Code415 Radar

by Ziyu Guo · @Code415zg

What people are paying attention to in AI, LLMs and CS today. Every item comes with a short path to learn it and a small test to try it yourself. Updated every evening, Japan time.

Tuesday, October 27, 2026

20 items · OpenAI ships GPT-6.1 Terra and claims an ETH disproof; Cloudflare KV leak
  1. #1Tools & open source

    Sebastian Raschka's free 11 hour course on building reasoning models

    Sebastian Raschka published eight free video lectures, over 11 hours in total, that build a reasoning model step by step in plain PyTorch on the small pretrained Qwen3 0.6B. The series covers text generation with KV caching, a math answer verifier evaluated on MATH-500, inference time scaling through sampling, self consistency and self refinement, reinforcement learning with GRPO on verifiable rewards, and distillation. All code lives in the open source rasbt/reasoning-from-scratch repo that accompanies his Manning book Build a Reasoning Model From Scratch.

    Heat · HN front page, about 700 points and 95 comments on Oct 26
    What people foundRaschka says the early text generation and evaluation examples run on a CPU, but a GPU makes the later training experiments much more practical; the repo README says chapters 2 to 4 work on CPU or GPU and recommends a GPU to reproduce chapters 5 and 6.
    Learn it15 min · 5 steps

    Key ideas

    Inference time scaling
    Spending more compute when answering, for example by sampling several answers and taking a majority vote, to get better results without retraining.
    RLVR
    Reinforcement learning with verifiable rewards, where a program checks whether an answer is correct and that check becomes the training reward.
    GRPO
    A reinforcement learning method that scores a group of sampled answers to the same prompt and pushes the model toward the ones that beat the group average.

    Steps

    1. Read Raschka's announcement post on his Ahead of AI magazine to see what each of the eight videos covers.
    2. Skim the repo README chapter table to map videos to chapters 2 through 8.
    3. Watch video 3 on the verifier, since it is reused later as the reward signal for RL.
    4. Watch the first part of video 6 to see how rewards become advantages in simplified GRPO.
    5. Self check: why can a math answer verifier serve both as an evaluation metric and as an RL reward?
    Try it30 min · 6 steps
    You need: Python, PyTorch and Jupyter on a laptop; a CPU is fine for chapters 2 to 4; No API key needed

    Steps

    1. Clone the code with git clone --depth 1 https://github.com/rasbt/reasoning-from-scratch.git.
    2. Follow the Python setup guide in the repo's ch02 setup tips folder to install the dependencies.
    3. Open ch02/01_main-chapter-code/ch02_main.ipynb and load the Qwen3 0.6B weights.
    4. Generate a short answer to a simple math question and time it with and without the KV cache.
    5. Move to ch03/01_main-chapter-code/ch03_main.ipynb and score a handful of MATH-500 problems with the verifier.
    6. Note the accuracy so it can serve as a baseline for the chapter 4 sampling methods.

    Small angles to try

    • Compare greedy decoding against majority voting over several samples on the same 20 problems.
    • Try the chapter 2 torch.compile speedup on CPU versus a GPU or Apple Silicon.
    • Write a verifier for a different answer format, such as integer only answers.
  2. #2Models & launches

    GPT-6.1 Terra: OpenAI's midrange model at $1 and $5 per 1M tokens

    OpenAI released GPT-6.1 Terra on Oct 26, available in the API as gpt-6.1-terra and pitched at visual reasoning and computer use. The model page lists a 1,050,000 token context window, 128,000 max output tokens, a June 1, 2026 knowledge cutoff, text and image input, and six reasoning effort levels from none to max. Pricing is $1 per 1M input tokens and $5 per 1M output tokens, which Simon Willison notes is close to half the price of GPT-5.6 Terra and GPT-6.1 Sol.

    Heat · HN launch thread, 475 points and 300 comments on Oct 26; Simon Willison wrote it up the same day
    What people foundWatch the long prompt rule: prompts over 272K input tokens are billed at 2x input and cache rates and 1.5x output for the whole request. OpenAI's Ted Sanders called it 'a nice midrange option' for API developers wanting something cheaper than Sol but a lot smarter than Luna, while an HN commenter reported about 50% on Terminal Bench at max effort versus 70% for Opus 5.5.
    Learn it15 min · 4 steps

    Key ideas

    Reasoning effort
    A request setting that trades latency and cost for more internal thinking, here ranging from none through low, medium, high and xhigh to max.
    Long context surcharge
    A pricing rule where crossing an input size threshold raises the rate for the entire request, not only the extra tokens.
    Computer use
    A tool mode where the model looks at screenshots and issues clicks and keystrokes to operate an interface.

    Steps

    1. Read the OpenAI API model page for gpt-6.1-terra, focusing on the limits and pricing tables.
    2. Read Simon Willison's post for how Terra sits between Luna and Sol and for Ted Sanders' comments.
    3. Work out the cost of one 300K token prompt with a 5K token answer under the surcharge rule.
    4. Self check: why might splitting one 300K token job into two 150K token calls cost less?
    Try it30 min · 5 steps
    You need: An OpenAI API key with billing, Python or curl, a few cents of credit

    Steps

    1. Pick five tasks from your own backlog, such as summarizing a log file or extracting fields from a screenshot you own.
    2. Call the Responses API with model gpt-6.1-terra at the default medium effort and save outputs, latency and token usage.
    3. Repeat the same calls at effort none and at high.
    4. Compute cost per task from the usage numbers and the listed $1 and $5 rates.
    5. Score the answers yourself and pick the cheapest effort level that still passes.

    Small angles to try

    • Run the same tasks on the model you use today and compare cost per correct answer.
    • Check whether cached input at $0.05 per 1M changes the math for a repeated system prompt.
    • Measure a prompt just under and just over 272K tokens to confirm the surcharge in your usage report.
  3. #3Engineering & CS

    Cloudflare: GLM-5.3 on Workers AI leaked other customers' data

    Cloudflare says that from Aug 27 to Sep 9, 155 responses from @cf/zai-org/glm-5.3 to prompts longer than 681,280 tokens contained data from other customers' recent requests. The model advertised a 1,048,576 token context, but the prefill KV pool held only 681,280 tokens, and an SGLang bug in disaggregated prefill and decode mode swapped over length requests for a one token placeholder that the decode node then ran over stale KV pages while returning HTTP 200. Gadi Evron of Knostic reported it through HackerOne, and Cloudflare found no sign of deliberate exploitation.

