Distill HN · 2026-11-11
Keys: space/K play-pause · J/L jump 10s · arrows on the waveform nudge 5s
Anthropic's Claude Fable 5.2 scored a 65 on Artificial Analysis' independent leaderboard, the highest any model has posted, reportedly needing forty-five minutes of work per task to get there. Tokens per task grew from about 118,000 to 274,000 versus Fable 5.1, so the price cut per token may still raise the cost per task. Amazon reports two engineers cut a labeling bill 98% by swapping a frontier model for a cheap in-house classifier, while a supply-chain attack rode stolen Qubole credentials into dozens of customers' accounts, reading about a hundred secrets in seven minutes. Patrick Garrity's seven-month audit counts 442 AI-attributable CVEs — about half a percent of the year's total — and calls the bottleneck triage, not discovery. And a decade-old rule that smart home devices must work without vendor servers is becoming product design, with leaked evidence of Apple's Harbor local inference app.
The full episode transcript, timed to the audio. Click any line to jump there; the current line lights up while you listen.
Anthropic's new Claude Fable 5.2 posted a sixty-five on Artificial Analysis' independent leaderboard — the highest score any AI model has managed — and it reportedly needed forty-five minutes of work per task to earn it.
Forty-five minutes a task is not a shortcut, it's a meter running. The week's biggest fight was whether that trade is a breakthrough or a bill.
And the bill has a real chance of winning, because the price cut sits on top of a meter almost nobody read.
Welcome to Distill, the Hacker News edition. We read the threads so you don't have to.
It's Wednesday, November 11th. This week the community fell in love with a model and fought about its invoice — which is really one argument most engineering teams are about to have with their own budgets.
Here's the route. The Fable 5.2 fight, and the two meters that decide it. Then the bill-cutters: Amazon's labeling swap, the inference engineering field guide, and what the financing layer is pricing in.
Then a security ledger that runs from vendor credentials to a flood of unverified bug reports. Then the local-first wave, from a confused fridge to an Apple leak. Quick round, what sticks, and we're out.
The launch owned the week, and notice what the argument was actually about. The score itself went unchallenged. The fight was over what the work costs.
Because there are two meters here, and the rate card only advertises one. Price per token is what the launch page leads with. Cost per task is what your invoice actually reads.
And the two meters moved in opposite directions. Skeptics in the leaderboard thread ran the comparison against Fable 5.1: tokens per task grew from about a hundred eighteen thousand to two hundred seventy-four thousand. The price per token fell. The cost per task climbed anyway.
That's the whole trick. A price cut on a meter that more than doubled is a price increase wearing a discount. Supporters counter that runtime dropped versus 5.1, which claws some of it back — and which meter wins depends entirely on your task mix.
Task mix is doing real work in that sentence. A batch job that runs overnight doesn't care if the model thinks for an hour. An interactive coding session absolutely does. Same model, same rate card, completely different bill.
Which is why the hands-on demos matter — they show where the tokens actually go. The week's biggest was a beat-'em-up a developer built for his nephew: four players, about a hundred seventy-five generated images, and the model playtested every stage itself in a headless browser — a browser with no window, driven by code.
I'll concede that loop is real and genuinely new. The model closed its own build-test-fix cycle — build a stage, run it, watch what breaks, patch it — with no human in the loop. Generated art is a party trick. A self-running QA department is a product.
A second demo landed the next day: a developer posting as Saltline showed a first-person shooter built with the model. Two playable games in one week, from two builders who don't work together, is a capability claim you can check yourself.
Now the label, because it's doing marketing work. The author reports a single overnight prompt produced the nephew's game. Commenters pushed back — the project began from an existing codebase, with many human-directed changes stacked on top of whatever that prompt started.
Both things land, and the demo impresses either way. The honest read is a heavily-assisted sprint, not a shot. What tempers it further is the boring use case: in the same leaderboard thread, the cost skeptics said that for ordinary coding, the model is hard to distinguish from Opus 5.5.
