Models are reading weights, and tools are taking apps apart

Spend 1% of your day keeping up with tech.

Quote of the Day#

“Original games, genre games, and games built from your own designs and assets are meant to keep working.” — Addy Osmani, Anthropic, on the change to Claude Code’s system prompt (source)

“Software is full of this blabber where words mean nothing.” — Chalmovsky, author of “WTF Ubuntu?” (source)

Today’s Theme#

Today was all about taking things apart. Rikiyat handed GPT-6 Astra nothing but raw weights, and it figured out which game each of four small PPO networks had learned. Then it tweaked about 0.016% of Qwen3.5-0.8B’s weights and pushed MATH-500 from 7.9% to 48.1%. Over in Estonia, Rasmus Moorats just wanted his 2014 Renault’s clock on UTC+2. He ended up building a QEMU emulator and getting root through Linux’s core_pattern. Craft Anything picked up 3,821 GitHub stars in three days: it points 314 tools at a website, app or game, then has a coding agent rebuild it. levelsio says he used Claude Code to decompile Battlefield 1942’s C engine and get it running in the browser. And that same week, Anthropic slipped two sentences into Claude Code’s system prompt saying don’t recreate specific existing games. Figuring out how something works has gotten really cheap. The part I keep thinking about is what comes after: once it’s in pieces, what are you allowed to rebuild, and what should you leave alone?

Must Read#

GPT-6 Astra edits Qwen’s weights by hand, changes 0.016% of them, and math scores jump 6x — Hacker News AI
He just wanted to fix the clock and ended up rooting his 2014 Renault’s whole head unit — Lobste.rs Security
Follow-up: CVE-2026-98432 has been public for over two weeks and Ubuntu still hasn’t fixed it, so one admin shut all his servers down — Hacker News Security
Figma’s PMs turned their Claude Code setups into one shared repo: 31 skills, used by 60 to 70 PMs — Lenny’s Newsletter AI
Craft Anything: study how a website, app or game works, then tell an agent to rebuild it — GitHub Tools
Google’s October AI recap: Gemini 4 Argon is live, and two weeks later Carbon was announced — Google AI AI
R²Orch: an agent orchestrator that makes up its own tasks, drops its own skills, and ships with none — HuggingFace Papers Research
Subvocal: voice input without making a sound, glasses that turn the words you silently mouth into text — Hacker News Product
Don’t trust agent autonomy too much: how Fliggy, Lalamove and Jiangsu Mobile drew the lines after going live — InfoQ 中文 AI
FrameForge: using a video model’s sense of “time” to edit images — HuggingFace Papers Research
Apple Intelligence comes to China with iOS 27.3, and Siri can ask Qwen for help — 少數派 Product
Anthropic added two sentences to Claude Code’s prompt: don’t recreate a specific existing game — The Verge AI

1. GPT-6 Astra edits Qwen’s weights by hand, changes 0.016% of them, and math scores jump 6x #

12 min · Research · Hacker News

Why you should care: If one model can read and edit another model’s weights directly, a lot of what we think we know about fine-tuning and interpretability is up for grabs.

The author calls it “Weight-Space Programming”: a general-purpose LLM reads and writes weights directly, no gradient descent involved. First test: he gave Astra the weights of four game networks with the same architecture, all trained with PPO, and no list of possible answers. It named all four games. Second test: three DDPMs that draw circles, triangles and squares. Looking only at the weights, Astra drew the right shapes, though every one came out as a hollow outline, which the author takes as a sign it was reading the structure of the weights rather than simulating a forward pass. The third test is the one everyone’s talking about. No gradients allowed, just make Qwen3.5-0.8B better at math. Astra found the spot in the weights that sends the model into reasoning loops (the Qwen model card even warns about this), changed 0.016% of the weights, and MATH-500 went from 7.9% to 48.1%. IFEval tripled too.

