Muse Glimmer 30B, Docker Sandboxes, and 180,000 Leaked Meetings

Good morning. It's Tuesday, August 11, and we're covering Meta's first Apache 2.0 agent-first model, Docker's answer to running agents unattended, and a meeting-recording platform that left 181,874 meetings readable by any account.

The Muse Glimmer thread hit 1,118 points and 609 comments before lunch, the biggest open-weights story since the week's earlier model news. Docker followed the same morning with sandboxes designed for exactly the YOLO-mode question the thread keeps asking, and the tl;dv disclosure is the rare security story with receipts: the researcher walked into a live Malaysian government meeting, uninvited.

In today's brief:

• Muse Glimmer is a 30B Apache 2.0 model distilled from Muse Spark for always-on local agents, quantized to about 17GB with a 24GB envelope and 131K context
• Docker Sandboxes give Claude Code, Codex, Copilot CLI, and OpenCode a disposable microVM boundary so agents can install packages and run containers without permission prompts
• A researcher demonstrates tl;dv's Firestore has no tenant isolation: 181,874 meetings across 84,312 users are queryable by any account, and he joined live calls to prove it
• Claude improved a Riemann zeta lower bound from 41.6% to 67.2% and produced a formally verifiable proof, in Anthropic's account of the attempt

THE BIG ONE

Meta Open-Sources Muse Glimmer, a 30B Agent Model Built to Live on Your Machine

Meta Superintelligence Labs released Muse Glimmer on August 10 under a clean Apache 2.0 license - no Llama-style usage clause - with weights on Hugging Face. It is a 30-billion-parameter dense multimodal model optimized for always-on local agent workflows: tool calling, long-horizon task completion, failure recovery, and interleaved text and image input through a dedicated perception encoder. It is small enough to run on a Mac or PC with a single consumer GPU, which is the headline, and the HN thread spent most of its 609 comments on whether the benchmarks survive independent runs.

The training recipe is the notable part. Glimmer was distilled from Muse Spark's outputs using logit distillation, then mid-trained on longer-context, agent-heavy data with richer reasoning traces, then post-trained with SFT combined with on-policy distillation and reinforcement learning across general, reasoning, coding, and agentic domains. The result is a benchmark profile that is agent-shaped: MCP Atlas (Public) 75.5 and SWE-Bench Verified 76.0 against Gemma4-31B and Qwen3.6-27B as the comparison set. Our full benchmark and hardware breakdown walks the model card, the 233.4 tokens-per-second DFlash speculative decoding result on an RTX 5090, the 131K context window, and the 24GB VRAM envelope; Meta's methodology reports the most favorable figure between self-reported and internally reproduced numbers for other models, so read the wins as directional until independent runs land.

Optimized integrations on llama.cpp, MLX, and ExecuTorch are due in the coming days, and Meta explicitly lists OpenClaw and Hermes Agent as working orchestration patterns. Simon Willison had it running within hours: an 18.16GB quantized build through LM Studio on a 128GB Mac, a working pass over a Datasette checkout through his llm-coding-agent plugin, and a pelican photo correctly described through the vision encoder. The wider context is Meta's return to open models: Zuckerberg's FT interview the same day (509 points) attacks "closed" AI rivals while announcing open-weight releases as the default posture. For teams waiting on a genuinely permissive local agent model, this is the strongest candidate yet; if distillation-from-teacher is what makes that possible at this size, the recipe matters as much as the weights.

Why it matters: The open-weights class finally has an agent-first release with a license that enterprise legal teams can sign without a review cycle, and local agent workflows get a serious default at a size that fits a single consumer GPU. The benchmark reproducibility debate the thread is having will decide how quickly it displaces Qwen-class models in local tooling.

PLATFORMS

Docker Sandboxes: Disposable MicroVMs So Agents Can Run Without Permission Prompts

Docker launched Sandboxes, a new product and CLI (sbx) that runs AI agents in disposable, isolated microVMs - installable via brew install docker/tap/sbx on macOS, winget on Windows, and an apt package on Ubuntu. It is aimed squarely at the agent tools already on developers' machines: Claude Code, GitHub Copilot CLI, Codex, OpenCode, and Kiro. The pitch is 654-points-worth of appetite: "YOLO mode, safely." Each agent runs inside its own microVM with only the project workspace mounted, so it can install packages, modify configs, and spin up its own Docker containers while the host stays untouched, then the whole sandbox is disposed of in one command.

The design is a direct response to the two failure modes of current agent safety: permission prompts, which cause approval fatigue (and the auto-mode debate Anthropic kicked off last week), and over-restrictive environments that strangle the agent. Docker's bet is that a hard microVM boundary plus disposable lifetime plus network and filesystem controls per sandbox replaces the prompt loop with an enforce-at-boundary model. Our sandbox architecture guide covers how this tiering - prompt, wrapper, container, microVM - fits together and where each layer leaks. The product also integrates with Docker AI Governance for org-wide enforcement, which is how the BYOL (bring your own laptop) agent fleet story usually ends: individual tooling becomes a managed policy surface.

