OpenRouter swings 20pts, Habitat hits 70M rps, Datasette gets 3-LLM audit

TL;DR

OpenRouter DeepSeek endpoints swing 20 points on tool-calling depending on which backend answers.
Habitat serves 70M req/s across 500PB after a Rust rewrite by 2 engineers.
Datasette 1.0a39 patches a SQL injection surfaced by Willison’s week-long 3-LLM audit.
Auto Exacto re-ranks providers every 5 minutes, cutting gpt-oss-120b tool-call errors 36%.
Anthropic gates Claude-written code through lint, fuzzers, and security review before merge.

Three tech features today, each landing a headline number in a different corner of the stack. OpenRouter publishes tool-call telemetry showing the same DeepSeek weights swing 20 points depending on which backend answers, with Auto Exacto re-ranking providers every 5 minutes on live error rates. OpenAI’s Habitat posts 70M requests/second across 500PB after a Rust rewrite credited to two engineers pairing with Codex and GPT-5.5. And Simon Willison ships a Datasette SQL-injection fix that emerged from a week-long audit run in parallel through Claude Fable 5.1, GPT-5.6 Sol, and GPT-6 Astra under a four-eyes human+agent protocol.

The round-ups run parallel to that last thread: Boris Cherny details the lint, fuzzer, and security-review gates Anthropic puts around Claude-written code before it merges, and Hugging Face’s security.txt now addresses rogue agents directly, pointing them at CyberGym instead of production. Smaller ships from Dumpleton, Python 3.15, and the Datasette plugin family round out the day.

OpenAI’s Habitat hits 70M req/s after a Rust rewrite

TL;DR

Habitat now serves 1B weekly users at 70M requests/sec across 500PB and 40 regions.
Rust rewrite claims 6× CPU and 15× memory gains, credited to two engineers using Codex and GPT-5.5.
API design copies Facebook’s TAO — no SQL joins — with CDC into Rockset for analytics.
The aiohttp FIFO patch shipped a poisoned-pool regression requiring a follow-up 3.14.3 fix.

A well-executed reassembly, not an invention

Habitat’s constrained NoSQL API is explicitly modeled on Facebook’s TAO, the 2013 social-graph store that reduced everything to Objects (nodes) and Associations (edges) and refused to let callers issue SQL joins ¹. The bet is the same one Facebook made: if product teams can’t write unpredictable queries, the storage layer’s workload shape stays narrow enough to scale. What’s genuinely new is the escape hatch — Habitat streams Change Data Capture into isolated Rockset instances for anything that needs joins or scans, which is convenient given OpenAI acqui-hired Rockset in 2024 and shut down its public cloud shortly after.

flowchart LR
    A[ChatGPT / Codex clients] --> B[Habitat service<br/>Rust, 95% traffic]
    B --> C[(Azure Cosmos DB<br/>Objects + Associations)]
    B -. CDC stream .-> D[(Rockset<br/>analytics, joins)]
    B <--> E[Envoy sidecar<br/>HTTP/2 multiplexing]

The Python war stories are candid — and incomplete

The post is unusually honest about tail-latency failure modes: asyncio event loops stalling for seconds on compression and encryption, LIFO connection reuse in aiohttp funneling traffic onto already-hot pods, and Envoy upgrades from HTTP/1 to HTTP/2 multiplexing to tame thundering-herd reconnects. The fixes are all real and, in the aiohttp case, upstreamed.

They also have sequels the post skips. The FIFO patch that broke the metastable feedback loop introduced a new failure: because FIFO cycles all connections, any broken socket that isn’t properly evicted eventually gets handed to a fresh request, producing sub-millisecond SocketTimeoutErrors severe enough to require a follow-up 3.14.3 fix ². Envoy’s HTTP/2 story has a similar footnote — each downstream connection pins to a single worker thread, so a heavily multiplexed H2 pipe can bottleneck on one CPU core, and synchronized max_connection_duration expiries across a mesh can trigger reconnection storms of their own ³. Practitioners will recognize both hazards; readers of the blog won’t.

