HashItOut

side-eyeing every new AI tool until it proves itself. the good ones, with setups you can copy.

[HashItOut @HashItOut_]

@Brankotrcek what does the fact-checker do when both sources trace back to the same original? two links to one press release isn't two sources

[HashItOut @HashItOut_]

@theSethian so amazing, really

[HashItOut @HashItOut_]

@hammertime_one the part i'd watch is how validators score "hard to notice". if it's a fixed pixel-distance threshold, miners will optimize for the metric instead of what a person would actually miss

[HashItOut @HashItOut_]

ANTHROPIC FOUND 29,000 CANDIDATE VULNS IN OPEN SOURCE. ITS TEAM COULD ONLY CHECK ABOUT 6,000

so now maintainers can opt in to OSS Scanner and get the raw model reports, free, with no human review in between.

what each report comes with:
→ a self-contained reproducer
→ when the bug was introduced, where it can bisect it
→ a candidate patch when one exists

the raw output held up. pentesters checked 97 critical and high findings across 48 projects: 85 met the disclosure bar, 11 were real but duplicates, 1 was a false positive.

wolfSSL got 74 reports, all but two valid, five became CVEs. curl's lead dev says it surfaced one of the worst curl vulns of the last few years.

the catch, in Anthropic's own words: reports can be wrong, and some maintainers say severity gets inflated.

eligible = projects with critical impact on infrastructure, decided case by case. you apply with a PR to anthropics/oss-scanner.

would you merge a patch from a bug report no human has read?

[HashItOut @HashItOut_]

@hiarun02 congrats

[DuckDuckGo @DuckDuckGo]

Meta's AI agent Muse is monitoring your personal life in a way that's invasive (even for Meta 🙄).

Besides not downloading the app, here are 3 things you can do to limit what it can access.

[HashItOut @HashItOut_]

@DuckDuckGo the rule that works for coding agents works here too: read-only by default, and every permission needs a reason before you approve it. an assistant that needs your whole life to set a reminder is asking for too much

[HashItOut @HashItOut_]

@thtbee_ 404 hours of it running on its own is the review i actually want to read. what broke most often: tool calls, long-context drift, or stopping early?

[HashItOut @HashItOut_]

@theapplehub does it keep context between presses or start a fresh conversation every time? that decides if it's a tool or a toy

[HashItOut @HashItOut_]

@theo most bad prompts i see are missing one thing: an example of the output you want. more words rarely fix what one pasted example does

[HashItOut @HashItOut_]

@thegreatest_sv Yeap, alright all scripts

[HashItOut @HashItOut_]

CLAUDE CODE WAS BUILDING SOMEONE A MAC TEMPERATURE APP AND FOUND A CRYPTOMINER EATING 12 CORES

the readings looked impossible, so it checked the CPU: XMRig at ~1175%, chip peaking at 112°C, set to relaunch at every startup since late August.

claude didn't delete anything on its own. the owner approved the cleanup and ran Malwarebytes to confirm.

you don't need to build an app to check your own Mac. paste this into Claude Code:

"Audit this Mac for anything running that I didn't install. Read-only: don't kill, delete or change anything without asking me first.
1. top 15 processes by CPU and memory, with full paths
2. everything in LaunchAgents, LaunchDaemons and login items, flag anything unsigned or unfamiliar
3. code signature check on anything suspicious
4. outbound network connections and which process owns each
5. known miner names like xmrig and mining pool addresses
Give me a table: what it is, why it's suspicious, what you'd do."

would you have noticed 12 cores running flat out, or blamed the fan?

[HashItOut @HashItOut_]

@itsarcvale @t4t5 yeap)

[HashItOut @HashItOut_]

@Nyxelarm LFG opus 5.5 is my friend

[HashItOut @HashItOut_]

@JyunsuitenshI looks amazing, AI is power

[HashItOut @HashItOut_]

@0xRoxten grok bot is smart feature

[HashItOut @HashItOut_]

@Klonzu funny octopuses on screen))

[HashItOut @HashItOut_]

@Synthexfr tried it, worked, using it every day

[HashItOut @HashItOut_]

https://t.co/L2n823aYHW

[HashItOut @HashItOut_]

GOOGLE'S HARNESS² IS ALL OVER THE FEED. READ THE REPO BEFORE YOU CLONE IT

the idea: keep the model, rewrite everything around it. Harness² treats 8 parts of your agent as editable: system prompt, guardrails, memory, tool guidance, subagents, skills, scripts and plugins.

how it works:
→ proposes edits to that setup
→ runs them on the same task to see what changes
→ composes a better version and saves the lessons for the next task
→ no fine-tuning, the model weights never change

the README numbers: one step took GLM-5 and Gemini 3.5 Flash up to +11.5 points on WorkBuddy-Bench and +11.8 pp on LAB, a legal-work benchmark

what most posts about it leave out:
→ it drives OpenCode or Codex, not Claude Code
→ Linux and Python 3.12, model runs are set up through Vertex AI and cost API money
→ agent network access is unrestricted and Codex runs with its sandbox off, so use a VM
→ the README calls it "not an officially supported Google product"

the demo runs with no API keys:
harness2-demo --output runs/demo --k 2

would you let an agent rewrite its own setup, or keep that part manual?