| ← All issues | ||||||||||||||||||||||||
| The Diff No. 002 Monday, 5 October 2026 · AI dev news, only what is verified | ||||||||||||||||||||||||
 | ||||||||||||||||||||||||
Agents spend money while you sleep. Cap it. Then delete a plugin. Two sections as always. VIRAL is what the field argued about in the last day, with the number. UNDER THE RADAR is what almost nobody has noticed. New today: a video of the day, and a short strip of the boring official news (model releases, product changes) with dates and primary links. Limits beat reminders. For money, for time, for context. | ||||||||||||||||||||||||
IN THIS ISSUE
| ||||||||||||||||||||||||
🔥 VIRAL What blew up on X and Reddit this week. Each one has where and a number. | ||||||||||||||||||||||||
 V1 Hacker News · 562 points · 288 comments Hard budget caps, for the agent that never sleeps 🐷Simon Willison asks every cloud to ship them by default SCENE Simon Willison, on Oct 3: nobody wants to wake up to an email sent at midnight warning about a budget limit, to find that a rogue service ate several hundred or several thousand more dollars while they slept. Coding agents make it cheap to spin up code that calls paid APIs, he writes, and he has heard from people who refuse to use AWS for personal projects for fear of a runaway bill, and from people who ended up seriously burned. The post hit 562 points on Hacker News. THE THING Two providers have shipped something. AWS announced project spend limits on Sep 16: at the limit, the project is paused for the month. Its docs say a Paid Plan is required and that the new experience is rolling out to a limited number of customers. Google Cloud's Spend Caps pause new usage of eligible services in a project once estimated cost passes the budget. Its docs call it Pre-GA and list four services: Gemini API, Gemini Enterprise Agent Platform (formerly Vertex AI), Cloud Run and Cloud Run functions. They also say caps do not pause fixed usage on persistent resources like compute and storage, and you lift a cap by hand. An HN commenter called Google's caps fake because of the short list; the docs confirm the short list, so "narrow" is fair, "fake" is his word. ✂️ STEAL IT Open the billing console of the one provider your agent can spend on and set a hard cap on the project it uses. On Google, check whether your service is one of the four. Where there is no hard cap, create a separate project or key with a low prepaid balance for agent work. Try today VERDICT Ten minutes. It fails where your spend is not on an eligible service, on AWS where you are not in the limited rollout, and on anything that bills for storage or running instances, which a cap does not stop. Willison's post · AWS spend limits · Google spend caps · HN thread | ||||||||||||||||||||||||
 V2 Hacker News · 362 points · 11,352 stars · MIT A 125B model on a gaming PC 🎮Strata, and the one line in its README to read before you paste SCENE On Hacker News, snehesht reported 124 tokens per second on an RTX 4090 and prettyblocks said it flies on a 3090. Those are their numbers, not ours. The README's own figures are 94 tokens per second on an RTX 5070 and 60 on an AMD RX 9070 XT, at a 2-bit quantization. THE THING Niko1221/Strata, MIT, created Sep 24, 11,352 stars and 304 open issues when we looked. Per its README it runs a 125B-parameter Qwen3.8-Flash-Next model on a consumer gaming PC. The thread has 195 comments. We did not run it: it needs a GPU we do not have. Star counts move fast on a launch like this and we did not check how they grew. ✂️ STEAL IT The README suggests pasting a prompt into your agent that says to set Strata up on your PC by following docs/AI_SETUP.md. A commenter, deadbunny, flagged that as a prompt-to-install risk. Before you paste anything like it, open the file it points to and read what it will run. Watch VERDICT The speeds are the author's and commenters' reports on three GPUs, and nobody has shown that quality holds at 2-bit for real coding. It fails if your agent needs long context or tool calling reliability, which the README numbers do not cover. | ||||||||||||||||||||||||
