Anthropic says it went from about 2,500 merged changes a day in May to over 30,000 in September, and that git stopped coping. It built its own version control system. Separately, a user filed an 11-year-old Rust soundness bug, a developer found half his traffic was one AI newsletter bot, and a free Mac app turns an embedding model into a transcriber.

Today: Scion, the Rust borrow checker bug, the bot traffic post, and EmbeddingGemma Transcribe.

When agents do the typing, the slow parts are everything around the code.

🌿 Git could not keep up with the agents

Anthropic’s engineering team says it averaged about 2,500 merged code changes a day in May 2026 and over 30,000 a day by September. In its words, source control became the biggest development bottleneck. Its main branch history is almost 100 GB, a compressed working copy is over 25 GB, and it does about 25 million checkouts a day for CI alone. At peak it ran several hundred internal git mirrors.

So a team of seven built Scion, a server-side version control system, and migrated the monorepo from git in five months, per the post. The design assumes clients (mostly agents and CI jobs) are always online: commits, merges and rebases happen on the server, there are no packfiles, and the client fetches only the trees and blobs it asks for. The post claims Scion’s footprint is 200x smaller than the old git mirror fleet in CPU and memory, CI checkouts are two orders of magnitude faster, and CI alone gained 25% CPU capacity. It also says engineers’ main job was telling Claude no: for example, systems brute-forcing merge lookups by reading the commit log. These are Anthropic’s numbers about its own system. We did not verify them, and Scion is internal, not something you can install.

Redesigning source control at Anthropic  ·  HN discussion

🦀 Eleven years, twenty-two lines

On October 13 a GitHub user, jsnell, opened rust-lang/rust issue 164250. His title: a struct’s lifetime requirements can be bypassed via covariant field assignment. He attached a program of about 20 lines that the compiler accepts, and which prints XXXXXXXX where it should have printed a string that was already gone. Run under AddressSanitizer, he says, it crashes with stack-use-after-scope. He reports it on current nightly and on stable down to 1.85.0.

A note at the top of the issue, signed by Rust team member lcnr, says the bug is 11 years old and rated P-high. It says that would have been P-critical had anyone hit it in the wild, and that an 11-year-old bug nobody found cannot be that easy to hit. It also says exploiting it takes an intentionally malicious Drop implementation. The note points to the Types Team’s work on a next-generation trait solver and a region constraint rework. We did not compile the example ourselves, and the issue is still open.

Issue 164250  ·  HN discussion

🤖 Half his traffic was one newsletter bot

A developer who writes at sammystraus.com has been building Sprinklz, a customizable feed reader that can deprioritize topics, like AI, in your news feed. A month ago he posted it to HN and got about a hundred upvotes. Then the site got slow, days after the post, and the numbers did not add up: a few real logged-in users and a server under heavy load.

He added per-path request logging and found most requests never tried to fetch articles. His site is a single-page app, so they were not even running the JavaScript. Reading the nginx logs, he says nearly half of all traffic came from one client that describes itself as a service that watches websites for changes and writes an AI newsletter. It queried many times a minute, so he blocked it. The rest were self-identified crawlers (Claude, OpenAI, Google) and vulnerability scanners probing paths such as /wp-content/phpinfo.php. He added a robots.txt that discourages AI scanners but allows search, rate limits, and had Claude probe his own scan-bait paths to check nothing leaked. The numbers are his account, from his own logs. He does not name the bot, and we did not check his site. On HN a commenter who also hit #1 says the effect on a small Hetzner VPS was a few percent of CPU, so results vary.

The post  ·  HN discussion

🎙️ An embedding model that learned to listen

An independent team took Google DeepMind’s EmbeddingGemma 2, an Apache-2.0 embedding model for text, images, audio and video, and asked whether you could read words out of its audio space. They say you can. A small trained "reader" maps each slice of audio into the model’s text space, the closest of about 229,000 English words wins, and a tiny extra model adds punctuation and capitals.

Their page says only the reader was trained, in under two hours on 8 H100s on openly licensed English speech, and the audio encoder is untouched. They claim an hour of audio takes about 12.6 seconds on a base M3 MacBook Air with 8 GB, running on the Neural Engine, against about 25.7 seconds for IBM Granite Speech 5.0 TurboCTC on the same machine. They list NVIDIA Parakeet numbers from other people’s benchmarks on faster Macs and say the comparison is rough. They also admit a word error rate of about 5% now versus 2 to 3% for leading models. The app is free, for macOS 14 and up on Apple Silicon, downloads 715 MB on first launch, and you hold Right Option to dictate into any app. They say audio never leaves the machine. It is not affiliated with Google. On HN a commenter asked whether it is open source and nobody pointed to a repo; another commenter, not the authors, thinks a CTC head on Gemma’s encoder would do better. Everything here is the authors’ claim. We did not install it.

Embedding Gemma Transcribe  ·  HN discussion