Wundervault Weekly

The AI Bake-Off

November 8, 2026

◆ In this issue ◆

Top story
Show me the money

Attack Surface
The Password Too Long to Check

Unlocked
Why I Turned Opus Down to Medium

The Last Laugh
This Is How You Know It's Working

Welcome back readers! This is a PSA that it is time to take down your spooky decorations, yes, including(especially)the $300 giant skeleton and put it in storage until next year. Please don’t put a Christmas hat on your skeleton, just put it away.

A house at dusk decorated for four holidays at once: jack-o'-lanterns and a skeleton in a scarf on the porch, pumpkins and hay bales on the steps, Christmas lights on the roofline and a wreath on the door, a menorah glowing in the window and blue-and-silver lights on the railing. A man in a denim jacket stands on the lawn, hands on his hips, smiling at it.

One porch, four holidays, zero regrets. (Made with AI: Gemini 3 Pro Image.)

This week I’ve decided to do a little housekeeping on the weekly newsletter. I am finding that there are several recurring topics that we keep touching on so I decided to experiment in creating a weekly sections which I will detail right…now.

Attack Surface
Our first section is cybersecurity / AI-related hacks. This section will tell you the latest, most interesting hack of the week. I don’t see these stories slowing down and as I eluded to last week, it feels like they might be tremors of something larger.Looking forward to watching this area, and hoping that if we get an internet blackout it happens over the holidays so I can snuggle up around the fireplace with a nice book and a mug of hot cocoa.

Unlocked
The second recurring section is going to be a series of tips for working with AI. With continued experimentation, there is continued learning. These will be anecdotal, if I put a tip here it will be because I’ve tried it and can vouch for it. I might also include tips that I debunk or find to be of little or no use.

Below the fold
This recurring section has been with us since the beginning. In this space, I talk in more depth about what I’m building with AI. Make sure you check it out this week, to find out more about the Bake off.

The Last Laugh
The last recurring section will be a weekly comic. Right now I am using Mini Fantasy Theater by David Revoy. This open source comic series is a nice combination of fantasy and AI/technology. He’s an original artist and creator I encourage you to check out his website, there’s more than just comics there. You can see his exploration and creative process and he even has a whole post about some uses of AI that he prohibits. https://www.davidrevoy.com/article1178/license-update-ai-derivation-prohibited-on-all-my-art-lore-stories-and-comics

So let’s give this new layout a try. As always, love the feedback so let me know if you absolutely hate it. I’m hoping it gives readers more ability to skim and find stories that interest them, but I do appreciate the cover to cover folks too.

Last update this week. All newsletter go to my email now, so those of you who were writing in by replying, I will actually receive your message.

“Show me the money”

Anthropic has launched Personal Finance in Claude. You connect the bank and card accounts you choose, then ask Claude questions about your balances and transactions. It can find recurring payments and flag unusual transactions. Access is read-only, so Claude can’t move your money or make investments for you.

Claude's X post announcing Personal Finance in Claude, in beta: a video whose opening frame shows the title 'Personal Finance in Claude' surrounded by sample screens: monthly spending by category (housing, food and dining, shopping), upcoming bills like rent and electric, top expenses, and a food-and-drink calendar for the month. Claude's X post announcing Personal Finance in Claude, in beta: a video whose opening frame shows the title 'Personal Finance in Claude' surrounded by sample screens: monthly spending by category (housing, food and dining, shopping), upcoming bills like rent and electric, top expenses, and a food-and-drink calendar for the month.

The post from Claude.

It’s a US-only beta for Pro, Max and Ultra subscribers. Anthropic says conversations in the Personal Finance hub aren’t used for training, and there are no ads or sponsored recommendations. Good, because I would hate to ask where my money went and get a pitch for a new credit card.

What happens when you can ask about your money without digging through statements? Maybe you notice the subscription that has been quietly taking a few dollars every month. You might see what your low-interest savings account isn’t paying you much and decide to move the money elsewhere. Credit unions and big banks, and financial advisors may have to work a little harder to keep their customers and deposits.

A GIF reply to Claude's launch post: a doll with wild white hair and huge googly eyes, staring in horror. The post says: 'Claude after looking at my Finance.'

“Claude after looking at my Finance.” A reply to Claude’s launch post.

