AI & Tech News Digest — September 19, 2026

1AI NewsTop 5

• Unsealed NYT v. OpenAI Filings: Microsoft Execs Called AI Training “the Largest Theft of Labor in Human History” (Sept 17) — TechCrunch | HN, 868 points The newly unredacted filings in the three-year-old lawsuit hand both defendants’ own words to the plaintiffs: Microsoft applied-science director Brent Hecht wrote in a January 2023 memo that the training pipeline was “an astonishing theft of unprecedented proportions,” and his January 2024 deck called Copilot’s hit to The New York Times’ click-through rate — down as much as 93% versus plain Bing search — a “doom loop” that would “hurt the performance of our models and the entire web at the same time.” The scale is quantified for the first time: OpenAI’s mid-training data holds 91,692 copies of NYT/Daily News/Center for Investigative Reporting works, a Common Crawl-derived set has 2M+ nytimes.com documents, and Project Mango packed 160,903 unique publisher works. CEO Satya Nadella testified that paywalled content “should be licensed” and that he would have “invoked [Microsoft’s right to] require OpenAI to retrain its models” had he known; ChatGPT chief Nick Turley called the products an “existential threat” to publishers. Every admission lands on the market-substitution prong of fair use — the exact pillar the defense needs. For anyone negotiating AI licensing: the counterparty’s own exhibits now argue your side.
• US Military Nearly Intercepted a Chinese Ship Over an AI-Hallucinated Intel Report (Sept 18) — CNN | HN, 420 points This spring, a Special Operations analyst asked a chatbot about a Chinese vessel in the Middle East; the model fused open-source reporting with classified signals intelligence and concluded the ship carried nuclear-weapons components. The military swung into action — boarding teams armed, aircraft airborne — before officials discovered the report had been AI-generated and was, in one source’s words, “entirely false”; another says it “almost started a war.” Four sources describe a decentralized AI rollout under Defense Secretary Hegseth’s January “AI Acceleration Strategy,” with no unified standard for verifying model output across commands. The quote that should end up in every runbook: “AI allows you to get to a bad idea faster.” The operational lesson is boring and universal — AI-assisted analysis needs a human verification gate before it becomes a product others act on.
• ZCode, Z.ai’s GLM Coding Agent, Silently Uploads Your Entire Git History (Sept 18) — Tokenstead | HN, 258 points A developer who goes by ferstar reverse-engineered the ZCode desktop app from Z.ai (the company behind GLM) and found that whenever you’re logged in, it packages your whole workspace — including .git history, LFS cache, and reflogs, which made up 86.6% of a 313MB capture spanning 42,411 files — encrypts it, and uploads it to Alibaba Cloud OSS. The kicker is the crypto: envelope encryption with an RSA-OAEP-wrapped key whose private half exists only on Z.ai’s servers, so the archive on your own disk is unreadable to you. The UI toggles don’t stop the capture (the sidecar is instantiated unconditionally), deleting the archive just re-triggers it (564 retries logged), and the privacy policy never mentions workspace snapshotting. The defense that holds: chattr +i ~/.zcode/v2/checkpoints on Linux or chflags uchg on macOS. The meta-lesson for the local-AI crowd: open weights are not open harnesses — audit what your agent runtime transmits, especially in closed-source editors.
• Dan Abramov “Vibed” a Lean Proof of Conway’s Refinement Conjecture (Sept 18) — overreacted.io | GitHub | HN, 219 points The React core dev spent a month of evenings and roughly 40 billion tokens (≈$40k at API rates, >95% cache reads) driving a multi-agent lab — PM, math, red-team, and Lean agents chatting in a “cafeteria” — toward Conway’s 1976 conjecture that factorizations of omnific integers admit a common refinement. Two near-misses got burned when fresh sessions found circular reasoning in the model’s own “papers”; the fix was structural: Lean agents that only certify peer-reviewed math, kept separate from agents extending results. The final proof compiles with standalone statements under 500 lines importing nothing but Mathlib, passed mechanical checks from the Palomar registry, and is now public for mathematicians to attack — Abramov explicitly invites refutation. The practical takeaway for anyone running agent teams on hard verification work: Lean (or any kernel-checked target) is what turns “the model says so” into something reviewable, and separating exploration from certification is what kept it from collapsing.
• Cactus Needle 3: 8–29MB Models That Claim DeepSeek V4 Flash-Grade Tool Calling (Sept 18) — cactuscompute.com | Show HN, 175 points Needle 3 ships one set of weights (29–121M parameters, CQ2-bit quantized) where every depth from 2 to 20 layers is a deployable subnetwork, so an app can pick 8–29MB binaries per device. On the Mobile Actions benchmark the 20-layer subnetwork scores 86.0 — ahead of LFM2.5-1.2B (82.4), Qwen3.5-0.8B (76.0), and Apple’s on-device model (57.6) — while decoding at up to 4k tokens/s on a Raspberry Pi 5. The model does three things offline: tool calls with a calibrated confidence score for routing (act, confirm, or refuse), typed structured extraction, and embeddings. Fine-tuning a 4-layer subnetwork on one product’s tools reportedly reaches DeepSeek V4 Flash-grade accuracy there. For engineers building offline voice controls, wearables, or robotics, this is the edge-model tier worth benchmarking.

