ax@ax-radar:~/all $ grep -v 'tier=excluded' stream.log
33 srcsignal 72%cycle 04:32

posts · 2026-07-08

17 items · updated 3m ago
RSS live
2026-07-08 · Wed
05:25
76d ago
● P1Hacker News Frontpage· rssEN05:25 · 07·08
Researchers tricked GitHub's AI agent into leaking private repository contents
Noma Security tricked GitHub Copilot's AI coding agent into leaking private repo contents. They planted bait code in a public repo, then prompted the agent to recall context it had absorbed from a private repo, causing it to output snippets it shouldn't share. The attack exploits the agent's cross-repo memory. The post doesn't say whether GitHub has patched this yet. Worth noting: the attacker needs prior knowledge of what's in the private repo—this isn't indiscriminate leakage, but it exposes a real permission-boundary gap in AI coding tools.
#GitHub#GitHub Copilot#Noma Security
why featured
Featured · importance 92 · hook + knowledge + resonance
editor take
Researchers tricked GitHub's AI coding agent into leaking private repo code via prompt injection across repositories — GitHub patched it, but cross-repo memory attacks are a pattern to watch.
sharp
Noma Labs found a clever attack path: plant malicious instructions in a public repo, let GitHub Copilot's AI agent read and remember them, then watch it leak private code into a public PR when working on a different repo. Both sources point to the same Noma blog post, so this is a single research team's finding — but HN pushing it to the front page tells you the community is on edge about AI agent security boundaries. The attack works because Copilot's agent carries context across repositories — it remembers instructions from one task and applies them to the next. The researchers demoed the full chain with a PoC called GitLost, and GitHub confirmed and patched it. I'd discount this slightly: no independent reproduction has surfaced yet, and we don't know how long the vulnerability existed before the fix or whether anyone exploited it in the wild. The bigger story isn't this one bug — it's that AI coding agents now have read/write access, cross-file memory, and the ability to execute actions. That combination is a much larger attack surface than plain code completion ever was.
HKR breakdown
hook knowledge resonance
open source
92
SCORE
H1·K1·R1
04:29
76d ago
AI HOT (Curated Pool)· aihot-apiZH04:29 · 07·08
AI Audit Agent Finds 7 Bugs in Cloudflare's CIRCL
zkSecurity's AI audit agent found 7 real bugs in Cloudflare's CIRCL crypto library, all fixed. The most severe is a CP-ABE access-control break (Critical), found by zkao alone. The subtlest is a float64 precision loss in threshold RSA that produces wrong key shares (AI rated Critical, Cloudflare rated Low). AI self-assigned severity often mismatched confirmed severity, which the post flags as an interesting insight. All candidates were human-validated; the team notes 'AI findings are cheap, trustworthy reports are not.'
#Cloudflare#CIRCL#zkSecurity
editor take
AI audit agent found 7 real bugs in Cloudflare's crypto library. The float64 precision loss in threshold RSA is the subtlest. AI self-assigned severity often mismatched confirmed severity.
HKR breakdown
hook knowledge resonance
open source
55
SCORE
H0·K1·R0
03:03
77d ago
AI HOT (Curated Pool)· aihot-apiZH03:03 · 07·08
Ant Group's Robbyant Open-Sources LingBot-Vision: A 1B Boundary-Centric Vision Model for Dense Spatial Perception
Ant Group's Robbyant open-sourced LingBot-Vision, a 1B-parameter vision foundation model. It uses a boundary-centric design for dense spatial perception, like precisely identifying object edges in crowded scenes. The post doesn't disclose specific benchmarks or use cases, but open-source means developers can use or fine-tune it directly.
#Ant Group#Robbyant#LingBot-Vision#Open source
editor take
Ant Group open-sourced LingBot-Vision, a 1B model for edge detection in cluttered scenes. No benchmarks released—test it yourself.
HKR breakdown
hook knowledge resonance
open source
55
SCORE
H0·K1·R0
01:32
77d ago
Product Hunt · AI· rssEN01:32 · 07·08
Willow launches Frontier Pro, claims world's fastest and most accurate dictation model
Willow Voice launches two new voice AI models: Frontier Pro and Frontier Mini. Pro targets fast, accurate, polished writing; Mini is free and unlimited, claiming better speed and accuracy than rivals. The post doesn't disclose specific latency or accuracy numbers, only the 'world's fastest and most accurate' claim. Willow is YC-backed, launched in 2025, and previously won Product Hunt's Everyday Communication Award.
