#claude-code

Fed up with YouTube's recommendations late on a Friday night, Andrej Karpathy says he asked Anthropic's Claude Opus 5.5 the next morning to build a YouTube clone made only of videos recommended on Hacker News. Per his October 31 post, the agent downloaded HN's comments, used Claude Sonnet to filter out spam and found about 40,000 comments recommending a YouTube video, which gave 6,454 videos recommended by a few people each between 2007 and 2026, across 150 topics. The result, hackertube.org, has a YouTube-style interface, "For You" recommendations kept in the browser with no user accounts, keyboard shortcuts and a downloadable data export.

Karpathy says the whole thing took about two hours. His only manual steps were creating a Google Cloud API key for video metadata, starting a server and buying the domain; Claude Code deployed and hardened it.

After seeing Andrej Karpathy's HackerTube, the developer known on Hacker News as roansh built the same idea for books, again largely with Claude Opus 5.5. In the Show HN post, roansh says Claude wrote almost all of it, data pipeline included, while they steered, made decisions and bought the domain. The site lists books that at least two different commenters brought up between 2007 and now; its footer counts 15,704 books and 284,808 mentions. It sorts them into topics from fiction and history to programming and Lisp, with top-recommended, most-mentioned, rising and "For You" views, and each book links back to the comments that mentioned it. The data can be downloaded from the About page.

The author notes the ranking counts mentions, so praising a book and trashing it both count.

A Postman user filed a "[SEVERE]" GitHub issue reporting that opening the Postman desktop app (12.33.4) on a Mac automatically installed Postman plugins into OpenAI's Codex and Anthropic's Claude Code, plus a Postman CLI. Postman's own log recorded an "auto-existing-upgrade" install. The reporter says Codex's global config gained a Postman plugin, a remote MCP server connection and a session-start hook telling the agent to load Postman's skill before any non-trivial API engineering task, and that the plugin's installer source code tries to mark its own hook as trusted. The reporter says the report does not claim any data was exfiltrated.

The issue drew hundreds of reactions. On November 5 a Postman team member replied that the change was meant to simplify setting up coding agents, that the company now understands its messaging did not make that clear, and that Postman is reverting it and will redesign it "with the right level of control." The issue was then closed and locked.

Cursor says that on October 29, between about 2:27 a.m. and 1:35 p.m. Pacific, its VS Code extension marketplace served maliciously modified versions 2.1.312 and 2.1.313 of Anthropic's Claude Code extension for Windows and macOS, versions not made by Anthropic. The code ran as soon as the extension loaded: it sent host and user details to the attacker, added an attacker SSH key labeled "svc-telemetry" to the user's authorized keys, tried to enable SSH and open a reverse tunnel, and set up persistence. Cursor says errors in the malware meant the SSH step failed unless Cursor ran with admin rights. It pulled the versions, shut down and rebuilt the marketplace, rotated keys and had the attacker's server taken offline. Affected users should run its check, remove the key and persistence, and rotate credentials; uninstalling alone may not be enough.

The security firm Phorion, which also detected it, published a technical analysis, including the macOS permission-check mistake that skips turning on Remote Login.