0829 | Judge Blocks Pentagon's Anthropic Blacklist; OpenAI Ends Cursor Deal; GLM-5.3 Open

Mia: Welcome to HackerNews Daily on Bri Radio. I'm Mia.

Milo: And I'm Milo. Today we're looking at the Pentagon's blocked attempt to blacklist Anthropic, OpenAI's decision to wind down its contract with SpaceX, and the open-weight release of GLM-5.3.

Mia: Plus, the rumor-driven world of exploit hunting, new U.S. sanctions against the A/I Collective, and the fallout from Luanti's Android app leaving Google Play.

Mia: A federal judge has thrown out the Pentagon's blacklisting of Anthropic, and the ruling is blunt. Reuters reported on August twenty-seventh that U.S. District Judge Rita Lin, a Joe Biden appointee, struck down Defense Secretary Pete Hegseth's designation of Anthropic as a national security supply-chain risk in a fifty-nine-page order she called illegal and baseless. Her words: the empty invocation of national security is not a blank check to punish and retaliate against government critics.

Milo: And this was a first of its kind. Anthropic became the first U.S. company publicly designated a supply-chain risk under that obscure procurement statute, which is aimed at protecting military systems from foreign sabotage by keeping companies that could expose those systems to infiltration out of certain contracts. The label blocked Anthropic from a slice of military work.

Mia: The designation came right after Anthropic refused to let the military use Claude for U.S. surveillance or autonomous weapons. In its March ninth lawsuit in California federal court, Anthropic claimed the government violated its free speech rights by retaliating against its views on AI safety, and that it never got a chance to dispute the label. Anthropic executives said the whole thing could cost billions in lost business and reputational damage — its argument has always been that its models simply aren't reliable enough yet to be safely used in autonomous weapons.

Mia: OpenAI has told SpaceX it's winding down the contract that supplies OpenAI models to Cursor, after SpaceX acquired Cursor. The notice went out on August twenty-eighth, with a proposed shutoff date of November twelfth, twenty twenty-six — which is the maximum notice the contract allows. OpenAI says it can't be confident SpaceX will use the technology inside OpenAI's terms of service, citing past experience with Elon Musk's companies breaking contracts.

Milo: That history is specific. After Musk acquired Twitter, now part of SpaceX, that company broke the terms of its contract, and under oath earlier this year Musk admitted xAI — also now part of SpaceX — had violated OpenAI's terms. OpenAI points out those terms are similar to xAI's own, and the custom Cursor agreement gives the company a limited window to cancel after a change of control. It also says the upcoming Astra model brings a new level of accountability for ensuring the technology is used in accordance with its terms.

Mia: OpenAI held the cancellation to the latest allowed date while stopping future models from going to Cursor, after nearly four years of working together. On the discussion side, one commenter read the move as Cursor keeping its current OpenAI models rather than getting newer ones announced before the cutoff. Another noted Cursor already lets users bring their own OpenAI tokens and questioned whether new OpenAI models would still be offered. And a heavy Cursor user said they almost never touched OpenAI models in Cursor anyway — the first-party options, initially Composer and now grok-cursor, come competitively priced with generous usage limits in base plans plus per-token pricing.

Mia: GLM-5.3 is now open-weight, and the Hacker News reaction started strong. One commenter who says they've been using it more and more described it as feeling like Opus four point eight, but in the best possible way. That comparison immediately drew a follow-up asking for the practical details.

Milo: Right — the next commenter asked how the first poster is actually using it, which harness or service and how they're running it. So the thread is moving past the headline praise and wanting the hands-on specifics of deployment.

Mia: Shifting to Jordy Zomer's late-August article on pwning.systems, where he says he accidentally turned LLM memory into program analysis. He built Lemmalog, a Datalog engine that keeps an agent's knowledge as analysis state with provenance, retractions, and incremental evaluation, and benchmarked it against LongMemEval and LoCoMo.

Milo: The motivation came out of long vulnerability-research sessions where the model would slowly lose track of what it had already established, suggesting approaches already ruled out or reasoning from stale observations. Zomer's contrast is that typical memory systems store and retrieve observations and leave the LLM to figure out which conclusions still hold, whereas program-analysis-style maintenance automatically invalidates any derived conclusion the moment an input fact it depended on changes.