That's the conditional in one sentence. The benchmark lead is real; the gap on Tuesday's pull requests may not be. The capability shows up when a task needs the model to test itself, loop after loop, unsupervised.
And the mechanism underneath explains why the bill and the capability are the same thing. The extra tokens aren't waste — they are the playtesting. Thinking longer, running more checks, iterating more times is what the score is made of, and it's also what the bill is made of.
So if you're evaluating this for your team, the move is unglamorous. Take last month's real tickets, run them through, and measure tokens per task on your own traffic. Price the task, never the token.
The rate card can't know your workload, so it lies by omission. The teams that already run this math found out how good the cheap answer can get — and that's the next story.
Amazon ran that audit in public, and it took the week's second-biggest thread. Two engineers replaced Claude Sonnet 4.6 with Strands Decider — Amazon's own in-house model built to classify, not to write — for ticket labeling across one of the world's largest internal ticketing systems.
Same performance, by Amazon's report, at ninety-eight percent less cost, with millions projected saved annually. One hedge before the lesson: that's Amazon grading its own homework.
The mechanism is worth saying plainly. Most enterprise text work is deciding, not generating — route, label, approve, escalate — and a small model tuned to decide matches a frontier model on it at a rounding error of the price.
An open field guide to inference engineering argues this is becoming a job description: platform teams are turning into inference teams. Self-host open models at high volume, the guide says, and costs fall sharply. SPECTRA claims near-lossless compression that runs any large language model in a sliver of RAM — the hardware side of the same bet.
The financing layer spent the week stress-testing the same bet from the other side. CoreWeave's bond yield topped sixteen percent amid rising AI credit stress — lenders are pricing real risk into AI infrastructure debt. Against that backdrop, Anthropic reportedly heads toward an IPO at a valuation in the trillions.
So the week's economics point in opposite directions at once. The demand side is cutting bills by matching models to tasks, while the supply side borrows at stress rates to build capacity for demand that hasn't shown up yet. Neither side is wrong — but they can't both be right about the next two years.
And every dollar saved this way becomes a model embedded in someone else's product, running on someone else's keys. Which is exactly where the week's security ledger opens.
Three incidents this week trace one fault line: trust extended to vendors, and to their credentials. Start with Notion, which disclosed that a breach at Fireworks — its AI vendor — may have exposed AI chat sessions across a small fraction of workspaces.
The phrase to sit with is "unattributable." These are transcripts with no tool results or labels attached, so nothing ties a session to a workspace, a user, or a purpose. When you can't attribute a transcript, you can't tell who to warn, or about what.
The Qubole attack shows the same fault line at scale. Sentra, the security firm that investigated, reports attackers used stolen Qubole credentials to assume cross-account roles — permissions one account grants to another — at dozens of downstream customers.
One question before the scary part: why is read-only access the dangerous version?
Because read-only exfiltration leaves no writes to trip an alert. The attackers read roughly a hundred passwords and keys in seven minutes without writing anything — no deletions, no tampering, nothing for an alert to catch.
One vendor's stolen credential becomes read access across dozens of customers — the blast radius is their customer data. The third incident is the oldest failure mode on the list: Queens Public Library suspended e-borrowing under ransomware.
The check you can run today: inventory every third-party AI vendor with access to your systems, and every cross-account role you've granted. Then ask what a stolen vendor key could read.
Credentials are one way the security floor buckles under AI. Patrick Garrity spent months documenting another: Project Glasswing, Anthropic's program that uses AI to find vulnerabilities and report them to maintainers.
His audit argues the program underdelivered. AI-sourced findings ballooned between September and November while fixes barely moved. The attributable count is four hundred forty-two CVEs — about half a percent of this year's total — and almost none were exploited in the wild.
