jon cooper (@jdc) header
jon cooper (@jdc) profile picture

technologist, builder, catalyst, finance guy

NYC/OG
Joined March 2007
Photo by jon cooper (@jdc)Photo by jon cooper (@jdc)Photo by jon cooper (@jdc)Photo by jon cooper (@jdc)Photo by jon cooper (@jdc)Photo by jon cooper (@jdc)
jon cooper retweeted
We will all be learning in coming weeks & months, that most human-made software: ▫️ Was really slow ▫️ Had many security vulnerabilities ▫️ Was under-specified and incorrect AI will rewrite it all. Many times. It will make it fast, cost-efficient, and secure. It will think about failure modes we couldn't wrap our heads around. It will prove, formally verify, load test, harden. It will turn memory-unsafe foundations into robust, optimized ones. If you ask, it'll thoroughly document it, teach you about it, make diagrams, animations, and slide decks. In many ways, we are witnessing the true birth of software engineering.
438
514
187
5,676
212,252
jon cooper retweeted
After Anthropic cracked down it looks like OAI will now get a big slice of the distillation revenue Curious what happens if OAI closes it too. Does the teacher ceiling start to hurt??
1
1
9
1,189
jon cooper retweeted
SmartLoader and StealC must be on a generational run with this malware delivery strategy SmartLoader and StealC, masquerading as a legitimate GitHub repo, using AI to generate a slop ReadMe, has been persistent for like, a year, maybe longer, and it's still going strong
🧐 We found 73 GitHub repos posing as AI agent tools (Claude skills, Codex, MCP servers, OpenClaw) that delivers malware ZIP "installers." @SecurityBreakAI 51 were still live this morning. The payload is SmartLoader a Lua loader that usually drops the StealC infostealer. A small thread (Including IOCs) 🧵
21
27
297
16,165
jon cooper retweeted
a few years ago, I started out skeptical that many non-engineers really wanted to make/mod their own personal software -- but I've come around, think I was wrong. range of desires from: - I feel so powerful - no one will make me the workflow/personalization I need - can I just PM the product for a few weeks and fix this thing that is driving me crazy obvious in retrospect, but if the ease:power ratio is good enough, of course people will make their own software
89
17
14
368
41,011
jon cooper retweeted
BREAKING: Scientists confirm that an ADHD partner cannot actually relax on the couch while you are cleaning the kitchen—they just sit there frozen in "Guilt Paralysis," scrolling their phone in misery while their brain refuses to let them stand up. Researchers baffled. Here is why your partner looks "lazy" on the sofa while secretly panicking inside—and how to break the freeze: 1/6
11
90
7
1,476
183,879
jon cooper retweeted
Good: Can your SOC detect agentic attacks? Better: Can you identify Active Directory misconfigurations as they happen? Best: Can you please stop Suzy from pasting into the run dialogue….
10
4
1
97
6,089
jon cooper retweeted
there is a massive business opportunity now to help companies implement automatic vulnerability scanning and patching. massive. not having a system like this will be like running a webserver without SSL.
Security release pre-alert: We will release new versions of Node.js 22, 24, and 26 release lines on or shortly, after 2026-11-11 in order to address security vulnerabilities. The highest severity issue fixed in this release is HIGH. nodejs.org/en/blog/vulnerabi…
16
12
3
192
16,017
jon cooper retweeted
hands down the best talk I’ve ever seen. the slides are public now. - Calif got permission from @openai to discuss working with the (unreleased) “astra-cyber” model - researchers are struggling to believe some of these exploits are real - 0/1-click exploit development is possible in ~3 hours (with the right prompting, skills, and primitives) - the world is changing faster than expected I also loved the shoutout to the 2019 group facetime bugs and @natashenka’s FT work. everyone who worked on that will remember it forever ❤️ thank you so much for the presentation! @pwnlambda @brucedang @calif_io
5
42
1
487
32,462
jon cooper retweeted
I've been looking forward to this day, because Vercel has an internal security agent that is **astonishingly effective** (lovingly called @𝚑𝚊𝚌𝚔𝚎𝚛). Every single line of code gets audited, automatically. You can now get the same power. Just enable it on all your repos (this product works whether you host on Vercel or not) and your peace of mind will increase tremendously. You'll see it catch things that every other agent misses. Why: you cannot just bank on your engineers having a skill installed, prompting "please make secure", or rolling the weights' dice that the code is good out of the gate. The other cool thing about this is that this was entirely developed by our security team. A lot of companies out there are probably in a mad rush right now trying to staff up. If you wanted to 'download a security team' as software, this is the closest you get today.