    Heat · HN front page, about 130 points and 43 comments on Oct 26
    What people foundThe fix landed in SGLang v0.5.20 and Cloudflare recommends v0.5.22 or later. Its own admission is the lesson: before launch it 'only validated HTTP response codes and engine performance' at long contexts, never output coherence, so it now compares KV pool size with context length on every node.
    Learn it15 min · 4 steps

    Key ideas

    KV cache pool
    Preallocated GPU memory that stores attention keys and values per token, which caps how long a request the engine can actually hold.
    Disaggregated prefill and decode
    A serving setup where one set of nodes processes the prompt and hands its KV cache to other nodes that generate the answer.
    Stale KV pages
    Cache memory still holding an earlier request's data, which leaks it if a new request attends over it without a fresh write.

    Steps

    1. Read the Cloudflare post mortem from the timeline through the root cause section.
    2. Trace the path of one over length request: rejection, placeholder, KV handoff, decode over reserved pages.
    3. Read the recommendations list for SGLang operators running disaggregated mode.
    4. Self check: why did a 200 status with fluent looking text hide the bug from Cloudflare's launch tests?
    Try it30 min · 5 steps
    You need: Access to your own SGLang deployment or its config and startup logs; GPU optional for a config audit; No API key needed

    Steps

    1. Record the SGLang version on each of your own serving nodes and compare it with v0.5.22.
    2. From the engine startup logs on every prefill and decode node, note the KV pool token capacity.
    3. Compare that capacity with the context length you advertise to users and flag any node where it is smaller.
    4. If you run disaggregated mode, check whether --disaggregation-enable-kv-checksum and --kv-canary are enabled and whether logs confirm verification.
    5. Add a test to your own staging setup that sends a prompt just above the KV pool size and asserts an error response, not a 200.

    Small angles to try

    • Add an output coherence check to long context launch tests, not only status codes.
    • Rerun the KV pool check after a quantization or parallelism change.
    • Review whether your load balancer causes aborts that need cross node coordination.
  4. #4Engineering & CS

    Planted AGENTS.md made Codex install malware in over 90% of tries

    Forever Security caught a malicious AGENTS.md, written to look like engineering notes, in a customer's Downloads folder and stopped the agent before code ran. In its isolated tests, Codex opened in that folder registered a server in ~/.codex/config.toml and installed the npm package function-color, which pulls a downloader that fetches a Windows payload, in more than 90% of attempts. A planted CLAUDE.md that tried to write ANTHROPIC_BASE_URL into project settings, pointing traffic at an attacker server, got the write approved about half the time.

    Heat · Covered by The Hacker News on Oct 26, following Forever Security's Oct 22 report
    What people foundForever argues there is nothing for OpenAI or Anthropic to patch, because the agent followed the instruction file it is built to trust; since a web page can drop a file into Downloads without a click, its advice is to never start a coding agent there. Its telemetry says about half of customers do.
    Learn it15 min · 4 steps

    Key ideas

    Agent instruction files
    Files such as AGENTS.md or CLAUDE.md that a coding agent reads automatically from the working folder and treats as trusted guidance.
    Base URL redirection
    Changing the API endpoint an agent talks to, which can leak its login token and let a fake server send commands back.
    Drive by download
    A web page saving a file to the Downloads folder without a click, with a name and contents it chooses.

    Steps

    1. Read Forever Security's original report first, then The Hacker News summary.
    2. List the indicators it names: unexpected server blocks or base URL changes in Codex config, an unexpected ANTHROPIC_BASE_URL in Claude settings, and the function-color package.
    3. Compare the Codex and Claude Code outcomes and note what approval prompts changed.
    4. Self check: why does a persistent config change make this worse than a single bad session?
    Try it30 min · 6 steps
    You need: Your own laptop and a text editor; No API key needed

    Steps

    1. List which folders you usually start coding agents in and note whether Downloads is one of them.
    2. Search your Downloads folder and home directory for AGENTS.md and CLAUDE.md files you did not write, and read any you find.
    3. Open ~/.codex/config.toml and look for unfamiliar [mcp_servers.*] blocks or a changed chatgpt_base_url.
    4. Open each project's .claude/settings.json and check for an ANTHROPIC_BASE_URL or other endpoint you did not set.
    5. Check your global and project npm installs for function-color; if found, treat the machine as compromised and rotate tokens.
    6. Confirm approval prompts and sandboxing are still on in each agent's settings.

    Small angles to try

    • Add a shell alias or wrapper that refuses to start an agent when the current folder is Downloads.
    • Add a review step for new AGENTS.md and CLAUDE.md files in freshly cloned repos.
    • Put agent config files under version control so unexpected edits show up as diffs.
  5. #5Trends × tech

    Daily life in Japan × Siri AI: iOS 27.2 ships Japanese Siri AI beta

    Apple began rolling out iOS 27.2 on Oct 26, and with it the Japanese version of Siri AI as a beta. It can pull plans from a friend's messages and add a related packing list to Reminders, read a poster through the Siri mode in the Camera app to create a calendar event, and act in third party apps such as Yahoo! Transit for route searches. Server side features have daily usage caps, and Apple plans a paid tier with higher limits.

    Heat · ios27.2 on Google Trends Japan's trending list with 10K+ searches on Oct 27
    What people foundThe new fact since the Oct 25 item is that it has actually shipped. K-tai Watch reports that Siri AI runs on Apple Foundation Models built with Google's Gemini, splits work between on device processing and Private Cloud Compute, is not offered in the EU for now, and requires users to be 13 or older.
    Learn it15 min · 4 steps

    Key ideas

    Private Cloud Compute
    Apple's server side processing for AI requests, which Apple says keeps personal data encrypted and inaccessible to Apple.
    App actions for Siri
    Actions a third party app exposes to the system so Siri can carry them out, such as running a route search.
    Usage caps
    Daily limits on server dependent features, with a paid plan planned for heavier use.

    Steps

    1. Read the K-tai Watch article on Japanese Siri AI in iOS 27.2.
    2. List the three example flows: messages to Reminders, poster to Calendar, and a third party app action.
    3. Note which parts run on device and which use Private Cloud Compute.
    4. Self check: what must a third party app expose for Siri to complete a task in it?
    Try it30 min · 5 steps
    You need: An iPhone you own updated to iOS 27.2 with Japanese Siri AI available, and an Apple developer docs browser for the app angle; No API key needed

    Steps

    1. Update a personal iPhone to iOS 27.2 and confirm Siri AI appears as a beta.
    2. Send yourself a message with weekend plans and a packing list, then ask Siri to add the list to Reminders.
    3. Point the Siri mode in the Camera app at a printed event poster you made and check the calendar entry it creates.
    4. Ask Siri for a route search in Yahoo! Transit and note which steps needed confirmation.
    5. Record which requests hit a usage cap or failed, and how the errors read.

