Claude wrote security proofs for 123 libraries

Claude formally proved security properties in 123 open-source libraries! Anthropic and its partner Theorem had Claude turn existing fuzz tests into math proofs, showing the compiled code (RISC-V) won't crash with memory-safety errors for any input under 64 MB, under the assumptions they spell out. While writing the proofs, Claude found bugs that had gone undetected for years, despite trillions of test runs. Anthropic notes that verifying the seL4 kernel once took 20 person-years, which is why this kind of proof has mostly been limited to things like avionics. Why it matters: proving code is safe is getting cheap enough for everyday projects, and Theorem published a Claude skill so you can try it on your own code! (359 points on HN as of 4:45 AM PT Oct 23) Anthropic · Theorem's skill · HN

Anthropic launched Claude Duet, an agent that comes to you. It's a research preview where Claude sends you a short brief each morning on what needs you across your connected apps, takes on tasks while you're away, and checks with you before it acts on your behalf. It runs on Claude Opus 5.5, comes with Pro and Max plans in the US, and you join through a waitlist. Anthropic says it never directly sees your passwords or sign-in tokens. Why it matters: this is where AI assistants are heading, from waiting for your prompt to working in the background, and the "ask before acting" part is the design to copy if you're building agents! (551 points on HN as of 4:45 AM PT Oct 23) Claude Duet · HN

Agent Skills now has a neutral home at the Linux Foundation! Anthropic donated the Agent Skills standard (a folder with a SKILL.md file that teaches an agent a task) to the Agentic AI Foundation, the same group that already runs MCP. Anthropic says more than 70 agent platforms support it, including ChatGPT, Cursor, GitHub Copilot and VS Code, with 1 million skills published and nearly 280 million installed. Engineers from Anthropic, Google, OpenAI and other companies will maintain it. Why it matters: a skill you write once should keep working across your tools, so it's a safe bet to start saving your best prompts as skills! (Anthropic's numbers, Oct 22) Anthropic · Simon Willison

12 AI models were asked for their most controversial take on humans, and nearly all said the same thing. ModelCompare asked each model three times, and 29 of 35 answers boiled down to one idea: people put belonging ahead of truth. 7 of the 12 models gave that answer every single time. Why it matters: when you ask AI for a "bold, original" take for your app copy or pitch, you may get the same one everyone else gets, so add your own angle! 😄 (461 points on HN as of 4:45 AM PT Oct 23) ModelCompare · HN

PHP2Shell: critical PHP bugs found with AI help, and the news leaked early 😬 On Oct 21, PHP shipped 8.5.12, 8.4.27, 8.3.36 and 8.2.35 to fix two flaws (CVE-2026-109618 and -109619) that can let an attacker run code on a server with no login. Wiz says frontier AI models helped it find and exploit them, and that they go back to PHP 5.4. Update now!

The drama: a day before the planned announcement, an HN user posted that the bugs were coming, then apologized, saying he'd been told there was no embargo. Amazon says its honeypots saw an exploit attempt on Oct 17, four days early, and it doesn't know how the attacker got the details. The PHP Foundation is asking companies that rely on PHP to help fund its security work. php.net · PHP Foundation · Wiz · Amazon · The apology