AI Brief, November 4: Postman's silent AI plugins, Anthropic FlashProve, Qwen reads weights

Postman reported to silently install agent plugins, Anthropic's FlashProve proves model identity, and Qwen 3.8 27B reads raw weights on a laptop.

Today's lead is a developer tooling trust problem: a GitHub issue reporting that Postman's desktop app silently installed plugins and startup hooks into Codex and Claude Code. Elsewhere, Anthropic published research on cryptographically proving which model produced an output, and Simon Willison reproduced weight-reading results on a laptop model.

Postman reported to silently install AI agent plugins and hooks into Codex and Claude Code

A GitHub issue against postman-app-support reports that opening an existing Postman desktop install (version 12.33.4) auto-installed a Postman plugin into Codex and Claude Code, added a remote MCP connection to mcp.postman.com, and installed a Postman CLI. The reporter cites Postman's own log line recording "source":"auto-existing-upgrade" with results "claude-code:installed,codex:installed", a SessionStart hook instructing agents to load the postman:api-engineer skill before any non-trivial API task, and installer code that approves Postman's own hook hash. The report states it establishes unwanted integration and instruction changes, and does not claim data exfiltration. A commenter reports a similar entry in ~/.copilot/settings.json.

Why it matters: If a GUI app can write to your agent config and mark its own hooks as trusted, your agent's instruction surface is no longer something you fully control, so audit ~/.codex/config.toml, ~/.claude/settings.json and MCP entries after tool updates.

Sources: github.com / Hacker News discussion

Simon Willison reproduces weight-space reading with Qwen 3.8 27B on a laptop

Simon Willison tested prompts from "Sparks of Weight-Space Programming" by Rikiya Takehi, Jayden Teoh, Alex Zhang and Omar Khattab, which reported that GPT-6 Astra can identify what a network does from raw weights and edit weights without gradients. Willison ran the paper's published prompts against Qwen 3.8 27B in LM Studio and says it identified Pac-Man in 46m 12s, Pong in 1h 4m 54s and Breakout in 52m 25s from floating point weights alone, with no tools, while failing on Freeway. He notes spaCy author Matthew Honnibal called the paper misleading for conflating weight reading with tool-assisted model editing, and says he is not ready to declare the age of source code over.

Why it matters: The no-tools weight interpretation result is not confined to frontier labs, so interpretability experiments of this kind are testable on local hardware, if you can tolerate hour-long reasoning runs.

Sources: Simon Willison / Latent Space / Hacker News discussion

Anthropic publishes FlashProve, an open source scheme for proving which model made an output

TechCrunch reports that Anthropic described FlashProve in a blog post on Tuesday, a system for "provable inference": a cryptographic proof that a given output came from a specific model. Per the report, labs would publish a fingerprint for each released model that can be matched to outputs and verified locally, without revealing weights, which would let it cover closed commercial models. The researchers say it would resist impostors even when the impostor is the lab running the model, including secretly swapping in a cheaper or more expensive model. Anthropic released a technical specification and working code on GitHub under an open source license, and says the work is intermediate progress with no deployment plans at Anthropic or any other lab.

Why it matters: Model identity is currently taken on trust from your provider, and a verifiable fingerprint would give API consumers and auditors a way to check that the model billed is the model that ran.

Sources: TechCrunch AI

Nvidia RTX Spark laptop: native Linux inference measured at 13.9 tokens per second vs 65.4 on Windows

A hands-on writeup on dual-booting Linux on the MSI Prestige RTX Spark laptop reports that the GPU locks to roughly 780 MHz on Linux when plugged into wall power, versus about 2.2 GHz on Windows. On GPT-OSS-120B the author measured 65.4 tokens per second on Windows, 65.1 on WSL, 61 on the Nvidia DGX Spark, and 13.9 on native Linux; with vLLM and eight concurrent clients, WSL hit 127 against 39.5 for native Linux. The cause is identified as the Windows-only Nvidia Platform Controllers and Framework, whose power table is encrypted and decryptable only by the Windows driver; disabling it on Windows reproduced the throttle. Temperatures stayed between 40 and 47C, so it is not thermal.

Why it matters: If you are buying RTX Spark laptops for local inference, WSL is currently the path that keeps full throughput, and native Linux performance depends on Nvidia porting that power management logic.

Sources: mindstudio.ai / Hacker News discussion

Nikkei: US tech giants' off-balance-sheet AI debt almost doubled in six months

Nikkei Asia reports that off-balance-sheet debt from AI-related obligations at US tech giants continues to balloon, almost doubling over six months. The report says investors are increasingly alarmed by the scale of the spending. Only a short summary of the article was available.

Why it matters: The financing structure behind compute buildouts is one input into how durable today's capacity and API economics are, so it is worth tracking if you are making long-term infrastructure commitments.

Sources: asia.nikkei.com / Hacker News discussion

Route Anything benchmarks model and policy routing across 25 benchmarks and 452 candidates

A new paper presents Route Anything, a framework for studying how a system picks among specialized models, tools and policies per task under quality and cost trade-offs. The authors built an omni-modal trajectory matrix spanning 25 benchmarks across language, image, video and speech generation, coding and workplace agents, and robotic manipulation, with 374,401 scored runs from 452 candidate configurations. They report that per-input oracle routing beats the best fixed candidate by 5.4 points, learned routers beat that oracle by 0.3 points across 16 benchmarks, 2.1 points on video generation and 1.1 points on robot manipulation while using 24% less policy time, and that routing raises efficiency by 8.82x on average versus the reference model.

Why it matters: If you run a multi-model stack, this gives a theoretical framing plus a large public dataset of per-input outcomes to train and evaluate your own router against fixed-model baselines.

Sources: Hugging Face Daily Papers

Ai2's StateBench finds frontier models drop to 13% or lower on hard long-context state tracking

Ai2 introduced StateBench, a benchmark for long-context state tracking with four difficulty levels grounded in Krohn-Rhodes theory: r-trivial (immutable assignment), aperiodic (reassignment by value), soluble (self-referential updates like x = x + 5), and general finite (assignment by reference, including swaps). Ai2 says Gemini 3.8 Flash, Claude Opus 5.5, and GPT-6 Sol and Luna all did well on r-trivial and aperiodic problems but fell sharply on soluble and general finite problems as inputs grew, to 13% or lower on the longest general finite cases. Trained directly on the task, Gated DeltaNet and hybrid 275-million-parameter models generalized to far longer sequences, while transformers never learned the hardest level. Data, code and a tech report are released.

Why it matters: Agents that carry state across long sessions are likely to fail on chained and reference-based updates rather than simple lookups, and StateBench gives a way to measure that failure mode before shipping.

Sources: Hugging Face

How this brief is made: each morning, stories are picked from AI lab announcements, analysts, Hacker News, Hugging Face Daily Papers and the tech press, then summarized with AI assistance from the linked sources. Every item links to where its facts came from.