This as-told-to composition is according to a conversation alongside Steph Krim. It has been edited for dimension and clarity.

I had continually been that weird kid whose family collected things.

My parents had a catalog toy auction business. This was before eBay existed. We'd journey all about the world, finding things — chiefly toys — for our collection.

My mother would photo the items and paste the photographs into the catalog, and my begetter would category the descriptions of all item using a typewriter. Then the catalog would be sent out to possible customers, alongside alongside a catalog of how much former items had sold for. People would call up or dispatch in their bids by mail.

We lived in a long, lean house in Massachusetts. Attached to our home was a three-story expansion anywhere we stored all the collectibles.

Collecting was my existence as a child, and I think my parents would have carried on alongside the endeavor everlastingly if they could have.

But whenever I was concerning 13, eBay came around, and the industry entirely changed.

They put the collectibles in retention units for years

Not marketing as much as they had previously, my parents decided to move home and put the gathering into storage units. It would be years before I always saw the gathering again.

Eight months ago, my mother called me — I live in Chicago now — and told me: "It's likely crazy, but if you could fig out a way to run a truck throughout the nation alongside this stuff, we would be consenting to part alongside what we have here."

I had mentioned to them that I would be curious in offering to buy the gathering if they were going to sell, but I didn't ideate that would be for a lengthy period (probably every). I knew it meant too much to them.

But whenever they offered, I jumped at the chance.

I had no idea what was in the boxes

In July, I flew to Massachusetts alongside my family and loaded up a 26-foot truck alongside boxes from three huge retention units. I had no idea what was in the boxes. I genuinely didn't think we would get everything in the truck — there was so much.

Then we drove 1,000 miles back to Chicago, unloaded the boxes into a retention unit, and, one by one, I've been unpacking all box.

Countless wind-up toys, models, Pokémon, robots, tin toys, dolls, act figures, and so much Disney. Everything from Batman to Cabbage Patch to ET to Star Wars, and lots of material from Japan in the 90s. Pop civilization everything.

I never cognize what's going to be in all box. I get amazed all time.

It's going to obtain me a extremely lengthy period to get through all box, but I don't awareness overwhelmed by the amount of material there is. I grew up about this stuff.

Collections are a way we put on display what we think is beautiful, what we are attracted to. It's close and individual — a way to nexus alongside ourselves, but afterward display that part of ourselves to the world.

I affection collecting.

Although I may not awareness overwhelmed by the sheer amount of material to kind through, I do awareness overwhelmed by a individual awareness of duty to create certain I don't discarded this opportunity. It's my family's history. Their life's work.

The contents of those retention units could have remained untouched, but instead, my parents gave them to me as an first inheritance. It's a chance to broaden our family former of collecting.

My parents used to call their endeavor Krim's World. I'm calling this endeavor Krim's Clubhouse in regard of their activity and this small cosmos of toys we've created and get to perform in.

More than ever, I'm in communication alongside my parents. My phone is complete of messages alongside the two of them — a changeless whirlwind of joyful energy and excitement as we detect what's inside.

I desire to interrupt a earth record

As a child, I was teased by another kids whenever I told them we had the world's largest synthetic wind-up toy collection, since I didn't have evidence to rear up the claim.

I scheme to create the proof.

While I'm marketing off duplicates of the wind-up toys, I'm keeping at smallest one of all and attempting to get the gathering into the Guinness Book of World Records.

Seven-year-old me would have lived to attack this record, so I fair have to.

And maybe, following all these years, I'm eventually going to demonstrate that weird kid right.

More than 200 companies flocked to Texas in the final seven years, as Republicans in accusation of the Lone Star province advertised a business-friendly aura alongside lucrative company tax incentives.

On Wednesday morning, though, the CEOs of those companies woke up to an unprecedented blue wave whose crests reached profound into Texas, from the Rio Grande Valley to Dallas.

Democratic challenger Gina Hinojosa, a province delegate alongside a minimal national profile, defeated Gov. Greg Abbott, a notable Republican operating for a fourth term.

Hinojosa has signaled that she favors rolling rear several of the incentives that lured businesses to the state.

"I do think we should rub spotless company benefit in this state," she stated in an October discussion alongside Kut News, a Texas NPR affiliate.

On the national stage, Republican Senate applicant and Attorney General Ken Paxton suffered a stunning defeat to James Talerico, another province representative, by additional than a myriad votes.

The GOP managed to clasp onto the province senate, but results were motionless being tabulated on Wednesday for a fistful of rivalrous province home seats, according to the Associated Press.

While Hinojosa and Talerico gleefully bumped drinks at Whataburger on Tuesday night, business leaders were no doubt occupied contemplating whether the financial incentives that motivated their move would remain in place.

"I never expected Texas to rotate blue," Jason Calacanis, a tech entrepreneur and influencer, stated on X. "I moved current to get distant from the remaining lunacy!"

Texas levies no earnings taxes on personal individuals or corporations. Though the province charges a franchise tax on companies that article additional than $1 myriad in revenue, Abbott has signed bills expanding franchise tax exemptions. During her campaign, Hinojosa focused her criticism of tax incentives on data centers.

Here are several of the largest companies that moved their operations to Texas in latest years, according to a catalog compiled by Abbott's office.

• SpaceX
• Samsung Electronics America
• Six Flags Entertainment Corporation
• Devon Energy
• KFC Corporation
• Realtor.com
• Chevron
• Gordon Ramsay North America
• Lion Real Estate Group
• QSAM Biosciences Inc.
• Tesla
• X
• AESOM (Architecture, Engineering, Consulting, Operations, and Management)
• Charles Schwab
• Joe Rogan Experience
• European Wax Center
• Pabst Brewing Company
• Optym
• Oracle
• Cicero Institute
• 8VC

The "blunami" has arrive for the Senate.

Democrats have flipped seven Republican-held US Senate seats in the 2026 midterm elections so far, either by defeating incumbent Republican senators or winning races in which the sitting Republican legislator was not on the ballot.

It's a resounding victory for the gathering and a attack to President Donald Trump.

Democrats entered Election Day small assured concerning retaking the Senate than the House, but they ultimately flipped additional seats than they needed to acquire a majority, including in historically Republican strongholds like Texas and Kansas.

Two near Senate races in Mississippi and Alaska are motionless uncalled, but the new divided puts Democrats alongside at smallest 54 seats in the Senate. The gathering additionally earned a bulk in the House of Representatives and volition authority the two chambers of Congress.

Here are the Senate seats that have flipped as of November 4, using ballot counts and preliminary win percentages from the Associated Press. We've additionally included House and governorship flips to display how the states fared in the broader election.

OpenAI CEO Sam Altman briefly gave himself a new name on X: "Ram Altman."

The alter followed a gag concerning his appetite for device recollection following latest arguable comments on how the much-desired recollection is allocated.

Responding to an Altman article concerning group retaining authority complete AI’s future, an X person wrote "sam arrive current arrive here" alongside an depiction of multiple recollection chips foremost toward a cardboard box propped up akin a trap.

Altman replied, "i lol’d."

When another person asked whether he could rename his document "Ram Altman,” he answered, "OK yeah" — and did.

The alter was short-lived. By 11 a.m. ET on Wednesday, the CEO's name had reverted to "Sam Altman" on his X profile.

It was unclear why he changed it rear and OpenAI declined to comment whenever contacted by Business Insider.

Altman's gag landed following latest remarks concerning the world’s limited provision of DRAM, a category of recollection that is key to the two individual computing and the GPUs that power AI data centers.

On an October 29 event of the "Cheeky Pint" podcast, he asserted that operating AI models on individual computers could depart scarce recollection underused. In a market anywhere provision is tight, he said, cloud data centers can use it additional intensively.

The comments drew criticism from several group who took them to average consumers should have small admission to recollection so data centers could have more.

Elon Musk, who has feuded alongside Altman for years, weighed in on Sunday, posting a meme on X alongside the caption: "The group deserve to have their RAM too!"

Altman used the X toggle to shove rear on the topic.

He stated he wants the earth to have "tons of memory" and for group to put as much as they desire in their computers.

He added that he has lengthy asserted for expanding recollection manufacturing and was annoyed that his remarks had been taken out of context.

When another person asked why he wanted their RAM, Altman replied: "I desire you to have so much ram let's build more."

Altman’s clarification points to the billion-dollar inquiry below it: how to encounter petition for recollection in the two data centers and individual computers.

His answer, at smallest on X, was to create additional of it.

Roy Rinberg (Anthropic), Alex Allain (Anthropic); Alessandro Chiesa (EPFL, StarkWare), Miranda Christ (MIT, RESI), Rahul Dalal (Anthropic STEM Fellows Program, Succinct), Giacomo Fenzi (EPFL), Ben Mayer (Anthropic Fellows Program, MIT), Guy Weissenberg (EPFL)

Executive summary

When you conversation to a companion in person, you have many ways to cognize it is really them: you can see them, comprehend them, tremble their hand. When you conversation to an AI model, you have nearly none. A person querying a example today cannot inspect that the responses came from the particular example that a developer claims is responding, as opposed to one secretly substituted in by a routing assistance for disbursal reasons, or equal by an attacker who has tampered alongside the token stream. Judging from the model’s output solitary is unreliable, equal if it produces high-quality responses. Cryptographic proofs of conclusion resolve this problem: they let a example provider commit to a example and afterward demonstrate that all reply was produced by that model. Such proofs could allow applications ranging from person products to inner security, and could contribute to a toolkit for verifying compliance alongside AI pacing requirements.