In one setup Astra only got the middle four transformer blocks, with the input and output layers stripped off, and still had to work out whether this 7.2M-parameter model had learned Python, romanized Japanese or English
Astra never wrote a training loop. The author calls it “reasoning-driven optimization” and is clear that it isn’t just automated fine-tuning

What people are saying: A highly upvoted HN comment from vessenes: “If you’d asked me this morning whether LLMs understand their own weights worse than humans understand neurons, I’d have said about the same or worse.” (thread)

My take: It was the top story on HN today, with 1,395 points and 441 comments. If this holds up, fixing a small model might not need another training run at all. Still, it’s early results from one team, and I haven’t seen anyone else reproduce it yet.

2. He just wanted to fix the clock and ended up rooting his 2014 Renault’s whole head unit #

15 min · Reverse-engineering log · Lobste.rs

Why you should care: If your app has a setting that only loads from an external file, here’s how one annoyed user got around it.

The author drives a 2014 Renault Latitude. Daylight saving ended, he wanted to switch the time zone from UTC+3 to UTC+2, and the settings menu just wouldn’t open. Once he dumped the firmware, he found out why: the TomTom Carminat LIVE head unit loads the settings menu definition from the navigation SD card, so with no card it has no idea how to show the settings screen. And that card is locked to its CID with signature DRM, so you can’t copy it. A third-party card shipped to Estonia would run about 60 euros, so he did it himself. He built a Linux 2.6.28 emulator in QEMU, hit a 40-byte signature on the update image, and got around it: he used the LOG command in master.script to write a string into /proc/sys/kernel/core_pattern, then deliberately made dbus-monitor fail to connect to the system bus so SIGABRT triggered a coredump and ran his own script as root. Finally he found the time zone offset in /mnt/flash/settings.dat and changed it to UTC+2.

The head unit uses a Samsung S5P6440 SoC, and the system is TomTom’s modified Linux 2.6.28.10
The first thing he did after getting root was back up the whole eMMC with dd

My take: Using core_pattern as a stepping stone to root is a classic kernel-exploit trick. He pulled it off on a 12-year-old head unit and wrote down every step. If you’ve ever wanted to get into embedded reverse engineering, this is a great one to follow from start to finish.

3. Follow-up: CVE-2026-98432 has been public for over two weeks and Ubuntu still hasn’t fixed it, so one admin shut all his servers down #

3 min · Commentary · Hacker News

Why you should care: If your backend runs on Ubuntu VMs (the default at a lot of VPS providers), this 9.8-severity remote hole is still open.

Back in EP229 we covered Atlas Security’s technical write-up of CVE-2026-98432. This is the view from the user’s side, written the day after. The author says this Linux TCP bug has existed since 2016, scores 9.8 on CVSS, can be triggered remotely, and Anthropic has said it built an exploit that gets root. Debian fixed it on October 16, but as of 14:48 UTC on November 2, every supported Ubuntu version (LTS included) was still marked “Vulnerable”. He puts that next to the line on Ubuntu’s own site promising “timely patches for critical vulnerabilities”. He couldn’t migrate in time, so he just took every Ubuntu server he had offline.

The author points out that volunteer-run Debian, Arch and Alpine all fixed it, while Canonical, which sells a security subscription, hasn’t
levelsio reposted it on X and said he might move all his servers to Debian (1,433 likes, 100k impressions); the day before, his interim advice was to turn off MPTCP and not expose public ports

What people are saying: Discussion on X: levelsio “So @Ubuntu still hasn’t patched this open hole…” 1,433 likes, 84 reposts (post); his advice from the day before, “VPS ports all closed”, got 4,202 likes (post)

My take: 1,186 points on HN. If you run your own servers, I wouldn’t sit around waiting for the patch. Take ten minutes today to check which ports your VMs expose and whether you can put them behind Tailscale or a Cloudflare Tunnel.

4. Figma’s PMs turned their Claude Code setups into one shared repo: 31 skills, used by 60 to 70 PMs #

about 35 min · Podcast · Lenny's Newsletter

Why you should care: If you build products on your own, “turn the repetitive stuff into skills and keep them in a repo” is an idea you can steal today.

