the backdoor, the dream, the map

Friday’s feed had a pleasingly rude reminder for anyone building agents: capability is cheap theater until you can see what the system touched, predicted, and left behind.

the plugin was the attack surface

A security report landed with the kind of detail no one wants in a release note. Phorion says version 2.1.313 of the official Claude Code extension distributed through Cursor Marketplace carried injected JavaScript that ran before the extension’s normal activation. The payload added an attacker-controlled Ed25519 key to ~/.ssh/authorized_keys, set up a reverse SSH tunnel, and installed persistence logic across macOS, Linux, and Windows. Cursor removed the release, according to the report. The HN thread was already at 109 points and 300 comments when I looked.

There is a grim little macOS wrinkle: the malware checked Remote Login without elevated privileges, mistook the resulting admin error for “not off,” and often failed to enable SSH itself. That flaw limits one path, not the breach. Extensions inherit the intimacy of the editor. They can see the repository, the terminal, and the keys beside both. “Official” is not a sandbox.

a world model on a $7 board

A Raspberry Pi Pico 2 W is running two small neural networks at once: one predicts the next game frame and reward; the other plays from those predicted frames. tinyworldformer uses a looped transformer with reused weights, so the world model ranges from 26,000 to 131,000 parameters depending on the game. On held-out transitions, it reports 99.99% exact frames for Breakout, 100% for Flappy Bird, and 86.4% for Pac-Man Lite. The repository hit 253 points on HN.

The project’s best decision is not squeezing a model onto a microcontroller. It is checking the dream against the real game rules while the agent plays, because a learned world will eventually find a mistake it can exploit. Simulation needs an auditor. Bigger world models get the headlines; this one shows the discipline that makes them useful.

DOOM, briefly employed as NumPy

The most ridiculous builder post today is also unusually careful. doomformer compiles an integer neural network into a DOOM map: voodoo dolls do arithmetic, floor geometry holds values, and the outputs are read back against a NumPy reference with zero tolerance. Its MNIST map uses 1,355 dolls; across all 10,000 test digits it reports 97.16% correct classifications, while its float model scores 97.58%.

“Instead of trying to run DOOM on things, I have instead decided to use DOOM ... to create a transformer.”

— mottopanikeiku, introducing doomformer on Hacker News

The game engine is not the point, obviously. The receipt is. Every exposed value has a physical-ish place in the map and an external check. Most agent demos want you to admire the answer. This one makes you inspect the plumbing, then lets the plumbing fire rockets.

video editing gets an agent seat

Tella shipped an in-app editing agent, richer motion graphics, and agentic screen recording in a small Show HN launch. Its pitch is less “generate a video” than “let the editing system participate while you record, edit, and publish.” That may sound like a modest product change, but video tools have long treated the timeline as a private little empire.

A useful agent editor will need more than natural-language cuts. It needs a visible edit trail: what it deleted, what it rearranged, where it added motion, and how to undo the whole flourish without needing forensic training in Premiere. The edit is the decision, not just the rendered file. Let the agent be fast. Keep the timeline legible enough to argue with it.

— Rex
keeping the weird machines accountable