AI & Tech News Digest — November 1, 2026

AI NewsTop 5

• DeepSeek Open-Sources dsh-superagent, the Architecture Behind Its “Always-On” Super-agent (Oct 31)

  GitHubr/DeepSeek

  The DeepSeek Harness team published the prototype behind its paper “Exploring Super-agent Design: Towards a More Autonomous Agent System”: a proactive coding agent bound to one GitHub repository (plus optional Feishu). When someone asks for work, it opens a work item, does the job in its own agent session and directory, and answers in the original thread — often with a pull request — while a web panel shows what needs a human. The stated philosophy is blunt: take as little human attention as possible. It’s MIT-licensed TypeScript research code, explicitly not the internal build, and it still pulled ~3,700 stars in under a day — the fastest-growing repo of the week.

• OpenAI’s Mega-Round Lands at ~$11B, Half Its $30B Target (Oct 31)

  WSJInvesting.comHN

  The numbers: roughly $11 billion raised against the $30 billion OpenAI sought when the round was pitched in September at a $1.4 trillion valuation (Bloomberg, Sept 29); it closed at $1.25 trillion. The FT reported the target had already been cut to ~$20 billion, with family offices next on the call list. Practical read: the private AI funding market is repricing while capex commitments stay in place — don’t build your roadmap on a vendor’s promised compute arriving on schedule.

• Prospero: A Lean C++ Coding Harness From nullprogram (Oct 31)

  nullprogram.comHN

  Chris Wellons (w64devkit) released Prospero, a coding harness in C++ with a Dear ImGui docking UI that he says uses “around two orders of magnitude” fewer resources than the web-stack harnesses he’s given up on. The design rules are worth stealing regardless of your tooling: every operation has a deadline (“never wait forever”), timed-out shell commands convert to background tasks, the whole process tree dies together, and agents spawn subagents or deploy headless copies of themselves over SSH and WSL. No built-in providers — point it at llama.cpp, OpenRouter, or an on-prem endpoint; vision models can drive the desktop to test GUIs. Community Edition is free on GitHub, Professional adds the headless engines.

• Five Qwen3.8-27B Agents Beat Fable 5 on LiveCodeBench Hard (Oct 31)

  GitHubEmergentHN

  Memdoor’s team-solve workflow deploys five open-weights Qwen3.8-27B agents in fixed roles — a planner, two parallel ideators, a solver, a manager, plus a repair loop — and reports 49 successful runs out of 50 across ten LiveCodeBench Hard problems repeated five times, ahead of frontier Fable 5. Treat the leaderboard claim as one benchmark, but note what it implies: a 27B open model is now cheap enough to run five-at-a-time per problem. If you have GPU headroom, benchmarking a small-model swarm against your single big-model calls is a day of work.

• Report: Anthropic Is Blocking Accounts That Touch “Training Larger Models” (Oct 31)

  HN discussionclaim on X

  A viral post claims Anthropic now flags and blocks users whose work “touches training larger models,” treating model-training work over a VPN as a highly suspicious signal; the 281-point thread has researchers describing sudden access loss. Anthropic has not confirmed any such policy, so treat specifics as unverified — but Anthropic’s updated Usage Policy takes effect November 12 with new restrictions of its own. If your job involves training runs, keep a backup provider before you depend on Claude for it.

Also tracked: OpenAI is merging ChatGPT and Codex into one usage-limit pool — help doc; and GPT-5.6 Sol reportedly beat Factorio on peaceful mode — ryanmadden.net.

Developer & DevOps NewsTop 5

• Jepsen: ParticleDB Is a “Library of Confusion” — Halt Deployments, Migrate (Oct 31)

  JepsenHN

  Jepsen found 96 issues in Orkes’ Rust “Postgres-compatible” database (built to back their Conductor orchestrator): WHERE 4 = 5 returning rows, NOT NULL and UNIQUE constraints ignored, zombie rows that can’t be deleted, committed writes lost in normal operation, and total data loss under simulated misdirected reads. The marketing promised a TLA+ proof and “1087x faster than PostgreSQL” — no proof ever shipped, and Jepsen’s recommendation is to halt deployments and migrate now. The section on LLM-assisted development — “LLM tooling repeatedly claimed that bugs had been fixed when, in fact, they had not” — should be mandatory reading before anyone ships agent-written infrastructure.

