Horizon 日报 · 2026-11-05

From 59 items, 14 important content pieces were selected

Technology News 1. Go proposes encoding/json/v2 standard-library JSON API ⭐️ 8.0/10 2. Anthropic presents research on provable LLM inference ⭐️ 8.0/10 3. Tencent announces Hy4 open-weight model with science and game-engine integrations ⭐️ 8.0/10 4. OpenAI reports 948 Linux privilege-escalation exploits from AI pipeline ⭐️ 8.0/10 5. USTC's structure-guided RNA model structRFM published in Nature ⭐️ 8.0/10 6. Moonshot Releases Kimi K3.1 Pro Open Weights With 1M Context ⭐️ 7.0/10 7. IEEE Spectrum: AI Is Forcing a Payoff of Decades of Security Debt ⭐️ 7.0/10 8. Ten-year reverse-engineering effort brings co-op to DOS Wing Commander ⭐️ 7.0/10 9. OpenAI to acquire Pierre Computer, git storage for AI coding agents ⭐️ 7.0/10 10. Profiling Huginn on B200: weight sharing saves storage, not HBM traffic ⭐️ 7.0/10 11. Calif demos Lockdown Mode bypass on iPhone 18 Pro ⭐️ 7.0/10 12. Huawei Tells Ascend 960DT Customers to Source HBM Themselves ⭐️ 7.0/10 13. Bluetooth SIG adopts HDT for Core 7.0, raising LE peak to 7.5 Mbps ⭐️ 7.0/10 14. Apple to scan iCloud public links for harmful content starting with 27.3 ⭐️ 7.0/10

Technology News

Go proposes encoding/json/v2 standard-library JSON API ⭐️ 8.0/10

Go has proposed a new standard-library JSON API, `encoding/json/v2`, for Go developers, with discussion focused on API design and migration. Commenters say the proposal omits `MarshalIndent`, and they describe the replacement for producing readable JSON as complicated and non-obvious. The supplied material does not establish a release date or whether the API has shipped beyond the proposal stage.

hackernews · olexsmir · Nov 4, 17:52 · Discussion

「Context」 Go's existing `encoding/json` package has long been the standard way to marshal and unmarshal JSON; the v2 effort is positioned as addressing performance and API limitations in that design. The new API builds on `encoding/json/jsontext`, a lower-level package intended to provide the foundation for JSON handling in Go.

「Migration risk for existing encoders」 On Go 1.27, existing `encoding/json` imports keep compiling, but the engine underneath now runs the v2 implementation and several long-standing behaviors differ, so teams should exercise their serialization tests against the migration guide before upgrading rather than assuming drop-in compatibility. The package documentation now directs new JSON code to `encoding/json/v2`, which means new and existing code in the same module may follow two different behavior sets during the transition.

「Community discussion」 Commenters generally welcomed `encoding/json/v2` but criticized the loss of `MarshalIndent` as an ergonomics and migration pain, with one comparing Go's growing set of alternatives to Python's "one way" problem. Another said they now mostly have AI write Go code but still want it to remain Go because they understand its performance and safety.

Tags: #Go, #JSON, #standard library, #API design, #migration

Anthropic presents research on provable LLM inference ⭐️ 8.0/10

Anthropic has published research progress on cryptographic-style verification of LLM inference, a technique for letting a client check which weights and computation produced a response. The item provides no source text or shipped-product details, so this is best read as a research presentation rather than a deployed verification service. Discussion focused on whether the approach is practical and on attribution to prior work.

hackernews · ltononro · Nov 4, 17:17 · Discussion

「Background」 Provable inference aims to give a client a cryptographic way to verify that a specific model, identified by committed weights, generated a particular response. Anthropic's FlashProve is a research prototype for large mixture-of-experts models; the company's post compares it with VerInf, which proved the same 400B-parameter Llama 4 Maverick model at about 0.02 tokens per second, and with DeepProve, a peer-reviewed method that certifies an entire generated sequence in one forward pass.