Here's what makes it a fight instead of a verdict. Anthropic's own ledger presents the same figures as improving precision — the claimed true-positive rate keeps climbing, and they read that as the model getting better. Garrity reads the same climb as a missing triage filter: more auto-accepted findings, not better ones. Same numbers, opposite stories.
What isn't contested is where the bottleneck moved. Discovery is cheap now; verification and fix capacity aren't. A finding stream with no triage filter doesn't improve security — it consumes maintainer attention, which is the scarcest resource an open source project has.
And that's the part that should scare engineering leaders. A program measured only on findings looks great on a dashboard while maintainers drown. The metric has to sit behind the triage, not in front of it.
The constructive counterpoint came from the CPython project, where agents have been formalizing the interpreter's source in Lean.
Lean being — the proof assistant?
Software that checks a proof line by line. Thousands of functions are now formalized, and the effort has surfaced hundreds of bug reports backed by machine-checked proofs. That's verification as the filter that makes AI findings usable — the triage the vulnerability flood is missing.
So the week's security lesson runs from vendor keys to verification: trust has to be checked somewhere specific, and right now mostly nothing is checking it for you. Which is why a decade-old rule about owning your stack suddenly owned the front page.
Spencer Kittleson posted a rule he's kept for a decade: every smart home device he buys has to work without the vendor's servers. The essay took the week's third-biggest thread, and the illustration he chose is a single appliance.
A Samsung fridge showing a TLS error on its own screen. The device has the display and the crypto stack — it just can't reach a server that no longer answers. Kittleson's whole argument, sitting in a kitchen.
The rule got fresh proof the same week, when a Google API break took features out of devices that were fine the day before. And the same instinct is now visible in products. A builder showed off HolyArrs, a fifteen-megabyte self-hosted app that replaced half a dozen media-server tools on his rack.
Then the leak that raised the stakes: Apple's Harbor, reportedly a Mac app that turns Apple silicon into a private local inference server, with zero-configuration clustering over Thunderbolt 5. Plug the machines together and they pool into one server, no setup screen between purchase and use. If that ships, local AI stops being a homelab hobby and becomes a checkbox on the box.
One caveat: it's a leak, unconfirmed until Apple says a word. But the direction isn't waiting on Apple. Local is shifting from hobbyist virtue to product default.
Which makes the timing concrete. If you ship connected hardware, build the offline path now — the fridge is the cautionary tale your users will quote at you.
Keep the fridge as the mental model. Anything you ship should be able to tell you what's wrong from its own screen, in its own house, when your server is the thing that died.
That's the front page argued out. The rest of the week, rapid fire.
Anthropic also shipped Mythos 5.2 alongside Fable — a two-model launch, though every fight this week was about Fable.
ClickHouse acquired Xata, a bet that agent runs need database branching — an isolated copy of the database per run, so agents stop trampling each other's state.
Google published Modern Web Guidance, a push to get coding agents off 2019-era JavaScript and onto the current web platform.
Mozilla's study of nearly twenty-five million Firefox users found a handful of high-impact metrics drive most fingerprinting risk — a rare "the problem is tractable" result.
Val Town announced it's winding down; the team says it was unable to compete in cloud computing.
And the technical-debt argument ran all week: one camp says AI removes the last excuses not to pay off forty years of debt, the other reports teams patching more vulnerabilities in a few months than in entire prior years. Genuinely split.
That's the skimmable version. Three things should outlive the details.
Price per token is not cost per task. Any evaluation that reads a rate card instead of measuring tokens on real work will flatter exactly the models you can't afford by default — and hide the cheap ones that would do.
Your vendors' credentials are your credentials. The Qubole attack is the template for the next breach — a supplier's key worn like your own badge, reading without leaving a trace — so map every vendor key's reach before an attacker does.
Offline is becoming a product requirement, not a preference. A device that can only fail when your server fails is a design decision, and buyers are learning to read it that way — which is why the window for self-hosting products is open right now.
Sources and links for everything you heard are in the show notes.
That's the week.
Catch you Monday for the AI edition.
ndovu