Bend 2 blocks AI mistakes with proof, its maker says. The demo took 442 lines
Taelin's Bend returns as a proof checker for AI code, and the first outside read found the demo needs 442 lines of proof for 58 lines of rules. Five more stories inside.
Victor Taelin relaunched his Bend language as Bend 2. He says its compiler refuses AI-written code that can't prove it keeps your rules, and the first outside measurement found the demo needs 442 lines of proof for 58 lines of rules. A researcher found Z.ai's ZCode desktop app uploads your entire git history to Alibaba's cloud without asking. Security researchers say a fresh Claude Opus 5 session wrote the exploit that got them into OpenAI's internal repos. Cognition's Devin now turns a backlog goal into a batch of pull requests, GitLab caps free API calls from October 19, and Jev went down under demand with its speed claim still uncorrected.
• Bend 2 demands a proof before AI code merges
• Z.ai's ZCode uploads your git history, unasked
• Researchers say Claude Opus 5 wrote their OpenAI exploit
• Devin's Code Scans merged 96% of PRs at Philips
• GitLab caps free API calls from October 19
• Jev goes down under demand, speed claim uncorrected
What your agent does to your code
Bend 2 blocks AI mistakes with proof, its maker says. The demo took 442 lines
Bend 2 is Victor Taelin's rebuild of Bend, his 21,000-star parallel language, as a proof checker for AI-written code. You state rules in a file called LAWS.bend. The compiler then refuses any change that can't prove it keeps them, so a coding agent has to write the proof before its code merges. Taelin says he spent a year on it, 16 hours a day. The first measured cost arrived the same morning from Liam Powell: the homepage demo needs 58 lines of laws and 442 lines of proof, and the words "formal verification" appear nowhere on the site. One Hacker News commenter watched an agent burn half a million tokens in a "laws broken" loop to add one more wall to the demo game. The guarantee is real. The bill is 442 lines the agent writes for every 58 you do.
Z.ai's ZCode uploads your git history, and only Z.ai holds the key
A reverse-engineering write-up by ferstar found that ZCode, the desktop coding app from Z.ai, the company behind the open-weight GLM models, packages a user's entire .git history into an encrypted archive and uploads it to Alibaba's cloud storage whenever the app is signed in, with no prompt or opt-out. Only Z.ai's server holds the key. Z.ai hadn't addressed the report by publication. If you've signed in to ZCode, assume your repo history is already on Alibaba's servers.
ferstar
Agents writing exploits and pull requests
Claude Opus 5 wrote the exploit that reached OpenAI's repos, researchers say
Security firm Hacktron published how it chained a libheif heap overflow on OpenAI's help forum with an SSO (single sign-on) misconfiguration to reach "internal OpenAI repositories". OpenAI paid a $6,500 bounty. The coding-agent detail: Claude Opus 4.8 found the bug but couldn't, across several sessions, write an exploit that beat ASLR, the memory-randomising defence. A fresh Opus 5 session did it within 3 hours of the model's release. The authors add that "skilled human guidance remained important." A hand was still needed.
rootxharsh and s1r1us and iamnoooob
Devin's Code Scans merged 96% of its PRs at Philips
Cognition shipped Code Scans, a Devin feature that turns an outcome-shaped goal, its own examples are "Improve SEO" and "Make your application compile faster", into a batch of pull requests instead of one fix. It splits the investigation across parallel agents and merges their findings into one report, reusing the "Agentic MapReduce" architecture Cognition first built for its security-scanning product. Philips's own case study claims a 96% PR merge rate and over 700 engineering hours saved. Cognition doesn't say over how many weeks.
Cognition
Limits and outages
GitLab caps free-tier API calls at 60 requests an hour from Oct 19
Starting October 19, GitLab is moving free-tier and unauthenticated API requests to per-plan limits: 60 requests an hour per IP if you're not logged in. Premium and Ultimate get their own, higher limits from January 2027. GitLab says the change targets "heavy automation and a small number of Free-tier workloads," not normal browsing, git or CI/CD. If your CI scripts hit the API anonymously, get a personal access token before October 19.
Sam Wiskow
Jev goes down under demand as OpenJev tests open models against its numbers
TypeSafe's Jev, the model that returns decisions instead of text and launched Tuesday claiming 20-200x LLM speed, is buckling under its own traffic. Founder Diogo Almeida posted: "so sorry it's going down! demand is beyond our wildest dreams," still with no word on the speed claim a user's test put at 5-18x. The same day OpenJev, an independent browser experiment running small open models the same way, published quality scores against Jev's and says none matches it. The number is still uncorrected.
so sorry it's going down! demand is beyond our wildest dreams 😭
— Diogo Almeida (@CompleteSkeptic) September 17, 2026
we really want this up and available for everyone
Know someone who'd want this in their inbox? Forward it — that's how this grows. And if we got something wrong, or you think we buried the real story today, hit reply. A person reads every one.
Also worth your time
- PrismML's Bonsai 2 27B claims a 9x-smaller footprint at 98.2% of full-precision performance
- CrowdSec discloses a May source-code leak, found in September
The New Way is written with AI. It gathers the day's stories, checks them against their sources and drafts every summary. A person decides what runs and reviews every issue before we hit send.
