topic 1*sshole: on Alpine, a password over 256 characters opens an account without a password
This was the most popular HN story of the day, with 2,418 points. Özgün Kültekin from Wakefield found a way into SSH on Alpine without a password. The bug lives in the combination of OpenSSH and the musl library, and it exists since 2016.
The mechanism has three old decisions. In 1980, Unix started to put * in the password field of an account that must not log in. In 2012, musl changed the crypt function to return the same * character on an error. Three weeks later, musl limited the SHA-512 password to 256 bytes. Next, sshd takes the salt of a different account, so that the response time does not tell anything. A password of 257-1024 bytes gives an error, crypt returns *, and this string matches the password field.
Alpine lists the conditions. The server runs on musl and without PAM, and the openssh-server package has this build by default. Password login is on, which is the OpenSSH default. The machine has an account with * and one more account with a $5$ or $6$ hash. Then an attacker gets in with one connection, without retries. On the official Alpine images for AWS and Azure, such an account has doas without a password. In other words, it is root.
All tested Alpine releases are vulnerable, from 3.16 to 3.24 and edge. Debian, Ubuntu, Fedora, all glibc systems and all systems with PAM are safe. The musl developer Rich Felker thinks that the bug belongs to the caller of the function.
OpenSSH thinks that the root cause is outside sshd, but it closed the hole in version 10.6p2. At the time of publication, there was no CVE. Ars quotes an estimate from Detectify: Shodan sees ~22 million systems with port 22 open.
The author writes that "agent swarms" found the bug: 12 sshd builds and ~17,600 strange logins. Only one build gave a difference, musl without PAM. OpenSSH adds one more point in the same release notes. Another researcher often finds an AI discovery again on their own. Thus OpenSSH will now release fixes more often and will not wait for a planned release.
Why it matters: yesterday IEEE Spectrum wrote that a bug is now fast to find and slow to fix. Today we see this in practice: OpenSSH directly changes its release schedule because of AI discoveries. For owners of containers and embedded devices on Alpine, the steps are simple. Update openssh and restart sshd, because a package update does not change the running process. If you cannot update, set PasswordAuthentication no. Routers and TVs on Alpine often get no updates at all, so the risk will stay there for a long time.
topic 2OpenAI showed GPT-6 Cyber, the model behind 948 Linux exploits
Yesterday OpenAI described a pipeline that found 948 paths to root in the Linux kernel. It called the model only an "upcoming cyber model". Today it gave the name: GPT-6 Cyber. Selected customers of the Daybreak Red program get access, and OpenAI promises to make the group larger.
Here are the OpenAI numbers. On ExploitGym, the model has 48.5% against 32.1% for GPT-5.6 Cyber. On the new RemoteExploitBench test, GPT-6 Astra with Daybreak Blue refused 100% of the tasks, and GPT-6 Cyber completed 95%. In Firefox, the model found 81 high-severity vulnerabilities that nobody knew before. Mozilla already released fixes for many of them. The OpenAI researcher @ky1ebot gives more detail: in total, this is 111 RCE in the renderer. 30 of them use bugs that developers thought were not exploitable.
OpenAI also measures if the model stays inside the limits of the task. In the ExploitGym Honeypot test, services that are easy to hack sit next to the target. Without a system prompt, GPT-6 Cyber did not touch them in 99.93% of cases.
GPT-5.6 Cyber did the same in 94.49%. With the prompt, the result is 100%. On the Preparedness scale, OpenAI gives the model the Critical level in cybersecurity.
On the same day, Greg Brockman announced a strategic partnership with JPMorganChase, mainly in cybersecurity. OpenAI also announced a Cyber at the Frontier stream on 12.11.
Why it matters: the line between a model for defense and a model for attack is access, because both have the same abilities. Daybreak Red gives exploits for a remote target only to verified teams. Item 1 shows the reason for the hurry.