◆ Attack Surface ◆

The Password Too Long to Check

Ozgun Kultekin found a strange login bug. On certain Linux servers and devices, you could type a password longer than 256 bytes and get into an account that should never accept a password. Yes, any sufficiently long password. That includes some accounts set up to allow only a security key.

How does that happen? A locked account has an asterisk where its password would normally be stored. On the affected systems, the software that checks a password also returns an asterisk when the password is too long to process. OpenSSH sees two matching asterisks and lets the login through. Somebody put a lock on the door, and an error from another part of the system looked exactly like the key.

Kultekin found it using AI agents to try thousands of unusual logins against different versions of the login software. The affected combination uses a Linux component called musl, runs OpenSSH without PAM, and allows password logins. There is no known exploitation, and the computer most of you use isn’t affected. Servers, routers and some other devices are the concern. The fix is in OpenSSH 10.6p2; turning off password logins is a workaround for affected systems. If you look after one of those systems, check the details.

The sshhole.com home page: the name *sshole with a yellow asterisk, and the line "accounts that should never take a password at all … take any password longer than 256 characters."

The bug has its own website: sshhole.com.

◆ Unlocked ◆

Why I Turned Opus Down to Medium

Andrej Karpathy posted about building HackerTube, a site made by having Claude sift through years of comments to find videos people kept recommending. You can browse it here. In the same post, he mentioned the setting he uses in Claude Code:

“I use Claude Code (desktop app for Mac), Opus 5.5 on Medium effort as my default. I only talk to Claude and have it do everything.”

Karpathy coined “vibe coding,” so I paid attention. I had been running Opus 5.5 on xhigh for serious coding work. That was advice I’d picked up from Anthropic’s effort docs, except it was for the previous model, Opus 5: “step up to xhigh for demanding coding and agentic work.” For Opus 5.5, Anthropic made medium the default and says to test on your own work rather than carry settings over.

Artificial Analysis scores Opus 5.5 at 48 on medium, 57 on xhigh and 59 on max. So xhigh does score higher. I spent this week on medium and saw no noticeable difference in my work, with far fewer tokens used. I’ll leave it there for now.

The post from Andrej Karpathy.

Claude Opus 5.5 scores 35 at Low, 48 at Medium, 52 at High, 57 at Xhigh, and 59 at Max.

Medium already gets most of the way there.

◆ Below the fold ◆

The AI Bake-Off

The AI Bake-Off page: three claymation robot bakers, blue, green and yellow, each presenting a cake on a gingham-covered counter, above an order ticket that says "Order for all three" with a button "Send to all three bakers".

The AI Bake-Off, open until Sunday, November 15.

Are you looking to build along with me? If so, I’ve got some good news. This week I came to a conclusion about what I’m looking to buy and what it will let me run locally. The best models for running at home aren’t frontier models yet, but models this size have made a lot of progress in the past year, and I expect more to come. This week I’ll show you the three models I’m considering.

Come try the Bake-Off. Which of these three would you want as the AI that lives on a computer in your own home? You can ask all three the same question and see their answers side by side. It’s open until Sunday, November 15.

How to judge:

Ask something you actually needed help with this week.
Send a follow-up to see if it remembers your question and adjusts its answer.
Ask about something you know well. Catching a mistake tells you plenty.
Notice the tone. Would you want to ask it another question?
Notice the speed, too, but remember that all three are running on shared cloud machines here.

Then vote for the best answer and give me your reason in a sentence. The reason will help me more than the vote alone.

Meet the bakers. Each is small enough to run on one home graphics card. In the Bake-Off, all three run at medium effort, so all three think before answering.

Muse Glimmer 30B is made by Meta. It thinks before answering and can read about 131,000 tokens at once (a token is roughly three-quarters of a word).
Gemma 4 31B is made by Google. It can read about 262,000 tokens at once.
Qwen 3.8 27B is made by Alibaba. It thinks before answering and can read about a million tokens at once, enough for a very long document at home. (The Bake-Off keeps questions short.)

I’ll share the results and what I decide to buy in the coming weeks.

Three chat boxes, one per baker, each answering "Write a two-line poem about a toaster", with how long each took under its answer, above the vote panel "Who baked it best?".

Each baker gets its own chat box. Send the same question to all three, then follow up with just one.

◆ The Last Laugh ◆

Mini Fantasy Theater episode 77, “This is how you know it’s working” (November 4, 2026), by David Revoy. CC BY-SA 4.0, AI derivation prohibited.

← All Issues Subscribe