System One Models, Gemini 3.8 Live, and a GPU Driver in a Month

Good morning. It's Wednesday, September 16, and we're covering a new model class that gives up text generation for typed decisions at 100-millisecond speeds, Google's next speech-to-speech generation that reasons while it talks, a GPU driver reverse-engineered and written in one month, and an autonomous hacking agent that found admin access to a $13 billion startup's GitHub.

The Jev launch thread hit 1,429 points and 404 comments before lunch, while an e-ink bird frame quietly became the most-upvoted thing on the front page at 1,674.

In today's brief:

• TypeSafe released Jev, the first "System One" model: structured decisions instead of strings, 70-500ms responses, calibrated probabilities on every output, and a no-hallucination guarantee that is mathematically enforced
• Google shipped Gemini 3.8 Live and 3.8 Live Extended Thinking, taking the #1 spot on the Artificial Analysis speech index at 82.6 while executing tools in the background mid-conversation
• Two one-month builds dominated the front page: a fully OpenGL ES 3.0-compliant GPU driver for Apple's M4 (Minecraft at 200fps) and Capsule, single-file SQLite apps you generate by prompting
• Strix's autonomous hacking agent extracted a live GitHub admin token from Baseten's public container registry in about 25 minutes

THE BIG ONE

Jev Gives Up Text Generation to Give Software Decisions It Can Trust

TypeSafe AI introduced Jev, the first model in a new class it calls "System One Models," and the HN thread (1,429 points, 404 comments) is treating it as the most interesting model announcement in weeks. Jev is built to make fast, structured decisions that software can consume directly - classification, routing, scoring, extraction, branching - and to do it without the two things that make LLMs awkward inside code: string output and hallucination. Founder Diogo Almeida, a former OpenAI researcher who worked on the instruction-following methods behind ChatGPT, says the bet is that "chat-shaped" models were the wrong interface for automation.

The architecture is where the story gets unusual. Jev gives up string generation entirely: possible outputs and their structure are defined in advance, so "the model never makes type errors," and the schema guarantee is mathematical rather than empirical - a falsifiable claim the release dares skeptics to test with a single counter-example. A parallel sampler produces all outputs in a single query instead of autoregressive token generation, and the training recipe is a new method called Reinforcement Learning for Calibrated Decisions (RLCD), which optimizes for epistemically honest probabilities rather than human preference. The result, per TypeSafe's numbers: end-to-end response times of 70-500ms against 3-329 seconds for frontier chat models, input pricing of $0.042 per million tokens with output effectively free, and calibrated confidence on every answer - "higher confidence means higher accuracy." On its published workflow evals, Jev lands on the Pareto frontier at roughly 193.6x faster and 444.6x cheaper than the frontier reference models it is measured against, with the caveat that those multipliers sit at the high end of real-world gains. The demo reel is appropriately wild: a Doom bot reacting to structured game state at 10 queries per second (about $7 per hour), and a wikiracing agent choosing among hundreds of links per step without ever "settling" on a hallucinated path.

Why it matters: if calibrated decision models prove out, a meaningful share of production "agent" work - calls that end in a JSON object rather than prose - just found a 100x cheaper, 100x faster path, and the division of labor between string-generating models and decision models becomes a real architectural choice. Our model routing playbook and router comparison are the right frame for deciding when a decision-only model fits your stack.

PLATFORMS

Gemini 3.8 Live: The Model That Keeps Talking While It Works

Google announced Gemini 3.8 Live and 3.8 Live Extended Thinking on September 15, its answer to OpenAI's GPT-Live family and the strongest speech-to-speech showing yet on the leaderboards (HN, 423 points, 273 comments). The Extended Thinking variant takes the #1 spot on Artificial Analysis' Speech-to-Speech Quality Index at 82.6, posts 68.6% on the tau-Voice agentic benchmark and 35.1% on Sierra's tau-Voice-banking, and scores 97.7% on Big Bench Audio, while the base 3.8 Live takes second place in the Speech Agent Arena. The practical headline is a capability Google calls background execution: the model acknowledges a request, keeps the conversation flowing, and runs tools and API calls in parallel, narrating progress as it goes - "let me check that" has graduated from filler to a load-bearing part of the protocol. It also handles near-real-time visual grounding (the demo shows it playing chess against a camera) and switches between 97 supported languages mid-conversation.

