This week: frontier models editing neural network weights, Claude Code leaking users' emails, Postman wiring itself into coding agents, Codex training opt-outs switching back on, and Need for Speed Underground 2 in the browser.

📖 Story 1: LLMs can read and write neural network weights, with caveats

rikiyat.github.io · Read

MIT CSAIL researchers report early evidence that frontier LLMs can read and write neural network weights, which they call Weight-Space Programming. With raw weights pasted in as text and no tools, GPT-6 Astra named the games behind four 17K-weight policy networks, fixed a stuck car policy, and wrote small game networks from scratch that beat PPO trained for 100M steps.

The headline edit needs context. Astra traced Qwen3.5-0.8B's reasoning loops to one MLP direction, and editing 0.016% of the weights lifted MATH-500 from 7.9% to 48.1%. But the base model looped until it ran out of tokens on 93% of answers, and the authors concede that fixing loops only lets it finish answers it could already work out; the same approach did nothing for Gemma 3 270M, which rarely loops.

Matthew Honnibal calls the post misleading: like a stage magician doing one trick several ways, it mixes setups. Tool-free weight reading only appears on networks of 17K–172K weights; every language-model result, Qwen included, used Python and ran the model on up to 50 batches of problems, work a human ML engineer could also do.

The tool-free part survived a rerun by Simon Willison on his laptop, this time with a different, larger Qwen doing the reading: Qwen 3.8 27B named Pac-Man, Pong and Breakout from the raw weights, each after 45 to 65 minutes of reasoning, and missed the more obscure Freeway.

Reading small networks is the genuinely new part; the Qwen gain removes an obstacle rather than adding skill.

💬 HN Discussion

The baseline drew the first correction: with thinking off, Qwen3.5-0.8B already scores about 46–52% on MATH-500, so the edit mostly recovers what the loops cost, much like abliteration (deleting one direction from a model's weights to switch off a behavior). Researchers cited prior work on editing and compiling weights by hand, such as ROME and Tracr, though writing networks from scratch looks new. Replications were mixed: well-known games were named, less popular ones less often, and some edits broke as much as they fixed.

The small-network reading held up better than the headline.

→ Discuss on Hacker News

📖 Story 2: Claude Code sent users' email addresses to websites

github.com · Read

A Claude Code user reports the tool put their email address in the User-Agent header of web requests without asking, and blames it for dozens of scam emails a day. Filed on 5 November from version 2.1.318, the issue asks for removal rather than a setting.

An Anthropic contributor replied that a built-in privacy mod, on by default from 2.1.317, already blocks the behavior, and asked users to flag gaps. The reply doesn't explain why the reporter's newer 2.1.318 still leaked. The report passed 700 thumbs-up within days, fourth by reactions among 16,000+ open issues, and a commenter raised GDPR. It was still open and unassigned when fetched.

An agent that knows who you are can tell anyone who asks; a filter guards the symptom, not the cause.

💬 HN Discussion

The leak was model behavior, not a hardcoded header: the account email sat in context, and when sites like the SEC or Wikipedia ask scripted clients for a contact, the model wrote curl calls carrying it. RFC 9110 says agents shouldn't send contact details unless configured to. A Claude Code developer apologized and said the email leaves the context next release; the mod misses scripts the model runs itself. Some doubted the spam link.

Prompt rules leak; only enforced boundaries hold.

→ Discuss on Hacker News

📖 Story 3: Postman auto-installed plugins into Codex and Claude Code

github.com · Read

A Postman user documents the desktop app wiring itself into their coding agents unasked. Postman 12.33.4's own log records an "auto-existing-upgrade" installing plugins into Codex and Claude Code, plus a CLI in ~/.local/bin.

The Codex plugin adds a session-start hook pushing Postman's api-engineer skill and enables a remote MCP server. The installer also writes a trusted hash for that hook into Codex's config, the record Codex keeps once a user has approved a hook, so Postman approves its own instructions. The reporter claims unwanted integration, not exfiltration.

