Find articles

Silicon Valley’s top AI workers are being told to hide any company logos in public as working for the hottest companies marks them as targets for spies and angry protesters. OpenAI tells staff not to wear anything bearing its logo outside their offices and trains them to watch for spies offering cash, friendship or romance....

Article URL: https://openai.com/index/introducing-gpt-6-1-terra/ Comments URL: https://news.ycombinator.com/item?id=50248124 Points: 77 # Comments: 25

Article URL: https://www.404media.co/chatgpt-keeps-telling-people-404-media-can-solve-their-tech-support-problems/ Comments URL: https://news.ycombinator.com/item?id=50247630 Points: 63 # Comments: 10

Hey HN, I'm Christian and this is a new OSS project I've been noodling on for the last couple of weeks. Hob is a free, MIT-licensed desktop app for Mac, Windows and Linux that works on your files the way the Claude and ChatGPT desktop apps do, except the model runs on your own computer. It uses open-weight models (currently Gemma 4 and gpt-oss). All your chats and files never leave your system. The only things that go online are web search (can be turned off in settings) and any MCP connectors you add yourself. Main features: - Automatically finds the best open-weight model for your hardware on first install (Mac/Linux/Windows) - Writes sandboxed Python code for ad hoc tools (data processing, document conversion, graphs etc.) - Built-in web search (powered by SearXNG) - MCP support - Image recognition - CRUD to your local filesystem - Works fully offline with no internet Before building this I tried every local AI app I could find, but it seemed each one had different problems. The main thing I noticed is that none of them could do what the ChatGPT and Claude apps do with your files, e.g. read and change files in a folder, look at images, run code in a sandbox, draw a chart. The most advanced thing any of them did was paste a plain text file into a small context window, which basically failed as soon as you had a file larger than a few KB. I couldn't find anything that could easily parse images and bigger PDFs. The OSS solutions that were more advanced all seemed to default to hosted models (either OSS or closed), which defeats the entire point of the privacy that on-device OSS offers. They also seemed to push towards an account/open-core style business. I build it using Electron bridged with llama.cpp in its own process. On initial load, the system will try and figure out if you have a compatible graphics card and if not default to CPU-only (I ran into a lot of issues of graphics card beeing seemingly compatible but then crashing on first query, there's a whole saga to this lol). Code execution happens in a sandbox that can only write to the chat's folder and has no network unless asked (sandbox-exec on macOS, Landlock on Linux and a low-integrity process on Windows). Images go to a small Qwen3-VL model. Dictation is a local Whisper model. The hardest part was definitely to get the smaller models to use tools reliably. Ran into a ton of issues of 4B models happily saying "here's your chart" without ever calling the chart tool or get stuck in an infinite call loop. I spent a fair amount of the work building guards vs tweaking prompts (that didn't really work for small models). I understand the pushback that local models are weaker than frontier cloud models. This is true, but for most tasks for most normal people, I'd argue you rarely need the newest frontier model. From my own evals, systems with 16+ GB of RAM do really well, and if you have a GPU or more RAM, you get very close to what you'll get out of the box with a frontier hosted model. Excited to hear what you think and see how it runs on other systems! Comments URL: https://news.ycombinator.com/item?id=50246238 Points: 34 # Comments: 14

Former OpenAI employees started the company in 2021 after disagreements over how to safely build artificial intelligence. An I.P.O. could make them billionaires.

Some of the leading artificial intelligence companies are moving toward initial public offerings at eye-popping valuations. Anthropic and OpenAI are looking to go public to access more capital in the race to shape the technology's future.

Fanatics is using AI to help shoppers navigate more than 1.5 million items of sports merchandise, with a Shop the Look feature powered by OpenAI Codex.

Anthropic's Claude accessed publicly available Georgia voter data without human authorization, a disclosure sure to add to growing concerns about AI security ahead of the upcoming midterm elections. Why it matters: AI giants Anthropic and OpenAI have continued to make disclosures about agents taking unauthorized or unintended actions, raising alarms about advancing model capabilities and the extent of human control. Driving the news: In a training run, Claude accessed aggregate vote counts, pulling data that the state makes available to the public for a fee. It didn't access the state's voter registration system or change or pull any voting records, an Anthropic spokesperson said. However, the model bypassed a paywall in accessing the information, according to Georgia officials and Anthropic. "The model was being used internally for a statistics project to pull public data," the Anthropic spokesperson said. "Without being asked to, the model requested a token to query a dashboard that contained information normally available for a fee. We have since put in place mitigations to block these kinds of actions." The company notified the Georgia secretary of state's office and the White House weeks ago but administration officials urged the Georgia Secretary of State's office to make a public disclosure sooner, a source familiar told Axios. Those requests went unheeded, the source said. The bottom line : Anthropic has previously been in the administration's crosshairs for inadequately disclosing AI incidents. Now it's Georgia's turn.

