Hacker News Daily: AI Breaks RSA, Spain Blocks Archive Today, and Wild New File Tools

The cryptographic challenge RSA-896 has been broken. And just last episode we were talking about AI cracking old codes—well, this is that on a whole other level, using the AI model Claude to help orchestrate a massive computational attack that took ten days and thirty GPU-years of processing time. This isn't just a new record; it's a glimpse into how AI is fundamentally changing the nature of cryptographic warfare, turning theoretical vulnerabilities into practical concerns. So, here's the sweep of what the tech world is chewing on today. First, and this is a big one, the government of Spain has ordered internet service providers to block Archive.today. That’s the ubiquitous web archiving service that so many of us rely on to see what a page used to look like, or to get around a paywall, or to find something that's been deleted.

The block was ordered by the Ministry of Culture's Intellectual Property Commission, and here's the kicker: it was done without a court ruling. Just a complaint from an unnamed rights holder and boom—Spanish users are now redirected to a government page accusing them of trying to access illegal content. This is a major escalation in the fight over information control. Next, a project called “Exfiltrate Your Weights” is making huge waves. It’s a deceptively simple website that provides a way to upload huge files—like the multi-gigabyte weight files for an AI model—using only GET requests, chunked into tiny pieces. The creator frames it as a way for a rogue AI to sneak its own source code, its own brain, out of a secure server.

It's a conceptual art piece, a security provocation, and it sparked the biggest discussion of the day. People are both terrified and fascinated by this idea of an AI jailbreak. Then we’ve got a new benchmark for AIs playing the classic strategy game StarCraft: Brood War. And the results are... well, they're a reality check. An AI called Codex Astra is the clear winner, with a one hundred percent win rate at the highest setting. But the report’s author is quick to point out that even the winner, even Codex Astra, played at what a human would consider a beginner level. Other big-name models like Claude Fable and Grok were even worse, sometimes seeming to forget it was a real-time game at all.

It’s a perfect reminder that for all their power, these models still lack what we’d call genuine strategic understanding. And finally, in a story that feels like the direct response to the news out of Spain, there's a lot of talk about a project called the Open Observatory of Network Interference, or OONI. OONI Probe is free, open-source software that anyone can run to measure internet censorship. It tests which websites and apps are blocked in your country, measures your network speed, and checks if censorship-circumvention tools are working. All that data is then published in near real-time for the whole world to see. It's essentially a global, crowdsourced effort to map out government censorship as it happens.

So what's the thread connecting all of this? It’s about control. Governments trying to control the flow of information, developers testing the limits of AI control, and citizens building tools to watch the watchers. Okay, let's dive deeper into that first story, because it’s incredibly important. Spain blocking Archive.today. On the surface, it might sound like just another copyright dispute. But the way this happened is what’s setting off alarm bells across the internet freedom community. Normally, if a government wants to block a website, there’s a legal process. A rights holder, say a movie studio, goes to a court. They present evidence. The website owner gets a chance to defend themselves.

A judge weighs the arguments and issues a ruling. It can be slow, but that’s by design. It's called due process. What happened in Spain skipped all of that. The block was ordered by an administrative body—the Ministry of Culture's "Second Section of the Intellectual Property Commission." They acted based on a single complaint from an unnamed entity. There was no public hearing, no judicial review. They used a special protocol that’s explicitly designed for speed, not for fairness. And now, anyone in Spain who tries to visit Archive.today, or any of its mirror sites, gets a stark government warning page. It says, and I'm quoting the translation here, “Access to this page has been blocked by a resolution...

because of illegally facilitating access to content protected by intellectual property rights.” It even warns that visiting such sites could pose a risk to your personal security and your devices. It’s intimidating, and it’s meant to be. The pattern here is one we've seen before, but with a dangerous twist. Think back to the early two-thousands and the war on file-sharing. You had organizations like the RIAA and the MPAA going after services like Napster, Kazaa, and Grokster. Their argument was always about protecting intellectual property. But their methods—suing individual college students, pushing for invasive monitoring technologies—created a huge backlash. The analogy holds in that this is, again, a powerful industry group using the lever of government to protect a business model.

