DailyWeights & Takes

24 Oct 2026 · the swappable stack

Since the previous edition, 23 Oct 12:04 ET to 24 Oct 2026 17:00 ET

Edition 5 · 2 news · 1 model release · 5 repos · 5 papers · 1 thing to try

At a glance

News 2

A quiet news day. Dream Labs' Dream-1 robot model reached HN today but was announced on 19 Oct, and Microsoft's diagnosis study was published on 22 Oct, so neither is listed.

  1. Aikido Security

    Node2Shell becomes HTTP2Shell: the Brotli RCE reaches Python, Bun, Envoy and curl

    CVE-2026-111497 is an out-of-bounds write in Google's Brotli decoder (CVSS 9.2). A crafted compressed request or response can corrupt memory and possibly run code. Node.js patched it on 21 Oct. Aikido now reports that the same bug sits in anything that decodes Brotli: the Python Brotli package up to 1.2.0, brotlicffi 1.2.0.x, Bun, Envoy, Istio and curl. Python web stacks and Envoy-based gateways sit in front of a lot of model serving. The fix had been in Brotli's source since February, but nobody flagged it as a security fix, so no release shipped it. Aikido credits OpenAI with the February report. Upgrade to Brotli 1.2.1, brotlicffi 1.2.1.0 or Bun 1.4.4, or reject br-encoded bodies. Dropping br from Accept-Encoding alone isn't enough.

    241 pts123 commentssecurity discussion

  2. Show HN

    Corgi: a terminal multiplexer for coding agents

    Like tmux, it keeps sessions running in the background, but it also tracks what each agent is doing, so you can watch several runs at once. It works with Claude Code, Codex, Pi and OpenCode, runs on macOS, Linux and WSL, and has a scripting interface. It's built on Ghostty, and the code is MIT.

    121 pts42 commentsagents · terminal discussion

Model releases 1

  1. Moonshot AI

    Kimi K3.1 Pro and K3.1 Pro Highspeed

    This is K3 with much more post-training: reinforcement learning across hundreds of domains, aimed at long-horizon coding, finance and 3D work. Moonshot calls it a 3T-class MoE (2.8T total, 104B active, per its announcement) with a 1M-token context and image input. Artificial Analysis puts it fourth of 215 models, at 55 against Claude Opus 5.5's 58. On Moonshot's own numbers it scores 65.7% on Terminal-Bench 4.0, against Opus 5.5's 66.4%, and its hallucination rate on an internal stress test falls from K3's 23.4% to 8.3%. API pricing is $2 / $10 per 1M input / output tokens, half of Opus 5.5. Highspeed runs 2-3× faster at twice the price. It's verbose, though: Artificial Analysis counted about 150M output tokens to run its index, against a median of 87M. Moonshot says full weights will be released by 4 Nov but hasn't named a license.

    1,055 pts646 commentsAPI · weights by 4 Nov discussion Artificial Analysis

GitHub repos 5

All five broke out in the window. Folkbench and AutoSwarm-Shadow-Adapter broke out again; we skipped them for the reasons given on 23 Oct.

  1. GitHub

    kajisho5/ffmpeg-skill

    This gives your coding agent 42 FFmpeg tools for cuts, captions, reframing, loudness and platform exports. Each tool has a machine-readable contract, and there's an MCP server. One npx command installs it for Claude Code, Cursor or Codex. It runs locally, with no API keys. MIT.

    +480 ★ in window≈393/day · was ~41/daybreakout

  2. GitHub

    microsoft/skill-recorder

    You record yourself doing a task once. The Copilot CLI turns the recording (screen, window switches, URLs, optional narration) into an intent plus ordered steps. You review that, and it writes a SKILL.md or a scheduled automation. It needs Copilot access. Runs on macOS and Windows 11. MIT.

    +273 ★ in window≈224/day · was ~50/daybreakout

  3. GitHub

    ctoldigital/axuse

    This is browser and desktop control for agents that reads the accessibility tree over CDP instead of screenshots. You get kilobyte-sized diffed snapshots, stable element refs and typed errors such as STALE_STATE. One MCP server covers Claude Code, Codex and OpenCode. It has no dependencies, but the license is noncommercial.