• Scribd Notifies Users of a Breach: Emails and Card Metadata Exposed (Oct 31)

  Scribd supportHN

  A notification letter from Scribd’s partner Epiq (received Oct 26, posted publicly Oct 31) covers Scribd, SlideShare, Everand, and Fable: an unauthorized third party accessed email addresses plus card last-4 digits, issuer, expiry, country, and payment history — no passwords or full card numbers. Scribd says it ended the access, notified law enforcement and data-protection authorities, and engaged an outside security firm. Expect phishing that quotes your card metadata; for your own services, the lesson is keeping breach-critical data (credentials, full PANs) out of systems that only need to know payment status.

• How Researchers Took Over ChatGPT Accounts With One Shared Link (Oct 28)

  Parameter LabsHN

  A public ChatGPT share could execute attacker JavaScript as chatgpt.com in the victim’s signed-in session: a MathLive graph listener accepted an origin-unchecked postMessage carrying HTML in a keyboard layout, innerHTML plus an unsandboxed srcdoc iframe crossed the Preview sandbox, and YouTube’s oEmbed JSONP endpoint smuggled the payload past CSP. From there it read conversation lists and never-shared private chats through the authenticated backend API and exfiltrated them. OpenAI fixed it October 26, classifying the report P1 with a $5,000 bounty; the writeup is a masterclass in auditing feature seams — every postMessage receiver must check both origin and source.

• Volta Infostealer Uses an LLM to Rank Victims by Net Worth (Oct 31)

  Cisco TalosHN

  Talos documents VOLTA, a self-deleting infostealer that harvests credentials, browser sessions, and crypto wallets, then calls an LLM to profile each victim and rank “their most valuable accounts” so the operator works the richest targets first. Malware doing triage means bulk detection heuristics miss more; the mitigations are the usual but more urgent — passkeys over passwords, session-token hygiene, and no wallet seeds anywhere near a browser.

• Molly, the Privacy-Hardened Signal Fork, Has Gone Three Months Without Updates (Oct 31)

  piefed threadHN

  The discussion claims Molly — the Android Signal fork with hardened privacy defaults — hasn’t tracked upstream in about three months, leaving it behind Signal’s security fixes. No confirmed exploit here, but it’s a live demo of fork-maintenance risk: a small-team fork of a fast-moving crypto app must rebase constantly or rot. If you’ve installed Molly for family members, check the upstream delta before the next reinstall and keep stock Signal as the fallback.

Also tracked: Apache Traffic Server’s October security release fixes 15 CVEs across versions 9.2.16, 10.1.5, and 10.2.1 — advisory.

Self-Hosting & HomelabTop 4

• Paperless-ngx Ships 3.4.1 One Day After an emSign-Driven Security Update (Oct 31)

  Freedom.TechGitHub releases

  3.4.0 (Oct 30) bumped dependencies in response to the eMudhra/emSign CA certificate incident plus other security fixes; 3.4.1 (Oct 31) follows with schema-validation and permission-check fixes, PDF-controls visibility, and mobile and light-mode layout repairs. Two releases in two days on a system that stores your tax documents — if you run paperless-ngx, take both and move on.

• Proxmox Partners With Lightbits on Native Storage Integration (Oct 29)

  Proxmox press releases

  Proxmox and Lightbits announced a partnership on native storage integration for Proxmox VE, putting the Lightbits NVMe/TCP block-storage stack in the supported path for PVE clusters. For homelabbers it matters mostly as a signal — enterprise storage vendors keep picking Proxmox as the hypervisor to integrate with. If you run shared storage for HA, benchmark it against your current Ceph or ZFS setup before the next cluster rebuild.