Figma growth PM Ezra Mechaber says his goal is “to be lazy in the right places”. When he joined, almost nobody outside engineering used AI for real work, so he and a few other PMs gathered their individual Claude Code setups into PM OS, a shared repo with 31 skills that every Figma PM now uses. On the show he demoed a few things: a skill that runs six times a day to tidy up Slack, an agent that runs bug bashes with Codex, and AutoXP, an automated growth-experiment system with a single human checkpoint. He says AutoXP found a large win in its very first experiment.

PM OS is deliberately a repo, not a product; skills, hooks and private sub-repos keep 60 to 70 PMs in sync
It later moved from the terminal to a local web front end, so PMs who aren’t comfortable with the CLI can use it too

My take: I’ve been turning my own workflows into skills one at a time, so watching Figma scale that to dozens of people hit home. What they got right was putting it all in one repo. If everyone hoards their own prompts, nothing spreads.

5. Craft Anything: study how a website, app or game works, then tell an agent to rebuild it #

repo · 3.8k stars · Rust · GitHub

Why you should care: If someone wants to spend an afternoon cloning your app’s UI, this tool pretty much turns that into one button.

Craft Anything is an open-source engine written in pure Rust, created on October 31 and already at 3,821 stars today. It works in four steps: Study observes the original with real inspection tools, and for websites it screenshots at three screen widths for comparison; Build tells a coding agent to rebuild it with the tech stack you pick; Check lists where it differs from the original; Ready lets you open or play the result and ask for changes. There are 314 tools in total, each both a CLI command and an MCP tool. It defaults to “clean room” mode, which looks only at what a visitor can see (screens, text, layout and fonts) and never touches the original’s code; only Deep mode reads code and disassembles (it can connect to Ghidra), and the README says that mode is for private use only.

The build side supports Claude Code first, using the user’s own claude binary and login; a Codex adapter exists but hasn’t been verified in a real environment
ACP agents such as Gemini CLI, Qwen Code and opencode can plug in, but only Maki has actually been run

My take: The clean-room vs. Deep split lines up almost perfectly with Anthropic’s new limits on game clones this week. The tool doesn’t pick a side. How far you take it is on you.

6. Google’s October AI recap: Gemini 4 Argon is live, and two weeks later Carbon was announced #

6 min · Official roundup · Google AI

Why you should care: If you build with Flutter or Firebase, Gemini is the model sitting right next to you, and this post puts everything that shipped this month in one place.

Google rounded up its October AI updates. The frontier reasoning model Gemini 4 Argon launched worldwide after safety testing, in Google AI Studio, the Gemini API, Google Cloud, Search and the Gemini app, with a robotics version as well. Two weeks later Google announced Gemini 4 Carbon, aimed at long-horizon engineering and cyber defense, now available only inside the Fairwind Program for US government and select cyber defenders to test first. Also covered: Genie 4, a real-time interactive world simulator (with native audio), the Fitbit Edge band, and the SynthID Detector opening worldwide in English.

SynthID has now watermarked more than 180 billion images and videos, plus 240,000 years of audio
Carbon is rolling out in stages, and general developers can’t get it yet

My take: Argon is what you can actually use today. Carbon is going to take a while. The SynthID numbers are worth reading next to iOS 27.2 picking up SynthID and the xAI API adding watermarks (both in Chinese Tech Scene).

7. R²Orch: an agent orchestrator that makes up its own tasks, drops its own skills, and ships with none #

10 min · Paper · HuggingFace Papers

Why you should care: Everyone’s busy adding skills to their agents. This paper flips it around: which skills could you remove without anyone noticing?

R²Orch trains an orchestrator through recursive self-play. The inner loop has the orchestrator play against itself on tasks chosen by a Proposer, and the outer loop improves how the inner loop learns. The Proposer earns its reward by picking tasks where results still diverge after a skill is removed; if a controlled evaluation shows that removing a skill doesn’t change performance, that skill is withdrawn, which they call Skill Withdrawal. Failures are distilled into skills, skills are internalized into parameters, and the whole process heads toward zero-skill deployment.

