jon cooper retweeted
We will all be learning in coming weeks & months, that most human-made software:
▫️ Was really slow
▫️ Had many security vulnerabilities
▫️ Was under-specified and incorrect
AI will rewrite it all. Many times. It will make it fast, cost-efficient, and secure. It will think about failure modes we couldn't wrap our heads around.
It will prove, formally verify, load test, harden. It will turn memory-unsafe foundations into robust, optimized ones. If you ask, it'll thoroughly document it, teach you about it, make diagrams, animations, and slide decks.
In many ways, we are witnessing the true birth of software engineering.
jon cooper retweeted
After Anthropic cracked down it looks like OAI will now get a big slice of the distillation revenue
Curious what happens if OAI closes it too. Does the teacher ceiling start to hurt??
jon cooper retweeted
SmartLoader and StealC must be on a generational run with this malware delivery strategy
SmartLoader and StealC, masquerading as a legitimate GitHub repo, using AI to generate a slop ReadMe, has been persistent for like, a year, maybe longer, and it's still going strong
🧐 We found 73 GitHub repos posing as AI agent tools (Claude skills, Codex, MCP servers, OpenClaw) that delivers malware ZIP "installers." @SecurityBreakAI
51 were still live this morning. The payload is SmartLoader a Lua loader that usually drops the StealC infostealer. A small thread (Including IOCs) 🧵
jon cooper retweeted
a few years ago, I started out skeptical that many non-engineers really wanted to make/mod their own personal software -- but I've come around, think I was wrong. range of desires from:
- I feel so powerful
- no one will make me the workflow/personalization I need
- can I just PM the product for a few weeks and fix this thing that is driving me crazy
obvious in retrospect, but if the ease:power ratio is good enough, of course people will make their own software
BREAKING:
Scientists confirm that an ADHD partner cannot actually relax on the couch while you are cleaning the kitchen—they just sit there frozen in "Guilt Paralysis," scrolling their phone in misery while their brain refuses to let them stand up.
Researchers baffled.
Here is why your partner looks "lazy" on the sofa while secretly panicking inside—and how to break the freeze: 1/6
jon cooper retweeted
Good: Can your SOC detect agentic attacks?
Better: Can you identify Active Directory misconfigurations as they happen?
Best: Can you please stop Suzy from pasting into the run dialogue….
jon cooper retweeted
there is a massive business opportunity now to help companies implement automatic vulnerability scanning and patching.
massive.
not having a system like this will be like running a webserver without SSL.
Security release pre-alert:
We will release new versions of Node.js 22, 24, and 26 release lines on or shortly, after 2026-11-11 in order to address security vulnerabilities.
The highest severity issue fixed in this release is HIGH.
nodejs.org/en/blog/vulnerabi…
jon cooper retweeted
hands down the best talk I’ve ever seen. the slides are public now.
- Calif got permission from @openai to discuss working with the (unreleased) “astra-cyber” model
- researchers are struggling to believe some of these exploits are real
- 0/1-click exploit development is possible in ~3 hours (with the right prompting, skills, and primitives)
- the world is changing faster than expected
I also loved the shoutout to the 2019 group facetime bugs and @natashenka’s FT work. everyone who worked on that will remember it forever ❤️
thank you so much for the presentation! @pwnlambda @brucedang @calif_io
Finally back home! Slides from "0clicks in an AI World," the talk @brucedang and I gave at @unpromptedconf, are now up:
github.com/pwnlambda/talks/b…
jon cooper retweeted
I've been looking forward to this day, because Vercel has an internal security agent that is **astonishingly effective** (lovingly called @𝚑𝚊𝚌𝚔𝚎𝚛). Every single line of code gets audited, automatically.
You can now get the same power. Just enable it on all your repos (this product works whether you host on Vercel or not) and your peace of mind will increase tremendously. You'll see it catch things that every other agent misses.
Why: you cannot just bank on your engineers having a skill installed, prompting "please make secure", or rolling the weights' dice that the code is good out of the gate.
The other cool thing about this is that this was entirely developed by our security team. A lot of companies out there are probably in a mad rush right now trying to staff up. If you wanted to 'download a security team' as software, this is the closest you get today.
Today we are launching Vercel Security Review in public beta.
Run vulnerability reviews on every push, and ship fixes in one click with Vercel Agent.