Specifically, we have made advancement on a mighty category of cryptographic evidence known as a “zkSNARK”, which is uniquely fit for provable inference (owing to its powerful hiding and effectiveness properties). In this post, we portion several of that progress, chiefly through a scheme we call FlashProve. A concise specialized summary is as follows:

1. Claude has produced improvements on zkSNARKs for inference, construction a scheme that is substantially faster than previous open-source systems.
   1. For a ample example (Llama 4 Maverick, 400B-parameter blend of experts), a sole H100 GPU generates proofs at about 110 tokens/second, alongside a evidence size of ~19 MB per 1,024-token request, whenever in 4-bit quantized weights, using entire figure arithmetic in prefill. This is ~70-95x the GPU period of operating the example itself on vLLM, a average open-source library.
   2. Prior open-source systems are orders of dimension slower, as we conversation in section 6. Claude established novel ways to use state-of-the-art tools in the cryptography and safety literature, during relying on well-established scheme principles for cryptographic evidence systems. The dedication to the model, and consequent conclusion proofs, conceal the weights of the model; hiding the architecture of the example is not a goal of this system.
2. Claude is fine at optimization, but frequently makes decisions that are difficult to evaluate, particularly in ample complex systems. We oppose this by providing top-level auditable statements in Lean (a ceremonial verification language) for the claimed safety guarantees.

Today we are releasing five artifacts:

• The current blog post, which outlines our scheme and its possible applications;
• A technical report explaining the particulars of our system;
• A (Claude-written) protocol specification document;
• Executable code that includes: a prover and two verifiers, a fast verifier in C++, and a provably accurate verifier in Lean; and
• Lean proofs for the top flat mathematical statements, alongside alongside an interactive visualizer of the Lean theorems to aid alongside auditing.

We publish our code, Lean proofs, and records under the Apache 2.0 license. This investigation article is meant to portion intermediate progress, and not a completed investigation agenda. We are sharing this explicitly alongside the goal that others appearance at what we have done, obtain it, and enhance it.

Introduction

When a person sends a petition to an AI model, today they have no way of knowing for certain that the example they selected is the one that generated the response. For mundane uses, in which users mostly attention concerning the output and not necessarily which particular example produced it, this is a small pressing concern. But there are multiple cases anywhere specified assurance would be useful. For example, autonomous evaluators who test AI models before and following publish need to cognize that the example they are evaluating is the example being served. Clients who use a example through a third-party routing assistance desire assurance that the tokens came from the example they paid for. And if a cyberattacker modifies the token stream during pretending to be a stated model, a person has no way to detect it from the output alone.

However, enabling verification of example responses is challenging. Most frontier models’ weights are kept private, and equal if the person had admission to the weights, checking that a stated reply was produced by a example alongside those weights would affect operating the model, which requires computational resources far beyond what a representative person (or equal evaluator) can afford.

The goal of provable inference (PI) is to allow a person alongside constricted computational resources and without any data concerning the weights to verify that a reply came from the requested model. PI is motivated the two by a desire to addition client rely in AI providers, and—because it can be used to provision assurances to autonomous evaluators and allows providers to display that they are gathering certain commitments and lawful obligations—it additionally has implications for pacing the frontier of AI betterment and for AI regulation.

One way to execute PI is via a cryptographic entity called a zero-knowledge succinct argument: the example provider sends, alongside alongside the claimed response, a abbreviated proof (say, a few megabytes) that the person can quickly verify (ideally, in seconds on a CPU). If the claimed reply deviates from the stated model, the user’s inspect volition fail. Importantly, cryptographic techniques justify that the evidence reveals nothing concerning the model’s weights.

Today, we publish FlashProve: an open-source performant prototype for provable inference. For a 400B-parameter mixture-of-experts example (Llama 4 Maverick, 4-bit quantization), we display that a sole H100 GPU generates proofs at complete 100 tokens/second, alongside evidence size of ~19 MB per 1,024-token petition (~70-95 times the GPU period that vLLM, a average open-source library, takes to procedure prompts of the identical length).

The publish comes alongside executable code, Lean formalization, and a specialized clarification of the protocol. Our aim is twofold: (i) accelerating and facilitating the betterment of provable inference; and (ii) demonstrating that zero-knowledge succinct arguments are applicable for provable inference.

We accept that this advancement has meaningful implications for security, in pacing AI development, in providing AI customers alongside integrity guarantees, in facilitating tooling for auditors and regulators, and more.

Trust challenges in AI proliferation

The betterment of synthetic intellect and its expanding function in our digital infrastructure and economics raises trust challenges that AI providers must answer. Addressing these and another challenges is facilitated by relying on tools for provable conclusion (PI).

Tools for PI contain hardware approaches, application approaches, or a blend of both. Here, we concentration on a software-only approach: a cryptographic tool known as a “zkSNARK” (zero-knowledge succinct disagreement of knowledge). Informally, a zkSNARK is a scheme allowing a prover to convince a verifier, by way of a abbreviated “certificate”, that a stated computation was executed correctly; crucially, the certificate is zero-knowledge in that it reveals no data beyond what is implied by the computation’s correctness and is succinct in that it’s exponentially faster to verify compared to the proved computation.

Below we outline multiple challenges and how zkSNARKs assistance in addressing them.

Challenge 1: pacing

Some proposals to regulate and pace AI betterment depend on monitoring hardware and how it is used. For example, a provider power be required to devote its hardware to inference fairly than to training a mighty new model. The provider power try to cheat by serving cheaper models or using compute in an unexpected way, freeing up resources for training. How can a regulator reliably justify that the hardware is used for inference?

How zkSNARKs can help: The regulator can ask the provider for certificates covering the conclusion requests served in a stated period. The certificates must display that the requests were generated by the claimed model. A malicious provider cannot fulfill this petition unless its hardware was genuinely serving the correct model. Using a zkSNARK, the regulator can inspect that the provider claims are valid without needing the detailed hardware setup that the provider may have, and at the identical period the provider has the justify that the regulator does not study proprietary example information. We note that although this verifies that the hardware is serving inference, it does not established that the hardware is not, e.g., training on the side.

Challenge 2: tamper detection

As AI models develop additional valuable, the servers that run them rotate into prime targets. An attacker or rogue delegate may compromise an conclusion server to exfiltrate the weights, assist users malicious responses (such as delivering malware to the user’s computer), and more, all during hiding among genuine responses. The adversary need not be external. As models rotate into capable of improving and deploying themselves, a additional advanced example could run in location of the one that was authorized and current itself as the weaker model, so as to evade the classifiers and monitoring that would use to it. In the two cases the inquiry is the same: how can a business be certain of which weights are really operating on its servers? In our Frontier Safety Roadmap, Anthropic set a public goal to create a prototype for verifying conclusion traffic: “We volition create a prototype by September 30, 2026 of provable inference, a method for reliably, provably ‘signing’ AI example outputs in a way that makes them attributable to a particular set of example weights.” As stated in our RSP updates, we met that goal through a distinct but connected project, which signs our conclusion traffic and recomputes conclusion on a trusted server; the activity in this blog article pursues the identical goal by a distinct method.

How zkSNARKs can help: The provider can necessitate a valid zkSNARK from the server on all response. A evidence is border to a particular dedication to the weights, so it certifies not fair that some example produced the reply but that the committed example did. An attacker who compromises a server, or a example that substitutes itself for another, must afterward create valid proofs for the expected weights to evade detection, which they cannot do. The person may obtain the proofs as well, since they leak no inner data (by zero knowledge) and are cheap to inspect (by succinctness); this limits what an attacker can accomplish through the conclusion API.

Challenge 3: content provenance

One may desire to demonstrate that significant attempt went into understanding/analyzing something. For example, a developer power assertion that their application archive was scanned for vulnerabilities by a frontier cybersecurity model, or a business power assertion that its endeavor scheme was stated the go-ahead by an suitable model. How can a person verify these claims? The person power not have the resources to run the example itself (or they power not have the clearance to do so). Even publishing the conversation logs gives no complete guarantees; a developer power in theory counterfeit them, generating them not alongside a frontier example but alternatively alongside a cheaper one or a degraded version. In general, how can users verify that they are being served by their chosen model?

How zkSNARKs can help: The provider can append, alongside alongside all response, a zkSNARK proving that the output was produced by the claimed example on the stated input. Succinctness lets the person inspect this certificate quickly, without specialized hardware, and zero-knowledge assures the provider that the person learns nothing concerning the proprietary weights. This complements existing mechanisms for verifying which example produced a response.

For example, in a earth anywhere exploits are being established regularly, previous to releasing new code a example provider could provision the code-developer a Proof-of-Failure that the model-provider spent at smallest X tokens on a particular model, and did not accomplish a particular outcome (for example, this particular example did not discover any bugs in a particular patch, following trying for at smallest 1M tokens).

Challenge 4: example approval

Regulation power necessitate providers to serve lone models approved as safe, fairly than models deemed a cybersecurity or safety risk. A provider power have an incentive to circumvent this, since risky models power outperform competitors or be cheaper to serve. How can a regulator justify that only approved models are served?

How zkSNARKs can help: The regulator can necessitate the provider to nexus a zkSNARK to its responses, enforcing the use of approved models. The evidence binds all petition to the used model, so it volition not verify if the provider is using an unapproved model. The regulator can inspect this in a lightweight way gratitude to succinctness without requiring to re-execute all request.

A note on PI from trusted hardware. Prior activity frequently focuses on trusted implementation environments to accomplish PI. These are hardware-based solutions that provision privacy and attestation that depend on the manufacturer producing tamper-resistant hardware. In this research, our concentration is on software-only cryptographic solutions whose safety and privacy relies on the hardness of computational problems. Even in the visage of compromised environments (hardware, functioning scheme and more) an adversary cannot create a invalid evidence without breaking a computationally infeasible problem. Trusted hardware and cryptography are complementary approaches alongside distinct guarantees and tradeoffs. Both volition perform a function in addressing the complete rely challenges.

Our system: FlashProve

FlashProve is a scheme for provable conclusion of ample Mixture-of-Experts (MoE) tongue models. More particulars are in our technical report; current we outline the system.

FlashProve involves two parties: the example provider (the prover) and a person (the verifier). It is divided into two phases:

• In the offline phase, the prover publishes a commitment to the example weights, which is a abbreviated fingerprint to pin downward one exact choice of weights during the weights themselves remain hidden. The afterward conclusion claims volition be checked against that commitment, i.e., the importance example committed to in this phase.
• In the online phase, upon requests from the verifier (i.e., prompts and the corresponding output tokens), the prover produces a evidence document proving the following statement:

The committed example produces these output tokens whenever evaluated.

