HN Daily | July 28, 2026

Today's tech landscape is buzzing with activity: OpenAI open-sources a security scanner, Kimi drops a massive open-weight model, and Anthropic's Claude discovers cryptographic weaknesses. Meanwhile, Go's new garbage collector and map internals get thorough examinations, and a groundbreaking HIV vaccine study offers real hope. Let's dive in.

AI & Machine Learning

1. OpenAI just open-sourced Codex Security — A new CLI and TypeScript SDK for finding, validating, and reviewing security issues in code. It integrates with your CI pipeline and can even patch findings, making AI-assisted security auditing accessible to everyone.

2. A walk through of the DeltaNet family of linear attention variants — A beautifully explained derivation of modern linear attention, from softmax through DeltaNet to Kimi Delta Attention. If you've ever wondered how these efficient attention mechanisms work, this post uses bra-ket notation to make it crystal clear.

3. Kimi K3 Architecture Overview and Notes — Sebastian Raschka breaks down the architecture of the new 2.8T parameter open-weight model. Key takeaways: it's a scaled-up Kimi Linear with LatentMoE, attention residuals, and NoPE everywhere — a first for a frontier-level model.

4. Discovering Cryptographic Weaknesses with Claude — Anthropic's Claude Mythos Preview autonomously found improved attacks on HAWK (a post-quantum signature scheme) and reduced-round AES. The HAWK attack effectively halves its key strength, though no production systems are affected.

5. Using an open model feels surprisingly good — A personal reflection on running Kimi K3 on a custom inference endpoint. The author describes the feeling of data sovereignty as "freeing" — a sentiment that resonates beyond the open-source faithful.

6. Benchmarking Opus 5 on SlopCodeBench — A new long-horizon coding benchmark reveals that even the best models struggle with evolving codebases. Opus 5 scored only 24%, and all models showed significant code quality degradation over time.

Open Source & Tools

1. Golang Maps: how Swiss Tables replaced the old bucket design — A deep dive into Go 1.24's map rewrite. The new Swiss Table design brings compact metadata, flatter probing, and dramatically better cache locality — less pointer chasing, fewer cache misses.

2. Zig's Incremental Compilation Internals — A core team member explains how Zig now achieves rebuilds in 50-70ms by caching ZIR and patching binaries directly. The key insight: treating file processing as a pure function makes parallelism and caching trivial.

3. MCP 2026-07-28 Specification: transport going stateless — The Model Context Protocol moves from bidirectional stateful to request/response stateless. Each request is now self-describing, enabling plain round-robin load balancing. Also introduces MRTR for mid-call user interactions.

4. Self-contained highly-portable Python distributions — Python builds that minimize runtime dependencies, with statically linked libraries and limited CPU instructions. Perfect for embedding Python in larger binaries or running on minimal systems.

5. XY – A Fast, composable, GPU-accelerated interactive plotting library — A new Python charting library that renders 10 billion points from OpenStreetMap. Its Rust core computes only what the screen needs, and it supports notebooks, web apps, and static exports.

Programming Languages & Runtimes

1. Watching Go's new garbage collector move through the heap — A visual exploration of Go 1.26's Green Tea GC. The article compares heap layouts between Go and C#, showing how Go's non-moving collector struggles with sparse pages.

2. How Do I Profile eBPF Code? — A practical guide to measuring eBPF performance using perf, with a C test harness for file open operations. Includes setup for JIT symbol resolution and flamegraph generation.

Security & Privacy

1. GrapheneOS Defends Data-Wiping Function That Blocked US Border Search — An activist used GrapheneOS's duress password to wipe his phone during a CBP search. The case tests the legality of such features, with GrapheneOS arguing they're protected by the Constitution.

2. Anthropic publishes a practical key-recovery attack on HAWK-256 — A companion demo to the Claude cryptanalysis research, showing a practical key recovery attack on the HAWK-256 signature scheme. The repository includes code and methodology.

Science & Research

1. New HIV vaccine shows unprecedented success in preclinical study — After 14 years of research, scientists have developed an HIV vaccine that generates broadly neutralizing antibodies in primates. Human trials have already begun.

2. Glue bonds to nonstick surfaces and wipes clean with ethanol — A new small-molecule glue called CyclicFP-fmoc bonds to Teflon with 1.3 MPa strength and can be removed with ethanol. The adhesive is reusable and leaves no residue.

Graphics & Visualization

1. Ray tracing massive amounts of animated geometry using tetrahedral cages — A new technique decouples animation cost from triangle count by using low-resolution tetrahedral cages. Demonstrated with 585 million animated triangles at 60 fps on an AMD RX 9070 XT.

Web Development

1. Removing React.js from the codebase and adapting Htmx for UI interactivity — A forum software project explains why they're replacing React with HTMX: simpler code, no duplication between Django templates and React components, and better performance on mobile.

Closing Thought

Today's stories share a common thread: the industry is moving toward simpler, more efficient foundations. Whether it's Go's map rewrite, Zig's incremental compilation, or the shift from React to HTMX, there's a growing appreciation for systems that do less but do it better. Sometimes the best innovation is rediscovering what worked all along.