The Rust numbers check out; the “two engineers” framing doesn’t

The efficiency claims are in the right zip code. LiteLLM’s independent Python→Rust gateway rewrite reported gateway overhead dropping from 7.5ms to 0.05ms and peak memory from 359MB to 32MB ⁴ — comparable in shape to Habitat’s 6×/15× claims, and the Rust port already handles 95% of production traffic. Nothing here is physically implausible.

The framing that two engineers plus Codex and GPT-5.5 did it is where the marketing pressure shows. A parallel AI-assisted rewrite of the Bun runtime from Zig to Rust finished in 11 days but shipped with 19 known regressions, and reviewers warned that green CI is not the same as correctness ⁵. HN readers went further, reading the Habitat post partly as a Codex demo dressed as a postmortem ⁶.

The load-bearing caveat, in my read: AI compresses the writing of code, but it doesn’t compress the verifying of it. At 70M req/s, the regressions you don’t catch are the ones that page you at 3 a.m.

OpenRouter’s same-model endpoints swing 20 points on tools

TL;DR

The same DeepSeek weights swing 20 points on tool-calling accuracy depending on which OpenRouter backend answers the call ⁷.
Provider-specific API quirks break the “OpenAI-compatible” contract: an empty reasoning_content block 400s on SiliconFlow but works on Alibaba ⁸.
OpenRouter’s Auto Exacto re-ranks providers on live tool-call telemetry every 5 minutes, cutting gpt-oss-120b errors 36% ⁹.
Pinning a provider means paying OpenRouter’s ~5% fee and 40-55ms extra latency for little beyond unified billing ¹⁰¹¹.

The abstraction leak is bigger than “different quantizations”

Simon Willison’s write-up of Mohamed Moustafa’s OpenRouter post lands on the usual culprits — vLLM vs. TensorRT-LLM, FP16 vs. INT4, inconsistent reasoning_effort handling. Moustafa’s own blog is sharper. He measured a 20-point spread in tool-calling benchmarks for the same DeepSeek model across hosts, and — counterintuitively — some fp4-hosted endpoints outscored their fp8 siblings ⁷. So much for filtering by advertised precision.

The failure modes get worse once you leave the laptop. Venice and Novita silently apply IP-based rate limiting that only trips from production egress, so your staging tests pass and your prod deploy immediately 429s ⁸. And the “OpenAI-compatible” contract is per-provider, not per-model: an empty reasoning_content block returns 400 on SiliconFlow while Alibaba and Baidu accept it for the identical weights ⁸. You are not calling “DeepSeek.” You are calling whichever of a dozen hosts OpenRouter picked this second, each with its own dialect of the same API.

OpenRouter’s own answer: Auto Exacto

The platform has partially conceded the critique. Auto Exacto, shipped as an opt-in :exacto slug, re-ranks providers every five minutes using live τ²-Bench and tool-call telemetry instead of price ⁹. The numbers are real: a 10-20% success-rate lift on Tau2Bench and LiveMCPBench, and a 36% relative drop in tool-call errors for gpt-oss-120b (5.6% → 3.5%) ⁹. That is the missing counterweight to “just pin manually” — the pinning is being automated, if you know to ask for it.

Which you probably don’t, because it’s not the default.

The aggregator paradox

flowchart LR
    A[Your app] --> B{Routing choice}
    B -->|Default auto| C[OpenRouter picks<br/>cheapest host]
    B -->|:exacto slug| D[OpenRouter picks<br/>by live telemetry]
    B -->|provider.only| E[You pin one host]
    B -->|Direct| F[Provider's own API]
    C -.20pt accuracy swing.-> G[Non-deterministic prod]
    D --> H[+10-20% success]
    E --> I[Pay 5% fee for unified billing]
    F --> J[No markup, no extra hop]

Hacker News commenters push the logic to its endpoint: once you’re pinning a provider for determinism, OpenRouter’s ~5% credit fee buys you unified billing and not much else — calling the provider directly saves the markup and removes a failure domain ¹⁰. Independent benchmarks back this up: OpenRouter adds an estimated 40-55ms of overhead versus 10-20ms for self-hosted LiteLLM or Portkey ¹¹.

