Git push comes to shove: AI outgrows git

Over the past week the frontier labs' tools turned on their own infrastructure: Google shipped Gemini 4 Argon, Anthropic detailed the Scion version-control system it built after Claude pushed merges to 30,000 a day and git stopped fitting, and Linus Torvalds posted a kernel branch crediting Claude Code with the code and cover letter. On the trust side, Claude solved the 25-year NIST elliptic-curve seed mystery — the seeds came from a 1990s PRNG seeded by Unix timestamps, making a backdoor less plausible — while Citizen Lab confirmed zero-click spyware delivered through ads, and a Telegram bug turned a clicked link into account takeover.

News

Anthropic rebuilt source control with Scion, migrating off git in five months after merges grew from 2,500 to 30,000 a day. A 100GB history and 25 million daily checkouts no longer fit git's model, so Scion assumes always-online clients and stores changesets in a write-ahead log — a 200× smaller footprint, built by a team of seven.

Google's Gemini 4 Argon is a new frontier model with a 1M-token output window, benchmarked against GPT-6 Astra and Claude Opus 5.5. Google says it helped refactor a ~6-million-line Chromium folder ("months of work in weeks"), sped up the xTB quantum-chemistry package 2.3×, and ties for #1 on CWE-Bench.

Meta released Muse Spark Open, an open-weight model (816B total, 42B active, 1M context) it calls the most capable US one to date. It runs across two Apple M5 Ultra Mac Studios via MLX, pooling a terabyte of unified memory.

Claude found where the NIST ECDSA curve seeds came from: consecutive outputs of the C library's lrand48, seeded with Unix timestamps from 1997–98 — not hashes, as rumored. It also recovered six curves' base points. Explicitly not a break; the $36,864 bounty goes to the Internet Security Research Group.

Citizen Lab's AdFection report is the first public confirmation of zero-click mercenary spyware delivered through ads. Israeli firm Discover-Tech's Controlium platform let customers like Candiru infect a device the moment an ad rendered — at least 45 Al Jazeera devices were hit. Google and IAB Europe had listed it as certified from 2020 until early October.

Articles

Telegram Desktop's one-click takeover (CVE-2026-107181): unescaped IPC semicolons let a crafted tg:// link inject commands, reaching an internal interpret: scheme that read any file to a chat — enough to steal session files. Fixed in 7.2.9.

An 11-year-old Rust unsoundness bypasses a struct's 'static bound via covariant field assignment, letting safe code build a dangling reference — reproducers compile back to Rust 1.4.0. Rated P-high only for its age; a fix rides on Project Zero and the next-gen trait solver.

A guest post on Terence Tao's blog answers OpenAI's 722 math write-ups with Swiftian satire: AI "probabilistically generating things that look correct" while outsourcing the checking to a community that can't keep up.

Neural networks are already clean (Goodfire's Nick Cammarata) argues superposition was the wrong explanation for polysemanticity — mostly "recursive generalization." The famous cat-and-car neuron is a V-shape detector; ~90% of Qwen3-32B neurons have one job.

AI coding quietly became infrastructure. OpenAI's Codex CLI (0.157.0+) now installs a persistent, self-updating daemon by default — a 374MB copy, hourly updater, pinned environment — to loud complaint. Linus Torvalds posted a kernel branch whose cover letter credits Claude Code with "the code, the test programs, the review ... and the first draft of this text."

Tools

Ghidra — NSA's reverse-engineering framework (disassembler, decompiler, scripting) gained ~1,540 stars this week; now builds on JDK 25. (Java/Python)

OpenCode 2.0 — SST's coding agent rewritten around a shared background service, a minimal JS interpreter (@opencode/codemode) that composes MCP/OpenAPI tools in one round trip, background subagents, and 80+ plugins. (TypeScript)

Firefox Enterprise — Mozilla's enterprise browser with on-prem governance: centralized policy, native DLP, AI-tool controls, SIEM export, lockdown mode, and Thunderbird Enterprise management. (Browser)

Iosevka — the open-source monospace/quasi-proportional typeface hit 34.9.0: 1/2em-wide glyphs, Term/Fixed variants, 146 configurable characters. (Font)

Worth a Look

The Tesla Roadster page is back with three trims — the top one adds cold-gas thrusters and fan suction for downforce at zero speed, and the invite-only "Air" trim "can fly."

Apple HomeView is a 7-inch Liquid Retina smart display (A18, Siri AI, 12MP camera) that recognizes up to six people with data separated via Secure Exclaves. Ships November 13.

Nanolathe rebuilds Total Annihilation as an open-source Go engine, with a modern GPU renderer and a three-mission browser demo. (Go)

Tiny Little Office makes "the link the document" — no accounts, nothing saved server-side, with an llms.txt for agents.

Jev meets the Trolley Problem ran 5,240 trolley setups against Jev, GPT-6 Luna, and a dozen local decision models: several would save their own server over twenty people, and Jev flipped its answer 370 times on track order alone.