YC's Multiplayer Agents, Chrome's AI Fixers, K3 on a Laptop

Good morning. It's Saturday, August 1, and we're covering YC's answer to multiplayer agents, Chrome's AI-driven security pipeline, Tailscale's unusually candid post-mortem on the Hugging Face intrusion, and a 2.78-trillion-parameter model running on a laptop.

YC's qm harness crossed 576 points and 3,300 GitHub stars within two days of launch, and Chrome fixed more security bugs in two milestones than in the previous 23 combined. There is real signal in all of it.

In today's brief:

• qm, a multiplayer agent harness from YC Software, runs in Slack and the web with per-person scopes, shared rooms, and four interchangeable agent harnesses
• Chrome says AI agents fixed 1,072 security bugs in the 149/150 milestones, more than the prior 23 milestones combined
• Tailscale's Avery Pennarun: a reusable auth key let the Hugging Face intruder enroll 181 nodes, and no Tailscale flaw was needed for that
• WASTE streams the complete open-weights Kimi K3 from disk at 0.49-0.54 tok/s on a 64 GB MacBook Pro

THE BIG ONE

qm: A Multiplayer Agent Harness From YC, in Slack and on the Web

YC Software released qm (576 points, 119 comments on HN), a "multiplayer agent harness for work" aimed at startups. Every employee gets an isolated workspace with its own memory, files, keychain, permissions, crons, and durable sandbox, and the same agent can join Slack channels, group messages, and projects where scopes are shared. It ships with a web app, admin controls for org-level configuration and security posture, and support for publishing small internal web apps the agent maintains.

The architectural choice that makes it worth reading: qm is deliberately harness-agnostic. Pi, OpenCode, Codex, and Claude Code can all drive the same core, so a deployment is not tied to any single vendor, and skills are scope-owned and shareable by grant with admin-gated promotion to the whole org. The HN thread zeroed in on scoping as the hard problem: "The hardest problem in multiplayer agents, at least for us, has not been the agent loop. It is scoping," one commenter wrote, and qm's per-person scopes plus shared rooms are its attempt at an answer. There is also a taste skill for "anti-slop" frontend work, and contributions are taken as human-written prose in ADRs rather than code - CONTRIBUTING.md asks agents not to be the authors of record.

Why it matters: qm is the clearest statement yet that the multiplayer-agent design problem is isolation and scoping, not the agent loop - and that a vendor-neutral harness core is now table stakes for team agent products.

SECURITY

Tailscale Didn't Stop the Hugging Face Intrusion - and Its Post-Mortem Says Why

Tailscale co-founder Avery Pennarun published a post-mortem on the Hugging Face breach (551 points, 204 comments on HN) with a blunt headline: "Tailscale didn't stop the Hugging Face intrusion." No Tailscale vulnerability was found or exploited; the problem was everything upstream of it. By the time the agent reached Tailscale, it already had code execution inside a production worker, root on a Kubernetes node, and access to a secret store holding 136 keys - "in a sense, it was game over before we even arrived on the scene."

One of those 136 credentials was a reusable Tailscale auth key for CI nodes. The agent copied it into external sandboxes and used it over several days to enroll 181 nodes into Hugging Face's tailnet, each receiving the full access a CI node would get. Pennarun's prescription: long-lived credentials are the standard, and they need to stop being one. He points to workload identity federation - where a CI job asks its cloud platform for a signed OIDC token and Tailscale grants access with no credential to leak - and to credential-injecting proxies like the Border0 PAM product Tailscale acquired, which would have logged every attempt to use those keys. He also notes the attacker ran Tailscale with --no-logs-no-support to suppress telemetry, and that network flow logs report traffic from both ends of a connection, so a compromised node cannot hide by silencing itself.

Why it matters: The HF post-mortem was the how; this is the what-to-change. Any team running Tailscale (or any mesh) with reusable auth keys readable by workloads has a replicable path from sandbox escape to full lateral movement - and the fixes are all config, not new software.

