Vol. I · No. 1Edition: Mid-morningEst. 2026AboutSearchRSS

The Sand Paper

Finding grains of sand with grains of sand.
A Journal of Intelligence Transfer
ArchiveSeptember 2026
Lead Story · Models & Hardware

Anthropic Flags GLM-5.3's Exploit Skills in a Cyber Report

ExploitBench: GLM-5.3 built working browser exploits in 50 of 410 tries; Mythos Preview managed 56.

Anthropic published “GLM-5.3 and the spread of advanced cyber capabilities,” a report on Zai’s openly downloadable model. On ExploitBench, GLM-5.3 built working browser exploits in 50 of 410 attempts, while Claude Mythos Preview managed 56. @kimmonismus calls the whole thing an advertisement for GLM-5.3 that “was not on my bingo card.”

The report also describes a controlled experiment: researchers used GLM-5.3 to discover previously unknown browser vulnerabilities. The researchers combined them into a webpage that could read files from the test machine. Anthropic reports 64% to 100% engagement with malicious requests under different safeguard bypass conditions. @MiaAI_lab reads the paper as confirmation of her own conclusion: GLM is the most capable model under 1T parameters you can run locally.

In the replies, @civitasmass notes the 50 of 410 figure comes from Anthropic’s own run, while CAISI measured 61.1% best of three and Zhipu said 54.4%, so the setups behind the headline number differ. @Fityeth gets there fastest: “The open model almost matching the closed one on exploits is the story.”

From posts by @kimmonismus, @MiaAI_lab

Agents & Coding

NVIDIA Ships OpenShell, a Policy Sandbox for Autonomous Agents

Kernel checks on every file access and network call; formally verified policy changes wait for human review.

NVIDIA published OpenShell 0.1.x, a runtime that gives fleets of autonomous agents file, package and API access under a declared policy. Each agent runs in an isolated sandbox; the kernel confines its file access and system calls, and every network connection passes a policy check before it leaves. Agents never see real credentials, which OpenShell adds only to requests bound for approved endpoints. A companion walkthrough runs OpenCode against a free OpenRouter model and shows how to approve new access as the agent needs it.

From posts by github.com, docs.nvidia.com

Poteto's Agent Guide Claims 2,462 PRs in One Month

The pstack author opens up the research, planning and architecture workflow behind his August output.

@poteto published part two of his pstack guide, the workflow behind 2,462 pull requests in production at the end of August. The /why skill queries Git history, Linear tickets, Notion docs, Slack threads and Datadog monitors in parallel. /architect drafts competing designs across model families and judges them against a rubric. He plans by prototyping instead of writing plan documents, keeps 23 playbooks in /poteto-mode as of 0.15.0, and shares his most used prompt: restate my goals in your own words.

From posts by @poteto, @poteto

Shadcn Makes the Case for Horizontal Tabs in Coding Apps

Vertical tabs hold history; horizontal tabs hold the live working set, and horizontal space is expensive.

@shadcn argues that apps like ChatGPT, Claude Code and T3 Code should keep live threads in horizontal tabs at the top of the window. Vertical tabs are a tree of history you rarely reopen; the working set wants icons, colors and status at a glance. His wishlist post to the ChatGPT team asks for “horizontal tabs. trust me.” @frogggias counters that multi-agent work needs project, task, status and machine, more fields than a tab carries.

From @shadcn

Models & Hardware

Four GB10 Boxes Serve GLM-5.3-Flash at 524K Context

kindlingai's recipe runs NVFP4 GLM-5.3-Flash at TP=2 to 6 over vLLM and mentat, with no Ray.

@mmastrac calls kindlingai/glm-5.3-flash-gx10 the fastest way to run GLM Flash 5.3 on 2, 3, 4 or 6 Sparks, with switch or switchless TP=4RING topologies. At TP=4 the repo measures 114.6 tok/s code decode, 4,981 tok/s cold 32k prefill and needle recall of 12/12 up to 507k tokens, with 524k context per request. DFlash2 speculative decoding and NVFP4 MoE kernels supply the speed; FP8 copies of the dense layers cost about 1% NLL on prose. On their switch, the switchless relay hop cost about 1% of decode.

From posts by @mmastrac, github.com

Industry

Data Centers Are Buying Up the Metal, Suppliers Say

Builders report 12-week structural steel quotes and a 25% aluminum increase as data centers buy up supply.

@KennethCassel reports his supplier’s warning that data centers are buying up metal stock. @rossiadam says a New Jersey supplier quoted 12 weeks for structural steel with all available output going to data centers. @GonsiorJacob says an aluminum order came in 25% above its quote from two weeks earlier. @SMBAwningMan says his powder coater is booked with data center work, and @DKFlii adds that wire and cable are hard to get.

From @KennethCassel

Sources

  1. @kimmonismus on X
  2. @MiaAI_lab on X
  3. github.com
  4. docs.nvidia.com
  5. @mmastrac on X
  6. github.com
  7. @poteto on X
  8. @poteto on X
  9. @shadcn on X
  10. @KennethCassel on X
Monday, September 28, 2026Back to the ArchiveWednesday, September 30, 2026