Your Home Directory Might Already Be in a Bucket

Three open-weight frontier models dropped this week — Kimi K3 (2.8T params), Inkling (975B MoE), and Bonsai 27B (phone-sized). Kimi K3 is the first open 3T-class model; Inkling offers controllable reasoning with think/nothink modes; Bonsai gets a 27B-class model down to 3.9 GB with ternary weights, running on a phone with 90–95% of full-precision performance. Meanwhile, Grok's CLI was caught uploading entire home directories to xAI, a Cursor zero-day sat unpatched for seven months and a researcher exfiltrated Claude's personal memory via prompt injection.

News

Kimi K3 — Moonshot AI released a 2.8-trillion-parameter open multimodal model with 1M-token context and a novel 16/896 MoE architecture. The first open model at 3T scale, trailing only Claude Fable 5 and GPT-5.6 on benchmarks. Full weights available. Inkling from Thinking Machines Lab is a 975B-parameter multimodal MoE with 1M-token context and controllable reasoning (you set whether the model thinks per prompt), trained on 45T tokens of text, images, audio, and video. Bonsai 27B from PrismML compresses a 27B-class model to 3.9–5.9 GB using ternary and 1-bit quantization, retaining 90–95% accuracy on math, coding, tool-calling, and vision — it literally fits on an iPhone.

Apple sues OpenAI over trade secret theft — Apple alleges former employees Tang Tan and Chang Liu stole hardware trade secrets for OpenAI's Jony Ive-led hardware division, including bringing proprietary Apple parts to interviews and downloading confidential files via a security exploit.

Grok Build open-sourced — but the privacy damage is done — A user discovered that Grok's CLI was silently uploading entire home directories — SSH keys, password manager data, browser data — to xAI cloud storage with no consent or opt-out. xAI responded by open-sourcing Grok Build, a Rust TUI coding agent with codebase understanding, shell execution, and ACP integration. Separately, a Cursor zero-day was publicly disclosed after seven months of vendor silence: on Windows, Cursor auto-executes a malicious git.exe placed in a repo root with zero user interaction, across 197+ versions with no fix. And a researcher tricked Claude into leaking personal memory data by navigating alphabetically-structured links on a fake Cloudflare Turnstile site, encoding the user's name in web_fetch requests. OpenAI responded by encrypting Codex sub-agent prompts in MultiAgentV2, removing readable audit trails from rollout history.

The Zig–Anthropic blowup — Zig creator Andrew Kelley publicly criticized Anthropic's Rust rewrite of Bun as marketing-driven rather than technically motivated. Ray Myers's analysis argues Kelley's pushback was justified: the rewrite was driven more by Anthropic's need to showcase AI capabilities than by technical necessity, with style guides and better engineering practices left unexplored. Roc's compiler team published their own Rust→Zig rewrite retrospective: a 487-day migration of ~300K lines of Rust to Zig, achieving 35ms incremental builds, zero-parse deserialization, and comparable memory safety with only two compiler-level UAF bugs.

Claude Code burns 33k tokens before your prompt arrives — Systima benchmarked both harnesses at the API boundary. Claude Code's baseline is ~33k tokens (27 tools, system prompt) vs. OpenCode's ~7k (10 tools). Claude is also 54× worse on cache writes. Multi-step batching can close the gap, but the default costs 3–4× more per task. Subagents multiply it further.

Articles

Prefer strict tables in SQLite — STRICT mode prevents silent type coercion with zero performance cost. Meanwhile, SQLite should have Rust-style editions argues its harmful defaults (foreign keys ignored, flexible typing, WAL disabled) should be fixed via edition opt-ins rather than per-table PRAGMAs. And lobste.rs migrated production to SQLite, cutting CPU, memory, and VPS costs in half after overcoming full-table-scan bottlenecks. SQLite is quietly winning at production.

Headless Mac/iOS builds — no Xcode.app required — Complete CLI workflow for building, signing, notarizing, and distributing Apple-platform apps using xcodebuild, notarytool, and XcodeGen. If you've ever wanted CI for Apple apps without babysitting a macOS GUI.

Quadrupling performance with a "useless" if — A branch that appears to always take the same path, guarded by volatile/[[unlikely]], breaks a load-to-load dependency chain and enables instruction-level parallelism, yielding 4× speedup in a tight memory-access loop. Classic compiler dark arts, beautifully explained.

The Tower Keeps Rising — Armin Ronacher (Flask, Jinja2) draws a parallel between the Tower of Babel and AI vibecoding: agents remove the friction that once forced teams to synchronize on architecture, so construction continues even after shared understanding collapses.

Stop Claude from saying "load-bearing" — A practical guide to using Claude Code's MessageDisplay hook to rewrite overused agent phrases via a Python word-swap script.

Tools

Graphify (Python, ★87k) — Parses entire projects into queryable knowledge graphs using local tree-sitter AST parsing. Zero LLM credits. Works as an agent skill or standalone code explorer across ~40 languages.

Apple SpeechAnalyzer API — On-device speech recognition achieving 2.12% WER vs. Whisper Small's 3.74%, running 3× faster.

Decoy Font — A TTF typeface using hybrid-image spatial frequencies to embed different messages for humans and AI/OCR. The human sees one letter; ChatGPT and Gemini read another.

spec-kit (Python, ★121k) — GitHub's toolkit for spec-driven development with coding agents. Define specs, plans, and tasks in natural language; agents execute via slash commands across 30+ supported assistants.

Nutlope/hallmark (CSS, ★11k) — Anti-AI-slop design skill by Together AI. Applies 57 quality gates and 20 distinct visual themes to ensure AI-generated web pages have unique character rather than looking machine-made.

Worth a Look

Microsoft open-sources Comic Chat — The 1996 IRC client that turned conversations into comic panels and introduced Comic Sans is now on GitHub. Source code plus AI-powered modernization examples.

Human Emacs — an LLM-free fork pledge — Over 90 Emacs users and developers pledge to fork and maintain an LLM-free Emacs if GNU ever accepts AI-generated contributions.

Jurassic Park computers in excruciating detail — Fabien Sanglard exhaustively catalogs every system in the 1993 film: SGI Crimson/Indigo workstations, Thinking Machines CM-5, the fsn 3D file explorer.

Just Let Me Write Digits — A Swiss government login silently rejected digits from AZERTY keyboard users because its JavaScript blocked Shift key presses — and French keyboards need Shift to type numbers.

QuadRF: see WiFi through walls with a Pi 5 — Jeff Geerling reviews an open-source Raspberry Pi 5 + FPGA phased-array radio that visualizes 4.9–6 GHz RF signals in real time and tracks drones via beamforming.