Weekly Hallucinations: HackerTube, GPT Images 2.6 and Students Who Can't Google If Their School Bans AI
Russian-speaking Claude users have a new difficulty level: Persona asks for a photo of your passport and a selfie. With a Russian passport, judging by complaints since October 29, the level ends in a ban. We started the game over with a new account.
Researchers at MIT CSAIL and Omar Khattab, the creator of DSPy, described an approach they call weight-space programming. They give GPT-6 Astra another model’s weights to work with instead of code or a prompt. It reads them, figures out what’s broken, and edits the weights directly without further training. The main experiment used Qwen3.5-0.8B. Astra changed 131,072 weights, or 0.016% of the model, and its score on MATH-500 (500 math olympiad problems) rose from 7.9% to 48.1%. Astra had 50 runs of the small model to find a fix. The diagnosis was pretty mundane: Qwen was getting stuck in loops. The MLP blocks (the fully connected parts of a layer) in layers 15 and 19 were writing a “repeat that again” direction, and Astra subtracted it from 64 output columns in each block. GSM8K (grade-school math word problems) went from 13.8% to 67.1%, IFEval (which checks whether the model follows instructions) went from 21.0% to 62.3%, and the share of answers that hit the 32,768-token limit fell from 93.0% to 33.1%.
Astra wrote a Breakout policy starting from all-zero weights, and it scored 517.4 points. PPO (a standard reinforcement learning algorithm) scored 15.8 after 100 million steps and 25.3 after 500 million. In a policy for driving a little car up a hill, Astra tweaked 3.5% of the weights, and the success rate went from 0 out of 256 attempts to 1024/1024. Given 17,253 weights from four networks trained with PPO, it figured out which game each one played. There were failures, too: on Gemma 3 270M, the score only nudged up from 6.8% to 7.7% because there was no single component to switch off.
Sean Goedecke, an engineer who blogs about LLMs, responded with a write-up whose title says it all: LLMs are not superhuman at reading and writing neural network weights. A heatmap of the first layer, he writes, gives away the game, and it takes only a few lines of Python to make one. And the looping fix is plain old steering, shifting activations along a direction you’ve identified. It’s essentially the same technique the Heretic tool uses to remove refusal behavior from models. In his words, it’s “exactly what a competent human researcher would do.” Zhihu Frontier summarized a write-up by one of its authors. He reconstructed the procedure from the logs and found that 576 of the 579 corrected answers had previously just been cut off at the token limit. So almost all of the MATH-500 gain came from the model no longer getting stuck in loops.
Niels Rogge of Hugging Face showed a replication with their ML Intern agent, and Simon Willison ran Qwen 3.8 27B on his laptop through LM Studio, without tools. From the weights, the model identified Pac-Man in 46 minutes, Pong in 1 hour and 5 minutes, and Breakout in 52 minutes. It gave up on Freeway. Kimi K3.1 Pro, running through the API aggregator OpenRouter, identified Breakout in 9 minutes and 41 seconds. Simon acknowledges that someone who knew what they were doing could pull it off with a pencil, too, and isn’t ready yet to declare the end of the source code era.
Andrej Karpathy put together HackerTube over the weekend. Hacker News has racked up 43 million comments in 20 years, and people are always recommending YouTube videos to each other in them. In a blog post, he describes the pipeline: Opus downloaded the comments from a Hugging Face dataset, and Sonnet in Claude Code filtered out the spam, leaving about 40,000 recommendations from 2007–2026. The site has 6,454 videos across 150 topics, no logins, and all state lives in the browser. It took about two hours in the Claude Code desktop app with Opus 5.5 at medium reasoning effort. The only things Sensei Karpathy set up himself were the Google Cloud API key, the VPS, and the domain. Then he asked Claude to update and secure the server. He put the data in a single archive so anyone could sic Claude on it and build their own version. A quote from the post: “I don’t do anything resembling traditional engineering anymore.” The clones started pouring in right away, from HackerBooks to Wikihack, and an Ask HN thread popped up asking if anyone else was bothered by the flood of “like HackerTube, but for X” apps.
