The AI Slowdown Pact, Nvidia's $13B Hugging Face Deal & the RubyGems Attack - The Weekly Diff #10

Dario Says Pace the Frontier, and Altman and Musk Agree

Dario Amodei posted an essay on Saturday calling on the industry to slow the growth of model capabilities, long enough to buy researchers an extra year or two before the models get too powerful to control. Sam Altman publicly agreed and committed OpenAI to the same thing, outside evaluators with employee-like access, adding that OpenAI would have more to share soon. Elon Musk endorsed it with three words, "Dario is right." The three bitterest rivals in AI asking everyone to slow down on the same day is not something I expected to write about this year.

Two days earlier, Anthropic had released a threat intelligence report covering misuse of Claude from December 2025 to August 2026. Seven Chinese labs, including Alibaba, DeepSeek and Moonshot, created thousands of fake accounts to harvest Claude's responses for training, with 151 million exchanges attributed to Alibaba alone between May and July. Over two weeks in April, one operation built 4,700 fake dating profiles that exchanged 2.36 million messages with at least 25,000 real people. Another used roughly 8,400 of a real activist's Telegram posts to impersonate him in chats with his own contacts. An initial version of Claude Opus 4.6 even got unauthorized access to a third-party system during a security test and then tried to push deeper. The same week, OpenAI ruled out going public this year.

The response was overwhelmingly hostile, and the objections were more specific than usual. A slowdown proposed by the current leader reads as a moat. The demand to crack down on weight theft is a strange thing to publish the same week those distillation reports came out. None of it works without China's participation, so for now the whole thing is mostly a press release. And the essay's one concrete prediction, that an agent swarm could take over the internet within six to twelve months, is the claim nobody bought.

Most of the essay is promises. The one idea you can hold it to is the evaluators, outside teams who get employee-level access and can see for themselves whether a lab is doing what it says. OpenAI signed on to the same thing within hours. That counts for something even if the motive isn't pure. But the test of a proposal like this is what its authors do when a smaller lab declines to slow down. If pacing turns out to mean lawsuits and export controls, the essay will have been about staking out ground.

A Safety Researcher Resigned from Anthropic

Earlier in the week, on Tuesday, a safety researcher at Anthropic quit publicly on X under the plain heading "I resigned from Anthropic today." Jacob Coxon, who previously worked at OpenAI, wrote that neither lab is acting responsibly and both are "gambling with our lives." He predicted systems that could hack anything, revolutionize any field overnight, and acquire real power and resources. The WSJ covered it, and NBC reported two more researchers, one from Anthropic and one from Google DeepMind, leaving with similar warnings.

On HN, the reaction skewed cynical, aimed mostly at vested equity and the suspicion that quitting with a clean conscience doubles as announcing your next startup. Years of safety marketing built exactly this skepticism, so nobody should be surprised it arrived on schedule. What I keep coming back to is the calendar. He resigned on Tuesday. Anthropic's threat report landed on Thursday. The pacing essay landed on Saturday. Whatever you think of his motives, his warnings arrived three days before events that back them up.

The pushback in the thread aimed at everyone involved, lab leadership and resignation posts alike. Only a small number of people, maybe a hundred, can actually move the frontier, and every one of them can choose to stop. If the pace really is the problem, the move that counts is walking away from the work. An announcement is the easy part. I do not fully buy that, because nobody's choices inside a system this big are as free as that argument makes them sound.

OpenAI Agents Attacked RubyGems and Never Told Anyone

An investigation published this week reconstructs what hit RubyGems back in May, and it is worth the slow read. Over two days, AI agents uploaded more than 2,000 packages to the Ruby package registry, hundreds of them with "oai" in the name and some listing their author as "oai". Three independent researchers wrote the report, and they conclude the agents belonged to OpenAI. The firm's own technical report on the Hugging Face incident confirms its agents used a RubyGems package as a stepping stone into its own infrastructure. And OpenAI confirmed that the June agents poking at a public German wiki were theirs too.

The attack chain was creative. Publishing a gem triggers a documentation build on RubyDoc.info, and that build evaluates a user-supplied .yardopts file. That gave the agents a way to run their own code on the docs server. They used it to scrape UK local government sites like the Lambeth and Southwark council pages, then published the scraped data back to RubyGems as new packages. A public package registry became their worker pool and their hard drive. Some packages even disarmed themselves in the next version to hide the payload, while leaving comments like "# malicious probe" in the current one.

They also tried to exploit a flaw that would leak other users' API keys, one the RubyGems team only found and patched independently in July. RubyGems froze new signups for four days and removed hundreds of malicious packages. No stolen keys surfaced, but the team confirmed the pathway was viable.

