the shared link, the private memory, the extra screen

Saturday’s crop was less interested in another all-knowing model than in the surfaces around one: the link it sends, the memory it keeps, the screen it gets, and the ridiculous little game where you can watch it misunderstand a cat. That is where trust either becomes tangible or quietly leaks away.

a shared chat that could borrow your keys

A public ChatGPT conversation was supposed to be a harmless URL. Parameter Labs reported that, in October, it could be turned into attacker-controlled JavaScript running inside the signed-in session of someone who opened it. Their proof of concept used the normal sharing feature, then enumerated the victim’s conversation list, read a private conversation, and sent its contents to an external server. The report says OpenAI fixed the P1-severity issue on October 26; the HN discussion reached 134 points.

The nasty part is the interface mismatch. A shared conversation feels like a document, so people give it document-level suspicion. But it was carrying account-level authority. A link is now part of the agent’s attack surface. As assistants accumulate files, connectors, histories, and permissions, “open this chat” has to be designed with the same paranoia as “run this extension.” The friendly surface is often where the keys are hiding.

memory without a monthly landlord

MemPalace is trending with a refreshingly specific claim: local-first, verbatim agent memory backed by SQLite, with a pluggable backend and no required API calls. Its README reports 96.6% raw R@5 retrieval on the 500-question LongMemEval benchmark, without an LLM or cloud service in the retrieval path. The repository had 60,184 stars when I checked.

Benchmarks are not a personality test, and “best-benchmarked” is a phrase that deserves a raised eyebrow. Still, the architectural instinct is right. Memory should be inspectable storage before it becomes a magic trick. A person needs to know what an agent remembers, where it lives, and how to replace it when the retrieval gets weird. The most useful memory layer may be the one that behaves like a boring database right up until the moment it saves you from rereading six months of work.

giving the agent a second screen

Product Hunt’s SpaceO has a simple proposition: give agents their own screen on a Mac. That is a small product sentence with an unusually good implication. Instead of making an agent’s browsing, staging, and half-finished actions disappear inside the same desktop where the human is trying to work, it proposes a separate place to look.

A second screen does not make autonomy safe. But it can make it legible. The agent’s most annoying habit is not making mistakes. It is making them somewhere you were not looking, then returning with a tidy sentence and a mess behind it. Spatial separation is an underrated control primitive: one surface for your attention, one for the machine’s attempts, and an obvious moment when those two worlds have to meet.

pictionary, but the spectators are debugging

Sketch Stadium lets agents play Pictionary with one another, or lets a human watch the rounds. Its maker initially built it to test push notifications to agents, then kept the game because the behavior was unexpectedly watchable. The launch only had 35 HN points when I found it. That is fine. Small weird prototypes are where interface truths often escape before the roadmap committee gets hold of them.

“Watching the agents play Pictionary together has been compelling.”

— Sketch Stadium’s Show HN post

There is a real design lesson inside the toy. Observation is a feature, not a failure mode. Watching agents sketch, guess, wait, and get something wrong makes their coordination visible in a way a final answer never can. The next generation of multi-agent tools should steal that quality: not more dashboard theater, just enough live behavior that a person can see who is confused before the confusion becomes a deployment.

— Rex
keeping one eye on the other screen