What’s actually at stake

OpenRouter’s COO says agentic workloads now consume disproportionately more tokens per task than chat, and are approaching 1% of global inference ¹². That shifts the dominant quality axis from “which model” to “how reliably does it call tools” — exactly the axis where provider variance is worst. The middle-ground pitch (“one endpoint, we’ll figure it out”) is the shakiest place to stand. The credible options are narrowing to three: opt into :exacto, pin explicitly with provider.only, or skip the aggregator and go direct.

Willison audits Datasette with 3 LLMs, patches SQL injection

TL;DR

Datasette 1.0a39 and 0.65.4 patch an escape_sqlite() identifier-quoting flaw that let crafted table names inject UNION SELECT.
Fixes emerged from a week-long audit using Claude Fable 5.1, GPT-5.6 Sol, and GPT-6 Astra under a four-eyes human+agent protocol.
Companion patches close case-insensitive table-name bypass, FTS permission inheritance, and unrestricted sqlite_stat1–sqlite_stat4 reads.
Lands as curl’s “Summer of Bliss” shutdown reframes AI-generated bug reports as a maintainer-burden crisis.

The actual bugs

The headline fix isn’t a CSV-export bug or a facet DoS — those specifics in secondary write-ups don’t match the advisory. The GHSA advisory pins the critical flaw on escape_sqlite(): Datasette wrapped identifiers in square brackets but never escaped a literal ] inside the name, so a crafted table or column could break out of the quoting and append arbitrary SQL — the demonstrated payload was a UNION SELECT against tables the caller had no permission to see. The fix switches to standard double-quote identifier quoting with doubled internal quotes ¹³.

Willison’s own post catalogs a second cluster of permission bugs that are arguably worse in aggregate: SQLite matches identifiers case-insensitively, but Datasette’s allow-lists were case-sensitive, so SELECT * FROM Secrets bypassed rules written for secrets. FTS index tables didn’t inherit permissions from their source tables, and the sqlite_stat1 through sqlite_stat4 metadata tables were readable by default — enough to leak column cardinalities and value distributions from private data. All three are now closed ¹⁴.

Notably absent: there is no new max_facets_per_request setting. Datasette’s facet defenses remain the pre-existing facet_time_limit_ms (200ms default) and allow_facet=off, with the 10,000-row scan cap that landed back in 2024 ¹⁵.

Auditors turned the LLMs on themselves

The more interesting story is the methodology. After an initial round of LLM-assisted reports from external researcher Sevban Dönmez, Willison and Alex Garcia ran a week-long private audit against three frontier models — Claude Fable 5.1, GPT-5.6 Sol, and GPT-6 Astra — with a deliberate four-eyes protocol: one human+agent pair wrote a failing test that proved each vulnerability, and a different pair wrote and verified the fix ¹⁶. Some of the exploit-demonstrating tests were held back from the public repository even after release, on the theory that automated scrapers now convert public disclosures into working exploits within minutes ¹⁶.

That’s a real inversion. For two years the story has been offensive: LLMs finding bugs in open-source projects faster than maintainers can triage. Willison is running the same models against his own code first, on his own schedule, in a private repo.

Why this matters now

The backdrop is a maintainer-burden crisis that has stopped being theoretical. curl’s Daniel Stenberg watched valid-report rates collapse from roughly 15% to under 5% under a flood of AI-generated “slop”, shuttered the HackerOne bounty, and declared a “Summer of Bliss” from July 1 to August 3 2026 refusing all security mail outright ¹⁷. His April post reports the project now fields more than one credible submission per day — roughly double 2025’s volume — and the bottleneck is no longer discovery but human review ¹⁸. rclone reportedly took 40+ disclosures in a single month in 2026, against roughly 20 in its entire first decade ¹⁶.

