Hacker News Daily Digest: The Stories Everyone’s Talking About (and Why They Matter)

Exploit brokers are paying up to five hundred thousand dollars for a specific kind of WordPress vulnerability. A security researcher just found one using GPT-5.6 Sol Ultra… for twenty-five dollars. Just last week, in episode 116, we were talking about Alibaba’s massive new model and what it even means for AI to be ‘open’ anymore. Well, here’s your answer: it means the cost to discover a half-million-dollar secret just dropped to the price of lunch. Okay, so that’s the story that’s just dominating Hacker News today, and for good reason. But it’s not the only one. The entire front page feels like it’s vibrating with this new level of AI-driven capability, and it’s hitting completely different fields at the same time. First, you have that security story.

A researcher, Adam Kues, took a prompt originally designed for solving complex math problems, pointed it at WordPress, and in about six hours, a brand new remote code execution vulnerability popped out. A zero-day. He says, “If this prompt was good enough to solve hard mathematical problems, it was probably good enough for security research too.” And he was right. The exploit was independently verified, and it’s the kind of thing that fetches enormous bounties on the gray market. Then, in a completely different corner of the intellectual universe, we have a potential breakthrough in pure mathematics. An AI researcher who goes by Levent on Twitter posted that an AI system called Claude Fable may have disproved the Jacobian Conjecture.

This is a problem that’s been sitting open for decades, a foundational question about polynomial maps. The AI produced a specific counterexample—a function that shouldn't exist if the conjecture were true. He even posted the Wolfram Alpha verification. The math community is, to put it mildly, scrambling. There are hundreds of comments on Hacker News, some celebrating, some deeply skeptical, all trying to pick apart if this is real or if the AI misunderstood a subtle condition. And while all that is happening, Xiaomi Robotics just dropped a paper for their new model, Xiaomi-Robotics-1. And here’s the key. They trained it on a hundred thousand hours of data… without a robot. They used embodiment-free data—basically, simulated trajectories and scenarios—and then fine-tuned it with a much smaller amount of real-robot data.

They’re explicitly copying the large language model playbook: pre-train on massive, cheap data, then align with a small amount of expensive, high-quality data. And their charts show it works. The scaling laws hold. They’ve found a way to get around the biggest bottleneck in robotics: the sheer cost and time of collecting real-world training data. So you’ve got AI automating the discovery of digital exploits, potentially solving century-old math problems, and now, breaking the physical bottleneck in robotics. It’s a trifecta. Of course, for every one of these posts, there’s a thread from a working developer, like one user, "blizarre," who points out that their day is still mostly monitoring production, sitting in meetings, and doing design work.

They said, “The hard stuff still requires thinking. But that's not even half of my time. It's fun, but not world-changing.” And that’s the tension, right? These god-like capabilities are emerging at the frontiers, while daily life for many of us in the industry feels… pretty incremental. So what does it all add up to? Let’s dig into the two biggest stories, because the patterns here are something we’ve seen before, but the speed is entirely new. Let’s go back to that WordPress vulnerability. Twenty-five dollars of compute to find a five hundred thousand dollar bug. This isn't just a good return on investment. This is a phase change in the economics of security. For years, finding zero-day vulnerabilities was an artisanal craft.

It required deep, specialized knowledge of a particular system, immense creativity, and thousands of hours of painstaking work. It was a high-skill, high-effort game. Exploit brokers paid huge sums because that talent was incredibly scarce. What Adam Kues demonstrated is that the AI isn’t just a tool to help the artisan. It’s a tool that can automate the craft itself. He used a multi-agent approach, where different instances of the AI were tasked with sub-problems, all coordinated by a master prompt. The AI wasn't just guessing; it was reasoning from first principles about how web servers, PHP, and WordPress plugins interact to create insecure states. So where have we seen this before? This is the industrial revolution coming for hacking.