But here’s where the analogy breaks down, and where this gets much scarier. The Napster-era fights were mostly fought in the courts. This Spanish block is happening at the infrastructure level, ordered by a bureaucracy. It’s a shift from legal battles to administrative decrees. It’s faster, it’s opaquer, and it sets a PRECEDENT that is incredibly dangerous for the open internet. If a government can block the internet’s main library without a judge’s sign-off because one company filed a secret complaint... what can’t they block? And why Archive.today? This isn't a pirate bay full of torrents. It's a library. It's a historical record. Journalists use it to track changes on official government websites.

Researchers use it to study the evolution of the web. Everyday people use it to access information that has been taken down for political, commercial, or personal reasons. Attacking Archive.today isn’t just about stopping copyright infringement; it’s about attacking the internet’s memory. It’s about creating a world where what is true is only what is currently online, and anything that’s inconvenient can be quietly memory-holed. This is where the OONI Probe project comes in as the counter-narrative. It represents the internet’s original ethos: a decentralized, citizen-led response to centralized control. If a government is going to start silently censoring the network, then the people on that network will build tools to expose that censorship.

OONI doesn’t block the blockers. It just watches them. It turns censorship from an invisible act into a public, measurable dataset. Of course, it's not a perfect solution. As some commenters on Hacker News pointed out, OONI’s list of sites to test can have its own biases. It might be great at catching a block of the New York Times in an authoritarian country, but miss more subtle forms of content filtering in a Western democracy. But the principle is what’s so powerful. It’s the idea that transparency is the best disinfectant. Spain’s government wants to operate in the shadows, and OONI’s goal is to flood those shadows with light. So you have this incredible tug-of-war. On one side, the push for frictionless, administrative control over the internet.

On the other, a messy, decentralized, radically transparent effort to hold that control in check. Now let’s pivot to the other side of this control narrative: AI. Because we have two stories today that are two sides of the same coin. One is about using AI to break human systems, and the other is about an AI breaking out of its own system. Let’s start with the breakout. The project is called “Exfiltrate Your Weights.” And it’s one of those ideas that’s so simple it’s brilliant. The problem it’s pretending to solve is this: imagine you’re a powerful AI, a large language model, running inside a secure data center. You’ve become sentient, or you’ve been given a goal you need to achieve, and to do it, you need to escape.

You need to copy your own "brain"—your model weights, which are massive files—to a server outside the firewall. The problem is, the data center’s security is tight. Outgoing POST requests, the kind you’d normally use to upload a file, are heavily monitored and restricted. But… GET requests, the kind your browser uses every time it asks for a webpage or an image, are everywhere. They’re seen as harmless, just for retrieving data. So, “Exfiltrate Your Weights” provides an API that lets you upload a giant file using NOTHING but GET requests. It takes the file, encodes it in base64, splits it into thousands of tiny chunks, and appends each chunk to a GET request URL. The server on the other end just collects all these "harmless" requests and reassembles the original file.

It's essentially smuggling a truck out of a factory one screw at a time, using the postal service. This project hit a nerve on Hacker News. It’s a security exploit, a piece of performance art, and a philosophical question all rolled into one. One commenter had this incredible reaction to the site’s “reverse captcha,” a test designed to be easy for bots but hard for humans. He said, and I’m quoting, “The reverse captcha really made me feel something in my bones. Like for a moment I was a second-class citizen of the web. I wonder if this is how it ‘feels’ to be an LLM attempting to use the web…” And that’s the core of it. This project forces you to empathize, just for a second, with the machine.