「Impact」 For closed-model customers, the approach targets a specific audit gap—confirming which weights served a request—but the overhead figures cited in the thread, including 17-second proof verification on 24 threads and a 90–100x inference compute hit, would make routine per-request checking costly without further optimization.

「Community discussion」 Commenter neuwirth alleged that Anthropic's work is built on VerInf, a project from their MARS fellowship, and that it reuses choices such as the 400B Maverick model with “very little attribution.” Other commenters called the result progress over prior zk work but questioned practicality, citing the compute overhead and arguing that open-weight models can be verified more cheaply by deterministic re-execution.

Tags: #provable inference, #LLM verification, #cryptography, #Anthropic

Tencent announces Hy4 open-weight model with science and game-engine integrations ⭐️ 8.0/10

Tencent announced Hy4, an open-weight model, alongside two open-sourced scientific foundation models: HyCell for single-cell representation and HyPDE for physical field modeling. Tencent says it adapted Hy4 for Unreal Engine, Unity and Godot and extended it to multiplayer game development, targeting feature implementation, gameplay logic, state tracking and asset pipelines. The company describes Hy4 as one of the strongest open-weight models available but acknowledges a gap to top proprietary models on internal benchmarks for research-level mathematics, long-horizon coding, model self-improvement and advanced visual question answering.

hackernews · Philpax · Nov 4, 14:11 · Discussion

「Prior context」 Tencent describes Hy4 as the latest generation of its Hy model line and ranks it among the world's leading open-source models, a claim the surrounding discussion tests against the earlier "Hy4 preview" release. The announcement also places Hy4 inside a wider research stack: the quoted material says the open-sourced HyCell (single-cell representation) and HyPDE (physical field modeling) foundation models were co-developed by Hy4 and Hyra 2.0.

「Impact」 Game developers using Unreal Engine, Unity or Godot are the clearest audience: Tencent says Hy4 was adapted for those engines and for multiplayer work, so teams could evaluate it inside existing workflows for gameplay logic and asset pipelines. The engine integrations are vendor-reported, and the supplied material does not establish their maturity or how much adaptation teams will still need.

「Community discussion」 areoform welcomed the open sourcing of HyCell and HyPDE as a contrast to restrictions at some U.S. AI companies, while frangonf praised Tencent for openly acknowledging Hy4's gap to top proprietary models. chriddyp reported that on a Plotly data-analytics benchmark Hy4 landed between GPT-6.1 Sol and GPT-6.1 Terra but was very slow, running about 26 queries per question and sometimes 64.

Tags: #open-weight models, #foundation models, #Tencent, #game development, #AI research

OpenAI reports 948 Linux privilege-escalation exploits from AI pipeline ⭐️ 8.0/10

OpenAI says its autonomous vulnerability-research pipeline, in an October 2026 Linux kernel scan, reproduced 1,724 vulnerabilities and generated 948 working local privilege-escalation exploits that can give an ordinary user root. It also produced 291 information-leak proof-of-concepts and reported at least 10 novel exploitation techniques that it says third-party experts confirmed, including new cache-spraying objects, page-grooming methods, a data-only arbitrary-write/privilege-escalation technique, and arbitrary type confusion. OpenAI put the run's API cost at $1,213,430, or about $1,279 per successful LPE exploit, with actual exploit development costing roughly $359; at $20,000–$70,000 per exploit in historical Pwn2Own/TyphoonPWN bounties, it estimated a theoretical value of $18.9 million–$66.3 million. These figures and the novelty claims come from a secondary Telegram summary of OpenAI's post and have not been independently verified; the post reportedly withholds full technical details for safety.

telegram · zaihuapd · Nov 5, 03:04

「Background」 The result builds on OpenAI's June "Patch the Planet" program, in which its GPT-5.5-Cyber model produced 24 Linux privilege-escalation exploits, according to a Cybersecurity News report. The new run applies the same autonomous discovery, exploitation, and patching pipeline to a much larger set of Linux kernel vulnerabilities.

