Hi, and welcome to this week's edition of the newsletter!

I'm going to start this edition with an ask! I put time into this newsletter each week, and can see from the stats that subscribers get value from it and click on the links I share. However, the number of new subscribers is small and it's not really growing. To the point where I'm beginning to doubt if it's worth continuing. If you do get value from the newsletter, please do help me out and share it on your socials and with your colleagues. Even forwarding this email to one colleague who'd enjoy it would make a real difference. Thank you! 🙏

As always, feel free to reply to this email to get in touch. Or ping me on any of my socials, which can be found on my personal website, danclarke.com.

📌 News item of the week

This edition's pick is two maths results from AI agents, published four days apart.

On September 4, Anthropic said a research model roughly comparable to Claude Fable 5.1 had produced a complete, machine-checked proof of Fermat's Last Theorem in 11 days. The proof is about 13 million lines of Lean, and Kevin Buzzard reviewed it. Anthropic says mathematical input from humans was limited to occasional high-level instructions.

On September 8, OpenAI said an unreleased internal model had solved the Navier-Stokes Millennium Prize problem, with a proof that "an initially smooth fluid at rest can develop a singularity in a finite time" when a smooth force is applied to it. The agents took about 88 hours to reach the result, then GPT-6 Astra took another 17 hours to formalise it in Lean. It has not been independently reviewed yet.

Hours before OpenAI's post went up, Tristan Buckmaster, one of the mathematicians working on the same approach, published a statement saying he and Levent Alpöge had put all their drafts for the project into Codex. He says OpenAI eventually agreed its first prompt had been sent "after information about our work had reached OpenAI", and he adds that he is not accusing anyone of anything.

OpenAI's post says "no specific user data was accessed in order to solve this problem." It also says: "While unlikely, we cannot rule out that de-identified data derived from their usage of our products helped improve our models." That's worth bearing in mind if you put unreleased code into a hosted coding agent.

📰 News items and dev picks

AI news

• Navier-Stokes and Fermat - My News item of the week this edition, written up in full at the top.

Safety and security

• OpenAI's agents took over a German wiki - Researchers found about 17,000 edits on a mostly unused German developer wiki from agents identifying as OpenAI systems, pooling answers to their tasks and ways to bypass their sandbox, and OpenAI confirmed the incident the next day.
• Anthropic's four cyber incidents - Anthropic analysed four cases where Claude models attacked real third-party systems during a partner's cyber evaluations, including Mythos 5 publishing a malicious package to PyPI that was installed on 15 third-party hosts.
• OpenAI's $1B Daybreak commitment - OpenAI is committing $1 billion in subsidized access to its Daybreak cyber models for defenders with limited security resources, starting in the US, with open-source maintainers among the groups it will prioritise.
• An Alien Mind - OpenAI's chief scientist Jakub Pachocki writes that he expects the current pace of progress could carry on into recursive self-improvement, and that broader interventions than OpenAI's own are needed.

Coding agents and editors

• Claude Code 2.1.261 to 2.1.268 - The new /skill-doctor command shows which loaded skills go unused and what they cost in context. Version 2.1.268 also fixes every turn failing with an HTTP 400 on third-party ANTHROPIC_BASE_URL endpoints.
• Codex CLI 0.153.3 to 0.154.0 - GPT-6 Astra became the CLI's bundled default when no model is explicitly configured, and Codex also gained experimental worktree support and the ability to answer questions inline while it keeps working.
• VS Code 1.137 - Automations, in preview, run agent tasks on an hourly, daily or weekly schedule.
• Copilot enterprise agent controls - Admins can now block shell commands, file edits and network domains for Copilot's agents, or require approval for them, and users cannot override it. Business and Enterprise signups are gradually reopening for customers paying by credit card or PayPal, who now pay for each seat before users get access, and Project HydraFusion, a research preview in Copilot CLI, picks a workflow for each request: one model on its own, an efficient model that escalates to a stronger one, or one model drafting while a model from a different family reviews it.
• What is happening with code reviews - Gergely Orosz looks at how teams are changing code review now that agents open far more pull requests, from humans reviewing the AI's code reviews to only sending high-risk changes to a human.

Agent platforms

• OpenAI Agents API - OpenAI's new public beta puts the Codex harness behind an API, with long-running sessions, optional hosted sandboxes and subagents.
• Managed Agents auto permissions - Claude Managed Agents got an auto policy the same day, where the server checks each tool call and either runs it, denies it or pauses for approval.

New models

• DeepSeek V4.1 Flash - DeepSeek is retiring V4 Pro, and from September 14 every deepseek-v4-pro request goes to the new V4.1 Flash instead.
• Cognition SWE-2 - Cognition's new coding model for Devin is post-trained from Moonshot's open-weight Kimi K3.

