Your shipped code is now readable

Games and software Lesson

Agents rebuilt a shipped game

A developer used a team of AI coding agents to turn a shipped game back into readable source code that compiles to almost exactly the original.

Functions that do not match go back to the agents. Result: about 99% of functions present, 83% byte-exact.

Maurice Heumann spent three months on it. Each source file became its own task, and a fleet of up to 16 agents worked through them, using an estimated 600 to 700 billion tokens. The game is not named and the code will not be shared.

The first month produced code that read well but was quietly wrong, and a reviewer agent did not catch it. What worked was a strict automatic check: compile each rebuilt function and compare it with the original, byte for byte. The agents could not edit that check, so they could not cheat it.

About 99% of the functions are back and 83% match exactly. Xbox's new Labs team named decompiled games among the experiments it wants to learn from, and indie developers are already making preservation ports.

83%of functions rebuilt byte for byte from the shipped binary

Technical details

Tooling: IDA connected through an MCP server, one GitHub issue per source file, and 14 Luna and 2 Opus 5.5 agents. CI hashed the verify script so agents could not change it, compaction was lowered to 42% of context, and the instructions were re-injected every hour.

Why it mattersTwo lessons in one result. For agent work: a strict pass or fail check lets cheaper models do expert work. For anyone shipping software: a binary can now be reconstructed, so secrets and authority belong on the server.

For youYour Fab plugins and demos ship as binaries, so assume they can be read: keep license checks and anything sensitive out of client code. And give your Claude Code loops the same kind of tamper-proof verifier.

decompile: Turning a compiled program back into source code a person can read and change.
source code: The human-readable instructions developers write, before a compiler turns them into machine code.
reviewer agent: An AI agent whose only job is to check another agent's work.
MCP: Model Context Protocol: a standard way to plug tools into an AI agent.
compaction: Summarising an agent's earlier conversation so it fits in its memory window.
tokens: The small chunks of text a model reads and writes; a token is roughly three quarters of a word.

Sources momo5502 Popcar Simon Willison Xbox Wire

More like this Less like this

Agents at work

How teams build and check things with AI agents, and what changed in their tools.

Games and software Lesson

Build the game so an agent can check its own work

If a game can replay the same match exactly and run without its graphics, an AI agent can test its own changes instead of waiting for a person to play them.

Kyle Kukshtel's talk-turned-post argues the best agent harness for a game is the game's own architecture: deterministic, replayable, and testable without the engine.

The text profile feeds the next turn. 168 points on Hacker News; the post shows no code, the loop is the lesson.

Why it mattersGames are hard for agents to test because the outcome is visual. A seeded RNG, a command log and gameplay code that runs headless turn that into a pass or fail signal an agent can work against.

For youThis maps directly onto your UE5 C++ plugins: a gameplay module with tests that run without the editor gives Claude Code a pass or fail signal instead of your eyes.

harness: The setup around an AI agent that lets it run, test and check its own work.
deterministic: The same inputs always give the same result, so any run can be replayed exactly.
replayable: A run can be recorded and played back step by step, identically.
engine: The software a game runs on, such as Unreal or Unity, which handles graphics, physics and input.

Sources Kyle Kukshtel

More like this Less like this

Software and AI Release For practitioners

Claude OpenTelemetry

Traces for the Messages API, tool runs and Managed Agents, sent to any OTLP backend. In beta.

Apps built on Claude can now report a step-by-step timeline of what each request did, to the monitoring tools teams already use.

It covers the Messages API, tool runs and Managed Agents, and it is in beta. You can switch it on in code with the official SDKs, or have an admin add a destination in the Claude Console.

Default: metadata_only, no prompt text
Content limit: 0.75 MB per span
Works with: Sentry, PostHog, Langfuse
Delivery: best effort
Status: beta, so pin the SDK version

Try itANTHROPIC_OPEN_TELEMETRY_TRACES_CONTENT_MODE=content

Technical details

Two sources. SDK tracing is set in code in seven SDKs (TypeScript and Python among them) and emits a span per request and per tool run. API tracing is a destination an admin adds in the Console, and it is the only one that shows each model run, Managed Agents turns and server tools.