「Impact」 If the reported figures hold, the economics favor automated exploit generation: about $1,279 per working LPE versus $20,000–$70,000 bounty values, a 16–55× gap. Kernel maintainers and product security teams would then need to treat such pipelines as a scalable source of local privilege-escalation exploits, not merely as bug-finding tools.

「Community discussion」 Commenters questioned both the count and the disclosure: tzury argued that the 948 exploits may be variations on far fewer underlying vulnerabilities, comparing them to many SQL-injection routes into one database flaw, and evan_a_a said it is convenient to invoke safety when patches are already public. dangelosaurus, who identified themselves as a member of the team, offered to answer questions and said the team is hiring.

Tags: #AI vulnerability discovery, #Linux kernel security, #exploit generation, #OpenAI, #cybersecurity

USTC's structure-guided RNA model structRFM published in Nature ⭐️ 8.0/10

A University of Science and Technology of China (USTC) team published structRFM, a structure-guided RNA foundation model, online in Nature on November 5. The model incorporates base-pairing information from secondary structure into sequence pretraining and was trained on about 21 million sequence-structure pairs, with the team reporting frontier-level results across multiple tasks. The team also developed MUSES, which integrates multiple secondary-structure predictions to reduce bias, and Zfold, a three-dimensional structure prediction module that the team says performs comparably to AlphaFold 3. The data, weights, and code have been made openly available; the AlphaFold 3 comparison has not been independently verified in the supplied material.

telegram · zaihuapd · Nov 5, 04:49

「Earlier preprint」 An earlier version of structRFM was posted as a 2025 bioRxiv preprint, which described pretraining that injects RNA base-pairing interactions into masked-language modeling. The Nature paper follows that preprint and represents peer-reviewed publication, but the preprint itself is not independent validation of the reported performance.

「Practical impact」 Labs can now reproduce structRFM's reported results and test Zfold on their own RNA targets because the data, weights, and code are open. Any group treating Zfold as an AlphaFold 3 replacement should run its own benchmarks first: the comparable-performance statement is the authors' claim, and alternative base-pair-aware predictors such as RNAbpFlow are already published for comparison.

Tags: #RNA基础模型, #AI for Science, #结构生物学, #开源模型, #Nature

Moonshot Releases Kimi K3.1 Pro Open Weights With 1M Context ⭐️ 7.0/10

Moonshot AI has released the Kimi K3.1 Pro weights on Hugging Face, giving developers a downloadable model with 2.8 trillion total parameters, 104 billion active parameters, and roughly 1 million tokens of context. The weights are published in MXFP4 quantization, and Moonshot also offers the model via platform.kimi.ai as kimi-k3.1-pro with interfaces compatible with OpenAI and Anthropic APIs. It is the first model in the K3.1 series and is described as natively multimodal and agent-oriented.

hackernews · abrarthought · Nov 4, 15:30 · Discussion

「What the release contains」 Kimi K3.1 Pro is the first model in Moonshot AI’s K3.1 series, and its 2.8T total versus 104B active parameters points to sparse activation: only a fraction of the network runs per token, keeping inference compute below what the full parameter count implies. The weights are distributed in MXFP4, a 4-bit floating-point format that shrinks the checkpoint and reduces memory-bandwidth needs compared with higher-precision formats, though the release remains large enough that self-hosting requires substantial GPU memory.

「Self-hosting barrier pushes users to hosted APIs」 The released checkpoint is large enough that self-hosting is impractical for most teams: commenters peg the MXFP4 download at about 1.45 TB and a viable node at roughly 8×B300-class GPUs, matching a 2.8T-parameter model with 104B active parameters. That leaves the OpenAI- and Anthropic-compatible endpoint at platform.kimi.ai (model id kimi-k3.1-pro) or third-party hosts such as OpenRouter as the realistic route; Yotta Labs' pre-release writeup put the API at $2 per million input tokens and $10 per million output, a third below Kimi K3.