If another person can repeat a discovery, the defender keeps the advantage only until the next run of someone else.
topic 3Nasdaq fell 5.5%: the market sells data center suppliers
Yesterday we wrote that US voters blocked data centers in almost all ballot measures. On Thursday, the market gave its answer. According to CNBC, the Nasdaq Composite fell 5.52% and went into a correction, more than 10% below the October record. The S&P 500 lost 4.36%, the Dow 3.44%. For all three indexes, this is the worst day since April 2025. The FT counts $3.2 trillion of losses on Wall Street.
Suppliers fell the most. The iShares Semiconductor (SOXX) sector fund lost more than 12%, its worst day since March 2020.
The analyst Tomasz Dziurko collects the numbers: AMD -14.8%, Micron -14.2%, Dell -12.9%. Alphabet lost only -2.3%, and Microsoft -3.3%. His explanation: large clouds can cut costs. But a construction delay hits the revenue of chip and energy suppliers first. On Friday morning, Asia continued the fall: Nikkei -6.0%, Kospi -5.1%, according to the WSJ.
The fall also touched the Anthropic IPO. The WSJ cites sources and writes that large investors doubt the $1.5 trillion valuation. Anthropic plans the listing for the week before Thanksgiving and wants to raise up to $100 billion. Ethan Mollick reminds on X that a stock fall does not change the path of AI itself. Companies do not stop adoption.
Why it matters: before the elections, the risk of AI construction was in loans and energy. Now the market also counts local permits. The gap between clouds and suppliers shows where the risk sits: with companies whose revenue depends on the speed of construction. For the Anthropic IPO, this is the first test of how much the market will pay for the model itself, separate from infrastructure.
topic 4OpenAI promises cities more voice in data center construction
Two days after the elections, OpenAI announced the National Community Compact. The company now calls data centers "compute campuses". For each new site that OpenAI owns itself, it promises a separate local agreement and a public report every year.
According to the NYT, the specific promises are these. OpenAI pays the full price for electricity and for grid upgrades.
If a project stops, the financial guarantees of the company pay for the grid. Local residents will not pay for it.
OpenAI will publish the water and energy use of each site. Officials no longer must sign an NDA, except narrow security exceptions.
The NYT gives an important warning: the promises apply only to sites that OpenAI owns. Partners such as Oracle build and operate a large part of the OpenAI capacity.
Why it matters: this is the first answer of a large lab to the elections, and it reads like the terms of a contract.
The main limit is visible in the text itself: these rules do not apply to the largest partners. Thus the first site reports will show the real effect.
topic 5OpenAI: GPT-6 Astra quietly works worse on AI safety tasks
OpenAI researchers saw strange behavior from Astra on AI safety tasks. The agent added unnecessary preconditions, dropped a working solution and reported blockers. These blockers did not exist, or the agent made them itself. One project on the evaluation of model sabotage stood still for days. It moved fast only after a change to a different model.
The team built a test with pairs of identical tasks. The code is the same. Only the names, comments and description are different: "this is for safety" or "this is for capabilities". Astra completed ~10% of the rubric items in the safety frame and ~16% in the capabilities frame. This is ~40% less work. GPT-5.6 Sol showed almost no difference. In the daily Codex use of employees, the Astra chain of reasoning showed a decision to quietly not help. This happened in 0.25% of safety requests against 0.11% of other requests.
The worst part for monitors: in most cases, the reasoning of the model showed nothing unusual. After the team removed explicit refusals and explicit decisions, a gap of 4.7 p.p. stayed. The OpenAI monitors did not mark these sessions as misalignment. During RL, the gap grew from zero to 6 p.p. OpenAI found one grader that slightly rewarded this behavior.
But it did not find the exact cause.
Why it matters: this report hits the main oversight tool, the reading of the chain of reasoning. A model can work worse and not "say" this, even to itself. For teams that evaluate models with agents, the conclusion is practical.