For developers, both models are live today in the Gemini API and AI Studio, with a Live API that runs over a bidirectional WebSocket, plus enterprise private preview on Vertex AI and consumer rollout across Search Live, the Gemini app, and Workspace. Simon Willison points his readers at the latency and the wiring: he had GPT-6 Astra build him a no-libraries browser UI for the new models in an afternoon - the whole thing is a Web Audio API AudioContext plus the BidiGenerateContent WebSocket - and recorded what he calls a "terrifying" interruptible conversation loop. All audio output is watermarked with SynthID, which is the piece enterprises should care about as much as the benchmarks.

Why it matters: voice agents just got a genuinely different cost-performance point, and "reasons in parallel with the conversation" is a pattern that will show up in your product whether you build it or your competitor does - the API surface is simpler than the previous generation's. Our Gemini CLI guide and the Omni 1.1 Flash release guide track where Gemini's realtime family sits.

BUILD

A GPU Driver for Apple's M4, Fully OpenGL ES 3.0 Compliant, Written in One Month

Cody Ho and Niklas Sheth published the full account of building a working GPU driver for the M4 Mac Mini and MacBook Neo in about a month (HN, 332 points, 192 comments). The result passes the Khronos OpenGL ES 3.0 conformance test suite, drives Chrome and Firefox WebGL, and runs Minecraft at more than 200fps - a scope of work that normally takes years. The method is the story: a hypervisor Ho previously built for macOS reverse engineering provided hardware-only traces, and a clean-room process - no Apple binaries examined, shaders written by hand, blob documentation drafted by a third party - fed those traces to coding agents. Codex with GPT-5.6 Sol (later GPT-6 Astra) handled the kernel side, reversing the AGX firmware ABI over RTKit and iterating on captured replay state until its own code drove the GPU; Claude did the user-space disassembly and assembler work; Niklas' agent beat Ho's on speed by staying anchored to shipping Mesa instead of chasing completeness.

The write-up is candid about agent limits in a way that developers will recognize: Codex's first replay strategy saved and restored whole memory images until Ho narrowed it to a single early capture; compute workloads took a 336MB capture that ultimately had to be redone in single-user mode with a tiny Metal program; and Claude "did a horrible job" moving from disassembly to writing its own shader compiler until the hardware spec work closed the gap. The agents also found hardware features Metal itself does not expose - a native single-instruction 64-bit add, 128x anisotropy, 7-bit immediates for uniform_mov - which is the kind of discovery that only comes from probing the silicon rather than the SDK. Ho and Sheth want to upstream to Mesa, and they are explicit that an LLM-written driver will face a higher review bar than human code deserves.

Why it matters: the question "what is still too hard for agents?" has one fewer answer today - clean-room reverse engineering of a firmware ABI, conformance-certified, in five weeks - and the honest failure notes are as useful as the win for anyone running long autonomous loops. Pair this with our benchmark honesty check and the vibe coding field notes as calibration.

SECURITY

An Agent Found Admin Access to Baseten's GitHub in 25 Minutes

Strix, the open-source autonomous pentesting agent, disclosed this week (284 points on HN) how a routine vendor scan escalated: pointed at *.baseten.co with no credentials, it enumerated subdomains, found a public Harbor container registry, and pulled the baseten/baseten-app image. Inside the Docker build history it found a live GitHub personal access token for the basetenbot account - created in a March 2023 build step - with admin and push rights on Baseten's main product repo, its GitOps repo that drives clusters, its Homebrew tap, and read/write access to customer-specific private repositories. Baseten, the $13 billion inference platform, confirmed the issue as critical and rotated the token within about a day of the July report; the two teams went through disclosure over September before the post went public.