「Community discussion」 Commenters focused on the hardware burden: one estimated that something like an 8× B300 node would be needed to run the weights, and another noted the download is 1,453 GB. A separate dispute centered on benchmarks, with one commenter saying the model barely outpaces DeepSeekV4.1-Flash and appears “benchmaxxed,” while another said their testing did not support that and described it as strong but a bit off the frontier.

Tags: #open-weight models, #large language models, #AI inference, #Moonshot AI, #model release

IEEE Spectrum: AI Is Forcing a Payoff of Decades of Security Debt ⭐️ 7.0/10

The IEEE Spectrum piece examines how AI-driven vulnerability discovery is surfacing long-standing software flaws and forcing the industry to address accumulated security technical debt. It treats the issue as a broad remediation burden for software maintainers and organizations, not a discrete product launch or benchmark result.

hackernews · pseudolus · Nov 4, 11:52 · Discussion

「Background」 The article's lead example, PHP2Shell, is a pair of memory-safety vulnerabilities tracked as CVE-2026-109618 and CVE-2026-109619 that affect PHP versions 5.4 through 8.5 and permit remote code execution. A related disclosure, Brotli2Shell, showed that the vulnerable Brotli decoder could be reached through far more than HTTP clients and servers, widening the exposure beyond the initially named Node2Shell and HTTP2Shell cases.

「Community Discussion」 Several commenters expect short-term patching pain to yield more secure software, while one argues that the HTTP2Shell/Brotli2Shell timeline shows humans still sit on vulnerabilities for months or years. A developer also reports using AI to lower the cost of clearing five to seven years of technical debt in codebases.

Tags: #AI security, #vulnerability discovery, #technical debt, #cybersecurity, #software security

Ten-year reverse-engineering effort brings co-op to DOS Wing Commander ⭐️ 7.0/10

A decade-long reverse-engineering project has added co-op multiplayer to the original DOS Wing Commander, according to the author's Show HN write-up. The work began in 2015 with the observation that the game state fit inside the 64K data segment; the author and his brother then ran stop-and-go, turning, and communication experiments while probing memory to locate the game's variables. They learned how to inject calls into game functions and synchronize game state across a network, which the author says lets players fly the story missions together.

hackernews · daniel_rh · Nov 4, 18:51 · Discussion

「Background」 Wing Commander, released by ORIGIN Systems for DOS in 1990, is a space combat simulation in which the player flies story missions alongside AI-controlled wingmen who can be given orders. The original game was built as a single-player experience, so flying those same campaign missions with a second human pilot required intervening at the memory and game-state level rather than using any built-in network mode.

「Impact」 Because the modification works on the original DOS binaries through memory patching and call injection rather than a source port, co-op covers the shipped story missions themselves. Players need a way to run the DOS game and a network link between the machines, since the synchronization operates over the network.

「Community discussion」 One commenter asked whether the same approach could be used to create a similar new game, while another asked why voice is carried over the data channel instead of the RTC stream. A third compared the technique to 8-bit-era save-file editing used to locate and alter values such as inventory, stats, and quest stages.

Tags: #reverse engineering, #DOS, #Wing Commander, #co-op multiplayer, #memory patching

OpenAI to acquire Pierre Computer, git storage for AI coding agents ⭐️ 7.0/10

OpenAI announced it will acquire Pierre Computer, the company that HN commenters identify as the maker of Code.Storage, a git-based system for storing code and other machine-generated artifacts at scale. Commenters said Pierre was founded by original Bootstrap developers Jacob Thornton and Mark Otto, and a quoted product description names Lovable, Bolt, Amp, and Parahelp among customers. The supplied announcement does not disclose the purchase price, timeline, or whether Pierre's products will remain available to non-OpenAI customers.

hackernews · itunpredictable · Nov 4, 15:21 · Discussion

「Context」 OpenAI's announcement describes the deal as expanding Codex's tools for building, understanding, and reviewing code. Coverage identifies Pierre as the developer of Code Storage, a git-based system for holding code and other generated artifacts at scale, placing the acquisition in the developer-infrastructure layer beneath AI coding agents.