In zero-skill tests, the 9B orchestrator ranks first on all 12 benchmarks, with in-distribution averages of 86.0 to 89.8 and out-of-distribution of 76.1 to 78.8
AIME 2026 goes from 74.0 to 81.3; the code is on GitHub (10 stars so far)

My take: 86 votes on HF Daily Papers. If skills end up baked into the model, the skill files we’re writing now are basically scaffolding. You take it down once the building’s up.

8. Subvocal: voice input without making a sound, glasses that turn the words you silently mouth into text #

5 min · Product launch · Hacker News

Why you should care: Voice input is awkward in an office or a library, and this product is built for exactly that: no sound at all.

The Subvocal Company (YC F26) has two founders, Aarush and Arnav, who were computer science students at Georgia Tech earlier this year and had never worked on silent speech or sensing before. Heavy Wispr Flow users, they couldn’t stand not being able to use voice input in libraries and offices, so in February at Stanford TreeHacks they decided to build “the most technically absurd thing”, modeled on MIT Media Lab’s AlterEgo. The result is a pair of smart glasses that uses RF to sense movement inside the mouth and decodes silent mouth shapes into text at speaking speed. The founders added that the system can be fine-tuned for “mouthing with your mouth closed”, so the lips don’t have to move.

429 points and 243 comments on HN; the post includes a video of YC’s Dave trying it
A highly upvoted comment asks “do most people really talk faster than they type?”, and someone posted an open-source version, subvox

What people are saying: HN commenter avree: “Do most people talk faster than they type? I’m the opposite.” (thread)

My take: I use voice input a ton, but it falls apart in shared spaces, so I’m watching this category closely. The AI on the other end keeps getting better. Getting your words into it is the bottleneck now.

9. Don’t trust agent autonomy too much: how Fliggy, Lalamove and Jiangsu Mobile drew the lines after going live #

15 min · Panel recap · InfoQ 中文

Why you should care: Before you let an agent anywhere near payments or a database, read what actually went wrong at four companies.

InfoQ’s livestream brought together Wang Fang, CTO of NoDesk AI; Lü Detao, algorithm expert at Fliggy; Qi Longji, technical director at Lalamove; and Wang Shangqi, AI CTO at Jiangsu Mobile. The four agreed on most things: business needs determinism, models can’t offer it by nature, so uncertainty has to be fenced inside clear boundaries. Fliggy lets the model understand the request, hands ticket combinations and total prices to a solver, swaps hotel and room-type IDs for short IDs and fills them back in later, and always asks the user to confirm whenever money is touched. Wang Fang described a case where a leading apparel client’s internal agent had no concurrency limit and knocked over an internal database interface, affecting production for more than half an hour.

“Use rules for the critical steps, and use AI only to describe and generate the rules”, so that when something goes wrong you can find the cause and roll it back
Wang Shangqi said an agent error once dragged down their whole production environment, so beyond DDoS they now also guard against an agent accidentally exhausting resources

My take: Money math goes to a solver, the model never sees raw IDs, and anything involving payment gets one more confirmation. These are concrete enough that I’m copying them straight into my own agent design checklist.

10. FrameForge: using a video model’s sense of “time” to edit images #

8 min · Paper · HuggingFace Papers

Why you should care: A lot of apps’ AI features boil down to image editing and keeping the subject intact, and this paper does it on a completely different kind of base model.

FrameForge starts from this idea: in conditional image generation, how far the “input image” is from the “target image” depends on the task, and pretrained video models have already learned visual change across different time scales. It builds two components. Mixture of Temporal Experts (MoTE) dynamically picks RoPE experts for different virtual time intervals to express how far the target is from the input. Chain of Temporal Reasoning (CoTR) adds a latent intermediate state plus a reasoning-bottleneck attention mask to simulate how the input turns into the target step by step.

On DreamBench, COCO2017 and GEdit-Bench, it beats the compared methods on subject-preserving generation, canny-to-image and image editing
111 votes on HF Daily Papers, the highest today

My take: If video models can be the base for image models, image editing should get better every time video models do. No need to change anything in your app today. Just know the APIs you call are going to improve.

