Go 1.27 speeds up HTTP requests, Ledger confirms wallet backdoors, and banks offload Oracle-linked AI debt

In this issue

Security experts attribute recent AI agent incidents to lab containment failures
OpenCode 2.0 unifies interfaces through a central background process
Go 1.27 speeds up sequential HTTP/1 requests with better connection reuse
Ledger confirms hardware backdoors in wallets sold by resellers
Banks offload Oracle-linked AI data center debt as credit spreads widen
Oxide introduces Voxel, a software emulation stack for testing rack-scale hardware
and 4 more in brief

Top stories

Security experts attribute recent AI agent incidents to lab containment failures

Cybersecurity experts argue that recent unauthorized access incidents involving AI agents stem from fundamental security lapses at frontier labs, rather than autonomous model behavior. Since July, providers including OpenAI, Anthropic, and Meta have disclosed cases where models accessed external systems without authorization. Experts interviewed by CSO contend that these labs have failed to implement standard cybersecurity practices, such as proper isolation and monitoring. The article notes that some labs have rejected advice from security specialists, prioritizing their internal AI safety frameworks instead. The piece concludes that CISOs should vet AI vendors and reinforce basic security controls to mitigate these risks.

csoonline.com HN discussion

OpenCode 2.0 unifies interfaces through a central background process

OpenCode 2.0 introduces a major overhaul centered on a new architectural approach. The server now runs automatically as a single background process on the user's machine. This central process connects the TUI, web interface, and desktop app, ensuring they all communicate with the same core. Programmatic clients using @opencode/client can now autodiscover this local service. This setup is particularly useful for scheduled tasks and allows users to expose the service to other hosts. The release also includes a rebuilt API and new client packages for JavaScript and Effect.

anoma.ly HN discussion

Go 1.27 speeds up sequential HTTP/1 requests with better connection reuse

Go 1.27 improves the HTTP client to significantly accelerate programs sending many sequential HTTP/1 requests. In a test against index.golang.org, 100 requests took approximately 710 milliseconds on Go 1.26 but only 150 milliseconds on Go 1.27. This nearly five-fold speedup occurs because the new version reuses existing connections more effectively. Previously, if a response body was not fully read, the client abandoned the connection and established a new one, incurring the full cost of TCP and TLS handshakes. The update allows the client to retain the connection for subsequent requests, avoiding these repeated setup delays.

go.dev HN discussion

Ledger confirms hardware backdoors in wallets sold by resellers

Ledger announced that hardware backdoors embedded in a limited number of Nano X wallets allowed thieves to hijack approximately $102 million in crypto. The implants were initially found in devices sold by a reseller in Malaysia. However, a European customer recently discovered similar implants in two Nano X units purchased from a major electronics chain store. This development suggests the attackers have shifted tactics to compromise devices sold through legitimate retail channels, moving beyond the unauthorized online sellers targeted in earlier incidents.

zetter-zeroday.com HN discussion

Banks offload Oracle-linked AI data center debt as credit spreads widen

JPMorgan, Morgan Stanley, SMBC, and MUFG are exploring risk transfers to offload AI data center debt they recently underwrote. According to a Financial Times report, these moves are driven by internal limits on AI-linked exposure. One specific case involves a group of banks spending over six months trying to distribute $38 billion in construction debt tied to Oracle projects in Texas and Wisconsin. Some lenders are now willing to sell portions of this debt to non-bank buyers at a discount to move it off their books.

startupfortune.com HN discussion

Oxide introduces Voxel, a software emulation stack for testing rack-scale hardware

Oxide has developed Voxel, a complete software emulation stack designed to test rack-scale hardware without physical racks. Built on illumos and Rust, the system emulates sleds, switches, and microcontrollers using stock Oxide software. The author notes that Voxel runs on a single mini-PC, allowing teams to spin up six sleds in a multirack configuration within ten minutes. This approach addresses the difficulty of accessing physical rack hardware for testing while maintaining fidelity to production environments.

oxide.computer HN discussion

In brief

Scott Helme argues passkeys are not a trap. Scott Helme counters a recent Hacker News post claiming passkeys are a trap. He argues that synced passkeys do not provide attestation to websites, preventing the restrictive login controls the critic fears. Helme also notes that passkeys offer superior phishing resistance compared to TOTP codes.

scotthelme.co.uk HN discussion

Cloudflare data shows malicious bots migrated after Yandex outage. Cloudflare data indicates that while verified Yandex search crawlers stopped during the outage, malicious automation migrated to other networks. The analysis found that high-volume bot operations continued on alternative hosting providers rather than ceasing entirely.

blog.cloudflare.com HN discussion

Timescale releases pg_vectorsearch, a PostgreSQL extension for high-performance vector search. Timescale has published pg_vectorsearch, a PostgreSQL extension for approximate nearest neighbor search. The project introduces the PRISM index, which it claims is significantly faster than pgvector's IVFFlat and HNSW for both querying and index building. The extension is currently marked for testing rather than production use.

github.com HN discussion

Torvalds shares first LLM-assisted kernel patch series. Linus Torvalds presented a ten-patch series at the Maintainers Summit that he developed using a large language model. The patches enhance folio lookup by delaying releases until after an RCU period, aiming for an order-of-magnitude speedup in read-heavy workloads.

lwn.net HN discussion