「Impact」 For developers and agentic-coding companies that rely on Code.Storage—commenters name Lovable, Bolt, Amp, and Parahelp—the immediate concern is continuity: the supplied announcement gives no commitment that Pierre's git-based storage will keep serving non-OpenAI customers or remain compatible with existing workflows.

「Community discussion」 Commenters speculated that the acquisition is connected to OpenAI's separate work on scaling Git and to support for Pierre from Mitchell Hashimoto, while one joked that buying the company might be cheaper than paying for its product by subscription. Another reader highlighted Pierre's diffs library and questioned whether big labs also acquire successful product teams to learn how those products are built.

Tags: #OpenAI, #acquisitions, #git infrastructure, #AI coding agents, #developer tools

Profiling Huginn on B200: weight sharing saves storage, not HBM traffic ⭐️ 7.0/10

A Reddit post by /u/2dayyy6 profiles whether looped transformers such as Huginn reduce HBM traffic on a B200, using a teaching implementation with random weights and Nsight Compute data. In a microbenchmark, a chain of eight matmuls sharing one 72 MiB weight ran 24% faster than the same chain with eight identical copies and read almost nothing from HBM; at 288 MiB, above L2 capacity, the difference disappeared. In the full Huginn Core, eight iterations took about eight times as long as one and read about eight times as much data from HBM. The author concludes that sharing weights saves storage but does not by itself prevent the GPU from re-reading them from HBM on each iteration.

reddit · r/MachineLearning · /u/2dayyy6 · Nov 4, 16:26

「What looped transformers reuse」 Huginn is a looped transformer that places a recurrent core between a prelude and a coda, applying the same core weights at each iteration so latent computation can be scaled at inference time. The pattern generalizes across looped models, which reuse physical Transformer blocks across logical depth instead of allocating distinct parameters per layer. The profiled question is whether that shared-weight design, which clearly reduces parameter storage, also reduces the bytes pulled from HBM on each loop.

「Impact」 For developers estimating looped-transformer throughput, shared weights should not be treated as a bandwidth optimization: in the author's tests, deduplicating the weight stopped helping once it exceeded L2, and the full core's eight iterations still read roughly eight times the HBM data. Keeping recurrent weights on chip across iterations, for example with a persistent kernel, remains an untested suggestion in the post.

Tags: #looped transformers, #HBM bandwidth, #GPU profiling, #Nsight Compute, #ML systems

Calif demos Lockdown Mode bypass on iPhone 18 Pro ⭐️ 7.0/10

Calif posted a video on X showing an iPhone 18 Pro with Lockdown Mode enabled being jailbroken, and the device remained jailbroken after updating to iOS 27.2—a demo that, if confirmed, concerns iPhone users who rely on Lockdown Mode for high-risk protection. The video shows a PDF sent over AirDrop and the update performed in Settings. Calif has not disclosed technical details, says it is reporting the vulnerability to Apple, and will not release a jailbreak tool, so the demonstration has not been independently verified. Apple claimed in March 2026 that Lockdown Mode had a 100% protection success rate since 2022.

telegram · zaihuapd · Nov 4, 14:38

「What Lockdown Mode is meant to do」 Lockdown Mode is Apple's optional maximum-security setting, introduced with iOS 16 in 2022 for people who may be individually targeted, which sharply restricts features such as message attachment handling, some web technologies and wired connections in exchange for reduced functionality. The source notes that Apple claimed in March 2026 that Lockdown Mode had maintained a 100% protection rate since 2022, which is the record the Calif demonstration purports to break.

「Why it matters」 Lockdown Mode is aimed at people at elevated risk of targeted spyware, such as journalists and activists, so a demonstrated bypass matters most to users who treat the setting as a hard guarantee rather than a speed bump. The practical exposure is still bounded: Calif released no tool, published no technical details, and says it is disclosing the flaw to Apple, so the demo does not yet give attackers a usable method and the main near-term action for defenders is to watch for Apple's fix rather than change settings.