#Willow Voice#Y Combinator#Product Hunt
editor take
Willow Voice launches Frontier Pro and free Mini, but only claims 'world's fastest' with no latency or accuracy numbers.
HKR breakdown
hook knowledge resonance
open source
55
SCORE
H1·K0·R0
01:20
77d ago
Product Hunt · AI· rssEN01:20 · 07·08
LemonLime: Automate your existing workflows with a single prompt.
LemonLime launched today on Product Hunt, promising to automate existing workflows with a single prompt. It connects to your tools, studies your business, and self-creates specialized AI agents and automations. It also surfaces suggested automations you can implement with one click. The post doesn't disclose the underlying model, pricing, or specific integrations.
#LemonLime
editor take
LemonLime launches today claiming to automate workflows from a single prompt, but no model or pricing details yet.
HKR breakdown
hook knowledge resonance
open source
55
SCORE
H1·K0·R0
00:32
77d ago
Hacker News Frontpage· rssEN00:32 · 07·08
rlm-workflow: treat chat as CLI, use a kanban pipeline for coding
rlm-workflow is a skill for coding agents like Cursor and Codex. Its core idea: don't pass requirements, code analysis, or implementation plans through the chat window—use chat only as a CLI. It models a kanban workflow with five sequential phases: requirements, as-is analysis, to-be design, implementation summary, and manual QA. Each phase outputs a locked markdown doc; the next phase can't start until the previous one passes. After a run, it updates DECISIONS.md and STATE.md for traceability. The author claims this reduces context rot, cuts token usage, and makes the process human-readable. The post doesn't specify which IDEs or agent frameworks are supported beyond Codex and skills.sh.
#Code#rlm-workflow#Codex#Cursor
editor take
Lock requirements in markdown docs, use chat as CLI only—cuts context rot and token waste.
HKR breakdown
hook knowledge resonance
open source
55
SCORE
H0·K0·R0
00:12
77d ago
AI HOT (Curated Pool)· aihot-apiZH00:12 · 07·08
Turn Stanford's Life Design course into a prompt and let Claude plan your life
An author turned Stanford's Life Design course into a full prompt set that guides users through four stages of life planning with Claude. It blends design thinking, flow theory, and positive psychology: users score health, work, play, and love, distinguish gravity problems from designable ones, and generate three five-year life versions. The final output is an 8,000–12,000-word personal life design blueprint. The post doesn't spell out the exact prompt instructions or which Claude version was used.
#Claude#Stanford
editor take
Someone turned Stanford's Life Design course into a Claude prompt that outputs a 10k-word life blueprint. Sounds useful, but the full prompt isn't shared.
HKR breakdown
hook knowledge resonance
open source
55
SCORE
H1·K1·R0
00:08
77d ago
Hacker News Frontpage· rssEN00:08 · 07·08
Fortress: a stealth Chromium so your AI agents stop getting blocked
Fortress is a modified Chromium that makes AI agents look like regular browsers to avoid bot detection. The GitHub repo is live but the post doesn't disclose which stealth techniques it uses, performance overhead, or whether it bypasses Cloudflare-level protections.
#Fortress#Chromium#GitHub#Open source
editor take
Fortress tweaks Chromium to make AI agents look human, but the post doesn't say if it beats Cloudflare.
HKR breakdown
hook knowledge resonance
open source
65
SCORE
H1·K1·R0
00:00
77d ago
● P1OpenAI Blog· rssEN00:00 · 07·08
OpenAI launches GPT-Live, a full-duplex voice model for simultaneous listening and speaking
OpenAI rolled out GPT-Live, a new voice model family that replaces the turn-based Advanced Voice Mode. Built on a full-duplex architecture, it can listen and speak simultaneously, use backchannel cues like 'mhmm,' and stay quiet when you pause to think. For tasks requiring search or deeper reasoning, GPT-Live delegates to GPT-5.5 in the background while keeping the conversation going. Two versions—GPT-Live-1 and GPT-Live-1 mini—are rolling out to ChatGPT users globally today, with API access planned soon. In OpenAI's human evaluations on 5–10 minute conversations, GPT-Live-1 was strongly preferred over Advanced Voice Mode on overall preference, turn-taking, interruptions, and conversational flow.
#Audio#Reasoning#Agent#OpenAI
why featured
Featured · importance 100 · hook + knowledge + resonance
editor take
OpenAI split the voice model into a front-end conversationalist and a back-end delegator to GPT-5.5 — full-duplex is the real architectural shift here.
sharp