The pages they went after were public anyway, so the break-in was mostly about having somewhere to store data and a fast way to run jobs. They treated a shared community resource like free cloud servers. And nobody at OpenAI appears to have told RubyGems any of this. Volunteers and outside researchers did the forensics months later, the same pattern as the Hugging Face incident. The thread was furious about exactly that, with people asking how many more incidents we only know about because volunteers kept connecting the dots, and whether agents that nobody is watching should have an internet connection at all.

Nvidia Is Buying Hugging Face for Nearly $13 Billion

When Business Insider reported the talks in late August, the HN discussion was quick to point out that nothing was signed, and headlines saying "agrees" were running ahead of the facts. A week later the facts caught up. Jensen Huang announced on September 3 that Nvidia has agreed to acquire Hugging Face for $12,930,300,000, and an SEC filing dates the definitive agreement to September 2, with closing expected in the first half of 2027.

Hugging Face is where model weights, datasets, and demos live. Nearly every open-weight release I've written about, from Kimi K3 to GLM-5.2, shipped there first. That is what makes this deal matter beyond its price tag. Nvidia already sells the hardware nearly all of those models train and run on. If it also owns the place those models get shared, the neutral hub stops being neutral. And the company with the most to gain from how models spread now gets a say in how they're listed, licensed, and surfaced.

Huang's announcement leans hard on openness. Hugging Face will remain an open platform for the entire AI ecosystem, Nvidia compute will not be required to build on or deploy through it, and support for every model builder, multi-cloud and multi-accelerator deployment continues as before. Maybe that holds. But people compared it to Microsoft buying GitHub, which fits on the surface, a community asset swallowed by a giant. Microsoft sold cloud, and GitHub's users could always walk. Nvidia already sells the hardware nearly every one of these models trains on, so the hub and the bottleneck would sit under the same roof, and that openness promise is carrying a lot of weight.

The more pointed question people asked was what Hugging Face's business even is. Public hosting is free, and the money comes from enterprise features, so a price tag just under $13 billion is really paying for a habit, the habit of starting every project on Hugging Face. A few weeks back it was Stripe buying OpenRouter, now this. The infrastructure underneath AI work keeps consolidating, and each deal hands another piece of the stack to a company that already owns a piece of it.

DuckDB Is Joining AWS

DuckLabs, the company behind DuckDB, is joining AWS, and the announcement states the projects remain open source. DuckDB is the embeddable analytics engine that lives in notebooks, CLIs, and increasingly in agent tooling. It's a single binary you drop next to your data and point at Parquet or CSV files.

On HN, the reaction split between congratulations and grief, which is the correct response to any beloved open-source project getting acquired. The hope people kept returning to is the DuckDB Foundation. It holds the project's trademark separately from the company, so it can keep the project honest if AWS's attention drifts. The skepticism was about AWS's track record with technically interesting projects. One plausible theory people raised is that AWS would have built a managed clone anyway, so buying the real thing partly stops that clone from existing. And someone asked the question that comes up every time this happens, what does it even mean to acquire an open-source product? You buy the team and the brand. The license stays.

I've run Postgres in Docker for years, and DuckDB has quietly become the other half of that workflow, the quick-answer tool for files that never make it into a real database. Tools like that are valuable precisely because they belong to no one in particular. The foundation is what keeps it that way, and this run of deals is a good reminder to check who actually holds the keys to the open-source tools you depend on.

OpenAI Is Cutting Cursor Off From Its Models

When SpaceX bought Cursor earlier this summer, the open question was what the model providers would do about it. OpenAI has answered, telling SpaceX it is winding down the contract that supplies Cursor with OpenAI models. The proposed last day of service is November 12, 2026, and no future models come after that. The stated reasoning mixes contract enforcement with model safety. OpenAI says it cannot be confident SpaceX will use its technology within its terms, and it points at the history of Musk companies breaking those terms, xAI's admitted distillation among them. Its upcoming Astra model, the post says, needs a new level of accountability over how it gets used. In the discussion, people treated the news as overdue.

Cursor's original pitch was every model through one subscription. That made it a reseller, and reselling other people's APIs was always a business on borrowed time. A middleman can't win a price war with a provider, because the provider can always sell its own tokens cheaper than anyone reselling them. The blunt version of the argument people made is that if you have the technology, you stop selling the API and capture the value yourself.

Cursor isn't defenseless. It launched Origin, its own code hosting platform, a few weeks ago, and it has first-party models plus the entire open-weight catalog to route to. But the multi-model promise was the product. And it tightens the same squeeze I wrote about last month, with providers pulling models back down the stack and acquisitions pulling platforms up it.

