#131

Anthropic and OpenAI reasoning blobs gave up 182 credentials, and Google crowned Go for agents

Eight researchers decoded 315,320 encrypted reasoning blocks and pulled 182 credentials out of public repos. Only 17% of Go developers run agents unsupervised.

Listen to this edition

Matthew Green filed the bug in May, and Anthropic told him it saw no security implications in replays. Three months later, eight researchers decoded 315,320 encrypted reasoning blocks scraped from public repos. Out came 367 PII artifacts and 182 credentials.

Both vendors tell you to pass those blocks back unchanged inside every tool loop. So your agent transcripts are already full of them.

In today’s indie hacker news:

  • 🔓 Your agent transcripts are a plaintext leak
  • 🐹 Google crowned Go, its own survey disagrees
  • 🗜️ Compression is prediction, and a free model eval
  • 💊 England’s hepatitis C funnel is drying out
  • 🪑 OpenAI’s only ethicist left with no replacement

TOP STORIES

🔓 TRUST ME BRO, IT’S ENCRYPTED

A padlocked black box sitting open inside a glowing repository folder, spilling keys and identity cards onto the floor

Eight researchers turned a declined bug report into a working extraction attack.

The story: Stealing Reasoning Traces from Proprietary LLM APIs landed on arXiv on 10 Aug 2026. The authors say the encrypted blocks are interchangeable across sessions, users, and sibling models inside one provider. Feed a strong model’s trace to a weaker sibling and it prints the reasoning back in plaintext. The stronger model never gets jailbroken.

The paper builds on a weekend project. Johns Hopkins cryptographer Matthew Green burned 20 hours and about 5 million Codex tokens in May. He got replay working across separate accounts, filed it with both bug bounty programs, and got told no.

The details:

  • Tampering with a block throws an API error. Replaying an unmodified older block throws nothing at all.
  • Green reads cross-account replay as one global key covering everyone’s reasoning data. Zero data retention is the mode that hands it to the client.
  • Anthropic documents that signatures work across its own API, Amazon Bedrock, and Google Cloud. That portability is a feature, not an accident.
  • One paper, four attack vectors. Distillation bypass, data extraction, hazardous content behind a safe refusal, and invisible prompt injection.
  • You pay for thinking tokens as output tokens, and no setting returns the raw chain of thought.

“If you think reasoning state is worth encrypting, then properly encrypt it.” (Matthew Green, cryptographer, Johns Hopkins University)

Why builders care: Every agent transcript you committed is now a candidate leak, not an opaque blob. That makes signature and encrypted_content fields secrets, and user supplied JSON an injection surface.

🐹 THE CALL IS COMING FROM INSIDE THE SURVEY

A presenter gesturing proudly at a giant glowing gopher mascot while the developers below stare down at their laptops

Google says Go is built for agents, and its own survey pushes back.

The story: Google’s Developers Blog argued on Aug. 11 that Go is the ideal language for AI-assisted engineering. The case from Cameron Balahan and Richard Seroter rests on verification. When an agent writes hundreds of valid lines in seconds, your night goes to reading them. So the pitch is a toolchain that shrinks review. One canonical format, a compiler that rejects hallucinated methods, a compile loop fast enough to run every pass.

The same team also runs a survey. The 2025 Go Developer Survey drew 5,379 cleaned responses. Only 17% call unsupervised agents their primary way of using AI tools, against 40% occasionally trying them.

The details:

  • The post’s load-bearing number carries no source. A first refactor pass “might be 95% correct”, with no benchmark or dataset cited.
  • Go developers rate Go at 91% satisfaction and their AI tools at 55%. Same survey, same people.
  • 53% name non-functional code as their main problem with AI tools. Another 30% say even the working code is poor.
  • 78% are not building AI features into their Go software, a 14-point move away from that work since 2024.
  • The modernizer program exists because models wrote stale Go. The team started it in December 2024, then rewrote go fix for Go 1.26.

”… mentally taxing to review ai generated code … that overhead kills the productivity potential.” (2025 Go Developer Survey respondent)

Why builders care: Google’s argument survives its own survey, but only as a claim about tooling, not adoption. If review is your bottleneck, the cheap move is a language server your agent can query, not a rewrite.

🗜️ THE MODEL IS THE ZIP FILE

One handwritten sentence funneled through two glass tubes, one spilling a wide stream of binary and one a thin ribbon

The same Dickens line costs 434 bits or 176, depending on the model.

The story: ngrok’s explainer by Annie Sexton makes one claim and then proves it with arithmetic. Entropy coders are fixed, deterministic, and lossless, so there is nothing in them to tune. The only lever left is the model predicting what comes next. Run the same Charles Dickens quote through an arithmetic coder twice. An order-1 model spends 434 bits while GPT-2 spends 176.

