AI & Tech News Digest — October 13, 2026

1AI NewsTop 5

• Meta Launches Muse Wonder and Muse Wonder Full, Its “Most Capable Models To Date” (Oct 12) — Meta Newsroom | VentureBeat | HN discussion (568 points) Fourteen months after the Superintelligence Labs reorg, Meta shipped two frontier agentic models with 1M-token contexts and text/image/audio/video input, built around Active Memory (context carried across conversations) and Active Focus (recovering from errors mid-task). The catch is the packaging: Muse Wonder (muse-wonder-1.0) is on the Meta Model API at $4/$20 per million tokens — exactly Claude Opus 5.5’s rate card, with cached input at $0.20 — but Wonder Full, the stronger model, is API-only in name and actually locked to Muse Code subscriptions ($50/mo Power, $200/mo Max). On Artificial Analysis’ Intelligence Index, Wonder Full scores 56 (tied with Sonnet 5.5, ahead of GPT-6 Astra and Gemini 4 Argon at 53, behind Opus 5.5’s 58) and leads the SWE-Marathon long-running-coding benchmark at 57.5 vs Opus 5.5’s 46.3. No open weights this time — unlike Apache-2.0 Muse Glimmer — and Muse Code defaults to Contributor mode, which trains on your code unless you opt out. The API is OpenAI/Anthropic-SDK compatible, so a drop-in benchmark against your current agent stack is an afternoon of work; just don’t send secrets through Muse Code subscriptions without checking that mode.
• Z.ai Trains GLM-Legal, a Domain Model That Passes Harvey’s All-Pass Bar (Oct 12) — Z.ai blog | HN discussion (479 points) Built on the lightweight GLM-5.3-Flash foundation, GLM-Legal scores a 19.2% all-pass rate on Harvey LAB across 24 practice areas — a 12.5-point jump over its base model — and claims parity with frontier closed models on LegalBench and PLawBench (Chinese practice) from a much smaller parameter budget. The recipe is mid-training on dense legal corpora plus reinforcement learning across tens of thousands of simulated legal environments, with the agent harness and model training co-iterating: edge cases from training expose harness bottlenecks, and harness constraints feed back into task environments. It ships into AutoClaw, Z.ai’s desktop agent platform, editing Word documents with tracked changes; API access is application-only. The 275-comment HN thread is the real signal: domain-tuned small models are now a viable product category, not a demo.
• Codex CLI’s Persistent, Self-Updating Background Daemon Becomes a Flashpoint (Oct 12) — GitHub issue | HN discussion (497 points) Since Codex CLI 0.157.0, merely opening an interactive session starts codex app-server --managed-daemon — a background daemon that survives window close (reparented to PID 1), copies a ~374 MB platform package into ~/.codex/packages/app-server-daemon/releases/, and runs a detached updater that checks hourly and can restart the backend mid-turn. Worse, it pins the environment of whichever session spawned it: one user’s per-invocation HTTPS_PROXY and another’s direnv variables leaked into all later sessions. The issue has been open since Sept 25 and blew up on HN with comments calling it “a trait of malware”; the daemon_auto_start flag that disables it appears nowhere in the official config reference. The full opt-out: codex features disable daemon_auto_start, then codex app-server daemon stop, kill the leftover pid-update-loop process, and delete the package copy. If you package Codex CLI for fleets, pin a version and audit what it leaves running.
• Amazon in Talks to Buy Decart for Around $7 Billion (Oct 11) — WSJ | Reuters Per the WSJ’s Sunday report, Amazon is negotiating to acquire Decart — the San Francisco-based, Israeli-founded startup behind real-time live-video AI that can edit video streams on the fly — in a deal valued around $7 billion, with Reuters and other outlets confirming the talks. No deal is signed, and neither company has commented beyond the reports. If it closes, Decart’s models landing inside AWS is the part to watch: teams building on its real-time video APIs should assume pricing, endpoint, and data-residency changes and keep an abstraction layer between their product and a startup that’s mid-acquisition.
• Anthropic Opens Enrollment for OSS Scanner, Free AI Security Review for Critical Repos (Oct 8) — GitHub The repo has pulled ~900 stars in five days: OSS Scanner is an Anthropic service that scans critical open-source projects for vulnerabilities. Maintainers enroll by opening a PR that adds a projects/<name> directory with a project.yaml (repo URL plus a public security contact), a Dockerfile that builds the project, and optionally a threat_model.md that tells the scanner how you rate severity. The service builds your project in an isolated VM, analyzes it with no internet access, and emails findings to your security alias with a reproducer and a proposed patch where available. The trust model is stated bluntly: reports are model-generated, never human-reviewed, never published, and carry no 90-day disclosure embargo. For maintainers of infrastructure libraries, it’s free extra review — just treat every report as an unvetted lead to reproduce yourself, not a CVE. Also tracked: “AI Models Can Provably Hide Arbitrary Capabilities” (arXiv 2610.13928), off to a fast start on HN — paper | discussion.