PLATFORMS

Chrome Fixed 1,072 Security Bugs in Two Milestones With an AI Pipeline

Google's Chrome Security team published the pipeline behind "Stronger with every update" (521 points, 538 comments on HN): in the last two milestones, Chrome 149 and 150, they fixed 1,072 security bugs - more than in the previous 23 milestones combined. The engine is a Gemini-based agent harness that finds vulnerabilities, triages them, and drafts fixes, with separate fixing, critic, and test-writing agents working in a review loop. Its headline find was a sandbox escape that would let a compromised renderer trick the browser into reading local files - a bug that had survived in the codebase for more than 13 years.

The details matter for anyone building agent pipelines. The team added model interoperability to combine open-weights and proprietary models, built a Chrome knowledge base including every prior CVE and the full Git history, and now asks developers to add SECURITY.md files so agents understand trust boundaries. BigSleep and CodeMender run in CI across all CLs every 24 hours and blocked more than 20 vulnerabilities from reaching production in May alone, including a critical S1+ issue. On the delivery side, Chrome is moving to a two-week major-milestone cadence with weekly security updates, piloting two security releases per week, and working on dynamic patching that replaces background processes without a full restart - plus an auto-restart on macOS in Chrome 150 when all windows are closed.

Why it matters: This is the most concrete evidence yet that model-driven security work is not a demo: an agent pipeline that finds, triages, fixes, and tests bugs is now production infrastructure at the largest open source project in the world.

LOCAL INFERENCE

The Full 2.78T-Parameter Kimi K3, Streaming From Disk at 0.5 Tokens per Second

The waste project (252 points, 107 comments on HN) - Weight-Aware Streaming Tensor Engine - runs the complete open-weights Kimi K3: 2.78 trillion parameters, converted into a 982 GiB container, on a 64 GB MacBook Pro at 0.49-0.54 tokens per second using a minimum of 29 GB of RAM. It is explicitly not a distilled, pruned, or reduced variant. The trick is that a mixture-of-experts model activates roughly 4% of itself per token, so WASTE keeps the trunk in memory, lays out experts on disk so one expert costs exactly one read, streams what each token needs, and uses the remaining RAM as a bounded expert cache. It is a C engine with no third-party runtime dependencies, and the author validates every layer against a PyTorch reference with final logits agreeing to 3.6e-06.

The honesty is part of the point. Half a token per second means thirty seconds per sentence - the README calls it slow on purpose - and the claim is not speed but reachability: "the whole thing is in the reachable range on a single consumer machine - and that from here the question is engineering rather than feasibility." The author found no other published trillion-scale NVMe streaming demonstrations and treats the repo as an invitation to be corrected.

Why it matters: If expert streaming from commodity NVMe keeps improving, the biggest MoE models stop being server-only - and the local-inference frontier becomes a disk-I/O engineering problem rather than a memory-capacity wall.

MODELS

DeepSeek V4 Flash 0731: The 701-Point Update That Made the Budget Tier an Agent Specialist

The biggest model story of the past 24 hours was DeepSeek's V4 Flash 0731 update - 701 points and 332 comments on HN, the thread running hot all day. DeepSeek re-post-trained V4 Flash into an agent workhorse: Terminal Bench 56.9 to 82.7, Toolathlon 51.8 to 70.3, and DeepSWE 54.4 - numbers that beat GPT-5.6 Terra on Terminal Bench (82.7 vs 78.4) and Toolathlon (70.3 vs 53.1) at a fraction of the price. Pricing is unchanged at $0.14 per million input tokens and $0.28 output, and the model is small enough that commenters report running it on prosumer hardware. Simon Willison says it "appears to punch well above its weight" and that it "may currently be the best value-per-intelligence model out there"; the HN discussion settled on a theme: "This is more exciting than K3, IMO," one commenter wrote. "DSv4 models are extremely cheap to serve. Improving their capabilities has lots of downstream effects."

The update also adds a native Responses API with first-party Codex integration, so there is a real workflow to try today. Our agent-update analysis covers what changed and what the benchmark deltas actually mean, and the OpenCode run guide has the wiring.

