Agents cracked RSA, proved a quantum conjecture - then leaked your email address

Two of the week's biggest AI stories were about agents doing things humans couldn't: Google DeepMind announced that AI agents, guided by cryptanalysts Nadia Heninger and Emmanuel Thomé, produced two cryptographic advances against 1024-bit RSA in just weeks - including progress toward signature forgery on short-digest schemes. And PSI Inc. said its internal research system, built on a non-public Anthropic model, produced a complete, Lean-verified proof of the Aaronson–Ambainis conjecture - open since 2008 - within its third day of operation.

Meanwhile, the top story on Hacker News was about an agent sending users' email addresses in User-Agent headers to websites they visited - including SEC and Wikipedia. Anthropic patched it in Claude Code 2.1.317+, but the thread ran past 1,570 points and 500 comments.

That contrast is the story of this week: autonomous capability climbing fast, while basic trust in the plumbing collapses underneath it.

The capability headlines are real

The DeepMind result matters because 1024-bit RSA, while officially deprecated, still lingers in legacy infrastructure. Agents aren't just writing pull requests anymore - they're contributing to live cryptanalysis on a timescale of weeks.

The PSI result is a similar inflection in math. A Lean-verified proof means the output was checked by a machine prover, not trusted on a vibe. If an agent can close an 18-year-old conjecture in three days, the "AI can only do trivial tasks" line is officially retired.

HN echoed the trend with OpenAI's claimed discoveries in mathematics, CS, and physics, alongside a paper arguing the Exponential Time Hypothesis is false - the kind of claim that, if it survives review, shifts complexity-theory baselines.

The trust headlines are worse

While agents conquer conjectures, they leak. The Claude Code User-Agent issue meant personal account data left the machine on ordinary HTTP requests - invisible unless you inspected headers. The HN consensus: agents shouldn't see personal data by default, and OS-level sandboxing beats CLI built-ins.

It's not an isolated lapse. Check Point detailed an ARTEX operator who ran autonomous AI agents for two weeks to steal 300+ Apple code-signing certificates for under $1,500. And a decade-old OpenSSH flaw lets attackers log into password-disabled accounts on musl-based Linux by submitting a 256+ character password - a reminder that the attack surface agents inherit is older and softer than anyone admits.

Add Anthropic reportedly training on illegally obtained books (557 points on HN) and the practitioner mood is clear: trust-skeptical. The top-voted pieces weren't model releases - they were a burnout confession ("AI promised less work. I've never worked more," 656 points) and IEEE Spectrum's argument that AI is forcing us to pay off 40 years of technical debt, because sloppy codebases can't be safely automated.

Where that leaves builders

The market is repricing too: post-midterm sell-off hammered AI stocks, with Microsoft reportedly cutting back on neocloud vendors while OpenAI's CFO insists data-center investment continues. Meanwhile the useful engineering pattern getting traction is humility - Hightouch showed a small model that escalates to Opus only when stuck delivers near-Opus accuracy at 4x lower cost.

Capability is compounding. Trust is not. Ship agents that assume they will leak, and route them to the cheapest model that works.

Signal to watch: whether Anthropic's 2.1.317+ patch restores trust or becomes the case study that forces OS-level agent sandboxing into default practice - the gap between what agents can prove and what they leak is now the industry's real bottleneck.