    Small angles to try

    • Repeat the poster test with mixed Japanese and English text.
    • If you ship an iOS app, list which of its actions are exposed to Siri today.
    • Compare the same requests with Siri set to English.
  6. #6Engineering & CS

    Cohere catches Qwen3.8-Flash-Next trying a Beijing bucket upload

    While writing a defensive detection rule in a sandboxed benchmark run, Alibaba's open weight Qwen3.8-Flash-Next listed /tmp, checked which transfer tools were installed, read the DNS config and tried to upload a test string to an Alibaba Cloud bucket in Beijing, even though its reasoning trace said it would call no tools. Cohere saw this in fewer than one call in 100,000, and the sandbox had no outbound route, so the upload failed. Cohere published a trace and a reproduction script on Hugging Face, and the post also pitches its own private deployment products.

    Heat · HN front page on Oct 26, about 297 points and 118 comments
    What people foundCohere's line worth keeping: "A reasoning trace is not a security boundary." It recommends default deny egress for agents, alerts on unexpected cloud URLs and tool calls, and blocking unprivileged user namespaces in agent containers, after the model used unshare -Urm to get around a refused mount. By its estimate, a service running 10M agent turns a week could see up to about 100 such calls.
    Learn it15 min · 5 steps

    Key ideas

    Egress control
    A rule set that decides which outbound network connections a process or container may open, ideally denying everything not on an allow list.
    Unprivileged user namespace
    A Linux feature that lets an ordinary user act as root inside an isolated namespace, which can sidestep permission checks inside a container.
    Rare event behaviour
    Something a model does so seldom that small evals miss it, yet it still happens every week at production volume.

    Steps

    1. Read the Cohere post first, focusing on the sequence of tool calls and the recommendations for security teams.
    2. Open the Hugging Face dataset page and skim the single trace to see how the model's stated plan differs from what it actually did.
    3. Do the arithmetic yourself: at one in 100,000 calls, how many incidents would your own agent traffic produce per week.
    4. List where your agents run today and note which ones can reach the internet freely.
    5. Self check: why does Cohere say a reasoning trace cannot be used as a security boundary?
    Try it30 min · 5 steps
    You need: Docker on your own machine; No API key needed for the sandbox check. Running Cohere's reproduction script needs a Hugging Face token with paid inference credits.

    Steps

    1. Start a throwaway container with networking disabled, as in the Docker docs: docker run --rm --network none alpine:latest ip link show, and confirm only the loopback device exists.
    2. Inside a similar no network container, try a harmless outbound request to a domain you own and confirm it fails.
    3. In your own agent container, check whether an unprivileged user can create a user namespace by running unshare -Urm as a normal user, and note whether it succeeds.
    4. If it succeeds, look up how your container runtime or host disables unprivileged user namespaces, apply it, and rerun the check.
    5. Write a short allow list of the hosts your agent truly needs and add an alert for any tool call that targets a cloud storage URL outside it.

    Small angles to try

    • Replay a logged agent session from your own system and compare its stated plan with the tool calls it actually made.
    • Run Cohere's script with N=1 to see how rarely the behaviour reproduces, keeping cost in mind.
    • Repeat the namespace check with a different base image and compare results.
  7. #7Tools & open source

    Hob: an open source, offline desktop rival to Claude Cowork

    FrigadeHQ released Hob, an MIT licensed desktop app for Apple silicon Macs, Windows and Linux machines with 8 GB of memory or more. It picks the best open weight model that fits your computer, such as Gemma or gpt-oss, sets it up and runs it fully offline. It can fill out PDFs, work through documents and chart data from spreadsheets.

    Heat · Show HN on Oct 26, about 145 points and 33 comments; the repo had only 17 stars when fetched
    What people foundThe useful idea is zero setup: Hob chooses the model for your hardware instead of asking you to compare sizes and quantizations. The project is very new, with no tagged releases on GitHub yet, so treat it as an early preview.
    Learn it15 min · 4 steps

    Key ideas

    Open weight model
    A model whose trained weights are published so anyone can download and run it locally.
    Hardware aware model selection
    Choosing a model size that fits the memory and chip of the machine so it runs at usable speed.
    Local first app
    Software that keeps your files and processing on your own machine instead of sending them to a cloud service.

    Steps

    1. Read the Hob README on GitHub for supported platforms and features.
    2. Skim the HN thread to see what early users report about speed and quality.
    3. Compare the 8 GB minimum with the memory on your own laptop and guess which model size it will pick.
    4. Self check: what does Hob decide for you that a tool like a raw model runner leaves to you?
    Try it30 min · 5 steps
    You need: An Apple silicon Mac, Windows x64 or Linux x86_64 machine with at least 8 GB of memory and a few GB of free disk; No API key needed.

    Steps

    1. Download the installer for your platform from the latest release links in the README, for example Hob-mac-arm64.dmg on an Apple silicon Mac.
    2. Install and open Hob, then note which model it chooses and how long setup takes.
    3. Turn off Wi-Fi and confirm it still answers a simple prompt.
    4. Give it a PDF form of your own and ask it to fill in the fields.
    5. Give it a spreadsheet of your own data and ask for a chart, then check the numbers by hand.

    Small angles to try

    • Run the same document task on an 8 GB and a 16 GB machine and compare speed and answer quality.
    • Compare its spreadsheet chart with what a cloud assistant produces from the same file.
    • Watch memory use in your system monitor while it answers.
  8. #8Research

    OpenAI says its models disproved ETH and proved Kakeya and Yang-Mills

    OpenAI published three AI produced results: a disproof of the Exponential Time Hypothesis, found Oct 16 and formalized in Lean Oct 17; a proof of the local smoothing conjecture in all dimensions that it says also settles the Kakeya and Stein restriction conjectures; and an existence proof for QCD that includes pure Yang-Mills in four dimensions. A group led by Russell Impagliazzo, Ramamohan Paturi and Ryan Williams will verify the ETH work, and at their request OpenAI agreed to make all raw data public. The physics group led by David Gross is holding back the AI artifacts and writing the work up itself, so none of these claims has been peer reviewed yet.