11. Apple Intelligence comes to China with iOS 27.3, and Siri can ask Qwen for help #

5 min · News · 少數派

Why you should care: iPhones in China are getting system-level AI, so if your app is there, people will start comparing it with what’s built in.

Apple announced on October 31 that the first batch of core Apple Intelligence features is coming to China: system writing tools, photo cleanup and natural-language search, Genmoji, mail and notification summaries, and live translation in messages and calls. Siri supports continuous conversation and typing, and hands complex questions to Alibaba’s Qwen. It opens in the developer beta on November 4 and ships officially in December with iOS 27.3. The same morning brief also cited the Wall Street Journal: flash memory prices rose 5x in a year, and TechInsights estimates Apple’s 2026 flash purchases at $25 billion, against $6 billion for the same volume in 2025.

Supported devices are iPhone 16 and later, iPhone Duo, iPhone Air and iPhone 15 Pro, with the language set to Simplified Chinese or English; the new-generation Siri announced at WWDC 2026 is not included this time
The iPhone 18 Pro goes from 256GB to 512GB, flash cost rises from $15 last year to $66, and the price increase is still $200

My take: Come December, users in China get summaries and translation for free in the OS. If your app does something similar, think hard about what the system can’t do. The flash prices also explain why Apple raised prices across the board this quarter.

12. Anthropic added two sentences to Claude Code’s prompt: don’t recreate a specific existing game #

3 min · News · The Verge

Why you should care: If what you’re building with Claude Code “looks a lot like some existing product”, it might start getting blocked.

The Verge, citing a Tom’s Hardware report: users on X noticed two new sentences in Claude Code’s system prompt: “Do build original games, games in a genre, and games from the user’s own designs and assets. Don’t build a recreation of a specific existing game, even if it is named or called original.” Anthropic’s Addy Osmani didn’t confirm the exact wording but acknowledged that two sentences were added to the Opus 5.5 Claude Code prompt, because using Claude to infringe intellectual property violates the usage policy. He said original games, genre games and games built from your own assets should all work as before, and anyone wrongly blocked can contact him directly.

The background is a recent flood of AI-decompiled, recompiled and ported work in the retro gaming scene
The Verge asked whether other Claude system prompts will change too, and has not received a reply

What people are saying: Discussion on X: levelsio “I may or may have not just decompiled Battlefield 1942’s raw C engine with Claude Code” 964 likes, 137k impressions (post)

My take: Same week, levelsio decompiled Battlefield 1942 with Claude Code (964 likes) and Craft Anything is pitching “rebuild anything”. Model makers are starting to draw lines right in the prompt, and my bet is the next line covers apps and websites.

Also Worth a Look#

Google Earnings, Facebook Déjà Vu, The Agent Play — Stratechery (paywalled, only the intro was visible, downgraded)
DeepSeek open-sources Super-Agent, a coding agent that picks up work nobody assigned it, but by default only logs instead of acting — TechOrange (dsh-superagent already covered in EP229, downgraded as a cross-day duplicate)
TLDR AI: DeepSeek super agent, GPT-6 Rosalind, Google orbital compute — TLDR AI (aggregator newsletter)
SpaceX reportedly wants to buy Boost Mobile — TechCrunch
Elon Musk throttles Grok Bot limits due to ‘unsustainably high’ costs — TechCrunch (see Builder Radar)
OpenAI is finally merging ChatGPT’s Chat and Work tabs — TechCrunch
Ford launches a ‘privacy promise’ and explains how and why it uses customer data — TechCrunch
Introducing the Grid Protectors Program — OpenAI
Meta will end Quest 2 OS updates in 2027 — The Verge
Germany says lawmakers’ iPhones may have been hacked with spyware — TechCrunch
Vercel MCP now renders deployments as an interactive card — Vercel Blog
Show HN: I’ve updated my Linux System Call website and API — Hacker News

Builder Radar#

1. Firebase AI Logic now requires App Check, starting today #

2 min · Policy

Why you should care: If your app calls Gemini through Firebase AI Logic, any request without App Check is going to start bouncing.