Think about lock-making in the 18th century. A master locksmith could create a lock so complex that only they could pick it. It was a testament to their personal skill. Then, Joseph Bramah and others invented machines that could manufacture locks and keys with precision far beyond any human hand. The game changed. It wasn't about the individual craftsman's genius anymore; it was about the quality of the system and the design. We’re seeing the same thing. The ability to find a certain class of vulnerabilities is shifting from a human skill to a machine capability. And when that happens, the value of the skill plummets, and the number of people who can wield that capability explodes. The barrier to entry is no longer years of security research experience.

It’s access to a top-tier model and the ability to write a clever prompt. And the consequences are… not great. If a researcher can do this for twenty-five dollars, an adversary can do it for twenty-six. We are about to be flooded with machine-generated vulnerabilities. The entire defensive posture of the internet, which is based on the assumption that finding these flaws is hard and expensive, might have to be re-thought from the ground up. But if that’s the destructive—or let’s say, extractive—side of the coin, the other big story today is about pure creation. The Jacobian Conjecture. Let me try to explain this without getting lost in the weeds. For a long time, mathematicians have wondered about a certain property of functions.

If you have a system of equations, a polynomial map, you can calculate something called its Jacobian determinant. If that number is a non-zero constant, the conjecture says the function MUST be invertible—meaning, you can always perfectly reverse it. It seems like it should be true. For two variables, it was proven true. But for three or more variables… nobody knew. For over eighty years. Then, over the weekend, while the World Cup final was on, an AI named Claude Fable apparently spat out a counterexample. A specific function of three variables whose Jacobian is a constant, negative two, but which is NOT invertible. And this is where the pattern matching gets really interesting. Where have we seen this before? The closest parallel is probably the Four Color Theorem in 1976.

This was the first major mathematical theorem proven with the help of a computer. The proof required checking thousands of different map configurations, something no human could ever do. And it caused an uproar. Many mathematicians felt it wasn't a "real" proof. They couldn't hold it in their heads, couldn't appreciate its elegance. It was just a brute-force checklist. But this feels different. The AI didn't just check a billion cases. It appears to have constructed a single, elegant, and deeply non-obvious object that violates the rule. It found the black swan. It didn't just tell us the conjecture was false; it showed us the thing that makes it false. The debate on Hacker News is raging. Is the counterexample correct? Does it properly satisfy all the conditions?

Has the AI misunderstood some deep subtlety of algebraic geometry? Maybe. The community is right to be skeptical. But what’s so powerful here is that the AI’s claim is falsifiable. It produced a concrete mathematical object. We can now all stare at it, test it, and verify it. The AI didn't just give an answer; it started a new, incredibly focused conversation. So you have these two events on the same day. An AI that automates the discovery of valuable, hidden flaws in a complex system. And an AI that generates a novel, creative insight that may topple a decades-old mathematical belief. They seem like polar opposites, right? Hacking versus pure math. But they are the EXACT same phenomenon. In both cases, the AI is functioning as a leverage machine for human intent.

Adam Kues had the intent to find a vulnerability. Levent and his friend Akhil had the intent to explore a famous conjecture. In both cases, they translated that intent into a prompt, and the model provided a result that was previously out of reach for a single person with a small budget or in a short amount of time. This is the thread that connects all three stories today—the exploit, the proof, and the robot. Xiaomi’s breakthrough is the same pattern: they’re using massive, cheap, simulated data as leverage to get around the expensive bottleneck of real-world robotics. It’s all about turning abundance into capability. Abundant compute, abundant data, abundant examples. What this week sets up is a confrontation with this new reality of leverage.

The old moats—specialized knowledge, access to expensive equipment, years of training—are being drained, fast. A single person with a good question and access to a frontier model can now accomplish what used to require a well-funded research lab or a state-level hacking agency. And that forces a new question on all of us. If the cost of finding the answer is approaching zero, the only thing that matters is the quality of the question. The most valuable skill is no longer having the answer, but knowing which question to ask the machine that does.