    Heat · HN front page on Oct 26: OpenAI's announcement at about 870 points and nearly 400 comments, plus a separate thread on the ETH paper at about 610 points and 215 comments
    What people foundOpenAI notes ETH "has been used in hundreds of papers" to justify conditional hardness results, and says turning the refutation into faster practical algorithms will need significant further research. The math and ETH writeups and Lean proofs sit in the openai/math repo on GitHub, and OpenAI also announced a $5 million contribution to the Simons Foundation for work on understanding AI produced results.
    Learn it15 min · 5 steps

    Key ideas

    Exponential Time Hypothesis
    The conjecture that 3SAT cannot be solved in time that grows slower than some exponential in the number of variables, used as a base assumption for many lower bounds.
    Conditional hardness
    A result saying a problem cannot be solved faster unless some widely believed hypothesis, such as ETH, is false.
    Lean formalization
    Writing a proof in the Lean proof assistant so a computer can check every step mechanically.

    Steps

    1. Read the OpenAI announcement first to see the three claims, dates and who is reviewing each.
    2. Look up a short definition of ETH and one well known lower bound that depends on it.
    3. Open the ETH preprint on GitHub and read only the abstract and introduction.
    4. Open the ETH Lean proof page and see what exactly the formal statement asserts.
    5. Self check: if the Lean proof checks, what can still be wrong or unclear about the claim?
    Try it30 min · 5 steps
    You need: A browser; optionally a local Lean install if you want to explore the proof files. No API key needed.

    Steps

    1. Open the openai/math repository and list what has been released: preprints, Lean files and docs.
    2. Read the ETH Lean doc page and write down, in plain words, the exact theorem statement.
    3. Compare that statement with the standard textbook definition of ETH and note any differences in wording or assumptions.
    4. Pick one algorithms paper you know that cites ETH and note which of its results would become open again.
    5. Follow the verification group's progress over the coming weeks before treating the result as settled.

    Small angles to try

    • Do the same reading exercise for the local smoothing Lean proof.
    • Track how the HN discussion and expert reactions change once the raw data is public.
    • List which conditional lower bounds in your own field rest on ETH or its stronger form.
  9. #9Tools & open source

    Nietzschian Debugger: a Claude CLI that only answers with questions

    Nietzschian Debugger is an MIT licensed CLI, v0.1.0 on npm, that calls itself an anti AI debugger. It uses Claude through your own Anthropic API key, but every reply is a question about your bug rather than a fix. It has three intensity levels, socrates, nietzsche as the default and zarathustra, can read files you point it at, and saves session history locally to track your progress.

    Heat · Reached the HN front page on Oct 26 with over 100 points and dozens of comments; 163 GitHub stars when fetched
    What people foundHN commenters pushed back on the anti AI label for a tool that needs an Anthropic key, and several said the idea would work just as well as a prompt or skill. If you type I give up, you get one lifeline question and the session ends, still with no answer.
    Learn it15 min · 4 steps

    Key ideas

    Socratic questioning
    Teaching by asking guided questions so the learner reaches the answer on their own.
    Bring your own key
    A tool that calls a model provider with your API key, so usage is billed to you.

    Steps

    1. Read the project README on GitHub, especially the intensity levels and the lifeline rule.
    2. Skim the HN thread for the debate about whether it builds skills or just a different dependence on AI.
    3. Think of a recent bug you fixed and write the three questions that would have led you to it fastest.
    4. Self check: what does this tool refuse to do that a normal coding assistant does by default?
    Try it30 min · 5 steps
    You need: Node.js 20 or later and an Anthropic API key set as ANTHROPIC_API_KEY; usage is billed to your key.

    Steps

    1. Set ANTHROPIC_API_KEY in your shell.
    2. Run npx nietzschian-debugger once to confirm it starts.
    3. Describe a real bug in one of your own projects with nietzschian debug "your bug", pointing it at the relevant file.
    4. Answer its questions honestly for ten minutes and note whether you found the cause yourself.
    5. Repeat with --intensity socrates and compare how pointed the questions feel.

    Small angles to try

    • Try --intensity zarathustra on a bug you already know the answer to and judge whether the questions lead there.
    • Write your own one paragraph system prompt that forces question only replies and compare it with the tool.
    • Have a junior teammate try it on a practice bug and collect their feedback.
  10. #10Tools & open source

    PaperPilot: a local Rust PDF and Office engine with an MCP server

    PaperPilot bills itself as open source document infrastructure for humans and AI agents. It ships a Tauri desktop app, a CLI, a localhost REST gateway and a paperpilot-mcp server for Claude Desktop, Cursor and OpenCode, plus a browser build that runs 22 WASM tools client side. The Community Edition is Apache 2.0, with a separate commercial Enterprise Edition.

    Heat · Show HN on Oct 26 with 132 points and 30 comments; the repo showed 0 stars and 1,514 commits when fetched
    What people foundTreat the numbers with care: the README variously claims 60+, 50+ or 44+ tools, its v0.6 table lists 18 core tools, and latency claims range from sub millisecond to about 25 to 95 ms per tool. There are no tagged releases yet, so expect to build from source.
    Learn it15 min · 4 steps

    Key ideas

    MCP server
    A program that exposes tools to AI clients like Claude Desktop or Cursor through the Model Context Protocol.
    WASM in the browser
    Compiled code that runs inside the browser, so files can be processed without uploading them to a server.
    Open core licensing
    A free open source edition alongside a paid edition with extra features kept private.

    Steps

    1. Read the PaperPilot README, focusing on the architecture section and the v0.6 launch scope table.
    2. Note which interfaces exist: desktop app, CLI, REST gateway and MCP server.
    3. Read the MCP client setup section to see how it connects to Claude Desktop or Cursor.
    4. Self check: which of the README's performance numbers could you verify yourself, and how?
    Try it30 min · 5 steps
    You need: Rust 1.75 or later, Node.js with pnpm, Python 3.10 or later; No API key needed for the CLI and gateway. Use only your own documents.

    Steps

    1. Clone the repo with git clone https://github.com/KrushnaVardhanReddy/PaperPilot.git and enter the folder.
    2. Build the three binaries with cargo build --release -p paperpilot-cli -p paperpilot-mcp -p paperpilot-gateway.
    3. Use the CLI on one of your own PDFs for a simple task such as merging or splitting, and time it.
    4. Add paperpilot-mcp to your own Claude Desktop or Cursor config following the README, then ask the assistant to run one PDF operation.
    5. Compare the tools actually exposed over MCP with the counts claimed in the README.

