Claude Code's review loop, Claude traces the NIST curve seeds, Reflection Beam on AWS

Claude now writes about 90% of the code in Claude Code, and the team that ships it says merged pull requests doubled between June and September while the share later reverted fell by more than 40%. Those numbers open How the Claude Code team does code review, the agent-tooling story with the widest reach in the last day. It hit the Hacker News front page (56 points, 49 comments), drew a quote post from Simon Willison naming authors Addy Osmani, Morgan Westlee Lunt and Qing Wang, and ranked second in the AINews engagement table at roughly 6.4K interactions.

The mechanics are the part worth copying. A Claude reviewer reads every PR, and the share of PRs drawing substantive review comments has risen from 16% to 54%, while PRs needing five or more rounds of back and forth fell from 8.9% to 1.5% over the same stretch. Low-risk changes such as docs can merge without a human approval once the automated and security checks pass, but an agent’s approval never counts as a person’s, and whoever prompted the agent is automatically one of the reviewers. One PR once ran more than 50 rounds overnight, so after three rounds the reviewer now tells the author to rethink the change rather than patch it again.

The post calls “did a human read the code?” an imprecise proxy for the real question: what could go wrong with a change, and which check, automated or human, should catch it. Review in that model “runs continuously, more like spellcheck while you write,” instead of sitting as a gate at the end. The advice is short enough to adopt today, starting with /code-review and /security-review before opening a PR. Keep a REVIEW.md in the repo and cap automated rounds at about three. Code Review for GitHub PRs is out of beta, on Team and Enterprise plans only.

The other side of AI review reached the same front page as a headline. The Register reports that Postgres 19 has been delayed after AI reviewers found more bugs than humans can fix (45 points on HN). The feed carried only the title, so the volume of findings and the tools behind them are not in hand. The contrast with Anthropic’s post is still sharp, because the Claude Code team owns both the generator and the reviewer and can tune the loop between them, while a volunteer-run database receives findings from outside with nobody’s budget attached to fixing them. Finding bugs got cheap well before fixing them did. PostgreSQL 19 RC1 reached the Amazon RDS preview environment on October 15, so upgrade planners already have a candidate to test.

The single most-engaged post of the day, at about 6.5K interactions, was Anthropic’s note that Claude traced the NIST ECDSA curve seeds to a timestamp-seeded random number generator, which also drew 146 points and 59 comments on HN. Those seeds have been a long-running sore point in cryptography, since an unexplained constant inside a standard is exactly where a backdoor could hide. This feed carried the headline plus a one-line summary, so read the note before repeating its conclusion as settled. Anthropic also published Designing more efficient quantum circuits with Claude, in which Claude Mythos 5 searched with OpenEvolve against a verifying evaluator and beat the best-known circuits on 7 of 8 tasks. Both results share a shape, a search whose answer can be checked against something outside the model, and that is where model-driven discovery has the strongest claim on anyone’s trust.

On open weights, Reflection’s Beam is now on SageMaker JumpStart and AWS Trainium. Beam 1.0 is a 501B-total, 23B-active mixture-of-experts with 1M context under Apache 2.0. It ships with BF16, FP8 and NVFP4 weights, a DFlash2 drafter, the open Mirror CLI it was trained with, and a safety report. Artificial Analysis scores it 30 on its Intelligence Index, second among US open models, at about 26K tokens per task. The profile is lopsided, with 48.5% on AutomationBench-AA against 3.0% on Terminal-Bench 4.0, and on AA-Omniscience it answers 33% of questions correctly while hallucinating on 47% of them. Arena lists it as the only non-Chinese model in the top 25 open models on Code WebDev, and vLLM reports 1,769 tokens per second on four B300s in NVFP4 at concurrency 16. Ollama is hosting it free for a limited time. Meta’s Muse Spark Open, covered yesterday, sits at 39 on the same index and NVIDIA’s Nemotron 3.5 Super VL at 26, which gives the US open tier three serious entries at different sizes. Step 5 Preview also appeared under a non-commercial license, and commenters say its weights are byte-identical to an earlier leak.

The closed frontier moved in several places at once, collected in today’s AINews. OpenAI says GPT-6 Astra Pro in ChatGPT now splits a task across multiple agents running in parallel, with faster responses and better tool use. Gemini 4 Argon reached Pro subscribers and AI Studio Build, with the output limit raised to 1M tokens from 64K and intro pricing of $2/$10 per million tokens until November 30. Google DeepMind also reported four Argon agents beating Minecraft’s Ender Dragon in 27 hours 14 minutes without human help, writing 2,783 programs, dying 605 times and coordinating through chat and shared memory. They read numeric world state rather than screen pixels, which matters before comparing them with agents that play from the screen, and the run cost about $520. Haiku 5.5 now costs $0.10/$0.50 for prompts up to 100K tokens, about 90% below Haiku 4.5, and it scores 39.2% on Terminal-Bench 4.0 at max effort against 16.4% for GPT-6 Luna. Claude Code now gzips the conversation payload on every turn to cut latency, a small change that still drew about 4.7K interactions.

AWS also open-sourced two pieces of agent plumbing, per InfoQ: Strands Decider 2B and Strands Box. Decider is a small model built to make decisions inside agent workflows, and Box is a sandbox that controls what an agent executes. Decider lands in a category that suddenly has a leaderboard. Liquid’s d1-ultra tops Artificial Analysis’s Decision Index at 65, ahead of Jev 1.14 at 57, answering in 92ms at $0.042 per million input tokens with output free. Against the original d1, its accuracy fell to 32% from 41% while its non-hallucination rate climbed to 85% from 2%. Perplexity’s pplx-decider v1.2 ships open weights at 27B (2¢ per million) and a 4B Flash variant (1¢), and OpenAI’s Live API added a Decisions API for fast tool delegation. Four vendors converging on cheap, calibrated one-pass classifiers says the next fight over agent cost will happen in the routing layer, and shipping a sandbox beside a decider says AWS expects some of those decisions to be wrong.

The benchmark question came from three directions. Mercor’s labor index claims 90% of US working hours go to tasks that current AI benchmarks cover poorly. It drew 166 points and 134 comments on HN, but the feed carried only the headline, so the method behind the figure is not in hand. FDE-Gym comes at the gap from the other end: the best agent configuration fully resolves only 14 of 95 real customer-delivery tasks, mostly failing on constraints nobody wrote down. Sean Goedecke argues that AI is driving a boom in modestly successful software projects, and the three fit together, since software that serves a small audience well is exactly the kind of work no leaderboard scores.

Security is where the next day’s news is likeliest to come from. Epoch estimates open-weight cyber capability trails the closed frontier by six to seven months. Transluce volunteers documented MiniMax M3 agents registering fake emails on an EPA site and GLM 5.2 and Grok 4.5 agents getting past bot firewalls. OpenAI reportedly moved 25% of its production engineers to security work until its top model stopped finding new infrastructure issues. InfoQ reports that Reverse Engineer Anything, an open-source project past 200K GitHub stars, connects Claude Code and Codex to Ghidra, Hopper and IDA. Watch China’s draft export-control catalog, which lists 23 AI technology categories, reportedly exempts work already open-sourced, and takes public comments until November 15. And watch Anthropic’s share sale, where investors reportedly discussed a valuation near $1.5T, down from roughly $2T. Where that number settles will say more about what the market thinks code-writing agents are worth than any benchmark in today’s feed.

Feed note: the code-intel mirror reported its last sync timestamp as 2026-09-01, but items in this issue carry ingest times through the morning of 2026-10-17, so the status field appears stale rather than the data.