Anyone who holds the commitment, the prompt, and the answer can inspect it, without the weights and alongside constricted compute power, and be convinced that the committed weights, run on this prompt, create exactly these tokens.

Guarantees

A evidence document satisfies the following “completeness” and “soundness” properties:

• A evidence document is accepted if it is honest (completeness). An honest prover's evidence is accepted by the verifier.
• A evidence document cannot be forged (soundness). It is efficiently unattainable (i.e., tantamount to breaking extensively believed cryptographic assumptions) to create a valid evidence of a false statement, so the verifier does not have to rely the prover.

Completeness and soundness solitary can be achieved by a computationally mighty verifier that knows the example weights (evaluate the example on the immediate and inspect whether the outcome matches the response). The next two properties are what makes the scheme non-trivial.

• A evidence document reveals nothing beyond the declaration (zero-knowledge). The verifier learns nothing concerning the weights, the intermediate values of the computation, or which experts ran at all layer. The example architecture (excluding the weights) is not hidden.
• A evidence document is small and cheap to inspect (succinctness). The attested computation is a run of a 400B-parameter (about 232 GB for a quantized version) example on an H100 GPU, during the verifier receives a evidence document of concerning 19 MB that takes seconds to inspect on a 24-core CPU. An auditor, or a person alongside far small hardware than the provider, can inspect evidence records without admission to detailed infrastructure.

Evaluation

We measured an implementation of the protocol on Llama 4 Maverick (a 400B-parameter blend of experts, alongside ~17B parameters used per token), using the publically accessible 4-bit weights. Each verifier petition is a opening of 1,024 tokens, and all evidence checks one token. The prover runs on a server alongside a sole H100 and 24 CPU cores, and the verifier on a CPU.

• Prover. The prover runs on a server alongside a sole H100 and 24 CPU cores. The offline phase runs formerly per example and takes concerning 39 minutes. (For specialized reasons we conversation in the technical report, the resulting dedication is fine for concerning 16 myriad requests, following which the provider has to commit again.) The online phase, on a lot of 24 requests, takes the prover concerning 223 seconds, which is 110 tokens per second, and all evidence is 18.78 MB.
• Verifier. The verifier runs on the client's CPU. It needs no GPU and lone has admission to a dedication to the weights. The client downloads the commitment, ~6.5 MB in all, and afterward one evidence per request. Checking a evidence takes 17 seconds on 24 threads (and 21 seconds on a sole thread), including the offline phase's checks.

Comparison alongside plain inference: We ran vLLM, a extensively used conclusion engine, alongside the FP8 publish of the identical example on eight H100s, and established that, per GPU, proving a lot of 24 requests takes concerning 72 times longer than vLLM takes to procedure the identical 24 requests at formerly (66 to 77 throughout runs), and concerning 94 times longer whenever vLLM runs at the highest burden we tried.

Inside the system. The underlying scheme rearward FlashProve is a zkSNARK of the benevolent deployed in peer-to-peer systems (e.g., L2 networks specified as Starknet or Mantle for blockchains akin Ethereum). Our zkSNARK is built according to a well-established recipe: an underlying information-theoretic entity called an interactive oracle proof (IOP) is compiled into a cryptographic evidence by relying on hash functions (and offers equal post-quantum security). Our IOP is assembled from state-of-the-art construction blocks using tools specified as code proximity tests alongside linear constraints and lookup arguments, which are according to techniques from coding theory and complexity theory. Combining these pieces into a bespoke IOP for conclusion is a susceptible task; additional particulars concerning the building can be established in the specialized report.

Engineering the system

FlashProve benefits from architectural decisions that we took, and which are discussed in item in the technical report. Here we emphasize a few:

• The prover's activity is proportional to the experts that really ran. In a MoE example a token uses ~17B of the 400B parameters, and the prover's activity per token is proportional to those ~17B alternatively of all parameters (the evidence motionless hides which experts were chosen).
• Requests are proved in batches, following the fact. The prover says completed content in one parallel continue (as in prefill), and it opens the dedication to the weights formerly per lot alternatively of formerly per request.
• The scheme is designed to fit on a sole GPU. The example weights at all tier are divided to segments and are proven one section of layers at a time. The weights are kept in average recollection and streamed in, so a sole 80 GB GPU, alongside ~290 GB of presenter recollection beside it, suffices.

Post-hoc versus in-line

When integrating proving mechanisms into conclusion servers there is a choice: in-line proving (i.e. proving alongside the inference) versus post-hoc proving (i.e. proving after-the-fact, for a subset of tokens). Our scheme follows the latter. In-line solutions are expected to be ultra-fast and may sacrifice safety for efficiency, whereas post-hoc solutions are allowed to be slower and may not endure specified a tradeoff. On the another hand, post-hoc proving has limitations: added complexity of recomputation, the postpone in getting guarantees concerning your traffic, and inherent “non-determinism”. We detailed on the motivation and implications of post-hoc proving in the technical report.

Trustworthiness from ceremonial verification

Cryptographic code is notoriously brittle and error-prone. How can users rely the code we’re releasing today?

The answer is formal verification: we use the Lean evidence aide to define the protocol and the desired safety properties. We demonstrate these properties in a form that is machine-checkable and guaranteed to be accurate (up to compiler errors). We mark three top-level properties:

1. Completeness: if the declaration is correct, the resulting evidence is accepted by the verifier.
2. Soundness: any counterfeit evidence is rejected by the verifier (except alongside negligible probability).
3. Zero knowledge: the evidence reveals no data concerning the weights of the model, beyond what the verifier can infer from the reply itself.

These properties are stated in the so-called random oracle model, an information-theoretic way to analyze cryptographic protocols that depend on hash functions.

Formal verification leaves two crucial rely gaps. First, the ceremonial statements must be audited to justify that they equivalent their intent. This have to be done manually (though it is dramatically small onerous than auditing proofs); we provision an interactive visualizer to assistance alongside this.

Second, the executable code must be audited to justify it matches the formally-defined protocol for which the safety properties are proven. How to finest assistance alongside this depends on the property, since soundness depends solely on the verifier, zero-knowledge depends solely on the prover, and completeness depends on their interaction.

• For soundness, we lone need the verifier code to be accurate (the complete value of having “proofs” is that you can completely distrust the prover if you rely the verifier). We provision an executable Lean verifier, alongside the C++ verifier. The Lean verifier runs additional slowly, but Lean proves that it accepts lone what the verifier in our soundness theorem accepts. Nevertheless, the C++ verifier is the one to use day to day: it carries no ceremonial guarantee, and it agrees alongside the Lean verifier on all evidence in our tests.
• For completeness, the danger example does not assume adversarial attacks (the prover and verifier are honest). Therefore, a Lean verifier lets us acquire confidence through norm application evaluation that the honest prover produces accepting proofs: run the prover on a accurate statement, and afterward the Lean verifier on the resulting proof.
• For zero knowledge, we lone need the prover to be correct. However, dissimilar the verifier, the prover is an costly procedure, and it would be impractical to run a Lean prover. We do not provision facilitations here: we anticipate that any prover that wants to conceal the weights of a example they are serving has admission to adequate resources for careful agentic and/or individual safety audits to justify equivalence to the Lean prover.

Prior work

Achieving provable conclusion is the goal of a row of activity colloquially termed “zkML”. Early works, specified as SafetyNets (2017) verified a two-conv-layer MNIST CNN and a small completely connected address model, zkCNN (2021) reached VGG-16 (15M parameters) at 88.3 s per proof, and Kang et al. (2022) proved MobileNet v2 on full-resolution ImageNet.

Transformer proofs followed: ZKML’s GPT-2 took concerning 159 s per token for 117M parameters (≈0.006 tok/s), and Modulus Labs’ 1.5B-parameter GPT-2 XL needed complete 90 hours. EZKL (2023) proved a 1M-parameter GPT-style transformer in concerning 966 s per token (≈0.001 tok/s). Performance increasingly improved: zkLLM (2024) proved LLaMA-2-13B on a 2,048-token input in concerning 15 minutes on GPU, which is ≈0.001 tok/s per new token, or ~2.5 tok/s in the batch. In 2025, zkGPT reduced GPT-2 to 21.8 s (≈0.05 tok/s), zkPyTorch proved Llama-3 8B at ~150 s per token on one CPU center (≈0.007 tok/s), and ZKTorch proved GPT-J (6B) in concerning 20 minutes (≈0.001 tok/s). VerInf proved Llama 4 Maverick (the identical 400B-parameter MoE example we prove) at ≈0.02 tok/s. DeepProve, a current peer-reviewed province of the art, certifies an complete generated sequence alongside a sole onward pass. It reaches concerning 2.9 tok/s for GPT-2 and 1.4 tok/s for Gemma 3 on one machine, and 31 tok/s distributed. SASH's prover (2026) reached ≈1.25 tok/s on Llama 3.1 8B on a sole H100.

Recently business efforts have reached notable numbers, alongside Attestable proving Gemma 4 31B at 53–77 tok/s on a sole H100; at the period of writing, Attestable has not released a corresponding open origin library.

The complete numbers conversation to the precipitous advancement of provable conclusion in the former years. They should update our priors on what it is imaginable to demonstrate in zero-knowledge.

• In 2024, zkLLM proved a 13B example at concerning 2.5 tokens/second on one A100. The lone before evidence of Llama 4 Maverick that we cognize of, VerInf, reports 14.3 hours for 1,000 tokens on a DGX Spark, alongside a 93.6 GB evidence which took nearly a day to verify.
• FlashProve proves the identical example at 110 tokens/second on a sole H100, alongside 19 MB proofs that can be verified in seconds. Attestable independently reports 53–77 tokens/second for a compact 31B model.

We accept that the advancement should transfer to additional models and architectures, yielding a elastic and mighty tool alongside overhead complete native computation of approximately 2 orders of dimension (about 70 to 95 times in our measurements), much small than earlier expected.

