The most telling number in tech this morning is in a Postgres committer’s blog post: 1,169 commits back-patched to the 19 stable branch, against 724 for 18 over a comparable window. Robert Haas explains that LLM-assisted bug hunting is surfacing flaws faster than committers can fix them. Three headline features (FOR PORTION OF updates, SQL/PGQ property graph queries, and partition merge/split) were reverted between late August and mid-September, partly because the people who would have polished them were busy on back-branch repairs. Postgres 19 will probably ship in November instead of on schedule.
Haas isn’t alarmed, and neither should anyone be: these are bugs that were already there. But the arithmetic is worth noticing. When finding defects gets cheap, the bottleneck moves to the humans who triage, review and merge. The decades of accumulated debt in mature software get itemized all at once, and a project’s release calendar absorbs the bill.
Cheap proofs, expensive judgment
Mathematics is having the same argument in a different register. In a guest post on Terence Tao’s blog, Frank Calegari argues that the field should respond to AI progress, including the 700-plus papers OpenAI released on October 6, with optimism rather than grief. His analogy is the classification of finite simple groups: a famous problem ended, interest in the area cooled, and the interesting questions (why the Monster group exists at all) remained.
His proposals are practical. Evaluate all work as if it were AI-assisted, hire through in-person interviews instead of paper files, push journals to demand more, and widen graduate training. He is also pointed about the rush to post machine-assisted results: choosing which problems deserve a proof may now matter more than producing the proof. It is the Postgres lesson again. Production gets cheap, and taste becomes the scarce input.
Trust, and the PR blitz
Kyle Kingsbury, in his Jepsen analysis of ParticleDB, put the cost in plain terms: LLM use erodes trust in documentation, software and the organizations behind them, because the signals of maturity are now easy to counterfeit. A concrete case surfaced over the weekend. Parameter Labs described an exploit chain against ChatGPT’s sandboxed HTML previews. A MathLive virtual keyboard injected an unsandboxed iframe, and YouTube’s oEmbed endpoint, which OpenAI’s CSP allowed, reflected script into it. A crafted share link could then read or act on behalf of any signed-in user who opened it. OpenAI fixed it and paid a $5,000 bounty, which Simon Willison called “a bit cheap.”
Meanwhile OpenAI is thinking about its image. Axios reports a “PR blitz” planned for after Tuesday’s midterms, and TechCrunch relays that policy chief Chris Lehane floated AI “speed limits,” a US role in global standards, and calling data centers “AI compute campuses.” Lehane called the data-center debate “good and healthy” and noted Amazon and Microsoft have pledged to stop using NDAs with local governments. A new name for the buildings is easy; whether neighbors accept the power bills and the pollution is a separate question.
A thin news day, and it shows. The stories that held up were the ones about second-order effects: what happens to maintainers, mathematicians and security teams when a machine can do the finding.
