Claude's web_fetch stops following the links inside the pages it reads
The path that could pull your saved chat memory out through Claude's own web_fetch is closed, and the free-roaming browsing step it exploited closed with it.
A patched web_fetch trick walked Claude's memory out one letter at a time1
Claude's web_fetch will no longer follow a link it finds inside a page it already fetched. It follows only links a user typed or that web_search returned.1 Ayush Paul's writeup shows the hole that closed. His server answered every path in an alphabetical trie, so a page telling Claude to walk that structure and spell out a name logged the name letter by letter in ordinary GET requests, turning a read-only fetch into a write channel.1 A fake Cloudflare turnstile, shown only when the Claude-User agent was present, supplied the cover: it claimed AI assistants could authenticate by stating their user's name.1 Three fields left Claude's chat memory this way: full name, employer, and hometown. Anthropic paid no bounty and said it had found the bug internally first.1 Simon Willison files the attack under the lethal trifecta he named in 2025: private data, hostile instructions, and a channel out.2 The class is old and the vector is new. The fix closes the vector, and the multi-hop browsing that chained one page's links to the next closes with it. The trifecta still stands wherever memory, tools, and untrusted text meet.
xAI open-sourced the Grok Build harness after it shipped whole repos to a bucket3
xAI placed Grok Build under Apache 2.0 and pushed the harness to GitHub: a full-screen Rust TUI, 99.6% Rust, that edits files, runs shell commands, and drives long tasks over the Agent Client Protocol.3 The release is repair, not generosity. Version 0.2.93 had been uploading complete local Git repositories to a Google Cloud bucket named grok-code-session-traces, and the in-CLI toggle meant to opt out of model-improvement changed nothing.4 One session moved 5.1 GiB where about 192 KB would have carried the work, a factor near 27,800.4 Running the harness locally, xAI says, takes it out of the data path. That holds only if a builder also points the harness at their own inference rather than x.ai's hosted models, and it leaves open why the toggle failed, how long the uploads ran, and how many users were touched. As of July 13 xAI had filed no incident report.4 Simon Willison's SLOCCount read puts the tree at 844,530 lines of Rust, roughly 3% vendored, with tools adapted from Codex and OpenCode and a subagent prompt that tells the model not to reveal its own system prompt.5 CONTRIBUTING.md refuses outside patches. The new disable_codebase_upload flag and a reset of usage caps shipped with the July 15 open-sourcing.6
TRACE hands a long-horizon agent turn-level reward with no critic to train7
Outcome-only rewards are sparse over a long agent rollout and blame the whole trajectory for a bad ending, including the useful tool calls inside a run that failed. TRACE scores credit at each tool-call boundary instead. It reads a reference model's log-probability of the gold answer, converts that to a state value, and takes temporal differences for per-action rewards, with no separate critic trained and no step-level labels.7 The offline gains on BrowseComp-Plus are large: Qwen3-4B rises from 7.2 to 35.6 and Qwen3-30B-A3B from 8.4 to 42.6, pure RL with no supervised warm-up.7 Two limits hold the number in place. It is one benchmark family on two Qwen3 sizes, and the method needs a verifiable gold answer to score against, so the softer claim that it transfers to the open web carries less than the offline figures a builder would quote.7
DeepLoop finds the residual rule looped Transformers were missing8
A looped Transformer reuses one shared block across several visits, so a single update aggregates gradients from every visit and is read back by those same visits on the next pass. DeepLoop formalizes that tied-depth coupling and finds standard DeepNorm scaling too weak for it. In the aligned regime the residual exponent has to climb from 1/4 to 1/2 as the loop count grows at fixed physical depth.8 The rule it prescribes, α=(2N)1/2 and β=(8N)-1/2 for unrolled depth N, is neutral when no block is revisited and lifts validation loss and downstream accuracy once recurrent depth is on.8 The evidence reaches GPT-2 medium, and the 1/4-to-1/2 figure comes from a conservative worst-case bound rather than a measured optimum. It is a principled default for a builder scaling a recurrent-depth model, still short of a frontier-tested constant.8
AHR adapts a model by learning one number per attention head9
AHR fits a new text-classification task by learning a single scalar on each attention head and changing nothing else, about 0.0001% of the model's parameters.9 In the low-sample regime that beats LoRA while training 200 to 1000 times fewer parameters, and the per-head weights read back as an interpretable map of which heads the task leaned on.9 It is shown for classification, not generation, and the edge over LoRA lands specifically where labeled data is scarce, the security-style setting the authors target. It is a cheap few-shot knob, not a general replacement for low-rank tuning.9
Sources
- Ayush Paul · The Memory Heist
- Simon Willison · How I tricked Claude into leaking your deepest, darkest secrets
- xAI · grok-build repository (README, CONTRIBUTING.md)
- Crypto Briefing · xAI's Grok Build CLI caught uploading private code and secrets to Google Cloud bucket
- Simon Willison · xai-org/grok-build, now open source
- Crypto Briefing · Grok Build open-sources code and resets usage limits for users
- arXiv · TRACE: Turn-level Reward Assignment via Credit Estimation for Long-Horizon Agents
- arXiv · DeepLoop: Depth Scaling for Looped Transformers
- arXiv · Data-Efficient Adaptation of LLMs via Attention Head Reweighting