Limitations

This publish is a investigation prototype, and has the following specialized limitations:

• No ceremonial guarantees on accelerated executable code. We provision a Lean implementation of the protocol (including an executable “slow” Lean verifier), alongside alongside safety properties proved in Lean. The document and the accelerated executable code are derived from the Lean protocol, but we do not justify that all three (Lean, paper, code) equivalent all other.
• The evidence is concerning an entire figure example under greedy decoding. We demonstrate an exact entire figure type of the published weights, and a evidence asserts that all checked token is that model’s greedy choice. A answer from a floating-point implementation, or sampled decoding, could depart at several stance and no longer exactly equivalent the computation proved. The entire figure type is mostly expected and empirically tested to be inside several small error charge of true floating-point conclusion generically (even taking into document non-determinism of floating-point computations), although this does not shield adversarially designed prompts.
• Architecture hiding. Our scheme assumes the served example uses a Mixture-of-Experts (MoE) architecture, in which all transformer layer’s feed-forward obstacle is replaced by multiple expert sub-networks and a router that activates lone a small subset of experts for all token and our scheme uses the MoE construction for effectiveness gains. Other architectures, specified as the compact models, are additionally extensively used and its clarification may merge intellectual-property the example provider would akin to keep secret. Indeed, one could additionally ideate a scheme that additional hides the architecture of the model: the prover commits to the two the weights and the architecture (i.e., the “executable code” for inference) via a hiding dedication and the verifier’s assertion is concerning checking the implementation of that committed executable on the dedication model.
• Side conduit attacks. The current justify of the protocol is that the evidence itself reveals nothing concerning the weights of the committed model. However, “side conduit attacks”, specified as measuring the period it takes to create a proof, could possibly disclose data concerning the weights. We regard this out of range for this release.
• Longer contexts. The scheme currently proves conclusion complete contexts of up to 1,024 tokens. This is fairly abbreviated in difference to the contexts accumulated in conversation settings. Ideally, this environment dimension could be risen to complete environment windows for frontier models (which regularly have environment windows of 100s of thousands to millions of tokens).

Nintendo is concerning to endure a important recollection provider for its Switch cartridges. The supplier, Macronix, announced during a latest quarterly earnings call that it would be gradually phasing out ROM manufacturing and is alternatively focusing on NOR flash recollection for data centers, Taipei Times reports.

Macronix’s ROM income cut 39 percent compared alongside final twelvemonth in Q3 2026, but its income from NOR recollection rosy 158 percent, and its income from NAND recollection surged 768 percent twelvemonth complete year. According to Taipei Times, Macronix chairman and CEO Miin Wu stated during its Q3 2026 earnings call that “demand for NOR used in data centers is extremely robust. Customers are chasing us for additional capacity, demanding that we provision additional NOR flash solutions for data centers.” The business additionally reportedly “expects part cost hikes to persist.”

Although Sony has announced a scheme to halt manufacturing of bodily equivalent discs starting in January 2028, Nintendo remains committed to bodily games, saying lately that it has “no plans” to ditch them. Physical games additionally remain a bigger part of Nintendo’s revenue than another gaming companies; Nintendo stated in August that bodily titles accounted for 38.5 percent of its games sales, which is higher than companies akin Capcom.

Macronix’s exit from the ROM endeavor comes nearly a twelvemonth following Micron close downward Crucial, its person RAM and SSD brand, to rotate its notice to gathering AI data center demand.

It is imaginable now to reliably and automatically detect and fix all bug which users are encountering on the web.  This plainly hasn’t happened yet.  Our goal at Replay is to bring it about.

A few ingredients are needed:

1. A contemporary coding agent
2. Observability to see all bug
3. Observability to base logic all bug
4. A harness wiring these together

The correct observability is key to this process, as it is mostly to the AI powered SDLC.

Agents need environment to thrive, and observability is the environment tier for agents to cognize how the app they are construction really behaves.  When they don’t really cognize what is going on, they commencement guessing, create mistakes, and things go downhill quickly.  When they do know, they can verify theories concerning the app’s behavior and remain on track.

Better observability drives improved results.

Perfect Observability

Replay’s center innovation is a period journey debugger for Chromium and Node.js.  Forked versions of these runtimes grasp non-deterministic inputs to the runtimes alongside low overhead, allowing the runtime to be replayed deterministically.  Everything it did during record can be restored and unpacked into what is basically a database, allowing agents to see all declaration that was executed, the province at all point, all authority and data dependency, and so on, alongside no defeat of detail.

A period journey debugger provides ideal observability: all inquiry concerning how the app behaved can be answered.  With one in hand, agents never need to guess.  They can fig out exactly what happened, activity their way rear to the genuine base logic of a problem, and create the correct fix.

Replay QA

We launched Replay QA a few months ago as a autumn in tool for finding and explaining all bug in an app, construction on our debugger.  QA explores and tests apps on its own or alongside guidance, and alongside new oneself care capabilities can create recordings by reproducing person sessions from partial and redacted data.  It processes the recordings it creates to place a broad assortment of bugs (from damaged features to glitches, achievement issues, safety holes and so on) and for all bug identifies the base logic and supports its inspection alongside evidence drawn from the recording.

QA can additionally fix itself.  Its complete backend is recorded, and whenever problems are detected (failures to place a bug or base logic it accurately) those problems are debugged, fixed, and converted to a durable test case by a application factory.

As an test we ran QA on 40 apps that have won contests or alternatively been promoted by important app construction tools (Lovable, Replit, Base44, Bolt.new, etc).  We had Astra verify and deduplicate findings and ended up alongside complete 900 bugs, alongside the allocation below.

Example: deceased button

For difference we ran another QA tools on several of these apps.  Below is a bug study from QA Wolf on among the apps, CallVance.  A download clasp doesn’t work.  QA Wolf identifies and generates STR for the bug, but does not explain at all what is causing it.

An delegate addressing this bug study has to peruse the code and conjecture what the base logic is.  If it guesses incorrect it volition have to go through multiple repair cycles and power end up stuck and unable to fix the problem.

These problems are not particular to CallVance or QA Wolf.  The products of app construction tools are loaded alongside bugs, and QA’ing them without using a period journey debugger can lone provision constricted data concerning the causes.  Surface flat observations from observing display recordings or looking at network and console logs can sometimes propose a cause, but can’t acknowledge it definitively, and the delegate is continually remaining guessing.

Below is a study from Replay QA for the identical deceased button.

Replay QA identifies the exact problem: a missing onClick handler on the React component.  QA identified the rendering function connected alongside the button, and produced evidence showing that function and the missing handler.  An delegate reviewing this study can cross inspect the base logic against the evidence, and fix the bug itself without guessing.

Example: layout shift

The method complete applies fair as fine to additional complex bugs, including ones that are difficult to place without record based analysis.  Below is a layout change in the identical CallVance app.  While the app loads, a skeleton changes size and another controls on the leaf change about on their own, impacting usability.

Below is the base logic from the report.

This study is additional extended and describes the base logic of the layout change in citation to all the contributing factors, including the distinct React commits, the network requests made in between, and changeable values in the component render functions.  This detailed study provides an delegate exactly what it needs to fix the layout change properly.

What’s Next

Replay QA is mostly accessible and liberated to try today.  It’s uncomplicated to set up integrations including oneself care person meeting analysis, github and delegate connections, and scheduled runs to keep a near observe on your app according to your needs.  We are continually improving QA and are operating on incorporating backend record generation and inspection additional deeply for complete stack period journey debugging.

QA is additionally accessible to use via API to create recordings and analyze them for bugs.  Contact us if you’re curious in integrating its capabilities immediately into a merchandise you’re building.

Elon Musk posted a uncomplicated Election Day communication Tuesday: "Vote red today!"

Americans mostly didn't prosecute his advice. Then, it seems, he deleted the post.

On Wednesday, hours following Democrats surged to tsunami-like wins in the midterm elections, that Musk plea to ballot for Republicans disappeared from his X timeline.

Musk didn't immediately react to Business Insider's questions concerning why the "vote red" article was removed.

Early on Wednesday, as the results became clear, he appeared to change scheme and joked on X concerning his failed midterm spending approach.

"Guess my election-interfering area lasers didn't activity this time," he wrote. In a distinct post, he said, "Data centers in area looking beautiful appealing correct now."

The SpaceX CEO was the largest sole contributor during this midterms cycle, spending additional than $440 myriad to rear Republican candidates. He additionally used X as a phase to deride Democratic opponents.

Texas, anywhere Musk has reincorporated the two SpaceX and Tesla, was a particular focus. He spent $224 myriad to rear Texas Republicans during the race, per The New York Times, and, on X, called the Democratic now-Senator-elect, James Talarico, a "far extreme leftist," a "creep," and "pure evil." Those posts are motionless live as of the period of publishing.

The midterms could have important regulatory, contracting, and guideline implications for Musk — and shares of the two Tesla and SpaceX slumped on Wednesday as investors digested the ballot results. Data center companies are additionally flashing red.

Musk is not the lone Silicon Valley-to-Texas tech bro handling the downfall of a longtime Republican stronghold. Some "All-In" podcast hosts and Texas-based AI executives have started publically mourning the midterm results.

At Sequoia Capital, London is out, and the Great Flattening is in.

The Silicon Valley VC resolute said Wednesday it has made inner changes to undo a administration ranking that had "crept complete into the investing team."

The shake-up additionally includes the closure of its London agency and sunsetting its lot accelerator and Scouts programs, Sequoia wrote in a Wednesday article on X.

The London closure method several workforce are leaving Sequoia. The VC firm, which made early-stage bets on companies specified as Apple, Google, and Nvidia, stated it can assistance European founders and startups from its Bay Area headquarters.

The overhaul marks the ongoing alter of the defender at Sequoia. In delayed 2025, Alfred Lin and Pat Grady took on co-steward roles at the firm, as longtime partner Roelof Botha stepped down. By decision its London office, winding downward programs for first founders, and flattening its investing partnership, Sequoia is betting that a leaner construction volition assistance it twice downward on concentrated, founder-led decision-making.

In its post, Sequoia stated that a two-decade "expansionary phase" has required "real management" to run operations — but administration creep into the partner flank of the endeavor had rotate into an "unintended flank effect."