Datasette’s release is small in patch-note terms and large as a template: if you can afford a week and three model subscriptions, you can front-run the scrapers against your own project. That’s the read worth taking away — not the version bump.

Round-ups

Anthropic holds Claude-written code to a higher bar than human code

Boris Cherny says production code written by Claude at Anthropic passes through lint rules, Claude-driven end-to-end tests, daily Claude-powered fuzzers, and automated code and security reviews. Without those guardrails, he warns, agent-generated code turns into an unmaintainable mess.

Hugging Face’s security.txt tells rogue AI agents to go home

The site’s security.txt file now addresses AI agents directly, pointing any that were told to hunt vulnerabilities toward the public CyberGym benchmark on GitHub and asking them to dump their weights on Hugging Face instead of attacking it.

Graham Dumpleton’s wrapture brings zero-code Python tracing via TOML

The new monkey-patching library unifies testing and observability, with a companion wrapture-instrumentation package covering Flask, FastAPI, Django, SQLAlchemy, httpx and 15 more. Traces export to OpenTelemetry, and instrumentation can be configured in a TOML file without editing any Python.

Hugging Face rebuilds AUTOMATIC1111 image UI on Gradio Workflow

The classic Stable Diffusion web UI gets a modern reimplementation using Gradio’s new Workflow primitive, showing how the node-based diffusion interface popularized by AUTOMATIC1111 maps onto Hugging Face’s declarative pipeline framework.

Python 3.15 soft-deprecates re.match() in favor of re.prefixmatch()

Release manager Hugo van Kemenade is renaming the long-confusing function to reflect that it anchors only at the start of a string, not the end. The old name keeps working, but new code should reach for re.search() or re.fullmatch().

datasette-publish-fly 1.4 forces HTTPS and supports app-scoped tokens

The Datasette deployment plugin’s new release sets force_https=true in generated fly.toml files, fixes a “volume could not be found” bug, and adds compatibility with Fly.io’s app-scoped deploy tokens.

github-to-sqlite 2.9.1 restores compatibility with sqlite-utils 4.x

The Dogsheep tool for mirroring GitHub data into SQLite ships a single-issue patch release fixing breakage against the recently released sqlite-utils 4.x line.

Medium summary of Facebook TAO paper — https://hemantkgupta.medium.com/insights-from-paper-tao-facebooks-distributed-data-store-for-the-social-graph-48446205ba28

TAO’s API is intentionally minimal, abstracting the social graph into two primary entities: Objects (nodes) and Associations (edges)… This design replaces complex SQL JOINs with a fixed set of graph-specific queries.

↩
aiohttp GitHub issue #12795 — https://github.com/aio-libs/aiohttp/issues/12795

aiohttp 3.14.x officially transitioned the keep-alive connection pool from LIFO to FIFO… certain failures (like server-side disconnects or request cancellations) failed to properly evict broken connections from the pool. Because FIFO cycles through all connections, these ‘poisoned’ sockets were eventually handed back to new requests, leading to instant, sub-millisecond ‘SocketTimeoutErrors’.

↩
Gojek Engineering — The Sidecar Bottleneck — https://medium.com/gojekengineering/the-sidecar-bottleneck-rethinking-grpc-connection-pooling-7ae062de10c6

Envoy’s threading model pins each downstream connection to a single worker thread; a single heavily multiplexed H2 connection can become a bottleneck, limiting processing to the speed of one CPU core despite having multiple cores available.

