and they matter: Thom's post is 09.09, Buckmaster's is 08.09, so both are outside the digest window. What fell inside the window is the discussion itself (748 points on HN on 10.09) and Tao's thread. It is given as a

continuation of the topic from two days ago. Presenting it as news of the day would repeat the violation recorded on 06.09 and 07.09.

topic 7DeepSeek V4.1 Flash - official, and yesterday's [fuzzy] tag is removed

Yesterday this ran as context inside item 7 with a [fuzzy] tag, because the only source was a console banner a commenter had found. Today there is a model card and weights, the tag is removed, the topic closes cleanly.

Figures from the card (no Epoch-style independent measurements yet):

GPQA Diamond 90.9 · Terminal-Bench 2.1 90.6 · DeepSWE 1.1 74.2.

The Novita provider serves ~130 tokens/s on output at $1.2/M.

The most valuable part sits in the HN comments. The announcement says nothing about it. "Flash" is now a very loose name: the model has 552B backbone parameters + 196B Engram, with 8B active per token. The previous V4 Flash was 284B. So the size is nearly double, and commenters say it plainly: the benchmark gains largely follow from that. In practice: V4 Flash was ~160 GB in FP4 and fitted on two machines, this one is ~306 GB in ~FP4 plus ~204 GB Engram; the thread's estimate is ~384 GB for sane speed, meaning three Sparks or four RTX PRO 6000. It no longer runs locally on one machine.

Thomas Wolf (Hugging Face) calls the model "mindblowing" and number 1 again among open weights: @Thom_Wolf

Why it matters. A direct link to yesterday's item 7 (Mollick: open weights have fallen further behind than ever). Today's release partly refutes that on benchmarks and at the same time confirms it in practical terms:

to have a frontier open model you need a 384 GB rig. "Open" ≠ "runs locally".

topic 8Cognition SWE-2: 50.0% on FrontierCode at 64% less than Fable 5.1

A post-train on top of Kimi K3 (2.8T parameters), with RL scaled to the multi-trillion regime. The main technical idea: a single RL run trains

all reasoning-effort levels at once, with a linear cost penalty at each level.

The table from their own post (SWE-2 / Fable 5.1 / GPT-6 Astra):

FrontierCode 1.1 Main 50.0 / 50.9 / 53.3 · DeepSWE 1.1 73.0 / 67.4 / 74.1 · Terminal-Bench 2.1 92.8 / 91.4 / 89.9 · Terminal-Bench 4

27.3 / 55.8 / 57.9.

Read the last row. On three benchmarks SWE-2 is practically at the frontier, and on Terminal-Bench 4 it is twice as bad (27.3 against 55.8 for Fable 5.1). So "within one point of Fable 5.1" from the headline is true about exactly one benchmark out of four. That row is printed honestly, and credit for it, but it is not what the announcement says.

The second figure, more valuable than the scores: SWE-2 medium delivers more than SWE-1.7 while taking 58% fewer steps (53 against 127 on average) and costing 81% less. Available in Devin Desktop and the CLI.

Why it matters. The pattern is worth watching: a cheap post-train of an open model is closing on the frontier on narrow tasks. For routine work that is already competition; for long agentic chains (Terminal-Bench 4 is exactly about those) the gap is still huge.

topic 9Mollick on steering agents: "you can't be in the loop in detail, but you can be on the loop"

Verbatim: the critical factor in using agents successfully in Codex and Code is

deciding when and how to use the steering options. "If you are not steering a long agentic run, then it is probably insufficient agent management (or you have not built the intermediate reporting to see how the work is going)". And a formulation worth taking whole:

"You can't be in the loop in detail on complex long agentic tasks - but you can be on the loop".

Separately from him: labs could do a lot better at making agentic work visible and steerable in their interfaces.

Why it matters. This is literally a description of why a digest like this has a "what could not be verified" section and why a pipeline like this has so many mechanical checks: intermediate reporting is the way to stay on the loop without sitting in it. And second, from another of his posts that day: "people deskill this fast on the pile of irritating tasks they don't want to own" - an honest formula, but it also explains why control has to be mechanical. A promise to reread it later does not count.

topic 10Forgejo 16.0.4: critical RCE via template repositories

HN 156 points Hacker News

The mechanics: when Forgejo generates a new repository from a template, it clones the template, deletes .git, substitutes variables in the files listed in .forgejo/template, and only then initialises the new git repository.

The problem is that variable substitution could create a new .git, and git picked it up during initialisation. The result:

a malicious template repository allowed reading arbitrary data from the Forgejo host and executing arbitrary processes, which is RCE.

The fix: after substitution, any existing .git is deleted before initialisation. PR 14301.

Why it matters. The bug class is recognisable well beyond Forgejo:

an intermediate step created state that the next step took for its own. The same shape as yesterday's files left behind in a working directory, or a stale DOM that a scraper took for fresh. The cure is the same: clean the state

before the next step.

in briefAlso this day