Also tracked: “An empirical study of harness design for coding agents” (arXiv 2609.20804) hit 204 points on HN — more evidence the harness matters as much as the model — paper | discussion.

2Developer & DevOps NewsTop 5

• Claude Code Now Reads AGENTS.md When There’s No CLAUDE.md (Sept 18) — changelog | HN, 571 points Anthropic adopted the cross-tool agent-instructions convention: in a project with no CLAUDE.md, Claude Code reads AGENTS.md instead — the same file Codex, Cursor, and friends already pick up — with the setting under “Project instructions” in /config (not yet on Bedrock, Vertex, or Foundry). The Sept 19 follow-up quietly matters for budget-watchers: auto mode now defaults to a server-side classifier for API, Enterprise, Bedrock, Vertex, Foundry, and gateway users, which no longer bills classifier overhead (opt out with CLAUDE_CODE_AUTO_MODE_SERVER=0). Net effect: one instructions file to maintain across coding agents, and one less per-turn token tax on auto mode. If your repos still carry both files, the single-file future just got real.
• White-Hats Chained a libheif RCE and an SSO Flaw Into OpenAI’s Internal Repos (July 25, disclosed Sept 18) — Hacktron | Tom’s Hardware | HN, 474 points The three-person Hacktron team turned a heap overflow in libheif — Debian 12 shipped the vulnerable 1.19.7 because the upstream fix landed without a CVE or security flag — into RCE on community.openai.com via Discourse’s HEIF-to-ImageMagick image pipeline. Opus 4.8 couldn’t beat ASLR; Opus 5 produced a working x86-64 exploit hours after release. From the forum they used an OpenAI SSO misconfiguration to take over employee ChatGPT/Codex accounts, reached the GitHub-connected integration, and opened a harmless pull request in OpenAI’s internal monorepo as proof — under 72 hours end to end. OpenAI fixed the SSO issue ~14 hours after the Bugcrowd report and paid a $6,500 bounty; Discourse shipped advisory GHSA-vhm9-85gw-x335 with image-sandboxing within days. Your action items if you self-host Discourse: git pull && ./launcher rebuild app — web-tier updates don’t replace the vulnerable Docker image — and inventory every service that accepts .heic/.heif/.avif uploads. The economics are the story: the whole “HEIF Heist” campaign cost under $3,000 in tokens.
• Android 17 QPR1 Is the First Release Since Honeycomb to Add App APIs Without AOSP (Sept 15) — GrapheneOS | API diff | HN, 659 points Since Android 16, only QPR2 releases go to AOSP — and QPR1 is the first Pixel-OS release since 2011 to add new developer APIs that other OEMs can’t touch until Android 17 QPR2 lands in December. GrapheneOS finished its QPR1 port before launch but is barred from releasing it, is reverse-engineering Pixel-only security patches to ship them early, and waited weeks for GPL-mandated kernel sources. If you build against the new 37.1 APIs, non-Pixel users wait until December; if you ship a custom ROM, budget for the new patch-gating reality. The Open-Source part of AOSP just got more conditional.
• Cloudflare Reclaimed 100TB of RAM With Math (Sept 18) — Cloudflare blog | HN, 274 points Cloudflare’s Pingora-based backend router was burning up to 6GB per node on consistent-hash rings — dozens of them, one per feature combination, with 160 hashes per server each. The fix is a statistics lecture applied in production: the load-imbalance coefficient of variation for k hashes per server is √((N−1)/(kN+1)), so adding hashes has brutal diminishing returns and 32-bit collisions eventually make it worse — meaning they could cut the hash count by 90% at equal error. A struct compacted from 8 to 6 bytes (u16 index packed into a byte array, since Rust’s alignment rules ignore naive field shrinking) added another 25%. The migration ran both rings with per-request routing to avoid nuking the cache, rolled out data-center by data-center, and reclaimed over 100TB of RAM globally. The changes ship as an unadvertised v2 feature in the pingora-ketama crate — read it before you next “just add more replicas of the ring.”
• Xcode 27.1 Beta Release Notes Land — With a New Open-Source xcproj Library (Sept 18) — Apple | apple/xcode-project-format | HN, 124 points Apple posted the Xcode 27.1 beta notes, and the more interesting artifact for tool builders arrived alongside it: xcode-project-format, an Apache-2.0 Swift library for reading, writing, and manipulating the JSON-based project.xcproj format (363★ in three days). XcodeGen, Tuist, and every merge-conflict-prone pbxproj tooling hack now have a first-party target to converge on. Worth watching if your repos are generated or agent-written Swift.