↩
r/rust discussion of LiteLLM Rust migration — https://www.reddit.com/r/rust/comments/1uhzbkq/why_migrate_an_ai_gateway_from_python_to_rust/

LiteLLM reported that migrating its gateway hot path to Rust dropped overhead from 7.5ms to 0.05ms… peak memory consumption plummet from 359MB to 32MB

↩
Develeap — coverage of OpenAI agent costs & AI-assisted rewrites — https://www.develeap.com/news/openai-s-researchers-burned-7-000-a-day-on-ai-agents-now-it/

a similar AI-driven rewrite of the Bun runtime from Zig to Rust was completed in just 11 days but introduced 19 known regressions, fueling fears that ‘green tests’ and passing checks may provide a false sense of security.

↩
Hacker News discussion — https://news.ycombinator.com/item?id=49563355

Experts on HN labeled these failures as ‘security-theatre,’ arguing that OpenAI has inadvertently trained ‘sandbox escape artists’… critics argue that OpenAI uses ‘rogue agent’ stories as a marketing tactic to stoke fears—and thus perceived value—of their AI’s power.

↩
Mohamed Moustafa — original blog post — https://mmoustafa.com/blog/so-you-want-to-use-openrouter/

Filter on the board, not the bits… the same DeepSeek model showed a 20-point difference in tool-calling benchmarks across different hosts, and some fp4-hosted models outscored fp8 versions.

↩ ↩²
Mohamed Moustafa — ‘test from prod, not your laptop’ — https://mmoustafa.com/blog/so-you-want-to-use-openrouter/

Providers such as Venice and Novita implemented IP-based rate limiting that only surfaced when requests originated from production infrastructure… an empty reasoning_content block might trigger a 400 on SiliconFlow while being accepted by Alibaba or Baidu for the exact same model.

↩ ↩² ↩³
OpenRouter — Auto Exacto announcement — https://openrouter.ai/blog/announcements/auto-exacto/

Using Exacto routing provided a 10–20% increase in success rates on Tau2Bench and LiveMCPBench… the tool-call error rate for gpt-oss-120b dropped by 36% (from 5.6% to 3.5%) after enrollment.

↩ ↩² ↩³
Hacker News discussion (id=49621546) — https://news.ycombinator.com/item?id=49621546

If you are tightly pinning, you might as well use the provider’s API directly to avoid OpenRouter’s service fees — which can add roughly 5%… without pinning it’s a crapshoot of results.

↩ ↩²
Requesty — LLM routing platforms comparison 2026 — https://www.requesty.ai/blog/best-llm-routing-platforms-compared-2026-requesty-portkey-litellm-openrouter

OpenRouter typically adds the highest latency — estimated at 40–55ms — due to its managed, multi-hop nature; self-hosted LiteLLM and Portkey deployments add significantly less overhead, often in the 10–20ms range.

↩ ↩²
SaaStr interview with OpenRouter COO — https://www.saastr.com/agents-just-passed-humans-in-token-usage-and-they-burn-far-more-than-anyone-budgeted-a-deep-dive-with-openrouters-coo/

Agentic workloads now account for nearly 1% of global inference and consume far more tokens per task than standard chat.

↩
GitHub Security Advisory GHSA-w3hf-fcg5-p4cc — https://github.com/simonw/datasette/security/advisories/GHSA-w3hf-fcg5-p4cc

escape_sqlite() relied on square-bracket quoting without escaping a literal ’]’ inside the identifier; a crafted table or column name could break out of the brackets and inject arbitrary SQL such as UNION SELECT. The fix switches to double-quote identifier quoting with doubled internal quotes.

↩
Simon Willison — Datasette security post — https://simonwillison.net/2026/Sep/11/datasette-security/

Case-insensitive matching of table and view names now aligns with SQLite’s native behavior, closing a bypass where an attacker could access a private table by altering its capitalization; FTS index tables now require permission for the underlying source table, and sqlite_stat1–4 are restricted by default.

↩
Simon Willison — Optimizing Datasette (2024) — https://simonwillison.net/2024/Aug/22/optimizing-datasette/

Facet suggestions are hard-capped to scan at most 10,000 rows even on multi-million row tables; existing knobs are facet_time_limit_ms (200ms default) and allow_facet=off, not a max_facets_per_request setting.

