Everyone Shipped a Cyber Model This Week

Three frontier models were launched this week — GPT-6 Astra, Claude Fable 5.1 and Mythos 5.1, and Gemini 3.8 Flash and Flash Cyber — and all three shipped a hardened, access-controlled "cyber" variant for defensive security work. The open-weight side kept pace with GLM-5.3, Qwen 3.8 27B on Cerebras, and Meta's Muse Spark 1.3. Two other threads ran through the week: Google tightening its grip on the open web and app stores (Manifest V2 removal, AnkiDroid, AuroraStore), and a run of security stories from an Omarchy root-escalation default to a year-long ID-scan leak.

News

GPT-6 Astra rolled out to a limited set of organizations with OpenAI reporting 98% on FrontierMath Tier 4, 99.9% on ARC-AGI-3, and two new results on prime gaps, including improving the bounded-gap result from 240 to 186. It also meets OpenAI's "Critical" cybersecurity threshold — 100% on ExploitBench — and OpenAI says it discovered two previously unknown zero-days during evaluation, which it is disclosing to maintainers. Claude Fable 5.1 is the same model as Mythos 5.1 with fewer safeguards, priced ~25% cheaper via 75%-off cache reads, and paired with a new "Enterprise Frontier Safeguards" mode that gives customers zero-retention privacy on their own infrastructure. Anthropic reports Mythos 5.1 designed protein binders with ~10x the binding affinity of Adaptyv Bio competition winners and a ~50% hit rate across 12 targets. Gemini 3.8 Flash is Google's third Flash release in six weeks, at $0.75/$3.75 per million tokens, with a Flash Cyber variant (via the Fairwind Program) that Google's Chrome team says produced 2.6x more correct patches than larger commercial models.

GLM-5.3 from Z.ai is a 753B-parameter open-weight model that reuses GLM-5.2's base and gains everything from post-training; it claims top open-weights coding scores and, per its own table, more than doubles GLM-5.2 on exploitation benchmarks as cyber capability emerged during scaling. Cerebras now serves Qwen 3.8 27B at ~1,500 tokens/s alongside GPT-OSS 120B at ~3,000. Meta's Muse Spark 1.3 scores 61-62 on Artificial Analysis' index — second only to Claude Fable and Opus — at $1.25/$4.25 per million tokens, but Meta hasn't decided whether to release weights.

Google's clampdown extended across browsers and app stores this week. It removed the last Manifest V2 extensions from the Chrome Web Store, including uBlock Origin, on August 31. AnkiDroid (10M+ installs) is being rejected over its Open Collective donation link because its fiscal host holds 501(c)(6) rather than 501(c)(3) status, with a September 11 removal deadline, and has stripped the links to stay listed. GrapheneOS users report AuroraStore "server busy" failures on anonymous-account installs, which maintainers attribute to a Google backend change on android.clients.google.com. And Luanti was pulled from Google Play after a Tracer.AI DMCA on Microsoft's behalf claimed Minecraft infringement — the app ships no Minecraft assets and won the same appeal in 2023.

A security researcher found that DHH's Omarchy placed its default user in the docker group, letting any process in the session mount the host filesystem as root via the Docker socket; it's fixed in 4.0.1 after private disclosure. A breach at IDScan.net exposed 153M+ driver's-license scans that were exfiltrated in near-real-time for over a year, per Krebs. Daniel Stenberg detailed curl's first CVE dispute, where MITRE sided with curl's decision not to assign a CVE to a "lower than LOW" wildcard-check bug. The European Commission's ProtectEU strategy revives encryption-backdoor language through "lawful access" roadmaps.

Debian voted to allow "responsible use of generative AI," neither endorsing nor prohibiting it while holding contributors accountable for reviewing AI-assisted output. CERN is migrating 2,200+ industrial accelerator-control computers from RHEL/CentOS to Debian 13, citing the x86-64-v2 default as "forced obsolescence." And OpenAI is winding down its Cursor contract after the SpaceX acquisition, proposing a November 12 shutoff and citing SpaceX/xAI contract violations.

Articles

GUIs should be fully keyboard-driven — Charalampos Kardaris pushes back on the TUI-vs-GUI debate, arguing keyboard navigation is not inherent to terminal apps and that the GNOME HIG already requires every GUI action to be reachable by keyboard.

"It works better in the app" — Terence Eden recounts failing to subscribe to a calendar on Android 17 while the desktop-mode web version worked, making the case that half-finished apps keep punting users back to the browser.

Fine, I'll build my own text editor — David Bushell walks through building a browser text editor on canvas, then contenteditable, then a textarea, finding plain textarea most performant for long text and contenteditable most accessible.

A small transformer beats many LLMs on ARC — Mithil Vakde trained a transformer in 1.5 hours on a 5090 to 44% on ARC-AGI-1 with test-time training, arguing LLM gains on ARC are mostly post-training and synthetic data, not general reasoning.

But where does taste come from? — Christine Lemmer-Webber argues taste develops from doing the practice yourself, and that heavy generative-AI use can make you "nose-blind" to its output, using the "Taste Is All That's Left" episode as a case study.

Tools

htmx 4.0 (JavaScript) — a fetch()-based rewrite with explicit :inherited attribute inheritance, built-in morph swaps, a new <hx-partial> tag, streaming extensions, and a CLI upgrade checker; 2.x stays latest on npm.

Audacity 4.0 (C++/Qt) — a Qt rebuild with a new clip-editing model (multi-clip editing, grouping, dedicated split tool), workspaces, themes, and a .aup4 project format; some 3.x features like MIDI and macros aren't ported yet.

OpenShot 4.0 (C++/Qt) — adds a Color View (wheels, curves, LUTs, scopes), a Recording View for screen/webcam/mic capture, and local AI object masks via ONNX models (YOLO, EfficientSAM, Cutie) with no cloud dependency.

Janet 1.42.0 (C) — a bug-fix and documentation release for the Lisp language, with GC fiber fixes, shell completions, new OSS-Fuzz targets, int8/uint8/float getters, and Plan 9 port maintenance.

jujutsu 0.45.0 (Rust) — the Git-compatible VCS adds a jj converge command to auto-resolve divergent commits, --file config targeting, and per-worktree Git HEAD tracking.

Worth a Look

Orbify is a WebGL demo of an "Inception-style" curved map for turn-by-turn directions, patent pending.

OpenOffice does not print on Tuesdays — a 2009 debugging classic: file misread "Tue" in PostScript date headers as an Erlang JAM file, so printing failed only on Tuesdays.

Playa Phone is a Burning Man phone booth with internet-calling internals; anyone can dial +1 (775) 557-4848 and reach a random Burner, though it went offline Thursday to a power-supply failure.

BirdNet-Go turns existing security cameras into a 24/7 local bird-and-bat identifier, with species alerts and Home Assistant integration — 418,726 detections and 271 species over a year.