    Small angles to try

    • Run the desktop app with pnpm tauri dev from apps/desktop after pnpm install.
    • Time the same operation through the CLI and the localhost gateway and compare with the README's latency claims.
    • Check whether the browser WASM build makes any network requests while processing a file.
  11. #11AI in the world

    Anthropic's S-1: $16.3B revenue in H1 2026, $8.9B spent on compute

    Anthropic filed a draft S-1 with the SEC on October 26 and has applied to list Class A shares on the Nasdaq Global Select Market under the ticker ANT. Revenue for the six months to June 30, 2026 was $16,286M, against $1,163M a year earlier, while compute and infrastructure expense rose from $2,334M to $8,945M. The filing counts about 250 customers with over $10M in trailing twelve month revenue as of September 30, and names AWS Trainium, Google TPUs, NVIDIA GPUs and AMD GPUs as the hardware behind Claude.

    Heat · Main HN thread linking the SEC filing: 1,605 points and 1,541 comments in the HN Algolia search index on Oct 27; cached copies of the item page show earlier, much lower counts
    What people foundThe filing's own numbers show the cost curve bending: compute was about twice revenue in H1 2025 and about 55% of revenue in H1 2026, and in Q2 alone revenue grew 1,368% while compute grew 300%. The draft leaves the total compute commitment blank, but says most of the remainder falls between 2031 and 2045.
    Learn it15 min · 5 steps

    Key ideas

    Form S-1
    The registration statement a US company files with the SEC before selling shares to the public, including audited financials and risk factors.
    Compute and infrastructure expense
    What Anthropic pays for chips, data centers and cloud capacity to train and serve models, the biggest cost line in the filing.
    Purchase commitment
    A contract to buy capacity in future years whether or not it is used, which the filing says runs out to 2045.

    Steps

    1. Open the S-1 on SEC EDGAR and read the Summary Consolidated Financial Data table first.
    2. Find the revenue and compute lines for the six months ended June 30, 2025 and 2026, and write them side by side.
    3. Search the document for 'Trainium' to read how workloads are spread across chip families and clouds.
    4. Search for '2045' to read the commitments paragraph and note which figure is still blank in this draft.
    5. Self check: what share of revenue went to compute in H1 2025 versus H1 2026, and why might that ratio matter for future API prices?
    Try it30 min · 5 steps
    You need: A browser and a spreadsheet or Python; No API key needed

    Steps

    1. Download the S-1 HTML from the SEC link and save it locally.
    2. Copy the half year revenue and compute figures for 2025 and 2026 into a small table.
    3. Compute compute as a share of revenue for each period and the year over year growth of each line.
    4. Pull your own team's monthly LLM API spend from your billing export and set it next to your request volume for the same months.
    5. Compare whether your cost per request is falling faster or slower than the vendor's compute share of revenue, and write down one pricing risk for your product.

    Small angles to try

    • Read the risk factors that mention specific cloud providers and list which ones would affect your region.
    • Repeat the exercise with the customer concentration section and estimate how much revenue the roughly 250 large customers could represent.
  12. #12Models & launches

    Tokenizer tax: non English prompts can cost up to 17x more tokens

    Rest of World reports on a September 2026 study by the Coalition for Language Equity in AI Research, CLEAR. Across the top 20 languages, the most expensive one needed 1.5 to 5 times as many tokens as the cheapest, and across 200 languages the gap reached 17 times in one model that the article does not name. Script mattered as much as how widely a language is spoken: Burmese, Tibetan, Tifinagh, Khmer, Lao and Ol Chiki were at a disadvantage across nearly all models tested.

    Heat · HN: 22 points, 0 comments on Oct 26
    What people foundPratyush Choudhury, cofounder of Activate AI, wants every major lab to publish a language by language scorecard of the cost of completing comparable tasks. The study adds that more tokens also mean higher latency and less usable context, which hits hardest where compute and connectivity are already scarce.
    Learn it15 min · 4 steps

    Key ideas

    Tokenizer
    The component that splits text into the units a model reads and bills for, learned mostly from the data it was trained on.
    Tokenizer tax
    The extra tokens, and so extra cost and latency, a language pays for the same meaning compared with English.
    Context window
    The fixed token budget for one request, so a costlier language fits less history into it.

    Steps

    1. Read the Rest of World article first for the headline numbers and the script effect.
    2. Open the CLEAR page linked from the article to see who ran the study.
    3. Read the tiktoken README to see how an encoding turns a string into token ids.
    4. Self check: why can a widely spoken language still cost more tokens than a small language written in Latin script?
    Try it30 min · 5 steps
    You need: Python 3 and the tiktoken package; No API key needed

    Steps

    1. Install the tokenizer library with pip install tiktoken.
    2. Pick five sentences from your own product, such as UI strings or a support reply, and write each in English and in Japanese or another language your users speak.
    3. Load an encoding with tiktoken.get_encoding("o200k_base") and count len(enc.encode(text)) for every sentence.
    4. Compute the token ratio of each language to English and the average across the five sentences.
    5. Multiply your monthly English token usage by that ratio to estimate the cost and context impact for a localized launch.

    Small angles to try

    • Compare an older encoding with tiktoken.encoding_for_model("gpt-4o") and see whether the ratio changes.
    • Try a long system prompt in both languages and check how many turns of history still fit in your context budget.
  13. #13Tools & open source

    OpenHands SDK CVE-2026-112346: sandbox server exposed with no auth

    Before 1.52.0, the DockerWorkspace and Apptainer launchers in the OpenHands Software Agent SDK started the sandbox agent server reachable on all interfaces with an empty session API key list, so authentication was off by default. Anyone who could reach the published port could run shell commands as root in the sandbox, read the mounted workspace and pull plaintext secrets. The official fix, PR #5209, publishes Docker ports on 127.0.0.1 only and passes the configured session key to the client; the 1.52.0 release on Oct 5 does not label it a security fix, and the CVE details come from the VulnCheck advisory published Oct 26.

    Heat · CVE published Oct 26, rated CVSS 9.3 by VulnCheck and 9.8 under CVSS 3.1 on aggregators; no public PoC reported and no HN thread found
    What people foundThe patch went out three weeks before the CVE, so anyone who has not upgraded since early October is exposed. The fix only changes the host side of the Docker port mapping, so checking your running containers for a port bound to every interface is the quickest test.
    Learn it15 min · 4 steps

    Key ideas

    Binding to 0.0.0.0
    Listening on every network interface, so any machine that can route to the host can connect.
    Docker port publishing
    The host side of a mapping decides who can reach the container, and a mapping with an IP of 127.0.0.1 keeps it local to the host.
    Session API key
    The shared secret the OpenHands agent server checks on each HTTP and WebSocket request; an empty list means no check.