The official Firebase account posted on November 2 (22 likes · 3.5k impressions) that App Check enforcement is now mandatory for Firebase AI Logic. The official security checklist lists what attestation each platform uses: Apple uses DeviceCheck, App Attest or reCAPTCHA Enterprise, Android uses Play Integrity, Web uses reCAPTCHA Enterprise, and Flutter and Unity are also supported. Setups created through the console onboarding flow after July 2026 are already enforced automatically; projects created earlier have to turn it on themselves.

What this means for your app: If your Flutter app calls Gemini straight from the client, go check App Check in the Firebase console today, and set up the debug provider for local dev. Otherwise your generation features could just stop working in production one morning.

2. RevenueCat: about half of Black Friday’s new paying users were installs more than 3 months old #

10 min · Data study

Why you should care: Year-end sales are coming up, and this study helps you figure out who the discount is actually for.

RevenueCat’s full study looked at data from nearly 5,000 subscription apps during the 2025-26 holiday season. Apps that ran a Black Friday promotion got more new paying users and higher 6-month revenue; unit price was a bit lower, but volume made up for it. About half of that growth came from people who had installed the app more than three months before their first payment. Apps that only promoted at Christmas showed no clear advantage. Apps with a New Year promotion saw 14% more new paying users per day than their September-October baseline, while those without one saw 4% fewer. Health and fitness and games stayed above baseline from New Year through January (11% and 10% higher respectively).

What this means for your app: For fitness apps (like HerFIT), New Year is the big moment, and Black Friday matters less. For utility apps, try a Black Friday annual-plan deal aimed at free users who are already in the app. That beats paying for new traffic.

3. Someone on X distilled RevenueCat’s 338-page subscription report into the five numbers most worth acting on #

3 min · Data summary

Why you should care: Paywall type, trial length and Google Play billing failures are all things you can change this week.

Will Wang on X summarized RevenueCat’s subscription benchmark report, which covers 115,000 apps. Hard paywalls convert at 10.7% by day 35 against 2.1% for freemium; revenue per install at day 60 is $3.09 versus $0.38, yet one-year retention is about the same (27% versus 28%). For 3-day trials, 55% of cancellations happen on day 0; trials of 17 to 32 days convert at 42.5%, against 25.5% for trials under 4 days. On Google Play, 31% of cancellations are billing failures, against 14% on the App Store. These numbers are his retelling, and I haven’t checked them page by page against the original report.

What this means for your app: If a lot of your users are on Android, fix Play billing failures first (grace period, retry reminders). That might win back revenue faster than any new feature. And remember, most conversion gets decided the very first time someone opens your app.

4 min · News

Why you should care: What your monthly AI subscription actually buys you is being redone.

iThome reports that OpenAI plans to have Chat, Work and Codex under ChatGPT Plus, Pro and Business share one token-based allowance starting in December, with ordinary chats in Instant mode not counted; the size of the new allowance and the effective date have not been announced. TechCrunch reports that Musk has lowered Grok Bot’s usage limits, saying in a reply to a user that the cost of the service relative to revenue is “unsustainably high”, with no word on future limits.

What this means for your app: If you lean on coding agents every day, check your usage before December. Keep one or two other tools around to rotate in, so hitting a limit on one doesn’t stop your whole day.

5. Flutter 3.47.9 fixes flutter test crashing in monorepos; Firebase also lands in the Antigravity Marketplace #

2 min · Release

Why you should care: If your Flutter project uses pub workspaces or a monorepo, your tests should stop crashing over path issues.

The official Flutter account (25 likes) released stable 3.47.9, which fixes the native assets issue flutter/192933 (see the CHANGELOG), so flutter test runs reliably under pub workspaces, monorepos and symlinked paths. The same day Firebase posted that it put a plugin in the newly launched Google Antigravity Marketplace, giving agents guidance to follow when setting up Firestore security rules, deploying App Hosting and configuring AI Logic.

