topic 1Claude Code writes passwords from commands to a file, and the file goes to GitHub
The mechanism is simple. The agent proposes a command, for example a database query, and the command contains a password from a config file. The user clicks "Yes, and don't ask again". Claude Code saves this command word for word, with the password, as a permission rule in .claude/settings.local.json in the project folder.
Claude Code adds this file to the global gitignore of the developer, but only when it creates the file inside a git repo. A folder that becomes a repo later, a clone on another machine or a file that is already in a commit stay without protection. The rule never goes into the .gitignore of the repo itself.
Apiiro examined all 104,185 public copies of this file on GitHub. 1,122 files contain a real secret: database passwords, Supabase, AWS, npm and GitHub keys, 43 SSH logins. With git history, shared settings.json files and agent transcripts, the total is 2,539 secrets in 1,994 repos. In 539 of 1,105 repos, a commit with Claude as co-author changed the file.
Scanners find this badly. gitleaks found 564 of the 1,122 files, TruffleHog found 643, and 215 files stayed hidden from both. The cause: a password after PGPASSWORD= or sshpass -p has no known key format. Users reported the mechanism in GitHub issues since August 2025, and Anthropic gave no reply there.
Why it matters: the "do not ask again" button turns a one-time permission into a permanent record on disk. The practical protection is short. Add .claude/settings.local.json to the .gitignore of each repo, pass secrets as environment variables and allow command patterns instead of literal strings. If the file was ever in a commit, rotate the keys: removal of the file does not clean the history and the forks.
topic 2MaxxBench: small requirement changes move "equal" models 23 points apart
The brothers Gavin and Justin Lo took 89 tasks from DeepSWE and changed one small detail in each. For example, report file names must now be lowercase, and the API must return time in UTC. The median reference patch grew by only 17 lines, or 3.5%.
The result is strong. Claude Opus 5.5 and Gemini 3.8 Flash both score about 74% on DeepSWE. On MaxxBench, Opus 5.5 scores 76.4% and Gemini 3.8 Flash scores 53.4%. DeepSeek V4.1 Flash falls from 74.2% to 55.6%. The spread across 15 configurations grew from 20.9 to 48.3 points.
The authors also describe the behavior. A model understood the new requirement and then decided that the hidden tests wanted the old version. In one run, a model implemented the change correctly, asked another model for the original answer and removed its own correct code. The post by Justin Lo got more than 500 thousand views, and Garry Tan reposted it.
Why it matters: with time, a popular benchmark measures how well a model learned that benchmark. For the choice of a model for real work, a better test is the same task with a change that a reviewer would ask for. A 23-point gap between models with the same score weighs more than any row in a leaderboard.
topic 3Microsoft closed the AI Frontiers group, and its founder left
John Langford, a well-known machine learning theorist, wrote that AI Frontiers is over. Microsoft Research created the group of about 50 people in 2023. It made the Autogen framework, the Fara computer use agent and research on new architectures.
In early September, Microsoft moved the group into Microsoft AI. Langford says that the MAI leadership, which came from Inflection, bets on scale and "aggressively not research". He writes that MAI "just did not really want us". Langford left, and he says that every other founding leader of AIF made a similar decision. There will be no internships with this team next year.
He gives his argument with a number. ByteDance experiments show that a variant of his Full Bandwidth Transformer performs at the level of a model two times its size. That is half the cost of training and inference for the same quality.
Why it matters: large labs choose scale over research more often, because the return on scale is easier to plan.
Researchers who think otherwise now go to smaller teams. Where they go decides where the next compute savings come from.
topic 4Every Mac runs a knowledge graph about its owner and the owner's family
The researchers Dario Pasquini and Michał Bazyli examined two macOS daemons: knowledgeconstructiond and intelligenceplatformd. They run since macOS 13 (2022) and build a graph about the user. The official description is a few lines in a man page.
~/Library/IntelligencePlatform holds 51 SQLite databases in plain text. Only the Full Disk Access permission protects them. The main database, graph.db, has 181 entity classes and 278 relation types. The graph takes contacts, faces from Photos, the calendar, Family Sharing with the age of each family member, the emergency contact from Health and data from mail and messages.
The most interesting part: two XGBoost classifiers decide which contacts are family. They use 144 features, and most are behavioral: who the person messages and who appears with them in photos, by day of week and time of day. One feature has the name photosPersonPosteriorProbabilityGivenSaturdayNight. The authors released a local dashboard, iKnow, so that anyone can see their own graph.
Why it matters: personal AI needs context, and somebody must collect it. Here the OS collected it, without a separate consent from the people in the graph. For a risk estimate, one question is important: what happens if such a file gets into the wrong hands. The answer depends on one disk permission.
topic 5The Huang case: FT reports an intelligence memo, a senator promises an investigation
Yesterday's issue said that three House committees asked Jensen Huang to a closed briefing. Today the FT adds a detail. According to its sources, US officials this year wrote a memo based on intelligence data. The memo says that Huang had a romantic relationship with Alice Huang, an executive of the Singapore company Megaspeed.