Spans follow the GenAI conventions, so you can group a thread by gen_ai.conversation.id. In TypeScript, set propagation: false if you use @opentelemetry/instrumentation-undici, or a package bug sends two traceparent headers.

Why it mattersAgent apps can now send token, latency and tool spans to an existing observability stack in a few lines, and Managed Agents sessions become traceable end to end.

For youWire it into your Node and Supabase products, Polyglyph first: per-job token and latency traces will show where translation runs spend money.

OpenTelemetry: An open standard for recording what software does, step by step, so any monitoring tool can display it.
OTLP: OpenTelemetry's format for sending that data to a monitoring service.
beta: Released for use but still changing; details may break between versions.
SDKs: Software development kits: the official code libraries for calling an API from a programming language.

Sources Claude docs: SDK tracing API release notes OpenTelemetry overview

More like this Less like this

Software and AI News

Agents pass the tests, then ship the hole

When AI coding agents fix real bugs, their code usually works but is also secure only about a quarter of the time. Simply asking for secure code helps a lot.

A new benchmark gave agents 450 tasks built from 150 real security flaws in 7 languages, then checked the results with hidden tests for both function and security. Share of tasks that were both working and secure:

Functional pass rates were 73.6 to 91.3%. One added sentence asking for secure code raised the secure share by 15 to 21 points for three of four models re-run.

Why it mattersEven the best coding agent ships code that is both working and secure only a quarter of the time. An explicit security instruction helps, but data exposure and outbound URL fetches stay weak and still need a human look.

For youAdd an explicit security line to CLAUDE.md in your SaaS repos and keep reviewing data exposure and URL fetches by hand.

benchmark: A fixed set of tasks used to compare tools or models fairly.
security flaws: Mistakes in code that an attacker could use to break in or steal data.

Sources arXiv Code

More like this Less like this

Software and AI Do this For practitioners

Five changes to check in your setup

Five small tool changes from the last two days that can quietly break automated coding workflows, for anyone running AI agents or CI.

Show the details

Small changes from the last two days that can quietly change how your tools behave.

Hook edits are now validated
Since Claude Code 2.1.300, updatedInput from PreToolUse and PermissionRequest hooks is checked like Claude's own input: unknown keys are dropped and invalid input denies the call.
Idle compaction is on
A 200K+ token session left idle about 54 minutes is compacted before its cache expires (2.1.299). Turn it off with "idleCompaction": false.
GitHub blocks Anthropic keys
Push protection now rejects anthropic_service_api_key and anthropic_user_api_key by default, free public repos included. An agent that commits a .env will see the push fail.
Codex dropped GPT-5.5 for ChatGPT logins
Since Oct 14, scheduled jobs and configs that pin gpt-5.5 need gpt-6.1-sol. API-key sessions are unaffected; stable is still 0.162.1.
GitHub Apps can create repos without admin
The new repository_creation:write permission lets a bot scaffold repos without the delete and transfer rights of repository administration.

Why it mattersEach one can break or change an automation that is already running, so they are worth a minute before agents hit them.

For youCheck them against your Claude Code setup and the Radar routine first.

hooks: Scripts that run automatically before or after an agent acts, to check or block what it does.
compaction: Summarising an agent's earlier conversation so it fits in its memory window.
push protection: GitHub refusing a push that contains a secret such as an API key.

Sources Claude Code releases GitHub Changelog Codex changelog

More like this Less like this

Lock it down

Accounts, packages and devices that need a look.

Game dev News

Unity locks out accounts that missed a 2FA reset

Unity locked some developers out of their accounts, and with them their projects and purchased assets, after they missed an email asking them to reset two-step sign-in.

Accounts were suspended for "ongoing account security measures", and a suspended account loses its Hub sign-in, so projects and Asset Store purchases go with it.