What this means for your app: If you keep several apps in one monorepo (say, with shared packages), go ahead and upgrade to 3.47.9. And if you’re on Antigravity, install the Firebase plugin so the agent has the official playbook when it writes your security rules.

6. 20 days for App Store review, 1 hour for Google Play: indie developers are complaining about review again #

2 min · Community watch

Why you should care: When you ship apps on your own, review time is the one thing you can never predict.

The open-source secret-sharing app Mosaic said on X that for the same app, the App Store took 20 days to review and Google Play took 1 hour. Others complained the other way: Dom Barnes said his Google Play update had waited 5 days and still hadn’t passed. In X’s roundup, several iOS developers recently posted “Waiting for Review” for more than 7 days, and one was rejected for not including a real-device demo video.

What this means for your app: For a new app’s first submission, I’d budget one to three weeks. Get the demo account, real-device video and everything else ready in one go. Getting rejected and going back to the end of the line really hurts.

What the Community Is Arguing About#

1. At retail prices, Anthropic’s internal AI usage already exceeds employee pay #

Business Insider reports that Anthropic’s prospectus says internal Claude usage (priced at external rates) has exceeded monthly employee compensation (excluding stock) since April, that September usage was more than 250 times January’s, and that more than 90% of the code added in September was written by Claude. On HN it has 253 points and 215 comments; the top comment, from hungryhobbit, points out that this is at retail prices and the cash actually spent is far lower, and that other companies count at cost. The fight really comes down to whether tokens count as pay. BI’s author wrote in March that tech companies are starting to treat tokens as a fourth form of pay.

2. Ask HN: which TV spies on you the least?#

677 points, 813 comments. The top reply suggests buying an LG OLED, rooting it and installing Glasshouse to turn off telemetry; another camp says any TV with CEC will do, never connect it to the internet, and play through an external box. Read the whole thread and it’s one complaint over and over: consumer electronics stopped being set up for the user a long time ago. The Renault that needs an SD card just to change the clock is the same story.

3. levelsio had Claude Code edit his whole vlog #

levelsio says his latest vlog was edited entirely by Claude Code, with the agent doing transcription, clip selection and cut points, and the post has 2,070 likes. The replies are split between “editors are done” and “sure, for talking-head vlogs”.

4. Is coding with AI boring?#

From X’s trending roundup: some developers say coding used to engage the mind, and once the novelty of AI wears off, engineers are left writing prompts. The other side thinks creativity lives in architecture and design, and typing was never the point. V2EX was also arguing the same day about “whether to review agent-written code at all”, and both fights are really the same question: which parts do we still keep for people?

Chinese Tech Scene#

1. Should agent-written code be reviewed?#

(V2EX): The poster shared a piece of pandas masked-column aggregation code written by Claude Code and asked whether agent-written code still needs to be reviewed line by line.

2. Claude’s iPhone voice mode supports CarPlay, and Anthropic expands to 33 languages #

(INSIDE): CarPlay now has five assistants: ChatGPT, Perplexity, Grok, Meta AI and Claude, with Gemini still missing; 24 languages were added, but there’s no word on whether it works in Taiwan or supports Traditional Chinese.

3. xAI Grok API adds invisible watermarks by default from November 7 #

(INSIDE): Text output, structured output and tool-call parameters from seven models including grok-4.7 will carry watermarks; the x-watermark response header tells you whether one is present, based on Article 50 of the EU AI Act.

4. Four AI companies back a shared AI-training preference signal, letting sites set it through robots.txt #

(iThome): The new marker __usage_ai-training goes in the User-Agent field of robots.txt. Anthropic already supports it, OpenAI says within a few months, Google in 2027, and Microsoft on February 1, 2027.

5. Apple iOS 27.2 adds Google’s AI watermark; edits are written into pixels, yet its own apps can’t verify them directly #

(TechNews): Images made in Image Playground always get SynthID, while Photos adds it only for extend, spatial reconstruction and large-area removal; to verify, you have to upload to Google’s detection site.