Claude Code itself was caught sending the user’s email address to websites. The person who opened the issue on November 5 spotted their address in the User-Agent header (the string a program uses to identify itself to a server) during a web search and links it to a flood of scam emails. The issue already has more than 730 likes, and one commenter worked out that it ranks fourth by reactions among 16,000 open issues. In an HN thread, Lydia Hallie from the Claude Code team explained what happened and apologized: users had complained that Claude was making up names in @author tags, so the team added the account email to the model’s context. When the model wrote commands like curl, it sometimes put that address in the User-Agent. In the same thread, people noted that many had spotted this with the U.S. Securities and Exchange Commission (SEC) API. Its documentation asks automated clients to identify themselves in the User-Agent, and the example includes an email address. As of version 2.1.317, the built-in cc-plugin-privacy module blocks these requests and is enabled by default. The email address will be removed from the model’s context in the next release. This complaint goes back a while: issue #55743 was opened back in May about the email address appearing in the model’s context with no way to turn it off.
Someone on Reddit counted 16,060 open issues in the Claude Code tracker, and 15,766 of them are unassigned. That’s over 98%. The poster points out that Anthropic itself says it makes more than 30,000 code changes a day.
Since October 29, Russian-speaking Claude users have been reporting the same thing: the service asks them to verify their identity through Persona, a third-party KYC service that requires a photo of an ID and a selfie. As soon as they upload a Russian passport, their account is suspended. The best-known example was posted on Reddit. It’s about a paying subscriber who mainly used Claude Code, lives in New Zealand on a four-year visa, and had paid for another month two days before the suspension. Users in Georgia and Armenia reported similar cases, and one got an email about “a high number of signals” indicating violations of the usage policies. The list of supported countries leaves out Russia and includes New Zealand, Georgia, and Armenia. The rules themselves are based on where someone uses the service rather than their citizenship. We got caught up in it, too, and had to sign up for a new account. We couldn’t find a public explanation from Anthropic.
On November 5, Habr published an account with the opposite outcome: the author uses Claude from Russia through a VPN, got banned after verifying with his international passport, appealed through the standard form, and got his access back about three hours later. His Max subscription was canceled with a partial refund of $78.97, though, and he had to sign up for it again. Anti-Malware points out that the author doesn’t claim the passport caused the ban, and that the region, the VPN, and a change of IP address may have played a part. The appeal form is available at claude.ai/restricted only from the suspended account. Anthropic warns that a response will take longer than usual, and you can export your account data before a decision comes through.
OpenAI showed what its unreleased cybersecurity model can do. In mid-October, a pipeline powered by the model analyzed 2,308 potential vulnerabilities in the Linux kernel, reproduced 1,724 on a live system, and wrote 948 working LPE exploits (escalating an ordinary user’s privileges to root) and 291 data leak PoCs (proofs of concept) for a popular distribution. The whole thing cost $1,213,430 in API credits, or $1,279 per exploit. At Pwn2Own and TyphoonPWN rates, where bugs like these pay $20,000–$70,000, the same haul would be worth $18.9–$66.3 million, or 16–55 times as much. For comparison, OpenAI used kernelCTF, Google’s kernel exploit bounty program: the model produced 21 LPE exploits that met its rules for about $32,936, while kernelCTF has accepted 26 such zero-days since the start of 2026. The model found more than five times as many new LPEs as the July run with GPT-5.6 Sol. On the kernel community’s advice, work on fixes started with the critical bugs, alongside partners in the Patch the Planet program.
OpenAI’s Eric Wallace put it in perspective: before AI, researchers would find about 20 Linux LPEs in a typical year. Here they found about 1,000 in a week for roughly $1 million in tokens. Over the ten days the project ran, other people fixed more than 100 of the LPEs it found, and about 300 were already being discussed publicly. For a well-resourced attacker, an account with minimal privileges on an unpatched system is almost as good as root, so the advice is to run untrusted code in isolation using something like Firecracker or gVisor.
OpenAI released Images 2.6 in ChatGPT, Codex, and the API. Generation is 50% faster, there are now GIFs, SVG export, and image annotation in the API, and a new complexity parameter controls how much planning the model does before it starts drawing. There are two versions in the API: GPT-Image-2.6 Flare returns an image at low quality in 6 seconds, while Sunburst produces higher-quality images and preserves more detail when editing. OpenAI says users generate 4 billion images a week. On the Arena leaderboard, where people vote on models in blind comparisons, Sunburst ranks second in text-to-image generation with 1,409 points, and Flare ranks fourth. OpenAI now holds all five top spots. In image editing, Sunburst ranks third and Flare fifth.
