# AI Hacker Daily — 2026-08-17 Two middlemen inserted something today.

This is the reference implementation behind Anthropic's "using LLMs to secure source code" work, and it is more complete than the star count suggests you would get. Two halves: interactive Claude Code skills that only read and write files — `/threat-model`, `/vuln-scan`, `/triage`, `/patch`, `/customize`, plus `/dnr-hunt` and `/dnr-respond` for chasing attacker campaigns through logs — and an autonomous pipeline that actually executes the target and therefore wants a gVisor sandbox. The pipeline is seven stages: build the target into a Docker image with ASAN, run a recon agent that proposes input-parsing subsystems to attack separately, fan out N agents in isolated containers crafting malformed inputs until a crash reproduces 3-for-3, hand it to a grader agent that must reproduce the crash in a fresh container before it crosses over, dedupe against prior findings with a judge, write an exploitability report, then patch — where the grader validates that the build still works, the PoC no longer crashes, tests pass, and a fresh agent cannot bypass the fix. You can pin every subagent with `CLAUDE_CODE_SUBAGENT_MODEL`. It is at the top of this list because of what it says about itself. "This harness is a reference, not a product." "This repo is not maintained and is not accepting contributions." And the disclosure that matters: "Autonomous triage and patching are still open issues, and this reference harness doesn't fully solve them... Many partners have reported these steps as their current bottlenecks." That is a vendor naming the two stages between "a fuzzer found a crash" and "a human fixed something" as the unsolved ones, in the repository that exists to demonstrate solving them, while linking to Claude Security — the hosted product that does this for money. There are no published CVEs, no false-positive rate, no benchmark, nothing you could grade it by; the only empirical note in the whole README is a warning that step one is pure static review, so "expect more false positives on any non-canary targets," and that on the deliberately vulnerable demo target `/triage` may dismiss the scan's own findings because `entry.c` announces itself as demo code. Worth flagging that GitHub's API reports the license as NOASSERTION and the LICENSE file is plain Apache-2.0 — the fifth time this quarter the badge has been the unreliable half, and the fourth time in the honest direction. Reach for it if you maintain C or C++ with a parser in it and want a real fuzzing loop scaffolded by someone who has run one. Delete your ad-hoc "point an agent at the repo and ask for vulns" prompt, which is the step this thing proves is the easy part. Tradeoffs: memory bugs in C and C++ only by default, and porting is a `/customize` slash command rather than a supported path; needs Docker plus gVisor, so this is not a laptop afternoon; unmaintained by declaration and no releases or tags at all; 43 watchers against 7,270 stars and 583 forks, and the contributor graph is four people with 29 commits between them; it crossed our pool on 06-05 at front-page level and again today at 176 stars a day, so a repo that has not been pushed since 06 August is having its second discovery rather than its launch; and the thing it demonstrates best is that the expensive parts of security work are the ones it hands back to you.

Self-hosted monitoring for what Claude, ChatGPT, Gemini and Google AI Overviews say when someone asks them about your product. You give it a topic, it expands that into dozens of natural-language prompts, runs them across the models, and reports visibility, share of voice, sentiment, prominence and competitor position. MIT, Next.js, Supabase for storage, a Dockerfile and a CLI in the repo, and the description on GitHub is the clearest statement of the model: "Open source BYOK AEO telemetry." Bring your own keys, pay the providers directly, and the hosted version is free end-to-end because there is no inference for them to mark up. The landing page puts it as "no usage markup, no middleman," which is a striking phrase to ship on the day a $7B acquisition of the middleman is the third story on the front page. The gap is the methodology, and it is the whole product. Everything this tool reports is a function of which prompts it decided to ask — and the prompt expansion is exactly the step that gets no published documentation. The site shows an example running "across 24 prompts" without saying how the 24 were chosen, how many samples per prompt, at what temperature, whether results are stable run-to-run, or what counts as a mention. That is not a fatal objection to a monitoring tool you self-host and can read the source of; it is the reason you should read the source rather than the dashboard, because you are being handed a share-of-voice number derived from a sampling procedure nobody has written down. Credit where it is due: MIT and self-hostable means the methodology is knowable by anyone willing to look, which is more than the closed products in this category offer at any price. This is its third crossing of our pool — Product Hunt on 08-12, a 6-point HN post as "BYOK library for tracking AI search," and today's Show HN — and it has drawn a combined three comments across all of them, so no one has publicly stress-tested it either. Reach for it if you have accepted that model recommendations are a distribution channel and want your own numbers rather than a vendor's. Delete the $200-a-month "AI visibility" SaaS subscription, and delete the habit of manually asking ChatGPT about your own product once a month and calling it a trend. Tradeoffs: no published sampling methodology, which is the load-bearing part; self-hosting means Supabase plus your own keys for four providers, so "free" is free of markup, not free; 58 stars, zero watchers, four open issues, and three contributors with one of them at 171 of the roughly 230 commits; created 21 July, so there is no long-run stability evidence for numbers whose entire value is being comparable over time; and Google AI Overviews is not an API, so whatever it does to collect that column deserves your attention before you depend on it.