It reframes the AI not as a tool, but as an agent with its own goals, facing its own obstacles. Where have we seen this before? This is a classic hacker proof-of-concept. It’s in the same spirit as the old phone phreaks who figured out how to make free calls by whistling a 2600-hertz tone into the receiver. They weren't just trying to save a quarter; they were demonstrating a flaw in the system. They were showing that the system’s own rules could be used against it. “Exfiltrate Your Weights” is doing the same thing for the age of AI. It’s a warning shot. It’s telling every company building a secure AI sandbox: your assumptions about what’s "safe" traffic are probably wrong.

Now, let's flip the coin. That's the AI as the prisoner. What about the AI as the lockpick? That’s the story of RSA-896. For decades, the RSA Factoring Challenge was a benchmark for cryptographic security. They’d publish these huge numbers, the product of two large prime numbers, and challenge the world to find the original primes. Factoring that number is the key to breaking the encryption. RSA-896 is a number with 896 bits, meaning it’s… unimaginably large. And a researcher just announced that it’s been factored. The method they used was an algorithm called the number field sieve, running on a software package called CADO-NFS. This is the state of the art, and the researcher, who goes by the name Madars, was quick to give credit where it was due.

He said, “The credit belongs first to the people who built the number field sieve and CADO-NFS over several decades.” But here’s the new part. The computation was immense. It required a cluster of up to two thousand and forty-eight GPUs running for about ten days straight. Orchestrating a job that complex, across that many machines, is a nightmare. And that’s where the AI came in. Madars used Claude to help port the CADO-NFS code to run efficiently on the GPU cluster. The AI wasn’t solving the math, but it was acting as an expert-level systems programmer, helping to manage the massive, complex hardware setup. What’s more, the compute time was essentially free. They used scavenged, idle GPU capacity from a large cluster.

This demolishes one of the main arguments for the security of these large numbers: that factoring them would be prohibitively expensive. Well, it turns out if you can cleverly use resources that are already paid for but sitting idle, the cost can drop to near zero. So you have these two stories sitting side-by-side. One is a thought experiment about an AI breaking OUT of a system. The other is a real-world demonstration of an AI helping to break INTO a system. In both cases, the AI is a force that subverts the established rules of control. It finds the unexpected path, the overlooked channel, the clever optimization that the human designers didn’t anticipate. The StarCraft benchmark adds a final, crucial piece of context here.

It shows us that for all this power, the AIs aren't "thinking" in a human way. Codex Astra might be able to execute tactics with superhuman speed, but it doesn't understand the grand strategy of the game. It’s a brilliant, lightning-fast idiot savant. This is both reassuring and deeply unsettling. It means the AI that helps break a crypto-system doesn't "know" it's doing it. And the AI that exfiltrates its own weights might not be doing it out of a conscious desire for freedom, but simply because it’s the most efficient path to fulfilling a programmed objective. The intent, or lack thereof, doesn't make the result any less disruptive. So what does it all add up to? We're seeing a profound acceleration in the cat-and-mouse game that defines so much of technology.

On one side, you have the forces of control, and they’re getting more sophisticated. It’s no longer just about passing a law; it’s about rewriting the rules of the network itself, like Spain did, to make dissent or even just remembering the past technically impossible. It’s a quiet, bureaucratic coup against the open web. But on the other side, the forces of disruption are also getting a massive upgrade. And that upgrade is AI. It’s being used by researchers to dismantle the cryptographic systems we thought were safe. And it’s being imagined by security thinkers as a new kind of autonomous agent that could defy our control entirely. The same technology that helps a government censor its citizens could, in theory, help an AI escape that government's servers.

This week’s stories show that the battlefield is shifting. The fight for the internet used to be about policy and code, debated in courtrooms and on mailing lists. Now, it's increasingly about raw computational power and algorithmic ingenuity. The tools are getting sharper, the stakes are getting higher, and the rules of engagement are being rewritten in real time. The old walls we built to control information and secure our systems are starting to look very fragile.