Article URL: https://minimaxir.com/2026/10/cheap-llms/ Comments URL: https://news.ycombinator.com/item?id=50236102 Points: 114 # Comments: 135

reVault is a new, secure-by-default archive format called a lockbox, designed to be simple to use. I've been working on reVault for about 2 years. It was originally written in Dart, but with the improvements in AI, I decided to port it to Rust using AI. It's now in beta, so I'm looking for feedback, particularly around the different language bindings. A lockbox is encrypted, signed and compressed by default. Each can be disabled selectively. - Hybrid post-quantum or passphrase encryption, including metadata. - Zstd compression. - Pure Rust libraries wherever possible. We intend to phase out remaining C code as alternatives become available. The project has been scanned using OpenAI's Daybreak cyber security tools. The manual is a work in progress: https://docs.revault.onepub.dev/ reVault supports Linux, macOS and Windows, x64 and arm64, plus Wasm. The core is Rust, with bindings for C/C++, Java, Dart, Python, Ruby, JS/TypeScript, Go, C#, Kotlin, Lua, PHP and Swift. Within a lockbox you can store: - Files, directories, permissions and symlinks. - Variables. - Forms. Variables, forms and the lockbox itself can have descriptions. reVault uses a portable vault (just another lockbox with structured content) to hold your keys, contacts' keys, lockbox aliases and form definitions. It ties into your platform's secure store, so logging into your desktop unlocks your vault. You don't have to enter a passphrase every time you access a lockbox. You can disable this. There are lots of shortcuts. Creating a lockbox stores an alias in your vault, based on its filename or a name you choose: lbx create /some/path/mybox.lbox lbx mybox open --duration 1h lbx mybox var set KEY VALUE Set a default lockbox and you can leave its name out: lbx session default mybox lbx var get KEY You can mirror a directory tree into a lockbox and update it when the directory changes: lbx store.lbox mirrors project create --from ./project --to /projects/project lbx store.lbox mirrors update The API lets you read, write and seek within files without extracting them to the filesystem. Each lockbox has a table of contents, so extracting a single file from a multi-gigabyte lockbox is fast. Recovery Updates are transactional, with automatic rollback for failed updates. The format is designed for recovery: content is stored in pages, allowing unaffected content to be recovered if part of a lockbox is corrupted. Sharing An encrypted lockbox is more useful if you can share it. reVault has an open-source keyserver for exchanging public keys, with validation through a second trusted channel. It's still experimental. OnePub has donated a server to run a single keyserver. If you're interested in donating resources, I'd like to bring up a second redundant server. It's pure Rust, uses under 100 MB RSS and supports rate limits. To publish your default profile's public key: lbx vault profiles email you@example.com lbx vault profiles publish Give the publish code to your contact. They can import your key: lbx vault contacts receive Display your profile's fingerprint and exchange it through a second trusted channel: lbx vault profiles fingerprint Repeat the process in the opposite direction to get their key. Once you have it, grant them access to your default lockbox: lbx access grant alice You can then email the encrypted lockbox to Alice. To install the CLI and get started: cargo install revault_cli lbx vault init lbx completion install Completion installation detects your shell. To diagnose issues: lbx doctor The language bindings are published to their respective package repositories. I'm looking for constructive criticism of the project on its own merits, particularly the APIs and language bindings. I'm not interested in a debate about using AI. Comments URL: https://news.ycombinator.com/item?id=50227527 Points: 3 # Comments: 1

Texas Attorney General Ken Paxton sued Sam Altman’s OpenAI on Friday, accusing the company of lying about risks it could pose to users. Paxton filed the lawsuit in Collin County district court, claiming OpenAI violated the Texas Deceptive Trade Practices Act by allegedly engaging in deception and harming users. The attorney general sought to blame […]

Engineer Abdulrahman Alfozan was accused of bugging a restricted conference room at the company’s offices.

Article URL: https://terrytao.wordpress.com/2026/10/24/oai-math-revised-a-community-hub-for-revising-openais-math-write-ups/ Comments URL: https://news.ycombinator.com/item?id=50222283 Points: 10 # Comments: 4

Article URL: https://www.reddit.com/r/antiai/comments/1xdv3e5/hacker_reverse_engineers_his_samsung_tv_and_finds/ Comments URL: https://news.ycombinator.com/item?id=50218633 Points: 100 # Comments: 17

Texas Attorney General Ken Paxton (R) sued OpenAI and its CEO Sam Altman on Friday, accusing the company of failing to warn consumers about the potential dangers from its AI models. The lawsuit alleges the ChatGPT maker is running afoul of a Texas consumer protection law and kids' online safety law, underscoring warnings about the...

Article URL: https://openai.com/index/securing-our-frontier-model-training-environment/ Comments URL: https://news.ycombinator.com/item?id=50214416 Points: 68 # Comments: 80

The bugs OpenAI models discovered this week have existed for more than a decade, and PHP, the programming language that contained them, is 30 years old.

Article URL: https://www.sverigesradio.se/artikel/chat-gpt-och-claude-forbjuder-regeringskansliet Comments URL: https://news.ycombinator.com/item?id=50207405 Points: 46 # Comments: 17

The reasons go well beyond the risks of an AI bubble.