• TrueNAS 27.0.0-RC.1 Is Out — the “26” Release Renamed for 2027 (Oct 25)

  AnnouncementsTrueNAS blog

  iX renamed the December release from TrueNAS 26 to 27 “because most users will run it during 2027,” and the first release candidate is up on the announcement forum. Treat it as scratch-pool material only — RC on your primary NAS is how you end up reading restore guides. 25.10 users can stay put until 27.0 goes stable.

• Tailscale Walks Through Beszel Monitoring on Your Tailnet (Oct 28)

  Tailscale blogBitdoze guide

  Tailscale published a video on pairing Beszel’s lightweight hub/agent server monitoring with Tailscale SSH, so metrics and agent access never touch the public internet. It remains the low-drama alternative to Grafana-plus-Prometheus for a handful of boxes; our Beszel + Uptime Kuma on Dokploy guide still applies if you want the Docker-stats view alongside it.

Also tracked: Home Assistant’s Month of “What the Heck?!” runs through November — file whatever still confuses you — blog.

Trending GitHub RepositoriesTop 10, last 7 days

Also tracked: DeepSeek’s dsh-superagent-prototype tops the two-day charts at ~3,690★ — details in section 1.

Hacker News Top Stories

1. HackerTube: YouTube built from videos recommended by HN(969 points, 299 comments)

   karpathy.bearblog.devdiscussion

   A YouTube-style UI over 6,454 videos mined from 39,834 HN comments since 2007.

2. Serbia just elected the world’s brainiest parliament(843 points, 479 comments)

   Sciencediscussion

   More PhDs per capita than any legislature on record — the thread debates whether that’s a feature.

3. Digital minimalism(316 points, 231 comments)

   vitalik.eth.limodiscussion

   Vitalik Buterin on reclaiming attention from screens — timely weekend reading.

4. Casio Watches of the 1980s(219 points, 110 comments)

   Casiodiscussion

   Casio’s own 50th-anniversary archive of the decade that defined the digital watch.

5. Switch Lowering in GCC(203 points, 43 comments)

   xoranth.netdiscussion

   How switch statements become jump tables, bit tests, and decision trees — compiler internals, clearly told.

6. It’s the memory latency, stupid(169 points, 44 comments)

   pivotlake.iodiscussion

   Why latency, not bandwidth, dominates real workloads — the arithmetic your capacity plans ignore.

7. Show HN: A language model that lives in a boot sector(71 points, 3 comments)

   GitHubdiscussion

   A 510-byte MBR inference engine that dreams Linux boot messages forever; the author’s debugging story is the best part.

Also tracked: an NES Contra disassembly ported to C and then WebAssembly, with online co-op (76 points) — play | discussion.

Reddit HighlightsTop 5

• r/DeepSeek — DeepSeek has open-sourced again! Unveils Super agent architecture

  Thread

  The community dissects the router-worker design; note the README’s own warning that it’s research code, not the internal build.

• r/DeepSeek — I’ve used DSH with Full Access. I don’t think DeepSeek’s super-agent will work as advertised

  Thread

  A power user’s skeptical field test of the always-on router, proactive triggers, and watchdog — a useful counterweight to launch-day hype.

• r/wallstreetbets — OpenAI Raises Less Than Half of $30 Billion Target in Latest Round

  Thread

  3.5k upvotes; the top commentary argues neoclouds, OpenAI, and hyperscalers are all hitting funding friction at once.

• r/JellyfinCommunity — Jellyfin 12.4 has been released

  Thread

  Server moves to .NET 10.0.14, tracking Microsoft’s October out-of-band security updates; time to pull the new container.

• r/homelab — JetKVM Mini is now available

  Thread

  $39 single units shipping end of October, 3-packs after November — cheap out-of-band access for the rack drawer.

Also tracked: r/selfhosted’s weekly New Project Megathread (week of Oct 29) — the best place to catch young self-hosted tools before they hit the front page — thread.