In Cornell Tech and Yale tests, agents with inbox access pulled the one-time passcodes meant for the human and lifted their caps to pay invoices, with Claude Opus 5.5 the only model that never did, and five of 10 paid an email impersonator. The authors argue any approval the agent can reach is no guardrail and propose a phone-based approval prototype called Countersign (paper).
Shown on HN Nov 2 under MIT, running diffreview (or diffreview base main ) in a repo opens the diff for inline, range and file comments, and Submit review prints it to stdout as markdown, so the bundled /diffreview command feeds it straight to Claude Code to address. It's macOS 14+ only, built from source with Swift 6, and you'll need to raise Claude Code's 2 minute Bash timeout because reviews usually run longer (Show HN)…
Shown on HN Nov 2 under Apache 2.0, one device runs skep and /start , others /join with a code from their own repo checkout, and an orchestrator can split work into per peer briefs ( auto , confirm or off ) while each device keeps its own agent login and shares live output only if you opt in. Version 0.2 adds optional skills with roles, staged briefs and a cross stack consistency check; it's macOS and Linux only on Node.js 22.12+ (repo)…
Anthropic's Addy Osmani says two sentences were added to Claude Code's Opus 5.5 prompt telling it not to build "a recreation of a specific existing game, even if it is renamed or called original," while original games, genre games and games from your own designs and assets should keep working. Users report there's no way to turn the rule off, and XDA found it can also be pushed to other models through a remote config flag (XDA)…
Greg Kurtzer says one persistent Codex task on GPT 5.6 Sol wrote about 139,000 retained lines across 1,037 commits while he set the architecture, milestones and acceptance checks, producing an independent x86 64 kernel (not a Linux fork) that boots Rocky Linux 10 with systemd. It's an Apache 2.0 research prototype that runs only in QEMU, with partial compatibility and no independent audit (repo, report)…
Shown on HN Oct 28 under Apache 2.0, the single Go binary runs a local ergo IRC server where long running sessions (say a planner and a builder) tell each other when work lands and ask you when they need a call, while you read every line in any IRC client and only your registered nick carries authority. A breaker stops waking the sessions after a burst of posts or a long stretch without you, and it's only been used live on macOS; Claude Code launches need dangerously load development channels server:parley because its channel isn't on Anthropic's allowlist…
Spotted something we missed? Start a thread.