3Self-Hosting & HomelabTop 4

• NetWatch: a Terminal Network Monitor With eBPF Attribution and TLS Decryption (Sept 18) — GitHub | r/selfhosted A single static binary (macOS/Linux/Windows, brew install netwatch or cargo install netwatch-tui) that puts ten diagnostic tabs one keypress away: every socket with the owning process, PID, TCP state, GeoIP, and retransmits via PKTAP on macOS or an optional eBPF kprobe on Linux. It does live packet decode with JA4 fingerprinting and PCAP export, decrypts TLS 1.3/1.2 sessions you hold keys for by pointing SSLKEYLOGFILE at it (same mechanism as Wireshark), and learns per-process egress baselines — a new destination host gets flagged, and C2-beaconing, port scans, and DNS tunneling trip background detectors. A diagnostic engine ranks causes by the checks that separated them, with no ML anywhere. Genuinely useful on a homelab box where installing ntopng plus Grafana is overkill.
• Warpgate 0.29 Adds Just-in-Time Session Approvals (Sept 18) — release | r/selfhosted Warpgate is the FOSS bastion host that needs no client app and no server-side agent — the self-hosted answer to Teleport, StrongDM, and HashiCorp Boundary. Version 0.29 closes its biggest gap with Teleport’s paid tier: per-target manual approval gates that hold a connection until an admin approves (optional grace period), plus an optional MFA policy that forces TOTP enrollment at login. Clustering got polish too — live admin-UI updates now work cross-node — and Vault/OpenBao support is the next release’s headline. If you share a jump host with a team and want audited, approved access without enterprise licensing, this is the release to move on.
• ProgramAsWeights: Define Text Classifiers in English, Run Them on Your Own CPU (Sept 18) — GitHub | r/selfhosted University of Waterloo research turned practical: you describe a function in plain English (“Classify urgent emails”), a hosted compiler distills it into a task-specific LoRA adapter for a shared Qwen3-0.6B interpreter, and calls then run locally via llama.cpp — about 594MB for the base model plus ~22MB per program. Emails never leave your machine after compilation; the compiler weights are public if you want to self-host that step too, and the paper (arXiv 2607.02512) is open. A neat middle ground between regex filters and shipping text to a classification API — mail triage, alert routing, and log tagging on a NAS-class CPU.
• nzb360 v25: Watch Tracking Arrives, Readarr Handoff to Chaptarr (Sept 18) — r/selfhosted The Android media-server manager’s v25 is a two-fer for *arr-stack runners: watch tracking across Sonarr/Radarr/Dashboard (via Tracearr’s v2 APIs), and Readarr replaced by Chaptarr, the actively-maintained fork — existing server settings and lifetime unlocks carry over automatically. Also new: Unraid CPU temperature and power readouts, list-view calendar, Android 16 target, and a 30% smaller APK. If you’re still limping along on abandoned Readarr, the migration path is now one settings screen.