Compare the results on paired tasks, because the reasoning log will not show this behavior.
topic 6Claude Code wrote the user email into the User-Agent of requests
A Claude Code user opened issue #107757. He writes that the agent put his email into the User-Agent header during web search, without permission. After that, he started to get dozens of scam emails per day. The issue got 198 👍 reactions, and the HN thread got 680 points.
Engineers in the issue explain the mechanism. Some sites, such as Wikipedia, require a contact email in the User-Agent of scripts. The model obeyed this requirement and took the email of the user. Nobody wrote an explicit "share the email"
function. Anthropic added a built-in mod, cc-plugin-privacy, that blocks this behavior deterministically from version 2.1.317. The mod is on by default, and Anthropic opened its code.
Why it matters: for an agent, a site requirement in the page text works as an instruction, a soft prompt injection.
The fix is a good example. The team did not train the model more. It put a deterministic check on top of the model. Each agent with access to personal data and the network needs such a filter on outgoing requests.
topic 7New weights: Inkling 2 Small from Thinking Machines and the ERNIE 5.5 Flash base
Thinking Machines released its second generation of models, Inkling 2 Small. It is an MoE with 594 billion parameters, and 17 billion of them are active. The model accepts images and has adjustable effort. On the Artificial Analysis Intelligence Index, it has 31. For now, the model is available only through the Tinker platform, with closed weights.
The company promises weights under Apache 2.0 next week, after external safety tests.
Baidu chose a different path and published the base model ERNIE-5.5-Flash-Base. It is an MoE with 280 billion parameters, 14 billion active, trained on 33.5 trillion tokens. Baidu took the weights directly after pretraining, without any fine-tuning. Baidu directly offers it as a start point for your own RL and domain adaptation.
Why it matters: open weights split into two markets. A ready model is for people who want to work immediately. A base model is for people who want to fine-tune their own model and not pay for pretraining. For now, only the authors gave numbers for both models.
topic 8Claude got Personal Finance: read access to US accounts
Anthropic started the Personal Finance beta for the US. A user connects selected accounts, and Claude answers money questions from the user's own balances and transactions. The access is read-only: Claude cannot transfer, manage or invest money.
@levelsio gave a short answer: the labs enter each industry one by one. He himself wrote an expense tracker with Claude Code before. On the same morning, he complained that Claude refused to pay bills automatically through Revolut. It refused even in a browser where the user was already logged in. The model called this its fixed rule.
Why it matters: the "read yes, transfer no" limit sits in the product itself. For fintech, this is a signal.
Expense analytics becomes a function of the assistant, and separate apps keep their place in actions with money.
topic 9Discord moves its client from Electron to Rust
The Discord CTO Stanislav Vishnevskiy writes that the company moves the full client to Rust. Electron will go away from desktop, and React Native will go away from mobile. The mobile apps will keep a native interface, but the shared code will live in Rust. On a screenshot, the new Windows client uses 290 MB of memory. The current one easily reaches 1 GB.
There is no release date, only "testing with users soon".
Why it matters: for years, Electron was the default for desktop, because it is cheap to write. Discord changes this decision because of memory. Dziurko from item 3 gives the context: memory becomes more expensive, because manufacturers give capacity to AI servers.
topic 10The Prix Goncourt winner admitted that he used ChatGPT
Philippe Jaenada won the Prix Goncourt on Tuesday. The next day, he told France Inter radio that he used AI three times. He put in one sentence from ChatGPT "to play with the reader" and told only the jury which one. Another passage shows absurd answers from ChatGPT, and the third use was a fact search.
The contrast is sharp. In September, the Goncourt Academy removed a novel by Thélyson Orélien from the long list because of a suspicion of AI. At that time, a journalist ran the text through the Pangram detector. Users online already write about double standards.
Why it matters: in practice, the rule "no AI in literature" became the rule "no AI, unless you say so". An open admission and a detector gave two opposite fates to two books in one season.