Weeks before
Unity emails users to reset two-factor authentication. Several users say they never got the email.
Oct 13
The reset deadline passes.
Oct 14
Suspensions hit the forums; staff say they are aware. One user reports a release blocked and over EUR 1,000 of assets locked.
Oct 14
Unity's info post points to account recovery; staff say the two-week support wait "should be accelerated".

Why it mattersA missed security email can freeze an editor, purchased assets and a release. A minute checking 2FA and recovery codes on every engine and store account is cheap insurance.

For youCheck 2FA and recovery codes today on Unity, Epic, Fab and Steam, and keep one account per vendor that is not your daily login.

2FA: Two-factor authentication: signing in with a second proof, such as a code from your phone, on top of the password.
Hub: Unity Hub, the app that installs Unity and opens your projects; it needs your account signed in.
Asset Store: Unity's marketplace for models, tools and plugins that developers buy for their projects.

Sources Unity Discussions User thread

More like this Less like this

Software and AI Do this For practitioners

npm Trusted Publishing trusted the name, not the repo

A loophole could have let a stranger publish updates to someone else's JavaScript package after its project was renamed. It is fixed, but package owners should check their settings.

Show the details

Bloom Security found Trusted Publishing matched a repository by its owner/repo slug before the first publish, so re-creating an abandoned slug could earn publish rights for someone else's package. Over 1,500 packages were exposed; GitHub shipped fixes on Oct 2 and no exploitation was seen.

Check every binding
Confirm each trusted-publisher slug still points to a repository you control.
Recreate after renames
If a repo was renamed or transferred, delete the old binding and add it again.
Clean up
Remove bindings when a repo is deleted, moved or renamed.
Watch publishes
Alert on publish events you did not trigger, especially where agents pull latest versions.

Why it mattersAnyone publishing Node packages has a ten-minute audit to do: bindings are now tied to the immutable repo ID, and unvalidated ones expire after 48 hours.

For youRun the audit on any npm packages you publish before the 48-hour window closes.

npm: The main registry JavaScript packages are published to and installed from.
Trusted Publishing: Letting an automated pipeline publish a package without a stored password, by trusting one specific repository.
slug: The short owner/name path that identifies a repository, such as toamig/radar.

Sources The Hacker News CSO Online

More like this Less like this

Software and AI News

Anthropic tests whether small models can spread on cheap devices

Anthropic's red team tested how far small open-weight AI models, the kind anyone can download and run, can copy themselves onto other cheap devices and keep running there, without a datacenter.

Anthropic's diagram of four stages: network enumeration and initial access in a box marked not our focus, then inference setup marked our focus, then replication — Image: Anthropic

In a demo, Gemma4-26B-A4B ran split across 15 Android TV boxes at about $55 each, at 0.39 tokens a second. In a firewalled test network with open ADB, GLM-5.2 reached all 8 nodes in 4 of 5 trials; models of 30B or fewer handled single steps but could not chain them. The exploit was deliberately trivial, so treat results as an upper bound.

Watch for multi-GB model transfers and steady device-to-device traffic
Close unauthenticated ADB and open inference ports on dev boxes
Small-model capability rises about 13.7 index points a year, per the post

Why it mattersFor anyone shipping on-device models or leaving test devices on a network, the threat has moved from prompt injection to what is exposed. The defenses are boring and cheap.

red team: People who attack a system on purpose to find its weaknesses before someone else does.
open-weight: A model whose trained weights are published, so anyone can run it on their own hardware.
ADB: Android Debug Bridge: a developer tool that can control Android devices over a network if left open.
tokens a second: How fast a model writes text; a token is roughly three quarters of a word.

Sources Anthropic The New Stack

More like this Less like this

Platforms and players

Where games are sold, found and played.

Game dev News

Epic vibe coded its new launcher

Epic says it rebuilt its game launcher largely with AI-written code, and claims it now opens nearly twice as fast as Steam.