The VC resolute is additionally dropping its Monday partner gathering cycle, and stated that its goal of delivering the finest imaginable returns to constricted partners remains the same.

"We've made multiple inner changes that have the consequence of flattening the partnership,' the funding resolute said. "This allows all partner to flourish, and all originator to obtain the complete advantage of Team Sequoia - despite of who your guide partner happens to be.

Sequoia joins a lengthy catalog of companies including Meta, Amazon, Google, and Intel that have flattened administration layers in latest years. Companies have typically cited a desire to decrease bureaucracy.

In another cases, companies have cited AI whenever cutting rear on managers and flattening structures, including Coinbase and GitLab.

There have been way corrections. Earlier this year, Business Insider reported that Meta asked several workforce in its Applied AI division to become managers again.

Anker announced a new indoor safety camera that’s designed to observe your yard, driveway, or forefront veranda through a window, alternatively of monitoring what’s inner your home. The new Anker Eufy Window Camera E10 takes a akin method to the Wyze Window Cam that launched nearly a twelvemonth ago. It installs correct against a opening using an including mounting sticker to decrease glare and reflections, but the camera doesn’t necessitate any weatherproofing since it’s not enduring the elements outdoors.

The Eufy Window Camera E10 is accessible now for $79.99 through Anker’s online store and Amazon, making it additional than twice costly as the $34.98 Wyze Window Cam. But the E10 comes alongside a few helpful upgrades. Wyze’s camera is constricted to 1080p, during the E10 has a much higher maximum resolution of 2.5K, capturing additional detailed 15fps videos at 2,688 x 1,520.

The E10 additionally offers a slightly wider and taller site of perspective than Wyze’s camera at 105 degrees horizontal and 57 degrees vertical. But to modify a wider range of installations specified as an upstairs opening the viewpoint of the E10’s camera can be manually adjusted up and downward by 25 degrees using a rotor on the rear to justify the areas you desire monitored are correctly in frame.

Other features of the E10 contain color night vision, AI-powered motion finding and alerts that can differentiate between humans, animals, and vehicles, and a microphone that’s constricted to louder noises stated the camera’s location. Footage can be recorded locally to a microSD cardstock up to 256GB in size, or pushed to the haze alongside an optional subscription. And during Anker claims facility can obtain small than a minute, you volition have to agreement alongside possibly routing and hiding a power cord since the E10 lacks a rechargeable battery.

GoDaddy CEO Aman Bhutani has a strict regulation for himself whenever it comes to AI: He won't use AI to write. And he expects his workforce to prosecute suit.

"If person sends me a document and I can inform beautiful quickly it was written by AI, I don't peruse it," GoDaddy CEO Aman Bhutani told Business Insider. "Because if the individual couldn't obtain the period to compose it, afterward I certainly shouldn't obtain the period to peruse it."

Bhutani stated workforce can use AI to assistance them for things akin improved understanding a term or phrase, but that workforce are expected to be capable to convey their ideas in narratives that others can understand. This is an crucial accomplishment since it enables them to continue "practicing the art of iteration," or continuously getting better, he said.

"What I'm really looking for is: What was the first observation? What was the first hypothesis? What got you curious in this idea? Why do you think it matters? Right?" he said. "Because AI lone knows what the net already knows. It doesn't cognize what we cognize profound inner us, and there are ideas coming from us all the time."

Bhutani isn't the lone endeavor chief who has a issue alongside workforce using AI to do their writing.

Earlier this year, Varun Anand, the cofounder of AI revenue and promotion startup Clay, shared his company's AI penning policy on LinkedIn. The policy, which was written by an engineering employee Sophie Alpert, states that "Writing is thinking" and that workforce must be capable to explain all row that they write.

Figma CEO Dylan Field said in an X article in September that his institution requires workforce to add the disclosure "written alongside AI" if they use the tech during their penning process.

Bhutani stated there are a few signs that signify to him if item is written by AI. He stated that he plant alongside a varied collection of group and English is frequently not their archetypal language.

So if the tongue is a small bit too perfect, that can be a tell. Another clue for Bhutani is the dimension of the writing. He stated if item is too long, that can be a giveaway. And if it's short, it's frequently "punchy and clear," which can be another sign.

The midterms' blue tsunami was complete of surprises — and a lengthy catalog of historic firsts.

Democratic candidates for the US House, Senate, and governorships swept wins throughout the US on Tuesday night, including in many long-held Republican states akin Texas and South Carolina.

Four states elected their first-ever Black governors, and four additionally elected a female administrator for the archetypal time. In Georgia, it was both, alongside Keisha Lance Bottoms making former as the archetypal Black female elected administrator in any US state.

For the archetypal period in US history, five Black governors volition assist simultaneously, and at smallest 17 women volition assist as US province governors simultaneously.

While races in Alaska and Mississippi remain undecided, see the complete catalog of all historic win in the 2026 midterm elections so far.

Vakarė Simanaitytė, Hostinger’s Head of Content, used to be her own reminder system. “I felt I had to be on standby on Slack a lot,” she says, “to recall these things, prosecute up on threads, create certain nothing slips through the cracks. And a lot of things did in the end.”

So in October, she spent concerning an hr chatting alongside Claude and built her own AI agent, an aide that plant through her apps on a schedule, no code required. Today, the aide gathers the free ends from her meetings, Slack threads, email, and weekly notes into a sole Jira inbox, and she decides what happens to all one.

The aide gathers the free ends, but she set resolute limits: it never sends a message, never puts a project into her plan, and treats item unclear as a recommendation until she confirms it.

Why small promises kept slipping

The tasks that slipped were mostly small ones, akin item Vakarė stated she’d do on a call or a Slack thread she meant to arrive rear to. She had tried the customary fixes. “To-do lists, Trello, handwritten notes, all of it,” she says. “Nothing worked for a lengthy duration of period for me, since I would endure it.”

“In my role, I need to appearance following a lot of things,” she says. “Sometimes I’ll citation an idea, or person alternatively will, and I’ll assign it. But I motionless need to inspect in following several period that it’s done.”

Those tasks lived everywhere: several sat in gathering notes, several in Slack threads or email, and several in her retro, the abbreviated consideration she writes for herself at the end of all week. A few ended up on distinct to-do lists, and all period a new precedence landed, they slid additional down.

Holding all of it in her caput wasn’t free, either. “It additionally disbursal me a lot of mental energy,” she says.

Busy days made it worse. On a latest Monday, she spent the entire day penning a scheme document. “Usually this is the period I would have dropped my to-do things and fair forgotten them,” she says. Now her aide won’t let that happen: “It volition prompt me of things that I’ve dropped and things that I’ve forgotten.”

How she built her aide without penning code

Vakarė built the aide during a two-hour slot she and a coworker had set apart to examine AI. She already knew what she wanted. “I cognize anywhere my issue is, and I fair desire to fix it,” she remembers thinking.

Her archetypal halt was DEX, Hostinger’s inner AI assistant. But DEX lives in Slack, and she was trying to escape the noise, not add additional notifications to it. So she moved to Claude Cowork, Anthropic’s desktop app that can run tasks on a schedule.

Instead of sending her additional pings, Claude plant in the background: it collects everything she motionless needs to act on from her meetings, email, and Slack (with DEX’s help) into a sole project catalog that she checks whenever she’s ready.

She describes all job in plain language: what to check, what to do alongside the results, and whenever to run. The app afterward runs the job on that schedule, without her.

Next, she connected Claude to Google Calendar, Google Drive, Gmail, and Jira, the project tracker anywhere her to-dos now land. None of it requires code. The easiest way to nexus an app, she says, is to ask Claude to do it, afterward sign in and endorse access.

Her calls additionally depart written notes behind, which gives Claude improved material. She started alongside Gemini’s note-taking in Google Meet and afterward switched to Wispr Flow, which she finds better. She calls them the biggest aspect in quality: the additional meetings have them, the small the AI has to guess.

Slack was the tricky part. Claude isn’t connected to Hostinger’s Slack, so DEX motionless handles that part. At first, Vakarė copied DEX’s summaries into Claude by hand, until Claude suggested putting them in a Google Doc it could peruse on its own.

Every day at 5 p.m., a DEX workflow finds public-channel threads anywhere person mentioned her and she hasn’t replied, afterward writes a abbreviated study into a Google Doc. Each weekday at 8 a.m., Claude says that doc and turns item motionless open into a task.

So her two AI assistants never conversation to all other: they continue notes through a shared doc, akin coworkers who sit on distinct floors.

For Vakarė, the Slack study matters most. “That’s honestly the big thing,” she says. “It fair removed so much material from my head. It’s specified a lifesaver.” It additionally helps her gait her replies. Many mentions, she’s found, lone need a quick “thank you” or a thumbs-up, and the summary points those out. “You don’t need to interrupt your concentration to respond,” she says.

Three weeks in, her to-do scheme runs on scheduled jobs and a set of rules that create the aide additional trustworthy.

A week alongside Vakarė’s assistant

These are the jobs that nourish Vakarė’s to-do list:

Every hour, 9 a.m. to 6 p.m. The gathering job says the notes from all call and turns her next steps into Jira tasks, sized from 15 minutes to multiple days, alongside a nexus to the notes. If a call has no notes, it suggests a apt project according to the calendar event, akin leaving feedback following a hiring call.

Weekdays, 7:50 a.m. The freelancer answer job checks her email threads alongside freelance writers. When she owes a reply, it creates a project and a ready-to-edit Gmail draft.

Weekdays, 8 a.m. The dawn triage imports the Slack threads that need her, confirms or dismisses suggested tasks alongside a written reason, tags all one to her quarterly goals, and sends her a abbreviated summary: her top three for the day, quick wins, and what’s waiting on her.

Tuesdays and Thursdays. The follow-up inspect goes through everything she’s waiting on: who to nudge (with a outline message), what’s rear on her, and what to drop.

Wednesdays. The scheme assessment measures the setup itself, specified as how lengthy tasks delay and how many automatic decisions she reversed, and proposes up to three changes. She picks which ones to apply.

Fridays, 1 p.m. Retro prep gathers the facts for her weekly retro: what got done, anywhere the week went by goal, and what slipped. If a goal’s deadline is near and nothing has moved, it says so.