2Developer & DevOps NewsTop 5

• Intel Details GPU D270, the 480GB LPDDR5X Inference Card Formerly Known as Crescent Island (Oct 12) — Intel | VideoCardz | HN discussion (118 points) Intel’s inference-optimized data center GPU now has a name and specs: Xe3p silicon with up to 480 GB of LPDDR5X, 1.3 peak PFLOPS of FP8, 1.5 TB/s of memory bandwidth, in an air-cooled 350W PCIe card aimed at agentic AI, long contexts, and high-concurrency serving. Customer sampling is underway, per VideoCardz — no pricing or general-availability date yet. The pitch is capacity per dollar and per watt instead of HBM headline numbers: 480 GB on one card is 70B-class models with enormous context, no multi-GPU plumbing. If it ships near the rumored aggressive pricing, it’s the first credible “run a frontier-open model on one PCIe card” box — worth benchmarking against a used A100/H100 before you buy either.
• Bun 1.4.3 Ships bun check, a TypeScript Checker 3–6.4x Faster Than tsc 7 (Oct 10) — Bun blog The headline is bun check: a built-in TypeScript type checker ported from typescript-go that passes 100% of TypeScript 7.0.2’s conformance suite (51,210 tests), reports the same errors as tsc, and on real repos runs 3–6.4x faster with 2.2–4.9x less memory — VS Code’s src checks in 1.24s vs 5.98s. It plugs into bun run --check, bun test --check, and bun build --check, so a type error fails CI before anything executes. The rest of the release: Bun.FetchSession for per-client TLS/proxy/connection pools, an experimental Bun.ModuleGraph for running many app instances in one process, 67–89% less idle CPU for quiet servers, wildcards and CIDR blocks in NO_PROXY, 166 fixes, and hardened TLS certificate verification during the handshake. bun upgrade and re-run your typecheck in CI — this replaces a tsc step for Bun projects.
• First Official Ubuntu RISC-V Desktop Images Land with Ubuntu 26.10 (Oct 12) — SecurityOnline | Phoronix Canonical is shipping its first official Ubuntu Desktop images for RISC-V with the Ubuntu 26.10 release on October 15, alongside unofficial Xubuntu Minimal builds. Testing has focused on SpacemiT K3 boards on the RVA23 profile, and QEMU emulation is supported so you can boot the desktop image without hardware. RISC-V dev boards have been stuck with server-ish or vendor-blessed images; a Canonical-built, maintained desktop image changes the calculus for homelab experiments and CI runners on RISC-V. If you’ve got RVA23-capable silicon (or just QEMU), 26.10 on October 15 is the day to try it.
• “Unprecedented” Cyberattack Forces Supermarket Fridges into Continuous Defrost Across Europe (Oct 12) — Tom’s Hardware | HN discussion (511 points) Attackers hit Danfoss-made refrigeration controls at French chains Intermarché, Leclerc, and Coopérative U, reconfiguring automatic defrosting — normally two hours a day — into a continuous cycle at 50°C, with early losses near €300,000 and likely millions; Coopérative U’s president confirmed the incident Monday morning. In the Netherlands, Albert Heijn, Etos, and Gall & Gall took websites down after a separate Sunday incident that also tampered with electronic shelf labels, putting wrong prices on shelves, with Belgium’s Delhaize hit too. Whether the attacks are linked is unclear. The ops lesson is not funny at all: refrigeration and shelf-label systems are internet-facing control planes. Segment them off corporate networks, alert on out-of-band defrost commands and temperature trajectories, and treat “smart” building IoT with the same threat model as your servers.
• IBM Patches Critical RCE Flaws Across IBM i, Db2 Mirror, and Maximo AI Service (Oct 12) — SecurityOnline | IBM bulletin IBM’s latest batch includes three critical vulnerabilities enabling remote code execution in IBM i, Db2 Mirror for i, and Maximo AI Service. The Db2 Mirror for i GUI bulletin alone lists CVE-2026-17181, -17182, -17184, and -17186 among multiple fixed flaws, and Maximo AI Service needed third-party-dependency updates of its own. IBM i fleets are exactly the kind of long-lived, internet-adjacent infrastructure that nobody re-images — inventory your partitions against the bulletins this week, since these are the systems that quietly miss patch cycles for quarters. Also tracked: Node.js is switching to one major release per year starting this month, with version numbers aligned to the calendar year — nodejsdesignpatterns.com.