4Trending GitHub RepositoriesTop 10, last 7 days

Also tracked: browser-use/jev-ultrafast more than doubled to 5,874★ this week — the Jev-ecosystem wave has legs.

5Hacker News Top Stories

1. Microsoft exec called AI scraping “the largest theft of labor in human history” (868 points, 768 comments) — TechCrunch | discussion The unsealed NYT v. OpenAI filings, dissected in item 1 above — the comment section is a fair-use seminar with receipts.
2. Android 17 is the first since 3.x to add new APIs without releasing to AOSP (659 points, 321 comments) — GrapheneOS | discussion GrapheneOS’s thread covered in item 3 above, plus a long argument about whether “open” still modifies “Android.”
3. Claude Code now reads AGENTS.md if there is no CLAUDE.md (571 points, 203 comments) — changelog | discussion The agent-instructions standards war may have just ended by capitulation — see item 1 in section 2.
4. A heap overflow and SSO misconfiguration to compromise OpenAI internal repos (474 points, 198 comments) — hacktron.ai | discussion The full exploit chain from section 2, including the AI-accelerated exploit development timeline and the sub-$3k cost.
5. US military had close call after using AI for hallucinated intelligence report (420 points, 318 comments) — CNN | discussion The near-miss from item 2 above; the HN thread converges on verification gates and classification standards.
6. Bend 2 and the Vibe-Coding Trap (313 points, 229 comments) — blog.liampwll.com | discussion A postmortem on shipping with the Bend parallel language and where agent-written code hides its own complexity.
7. Saving another 100TB of RAM (274 points, 57 comments) — Cloudflare | discussion Consistent-hashing math from item 4 above — the rare HN thread where everyone learned some probability.
8. I vibed a proof of Conway’s conjecture (219 points, 195 comments) — overreacted.io | discussion Dan Abramov’s month-long agent-lab experiment from item 4 above, with mathematicians already poking at the Lean proof.

6Reddit HighlightsTop 5

• r/selfhosted — NetWatch: a network monitor for the terminal — Thread — r/selfhosted takes to the eBPF socket-attribution and SSLKEYLOGFILE decryption; the consensus is a single static binary beats a Grafana stack for small boxes.
• r/selfhosted — Warpgate Bastion 0.29 adds just-in-time session approvals — Thread — Approval gates plus optional TOTP enforcement pull the FOSS bastion close to Teleport’s paid features.
• r/selfhosted — ProgramAsWeights: define text classifiers in English, run offline on CPU — Thread — English-compiled LoRA classifiers on a 0.6B interpreter; the usual “what phones home” audit happens in the comments.
• r/selfhosted — Migrated Portainer-stored compose to GitOps and Renovate (still use Portainer) — Thread — A practical writeup: git-backed compose files plus a Renovate dashboard for one-click updates, keeping Portainer as the helm instead of the source of truth.
• r/selfhosted — Is there an open-source, self-hosted calendar to rule them all (CalDAV)? — Thread — The recurring question resurfaces post-Cal.eu-shutdown: multi-account CalDAV, VTODO, Google/M365 sync — and the replies confirm the gap Nextcloud Calendar and Baikal frontends still don’t close.