The HN thread presses on real gaps: microVM boot latency versus plain containers, how credentials get injected without leaking, and whether the network policy is granular enough for agents that need outbound API calls but not inbound anything. Docker's answer is per-sandbox network and filesystem control with org-wide defaults through AI Governance. Pricing starts free at the sandbox tier, with paid plans for governance features - the classic Docker funnel: get the developer experience right locally, then charge for the org control plane.

Why it matters: The approval-prompt model of agent safety is dying, and the industry is converging on two successors: classifier-based auto approval and hard sandbox boundaries. Docker is betting the latter, and by making the boundary disposable by default it is also changing what "safe enough to run unattended" means for every local agent workflow.

SECURITY

tl;dv Left 181,874 Recorded Meetings Open to Any Account - Six Months After Being Told

A security researcher going by BobDaHacker published the full account (583 points) of tl;dv, an AI meeting-recording platform with over 2 million users that drops a bot into Google Meet, Zoom, or Teams calls and transcribes them. The writeup is a tour of what happens when tenant isolation is forgotten: signing up authenticates you with a JWT that is exchanged for a Firebase token, and that token can query the platform's Firestore database with no tenant filtering. Any authenticated user can list every meeting on the platform - 181,874 records across 84,312 unique users and 35,003 email domains - including the creator's email, the conference ID, and recording status. For meetings actively recording (roughly 1,000 at any time), the conference ID is a joinable live room.

The damage is concrete, not theoretical. The researcher grabbed a conference ID and joined a live Google Meet belonging to the Malaysian Ministry of Education, where a presenter was addressing 157 participants; he also joined a call where US university students were building a startup and setting up Supabase live on screen. The data spans government meetings from 23 countries, university meetings from Berkeley and the University of Tokyo, and corporate meetings from companies including Mitsui-Soko, HubSpot, and Confluent. The most damning detail is the timeline: he reported the issue January 28, 2026. It is still open. The CTO never responded. Six months later the Firestore database was still wide open, which is why the post's subtitle is "Too Lazy; Didn't Validate."

This is the third big "AI tool at work with no security review" story this month, and the pattern is consistent: a viral product, a firehose of sensitive data, and no threat model. Sales calls, job interviews, and internal strategy sessions are the crown-jewel data class of most companies, and they sit in a shared database with an auth boundary measured in "did you sign up." Our agent security checklist is the practical version of the lesson: before you let any AI tool into your meetings, ask who can read the data, how isolation works, and what happens when you delete the account. The answer, in tl;dv's case, was "anyone" and "nothing."

Why it matters: Meeting recordings are the fastest-growing sensitive data class in the enterprise, and this shows the market is still shipping them with consumer-grade isolation. Any company using an AI meeting bot now has a due-diligence question it cannot afford to skip, and the "reported six months ago, still open" timeline is the argument for checking the disclosure history before the demo.

RESEARCH

Claude Improves a Riemann Zeta Lower Bound From 41.6% to 67.2%, With a Formally Verifiable Proof

Anthropic published the account (208 points) of an unreleased research version of Claude taking a real run at the Riemann hypothesis - the 1859 problem with a million-dollar bounty - and, while not solving it, improving a long-standing lower bound along the way. The result concerns the proportion of zeros of the Riemann zeta function that lie on the critical line: mathematicians have pushed this constant up over decades to 41.6%, and Claude's work raises it to 67.2%. Two mathematicians at Anthropic studied and validated the paper, Claude produced a formally verifiable proof of the result, and external experts Brian Conrey and Dan Goldston examined the work on short notice.

The technical path is a credit to the human literature, not a departure from it. Claude combined results from Baluyot, Goldston, Suriajaya, and Turnage-Butterbaugh - a series of works that let Montgomery's 1973 zero-distribution techniques run without assuming the hypothesis - with a 2000 paper by Bombieri, and found the combination improved the constant. Anthropic is explicit that it does not expect these techniques to prove the hypothesis, and the model's own writeup of what it tried and discarded is part of the post. What matters for working mathematicians is the shape of the result: a machine-generated proof that experts can check, a formal verification artifact alongside it, and a new constant that advances a question the field has been pushing for decades.

The HN thread split the way this class of news always does: excitement about the bound, and a long argument about how much of the work was Claude's versus the scaffold and prompting. Anthropic's own telling is that the model proposed the synthesis - the combination of the two lines of research the literature had not made - which is the creative step, and then did the legwork of producing and verifying the proof. The test for anyone watching AI in research is whether independent mathematicians can follow and build on the paper, and the involvement of Conrey and Goldston suggests the answer is yes. Our take on where AI research capability is heading frames the trajectory this sits on.

Why it matters: A machine improving a decades-old bound in pure mathematics, with a formally verifiable proof attached, changes what "AI does research" means: the creative synthesis step, not just the verification grind, is now in scope. Expect the "models as research collaborators" framing to get a lot more concrete in the next year.