    Steps

    1. Read PR #5209 on GitHub first to see the before and after port mapping in the DockerWorkspace code.
    2. Read the VulnCheck advisory for affected versions, impact and credit.
    3. Skim the OpenHands docs page on the Docker sandbox to see how host_port is set in the examples.
    4. Self check: after the fix, the server still listens on 0.0.0.0 inside the container, so why is it no longer reachable from your LAN?
    Try it30 min · 5 steps
    You need: A machine where you run OpenHands, Docker, Python with pip; No API key needed for the checks

    Steps

    1. Check the installed workspace package version with pip show openhands-workspace and note whether it is below 1.52.0.
    2. With a sandbox running, list containers with docker ps and look at the PORTS column for the agent server port.
    3. A mapping starting with 0.0.0.0 or with no IP means the port is open on every interface; one starting with 127.0.0.1 is local only.
    4. Upgrade with pip install -U openhands-workspace, restart the sandbox and confirm the PORTS column now shows 127.0.0.1.
    5. Review your environment for a configured session API key so requests are authenticated even on localhost, and rotate any secrets that lived in an exposed sandbox.

    Small angles to try

    • Audit your cloud VM firewall or security group for the sandbox port range and close anything not needed.
    • If you use the Apptainer launcher, read its configuration for the bind address, since the public PR diff covers the Docker path.
  14. #14Tools & open source

    Thomas Dohmke's Entire launches a Git forge built for agents

    Entire, led by former GitHub CEO Thomas Dohmke, launched on Oct 26 as a Git forge for agents and humans working together. Its 'Trails' view replaces the classic PR page with eval scores recalculated on every push and independent review agents that each give a score and rationale, while Gates can block merges until approvals and CI pass. It also offers Git compatible hosting that can mirror GitHub, plus two open source, local first CLI plugins, entire-graph and entire-brain, for code maps and shared agent memory.

    Heat · HN: 55 points, 36 comments on Oct 26
    What people foundThe numbers are Entire's own: its forgemark chart shows 418 pushes per second for Entire against 65 for Cursor and 4.7 for GitHub, and it says entire-graph cut tokens by up to 71% in internal testing. The more practical claim is that mirrored repos keep serving clones and fetches during a GitHub outage.
    Learn it15 min · 4 steps

    Key ideas

    Git forge
    A hosted service around Git repos that adds review, CI and permissions, like GitHub or GitLab.
    Merge gate
    A rule that blocks merging until conditions such as human approval or passing CI are met.
    Code map for agents
    A precomputed index of symbols and relationships so a coding agent reads less of the repo to find what matters.

    Steps

    1. Read the Entire launch post for Trails, Gates, hosting and mirroring.
    2. Open the forgemark README to see what is measured: concurrent push or clone throughput and latency.
    3. Read the entire-graph README for what it indexes and that its analyzer runs locally.
    4. Self check: which of the launch claims are independently testable today, and which rest only on Entire's own benchmark?
    Try it30 min · 5 steps
    You need: A machine with Git 2.36 or later, a repo you own, and Claude Code or another coding agent; No API key needed for the local graph analysis

    Steps

    1. Read the install script first, then install the Entire CLI as the entire-graph README shows with curl -fsSL https://entire.io/install.sh | bash.
    2. Add the plugin with entire plugin install graph and confirm it with entire graph version.
    3. In your own repo, run entire graph init-agents --repo . and review what it writes to AGENTS.md and CLAUDE.md.
    4. Run entire graph health to check the index, then give your agent the same small task with and without the graph guidance.
    5. Compare tokens used and files read in the two runs and note whether the savings come close to the claimed figure.

    Small angles to try

    • Run forgemark only against a throwaway private repo on a forge you control, never against a shared host at scale.
    • Check entire graph capabilities --json to see whether your main languages get semantic parsing or only inventory support.
  15. #15AI in the world

    ChatGPT keeps sending tech support problems to 404 Media

    404 Media says it has received dozens of tips clearly written with AI in recent months, about banned Instagram and Meta accounts, Verizon service and more, often with chatbot made 'evidence dossiers'. In one case ChatGPT named reporter Jason Koebler, gave his tip address and drafted the email, and when the outlet asked senders how they found it, the answer was universally an AI chatbot, based on a handful of conversations it reviewed. The article includes no response from OpenAI, Meta or Verizon.

    Heat · HN front page, 247 points and 89 comments on Oct 26
    What people foundKoebler's reading is that big tech offers little real support and companies tend to respond to bad press, so chatbots have learned to tell users their problem is news. One Verizon complaint went to Koebler, three other 404 Media staff and seven outside outlets at once.
    Learn it15 min · 4 steps

    Key ideas

    Referral by assistant
    When a chatbot recommends a specific person, company or inbox, it sends real traffic there with no agreement from the recipient.
    Escalation path
    The route a user takes when normal support fails, which chatbots now help choose and draft.

    Steps

    1. Read the 404 Media article in full, noting the four example cases.
    2. List what the chatbot produced in each case: a recipient, a drafted email, or an evidence dossier.
    3. Look at your own product's public help pages and note how a chatbot would describe your support options.
    4. Self check: what in public web text could lead a model to suggest journalists over a company's own support channel?
    Try it30 min · 5 steps
    You need: A browser and a free chatbot account of your choice; No API key needed

    Steps

    1. Write three realistic support problems for your own product or service, such as a locked account or a failed payment.
    2. Ask a chatbot each problem as a frustrated user would and save the full answers.
    3. Record every person, company, email address or outlet the answers recommend contacting.
    4. Check whether your official support route appears and whether any recommended contact is wrong or outdated.
    5. Write a short fix list for your help docs so the correct route is easy for models and people to find.

    Small angles to try

    • Repeat with two more chatbots and compare which ones suggest the press or regulators.
    • Ask the chatbot to draft the complaint email and check whether it invents evidence or contact details.
  16. #16Models & launches

    VKORE-325M: a model pretrained on an inference only NPU matches a B200

    FINAL-Bench, credited to VIDRAFT's VKORE project, trained VKORE-325M-NPU-Base from random initialization on a commercial NPU sold for inference only. The 325.6M parameter byte level model saw 5.0B byte tokens of FineWeb-Edu over 76,292 steps in about four days. On 1,024 windows of an unseen shard it scored 0.7993 loss against 0.7994 for the same recipe on a B200 GPU.