US intelligence, the FT writes, believes that China's Ministry of State Security recruited Alice Huang. A few top officials got the memo before Trump flew to the summit with Xi Jinping. The White House and the CIA declined to comment. Nvidia does not comment on the memo and said before that Huang meets "thousands of customer executives every year".
Senator Chris Coons, who will chair the Senate foreign relations committee from January, promised an investigation.
The US already examines Megaspeed for possible smuggling of Nvidia chips into China. An internal Nvidia probe found no wrongdoing.
Why it matters: the story moved past export control and now concerns the personal security of the head of the most valuable AI company. Both chambers of Congress now have separate questions for Nvidia. Everything except the statement by Coons rests on anonymous FT sources.
topic 6Data centre construction hits the limits of power and water
In September, Thailand paused construction of 49 data centres and decisions on 117 more projects. Earlier in the year, the country approved projects from TikTok, Skyline and Bridge for $27 billion. In the Malaysian state of Johor, data centre capacity grew from 94 MW in 2023 to 1,110 MW in 2026. Wood Mackenzie estimates that data centres already use 24% of the state's power and can use 40% by 2035. In February, Johor saw its first protest against such construction.
In Scotland, DataVita promised to power a 1 GW campus near Glasgow from renewable sources. After questions from the Guardian, the company changed the plan: the campus will be "fully grid served". The project still has £202 million in public guarantees. On the same day, the FT quotes the UK growth minister: the country will not slow down on AI despite the backlash in the US.
Why it matters: the limits for AI are now physical: the grid, water and the consent of local communities.
Countries that competed for data centres a year ago now count who pays for the power. Claims of "green" energy in applications need the same check as numbers in benchmarks.
topic 7Practitioners remove extra safeguards: models are now better than the safeguards
Garry Tan writes that agent skills need an eval loop. Each new model is better, so teams can remove what they do not need. He removed his own /investigate skill, because Opus 5.5 does this work better without it.
Ethan Mollick thinks that the fear of factual errors from AI in everyday work is out of date. He says data on new models shows that they find facts and check claims better than human experts, PhD specialists included. In a separate post, he writes that LLMs can make investigative journalism 10 times faster. The taste for which story is interesting stays human for now.
Dex Horthy adds a technical detail: context compaction is much better now. For some tasks, it is no longer necessary to clear the context by hand for the quality of the model's work.
Why it matters: each safeguard has a cost, and with a new model some of them become unnecessary. An eval must confirm this. Item 1 shows the other side: a button removed the "ask before a command" safeguard, and the consequences stayed on disk.
topic 8Discord in Rust: the client starts at once and uses 70% less memory
Discord CTO Stanislav Vishnevskiy showed a 15-second video. The new Rust client and the current Electron client start side by side on two Windows 11 laptops. The new client shows the friends list before the old one leaves its loading screen. The new client uses 290.2 MB of memory with two accounts at once. Discord staff confirmed that both clients started from a cold start.
Why it matters: for years, Electron was a reasonable compromise: one code base for all platforms. Now a rewrite of a large client costs less, in part because of coding agents. Thus the argument "convenient for developers" becomes weaker against the argument "fast for users".
topic 9Unitree: people assemble the robots by hand, and the economics support it
The founder of KAIKAKU visited the Unitree factory in Hangzhou. The actuator building has one or two automated lines, and people do the rest of the work on old winding machines. The IPO prospectus calls the viral video of a humanoid on the assembly line a pilot and says that assembly is "currently mainly manual".
The prospectus numbers are simple. At the end of 2025, all Unitree machinery was worth about $1.7 million for almost 32,000 robots in the year, or about $50 of machinery per robot. Labour was 8% of the cost. Research and education gave three quarters of humanoid revenue in the first 9 months of 2025, and factories gave less than 5%.
Why it matters: humanoids are still bought mostly by labs. Automation of assembly saves little when labour is 8% of the cost. The real limit is the robot's "brain", and the Unitree CEO now puts his bet there.
topic 10Polymarket bets an hour before a New York Times poll
Researchers from Vanderbilt University found suspicious bets before two New York Times/Siena polls. On 31.10, one Polymarket user put $191,277 on a win for Senator Pete Ricketts in Nebraska. About an hour later, a poll came out with Ricketts 6 points ahead. The user made more than $77,000.
The same user put $622,608 on a win for the Democrat in Michigan, and the next day another poll showed such a lead.
The profit was more than $180,000. The researchers do not claim insider knowledge: the person could guess only the time of publication or hedge other positions.
Why it matters: prediction markets sell a "clean" probability, but any leak of information affects them. Any organization that publishes data on a schedule now has a separate risk: its schedule itself becomes trade information.