MODELS

OpenAI Gates GPT-5.6-Cyber Behind Daybreak Red as the Cyber Defense Window Narrows

OpenAI expanded its Daybreak program (111 points) with two access tiers and a new model: Daybreak Blue gives approved defenders GPT-5.6 Sol with safeguards tailored to authorized defensive work - vulnerability discovery, secure code review, malware analysis, incident response - while Daybreak Red provides GPT-5.6-Cyber, a purpose-trained model for authorized vulnerability research, exploit validation, and security testing. Built on GPT-5.6 Sol, GPT-5.6-Cyber is trained to find zero-day vulnerabilities and develop exploit chains, and to reduce refusals on higher-risk dual-use cyber tasks. On OpenAI's internal completion-rate benchmark, it answers 95% of sensitive security queries the base model refuses (1.5% for GPT-5.6 Sol with standard safeguards, 57.3% for the previous GPT-5.5-Cyber). The capability proof is already public: Chrome's stable channel credits CVE-2026-15903, an out-of-bounds read and write in V8, to OpenAI's security research, and OpenAI says the model chained it with a second, still-restricted V8 flaw to bypass the V8 heap sandbox.

Distribution is the safety mechanism, and the post is explicit about it: the model is not on the public API, has no pricing page, and no path through any standard provider. Access requires identity verification, account security monitoring, legal declarations about scope, and - starting September 1 - mandatory hardware security keys for all Daybreak accounts. The framing is "the cyber defense window is narrowing": defenders need frontier capability before attackers deploy offensive AI at scale, and gated distribution is the only safe way to put refusal-tuned-down models in trusted hands. Our breakdown of GPT-5.6-Cyber has the benchmark chart, the Chrome CVE attribution, and the context: a purpose-built offensive model rated High under OpenAI's own Preparedness Framework, three days after the company said it cannot rule out Critical for Astra. The same release week the tl;dv story shows consumer AI tooling ignoring security is the week OpenAI argues the window for defenders is closing, and the contrast is doing work in both directions.

Why it matters: Gated cyber models are becoming a real product category with real artifacts - a fixed browser CVE - and the access controls are the product. If you do security work, the tier structure (defensive Blue, offensive Red) is the shape of every future vendor's answer to the "who gets the scary model" question.

TOOLS WORTH A LOOK

1. Needle 2: 14MB agentic LLM for tiny devices (open, 338 points) - Cactus released a 45M-parameter model in a single 14MB binary that runs a full session in 28MB of RAM, trades wins on tool-calling benchmarks with models 5x to 70x larger, and hits 500 tok/s on a Raspberry Pi 5. Smart-home and wearable agents just got a real runtime floor.
2. H3-metal: native MiniMax-H3 inference for Apple Silicon (OSS, 279 points) - antirez's h3.c is a from-scratch Metal inference engine for the MiniMax H3 hybrid attention architecture, the kind of single-file native implementation that usually becomes the reference everyone else benchmarks against.
3. Ante: a coding agent in a single binary that runs offline (OSS, 134 points) - Ante is a Show HN coding agent with no server component and no telemetry dependency; local models and air-gapped setups are the whole point.
4. Mcptoon: token-efficient MCP CLI client (OSS, 48 points) - a minimal MCP client focused on keeping tool-call context small, useful when every token in the window is a budget line.

WHAT ELSE IS HAPPENING

• Mistral patents "code implemented tool calls" (219 points): a granted US patent covering tool calls implemented in code, sparking the usual thread about whether the patent office is now minting claims over how every agent framework works.
• The UK's war on anonymity comes to America (505 points): an investigation into UK lobbying for US anonymity restrictions, worth a read for anyone shipping identity or account tooling.
• What's the best programming language for coding agents? (183 points): Dan Luu on the widely cited "dynamic languages are more token efficient" post, noting the evaluation problems in the original experiment and why token cost alone is the wrong lens for agent languages.
• Kinney Drugs pulls back its AI phone assistant (149 points): after hundreds of customer complaints, a US pharmacy chain disabled the voice bot; a useful counterpoint for every "AI can handle the phone" sales pitch.
• Illinois puts Linux on the hook for age verification (321 points): a new Illinois law requires operating systems to enforce age verification, and the Linux community is working through what that means for a platform with no central identity provider.
• As AI eats the web, the internet's collective memory is disappearing (311 points): a long read on search traffic shifts and link rot, and what it means for archives and the small sites that made the web worth linking.

FROM THE SITE

• GitHub Copilot SDK for Java: annotations, virtual threads, and BYOK - GitHub's Java-native Copilot SDK ships 1.0.7-preview.1 with @CopilotTool annotations, virtual-thread support, Jakarta EE and Spring composition, and a BYOK mode that works against any OpenAI-compatible endpoint with no Copilot subscription.
• Stop Means Stop: approval gates and cancellation leak in six agent frameworks - a new arXiv paper finds the barrier semantics of approval gates, cancellation, and timeouts hold on none of the six frameworks it probes; a sibling branch can execute while the user is rejecting another one, and replay can double-execute.

---

Every link above goes to a primary source or our sourced coverage. Tomorrow's brief lands when the news does - subscribe to get it by email.