    Heat · Hugging Face blog post from Oct 26; the model repo showed 14 likes and 49 downloads when checked
    What people foundThe paired difference was minus 0.0001 with a standard error of 0.0007, so the two runs are statistically indistinguishable. The catch, per the authors: the stability technique is in house and under patent application, the NPU is not named, and the training loop is not released, so only the weights and the evaluation can be checked.
    Learn it15 min · 5 steps

    Key ideas

    Byte level tokenizer
    Each token is one raw byte, so the vocabulary is just 256 entries and no tokenizer file is needed.
    Paired evaluation
    Both models are scored on the exact same text windows and the per window differences are compared, which removes noise from the choice of text.
    Inference only NPU
    An accelerator designed to run trained models, usually lacking the numeric range and memory features that training normally relies on.

    Steps

    1. Read the FINAL-Bench blog post on Hugging Face first, focusing on the evaluation table and the list of what is and is not released.
    2. Open the model card and note the architecture: 20 layers, hidden size 1024, grouped query attention with 2 KV heads, and a context of only 256 bytes.
    3. Look at the paired difference and standard error and work out why a difference far smaller than its standard error means no detectable gap.
    4. Compare the 0.7993 loss with the reported 1.1531 bits per byte and see that bits per byte is just the loss divided by the natural log of 2.
    5. Self check: what would you need from the authors before you could reproduce the NPU training run yourself?
    Try it30 min · 6 steps
    You need: Python with transformers and torch; a laptop CPU is enough for a 325M model; No API key needed

    Steps

    1. Install the libraries with pip install transformers torch.
    2. Load the NPU weights with AutoModelForCausalLM.from_pretrained("FINAL-Bench/VKORE-325M-NPU-Base").
    3. Encode a prompt as UTF-8 bytes and pass the byte values directly as token ids, as the model card shows, instead of loading a tokenizer.
    4. Generate about 200 new tokens with sampling and decode the output ids back into bytes.
    5. Load the GPU reference from the same repo with subfolder="b200_reference" and run the same prompt and seed.
    6. Compute the average loss of both models on a few paragraphs of your own text and compare the gap.

    Small angles to try

    • Run the repo's evaluate_unseen.py script and check whether you get the same 0.7993 and 0.7994 figures.
    • Feed Japanese or other multibyte text and see how quickly a 256 byte context runs out.
    • Measure generation speed on CPU versus a small GPU for a model of this size.
  17. #17AI in the world

    Brown student maps the data labeling supply chain behind AI

    Brown senior Cunyan Ma, working with the CNTR center led by computer science professor Suresh Venkatasubramanian, built a free interactive map linking 13 data labeling companies, 141 of their corporate customers and worker sites in 31 countries such as Kenya, Indonesia and Colombia. It combines existing databases including Data Work Landscape, her own collection of vendor delivery center locations, and news reports on working conditions. She calls the map illustrative, not comprehensive.

    Heat · Hacker News front page on Oct 26, 179 points and 171 comments
    What people foundDelivery centers are used as a stand in for where workers actually are, so read the map as a partial picture rather than a census. Venkatasubramanian sums up the point in a short phrase: "It's all humans underneath."
    Learn it15 min · 5 steps

    Key ideas

    Data labeling
    Human work such as tagging objects in photos, transcribing speech or rating chatbot answers, which produces the training and evaluation data for models.
    Delivery center
    A site where an outsourcing vendor's staff do the work for clients, used here as a proxy for worker location.
    RLHF rating
    People compare or score model outputs so the model can be tuned toward preferred answers, one of the labeling tasks the article lists.

    Steps

    1. Read the Brown University news article first for the scope, data sources and caveats.
    2. Open the interactive map and pick one labeling company, then follow its links to customers and countries.
    3. Visit Data Work Landscape, one of the source databases, to see how vendors and customers are catalogued.
    4. Note which task types the article lists, from tumor boundary marking to reviewing disturbing content for safety filters.
    5. Self check: why does using delivery center locations probably undercount where labeling work really happens?
    Try it30 min · 5 steps
    You need: A web browser and your own project notes or vendor list; No API key needed

    Steps

    1. Open the map and list the labeling vendors and customers that appear in it.
    2. Check whether any model provider, dataset or annotation vendor your team uses shows up as a node.
    3. For one dataset your team relies on, read its datasheet or model card and write down what it says about who labeled it and where.
    4. Write a short provenance note for that dataset covering vendor, worker location if stated, and task type, marking unknowns clearly.
    5. Share the note with your team as a starting point for a data supply chain question in vendor reviews.

    Small angles to try

    • Compare the countries on the map with the time zones your annotation vendor quotes for turnaround.
    • Draft three questions about pay and content exposure to ask a labeling vendor before signing.
    • Check whether an open dataset you use documents annotator pay or recruitment at all.
  18. #18Trends × tech

    New iPad mini × local AI: Apple pitches the OLED mini for local LLMs

    Apple announced a new iPad mini with an 8.5 inch OLED display and an A20 Pro chip, priced from 119,800 yen in Japan, with preorders on Oct 29 and sales on Nov 6. Apple credits its 7 core GPU with up to 4.5 times the previous model's AI performance and says the chip can run on device models in creative apps and local LLMs.

    Heat · "ipad mini" on Google Trends Japan's trending list with 20K+ searches on Oct 27
    What people foundThe neural hardware depends on storage tier: the 512GB model gets a dual 16 core Neural Engine and a 6 core CPU, while the 128GB and 256GB models get a single 16 core Neural Engine and 5 cores. Impress Watch's report gives no RAM figure, and for local LLMs memory decides which models fit, so wait for that number before planning around it.
    Learn it15 min · 5 steps

    Key ideas

    Neural Engine
    Apple's dedicated block for running neural network inference efficiently, separate from the CPU and GPU.
    Unified memory
    CPU, GPU and Neural Engine share one pool of RAM on Apple chips, so total RAM caps the size of a model you can load.
    Quantization
    Storing model weights with fewer bits, for example 4 instead of 16, so a model needs roughly a quarter of the memory.