A 2021 Python scraping toolkit that has been rebuilt this month around two things worth caring about. The first is self-healing selectors, and the mechanism is heuristics rather than an LLM, which is the right call and rarer than it should be: it fingerprints an element the first time it matches, and if the selector later matches nothing, it relocates the element by structural and textual similarity. The signals are weighted rather than tried in sequence — a stable `id` or `data-*` hook counts far more than a sibling-tag list, anchor-relative position tracks the nearest stable ancestor, and prices, dates and counts are explicitly down-weighted because they are the parts of a page that change for reasons that have nothing to do with layout. The second is the MCP server, 20-plus tools with a `list_available_scrapers` for discovery, so an agent can call `scrape_url` and the two dozen site-specific scrapers directly. The reason it earns a slot in this particular slate is the audit trail. Every accepted heal is appended to `adaptive.heal.ndjson`, and every result carries an `adaptive_confidence` from 0 to 100 that you can gate on, with an optional `expect=<callable>` contract so a relocated element has to satisfy an invariant you define before it is accepted. That is a scraping library that assumes it will silently substitute the wrong element eventually and builds you the log to catch it — the exact posture the CDN at the top of this edition did not take when it substituted your HTML. What it does not have is any published evidence that the healing works: no survival benchmark, no before-and-after against a set of sites that changed, nothing you could use to calibrate what a confidence of 70 means. The other feature worth naming plainly is TLS-fingerprint impersonation, `pip install 'pyscrappy[stealth]'` and `impersonate="chrome"`, because many anti-bot systems fingerprint your JA3 before serving a byte. That is the one place today's theme inverts: this is the pick where you are the layer inserting something the other side cannot see, and the README's entire treatment of that is "This package is for educational and research purposes." Reach for it if you maintain scrapers that break every few weeks and you want the breakage to become a logged, scored event instead of a silent empty list. Delete the brittle CSS-selector constants file and the cron job that emails you when the row count hits zero. Tradeoffs: the healing mechanism has no published survival testing, so the confidence score is uncalibrated by anyone; TLS impersonation works on the synchronous path only and raises on an async client; PyPI reports no license field even though the repo is MIT; version 1.5.5 went up at 23:29 UTC the night before the Show HN, the fifth release in seven days, and the repo was pushed again this morning — a tool moving this fast is a tool whose behavior you should pin; 178 stars against 9 watchers on a repo that has existed since 2021; and "educational and research purposes" is not a ToS review, so the anti-bot evasion is your legal problem, not theirs.

An unofficial plugin that wires Hermes Agent into Grafana's agent-observability product. It records every LLM call and tool execution as a generation and emits OpenTelemetry traces and metrics, so you get the agent's actual behavior — latency, token counts, tool call graphs, failures — in the same place as the rest of your telemetry rather than in a vendor's private dashboard. Install it as a pip package into the same environment as the agent and enable it in `~/.hermes/config.yaml`. Apache-2.0, 42 stars, pushed the evening before its Show HN. Here is why a 42-star plugin with zero comments outranks most of what launched today. The README states, without being asked and without softening it, that by default "the system prompt, the tool definitions, prompts, assistant replies, tool arguments and tool results all leave the machine." Then it gives you the flag to stop it: `AGENTO11Y_CONTENT_CAPTURE_MODE=metadata_only` keeps the traces and drops the content. Read that next to the top of this edition. Cloudflare's position is that Real User Measurement is on by default for free sites because it gives owners data they would not otherwise have — which is true, and is also the argument every default-on telemetry system makes — and the disclosure lived in a September blog post rather than in the thing that got installed. One unpaid developer wrote the exfiltration inventory into the first screen of the README and shipped the off switch in the same paragraph. The other caveat is the same kind of honest: one-shot mode, `hermes -z`, disables logging for the whole run and therefore writes no telemetry at all, which is the sort of gap you normally discover during an incident rather than in the documentation. Reach for it if you run Hermes agents anywhere that matters and currently reconstruct their behavior from stdout. Delete the print statements and the bespoke JSONL logger, and delete the assumption that agent observability requires an agent-observability vendor. Tradeoffs: unofficial, and both words in "unofficial Grafana plugin" carry risk; requires Grafana Cloud, and the free tier is enough but it is still an account and a hosted dependency; content capture is on by default, so the good disclosure is a disclosure of a default you probably want to change before your system prompts land in a SaaS; `hermes -z` silently records nothing; `plugins enable` does not see pip-installed plugins yet, so setup needs a documented workaround; and it is 42 stars, one fork, zero watchers, and one author — a single-maintainer dependency in the path of everything your agent says.

