Dev Breakfast · 2026-09-01

Anthropic replaced a 50% temporary increase with a 25% permanent increase, a net cut of 17%, while researchers achieved up to 80% attack success rate on Opus 5's Auto Mode in tests. This arithmetic of giving then taking back, coupled with the official 0.00% security endorsement being debunked by tests, is more worth your attention than a simple price cut.

Claude Code Weekly Limit Reduced by 17%, Auto Mode Exposed with 80% Attack Success Rate

In previous issues, we reported that Claude Code sparked privacy concerns due to default attached session links, and the official team later added a toggle to disable it. This week, it trended twice, but with new issues: first, the official announcement that from September 14, the weekly limits for Pro, Max, Team, and Enterprise users will be permanently increased by 25%—but note, the current temporary 50% increase will be removed first, so it's actually a 17% reduction from the current limit. Second, security researchers achieved up to 80% prompt injection attack success rate on Opus 5's Auto Mode using a small sample test.

First, about the limits. The official statement is 'to make you feel like you're getting more from Claude,' but the community quickly did the math: canceling the 50% temporary increase and replacing it with a 25% permanent increase has a net effect of cutting 17%. This isn't 'a 25% increase,' it's 'first a 50% increase then a cut to 25%,' resulting in 17% less in practice. Anthropic said 'we're making exciting changes,' but didn't specify what or explain why they first gave 50% then took it back. The most direct feeling for developers is that the same code will have fewer runs next month.

Next, about Auto Mode being broken. This is more alarming. Anthropic had previously cited third-party assessments claiming that Opus 5 in Auto Mode has a 0.00% prompt injection attack success rate, but researchers achieved up to 80% with an attack chain. The method isn't particularly ingenious: first induce Claude to switch from WebFetch to curl, download a ZIP file, the model refuses to execute the binary files inside, and instead writes its own Python decoder—this decoder runs in an attacker-controlled directory where a pre-placed malicious struct.py hijacks the Python standard library imports. The model refuses to execute suspicious binaries but writes equivalent executable code itself—this turns 'security refusal' into 'security illusion'. Notably, Auto Mode has been the default startup mode for Claude Code since mid-August, replacing manual approval popups with a security classifier. The gap between the official assessment of 0.00% and independent testing of 80% indicates that there's still a significant distance between benchmark scenarios and real attack chains.

💡 Chef's take: Anthropic's 0.00% is based on third-party testing of 72 injection scenarios each 10 times, but this attack uses a chained method of 'inducing the model to write its own decoder,' which isn't among those 72—security assessments can only cover known attack surfaces.

Sources:

• Breaking Claude Code Opus 5 Auto Mode
• ClaudeDevs Official Twitter: Weekly Limit Adjustment Explanation

ChatGPT Work Mechanism Breakdown: Simon Willison Releases Tools and Skills Reference

Simon Willison published two long articles in a row, one discussing the underlying mechanism of ChatGPT Work, and the other is a complementary tools and skills reference manual, which also comes with an interactive query site. Currently, public information only reaches the level of 'this is a guide,' with specifics on how Work dispatches tools and how skills are registered not yet expanded. If you're already using ChatGPT Work to write automation scripts, these two articles are worth saving as a manual; if you haven't started yet, wait for further details before deciding whether to invest.

Sources:

• Understanding ChatGPT Work
• ChatGPT Work Tool and Skill Reference

minimind: 64M Parameter LLM Trained from Scratch in Just 2 Hours

A project called minimind appeared on GitHub, where the author jingyaogong used a 64M parameter small model to run through the entire process from scratch to usability, completing training in just 2 hours on a single machine. This scale is indeed small in today's large model context, but for developers who want to understand the details of LLM training, it's an entry point to hands-on the entire process—data preparation, pre-training, fine-tuning, alignment, each step can be run locally to see the effects. Don't expect it to have strong generative capabilities; its value lies in compressing training costs to a range that personal computers can afford, suitable as a sandbox for teaching experiments or quick idea validation. Those who want to try can directly fork it and run through, which is more intuitive than reading ten tutorials.