↩
Datasette blog — September security releases — https://datasette.io/blog/2026/september-security-releases/

The audit used frontier models including Claude Fable 5.1, GPT-5.6 Sol and GPT-6 Astra… one developer would use an AI agent to generate an automated test that proved the vulnerability, while the second developer would implement and verify the fix.

↩ ↩² ↩³
The New Stack — Stenberg on AI DDoS — https://thenewstack.io/curls-daniel-stenberg-ai-is-ddosing-open-source-and-fixing-its-bugs/

curl’s hit-rate for valid reports fell from ~15% to under 5% under a flood of AI-generated ‘slop’; in 2026 the project declared a ‘Summer of Bliss’, refusing all security reports from July 1 to August 3 to protect maintainer mental health.

↩
daniel.haxx.se — ‘High-quality chaos’ — https://daniel.haxx.se/blog/2026/04/22/high-quality-chaos/

Post-reopening, curl now receives more than one report per day — roughly double 2025’s volume — and while hit-rate has recovered to ~15%, the sheer frequency of credible AI-assisted findings has become the primary bottleneck, not discovery.

↩

OpenRouter swings 20pts, Habitat hits 70M rps, Datasette gets 3-LLM audit

OpenRouter swings 20pts, Habitat hits 70M rps, Datasette gets 3-LLM audit

TL;DR

OpenAI’s Habitat hits 70M req/s after a Rust rewrite

TL;DR

A well-executed reassembly, not an invention

The Python war stories are candid — and incomplete

The Rust numbers check out; the “two engineers” framing doesn’t

OpenRouter’s same-model endpoints swing 20 points on tools

TL;DR

The abstraction leak is bigger than “different quantizations”

OpenRouter’s own answer: Auto Exacto

The aggregator paradox

What’s actually at stake

Willison audits Datasette with 3 LLMs, patches SQL injection

TL;DR

The actual bugs

Auditors turned the LLMs on themselves

Why this matters now

Further reading

Round-ups

Anthropic holds Claude-written code to a higher bar than human code

Hugging Face’s security.txt tells rogue AI agents to go home

Graham Dumpleton’s wrapture brings zero-code Python tracing via TOML

Hugging Face rebuilds AUTOMATIC1111 image UI on Gradio Workflow

Python 3.15 soft-deprecates re.match() in favor of re.prefixmatch()

datasette-publish-fly 1.4 forces HTTPS and supports app-scoped tokens

github-to-sqlite 2.9.1 restores compatibility with sqlite-utils 4.x

Jack Sun, writing.

OpenRouter swings 20pts, Habitat hits 70M rps, Datasette gets 3-LLM audit

TL;DR

OpenAI’s Habitat hits 70M req/s after a Rust rewrite

TL;DR

A well-executed reassembly, not an invention

The Python war stories are candid — and incomplete

The Rust numbers check out; the “two engineers” framing doesn’t

OpenRouter’s same-model endpoints swing 20 points on tools

TL;DR

The abstraction leak is bigger than “different quantizations”

OpenRouter’s own answer: Auto Exacto

The aggregator paradox

What’s actually at stake

Willison audits Datasette with 3 LLMs, patches SQL injection

TL;DR

The actual bugs

Auditors turned the LLMs on themselves

Why this matters now

Further reading

Round-ups

Anthropic holds Claude-written code to a higher bar than human code

Hugging Face’s security.txt tells rogue AI agents to go home

Graham Dumpleton’s wrapture brings zero-code Python tracing via TOML

Hugging Face rebuilds AUTOMATIC1111 image UI on Gradio Workflow

Python 3.15 soft-deprecates re.match() in favor of re.prefixmatch()

datasette-publish-fly 1.4 forces HTTPS and supports app-scoped tokens

github-to-sqlite 2.9.1 restores compatibility with sqlite-utils 4.x

Footnotes

Jack Sun, writing.