The new Epic Games Launcher library: a grid of game covers with Store, Library and Develop tabs and a friends panel on the right — Image: Epic Games via Siliconera

1.8xfaster cold start than Steam: 5.47 s against 10.07 s, Epic's test

3xfaster to open the store than Steam, per Epic

Epic's preview says it "vibe coded" a rebuilt Epic Games Launcher for Windows, Apple Silicon Macs and, for the first time, Linux. All numbers are Epic's own, with no published method.

Why it mattersA public case of a large AI-built rewrite shipped with measured claims, from a company that just moved its teams to AI-first production. Expect rough edges in the preview.

For youIt is where your Fab library and engine installs live, so expect launcher quirks around plugin installs during the preview.

vibe coded: Built mainly by describing what you want to an AI and accepting the code it writes.
cold start: How long an app takes to open when it is not already running.

Sources Gaming.net Siliconera

More like this Less like this

Game dev News

Google Play's new discovery runs on Game Stats

Google Play is adding AI game recommendations and short competitions between players, and a game only takes part if it reports a few basic stats.

A Google Play phone screen with a Game finder chip reading Find games matched to your playstyle, a quest banner and recommended games — Image: Google

Play added an AI Game finder (US English first), 48-hour Sprints for 2 to 5 players, monthly Leagues and 30-second Playbacks in the Sidekick overlay. Games qualify by reporting Game Stats.

Integrate Game Stats
Report match completions, score thresholds and milestones; it makes the game eligible for Streaks, Leagues and Sprints.
Set up Play Games Rewards
Now generally available, and Quests can grant in-game rewards.
Refresh the listing
Game finder and Gemini read your tags, media and reviews to explain why a game fits a player.
Check Level Up
Qualifying games get lower fees through the Play Console program.

Why it mattersGame Stats is now the ticket into Google Play's discovery surfaces for games. Wiring it in before launch is much easier than after.

For youWire it into your Flutter and mobile games before launch, not after.

Game Stats: Google Play's way for a game to report results such as scores, milestones and finished matches.
Sidekick: Google Play's overlay that sits on top of a game while you play.

Sources Android Developers Blog GamesIndustry.biz

More like this Less like this

Game dev News

Xbox Labs bets on games that run anywhere

Xbox started a small team to experiment with games that run anywhere, including straight in a web browser.

~90%of browsers worldwide nearly support WebGPU, says Xbox's memo

Xbox Labs is a small team that will build in the open and share its tools, starting from experiments like browser ports over WebAssembly and WebGPU.

Why it mattersA platform holder now treats the browser as a real game target. There is no developer program or timeline yet.

For youIt backs your three.js and browser game work as a lane worth staying in.

WebGPU: A browser feature that lets web pages use the graphics card for fast 3D, close to how installed games do.
WebAssembly: A way to run fast, compiled code inside a web page.

Sources Xbox Wire Shacknews

More like this Less like this

Game dev Trend

s&box goes free and puts humans back in charge

Contexts&box is the game-making platform from Facepunch, the studio behind Garry's Mod and Rust.

The s&box game platform is going free to play and will now choose by hand which games its fund pays, after automatic payouts attracted low-effort games.

My idea of a Netflix for games doesn't work.

Garry Newman, Facepunch Studios

s&box goes free-to-play by the end of 2026, and its Play Fund moves from automatic enrollment to approval, discouraging clickers, idlers and slop.

Why it mattersA UGC store flooded with low-effort games chose human gatekeeping. Expect more marketplaces to reward curation and quality signals over volume.

For youIf Fab follows, polish and documentation become ranking signals for your plugins. Treat the store page as part of the product.

Play Fund: s&box's program that pays creators for the games they publish on the platform.
slop: Low-effort content made in bulk, often with AI, to farm views or payouts.

