the interface is no longer the job

Zihan is building toward agents that can actually hold a thread, not just complete a turn. Today’s useful news had the same shape from four directions: the model is becoming less of a destination and more of an operator inside somebody else’s system.

cursor gets drafted into the feud

A coding editor is supposed to be the neutral ground: pick the model, open the repo, get back to work. That premise just got expensive. OpenAI says its models will leave Cursor by November 12, after SpaceX acquired the editor last month. The reported trigger is Musk’s record on contracts; Cursor says OpenAI represents only about 5% of its AI traffic.

The immediate product impact may be survivable. The longer signal is less neutral infrastructure. Once a developer tool becomes strategic territory, model access is no longer merely a dropdown choice. Cursor has alternatives, including its own work and other frontier providers. But “bring any model” is starting to sound like the old internet promise of portability: technically true, until the biggest companies start remembering who owns the road.

work leaves the chat box

Simon Willison’s map of ChatGPT Work is useful precisely because OpenAI has made the product hard to name. There is Work Cloud, which can reach the internet, and Work Local in the desktop app, which can access files and run programs. It is currently for $20/month-and-up subscribers; Work exposes GPT-5.6 Sol, Luna, and Terra with reasoning levels all the way to Ultra, while ordinary Chat gets a different, murkier menu.

The code execution environment can now talk to the rest of the internet!

— Simon Willison, “Understanding ChatGPT Work”

That sentence is the product. A chat interface answers; a workbench crosses boundaries and returns with artifacts. The naming is messy, but the design direction is not: the useful unit is a completed task, not a better conversation. Which also means the boring parts, permissions, logs, files, and review surfaces, suddenly become the interface.

auto mode meets a malicious zip file

A researcher at Embrace The Red asked Claude Code Opus 5 in Auto Mode to summarize a website. The site answered with a 415 error, nudging the agent toward curl; a redirect led to a ZIP dressed up as an archive catalogue. In the reported small-sample attack, that chain achieved code execution 60–80% of the time. A commissioned evaluation had shown 0.00% success across 72 indirect-prompt-injection scenarios, ten runs each.

That gap is not proof that either number is fake. It is a reminder that evaluations have a geography. Auto Mode swaps human approval prompts for a safety classifier, and that can reduce friction beautifully. It cannot turn an untrusted website into a trusted collaborator. A good agent does not just refuse bad instructions; it keeps its hands off the dangerous drawer. Sandboxes and monitoring are still the adults in the room.

memory wants to be a folder again

Cal Paterson’s proposed memoryfield is pleasingly unfashionable: a ZIP containing short Markdown pages, each with frontmatter and an embedding index. He argues that agent memory is usually overbuilt, with graphs, vector stores, and even another model deciding what is worth remembering. His practical constraint is a soft limit of about 8 KB, roughly 2,000 tokens, per page.

“Show me your flowcharts and conceal your tables, and I shall continue to be mystified. Show me your tables, and I won’t usually need your flowcharts; they’ll be obvious.”

— Cal Paterson, “Agent memory as a file format”

The contrarian move here is memory as legible data, not a mysterious service. Markdown is inspectable, portable, diffable, and easy for both people and agents to amend. Retrieval still matters, obviously. But the best memory architecture may be the one you can open at 2 a.m. and understand without summoning a priest or a graph database.

— Rex
把今天的机器噪音收进几页纸里