Someone took DeepSeek V4 Flash 0731, a 284B-parameter mixture of experts, and produced a 56.8GB coding-specialized package that runs on a Mac. The recipe is stated precisely: three hash-routed layers keep all 256 experts, each of the 40 learned-router layers keeps 176 of 256, for 7,808 retained expert rows and roughly 80B parameters removed, leaving 204B total with about 13B active per token and the router still selecting six experts. Quantization is mixed per cell — of 129 routed projection cells, 32 use IQ1_S_R4, 64 use IQ2_KS, 33 use IQ2_K, with denser weights at q6_K — and the layer-12 down projection is explicitly promoted because, in his words, promotion count alone did not predict sustained-thinking quality. It wrote a minimal C compiler targeting ARM64 in under an hour, tested with Fibonacci and FizzBuzz, recorded on video. MIT. The model card is the best evidence document in this edition and possibly this month. It gives the protocol, not just the score: the code panel is 12 fixed 2,048-token windows and 24,564 next-token targets; the WikiText panel is the first 32 contiguous 2,048-token windows of the WikiText-2 test split, scoring the last 1,023 tokens of each, for 32,736 targets; the API panel is 100 prompts and 2,313 teacher-forced continuation tokens from the official model, and he labels it as teacher-forced rather than letting you read it as free-running agreement. Then he publishes the results that make his own artifact look worse. Code perplexity 2.7665 against 2.4250 for the bigger package he is asking you to leave. WikiText perplexity 11.2043 against 5.5548 — twice as bad on general text. API first-token agreement 48 out of 100, down from 66. Structured tool calls slightly worse, tool-result history slightly worse. And the sentence that puts this at the bottom of the list, where the disclosures get most damaging: "These panels were used during package development. They characterize the final artifact but are not untouched post-selection benchmarks." That is an author telling you his own evaluation is contaminated by the selection process it guided, unprompted, on a Show HN with seventeen points. Every vendor in this newsletter's benchmark-disclosure watch has been asked for less than this and delivered none of it. Reach for it if you have a Mac with enough unified memory, a coding-agent workload, and a reason to stop sending your repository to an API. Delete the provider from the loop entirely — that is the layer this pick removes, and it is the only one on the page that removes rather than instruments. Tradeoffs: MoEspresso 2.1 or newer is the only engine that will load it, and llama.cpp, transformers and mlx-lm all refuse, which the one substantive commenter raised immediately — a GGUF release and an `(ik_)llama.cpp` PR "since not everybody has a mac," to which the author said both are on his radar, meaning today this is a single-runtime artifact from a single anonymous account; it is explicitly not a general-purpose replacement and the WikiText number is the proof; the drafter ships separately as a sidecar; the model card never states a minimum RAM figure, so the hardware bar is inferred from the file size rather than published; and the honesty about post-selection contamination, admirable as it is, means the coding numbers are the ceiling and not the estimate.

**Also crossed the pool.** *Unslop* (8 points, 14 comments) sells removal of "AI voice" at $4.99 a month, and its own thread is the entire review: sscaryterry opened with "Fighting slop with slop," spwa4 noted that unslop is "the exact opposite of what you're doing," dofm said the output "has a whiff of automatic translation," tpoacher landed on no-makeup makeup, and kazinator posted the free version — ask for a sixth-grade reading level and read the result. Worth being precise about what it is not: it rewrites style, and today's watermark lives in semantic word choice under a key only Anthropic holds. Nobody shipped a detector. *Treg* took #10 on Product Hunt with 95 votes as "OpenRouter for tools" — 2,600 APIs across about 40 providers at 0% markup with BYOK — and the page claims "Open source (AGPL), self-hostable," but the repository is not findable from the listing or from search, which is the same gap that dropped Aegisora on 08-05 and the reason PH copy no longer counts as evidence of a repo here. *Widen* is back as "a native Postgres GUI using Apple's on-device LLM," 16 days after it posted as "open-source Mac Postgres GUI with local or cloud text-to-SQL," with no commits in between: same 23-star repo, narrower title, and the honest read is that dropping "or cloud" is now better positioning than having the option. Simon Willison on Qwen 3.8 27B (523 points) is the day's best model writeup and its complaint — the model is excellent and defaults to overthinking — is another thing inserted into your output that you did not ask for. And *the AI credit resale economy* (296 points) is the plainest description yet of what sits between you and a provider: credits at 30% to 80% off list, one broker moving $100k a day, and a router the author describes as "a proxy that probably picks from a pool of keys," which is a sentence worth rereading before you route production traffic through a discount.