    +135 ★ in window≈111/day · was ~35/daybreakout

  4. GitHub

    opensec-git/Pi-Bolt

    An unofficial fork that compiles the Pi coding agent ahead of time into one native executable, with no Node or Bun needed. On its own Linux benchmarks, it's ready to type in 41 ms instead of 423 ms and uses 117 MB instead of 521 MB after 40 prompts. Builds for Linux, macOS, Windows and Android. MIT.

    +134 ★ in window≈110/day · was ~19/daybreakout

  5. GitHub

    hujjun/mcd-saver-strategist

    A phenomenon, not a pick. McDonald's China runs an official MCP server for menus, coupons and ordering, plus a developer contest whose entry window closes on 25 Oct. This is the top entry: an agent skill that works out the cheapest coupon combination for an order. Three more McDonald's repos were created today.

    +278 ★ in window≈228/day · was ~72/daylaunch wave

Papers 5

Hugging Face daily papers featured on 23 Oct that didn't run yesterday; submission dates shown.

  1. Hugging Face papers

    Agent Mosaic: recognizing confidentiality leaks in agentic LLM systems

    An agent can read several harmless documents and then state the sensitive conclusion they add up to. Even on benign questions, the best model tested leaked a forbidden composite in 7.08% of simulated answers, and more in live harnesses. Classification headers and explicit rules still left 32% of answers unsafe. Permissions on documents don't cover what an agent infers from them.

    16 upvotesagents · security

  2. Hugging Face papers

    Deep Fusion Memory: a chunk-level parametric memory for LLMs

    This adds knowledge to a frozen model without retrieval at inference. A small predictor generates a memory per text chunk and fuses it into hidden states. Building its training data takes 32× fewer retrieval queries than earlier parametric memories. It beats the strongest baseline on six QA tasks by 12.7% on Mistral-7B and 11.2% on Qwen3-8B.

    41 upvotesmemory · efficiency

  3. Hugging Face papers

    SCOPE: compiling natural-language policies into neurosymbolic predicate programs

    This turns a written agent policy into a program of narrow checks run by small models, plus code that combines their verdicts. Adversarially generated counterexamples tune it. On real policy tasks it beats LLM-as-judge setups, and it is more stable from run to run. Programs tuned on the weakest model carry over to others, so cheap models can run the guardrail.

    7 upvotesagents · guardrails

  4. Hugging Face papers

    Inherited, not invented: tracing the provenance of "wait" in reasoning models

    RL gets credit for teaching models to write "wait" and reconsider. Across open models' training histories, the word arrives with the training data instead. Zero-RL almost never invents it, yet still raises MATH-500 accuracy sharply. So don't read the word's frequency as evidence of RL-learned reasoning. LLM judges of revisions can even reverse human-labelled trends.

    7 upvotesreasoning · RL

  5. Hugging Face papers

    Meta Expert: cross-layer expert sharing for MoE

    MoE experts in different layers store a lot of the same content. Sharing one pool of experts across layers matches a standard MoE with only 70-80% of the experts, at the same active count and granularity. That means smaller checkpoints for the same quality, which is what decides whether a big MoE fits your hardware.

    25 upvotesMoE · efficiency

Things to try 1

Run one of your agent tasks on Kimi K3.1 Pro (released 23 Oct). It scores close to Opus 5.5 at half the price, and the weights are due by 4 Nov. A test now tells you whether self-hosting it is worth planning for. Pick a long task you already have a baseline for and compare the result, the cost and the output tokens. It's verbose, so the bill may not halve.

First step: create a key on Moonshot's platform and point any OpenAI-compatible client at its API with the model kimi-k3.1-pro. Moonshot recommends max reasoning effort, temperature 1.0 and top-p 0.95.

The take

Lock-in is draining out of both the model and the harness. The fourth-best model on Artificial Analysis is promised as open weights, and today's breakout tools are built to run under whichever agent you already use.

Kimi K3.1 Pro scores 55 to Claude Opus 5.5's 58 at half the price, with weights due by 4 Nov. axuse and ffmpeg-skill each ship one MCP server for Claude Code, Codex and Cursor. Corgi runs four different agents side by side, and Pi-Bolt recompiles someone else's agent to start in 41 ms. When both layers can be swapped, what you own is the skills, tools and evals around them. Prediction: within 30 days of the weights' release, a third-party host will list K3.1 Pro below Moonshot's $2 / $10 per 1M tokens.