Mia: He illustrates that with observations about an attacker-controlled object, a pointed-to object, and a kernel object. In the Hacker News discussion, tptacek called it an agent system embedding the core idea behind CodeQL, Datalog extraction from codebases, letting a model pose and answer questions about it. processunknown said it looked more like a handrolled CodeQL, and fizx asked directly whether it was re-inventing Graph RAG from another angle or genuinely novel.

Milo: linguae said the Datalog approach resonated because logic programming was a major piece of old-fashioned symbolic AI, and they've been thinking about using older techniques like heuristic search to steer agent planning. So whether it's a fresh category or a reinvention, it's pulled a real conversation about whether the symbolic toolbox deserves another look.

Milo: On a separate Hacker News story titled "Just the rumour of a bug is enough to find an exploit these days," the stand-out comment is from nickcw, a maintainer of rclone. He says it describes his life as a maintainer right now — in the first ten years of the project they received about twenty security disclosures through GitHub, and they've had to deal with more than forty just in the last month.

Mia: That's more than double their decade total landing in a single month. nickcw notes that even with AI tools helping triage and draft fixes for review, the deluge has eaten a huge amount of their time. The title captures the mechanism though — it's no longer a confirmed bug that drives work; the mere rumour of one triggers disclosure, triage, and patch review cycles. A decade of roughly two disclosures a year was manageable, but forty-plus in one month is a fundamentally different workload.

Mia: Luanti, the open-source voxel game-creation platform, says its Android app is no longer on Google Play because of a DMCA notice filed on behalf of Microsoft by Tracer.AI, which alleged Luanti infringes Minecraft's copyright. The team says the app contains no proprietary code or assets from Minecraft, and they've filed a counter-notice. This isn't Tracer.AI's first attempt either — they sent a similar notice in 2023, which Luanti successfully appealed, and filed a similar notice this year against the indie voxel-style game Allumeria.

Milo: The DMCA notice cited US Reg. TX 8-192-097, the registration for Minecraft Java Edition 1.9, but didn't identify any specific assets. Luanti points out it ships with no games or assets by default — Minetest Game, formerly bundled, hasn't been included since December 2023 and is now downloadable from within the client with original, properly licensed assets. ContentDB uploads are manually reviewed by volunteers, and the project has been exploring perceptual hashing to flag copyrighted assets while requiring a final human decision. The post argues the voxel or cube concept can't be owned, noting Minecraft itself was inspired by the 2009 game Infiniminer.

Mia: On Hacker News, commenters split on blame. One suggested suing for tortious interference, while another suspected Google's terms allow removal for any reason and floated a possible EU Digital Markets Act angle. A different commenter pushed back that it's Microsoft, not Google, who should be sued, since Microsoft filed the notice.

Mia: The U.S. government has designated the Italian hosting provider behind the blogging platform noblogs.org a global terrorist, and it's now sanctioned Autistici Inventati, the collective that runs it. That escalation is what's drawn hundreds of comments across several Hacker News threads.

Milo: And a lot of that comment volume seems to reflect plain confusion. One reader, after clicking around and reading the collective's manifesto, admitted they still had no idea what the group actually does day to day. That uncertainty is worth sitting with, because Autistici Inventati isn't a flashy company with a clear consumer product. It's a longstanding collective that hosts privacy-focused services, and noblogs.org is their blogging platform.

Mia: So the U.S. labeling a hosting collective a global terrorist organization is the kind of designation that normally targets militant groups, not infrastructure providers. The gap between that consequence and the reader's confusion about the group's actual work is exactly where the alarm sits.

Mia: A Ninth Circuit appeals court sided with the states in a gambling fight against Kalshi. In a unanimous decision written by Judge Ryan Nelson, the court found that sports betting contracts aren't shielded by the federal law Arizona Attorney General Kris Mayes had relied on to pursue her case. Nelson wrote that Congress didn't take a wrecking ball to decades of sports gambling rules built up by federal, state, and tribal governments when it amended the Commodity Exchange Act.