 V3 Hacker News · 413 points · 269 comments · MIT Turn off Apple Intelligence, get the disk back 🍏RemoveMacAI, and the curl | bash argument it started SCENE On Hacker News, Noaidi wrote that Apple Intelligence, turned off, still takes about four gigs on an iPhone: it vanished and came back. On the top of the thread, arialdomartini replied to the installer with a link to nocurlbash.com. Meanwhile nailer noted the project does curl | bash "properly", with a checksum and build attestation. THE THING omlahore/RemoveMacAI, MIT, created Sep 29, 566 stars. Per the README, macOS 27 no longer has a single switch for Apple Intelligence and its models stay on disk after the features are off. The tool turns the features off, removes the models and blocks re-download. The list includes Xcode predictive code completion. It installs a configuration profile that macOS makes you approve, and has status, off --dry-run and revert. The README gives no gigabyte figure, so we cannot tell you how much space you get back. We did not run it. ✂️ STEAL IT If you are on macOS 27, run removemacai status only after reading install.sh, then off --dry-run to see the changes before applying anything. The README says gh attestation verify checks that a download came from the repo's source. Watch VERDICT A real complaint with a careful installer. It fails if you rely on Xcode's predictive completion or Siri, and it is a third-party script that changes a system profile on your machine. Revert is documented, we did not test it. | ||||||||||||||||||||||||
🔭 UNDER THE RADAR Almost no attention. More useful than most of the loud stuff. | ||||||||||||||||||||||||
 U1 268 stars · BSD-3-Clause · the essay hit 352 HN points Agents don't need memory, they need documentation 📓a year of a plain folder, now a plugin SCENE Kevin Liao says that over a year ago he started telling his agent to write everything down in an internal/ folder: specs, plans, indexes. He had it read the right documents before work and update them after. By his own account that grew into a plugin called Operator Memory. His Oct 3 essay argues every memory plugin is the same thing underneath: snippets in a vector database, the top five injected into each prompt. THE THING aerovato/operator-memory, BSD-3-Clause, 268 stars. Per the README, the agent keeps a Markdown "brain" of instructions, specs, research and indexes, consults it before work and updates it after, with no vector database or embeddings. It lists Claude Code and Codex as fully supported. The claims that it works better than RAG memory are the author's, and we did not test them. ✂️ STEAL IT You do not need the plugin. Make a docs/ folder, add an index.md, and put two lines in CLAUDE.md: read docs/index.md before starting, update the relevant doc after finishing. Run it for a week and see how many corrections you stop repeating. Try today VERDICT Two lines, no install, files you can read and commit. It fails when the docs go stale faster than the agent updates them, which is the author's own point about memory snippets. | ||||||||||||||||||||||||
 U2 40 stars · created Sep 27 · no license · Show HN 91 points Faster clean Rust builds, from patching the compiler 🦀headstart, and why it is not for production yet SCENE You change a Rust dependency in CI and wait for a clean build. PowderworksCode's headstart patches rustc (-Zearly-metadata) and cargo (-Zheadstart) so crates can start compiling before their dependencies finish. THE THING PowderworksCode/headstart: 40 stars, created Sep 27, pushed Oct 4, and the repo shows no license. Per the README, clean builds of 13 projects ran up to 54% faster for cargo check and 42% for cargo build on 16 cores; OpenAI's codex-rs built 37% faster; the gain shrinks on 4 cores. Those are the author's numbers, we did not reproduce them. The README says the goal is upstream pull requests. ✂️ STEAL IT Do not install a patched compiler. Check your own clean-build time on a many-core runner: if cargo is mostly waiting on a long dependency chain, this is the idea to watch land upstream. Watch VERDICT Big claimed numbers on a patched toolchain with no license. It fails on small machines (gains shrink at 4 cores) and until the changes are in stable Rust. | ||||||||||||||||||||||||