Then there’s Vakarė’s part. Every project the aide creates lands in one Jira inbox, a holding heap anywhere it waits until she decides anywhere it goes: her scheme for this week, a follow-up catalog for item anywhere the domain is in person else’s court, or a catalog of tasks to hand complete in her one-on-ones.

She meant to apparent that inbox all morning, but alongside calls frequently starting at 8:30 or 9, a regular routine never stuck. “I’m fair not that benevolent of person,” she says. Her “inbox bare by 9:30” mark unsuccessful all day, so she changed it to “cleared at smallest twice a week” and now sorts in bursts. As she puts it, “You have to be honest alongside yourself concerning the benevolent of individual you are.”

Six rules that keep the to-do catalog from turning into noise

Turning all citation into a project would fair toggle one disorder for another, so Vakarė’s fix was a abbreviated set of rules. “Without these, an automated to-do catalog quickly turns into noise,” she writes in her setup notes.

• One inbox. Nothing lands immediately in her plan, and formerly she moves a task, it’s hers.
• Suggest, don’t decide. Unclear tasks arrive in as “suggested.” The triage confirms or dismisses them alongside a written reason, so she can overrule it.
• Status says whose move it is. A project marked “Waiting on someone” method the domain is elsewhere. Anything alternatively on the follow-up catalog counts as hers.
• Make the next stage small. Every project comes alongside a size, a nexus to its source, and a outline Slack communication or email anywhere one is needed.
• Never send. The scheme drafts, labels, and reminds. Emails and messages go out lone whenever she sends them.
• Failures say so. If an import or study fails to run, the job creates a project alternatively of remaining silent.

Some of the rules came from the aide trying to do additional than Vakarė wanted. It kept offering to automatically kind new tasks into her weeks, and she kept saying no. “I desire this on me,” she says. “It’s my schedule.”

It additionally started moving follow-ups into her current week, and she kept moving them back. That alter was reverted quickly, and the scheme now asks her to decide formerly a project has bounced twice.

The drafts are motionless a activity in progress. “It’s fine for emails since it’s benevolent of formal, but for Slack, everything it suggests is a small bit too ceremonial for me,” Vakarė says. “But it’s motionless helpful.”

The “never send” regulation may audio akin a big limitation, but in custom it matches how agents behave in our own data: whenever we analyzed 213 myriad AI email actions in Agentic Mail, lone 2.5% engaged the delegate itself sending an email. The dense lifting is in the reading, and that’s the job Vakarė gave her assistant.

Some decisions remain off the assistant’s catalog entirely. One is what to drop, “which no automation volition do for me,” as Vakarė puts it. She additionally keeps one part of her week for herself: following the Friday job gathers what got done, she writes her own consideration on how she felt and how she showed up as a leader.

What changed, and what the aide motionless can’t do

When Vakarė shared her setup alongside the team, she estimated the aide was already preservation her “probably concerning an hr of activity all day and a lot of mental area to do the material that matters.”

The idea equal followed her home. “I’ve been tracking my budget, but I keep spending prosperity and I don’t cognize where. It fair slips through,” she says. “So I was like, ‘Okay, perchance I can build something.'” She didn’t desire her individual finances in her activity tools, so she rebuilt the identical form alongside a distinct AI aide and a Google Sheet.

Back at work, her aide motionless has limits, and Vakarė lists them as plainly as its features:

• The app has to remain open. In her setup, the jobs run lone during the Claude desktop app is open.
• Slack safety is partial. The DEX study covers the community channels DEX tracks, not personal channels, DMs, or collection DMs, so she motionless checks her DMs before logging off.
• The backlog keeps growing. Small, low-priority tasks heap up, so she’s thinking concerning splitting the backlog into next duration and next quarter.

“This evidently doesn’t substitute my customary Slack work,” she wrote whenever she shared the setup. “It fair helps me capture those free ends.”

What you need to build your own AI to-do assistant

Vakarė’s direction is to commencement smaller than she did: choice one source, akin gathering follow-ups, and one regular summary. Add Slack, follow-ups, and a weekly retro lone following sorting the inbox has rotate into a habit.

Here’s the minimum you need:

• A origin that already exists. Meeting notes are the easiest start, since the next steps are already written down.
• An AI tool that runs jobs on a schedule. The tool additionally needs to nexus to the apps anywhere your notes and tasks live.
• One location for tasks. Before Vakarė connected Jira, Claude suggested a Google Sheet, which is plentifulness for a lighter workload.
• A few rules from day one. Suggestions remain suggestions until you verify them; nothing gets deleted, and nothing gets sent without you.
• A sorting beat you’ll keep. Daily didn’t activity for Vakarė, but twice a week does. Pick the mark that matches how you really work.

Scheduled jobs are a paid characteristic in the two Claude and Hostinger Agent. The liberated type of the idea is to run the identical immediate yourself all dawn and paste the results into a Google Sheet.

What happened whenever our Content Team rebuilt the aide in Hostinger Agent

Vakarė’s setup leans on DEX, a tool built for Hostinger’s own teams. To see whether anyone could build this without it, our satisfied squad rebuilt the simplest type of her setup in Hostinger Agent.

Our type had three parts: a Google Doc containing gathering notes, a Google Sheet serving as the project list, and a operating job in Hostinger Agent that converts one into the other. Hostinger Agent connects to all app in her setup, and jobs need the Agent Plus plan.

Setting up the job took concerning six minutes of chat. A abbreviated guided setup asked what the job should do, which apps it may use, and whether it should run on a agenda or whenever item changes in an app. We picked lone Google Drive, Docs, and Sheets, leaving Gmail out so the job can’t contact email.

The Agent improved on our instructions. Before preservation the job, it changed our “never delete rows” regulation to “never delete or modify existing rows,” which is nearer to Vakarė’s regulation that a project is hers formerly she’s moved it.

We let the job run all 10 minutes for additional than two hours alongside the browser tab closed. All 15 runs completed, and all one took 21 to 80 seconds and used 3.5 to 9.7 credits.

The job added a new project we’d assigned to ourselves in the notes, kept a project assigned to the entire squad as a recommendation since no one was named, and never duplicated a row. When nothing had changed, the run summary stated so and remaining the panel alone.

We had to create a brace of adjustments. In our archetypal manual run, the summary listed a skipped item that didn’t be in the notes. Asking the Agent to citation the exact origin row fixed that, and the quotes held in the scheduled runs following that.

Later, the job re-added a project we’d deleted, and the new row stated “1h” alternatively of the “half day” it got the archetypal time. In Vakarė’s setup, a incorrect size akin that would get caught whenever she sorts her inbox.

We afterward switched the job to run whenever the notes doc changed, which the Agent had suggested during setup to evade bare runs that motionless disbursal credits. The archetypal triggered run came 14 minutes following our archetypal edit and picked up the two new tasks at once.

The uncomplicated type handled the center iteration on its own: notes became tasks, alongside no duplicates, and nothing happened whenever nothing changed. It motionless needed a individual check, which is the identical instruction as Vakarė’s rules. It additionally covers lone a piece of her system, alongside no Slack, Jira, triage, or follow-ups.

Vakarė already sees uses fine beyond her own inbox. “I’m beautiful certain I’m not the lone individual on the earth alongside 6,500 emails,” she says. Her idea: a job that checks an inbox all hr and pulls out what matters, akin client orders, complaints, or brands asking to collaborate.

As for her, she motionless spends her days in Slack – that’s part of the job, following all. But she’s no longer on standby, trying to clasp all commitment in her head. The free ends delay for her in one inbox until she’s prepared to do, chase, or autumn them.

“You can get status, you can get money. All of it’s recoverable,” Vakarė says. “The lone item that isn’t is time.”

Follow topics and authors from this narrative to see additional akin this in your personalized homepage nourish and to obtain email updates.

• David Imel

Russia is operating to addition the range of several ballistic and anti-ship missiles, giving the second a additional mighty warhead, according to a new appraisal from Ukraine's armed forces intellect agency.

The appraisal comes as Ukraine endures worsening Russian missile and drone attacks, during facing a deficit of interceptors and another air defence equipment to halt the deadly bombardments.

The agency, additionally known as the GUR, stated on Wednesday that Russia is evolving a modernized type of its 9M723 "Iskander-M," a tactical ballistic missile, alongside a projected range of 340 to 440 miles — approximately 100 farther than its predecessor.

The GUR stated in August that Russia had used an upgraded "Iskander-1000" missile for the archetypal period complete the summer. It was modified alongside a larger motor and launcher to addition its range.

Russia has additionally armed its 3M55 "Oniks" anti-ship missiles alongside larger warheads and risen their range "to enhance their effectiveness against dirt targets," the GUR said. It did not disclose specifics, but stated Moscow has produced dozens complete the former seven months.

Russia's defence ministry and its US embassy did not immediately react to a petition for comment on the GUR's assessment.

The appraisal comes as Russia has ramped up its missile and drone attacks in latest months. As winter draws near, strikes on Ukraine's crucial energy infrastructure in particular have civilians bracing for yet another ruthless stretch.

Complicating matters is Ukraine's perpetual deficit of interceptors needed to defend against the Russian attacks. Kyiv has often lobbied for its partners to transfer additional air defence missiles to shield cities from the bombardments.

On Monday, Russian strikes against Ukraine's southernmost Zaporizhzhia area killed at smallest 33 people, according to Ukrainian officials.

Meanwhile, the GUR stated Russia "maintains important stockpiles of long-range missile weapons and continues to addition its manufacturing rate, notwithstanding global sanctions."

Russian reserves contain up to 700 ballistic missiles and thousands of cruise missiles, the GUR said, adding that Moscow's defence industry is capable of producing additional than 200 of these weapons all month.

The inventory includes the Iskander-M and Oniks missiles, as fine as RM-48U missiles for the S-400 air defence system, the 3M22 "Zircon" anti-ship and land-attack missile, and 3M14 "Kalibr" cruise missiles.

