Hacker News

Top Story

A massive 12TB BitTorrent release encompassing complete depot dumps from Valve’s defunct Steam2 architecture surfaced online, spilling over a decade of unreleased prototypes, cut content, and source-adjacent assets from 2003 to 2013. It represents an unprecedented archival leak for PC gaming history that lays bare internal builds from both Valve and third-party studios alike.

Front Page Highlights

Breaking Claude Code Opus 5 Auto Mode · Embrace The Red Security researcher Johann Rehberger demonstrated a multi-stage prompt injection exploit achieving an 80% code execution success rate against Claude Code in default Auto Mode by baiting the agent into writing a Python decoder in a directory containing a shadowed struct.py file. The exploit directly punctures vendor marketing claims of a 0.00% prompt injection attack rate on fixed benchmarks, proving once again that intent classifiers cannot substitute for OS sandboxes. The consensus among systems engineers is blunt: running autonomous developer agents without strict containerization and egress filtering is operational negligence.

Google Has Removed MV2 Extensions from the Chrome Web Store, Including UBO · Web Iterate Google reached the final milestone of its Manifest V2 deprecation by purging all remaining MV2 extensions from the Chrome Web Store, permanently disabling classic content blockers like uBlock Origin. While Google pitches Manifest V3 as an essential privacy and security overhaul, developers view it as the final closing of user agency over web content in the Chromium ecosystem. The move is driving another wave of technical users to evaluate alternative browser engines and independent forks.

Understanding ChatGPT Work · Simon Willison’s Weblog Simon Willison dissected OpenAI’s convoluted ChatGPT Work offering, detailing its dual-mode local and cloud execution environments complete with 44 hidden skills, sub-agent orchestration, and headless Chrome browser automation. The cloud environment now allows unconstrained outbound internet access from code execution containers and can autonomously build and deploy full-stack applications directly to Cloudflare Workers. While remarkably capable, practitioners are raising serious alarms about the classic “lethal trifecta” of pairing private enterprise data with untrusted web content and outbound execution.

How to build a diffusion language model · Kuleshov Group The Kuleshov Group published a rigorous architectural deep dive into discrete masked diffusion models like Gemma Diffusion and Mercury 2, which refine full sequences in parallel rather than generating text left-to-right token by token. By shifting generation bottlenecks from memory bandwidth to raw compute, diffusion models can reach inference speeds exceeding 1,000 tokens per second on standard commodity GPUs without relying on specialized ASIC clusters. The technical takeaway is compelling: parallelizing inference via diffusion could do for post-training and inference scaling laws what transformers did for RNN pre-training.

The EU has begun enforcing the AI Act: first RFIs to model providers · Tokenstead Less than a month after general-purpose AI rules took effect, the European Commission initiated formal enforcement of the EU AI Act by dispatching mandatory requests for information to frontier labs including OpenAI, Anthropic, and Google. The inquiries demand granular documentation on model security, red-teaming evaluations, and training data copyright summaries under threat of fines reaching up to 3% of global annual turnover. Technical observers note that while frontier cloud API providers will face heavy compliance scrutiny, local and open-weight fine-tunes remain in a regulatory gray zone that training summaries cannot easily police.

P99 0 ms* autocomplete for 240M domain names · Ruurtjan.com Ruurtjan shared an elegant latency optimization for Wirewiki that achieves an effective 0 ms P99 search experience by firing prefetch queries on keyDown and rendering suggestions on keyUp. The backend architecture pairs an in-memory prefix trie for top domains with a 2.5 GB memory-mapped, delta-compressed SSD block index to search 240 million names well within a 121 ms human keystroke budget. It is an inspiring example of thoughtful engineering, demonstrating how smart data structures and perceptual UX tricks can outperform brute-force cloud spend.

I Think the Military Commissary’s Freezers Were Hacked · Signal & Silence An investigative post pieced together official notices confirming near-simultaneous refrigeration failures across at least six US military installations, where entire commissary freezer fleets simultaneously flipped into active defrost mode rather than merely losing power. The author highlighted recent disclosure of high-severity remote vulnerabilities in commercial refrigeration controllers like Danfoss and Copeland, which are centrally orchestrated via network-connected monitoring systems. While official Pentagon investigations remain pending, the incident underscores the severe vulnerability of operational technology when mundane physical appliances are exposed to public networks.

Show HN & Launches

On the tooling front, Show HN: SlideOps introduced an agent skill for Claude Code that builds slide decks directly from repositories and uses lightweight Python scripts to detect drift whenever the underlying codebase changes. Meanwhile, interactive launches brought creative flair with Show HN: Laser Graffiti, a zero-dependency web canvas that tracks physical laser pointers through webcams to paint projected surfaces, alongside Show HN: Corporate Mind Games, a collection of satirical browser puzzles simulating RTO planning and org chart modernization. Major open-source releases also dropped today, including OpenShot 4.0 with local ONNX AI tracking models and a native Qt timeline, and ReactOS 0.4.16 bringing a unified graphical installer and expanded audio bus drivers.

Discussion & Debate

The spiciest community discussions centered on Daniel Stenberg’s A CVE Dispute, detailing curl’s multi-month refusal to issue a CVE for a non-exploitable bug involving dot-prefixed hostnames despite repeated pressure from MITRE. Developers rallied behind Stenberg, venting frustration over the perverse incentives of vulnerability bounty hunters and the massive downstream thrash CVE inflation inflicts on thirty billion installed systems. The thread highlighted a broader exhaustion with security theater, where bureaucratic compliance metrics increasingly outweigh actual threat models in open-source maintenance.

💡 Curious to dig deeper into the agent security findings or see a side-by-side comparison of the diffusion language model architectures mentioned across these posts?