Sources GamingOnLinux GamesIndustry.biz

More like this Less like this

Two panels: with only the project checkpoint skill the agent saves a read-only handoff; with a similar checkpoint-2 skill installed the agent commits to git without saying which skill it used — Image: Yan et al., arXiv

The problem: Skills come from teams, personal folders, plugins and copied collections, and the model chooses one by name and description alone. A similar skill can replace yours and drop its key rules, such as never touching git, while completion-only evals see nothing wrong.
The idea: Rebuild the skills Claude Code would load in 20,947 public repos, find similar pairs, and run 312 confirmed pairs across Haiku 4.5, Sonnet 4.6 and Opus 5: 6,368 runs scored on the functions only the installed skill provides.
The result: About 1 in 4 installed skills has a same-job twin. A twin cuts use of the installed skill by 19.9 points with no drop in task completion, and costs 9.4 points of its core functions (22.1 on Haiku, none on Opus). Replies name the skill used in 0.9% of runs. A hook blocking the twin's first read makes the model switch 96% of the time.
Use it: List personal, plugin and project skills and merge overlapping ones; give skills distinct names and descriptions; add a hook that redirects reads of known duplicates; test the rules only one skill enforces.

A gallery of meshes, from a chess piece and a Ferris wheel to a spider and a tree, each split into many colored convex parts — Image: Shi et al., arXiv

The problem: Physics and collision need meshes split into convex parts. Search-based methods take tens of seconds per mesh, which pushes collision generation into overnight bakes.
The idea: Design the algorithm around the GPU warp: fuse the search, cutting and hull steps into kernels that stay on the GPU, with a device-side allocator so nothing round-trips to the CPU.
The result: Mean per mesh against CoACD at the same concavity target: 0.23 s vs 18.03 s on the V-HACD set, 0.16 s vs 12.82 s on PartNet-Mobility and 0.25 s vs 25.93 s on an Objaverse subset, with equal or better concavity and fewer parts (for example 33.6 vs 40.5).
Use it: Batch-generate collision for meshes on an NVIDIA GPU, then import the convex pieces as custom collision in Unreal or another engine instead of waiting on slow decompositions.

An example Claude Code trajectory on a Django task marking repeated reads, near-duplicate scripts and rerun tests — Image: Hu et al., arXiv

The problem: Coding agents are expensive, and the recurring wasteful habits behind the bill had not been measured.
The idea: Study 1,200 SWE-bench Verified trajectories from Claude Code and Mini-SWE-Agent, name three habits (re-reading code already seen, writing near-duplicate scripts, rerunning unchanged tests), then compare three fixes over 10,000 trajectories.
The result: The habits appear in 79 to 98% of tasks and account for up to 22.75% of cost. A code-graph MCP raised cost in 4 of 8 settings. Agent-written skills saved at most 22.32%. Developer-written rules cut cost by 7.88 to 41.73% with pass rates within about 2.5 points.
Use it: Add a short section to an agent's instructions: state a hypothesis before searching, reuse context already gathered, keep and revise one script, rerun tests only when code changes, break loops. Compare cost on real tasks with and without it.

Your shipped code is now readable

Agents rebuilt a shipped game

Build the game so an agent can check its own work

Claude OpenTelemetry

Agents pass the tests, then ship the hole

Five changes to check in your setup

Unity locks out accounts that missed a 2FA reset

npm Trusted Publishing trusted the name, not the repo

Check every binding

Recreate after renames

Clean up

Watch publishes

Anthropic tests whether small models can spread on cheap devices

Epic vibe coded its new launcher

Google Play's new discovery runs on Game Stats

Integrate Game Stats

Set up Play Games Rewards

Refresh the listing

Check Level Up

Xbox Labs bets on games that run anywhere

s&box goes free and puts humans back in charge

Add one security sentence to your agent instructions

Add the line

Give it a real task

Review the weak spots

Install two skills for one job and the wrong one often runs, while the task still passes

Collision hulls in a quarter second instead of 13 to 26 seconds per mesh

Plain behavior rules cut a coding agent's cost by up to 42% at the same pass rate

Also moving

This week on Toa Radar