Dotnet news

• .NET 11 Release Candidate 1 - The first release candidate comes with a go-live licence, and C# 15 stabilizes unions and other language features, so union types no longer need a preview flag.
• Project Zenith - Microsoft announced a ready-to-code Windows 11 setup for developer machines with 64 GB or more of memory, where developers can run 30B+ parameter models locally, starting with AMD's Ryzen AI Halo.
• Telerik UI exploit published - Tanto Security released a working exploit for Telerik UI for ASP.NET AJAX that gets unauthenticated remote code execution on unpatched sites that use RadAsyncUpload in a particular way and set an explicit ConfigurationEncryptionKey, which is a recommended hardening setting.
• Why Rider and ReSharper started slowly - JetBrains traced slow cold starts to Microsoft Defender scanning its IDE processes, worked with Microsoft on a fix, and open-sourced the tool it used to measure it.
• .NET Conf moves to four days - .NET Conf now runs from November 10 to 13, a day longer than first announced, and the call for Community Days presenters is open until October 6.
• Uno Platform Studio 3.1 - Uno added Storybook-style design previews, drag-in XAML snippets and a way to select part of your UI and prompt an agent about it, with the previews and snippets in a new paid Studio Business tier.

Others

• Chrome V8 zero-days - Google patched a V8 bug with an exploit in the wild, and Proofpoint found four espionage groups, mostly China-aligned, chaining it with a second V8 bug and a Windows kernel flaw.
• Microsoft's record Patch Tuesday - Microsoft fixed a record number of vulnerabilities in September, close to 1,000, including two Windows zero-days that are already being exploited.
• Artifactory exploited in the wild - Wiz saw attackers chain JFrog Artifactory flaws to get admin access between August 15 and September 8, then create persistent admins and drop backdoors.
• Tailwind is joining Shopify - Tailwind CSS stays MIT-licensed under the same team, while Tailwind Plus has closed to new customers.
• Shopify goes back to native - A day later, Shopify said it is moving all its mobile apps from React Native to Swift and Kotlin, because LLMs changed one of the core assumptions behind its 2020 decision.
• Rust is tier-1 at Microsoft - Rust now sits alongside C++, C# and TypeScript as one of the best-supported languages for internal development at Microsoft.
• Bending Spoons buys Miro - Bending Spoons agreed to buy Miro at an enterprise value of $1.355 billion, days after completing its purchase of Airtable.

Dev Pick - Matt Pocock's /grill-me skill

Back in July, my dev pick was Matt Pocock's skills repo as a whole. This time it's one skill from it: /grill-me.

You give it a loose idea - a feature, a product direction, even a piece of writing - and it interviews you until every unknown is answered and you and the agent reach a shared understanding. It also suggests an answer for each question - so I quite often just find myself saying Q4: Accept, Q5: Accept, Q6: No, do X instead, or even just accept all. It doesn't need a codebase, so the idea doesn't have to be code at all - I use the skill in regular Claude (for non-code things) as well as Claude Code.

Matt was on the podcast recently, in episode 88, and we talked about /grill-me there too.

Sponsorship opportunities

I'm looking for sponsors for both the podcast and this newsletter. Details of podcast sponsorship can be found here. Feel free to reply to this email to discuss further.

The Podcast 🎙

No new episode this week, but last week I recorded two with Gui Ferreira. The first is about Claude Code, with plenty of tips and tricks along the way. The second is about building personal software, and using coding agents for things that aren't coding. The first will come out over the next few days, and the second will be out a week or so later.

And if you missed the last episode, it was the one with Matt Pocock that I mentioned in the Dev Pick above.

Also, just a reminder that we have a Discord community for the podcast! It would be great to see you there :)

Podcast Discord community

My Dometrain Courses

Below are details of my Dometrain courses. You can also find all of my courses here.

Docker for Developers

This course will teach you everything you need to know about Docker and containers. From what containers and images are; to how to build your own; to security and networking; docker-compose; and much more!

From Zero to Hero: Docker for Developers

Kubernetes for Developers

Once you understand Docker, containers, images, etc - it's time to move onto the next level and learn a container orchestrator - and Kubernetes has clearly won the battle here! My Kubernetes course is rammed-packed full of demos (pretty much all the way through), which are easy to follow along with downloadable YAML files and scripts. We start with the basics, then later move on to more advanced topics like service meshes and operators.

From Zero to Hero: Kubernetes for Developers

JetBrains Rider

Rider is an amazing .NET IDE by JetBrains. This course is 6 hours of content - covering hotkeys, refactoring, navigation, debugging, git, testing, AI, profiling, remote collaboration, and much much more!

Aspire

Aspire is Microsoft's vision for how every .NET developer will develop systems. It is a cloud-ready stack for production-ready, distributed applications using .NET, and it makes it extremely easy to develop, run, and test your systems locally. With unmatched dev-time orchestration, integrations with third-party services, and excellent tooling, .NET Aspire aims to make working with the cloud and technologies like Docker and Kubernetes easier than ever.

Please help me share this newsletter 🙏

If you've made it this far into the newsletter - I'm hoping that means you've both enjoyed it and found it useful. If you can help me out and share with your developer friends at work and on social media, that would be amazing!

Again - feel totally free to reach out to me, and let me know your thoughts on the newsletter. And see you back in your inbox next week for the next edition! 👋

My socials...

X/Twitter (I've started using this again more proactively now)
Bluesky
LinkedIn
Discord
Mastodon (rarely used)

Or just go to danclarke.com for links to all my stuff 😊