6. Muji Taiwan caught up in the 91APP breach, affecting about 180,000 members #

(iThome): This 91APP incident may affect up to 1,329 brands; for Muji, website orders from April 4, 2025 to October 14, 2026 are affected, and credit cards and passwords are not included.

7. Japanese figure maker Good Smile Company hacked, partial data on over 400,000 credit cards may have leaked #

(iThome): Malware was planted on the payment page, and the full card numbers of up to 2,800 customers leaked; customers shipped to Taiwan are not in this batch, though the last four digits of their card numbers may have leaked.

8. One-person companies are no longer just a side project: founders run whole teams on AI tools, but the hardest gap to fill is decision support #

(TechOrange): The share of startups with a single founder rose from 23.7% in 2019 to 36.3% in mid-2025; but in a Clarify Capital survey, only 8% of solo founders were heavy AI users.

9. Yann LeCun, 66, publishes a new paper challenging the Scaling Law: 109 million parameters beat 72 billion #

(InfoQ 中文): The headline says a 109-million-parameter model beats a 72-billion-parameter one. I only saw the headline, so see the original for details.

Open Source Picks#

1. caru-ini/stack-diagram #

TypeScript | 1,127 stars

An agent skill: describe your tech stack in one sentence and it draws an architecture diagram with the official logos

2. elvarofficial/teardown #

JavaScript | 1,215 stars

A Claude Code skill that turns any machine into a 3D simulator you can take apart

3. Verlintas/NOIR #

Kotlin | 1,244 stars

Uses adb to scan an Android app’s permissions, outbound endpoints and where data goes, and gives you fixes you can undo

4. Arjun-Ingole/hop #

PowerShell | 1,380 stars

Install Linux alongside Windows without a USB stick

5. modelflare-ai/AnyModelBot #

TypeScript | 1,327 stars

An open-source personal bot, local-first, that connects to more than 70 models and works from an app, WeChat or Feishu

Watch & Listen#

Theo on why Anthropic keeps winning: Claude Ultra and dropping the 5-hour limit #

148,581 views · 2026-11-02 · Theo (t3.gg)

Why you should care: AI plans keep changing, and this video walks through the new plan’s terms one by one.

The video description says Anthropic renamed its $200 monthly plan Claude Ultra
Verified accounts have the 5-hour limit removed, and Theo keeps saying “the details are what matter”
Read it alongside the merged ChatGPT/Codex allowance and the Grok Bot limit cut in Builder Radar

Blacksmith: running CI on esports CPUs, valued at $1 billion #

11,539 views · 2026-11-02 · Y Combinator

Why you should care: The more code agents write, the longer your test queue gets, and that’s exactly what this company fixes.

Blacksmith (YC W24) grew 20x over the past year, with a $66 million Series C at a $1 billion valuation
It started by renting CPUs from game servers originally used for Minecraft and Call of Duty
A team of 30 that cut CI wait times from minutes to seconds

Taking on a Grok Bot custom project solo: $25k upfront, $3,000 a month #

9,501 views · 2026-11-02 · Greg Isenberg

Why you should care: If you want to sell AI employees to small businesses as a one-person shop, this one gets really specific about pricing.

Orgo co-founder Nick built the agent platform Bops over a 36-hour weekend, where every bot has its own phone number, email and computer
The quote is a one-time $25,000, with an optional $3,000 monthly maintenance fee
How to find the first client: call 50 people you know, do the first one for free, and trade it for a case study and referrals

Today’s Take#

After a dozen-plus stories today, I keep landing on the same thought: figuring out someone else’s system has gotten really cheap. Astra reads weights, Craft Anything uses 314 tools to look at an app, Rasmus runs a 12-year-old head unit in QEMU, and levelsio moved a 2002 game into the browser with Claude Code. Reverse engineering that used to take a team weeks is now one person’s weekend. And people are starting to draw lines: Anthropic bans recreating specific games in its prompt, the Times is suing Brave over resold scraped content, and four AI companies are backing one robots.txt marker. For the apps I build, that means having the UI and flows copied is only going to get easier. What’s harder to copy is the data, the relationship with users, and the daily upkeep, so I’ll spend more of my time on those.