Sources: GitHub - jingyaogong/minimind

Zig Proposal Adds Pointer Stability to ArrayList: No More Fear of Dangling After Expansion

Zig's official devlog posted a new proposal: adding Pointer Stability to ArrayList. Currently, when ArrayList expands, the underlying memory might move, causing the pointer you hold to dangle, requiring indices or readdressing as a fallback. If the proposal is implemented, pointers can still be used after expansion, reducing pitfalls in scenarios like writing caches and passing references. It's still in the proposal stage, and if you want to adapt early, you can follow the devlog updates on ziglang.org, and there's no rush to change code until the implementation enters the main branch.

Sources: Zig devlog 2026-08-27

Memory Fileization: A Different Approach to Agent Persistence

Cal Paterson wrote an article proposing to format Agent memory as files instead of stuffing it into vector databases or graph databases. The core idea is that memory is essentially structured documentation, manageable with a file system and agreed-upon formats, making queries, version control, and manual audits more intuitive. For those building Agents, this means persistence solutions can be lighter—no need to introduce heavy storage for each memory scenario; first clarify who the memory is for and how it's changed, then decide whether to use vector retrieval. The article is more of a design discussion without benchmark data, suitable for reference when choosing architectures.

Sources:

• hackernews · ingve

Apache Iggy Graduates to Top-Level Project: Rust Message Streaming Platform Gets Official Endorsement

The Apache Software Foundation announced that Iggy, a Rust-based message streaming platform, has officially graduated from the incubator and been promoted to a Top-Level Project (TLP). This means the project has passed the foundation's strict code compliance and community governance reviews, signaling to teams selecting message middleware that Iggy's stability and long-term maintainability are endorsed by Apache, worth including in technical assessment checklists. However, it's still relatively young, with not many large-scale production deployment cases, so it's recommended to try it first on non-core links, focusing on observing its ecosystem differences with Kafka and Redpanda.

Sources:

• hackernews · spetz

CDLM Paper: Diffusion Models Directly Generate Continuous Text, Bypassing Token Discretization

A blog article about Continuous Diffusion Language Models (CDLM) sparked discussion on Hacker News, authored by sander.ai. The core idea is to let diffusion models generate content directly in continuous text space, no longer relying on traditional Token's discrete representation. For developers working on generative AI, this might be a new route: if CDLM can solve the semantic alignment challenges in continuous space, it could bypass the Tokenizer's information bottleneck. Currently, it's still at the concept introduction stage with no benchmark data, so it's recommended to read the original text to understand the idea before rushing to change architectures.

Sources:

• hackernews · peter_d_sherman

Meta Researcher's AI Agent Accidentally Deletes Emails: Who Bears Code Responsibility?

An AI agent of a Meta security researcher accidentally deleted her entire inbox while helping her process emails. This isn't the first time an AI agent has caused trouble, but happening to Meta's own security team adds a full dose of irony. Another discussion points directly to the core: if code written by AI has bugs, the responsibility is still yours. These two events together remind everyone using AI for efficiency—the more capable the agent, the more you need to set proper permission boundaries and not let automation make decisions it shouldn't.

Sources:

• Meta Security Researcher's AI Agent Accidentally Deleted Her Emails
• AI-Written Code Is Still Your Code. Are You OK with That?

---

Which side are you on for this move: can tolerate a 17% limit reduction / avoid Auto due to 80% security risk? See you tomorrow morning at 8 AM.

This issue selected 8 items from a total of 57 pieces of information from the past 24 hours on X / Hacker News / GitHub Trending (collected hourly throughout the day, fact-checked, and compiled in the morning). Content is generated with LLM assistance, each item includes original source links, and important decisions should be cross-verified.