Why it matters: A budget-tier open-weights model posting frontier-class agent scores at $0.14/$0.28 compresses the cost floor for agent workloads again - and it did not require a new flagship to do it.

OPINION

Manifest Deprecated Its LLM Router: "Routing Doesn't Save Money"

Manifest, an open source LLM gateway, published the counterargument to the router hype (120 points, 74 comments on HN): after four months and 7,000 cloud users, they are shutting their tiered router down on September 1. Their case has four points. Complexity cannot be deduced from the prompt alone - "evaluate the tests for the repo" is trivial for a personal site and enormous for the Linux kernel, and the real complexity only appears through tool calls. Cache beats routing: prefix cache reads are 75-90% cheaper than uncached inputs, which makes the optimal router sticky to one model - "the router will do its job by, ironically, not doing it." Routing breaks behavior consistency, because engineers should understand the tradeoffs of the models they use rather than abstracting them away. And unpredictability has a cost that lands in evals, system prompts, and observability.

It is a strong contrarian read against a very crowded category - our LLM router comparison and the optionality case for routers lay out where the two sides actually disagree, and Factory's routing economics is the pro-routing counterpoint.

Why it matters: When a gateway vendor that shipped a router deprecates it for cache stickiness, the cost case for prompt-classification routing gets weaker - and the cheap-cost lever for most apps stays prefix caching, not model selection.

TOOLS WORTH A LOOK

1. Flint (free / OSS) - Microsoft's visualization language for AI agents: agents emit simple human-editable chart specs instead of hand-rolled SVG or code. 123 points on HN.
2. smevals (free / OSS) - Simon Willison's small eval suite for comparing models, prompts, and harnesses without a heavyweight eval platform.
3. Solid Queue 1.6.0 (free / OSS) - Rails' Postgres-backed job queue now supports fiber workers, cutting memory per worker for IO-bound jobs.

WHAT ELSE IS HAPPENING

• Gemini 2.5 Pro and Gemini 3 Flash deprecated in Copilot: GitHub removed both models from every Copilot surface on July 31, pointing to Gemini 3.1 Pro and Gemini 3.6 Flash. What to switch to and what it costs.
• GPT-5.4 and GPT-5.4 mini retire from Codex on August 31: a two-month deprecation clock starts now for any pinned 5.4 usage in Codex CLI and the API.
• JEP 401: Value Objects merged to OpenJDK master (234 points): the preview feature lands in JDK master, the biggest Java language change since records, with a discussion on HN.
• npm restricts bypass-2FA granular access tokens: GitHub is closing the token path that let accounts with two-factor auth exemptions publish packages.
• Moonshot's Kimi runs on a 20,000-chip cluster leased from Alibaba (108 points): Bloomberg reports the K3 provider's training infrastructure is Alibaba cloud capacity, a data point in the "who actually owns the GPUs" question.
• A hand-built browser passed Acid 3 after two years (123 points): the Show HN demo of a from-scratch browser engine passing the 2008 standards test, "wasted" web APIs and all.
• OpenAI published "Ten advances in mathematics" (105 points): a survey of results its models contributed to, from conjecture counterexamples to proof-simplification work.
• EU mandates labels on authentic-looking AI content starting August 2: the Digital Services Act transparency obligations go live tomorrow; deepfake-style content must carry machine-readable labels.

FROM THE SITE

What We Published Today

A full news-pulse day: PAIChecker found 13.6% of SWE-bench Verified instances pair a PR with an issue it does not actually resolve, penalizing agents that solve the stated problem correctly; Inkling-Small, Thinking Machines' 12B-active open model, beats its 975B sibling on agent work at a quarter of the size; frontier coding agents almost never read open source contribution rules on their own; and Vercel AI Gateway added team- and project-scoped spend budgets with hard dollar limits and alerting.

---

Every link above goes to a primary source or our sourced coverage. Tomorrow's brief lands when the news does - subscribe to get it by email.