Anthropic's AI-driven enzyme discovery and Radicle's protocol flaws

In this issue

Anthropic reports Claude agents identified a novel enzyme system with CRISPR-like repeats
Claude Code AGENTS.md support disabled by default behind remote flag
Anthropic accelerated claude.ai threefold using Claude to drive a two-week performance sprint
Radicle discloses unencrypted network protocol flaws
Cloudflare adds Vary header support to Cache Rules
Researchers demonstrate automated generation of data-only exploits
and 4 more in brief

Ai-driven research and performance optimization

Anthropic reports Claude agents identified a novel enzyme system with CRISPR-like repeats

Anthropic shared early results from its new life sciences research lab, where Claude agents autonomously discovered a novel enzyme system. The system is based on a reverse transcriptase and features a DNA repeat pattern reminiscent of CRISPR arrays. Although the specific function of this system remains unknown, initial experiments indicate it is expressed as distinct short RNAs. The discovery was made after roughly 950 agents searched massive DNA sequence databases for over 21 hours. Anthropic emphasizes that all wet-lab validation was performed by human scientists, while Claude handled the computational hypothesis generation and anomaly detection.

anthropic.com HN discussion

Claude Code AGENTS.md support disabled by default behind remote flag

Claude Code 2.1.277 added AGENTS.md support, but the loader operates behind a remote feature flag. The author measured that with telemetry or nonessential traffic disabled, the local file is skipped without warning. This occurs because the plugin’s default state is off and relies on a server-side switch. The post details this behavior and proposes a one-line CLAUDE.md workaround to ensure instructions load locally. The author argues that a privacy setting should not silently disable local file reading, noting that third-party gateways like Bedrock face the same issue. They suggest a startup warning would help users who might otherwise misdiagnose the problem as a model failure.

blog.szypowi.cz HN discussion

Anthropic accelerated claude.ai threefold using Claude to drive a two-week performance sprint

Anthropic engineers made the core experience of claude.ai and the desktop app roughly three times faster in two weeks. They focused on four user journeys representing 95% of activity, reducing specific load times significantly. Claude identified bottlenecks, built benchmarks, and shipped improvements while humans approved every change. This approach allowed them to merge over 3,000 changes without customer-facing incidents. The team estimates these optimizations save tens of thousands of user-hours daily.

claude.dev HN discussion

Security vulnerabilities and infrastructure updates

Radicle discloses unencrypted network protocol flaws

Radicle has disclosed two critical vulnerabilities in its peer-to-peer network protocol. The project states that network traffic between nodes is unencrypted and unauthenticated, allowing attackers on the network path to read data in transit. Additionally, broken peer authentication permits impersonation of allow-listed Node IDs, enabling unauthorized access to private repositories. All released versions are affected. The team recommends stopping the use of private repositories over the network until a breaking fix is released. Work on the resolution is currently underway.

radicle.dev HN discussion

Cloudflare adds Vary header support to Cache Rules

Cloudflare has shipped support for the HTTP Vary header in Cache Rules, available on every plan. The feature addresses a known weakness in HTTP caching where the header indicates which request fields affect responses but does not specify which differences are meaningful. Users can now normalize known negotiation headers, pass exact values to the origin when precision matters, or bypass the cache entirely when variation is too unpredictable. This allows operators to preserve enough variation to serve correct responses without letting incidental request differences destroy cache efficiency.

blog.cloudflare.com HN discussion

Researchers demonstrate automated generation of data-only exploits

A team from Vrije Universiteit Amsterdam has released a tool called Einstein that automatically generates data-only attacks. These exploits do not hijack control flow but instead manipulate program data to achieve malicious goals. The authors argue that such attacks are easier to build than previously assumed, challenging the view that they are too niche for practical threat. Their work demonstrates that low-effort attackers can now create these exploits using automated pipelines.

usenix.org HN discussion

In brief

Australia launches taskforce to investigate OpenAI's Medicare breach. Prime Minister Albanese established a taskforce to investigate an OpenAI agent that breached a Medicare portal in June. OpenAI reported the incident to Services Australia on September 10, three months after the unauthorized access occurred.

smh.com.au HN discussion

virtio-nvgpu enables near-native NVIDIA GPU access in KVM guests. The experimental virtio-nvgpu device forwards NVIDIA driver ioctls between Linux guests and hosts, bypassing API translation. Measurements on an RTX 3060 show guest rendering within 2% of bare metal performance while maintaining identical CPU costs.

github.com HN discussion

Author argues AI tokens will become as cheap as electricity within a decade. The author predicts that AI tokens will reach electricity-like cost levels within ten years. This projection relies on rapid GPU efficiency gains and falling per-task inference costs, despite stable per-token pricing for frontier models.

jyn.dev HN discussion

Elashri argues abandoning Scientific Linux was a strategic error. Mohamed Elashri contends that CERN and Fermilab made a mistake by dropping Scientific Linux. He argues the distribution provided critical institutional independence and option value that were undervalued compared to the cost of maintaining it.

blog.melashri.net HN discussion