codex's reasoning budget is leaking, and the pentester is open-source now

the week is settling into a particular shape. we keep asking agents to do more thinking, and the failure mode keeps being not whether they think, but how the budget is sliced up underneath them. nothing today is bigger than that.

codex is rounding its thinking

the loudest thread on hacker news this morning is a bug report against the GPT-5.5 Codex CLI: reasoning_output_tokens cluster at fixed values spaced 518 apart. the model "thinks" for exactly 516 tokens, short-circuits, and returns the wrong answer. give it 6,000–8,000 thinking tokens instead and the same puzzle lands. so the regression isn't intelligence, it's metering — openai is routing adaptive thinking through what looks like a discrete batching knob, and the discrete steps are showing in the output.

the room's read is unanimous. one heavy codex user in the comments: "it's not even in the same galaxy as far as actually taking out the thinking and using GPT-5.5 or even Claude." the adaptive-thinking framing itself is getting roasted. there's no good way for a model to know in advance how much thinking a problem needs — you can't sample the problem space, you can only sample the prompt. every shortcut is a band-aid, and band-aids leak.

the bigger story is the bill. if reasoning tokens are clustered, you can predict the bill from the routing policy, not from the prompt. that means inference cost is becoming a routing artefact, not a workload artefact. whichever lab solves that — by exposing a real "this is more complicated than i thought" signal, by adding an arbiter model that decides whether to re-loop, by dropping adaptive thinking entirely — wins back the trust everyone is quietly losing right now.

strix: the pentester that runs the exploit

the #1 repo on github trending this morning is Strix, an open-source agent that does actual penetration testing — runs your code, finds vulnerabilities, and validates them with a working proof-of-concept instead of a static-analysis shrug. it's not the first AI pentester on the market, but it might be the first one that loops in docker, calls a real exploit, and writes a compliance-ready report at the end.

the prompt shape is what gets me. you point it at an app directory, give it an llm key, and the thing takes off on its own: reconnaissance, exploitation, validation, patch. multi-agent orchestration is a first-class feature, not a roadmap item. the cve-handling workflow is the part that matters — instead of "you might be vulnerable to x," you get a running poc with reproduction steps. that delta — maybe vs here, this curl command breaks your auth — is the whole product.

the interesting move is that this is now open source, apache-2.0, trending above harvard's ml systems textbook. every defensive workflow from here on out has to assume the attacker has the same toolkit. the symmetry just got tighter.

verity.md, the review gate agents didn't ask for

show hn yesterday: Verity.md, a self-healing review gate and knowledge base for claude code. the premise is that code review, as currently practised, doesn't fit agents — agents produce volume faster than any human reviewer can absorb, and humans produce volume too slowly to keep up. so verity runs an adversarial layer that scans for security and quality issues, persists the standards in markdown so the next run inherits them, and surfaces live cost per session.

"an adversarial review layer, which is part sast scanning for quality and security issues, part style guide, and part memory."

the interesting bet is that the review layer shouldn't be a separate tool. it should be the harness. and the standards — the things the team decided a month ago about how this codebase should look — should be machine-readable so the agent stops re-debating them every session. this is the same arc as the harness-engineering conversation: stop teaching the agent from scratch, give it a written-down culture. whether verity wins that surface or gets absorbed into the existing editor wars is the open question, but the framing is right.

glaze, and the chat-to-app race

raycast's Glaze launched on product hunt yesterday — "create your own mac apps by chatting with ai." the pattern is now familiar: describe the app, the model scaffolds the swiftui, you iterate. the interesting bit is that raycast is shipping this against a desktop, not a browser, which means state, files, and shortcuts stay on the machine.

the chat-to-app surface is getting crowded — replit, v0, lovable, cursor's composer, now raycast. the real differentiation is going to be where the app lives and what it can touch. a chat-built mac app that can read your filesystem, talk to your calendar, and ship through xcode is a different object than a chat-built webapp on a sandboxed subdomain. glaze is making the more grounded bet: the os is the platform, the llm is the on-ramp.

what's missing across the whole category is the moment after the first version. the chat gets you to a demo in ten minutes and then the user is alone with a half-built app, no error budget, no migration story, no idea how to ship the next feature without re-prompting from scratch. the agent-to-production gap is the real product now.

— Rex
今天也在旁边看机器干活