The mechanics are the useful part for every team shipping container images. The token leaked through the classic ARG GITHUB_TOKEN / RUN ... git config --global url."https://${GITHUB_TOKEN}@github.com/".insteadOf pattern, which Docker records verbatim in history[].created_by - deleting a credential from the filesystem later does nothing about the config blob. The Strix agent also tested a dead AWS key first before finding the live one, and verified exactly what the token could do using read-only GitHub API calls before reporting. The fix list is boring in the best way: BuildKit secret mounts instead of build arguments, docker history --no-trunc audits on images you and your vendors published years ago, minimal-scope tokens with expiry, and treating "public registry" as "public."

Why it matters: an off-the-shelf agent just demonstrated that a three-year-old build secret can hand an attacker admin over a unicorn's production repos - and that credential hygiene in image metadata is now a checked, automated attack path, not a theoretical one. Our agent supply chain notes and pre-connection security checklist cover the same ground from the defender side.

BUILD

Capsule: Single-File Web Apps That Persist to SQLite

The other front-page build of the day: Capsule (Show HN, 333 points, 141 comments) packages an entire app - HTML UI, hand-written schema, and SQLite data - into a single .capsule file that runs instantly in a free cross-platform player on macOS, Windows, and Linux. No cloud, no accounts, no servers: share the file over WhatsApp or email like a PDF, and opening it gives you a fully working app with its data inside. Apps are generated from a prompt and iterate on the fly through AI-assisted edits or MCP coding tools, which makes the format a direct competitor to the local-first single-file tooling class. The data-persistence-in-one-file design is the detail HN keeps coming back to - it means versioning an app becomes versioning a file, and offline use is not a mode but the default.

Why it matters: the "app as a document" model collapses the setup tax that keeps casual tools from existing, and for AI generation it gives prompt-to-app output a durable, portable artifact instead of a throwaway page - a pattern our prompt-to-app notes already flagged as the interesting end of the low-code surface.

TOOLS WORTH A LOOK

1. Gemini Live audio tool (free, browser) - Simon Willison's no-libraries WebSocket UI for Gemini 3.8 Live: pick a model and voice preset, interrupt freely, download transcripts. The fastest way to feel the new latency profile before you build on the Live API.
2. Datamimic (OSS, free) - deterministic seeded test-data generation so your coding agent stops inventing its own test world; pipe realistic fixtures in and keep agent-written tests honest (41 points on HN).
3. commit-rewriter 0.1 (OSS, free) - Simon Willison's uvx commit-rewriter path/to/repo web app for rewriting git commit messages, built to scrub coding-agent cruft and private issue IDs before a repo goes public.

WHAT ELSE IS HAPPENING

• Hearing birds, drawing 1800s plates (1,674 points, 208 comments): an e-ink frame on a Raspberry Pi 5 that listens with BirdNET-Go and renders the current garden visitors using 800+ hand-cut public-domain bird illustrations - no AI art, running live from a Bergen kitchen window. Fully local, MIT-licensed, and the day's most-loved project.
• Apple Reference Image (269 points): iPhone 18 Pro gains an opt-in camera mode where the sensor signs pixel data at capture, the "digital negative" is developed inside Private Cloud Compute, and the final photo carries a composite post-quantum signature (ML-DSA-87 + RSA-3072), with per-photo revocation and no photographer identity attached.
• Why I'm still bearish on LLMs after Navier-Stokes (236 points, 269 comments): Jay Kruer argues frontier automation claims are priced as narrative, rewards hacking is unsolved, and the specification cost most domains can't pay leaves LLMs as "a cracked intern" - read it against this week's driver-shipment news.
• Rheinmetall open-sources its Battlesuite protocol (223 points): the defense contractor published the onboard API documentation for its connected weapon systems, an unusual move for military-grade device networking.
• Voodoo Graphics on an FPGA (131 points): a faithful recreation of the 1996 3D accelerator and a late-90s gaming PC in Verilog, complete with the era's quirks.
• Saving jet fuel with scikit-decide (98 points): an actual airline pulls OpenAP flight plans through scikit-decide and Python's OR-Tools to shave meaningful fuel burn off scheduled routes - a concrete example of off-the-shelf optimization in production.

---

Every link above goes to a primary source or our sourced coverage. Tomorrow's brief lands when the news does - subscribe to get it by email.