3Self-Hosting & HomelabTop 4

• Janas Streams MoE Experts From Your SSD: 80B Models on a 32 GB Laptop (Oct 12) — GitHub | HN discussion (68 points) A pure-C inference engine that runs mixture-of-experts models larger than your RAM by streaming experts from NVMe: 37 tok/s from Qwen3-Next-80B (48 GB of weights) on a 32 GB laptop with speculative drafting — 24 without — against 2.8 tok/s for llama.cpp, with prompt reads of 62 vs 16 tok/s, and faster than llama.cpp on all 13 models compared at Q4_K_M. It runs on CPU or GPU (Vulkan), reads GGUF, and is GPL-3.0 with Linux as the target. For homelab boxes with big NVMe and modest RAM, this turns “can’t fit the model” into “how fast is your SSD” — the gap between 2.8 and 37 tok/s is the difference between unusable and daily-drivable.
• Hemmelig, the Encrypted Secrets-Sharing Platform, Is Archived (Oct 9) — selfh.st weekly Selfh.st’s weekly confirms the Hemmelig repo — the self-hosted one-time-secret share tool many teams run for credentials and links — has been archived on GitHub, meaning no further maintenance. If you self-host it, decide now: frozen-but-working is fine for an internal tool with no auth surface changes, but plan an exit to a maintained alternative or a fork before a dependency CVE forces your hand. It’s also a reminder to check the archived flag, not just recent commits, when you evaluate self-hosted software.
• Talorys: A Personal AI Agent Living in Your Own Cloudflare Account (Oct 10) — GitHub An MIT-licensed single-user agent that deploys into your Cloudflare account with one command — npx create-talorys@latest — and runs on Workers, Durable Objects, and Workers AI: chat, persistent memory, tasks, notes, and scheduled reminders, free-tier friendly and with no telemetry. The interesting bit for self-hosters is the threat model: your data and the model runtime live in an account you control, not a vendor’s, and there’s no server of yours to patch beyond the Worker itself. If you’ve wanted a “personal agent” without handing your notes to a SaaS, this is a 20-minute afternoon deploy.
• Helix Foundry Connects Your Data Into One Local-First Ontology (Oct 7) — GitHub A local-first data workspace built on HelixDB and DuckDB: point it at your scattered data sources and it connects them into one graph-plus-relational ontology that runs entirely on your own computer — Apache-2.0, TypeScript, 1,344 stars and climbing in its first week. It’s aiming at the “your company’s data, one query surface, no cloud” gap between a pile of CSVs and a full data platform. Worth a spin if your homelab dashboards each query a different database and you’ve been meaning to fix that. Also tracked: Nabu Casa is renaming the Home Assistant cloud subscription to “Link” to dodge the cloud stigma, and the NVIDIA Shield TV — a homelab favorite — got a $100 price increase attributed to AI-driven hardware inflation — selfh.st weekly.

4Trending GitHub RepositoriesTop 10, last 7 days

5Hacker News Top Stories

1. A Modern Web App in C (453 points, 181 comments) — prophitt.me | discussion A working web application written in C, no framework in sight — the thread relitigates memory safety versus simplicity with unusual civility.
2. Turn a WiFi 7 Router into a 320Msps Software Defined Radio Receiver (295 points, 82 comments) — GitHub | discussion The router’s radio frontend, repurposed as a wideband SDR — hardware hacking with a bill of materials you already own.
3. AI is a tool and using it well takes skill (281 points, 235 comments) — yyhh.org | discussion The case that the gap between AI output and AI-assisted work is still a skills gap — 235 comments of practitioners agreeing and arguing about where it ends.
4. Kevin Kelly’s 2016 AI Predictions, 10 Years Later (155 points, 54 comments) — taylor.town | discussion Grading a decade-old AI forecast card by card — a useful calibration exercise for this year’s predictions.
5. Leaving Tech (134 points, 127 comments) — ryanbigg.com | discussion A longtime Rails community pillar steps away from the industry; the comments are a candid thread on burnout and what comes after.
6. Making big downloads resumable in Firefox (129 points, 43 comments) — codeberg.page | discussion A TIL on how Firefox persists and resumes large downloads — the kind of HTTP detail that matters when your CI artifacts are gigabytes.
7. A look at OpenAI’s math that’s claimed computes faster Fourier transforms (47 points, 32 comments) — argmin.net | discussion A numerical-analysis blogger dissects the FFT claims from OpenAI’s math release — the thread is an hour old and moving fast; watch it before quoting the benchmark. Also tracked: The Making Of Super Mario 64 — the full 2001 Giles Goddard interview (237 points, 88 comments) — pixelatron.com | discussion.

6Reddit HighlightsTop 5

• r/OpenAI — Meta launches its new Muse Wonder model — Thread — The sub’s verdict centers on the pivot that matters: the company that open-sourced Llama now keeps its best model subscription-only.
• r/ClaudeAI — Meta says its new Muse Wonder scores at 85.6% against 81.5% for the competition — Thread — Benchmark-claim scrutiny in real time: effort settings, vendor-supplied numbers, and which comparisons survive contact with Artificial Analysis.
• r/LocalLLaMA — Intel “Crescent Island” GPU gets D-Series name, supports up to 480 GB LPDDR5X — Thread — Locals are already pricing imaginary rigs: 480 GB on one PCIe card means giant-context inference without HBM money.
• r/devops — Meme from Russian DevOps channel, AKA “List of DevOps interview questions for October 2026” — Thread — Interview-question satire that half the thread admits is uncomfortably accurate; the other half is arguing about which questions are actually fair.
• r/selfhosted — New Project Megathread — Week of 08 Oct 2026 — Thread — The weekly thread where new self-hosted projects debut; this is where next month’s trending repos come from.