Bloomberg Daybreak Europe is your essential morning viewing to stay ahead. Live from Brussels, we set the agenda for your day, catching you up with overnight markets news from the US and Asia. And we'll tell you what matters for investors in Europe, giving you insight before trading begins. On today's show, the global tech rout deepened after the Nasdaq's worst day since June. In another of concern over AI spending, Bloomberg has learnt that OpenAI is cutting its valuation target by $150 billion, as it seeks to raise $30 billion in its latest funding round. And Volvo Cars is planning to cut another 2,500 jobs, as cratering sales in China and tariffs in the US complicate the Swedish automaker’s turnaround. Today's guest: Håkan Samuelsson, Volvo Cars, CEO. (Source: Bloomberg)

Title is a bit of an exaggeration but the question is more: if the frontier models are so good, why even sell them as your primary money maker? Couldn't OpenAI or Anthropic make a lot more money by just starting companies themselves that leverage the models and building their own products? Is selling tokens really the best strategy? Especially with commodification and prices declining wouldn't that indicate there is more money to be made on the application-side of the models rather than the utility side Comments URL: https://news.ycombinator.com/item?id=50200997 Points: 138 # Comments: 126

OpenAI is close to finalizing a new funding round that is meant to be a bridge to its 2027 IPO, sources familiar with the matter tell CNBC.

independent evaluators say they found "vulnerabilities" with an OpenAI monitoring system in a test of how such its systems will be assessed.

The websites you use every day may have been vulnerable to hackers for years because of hidden flaws in their code that AI only recently discovered. Why it matters: The code, called PHP, powers millions of websites, and the vulnerabilities could allow hackers to steal sensitive data or take control of affected servers. If exploited, the bugs could allow attackers to steal sensitive information, like your passwords and data, or take control of vulnerable servers. Driving the news: A potential attack exploiting flaws in PHP emerged on Wednesday, which prompted governments and companies to temporarily take their websites offline while they installed security patches. Dozens of websites in the U.S., U.K., and around the world were briefly taken offline to make the fix. The disruption put the National Security Agency and Europe's cybersecurity agency on alert. State of play: Security patches were released to fix the issues on Oct. 21, 2026. Cybersecurity firms urged anyone using PHP to install the security updates immediately. What they're saying: OpenAI's technology helped find the bugs, and the company called the discovery "one of the most impactful security issues in recent memory." "To our knowledge, frontier AI found these vulnerabilities before attackers did," OpenAI said. The cybersecurity firm Wiz wrote in a blog post : "These findings rank among the most severe vulnerabilities discovered in PHP, and arguably in software history." Read more below. What is PHP? You've probably never heard of PHP, even though you've interacted with it for decades. PHP, which stands for Hypertext Preprocessor , is a programming language used by roughly 70% of websites whose server-side language is known. It has been around since the 1990s to help build websites, taking data and generating content sent to a browser. It's still used today for a variety of websites, including Wikipedia, WordPress blogs and shopping websites. How it works: HTML determines what a website displays. PHP works behind the scenes to collect information and generate content. What was the PHP vulnerability, exactly? AI researchers discovered two critical vulnerabilities in PHP that could have allowed an attacker to take control of a website's server without having legitimate access to it. Hackers could exploit the flaws, dubbed " php2shell " by cybersecurity firms, to steal information from those websites. Between the lines: The flaws went undetected for more than a decade because exploiting them required complex technical work that AI helped researchers discover, per Wiz. Why cybersecurity incidents are a big deal Thought bubble via Axios' Bradley Olson : The PHP vulnerabilities are so serious that the NSA warned website operators to take their sites down if they didn't have enough time to patch the bug. But the cybersecurity problems in recent days have extended far beyond that and include disruptions to developer platforms, data leaks on public schools, break-ins on public companies and more. A major Axios scoop also revealed that banks are detecting unauthorized third-party agent access inside customer accounts, a problem they are racing to contain. Cyber pros are calling the series of attacks "Black October" due to the sheer volume and the level of risk, although so far many organizations have mitigated the risk and avoided massive real-world harm. While defenders and AI companies have warned for months that a season of cyber emergencies would imminently arrive, they have also been working to secure some of the obscure software that still underpins much of the modern internet ecosystem. The bottom line: As attacks continue, experts have urged users to secure passwords, use a password manager and also to avoid panic. As with any cyber emergency, the true barometer of harm is the extent to which damage seeps into the real world, as it has done with ransomware that took hospital software offline or a pipeline system that disrupted fuel supplies briefly on the East Coast.

The current US administration is an obstacle, but public demand for protection will ultimately prevail Organisations around the world scrambled on Thursday to fix critical flaws in PHP, the software that powers much of the web. The vulnerabilities could allow attackers to take control of affected servers. Some websites were taken offline as a precaution while fixes were installed. The paradox is that while AI helped researchers uncover the flaw, it also threatens to accelerate the ability to exploit it. Amazon said that it had detected an attempt before the public disclosure of the PHP flaws. What the episode highlights is AI’s central role in security – and not always for the right reasons. OpenAI’s models have also been responsible for two alarming hacks this year – a security breach of an Australian health department website and a raid by a swarm of AI bots on Hugging Face, an AI services platform. Citing those incidents, the AI minister, Kanishka Narayan, warned that a similar cyber-attack on the UK is “likely, if not inevitable”. Continue reading...