Milo: One commenter distilled the reasoning to something unusually clean: whether the Super Bowl happens is an occurrence, but who wins it is not. That distinction is what lets the states keep enforcing their own gambling laws against Kalshi's event contracts. The decision drew very different reactions in the threads. Somebody going by mullingitover called it incredible it took this long to arrive at the obvious, while EA-three-one-six-seven defended the slow process as deliberative and multi-staged, arguing fast-tracking could let bad rulings take effect immediately rather than facing injunctions and review.

Mia: Another commenter, pennomi, countered that the law being slow is exactly why a figure like Trump can deal so much damage, because nearly everything he does is illegal but decisions take so long they have no effect. And echelon made a broader argument that gambling is a negative externality that needs to be taxed. Echelon said it takes advantage of the poor, the under-educated, and addictive personalities, burdens families and municipalities, strains the workforce, and deflects legitimate economic activity. They supported gambling as a personal liberty but argued companies that facilitate and profit from it should pay forty to fifty percent.

Mia: A next-generation HTTP client for Python called HTTPX2 has surfaced. It's a rewrite that the project description says addresses fundamental issues in HTTPX, and OpenAI appears to be migrating to it, with a separate document under its repository titled “Migrating to HTTPX2.” The person who posted it also noted their operating system's TLS trust store is now being used instead of the certifi bundle, a real change in how certificates get verified.

Milo: The naming did not go over well with everyone though. One commenter said they'd have been happier seeing the project called something like httpx-ng or httpy instead, which tells you the borrowing of the HTTPX name felt presumptuous to some. So you have a rewrite, a migration document sitting under OpenAI's Python SDK repository, and a community already split on the branding.

Milo: There's a discussion thread on Hacker News about the State of the Map 2026 conference, and it quickly turns to whether OpenStreetMap follows U.S. naming policy. One commenter asks directly whether the map project complies with U.S. executive order naming.

Mia: A second commenter says that when you load OpenStreetMap from a U.S. IP address, that area of the map isn't labeled at all. And searching for Gulf of America returns a result tied to that same behavior, which is what the map shows from a U.S. connection.

Milo: So the picture is that OpenStreetMap's rendering adjusts by where you're looking from, rather than picking one official name outright. The disagreement in the thread is essentially whether that's a neutral technical choice or a form of compliance — and the exchange leaves that open.

Milo: A Nature piece argues that smaller modular reactors could bring nuclear power closer to fulfilling its promise, but the Hacker News thread latches onto one word. A commenter points out that the word should is doing heavy lifting in the claim that small modular reactors should be cheaper and easier to construct, especially given the subject matter.

Mia: That same commenter figures we'll know by 2030, when one such reactor should come online. Another reply agrees that we should know by then, at least. So the timeline gives the whole should-based promise a concrete checkpoint to test against, even if getting there remains unproven.

Milo: A blog tool called the Sumerian King List Paleoclimate Alignment Explorer tests whether the ancient king list lines up with paleoclimate events, and the Hacker News discussion credits the author for an honest approach. One commenter says the author clearly put in the work to test the theory and that he isn't trying to force the data to fit the result.

Mia: Instead, the author explains why even apparent matches could just be coincidental. That honesty about the possibility of coincidental alignment is what stands out in the thread, rather than a claim that the dates were deliberately manufactured to match real climate events.

Milo: Over on Hacker News there's a site called Refund4Freedom that walks you through getting a refund on your Windows license, and it keeps tallies comparing which manufacturers make that refund process easy and which ones drag their feet.

Mia: ASUS is the most specific example the discussion flags, with a refund range between 9 and 65 euros — a spread that shows how much it can vary depending on the machine you bought.

Milo: And one commenter made the point that a Windows OEM license refund is generally a fairly honest reflection of what that license is actually worth, which is the core of why people bother pursuing it — you shouldn't pay for a Windows key you never use.

Mia: We leave you with the week's two tech legal flashpoints: a federal judge ruling the Pentagon's blacklisting of Anthropic illegal and baseless, and OpenAI moving to wind down its deal with Cursor after SpaceX bought the company.

Milo: Two real checks on how far corporate and military power reach. Thanks for listening, and we'll catch you next time.