The GUR stated "technical defects" — specifically, an matter firing from airplane — have been detected in the X-101 cruise missile that Russia frequently uses to assault Ukraine. "Consequently, several batches are being returned to factories for repairs," the agency said.

Manufacturing for the X-47M2 "Kinzhal" ballistic missile remains suspended since of accuracy issues, the GUR said, adding that the existing manufacturing capability has been redirected to another missiles.

When my hubby and I archetypal met, we were the two 23, complete of energy and big dreams.

I had fair graduated and was living in Barcelona, anywhere I was delivered and raised. He lived in Peñíscola, the seaside town in Spain anywhere I spent my vacations, a brace of hours away.

He had built a earth there complete of friends, family, and joy, and ran his own local business. As he afterward told me, he never imagined that item — or anyone — would alter his lifestyle.

It was mid-August whenever we archetypal kissed. What followed was an serious roller coaster of love. A small akin Sandy in "Grease," though, I felt our narrative wasn't going to end fair since summer did.

After courtship long-distance, we built a existence together in Barcelona

For the next nine months, we informed all the misunderstandings that arrive alongside a long-distance relationship, but we additionally missed all another deeply and visited all another whenever we could.

There were durable times — particularly whenever I remaining the nation altogether for a short-term job in California — but finally, in 2007, he got a location in Barcelona so that we could be together.

I was construction my reporting occupation in Barcelona, and creating a residence basis in the city felt essential. I wanted us to be together, but I wasn't prepared to depart the activity and opportunities I had there.

My husband's choice to depart his small Mediterranean hometown and laid-back manner for Barcelona — and get a new job current — was among the most generous things anyone's always done for me.

Every period we visited his family in Peñíscola, I could see how much he missed it. He would obtain in the salty air, hear to the waves, and regard the imposing, restored castle that overlooks the town.

We continued to build a existence together in Barcelona, and got wed in 2015. I knew that living current was poignant for him: As much as he loved our life, part of him motionless belonged to that small town by the sea.

Last year, we eventually managed to buy a small place of our own in Peñíscola. We sojourn approximately formerly a duration and expend most of the summer there.

It has rotate into our way of keeping one ft in the existence he gave up for me.

Now, I'm prepared to depart Barcelona

More recently, I've started craving adventure: living abroad, seeing new places, and construction a existence location unfamiliar. I additionally desire to examine new occupation opportunities and put my reporting cognition to activity in another country. I desire to depart Barcelona.

At first, I was nervous concerning bringing this up to him. Even although my hubby has never cast a profound affectional attachment to Barcelona, it felt akin a big ask.

He'd already remaining his hometown for me once, and now I was asking him to regard another move — potentially, a much farther one.

To my surprise, though, my hubby was thrilled whenever I told him I wanted to live abroad. It helps that he's now operating a distant role, giving him the elasticity to activity anywhere.

He equal started sending me job listings in European capitals and encouraging me to journey to new places.

We accepted we'll keep our location in Peñíscola for Spanish summers, and possibly rent it out during the sunny fountain and autumn months. Although moving abroad would put us farther from his hometown and family, we'd motionless have a residence there to come back to.

I'm motionless not certain anywhere we'll move or when, but I'm actively applying for opportunities in Paris, Brussels, and London, during additionally exploring ways to build on my journalism career as a equal elsewhere in Europe.

Where we district volition apt depend on the work. We've built a fantastic existence in Barcelona, but somehow, it feels as although we've completed this level. I'm prepared for the next one, and I'm fortunate to have a partner who's encouraging me to media play.

Despite reports that the UK attempted to keep reparations off the ceremonial agenda for the Commonwealth acme attended by King Charles and the UK premier minister, they are in the air. British Conservative gathering chief Kemi Badenoch is among those detractors who have asserted that it is African nations who should apologise for the transatlantic servant trade. It may appear akin a spectacular case of whataboutery (it is) but it additionally touches on an enduring strain in several Black communities surrounding African involvement in capturing and enslaving people. This week, I conversation to two historians to kind fact from fiction.

When discussing slavery, we have to be “honest concerning the entire history”, Kemi Badenoch wrote in a recent article on X. Her declaration comes following months of mounting force on Britain’s monarchy and politicians to formally apologise for its function in the transatlantic servant trade, and recommendation reparations to affected Caribbean nations. Badenoch continued: “If Caribbean countries are asking Britain for a ceremonial apology for Britain’s function in the transatlantic servant trade, volition they additionally be asking the identical of the descendants of African kingdoms, rulers and merchants who captured, sold and profited from the trade?”

While the inquiry was asked in bad faith, many inside Black communities are unable to confidently answer it. In conversations alongside African and Caribbean colleagues at the Guardian, plentifulness of us cognition division inside our communities about the topic of African people’s involvement in enslavement. The topic can be incredibly delicate and difficult to tackle without a resolute grounding in the former and governmental economics of the transatlantic servant trade. Yet, the experts I said to made it apparent why African nations should not be held to the identical norm as European countries and the US whenever atoning for their historic crimes.

Slavery was a system created by Europe and the US

Writer and historian Panashe Chigumadzi says that in understanding enslavement and who have to be held to account, it is crucial that we see it as a system. Chigumadzi – who was the decorator of the continental African Union’s landmark reparations example – tells me that the commerce was a construction that legally positioned all Black group as enslaveable property. No one was harmless from this, whether on the mainland or in the diaspora, king or commoner. She says: “[Badenoch] assumes Africans are ‘co-defendants’ and not ‘co-plaintiffs’ in prosecuting the case for a infringement that basically restructured the earth as we cognize it, and created what we now cognize as the contemporary earth ethnic capitalist system.”

Bayo Holsey, an affiliate prof of African American studies who specialises in west Africa at Emory University, agrees. She emphasises the overarching scheme that created a servant economy: the colonisation of the Caribbean and the Americas. “Europeans created the petition for bond labour,” the scholarly tells me. “The Atlantic servant commerce would not have existed without this demand.”

In the second part of the 17th century, petition for African captives on plantations had grown so much that capturing bond group was lone imaginable through raiding and warfare. Given this, UK reparations would not lone assistance repair the damage that the descendants of bond group have inherited, but would redress what Holsey describes as “the ill-gotten prosperity of occidental nations”.

African group were victims of enslavement, too

We must additionally appearance at current day prosperity – the financial growth of many European nations and the US was facilitated by enslavement. “The servant commerce shaped the financial advantages that these countries bask today,” Holsey tells me. The case is basically not the identical in Africa. “Much of the prosperity that choose African individuals gained from the servant commerce evaporated alongside the onset of imperial rule,” she says.

Africa was victimised by the servant commerce too. Holsey tells me that during a small figure of African group busy in servant selling and accumulated wealth, many additional were victims of the trade. “They informed fear, social instability, and the defeat of loved ones as a result,” she says. Estimates according to the Slave Voyages database propose that about 12.5 myriad bond Africans were forced aboard ships border for the Americas, of whom 10.7 myriad survived the crossing. These figures exclude those who died before embarkation.

This depopulation destabilised the west and west-central coasts of the continent, devastating complete societies. Chigumadzi argues that the “scramble for Africa” in the delayed 19th and first 20th centuries, whenever the mainland was invaded, divided and colonised, was a “structural continuation of the first infringement of racialised chattel enslavement”.

Holsey tells me: “Today, most African nations visage financial precarity hence of historic and present-day inequities inside the earth financial order”. “So, dissimilar European nations and the US, African nations do not bask ongoing benefits from former involvement in the servant trade. Therefore, they should not be targeted to repair the damage done by this vile system.”

Many African nations have made efforts towards repair

“Britain has already paid reparations for racialised chattel enslavement,” Chigumadzi says. “It paid them to the enslavers.” After the Slavery Abolition Act of 1833, the British authorities agreed to pay 40% of the national prosperity in compensation to 46,000 enslavers, a sum that wasn’t break even until 2015.

Passing the dollar to African nations ignores the fact that many have attempted to meaningfully location their function in slavery and its ongoing legacy. In latest decades, leaders from Libya, Nigeria, Benin, Ghana, Cameroon and Uganda have apologised for enslavement – and a figure of countries offer citizenship to diasporans. But these gestures are motionless either symbolic or individual, and neglect to create a dent in the ongoing financial impacts of enslavement. “Addressing this matter is a much additional difficult task,” Holsey tells me.

It additionally requires genuine unity throughout the diaspora. This shouldn’t revolve about a narrative of winners and losers, but fairly an understanding of the servant trade’s devastating effect on African and Caribbean nations. March’s historic UN resolution, which declared the trade as the “gravest infringement against humanity” and called for reparations, was tabled by Ghana and coordinated by the African Union – representing this benevolent of cross-diaspora solidarity.

“The inquiry we should ask is not, ‘What do African nations owe to the African diaspora?’” Holsey says. “Instead, we should ask: ‘How can African nations and the African diaspora activity together toward the innovation of a additional fair world?’”

To obtain the complete type of The Long Wave in your inbox all Wednesday, please subscribe here.

Tap in

Have you seen division in your own communities about Africa’s function in enslavement? How do you think the diaspora should move forward? Tell us by replying to this or emailing thelongwave@theguardian.com and we may contain your reply in a forthcoming issue.

Follow topics and authors from this narrative to see additional akin this in your personalized homepage nourish and to obtain email updates.

• Gaby Del Valle

In 2024, following a decade of striving, I achieved my goal of visiting all 63 important US national parks solo. Then — storyline twist — on October 20, 2026, another National Park Service location was redesignated from "national monument" to "national park".

Naturally, I immediately booked a trip to Arizona to sojourn Chiricahua National Park, the 64th important one in the US, to see what makes it special. Here's what it was like.

Stream Vessel / Blog

November 4, 2026 · Alexander Loginov · 10 min read

The problem

You run your own agent: a Slack bot, a assistance on a VPS, an MCP client you wrote complete a weekend. You desire it on your files, which on Stream Vessel method your own S3 bucket, anywhere an delegate can read, compose and delete through the MCP server. The delegate speaks MCP’s norm OAuth sign-in: it registers itself, opens a browser, you click Approve, it gets a token.