Moonshot released the weights for Kimi K3.1 Pro, as promised by November 4. It’s an MoE (a model that uses only some of its experts for each token) with 2.8 trillion parameters, 104 billion of them active. There are 896 experts, with 16 selected per token plus 2 shared experts. Of its 93 layers, 69 use KDA linear attention and 24 use sparse Gated DSA. These are attention mechanisms the model uses to connect the current token to earlier text. It has a context window of 1,048,576 tokens and takes text and images as input. The weights are stored in MXFP4, a compact format that uses 4-bit numbers. The model was trained for that format from the start. According to Moonshot’s own table, Kimi trails the closed flagship models by a fair margin on HLE-Diamond (the hardest subset of Humanity’s Last Exam, a collection of expert-level questions), scoring 39.4 against 55.1–65.8. On Arena’s agent leaderboard, it placed first among open-weight models and 13th overall.
The license is based on MIT with two caveats: products with more than 100 million monthly active users or $20 million in monthly revenue have to display “Kimi K3.1-Pro” in their interface, and services that sell access to the model as a service and bring in more than $20 million in revenue over 12 months need a separate agreement with Moonshot.
The MindStudio blog looked into why the MSI Prestige N16 Flip AI Plus laptop with Nvidia RTX Spark runs several times slower on Linux than on Windows. Nvidia Platform Controllers and Framework manages how power is split between the CPU and GPU, and only the Windows driver knows how to read the power table. As a result, with the laptop plugged in, the GPU sits at around 780 MHz on Linux versus roughly 2.2 GHz on Windows. GPT-OSS-120B gets 65.4 tokens per second on Windows, 65.1 in WSL (Linux inside Windows), and just 13.9 on native Linux, about 21% of the Windows speed. The funniest part is that on battery power, Linux gets 61–67 tokens per second. Linux initially saw only 28 GB of the 128 GB of shared memory, until the memory reservation was lowered through Windows. Only Nvidia itself can fix this by bringing power management to its Linux driver.
Google will let schools turn off its AI tools, with a catch. Starting next year, Gemini, NotebookLM, and Gemini in Classroom will be off by default for students, and schools will have to turn them on themselves. But if a school blocks AI entirely, students will lose Google Search too. Chris Phillips, who oversees education at Google, told The New York Times that those students “won’t have access to Search and will see a message from their school saying it’s unavailable,” because Search and AI are now “deeply integrated.” The announcement came alongside the launch of Guided Learning mode.
Data centers made it onto the ballot in the November 3 U.S. elections. Journalist JD Capelouto counted about 40 communities in 13 states that voted on bans, specific projects, or the recall of officials who had backed construction. By Semafor’s count, voters in more than 30 communities across nine states backed a moratorium, a ban, or other restrictions. Edgewater, Florida, wrote a ban into its city charter, while Perry, Ohio, put restrictions on hyperscalers (the largest cloud providers) seeking tax breaks. Democrats ran ads against tech companies and data centers in more than 130 races. Adam Kovacevich, head of the tech lobbying group Chamber of Progress, cited NBC exit polls showing that AI and data centers were a deciding issue for 23% of voters. Arizona Rep. Yassamin Ansari proposed a day-one agenda for Democrats: pause advanced AI development, regulate the industry, and ban artificial superintelligence. If you’re curious what’s going on over in ’Murica, give those threads a read. They’re genuinely interesting.
Semafor notes that banks already see local opposition as a credit risk, which ties in neatly with the news about Anthropic. In October, I wrote about its profitability on an adjusted basis, and now, according to the WSJ, its annualized revenue run rate topped $80 billion in October. But investors are skeptical of the $1.5 trillion IPO valuation, and one thinks a fair valuation is closer to $1 trillion. Earlier, the FT reported that Blackstone, the anchor investor in a $63 billion chip financing deal, now expects Anthropic to get a BB credit rating, at the high end of junk territory, after previously expecting it to reach investment grade before 2027.
And one last thing:
Stay curious.