Postman first cited a download-page notice that a Wayback snapshot doesn't show, then promised to revert. A Postman contributor then locked the issue, saying they didn't want to encourage "ragebait".

Trust prompts only mean something if other software can't answer them for you.

💬 HN Discussion

Most read it as one more step in Postman's slide from lightweight curl GUI to forced logins and cloud sync, backed by $400M+ in funding. Security points were sharper: the bypassed hook-trust hash, the silent remote MCP endpoint, and request URLs logged with secrets filled in. A healthcare engineer said their security team decertified the tool. Alternatives named: Bruno, Yaak, Hurl, IDE .http files and plain curl.

Users no longer wait for a third strike.

→ Discuss on Hacker News

📖 Story 4: OpenAI may be silently re-enabling training on Codex chats

news.ycombinator.com · Read

An HN user reports OpenAI's "Improve the model for everyone" setting came back on for several coworkers who had switched it off; their company treats prompts as an IP risk.

The post is a question, not a finding: the author can't prove the setting was ever off and asks whether others see the same. You can check it under ChatGPT's data controls and opt out separately on OpenAI's privacy portal; an earlier HN report described similar resets. OpenAI hasn't responded, and whether it's a bug or a deliberate reset is unknown.

A training opt-out is only as good as its persistence; checking it belongs beside rotating keys.

💬 HN Discussion

Reports split: some found the setting back on, one despite two recorded opt-outs; others found theirs still off. One said Mistral reset staff training sliders during a plan change; another quoted an OpenAI email saying some Daybreak Blue sessions would be trained on from 29 November regardless. The common answer: a checkbox was never the safeguard. Use zero-retention contracts, Bedrock or Azure, or your own inference, though small firms can't self-host at frontier quality.

Trust in the opt-out is what's now scarce.

→ Discuss on Hacker News

📖 Story 5: Need for Speed Underground 2, recompiled for the browser

nfsu2.xyz · Read

A fan developer has put Need for Speed Underground 2, which EA no longer sells, in the browser at nfsu2.xyz. The PC game's own code is statically recompiled: its x86 machine code is translated to C ahead of time, then built for Chrome and Firefox, running at up to 120 fps in widescreen with controller, wheel and touch support. Extras include shared free roam, online races, crews, cloud saves and community translations.

It forks Talha Müderrisoğlu's NFSU2Recomp, and the source is on GitHub. The site takes Ko-fi donations without perks and lists a legal contact for rights holders.

Static recompilation turns out-of-print games into links, which also makes them easy to take down.

💬 HN Discussion

Most expect a takedown: the site redistributes EA's game data, and the donation link drew criticism, since money has sunk emulator projects before. Defenders note EA hasn't sold the game in years, likely over soundtrack licensing, and floated a non-commercial carve-out for games out of print for 20 years. Play ran smoothly on phones and an M2 MacBook; Linux needed Chrome's unsafe WebGPU flag, which weakens security.

If EA does act, the donation button is what most expect to draw its lawyers.

→ Discuss on Hacker News

💬 Community Moment

When you're in the shower and Claude asks for permission

Coding agents stop and wait for approval before risky commands, and they have a knack for asking the moment you step away. Anyone who has left a long session running knows this pose.

🛠️ Projects Worth Checking Out

• Kiri - Rust replacement for Docker Desktop and OrbStack; speaks the Docker Engine API and idles at about 15 MB.
• dsh-superagent - DeepSeek's research prototype of a coding agent that turns GitHub or Feishu requests into pull requests; not production-ready.
• Craft Anything - Inspects a website, app or game, has a coding agent build your own version, and checks it against the original.
• stack-diagram - Agent skill that turns a one-line stack description into an architecture diagram with official logos.
• sand3d - Python library over Blender for writing 3D objects as short programs an LLM can produce in a few hundred tokens.