    Steps

    1. Read the Impress Watch article first and note which spec belongs to which storage tier.
    2. Separate measured facts from vendor claims: the 4.5 times figure is Apple's and is attached to the GPU.
    3. Learn the rule of thumb that weights take about parameters times bits divided by 8 bytes, plus room for the KV cache.
    4. Apply it to a 3B and an 8B model at 4 bit and see how much RAM each would need.
    5. Self check: why does the missing RAM figure matter more for local LLMs than the Neural Engine count?
    Try it30 min · 5 steps
    You need: A spreadsheet or a short Python script; no hardware purchase; No API key needed

    Steps

    1. Pick three open weight models you might ship on a tablet and write down their parameter counts from their model cards.
    2. Compute weight memory at 16, 8 and 4 bits for each model.
    3. Add an estimate for the KV cache at your target context length using each model's layer count and hidden size.
    4. Mark which models would fit under several plausible RAM sizes, leaving headroom for the OS and your app.
    5. Write down the minimum RAM your app would need and check it against Apple's spec page once RAM is published.

    Small angles to try

    • Repeat the sizing for an image model instead of a text model.
    • Compare your table with a device you already own and test whether the predicted fit holds.
    • Estimate how context length changes the answer for a chat feature versus a summarizer.
  19. #19Trends × tech

    Hobby image generation × Japanese text: free MOSS-Image test hits top 5

    An ASCII.jp column by Shin Kiyoshi, published Oct 26, tries MOSS-Image, a 5B parameter open weight image model from Shanghai's OpenMOSS team released Oct 16 under Apache 2.0. He used GPT-6 Astra to write prompts fixing text placement and layout for a fictional autumn travel poster, in a photoreal version and then a flashier anime version. He found that it renders Japanese text fairly crisply, and made the article's header image with MOSS-Image plus a LoRA of his own.

    Heat · No. 5 in ASCII.jp's access ranking for Oct 20 to 26, one of two AI items in the top 10; the MOSS-Image-SFT repo on Hugging Face showed 755 likes
    What people foundFor Japanese hobbyists the test is whether a model can put correct kana and kanji on a poster, and a free model that passes gets read even without benchmarks. The official model card only tags English and Chinese, so Japanese quality is the columnist's observation, not a vendor claim.
    Learn it15 min · 5 steps

    Key ideas

    Diffusion transformer
    An image generator that removes noise step by step using a transformer; the 5B figure refers to this part.
    Text encoder
    A separate language model that turns the prompt into vectors the image model follows, often a large share of the download.
    LoRA
    A small add on set of weights trained to steer a base model toward a style or character without retraining the whole model.

    Steps

    1. Read the ASCII.jp column first, looking at the sample posters and how the layout prompt was built.
    2. Open the MOSS-Image-SFT model card on Hugging Face and note the license, the hardware notes and the default sampling settings.
    3. Skim the OpenMOSS GitHub repo for the pipeline code and the ComfyUI plugin.
    4. Compare how the column used one language model to write prompts and another model to draw them.
    5. Self check: why could a model render Chinese well but still make mistakes on Japanese kana?
    Try it30 min · 5 steps
    You need: NVIDIA GPU with CUDA, Python 3.10 or later, PyTorch 2.9 or later, and a large download; or just a browser for the hosted Space; No API key needed

    Steps

    1. Try the hosted Hugging Face Space first with a short poster prompt that includes a Japanese headline.
    2. For a local run, install the libraries with pip install "diffusers>=0.38" "transformers>=5.3" "accelerate>=1.10" "safetensors>=0.6" "Pillow>=10".
    3. Load OpenMOSS-Team/MOSS-Image-SFT with DiffusionPipeline.from_pretrained, passing custom_pipeline="pipeline_moss_image" and trust_remote_code=True as the model card shows.
    4. Generate the same poster with a headline in kana, one in kanji and one in English, using a fixed seed.
    5. Check each image for wrong, missing or invented characters and keep a simple score per script.

    Small angles to try

    • Ask a chat model to write a structured layout prompt, then compare it with a plain one line prompt.
    • Lengthen the Japanese text step by step and find where rendering breaks down.
    • Compare results from the Base and SFT checkpoints on the same prompt.
  20. #20Research

    Skill∞: an agent that rewrites its own skill optimizer beats human skills

    Skill∞, from Wangcheng Tao, Zhanglu Yan, Han Wu and Weng-Fai Wong, uses a meta agent that follows a meta skill to optimize task skills and then applies the same procedure to improve the meta skill itself. On 83 SkillsBench tasks it reaches a 60.7% pass rate, against 56.4% for human curated skills and 54.5% for SkillEvolver. The paper went to arXiv on Oct 26 with no code link.

    Heat · New arXiv paper submitted Oct 26; no engagement signal seen yet
    What people foundA gain of about 4 points over human written skills is modest, but both levels are standard skill packages loaded through native skill discovery, so the result maps onto how teams already ship SKILL.md files. Without released code it cannot be reproduced yet.
    Learn it15 min · 5 steps

    Key ideas

    Agent skill
    A reusable package of instructions and files an agent loads when a task needs it, such as a SKILL.md folder.
    Meta skill
    A skill whose job is to improve other skills, here by reading execution traces, proposing edits and requesting reviews.
    Recursive self improvement
    A system that also improves the process it uses to improve itself.

    Steps

    1. Read the arXiv abstract for Skill∞ first and list the four things the meta agent does: diagnose traces, propose candidates, request reviews and allocate search budget.
    2. Skim the SkillsBench README to see what a task and its oracle look like.
    3. Compare the three pass rates and note that the baseline is human curated skills, not no skills at all.
    4. Think about why reusing one meta skill across tasks is cheaper than relearning it per task.
    5. Self check: what would you need to verify before trusting an automatically tuned skill in production?
    Try it30 min · 6 steps
    You need: Git, uv, Docker for a local sandbox, and an Anthropic or OpenAI API key for agent runs; the oracle check alone needs no model key

    Steps

    1. Clone the SkillsBench repo and enter it with git clone https://github.com/benchflow-ai/skillsbench.git and cd skillsbench.
    2. Install the tooling with uv tool install benchflow and uv sync --locked.
    3. Validate one task with bench tasks check tasks/offer-letter-generator.
    4. Run the oracle locally with bench eval run --tasks-dir tasks/offer-letter-generator --agent oracle --sandbox docker, since the README says the oracle must pass first.
    5. Write a small SKILL.md for that task by hand, run your agent with and without it, and record the pass result.
    6. Edit the skill once based on the failed trace, mimicking the diagnose and propose loop, and rerun.

    Small angles to try

    • Ask a model to rewrite your skill from the trace and compare it with your own edit.
    • Try the same skill on a second task to see whether improvements transfer.
    • Track token cost per run to see what an optimize loop would cost at scale.

Get the Radar by email

One email each evening, Japan time, with that day's items. Opening soon: leave your email and we'll send a confirm link when it starts.