Today we are launching Vercel Security Review in public beta. Run vulnerability reviews on every push, and ship fixes in one click with Vercel Agent. Read the blog → vercel.com/blog/vercel-secur…
149
40
17
1,012
88,118
jon cooper retweeted
this is basically the bitter lesson at work the smartest models will need fewer and fewer tokens, they won't need to verify their work or check it for bugs, they will just be right
maybe a hot take but i now consider adversarial reviews mostly a waste of tokens. far better to use those tokens on empirical combined with formal verification. i have updated pstack to use the interrogate skill less, and eventually i think i may remove it altogether i have found very little value with code review in the abstract, agents tend to just get lost in the nitpicks and yagnis
292
274
88
7,934
515,315
jon cooper retweeted
Lockdown Mode helps, until it doesn't.
244
792
223
9,310
1,382,937
jon cooper retweeted
It took me 29 years to realize that the cheat code to life is just having delusional confidence.
955
19,676
1,011
203,914
6,437,916
jon cooper retweeted
Applications are now open for the Anthropic Residency, a paid, fixed-term research program for academics, technical founders, and staff-level engineers who want to make AI safe and beneficial for everyone. No ML background is required. Apply by November 22: alignment.anthropic.com/2026…
1,214
3,190
923
40,447
14,673,765
jon cooper retweeted
I would like to congratulate the organizers of the 2026 Cybersecurity Awareness Month for putting together a truly spectacular event
35
698
32
4,687
96,776
Pandas spend the first hour after waking up struggling to fully wake up
875
4,380
2,899
39,128
1,637,372
jon cooper retweeted
Replying to @cglyer
Completely agreed. I would argue that the criminal gig economy supporting ransomware works like modular agent tasking. Let’s not forget victims had experience going from initial compromise to actions on objectives in 2 hours and full enterprise compromise in less than 3 hours. Many such cases and only a few public* I’m not sure how much faster agentic attacks could be, * thedfirreport.com/2020/11/05…
1
1
11
1,200
jon cooper retweeted
I think the era of rapid detection and response to keep incidents small & contained is going to draw to a close with agentic attacks. We’re going to have to security engineer our way forward instead. Limit blast radius by design. Brilliance in the basics. It will be more about hardening and configuring what you have (which is hard and slow and boring) vs. reaching for some shiny new product that will solve all your issues
24
63
15
372
32,192
What's happening in the sub-scale neocloud world is concerning I'm seeing a lot of startups who raised money from VCs basically pivot into being neoclouds; the issue with that among many other things which I'll highlight in a minute is that neoclouds are not a natural fit for VC money. There is no 100x on the end of the magic rainbow for small cloud teams, at best they'll grow quickly but it's still a business limited by physics to a large extent and even the best teams will not scale valuations like true venture companies (not even close) They're pivoting into the neocloud space because it requires capital (which they have from their investors) and it seems like a good business (rental rates keep going up), and maybe their original business plan isn't finding crazy traction A lot of these teams doing this however are not equipped to handle the execution required to actually bring capacity online when it was promised to off-takers It's "idea guy" meets the real world, and "idea guy" vs "local electrician" is not exactly a great matchup for ideaguy I see a lot of small teams "becoming a cloud" because it sounds good, but they're not close to being ready to really invest everything to ensure the RFS (ready for service) date they committed to their off-takers will be met by any means necessary. As a result I suspect there will be many lawsuits which actually will lead to the "Guppy Level Death" that Elon spoke about last week For off-takers, it's a dangerous environment at the moment - a lot of bad supply in the market, and "providers" who are inevitably going to let them down. Same for lenders. I suspect the financing constraints will continue to tighten on smaller providers unless they're able to put the puzzle together in a way that sufficiently de-risks the counterparties involved (not so simple). Something we're very focused on at @computeexchange To sum it up - Elon is probably right in that Guppy Level Death is on the horizon for many of the current sub-scale providers in the market. and what will force their demise imo will likely be lawsuits based on missed RFS dates and other forms of recourse. There will always be demand to work with smaller providers because 1. they can facilitate an RFS date that can actually support your business, and 2. they are more flexible on price than the big boys (which really matters) So the long tail of providers will ultimately still be there, it's just a question of who in this batch is going to survive. My guess is not a ton, because execution despite what people say, is still not a commodity at least when it comes to physical processes (like bringing a cluster online). Many aren't up to the challenge, but those who are are worth their weight in gold to off-takers and lenders alike
30
27
13
351
111,560
jon cooper retweeted
I’ve been following the TensorFold movement and was impressed, but I didn’t think it would meaningfully work on my 3060. I was wrong. After looking around I only found posts on xx90-class GPUs — nothing for the small-guy cards. So I gave it a shot. Here’s a thread. Starting with the most impressive result: Gemma 4 wrote the video prompts (via both llama.cpp and TensorFold), then those prompts went into Wan 2.1 all on the same RTX 3060.
7
3
1
15
954