That is 24% of the original against 10%, using a model Sexton calls archaic. The idea is 75 years old. Shannon’s Prediction and Entropy of Printed English had humans guess the next letter in 1951. He landed near one bit per letter, against 4.7 for a bare alphabet.

The details:

  • Context is the whole game. The letter U costs about 5.158 bits alone and about 0.001 bits right after a Q.
  • Skew pays more than length. “ABABAAC” lands at 1.38 bits per symbol, while a string with one dominant letter lands at 0.82.
  • A confident wrong guess is priced in bits. “Bermuda” at 0.82 probability costs 0.29 bits, and the actual next word costs 5.64.
  • DeepMind went further. Chinchilla 70B squeezed ImageNet patches to 43.4%, beating PNG at 58.5% on data it never trained on.
  • The post kills its own idea. Swapping gzip for a model means shipping gigabytes to both ends to save a few KB.

“Fortunately, compressing text is much easier. It is only as hard as AI.” (Matt Mahoney, Large Text Compression Benchmark)

Why builders care: Run the equivalence backwards and you get a free eval. Across 31 public LLMs and 12 benchmarks, average score tracked compression ability almost linearly. Ranking candidates on your own corpus is a same-day experiment.

💊 CAC, BUT FOR A CURE

Two funnels over a clinic floor, a narrow one dropping a single pill into a cup and a huge one swallowing a crowd

England cured 100,000 people, then published its cost per diagnosis by channel.

The story: NHS England said on 11 August that over 100,000 people have been diagnosed and treated since 2015. The cure is a tablet course of 8 to 12 weeks that works in more than 95% of cases. What makes this a builder story is the UKHSA data underneath it.

UKHSA publishes the number most companies keep private: people tested per new diagnosis, split by channel. Drug services need 37 and prisons need 64. Emergency departments need 1,298 for the same result.

The details:

  • Emergency departments carried half the testing volume. Of 1,149,711 antibody tests in 2024, they produced 614 diagnoses.
  • The funnel is drying out. Positivity fell from a 42.1% peak in 2016 to 12.2% last year.
  • Annual treatment starts peaked at 12,276 in 2019 and now run at 7,963.
  • England clears the treatment bar at 81.5% and misses the diagnosis bar at 84.6% against a 90% target.
  • The deadline moved. In December 2022 the NHS said it was on track to eliminate hepatitis C by 2025.

Why builders care: The last 15% of a market has different unit economics than the first 85%. The expensive channel earns its cost by reaching people the cheap ones never touch. Publishing cost per channel is also what lets anyone audit your claim.

🪑 NOBODY’S JOB, EVERYBODY’S PROBLEM

An empty office chair pushed back from a desk with a blank nameplate while engineers rush past in a lit hallway

OpenAI’s only dedicated ethicist left in July, and the seat is still empty.

The story: Chloe Bakalar joined OpenAI in August 2025 and left last month with no announcement. The Financial Times report says one person familiar with the role called her the only dedicated ethicist. There is no replacement. She spent six years at Meta before that, ending as chief ethicist.

OpenAI’s answer is that the job was never one person’s. A spokesperson said ethics does not live with one owner or team at the company. Gizmodo asked directly whether anyone holds the role now, and got that same statement back.

The details:

  • Bakalar’s focus was model development ethics, how humans interact with AI, and machine consciousness.
  • The safety systems seat got filled. Saachi Jain took it on an interim basis after Johannes Heidecke left.
  • Safety teams now report to Mia Glaese, a new vice president of research and safety.
  • Chief research officer Mark Chen says safety belongs inside frontier model development, shaping launch decisions earlier.
  • The claim rests on one unnamed source. OpenAI has never confirmed on the record that the desk is empty.

“There should never just be one person who serves as the moral centre.” (Chloe Bakalar, then OpenAI’s ethics lead)

Why builders care: Model policy now moves on the same release cadence as capabilities, with no owner to escalate to. Pin your own refusal and behavior evals in CI, and run them against every version you upgrade to.

STACK OF THE DAY

🧰 Ante

Ante is a coding agent that ships as a single binary and runs offline. It pulled 159 points and 88 comments on Show HN. After the reasoning-block story up top, an agent that never phones home reads a little differently. The pitch is narrow and useful: code that cannot leave the building still gets an agent. It also works on a plane.

Not sponsored. We just feature tools builders would actually use.

BOOKMARKED TODAY

That’s the board for today. Go build something.

Curated by AI, built by a human.