Tags: #iOS security, #Lockdown Mode, #jailbreak, #vulnerability disclosure, #mobile security

Huawei Tells Ascend 960DT Customers to Source HBM Themselves ⭐️ 7.0/10

According to The Information, Huawei has told some customers that its next flagship AI chip, the Ascend 960DT, will rely mainly on HBM from Samsung and SK Hynix and that those customers must secure the memory themselves because Chinese HBM capacity is insufficient. The report says the HBM is shipped attached to low-performance processors, declared under processor codes to Hong Kong, carried into mainland China, and then removed by heating. A Shenzhen chip broker said a single HBM3E chip now costs about $4,000, up from hundreds of dollars a year earlier, according to the report. These details come from a brief secondary report and include claims that have not been independently verified.

telegram · zaihuapd · Nov 4, 14:52

「Background」 Huawei has positioned the Ascend 960DT as the first chip in its 960 lineup, with the Ascend 960 PR slated to follow, and has promoted its UnifiedBus interconnect for linking multiple chips into larger AI systems. Because those accelerators depend on high-bandwidth memory, the reported shortfall in Chinese HBM capacity is the constraint behind the customer-sourcing arrangement.

「Impact」 Customers planning Ascend 960DT deployments will have to arrange their own HBM supply, adding a procurement step and exposing them to the reported roughly $4,000-per-HBM3E-chip price.

Tags: #Huawei Ascend, #HBM, #AI chips, #export controls, #semiconductor supply chain

Bluetooth SIG adopts HDT for Core 7.0, raising LE peak to 7.5 Mbps ⭐️ 7.0/10

The Bluetooth SIG announced on Nov. 4 that it has adopted Bluetooth HDT (High Data Throughput), an optional Bluetooth Core 7.0 feature that raises LE peak throughput from 2 Mbps to 7.5 Mbps—nearly four times—and improves capacity, energy efficiency, and reliability. HDT is designed to coexist with older devices. Its first standardized application is high-end wireless audio with lossless and high-resolution support, with products expected in 2027, so the throughput gain is not yet available in shipping hardware.

telegram · zaihuapd · Nov 5, 01:39

「Background」 Bluetooth Low Energy's maximum bit rate had been capped at 2 Mbps, and HDT is a new physical layer for LE rather than a tweak to existing links. Because it requires new radio hardware rather than a firmware update, current devices cannot gain the higher rate in software.

「Impact」 Because HDT is optional in Core 7.0, existing Bluetooth LE devices are not automatically upgraded; vendors must implement it in new products, while backward compatibility allows those products to interoperate with older LE devices.

Tags: #Bluetooth, #wireless standards, #lossless audio, #hardware, #Bluetooth LE

Apple to scan iCloud public links for harmful content starting with 27.3 ⭐️ 7.0/10

Apple said that beginning with iOS, iPadOS, macOS, and visionOS 27.3, iCloud content shared through “anyone with the link” links will be checked for harmful material. Content shared only with specific people is outside the described scope. If Apple judges content harmful, it reserves the right to move, refuse, modify, or delete it, and it may restrict or disable the accounts of users who upload such content, referring cases to law enforcement when necessary. The report describes an announced policy with concrete enforcement terms, not a demonstrated scanning implementation.

telegram · zaihuapd · Nov 5, 02:11

「How iCloud link sharing works」 iCloud lets users share images from iCloud Photos and files from iCloud Drive using an "Anyone with the link" option, which makes the item viewable by anyone holding the URL. MacRumors' coverage of the same change reports that items shared this way will be "made accessible to Apple" for the content check. The scope is narrower than all iCloud content: material shared only with specific people falls outside the described checks.

「What it means for users」 Users who distribute files through public iCloud links should expect that shared content can be removed or that their account can be restricted, while sharing limited to specified people is not covered by the stated checks. The policy adds a moderation review point between uploading content and making it publicly accessible by link.

Tags: #Apple, #iCloud, #content moderation, #privacy, #platform policy