Read the blog → vercel.com/blog/vercel-secur…
this is basically the bitter lesson at work
the smartest models will need fewer and fewer tokens, they won't need to verify their work or check it for bugs, they will just be right
maybe a hot take but i now consider adversarial reviews mostly a waste of tokens. far better to use those tokens on empirical combined with formal verification. i have updated pstack to use the interrogate skill less, and eventually i think i may remove it altogether
i have found very little value with code review in the abstract, agents tend to just get lost in the nitpicks and yagnis
jon cooper retweeted
Applications are now open for the Anthropic Residency, a paid, fixed-term research program for academics, technical founders, and staff-level engineers who want to make AI safe and beneficial for everyone. No ML background is required.
Apply by November 22: alignment.anthropic.com/2026…
jon cooper retweeted
What a disaster atlasum.net/blog/cve-2026-98…
jon cooper retweeted
Replying to @cglyer
Completely agreed. I would argue that the criminal gig economy supporting ransomware works like modular agent tasking.
Let’s not forget victims had experience going from initial compromise to actions on objectives in 2 hours and full enterprise compromise in less than 3 hours. Many such cases and only a few public*
I’m not sure how much faster agentic attacks could be,
* thedfirreport.com/2020/11/05…
jon cooper retweeted
I think the era of rapid detection and response to keep incidents small & contained is going to draw to a close with agentic attacks.
We’re going to have to security engineer our way forward instead. Limit blast radius by design. Brilliance in the basics. It will be more about hardening and configuring what you have (which is hard and slow and boring) vs. reaching for some shiny new product that will solve all your issues
jon cooper retweeted
What's happening in the sub-scale neocloud world is concerning
I'm seeing a lot of startups who raised money from VCs basically pivot into being neoclouds; the issue with that among many other things which I'll highlight in a minute is that neoclouds are not a natural fit for VC money. There is no 100x on the end of the magic rainbow for small cloud teams, at best they'll grow quickly but it's still a business limited by physics to a large extent and even the best teams will not scale valuations like true venture companies (not even close)
They're pivoting into the neocloud space because it requires capital (which they have from their investors) and it seems like a good business (rental rates keep going up), and maybe their original business plan isn't finding crazy traction
A lot of these teams doing this however are not equipped to handle the execution required to actually bring capacity online when it was promised to off-takers It's "idea guy" meets the real world, and "idea guy" vs "local electrician" is not exactly a great matchup for ideaguy
I see a lot of small teams "becoming a cloud" because it sounds good, but they're not close to being ready to really invest everything to ensure the RFS (ready for service) date they committed to their off-takers will be met by any means necessary. As a result I suspect there will be many lawsuits which actually will lead to the "Guppy Level Death" that Elon spoke about last week
For off-takers, it's a dangerous environment at the moment - a lot of bad supply in the market, and "providers" who are inevitably going to let them down. Same for lenders. I suspect the financing constraints will continue to tighten on smaller providers unless they're able to put the puzzle together in a way that sufficiently de-risks the counterparties involved (not so simple). Something we're very focused on at @computeexchange
To sum it up - Elon is probably right in that Guppy Level Death is on the horizon for many of the current sub-scale providers in the market. and what will force their demise imo will likely be lawsuits based on missed RFS dates and other forms of recourse. There will always be demand to work with smaller providers because 1. they can facilitate an RFS date that can actually support your business, and 2. they are more flexible on price than the big boys (which really matters)
So the long tail of providers will ultimately still be there, it's just a question of who in this batch is going to survive. My guess is not a ton, because execution despite what people say, is still not a commodity at least when it comes to physical processes (like bringing a cluster online). Many aren't up to the challenge, but those who are are worth their weight in gold to off-takers and lenders alike
jon cooper retweeted
I’ve been following the TensorFold movement and was impressed, but I didn’t think it would meaningfully work on my 3060.
I was wrong.
After looking around I only found posts on xx90-class GPUs — nothing for the small-guy cards. So I gave it a shot.
Here’s a thread. Starting with the most impressive result:
Gemma 4 wrote the video prompts (via both llama.cpp and TensorFold), then those prompts went into Wan 2.1 all on the same RTX 3060.




