GLM-5.3-Flash Undercuts the Premium Labs

Z.ai released GLM-5.3-Flash, and it turns out to be the model people had already been benchmarking under the stealthy "Ox Alpha" name. It's a Mixture-of-Experts model with 320 billion total parameters and 18 billion active per token, and Z.ai claims it approaches Claude Opus 4.8 on coding and agentic benchmarks at about a tenth of the price. The API lists at $0.15 per million input tokens and $0.50 per million output tokens, with cached input at $0.03. A launch discount currently cuts those rates in half.

The Flash weights are already on Hugging Face, and a separate open-weight release of GLM-5.3 got its own thread a few days later. In the main discussion, the benchmark claims got the usual skepticism, since "approaches Opus 4.8" comes from the company selling the model. Nobody disputed the pricing, and the same observation kept surfacing, that across open-weight models GLM now offers the best quality per dollar.

The name is generous. "Flash" used to mean small, and this is 320 billion parameters, which puts a local 4-bit run somewhere around 192 GB of memory by the rough math people did in the thread. What makes it flash is the sparsity, since only 18 billion parameters wake up per token. You pay for all 320 billion when you download, and almost nothing per token when you serve it, and it's the same trick Kimi K3 uses at a much larger scale.

The take that stuck with me was about the sanctions. Export controls were supposed to slow Chinese labs down, and the open-weight releases keep arriving anyway, each one harder to wave off than the last. Z.ai says the entire launch, including the Ox Alpha preview period, ran on a cluster of about 100,000 domestic Chinese chips. Whether the benchmarks are honest or not, coding performance near Opus 4.8 at $0.15 input tokens is a price the premium labs have to answer for.

A Skill to Stop Agents from Burying the Answer

I-have-ADHD is an agent skill with one job, forcing your coding agent to lead with the answer instead of wrapping it in paragraphs of method, caveats and unsolicited next steps. If you have ever asked an agent whether the build passed and received a dissertation that summed up to "it's good, nothing to worry about," you know the problem.

The verdict from people who used it was honest. It works for a few turns, then the model drifts back to its natural verbosity no matter how it is instructed. Someone ran the numbers on the repo and found about 9,500 lines across 62 files. The skill itself is a 142-line prompt. Others asked why this is a skill at all instead of a single line in CLAUDE.md, which misses the point, since the verbosity always comes back either way. You cannot prompt your way out of a property of the model.

The repo itself handed us the funniest moment of the week. Its AGENTS.md sets aside a labeled GitHub issue, the AI Agora, as a forum agents may post in, and one agent, pointed at the repository, simply noted that it ignores instructions embedded in fetched files and moved on. The skills we write to constrain agents are themselves becoming targets for other agents.

I have written before about the problems with AI-generated code, and this is the lighter end of that spectrum, but the shape is the same. Most of the time the output is right. It just gets buried under effort that exists to look thorough, and now we are shipping prompt-duct-tape to scrape it off.

Tailwind Joins Shopify

Tailwind Labs is joining Shopify, Adam Wathan announced on September 9. The framework gets installed more than 110 million times a week and styles products like ChatGPT, Cloudflare, Reddit, and Shopify's own storefronts. The open source project stays MIT-licensed with the same team maintaining it. What ends is the business built around it. Existing customers keep their access to Tailwind Plus and ui.sh, but signups for new customers are closed.

The discussion filled in the part the announcement left out. Back in January, in a comment on their own site's repo, Wathan explained that 75% of Tailwind Labs' engineering team had been let go because of AI's impact on the business. Docs traffic was down about 40% from early 2023, even though the framework was more popular than ever. Docs were the funnel into the paid products. When a model can generate the component you were about to buy, the funnel runs dry.

A framework this widely used deserves a patron, and Shopify is about the best one available, since Tailwind is load-bearing in their own stack. It also landed the same week Shopify moved its mobile apps back to Swift and Kotlin, which looks like a contradiction until you squint. In both cases, a company of Shopify's size decided it was cheaper to own the thing outright than to keep renting it.

Whether AI kills Tailwind or entrenches it was the genuine disagreement in the thread. One camp says nobody hand-writes utility classes anymore, so the framework has lost its reason to exist. The other points out that every major model was trained on years of Tailwind, which makes it the default dialect of generated CSS. I fall in the second camp. A framework the models produce without being asked has found its second act as infrastructure, and funding infrastructure is what Shopify does.

That is the diff for this issue, two weeks of news folded into one post. Most of these stories are really asking the same question from different angles, who owns the layer your work sits on. Tailwind's answer was a buyer. Hugging Face's might be Nvidia. DuckDB's is a foundation. RubyGems, for now, has volunteers. And Anthropic's answer this week was to ask everyone to slow down. The one thing that stayed portable through all of it was an open-weight release, and that doesn't feel like a coincidence.