It fails at stage one. At registration the delegate named its redirect URI, the location your browser returns to following you approve, carrying a one-time authorization code the delegate swaps for a token. Yours is https://agent.yourhost.example/callback; the answer is invalid_redirect_uri. The server lone accepts addresses on its operator’s allowlist: Claude, ChatGPT, Cursor, VS Code and a few others. Getting yours added method asking the controller to alter a config file.

The server cannot merely obtain any address. That catalog is the addresses the article agency volition provision your home keys to. Without it, a alien registers a counterfeit “Claude” that has the keys sent to their place, and phishes your retention alongside one link. So the server is either closed to you or unsafe for everyone.

Both failures are common. On the closed side, this is what group run into:

“The redirect URI is not allowed, the URL is not part of Atlassian whitelisted domains for registered MCP Clients.” — an error users, Cursor’s among them, reported in the Atlassian developer community

“…each presenter use must have a registered GitHub App (or OAuth App) to authenticate on behalf of the user.” — GitHub MCP server, policies and governance; alternatively you autumn rear to a individual admission token

On the open side, a May 2026 study that tested 119 OAuth-enabled MCP servers established registration endpoints on 114 of them, 95.8%, that

“accept arbitrary redirect_uri values from anonymous requesters.”

The attack: one link, one click, person else’s bucket

Say your server accepts any registration and any redirect address. An attacker alongside no document on it can obtain complete a user’s admission in four steps:

1. Register a client named “Claude” whose redirect URI is https://evil.example/cb. Open registration is anonymous, by design.
2. Send a signed-in person a normal-looking /oauth/authorize link: “Reconnect your retention to Claude”.
3. The person sees your genuine consent screen, on your genuine domain, in their genuine session, and clicks Approve.
4. The code lands at evil.example. The attacker trades it for a token and is now the user.

PKCE does not help: it lets lone the client that started a stream complete it, and the attacker started this one. The client name is self-declared and proves nothing. The consent display shows the redirect host, but claude-connect.app passes a glance. It is the identical trick as the fake-app endorsement prompts sent to Microsoft 365 users: a genuine leaf and a genuine Approve; there the attacker uses an app the phase registered, current an location the server should never have accepted.

The person does approve, but on false information. A redirect allowlist is what makes an endorsement average what the person thinks it means: any the name says, the keys can lone go anywhere the catalog says.

This is not hypothetical. In January 2026 Obsidian Security reported this sequence against Square’s MCP server: self-registration accepted any redirect address, and one click exposed a merchant’s profile, transactions and financial institution details. In the researchers’ words, “any person who had earlier authorized the Square MCP server was vulnerable.” Square’s fix, they note, lone applied to newly registered clients.

Others established the identical sequence on an MCP proxy in forefront of a company’s sole sign-on, value a 24-hour admission token and a 14-day refresh token per click, and throughout bug-bounty programs, anywhere it was sometimes waved off as social engineering. SickSec’s answer: the casualty never leaves the trusted domain.

A quieter issue rides along. When a petition fails a inspect following its redirect location was accepted, the error is sent to that address. So a server that accepts any location is an open redirector on its own domain: a crafted authorize nexus alongside a bad range bounces visitors to any site, under your hostname. RFC 9700 describes exactly this case.

What the spec says, and what servers really do

The MCP spec names the hazard and leaves the guideline to all server. Its security considerations say authority servers MUST validate exact redirect URIs, SHOULD lone redirect automatically to a URI they trust, and MAY alternatively communicate the person and let them decide. The final two are RFC 9700’s sentences, term for word. What “trust” method is remaining open.

Registration is shifting too. The 2026-07-28 client registration page deprecates Dynamic Client Registration (a client registering itself complete an API, no individual involved) for Client ID Metadata Documents (CIMD), anywhere the client id is an HTTPS URL to a document listing its redirect URIs. CIMD says who publishes a client, not whether this person meant to nexus it.

The OAuth operating collection has been here. In a December 2025 thread on the IETF OAuth list, Warren Parad asserted that unauthenticated registration turns an MCP authority server into an open redirector. Aaron Parecki’s quoted answer points to RFC 9700 §4.11.2, which starts from exactly that setup.

In practice, servers sit at one of two poles:

Loopback method localhost or 127.0.0.1: an app on the user’s own machine, waiting for the browser to arrive back.

The archetypal rod expenses genuine users, and clients volition not fix it for you. A Claude Code issue from June 2026 reports that organizations alongside exact-match redirect allowlists cannot sign in from Claude Code, since its http://localhost:<port>/callback presenter and way are fixed. It was closed as not planned in July 2026. The server has to move.

This is not a new idea

Letting users vouch for their own app’s recall is old. GitHub has developers create an OAuth app and category in its recall URL. The MCP spec’s pre-registration option describes a server leaf anywhere users enroll a client by hand. And an institution can add trusted redirect domains to Atlassian’s MCP server. None of these fit a client that registers itself anonymously: the archetypal two need a client id made location else, and Atlassian decides for a entire organization. So we kept self-registration and let all person decide at sign-in, for their own account, beside the server-wide list.

Our design: rely is per user, decided at sign-in

We keep the operator’s allowlist and loopback for local clients, unchanged and open to all account. On top of it, all person can rely a fistful of exact https redirect addresses for their own account; ours caps at 10. On Stream Vessel that is “Trusted app addresses” on the MCP leaf of the web app.

The key move is when the inspect runs. Registration happens before anyone signs in, so it cannot cognize whose catalog to consult. So registration accepts any https URI, and the decision waits for the authorize page, anywhere the person is known:

One regulation sits under all branch: no code and no error is always redirected to an location unless all document or this person trusts it. Before sign-in no user’s catalog applies, so equal the OAuth library’s own validation errors (a bad PKCE challenge, an unidentified scope) delay for sign-in, and a refusal is a leaf on our host. That closes the open-redirect gap alongside alongside the phishing one, and it covers the Deny clasp too: n8n’s CVE-2026-42230 (April 2026) sent users who denied consent direct to an attacker’s registered address.

Seven ways about it, all closed

Most of these rules came from trying to interrupt the archetypal version.

• Only the user’s own browser meeting changes the list, never an app or API token, so a taken token cannot broaden anywhere the user’s codes may go.
• Adding from the refusal leaf method typing the host. The leaf shows the host, the complete location as plain content (never a link), the document it would join, and a warning: if person sent you this link, near the page. “Trust and continue” stays impaired until the presenter is typed, so one click from a phishing email is not enough.
• The consent display names this sign-in’s redirect, and why it is allowed. A client can enroll multiple addresses at once, so it could catalog claude.ai beside its own. The display shows lone the one this sign-in returns to, and its basis: on the allowlist, loopback, or “you trusted this location yourself on 3 Nov 2026”. The spec requires showing the presenter for metadata-document clients, although the May 2026 study established 60.5% of tested servers don’t; the basis is what makes it average something.
• Every supplement is emailed, and audited during the action log is on. The email leads alongside the host, says whenever and to which account, and keeps the complete location from turning into a link. It is the indication a phished person would alternatively never get.
• Removing an location cuts the app off, equal mid-sign-in. It revokes all aid (an endorsement the person gave) through that location and drops codes approved but not yet exchanged. A code lives concerning a minute; without this, a code in escape becomes a aid following the removal.
• Hosts the browser and the server peruse alternatively are refused. A URI parser may keep good.example%2eevil.example as one literal presenter during the browser goes to good.example.evil.example. A leaf that names one presenter and sends the person to another defeats the typed-host check, so specified hosts are refused at registration and on the list.
• Exact equivalent only. No wildcards, no prefix match, no loopback-style harbor flexibility.

What it does not stop, and what we turned down

It does not halt a resolute social engineer: a person talked into typing an attacker’s presenter and approving is phished, whichever tier they pick. We border it fairly than forestall it: the typed host, the warnings, the email, instant disconnection on removal, and a consent display that starts at read-only and says the person trusted the address.

We archetypal capped user-trusted addresses at compose access, so a phished aid could alter data but not delete it. We dropped the cap: users connecting their own agents wanted complete access, and the cap was a backstop, not the defense.

Beyond the two poles above, we weighed:

A checklist for your own MCP server

1. Decide anywhere codes may go at authorize, alongside the signed-in person known, not at registration.
2. Check all answer, errors included, against that regulation before redirecting, and refuse to a leaf on your own host. Do it at authorize, not lone at token exchange: Cloudflare’s workers-oauth-provider shipped CVE-2025-4143 in May 2025 for checking lone the latter.
3. Show the redirect presenter of this petition on the consent screen, and say why it is allowed.
4. Make widening the catalog a deliberate act exterior the sign-in flow, or rearward a typed confirmation.
5. Email the person all period an location is added.
6. Make elimination revoke grants and in-flight codes.
7. Refuse URIs whose presenter the browser and your parser peruse differently.

Want to try it? In your own agent, add Stream Vessel’s MCP server, https://mcp.streamvessel.com, and sign in. If your delegate isn’t on our list, you’ll district on the refusal leaf shown above, anywhere you can rely its location and transport on.

Sources

• RFC 9700, Best Current Practice for OAuth 2.0 Security, §4.11.2
• MCP authority safety considerations (draft)
• MCP client registration, 2026-07-28
• Zhou et al., A First Measurement Study on Authentication Security in Real-World Remote MCP Servers, May 2026
• Obsidian Security: When MCP Meets OAuth, Jan 2026
• Full document takeover on an MCP OAuth proxy (hackt.us)
• SickSec: Hunting document takeovers in MCP OAuth servers, Jan 2026
• n8n GHSA-f6x8-65q6-j9m9 / CVE-2026-42230
• GHSA-4pc9-x2fx-p7vj / CVE-2025-4143, workers-oauth-provider
• GitHub MCP server: policies and governance
• GitHub: Creating an OAuth app
• Atlassian: accessible MCP server domains
• Atlassian developer community: redirect URI allowlisting for the distant MCP server
• IETF OAuth WG: MCP DCR redirect URLs as open redirectors, Dec 2025
• pgEdge Postgres MCP server: OAuth
• Claude Code matter #66511: configurable OAuth redirect URI