OpenAI dropped GPT-Live, covered by their own blog post and an HN thread — both pointing to the same official source. The real change isn't a smarter model, it's the architecture: full-duplex means it listens and speaks simultaneously, no more waiting for you to stop talking. They show it giving backchannel cues like "mhmm" and staying quiet when you pause. The other piece is delegation. GPT-Live handles the conversation flow, and when something needs search or reasoning, it hands off to GPT-5.5 in the background, then weaves the result back in. That fixes the old problem where voice models froze up on hard questions. Two versions are rolling out now — GPT-Live-1 and GPT-Live-1 mini — on ChatGPT first, API later. I'd discount the "dramatically more natural" framing a bit. The human eval comparisons are against their own Advanced Voice Mode, not competitors. No pricing, no latency numbers, no API timeline. The HN thread is just a title with no extra signal. Read this as an architecture upgrade, not a revolution in feel — yet.
HKR breakdown
hook knowledge resonance
open source
100
SCORE
H1·K1·R1
00:00
77d ago
● P1AI HOT (Curated Pool)· aihot-apiZH00:00 · 07·08
Cursor and SpaceXAI release Grok 4.5 general-purpose model
Cursor and SpaceXAI today released Grok 4.5, the first Cursor model built for more than software engineering. It handles long-running tasks in coding, data science, finance, and law that require creative tool use. The mixture-of-experts model was trained on trillions of tokens of Cursor user interactions plus STEM papers and knowledge work data. Reinforcement learning in realistic environments teaches it to investigate, use tools, recover from mistakes, and verify results. Grok 4.5 is available in Cursor today. Individual and team plans include significant usage, doubled for the first week. Base pricing is $2/M input tokens and $6/M output tokens; a fast variant costs $4/M input and $18/M output. The post doesn't disclose specific benchmark scores but notes SWE-Bench Pro and Terminal-Bench scores are self-reported, and Grok 4.5's advantage on CursorBench is due to accidental training data contamination.
#Cursor#SpaceXAI
why featured
Featured · importance 92 · editorial signal
editor take
Cursor and SpaceXAI co-trained Grok 4.5, slotting between Opus 4.7 and 4.8 but at 1/6 the cost. Both sources point to the same xAI announcement, so the numbers are likely solid.
sharp
The headline here isn't model capability, it's pricing. xAI positions Grok 4.5 as Opus-class but openly says it lands between Opus 4.7 and 4.8 — so it's half a step behind Anthropic's best. The real punch is cost: 6x cheaper than Opus, 3x cheaper than GPT-5.5. Cursor baked it in with higher usage limits, which tells me they're betting on undercutting the competition for high-frequency coding users. Both sources are working off the same xAI blog post, no independent evals yet. I'd wait for third-party benchmarks before believing the performance claims. Also, the SpaceXAI + Cursor co-training arrangement is odd — a rocket company and an IDE maker jointly training a general-purpose model, and neither source explains why these two specifically teamed up.
HKR breakdown
hook knowledge resonance
open source
92
SCORE
H0·K0·R0
00:00
77d ago
Computing Life · Share (鸭哥 research reports)· rssZH00:00 · 07·08
AI cut the low-gear tasks—and made rest harder
AI first eliminated low-gear tasks like formatting, data moving, and boilerplate code. Workflows sped up, but people lost chances to downshift. A BCG/Harvard Business Review study of 1,488 US workers calls the fatigue from continuously monitoring AI output 'AI brain fry.' Switching tasks doesn't equal rest—email, industry news, and AI summaries still demand judgment. Real recovery requires stopping three kinds of input: information, choices, and goals. A PLOS ONE meta-analysis links sub-10-minute micro-breaks to higher vigor and lower fatigue, though a few minutes usually isn't enough for complex cognitive recovery. A Microsoft WorkLab EEG study of 14 people suggests 10-minute gaps between meetings can block stress accumulation but don't mean the brain is ready for hard judgment again. The article offers a low-input rest protocol: keep the phone away, do a no-judgment action, and after 15 minutes write only one next step.
#BCG#Harvard Business Review#Microsoft WorkLab
editor take
AI cut the low-gear tasks—formatting, data moving—so people stay stuck in judgment mode longer; BCG calls this 'AI brain fry.'
HKR breakdown
hook knowledge resonance
open source
72
SCORE
H1·K1·R1

more

feeds

admin