 U3 2 MB binary · Show HN 6 points · author's benchmarks A package manager written entirely by Claude Code 📦jpm, with install scripts blocked until you approve SCENE JT Turner, an engineer of 27 years, says on Hacker News he built jpm at first to see if it was possible. By his account it worked within a few hours, then took another five days of the agent looping on popular packages and hardening it on Windows, Mac and Linux. The jpm site says Claude Code on Opus 5.5 wrote every line, its own TLS included, and that his condition was to test it as if nobody trusted it. THE THING getjpm.sh, a Rust package manager in one binary of about 2 MB. Per its page, on GitHub CI a cold nuxt install (591 packages) took 1.22 s against 1.28 s for bun and 18.54 s for npm, and jpm is fastest in 9 of 12 cells. Those are the author's benchmarks. The security defaults are the interesting part: dependency install scripts do not run until jpm approve, versions less than a day old are not picked, and a project's own .npmrc cannot lower TLS checks. It imports your existing lockfile and leaves the old one alone. We did not run it. ✂️ STEAL IT Even if you never switch, copy two settings into your own package manager: ignore install scripts by default, and set a minimum release age of a day. The page says its own approval step is not a sandbox: a script you approve runs as you. Watch VERDICT A fast, strict idea from a one-person project with 6 HN points and no track record. It fails on trust: its TLS and crypto are home-grown, and we only have the author's tests and benchmarks. | ||||||||||||||||||||||||
📊 THE ATTENTION GAP The loudest public number we found for each item (units differ: HN points, stars)
| ||||||||||||||||||||||||
ALSO ON THE RADAR Photo and video search on macOS. allenv0/SCM, a Show HN with 144 points: AI search for every photo and every frame of video. We read the title only, not the project. Repo → The house fuses. On r/LocalLLaMA, one poster went from a single 3090 to 20 DGX Sparks and says the first bottleneck was the house fuses. Most replies joke about the cost; not a dev tip, but a real picture of where local compute ends up. Post by ciprianveg, read via an archive. Reddit → | ||||||||||||||||||||||||
📺 VIDEO OF THE DAY  Did a 50 year old military secret just solve agent prompt injection? Fireship · 5:03 · 828,490 views when we looked · uploaded Sep 30 · thumbnail from YouTube We did not watch it all. We read the description and the project it points to. The video covers OpenAPPA (archestra-ai/OpenAPPA, MIT, 1,405 stars, created Aug 18, marked preview and RFC). Per its README it sits between an agent and its tools and checks, before every call, whether this data may go to this destination, using a declarative TOML policy and no model in the decision. The README's table is the author's: 89% task completion and 0% attacks that succeeded, against Claude Code auto mode at 90% and 10%, and Microsoft FIDES at 41% and 31%, on their own benchmark of 1,320 evaluations. We did not run it. A Claude Code plugin exists (appa plugin install claude-code) through a curl | sh installer. | ||||||||||||||||||||||||
🗂️ THE BORING STUFF Anthropic, Oct 6: On Pro and Max plans, new Cowork tasks run in the cloud and the Only on your computer setting is removed. Tasks already started on your computer stay there, with a transcript download. Page dated Oct 1. Claude Help Center → Aleph Alpha, Oct 3: Kolibri, an English-German mixture-of-experts model with 78B total and 3B active parameters, up to 1M tokens of context, open weights under Apache 2.0. Aleph Alpha blog → Cloudflare, Oct 1: Asks developers to build the next Git platform for agents on Artifacts, its versioned filesystem that speaks Git. Cloudflare blog → AWS and Google Cloud: Spend limits and spend caps, in V1 above. V1 → Official sources only, with dates. No financing news we could verify today. | ||||||||||||||||||||||||
🧪 ONE THING TO TRY TONIGHT Set one hard spend cap tonight. Pick the one provider your agent can bill and cap that project. Then add the two documentation lines from U1 to CLAUDE.md. Tomorrow, check whether the agent read them. | ||||||||||||||||||||||||
What this issue could not see. Numbers read between 01:00 and 06:30 on 5 October. The X mirror we use returned nothing, so X is not covered today. Reddit is RSS rank only, GitHub stars come from the GitHub API or the repo page and HN points from Algolia. Numbers from a commenter or an author are theirs, not ours. We ran none of today's tools. We read the video description, not the video. Bluesky and LinkedIn had nothing new for this audience. | ||||||||||||||||||||||||
| Illustrations are generated. |