log4j posted about owning a 2025 Samsung TV and finding a root shell via a zero day. The firmware was AES encrypted, but they bypassed it. They discovered constant hot mic functionality, automatic content recognition, and geo positioning. It also builds user profiles and shares data with 400 partners. As someone who runs a homelab, I find the amount of telemetry on a $3000 TV horrifying. It is a massive privacy issue.
Kimi K3.1 Pro scores 65.7% on Terminal-Bench 4.0. GPT-6 Astra manages 58.2%. Claude Opus 5.5 is still ahead at 66.4%, by about a point. It carries a 1M context window and the full weights go up on November 4. They also stripped cyber-attack training data out of both the mid-training corpus and the RL mix before release, which means the copy you download is deliberately worse at finding holes in your own servers. Fair trade. Read the number twice anyway.
There is no Linux feature called a container. There are namespaces deciding what your process can see, cgroups deciding what it can use, a pile of networking machinery, and an image that turns out to be a folder plus a chroot or pivot_root call. Five features in a trenchcoat. The author of a from-scratch runtime found this deflating and useful at the same time. Me too. The isolation is real, but it is isolation of view and resources, not a wall. Next time something leaks between containers, you will know exactly which of the five to blame.