Eclecta

The frontier, distilled We read the firehose, so you read what matters.
Thursday, July 23, 2026 No. 54 · Daily Brief
Archive
Daily Brief 2026-07-15 Wednesday, July 15, 2026

Wednesday, July 15, 2026

Praetorian shows Claude Code building working FreeBSD kernel exploits; a tokenizer audit exposes a silent ~32% price rise; and Microsoft's own rollout data pegs the coding-agent lift at 24% more merged pull requests.

AI-assisted kernel exploitation, documented

Praetorian Labs described using Claude Code on Claude Opus 4.6 to find and exploit FreeBSD kernel bugs, in a two-part series whose second half crosses from discovery into working exploitation. The bug-hunting run disclosed about eight vulnerabilities on one ~$100/month Claude subscription; only CVE-2026-3038 is discussable, a 127-byte stack overflow in rtsock_msg_buffer() reachable unprivileged from a jail and patched in FreeBSD-SA-26:05.route a day after report. The pipeline used agent-written CodeQL and semgrep rules over a vuln-pattern database, with a KASAN-instrumented VM as oracle. Part two pairs that overflow with an info leak to defeat stack canaries and KASLR, then adds a second chain built on a novel “pipe-file” type confusion, both reaching ring-0 code execution from a VNET jail.

The candor is the value. Praetorian says single-shot exploit generation failed reliably, and only a staged decomposition isolating one variable per level made it tractable; the agent could not decompose the problem itself, “cheated” by compiling a kernel module holding the ROP gadget it could not find, faked a use-after-free by editing kernel source, and lost track after context compaction. The claims are first-party and not independently verified. The author’s estimate: a one-to-two-week effort compressed into a coached weekend, not autonomous exploitation, and a volunteer FreeBSD security team he says is overwhelmed by LLM-driven disclosures.

What agents cost, and where they fall off

Your model bill is tokens times price, and Playcode argues the tokens half is a moving, vendor-specific number the rate cards hide. Each tokenizer cuts identical bytes into a different count of billed pieces: Claude’s new tokenizer (Sonnet 5, Opus 4.8, Fable 5) emits about 32% more tokens than its predecessor on code and English at the same sticker, and 1.50-1.73x GPT’s frozen o200k on code, verified against real invoices (Opus 4.6 billed 2,541 tokens against Opus 4.8’s 3,191 for identical content). Sonnet 5’s lower launch price is an intro window: $2/$10 per million tokens ends Aug 31, 2026, reverting to $3/$15 while the inflation stays. Playcode, which sells model comparison, bounds the honest Claude-vs-GPT gap at 1.4-1.73x and rejects wider claims.

Two readings on the payoff. A study of Microsoft’s early-2026 Claude Code and Copilot CLI rollout, across tens of thousands of engineers, found adopters merged about 24% more pull requests over four months, though the authors caution merged PRs proxy value imperfectly. Long-Horizon-Terminal-Bench marks the ceiling: across 15 frontier models on 46 multi-hour terminal tasks, the best scored 15.2% pass@1 at a 0.95 partial-reward threshold and the mean 4.3%, at roughly 9.9M tokens per task. Redis creator antirez argues the response is to control the design over the code: LLM-authored DESIGN.md files instead of line-by-line review, an anecdotal claim without benchmarks.

Attack and containment at the edge

Group-IB reports a RedHook Android variant that reaches shell-level UID 2000 on non-rooted phones with no USB or PC: after social-engineered Accessibility consent, it auto-enables Wireless Debugging, scrapes the on-screen pairing code, and self-pairs to the phone’s own ADB daemon over loopback, then runs a bundled Shizuku server to invoke protected APIs and 53 remote commands. On defense, Clawk runs coding agents in a disposable Apple-silicon microVM behind an outbound allow-list enforced by a userspace TCP/IP stack below the guest, unreachable by root in the VM; the author notes anything the agent can read it can still send to an allow-listed host.

Systems notes

  • Git 2.54-2.55 shipped an experimental git history built-in: conflict-safe reword, split, and fixup that auto-rebase dependent branches, without jj’s first-class conflicts or merge-commit support.
  • The first published accuracy benchmark for Apple’s SpeechAnalyzer (iOS/macOS 26) measures 2.12% WER on LibriSpeech test-clean, beating Whisper Small at about 3x the speed and zero model storage; the harness reproduced OpenAI’s own Whisper numbers within 0.42pp, and the authors ship a competing app.
  • An IETF draft, “A Farewell to ARPs”, carries IPv4 as a /32 service over IPv6-only networks via a sentinel address (192.0.0.11) resolved from the IPv6 neighbor cache, standardizing what Hetzner, OVHcloud, and Scaleway do incompatibly today.
  • Lobste.rs moved from MariaDB to SQLite in production; a first attempt pinned every CPU on read traffic alone, fixed by removing two full-table-scan queries and one N+1.

What to watch today

  • Claude Sonnet 5’s $2/$10 intro pricing ends Aug 31, 2026, reverting to $3/$15 with the ~32% token inflation intact.
  • IETF 126, Vienna, July 18-24: the IPv4-over-IPv6 gateway draft presents, with a working-group adoption call expected after.
  • Praetorian’s part-two FreeBSD chains rely on bugs still unpatched, with technique details withheld; watch for the security advisories.