AI cracks an Erdős conjecture & GitHub breach via VS Code - Hacker News (May 21, 2026)

First up, the headline that feels like it comes from the near future. OpenAI reports that an internal general-purpose reasoning model produced a proof that overturns a long-standing conjecture tied to the planar unit distance problem—how many pairs of points can be exactly one unit apart among n points in the plane. What’s notable isn’t only the result, which beats the growth Erdős expected, but the way it happens: the construction pulls in heavy algebraic number theory techniques that most people wouldn’t expect to show up in a geometry-flavored question. External mathematicians reportedly checked the argument and wrote a companion paper explaining it. If this holds up over time, it’s a twofer: a real shift in expectations for a classic discrete-geometry problem, and a rare, concrete example of AI generating a verifiable advance rather than just accelerating someone else’s work.

Now to security, and a reminder that developer tooling is a high-value target. GitHub says an attacker gained access to roughly 3,800 internal repositories after an employee installed a trojanized Visual Studio Code extension. GitHub’s assessment so far is that the impact is limited to internal repo exfiltration, and it hasn’t found evidence that customer data outside those repos was affected. The larger takeaway is the same one we keep relearning: extensions can sit in a position of extreme trust—close to credentials, source code, and tokens—and marketplaces are a supply-chain attack surface that’s hard to fully police. Even when containment is fast, the exposure can be broad.

Staying with developer ecosystems, Python 3.15 has reached beta feature freeze, and some of the most valuable changes aren’t the flashy ones. Asyncio gains a TaskGroup.cancel() method, which makes it much easier to stop a set of tasks cleanly without the awkward dance of triggering cancellation via an exception and then hiding it. Another fix targets a common gotcha: context managers used as decorators now properly wrap the full lifecycle of async functions and generators, so timing or logging wrappers don’t end early and quietly lie to you. And with the ecosystem moving toward more parallelism, Python is adding tools to make iterators safer across threads, reducing the risk of skipped items or corrupted state when code gets more concurrent. These are the kinds of improvements that don’t trend on social media—but they reduce the daily friction that turns into real engineering cost.

On the hardware-and-open-software front, Flipper Devices publicly introduced Flipper One, positioning it as a separate project from Flipper Zero: more of a Linux-based, expandable cyberdeck aimed at IP networking and heavier workloads like SDR and even local AI. The company is being unusually candid: it says the project has been rebuilt multiple times and remains financially and technically risky, so it’s opening development and asking the community to participate. What makes this interesting is the explicit upstream-first goal. Flipper One targets mainline Linux support on Rockchip’s RK3576, and they’re trying to avoid the long-term trap of vendor BSPs and binary blobs. They still have a big obstacle in the boot chain—a proprietary DDR “trainer” blob—and they’re working with Collabora to upstream core support while seeking help on power management, USB-C DisplayPort Alt Mode, and upstreaming drivers for things like the NPU and video decode. If they pull this off, it’s not just a gadget story; it’s a case study in whether consumer-ish ARM devices can be built to remain maintainable for years instead of becoming abandonware the moment a vendor kernel stops getting love.

A related theme—software that’s friendlier to automation—shows up in RMUX, a new Rust-based terminal multiplexer that aims for tmux compatibility but is also meant to be driven by a typed SDK, not just a CLI. The pitch is persistent, detachable sessions plus structured snapshots, so humans and automated agents can reconnect, inspect state, and orchestrate long-lived terminal workloads. This matters because a lot of modern infrastructure work is still glued together with terminal sessions over SSH, and we’re heading into a world where automation wants to be a first-class “user” of those same workflows. A tool that treats the terminal like a programmable runtime rather than an opaque screen could be genuinely useful—assuming it proves stable over time.

For macOS users who like to customize everything, there’s Phosphene—an open-source video wallpaper engine for macOS Tahoe that integrates into the native wallpaper picker and can set video wallpapers for desktop and lock screen. The twist is how it achieves that deep integration: it relies on Apple’s private WallpaperExtensionKit, accessed dynamically through runtime introspection. So it’s clever, and it’s more seamless than many third-party approaches—but it’s also inherently fragile, because private APIs can break with any OS update. The broader lesson is familiar: when platforms don’t offer official hooks for popular customization, developers either ship lesser experiences—or they take on the risk of building on sand.

Switching gears to law and creative industries: Fender has reportedly escalated efforts to control the Stratocaster-style, or “S-style,” body shape, sending a cease-and-desist to boutique builder LsL Instruments. The letter follows a German court ruling treating the Strat body as a copyrighted work of art, which Fender argues strengthens its hand internationally. LsL says the dispute could threaten small builders, and the notice allegedly seeks not only a stop to production but also actions affecting instruments sold into the EU. If this expands, it could reshape the long-standing ecosystem of compatible designs—where musicians benefit from choice and builders rely on familiar silhouettes—by turning what many consider a shared template into a tightly controlled asset.

And in open-source governance news, the Haskell Foundation announced significant organizational changes, with Executive Director José stepping down in June 2026. The Board says the Foundation is on steadier ground now, and it wants to shift more financial resources directly toward technical work so members can see tangible improvements in the ecosystem. There’s also a language shift from “donors” or “sponsors” to “members,” emphasizing participation and shared ownership. For any language community, this kind of restructuring is high-stakes: it’s not just about who holds titles, but whether funding and coordination translate into better tooling, better infrastructure, and a healthier contributor pipeline.

Finally, a quick note on the business side of AI: Google is testing Gemini-powered ad formats in a more conversational Search experience, with ads that respond more directly to a user’s question and placements inside AI-generated recommendation flows—while promising clear labeling as sponsored. The direction here is the story: advertising is shifting from matching keywords to mediating decisions. If Search becomes more like a guided conversation, the ad unit isn’t just a link—it’s part of the advice. That raises obvious questions about incentives and trust, and it will likely change how companies fight for visibility when the interface is no longer a list of blue links.