Hacktron researchers used Claude Opus 5 to help chain a Discourse/libheif image bug into OpenAI staff ChatGPT and Codex accounts, then opened a harmless demo PR in an internal repo. OpenAI patched within about 14 hours and paid a $6,500 bounty on Sept 1; there is no sign the chain was abused in the wild.
Built on Thinking Machines' Inkling Small (276B total, 12B active), it's available now in Devin Desktop and the Devin CLI, free for Pro, Max and Teams plans through Nov 30. There's no public API, per token price or weights yet; Cognition says it's building a program to share weights with partners and researchers…
OpenAI plans to fold Pierre's Git backed Code Storage service into Codex; Pierre's open source projects stay open and existing Code Storage customers keep access after closing. Terms weren't disclosed and the deal still needs regulatory approval (Axios)…
Conductor has stopped taking new users and plans a new interface in early 2027; its cloud service goes read only Nov 13 and shuts down Nov 20, when cloud data deletion begins, so export or move workspaces to the local app before then. Terms weren't disclosed (InfoWorld)…
In Positron 2026.10, turning on the MCP: Enabled setting lets agents like Claude Code, Codex, OpenCode, Kiro, Gemini and Copilot CLI see your loaded data, plots and consoles and run code there, labeled with the agent's name. Posit warns that this amounts to unrestricted shell access under your credentials, so trust decisions fall to your agent harness…
In a mid October run with an upcoming cyber model, the pipeline reproduced 1,724 kernel bugs and built working local privilege escalation exploits for 948 of them, about $1,279 each, with human researchers reviewing results before reporting fixes to maintainers. The 948 counts validated exploits, not merged patches (HN)…
Spotted something we missed? Start a thread.
