CTO and co-founder of CeTu. https://nitter.cf/t.co/vpoiQU09SX - Make coding agents your own.
Joined June 2009
- Tweets1.8K
- Following529
- Followers193
- Likes3.1K
I have been wondering about such metrology for a while. The notion of PRs and waiting for countless checks to run before you can get something merged is slowing down. The defences we got for software quality are mainly for humans. But for agents, can we do better?
I like this quote from the post
But if every change has to be perfect before it goes in, everyone ends up waiting in a single file line again. So we let changes in that aren't quite right, and require that once an hour everything is in line. Before that it can be a bit disorderly. With code you can spot the mess as it happens and send a janitor right away, which is what we do.
Agents don't work like human. They can figure out what is wrong quickly and fix it quickly. Usually faster than the PR times.
Seems like Google are back in the model game. Great news to everyone
I did say we'd be releasing our models periodically...introducing Gemini 4 Carbon, our next frontier model.
Following Argon's release just two weeks ago, Carbon shows the pace at which we’re pushing the frontier, it ranks #1 on the recently updated v5.0 of @ArtificialAnlys Intelligence Index at 59. It also leads across key cybersecurity evaluations scoring 88.2% on SEC-bench Pro for finding vulnerabilities, 54.8% on ExploitGym for exploitation, and 71.0% on CWE-bench for patching.
We’re seeing significant improvements in long-horizon tasks even compared to Argon, and we’ve strengthened frontier safeguards.
As we did with Argon, we’re going to roll it out gradually + responsibly. Some trusted cyber defenders will get access starting this week. We'll be expanding it to more partners through our Fairwind Program, ahead of wider availability soon, so hang tight!
Kfir Gollan retweeted
Announcing 3 Critical vulns for hundreds of millions of IoT, Firewalls, OT, and Military devices including: Palo Alto Networks, Comcast, D-Link, HP, Canon, Honeywell, GE, Oracle, Siemens, Rockwell, Digi, Lockheed Martin, Boeing...
The vulns are with GoAhead Web Server which is a backend library used by these devices. There's a patch available from GoAhead but that doesn't mean there's a patch available for the devices yet -- that's up to the manufacturer.
- TLS traffic over DHE ciphers have a 1-byte secret, "04", meaning anyone can decrypt connections to these devices and steal login credentials and session tokens if the client negotiated with DHE ciphers like the latest TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256, which is extremely likely.
- LibreSSL mTLS has been completely bypassed, meaning anyone can connect over mTLS. If you have one of these devices listening on the internet and are expecting mTLS to protect it from attackers, take it offline or patch asap.
- OpenSSL Certificate Revocation Lists (CRLs) are not enforced, meaning if a user device is stolen or compromised, and you revoke that mTLS cert, nothing actually happens. There are a lot of other attacks this can be used for.
These are critical because these types of devices run our world. Water systems, electricity, military, firewalls, critical infrastructure.
foxio.io/blog/choose-your-ba…
A few months ago I ordered NFC stickers but never got to do anything with them. Today I finally had some time so I gave it a go. A few hours passed and now I have a fully functioning personal use app that works with it. Bunch of stickers around the house and.. it just does things.
My current use case is mainly auto shopping list. Out of eggs? Just put the phone next to relevant sticker and it's on the list.
Any ideas for cool stuff for home automation based on NFCs?
This is interesting. If the claims here are true and the nvidia hardware is limited on purpose - we will see a wave of such attacks on hardware using the latest models. Once this path was proved to work it will most likely find its way to other nvidia chips as well
卧槽，3090要可能要涨价了！！
因为老黄的刀法被人破解了
有人给3090解了个锁，同样限制在 360W，PyTorch 测试从 75 TFLOPS 跑到了 135 TFLOPS，提升约 80%！
你以为是超频，把功耗往上拉？
但他改的是显卡里控制运算速度的寄存器，这些寄存器平时有权限保护，正常改不了
他利用 GPU 启动固件的漏洞，赶在 NVIDIA 驱动加载之前拿到写入权限，把相关运算改成全速，再交给原版驱动使用
解开的主要是 FP16／BF16 输入、FP32 累加这类 AI 运算的速度限制 但测试算力多了 80%！！
4090 也有分支项目做到了：同类运算的指令吞吐，从约 165 TFLOPS 提升到 331 TFLOPS，接近翻倍
项目地址，附上👇
github.com/Zagitta/gpu-unloc…
AWS finally getting into the Securiry business. I wonder if we'll see more significant actions here, as the result of the wiz acquisition, or it will remain some side line product
Almost every company we talk to is worried about security right now.
AI has taken the gap between finding a vulnerability and someone using it from weeks down to minutes, leaving teams scrambling to keep up.
That’s why we built AWS Continuum, now generally available.
It works autonomously with guardrails you set to discover vulnerabilities, confirm which ones are genuinely exploitable, prioritize what matters most, and build the patches to close them. Teams spend their energy on real risk instead of chasing noise.
Customers like IBM, Robinhood, Capital One, Infor, and Luminate have been running it in preview and see a meaningful difference in their security efforts.
Continuum gives security teams what they need to keep up with the risks of today, and get ahead of them. Should be a huge help. aws.amazon.com/blogs/aws/aws…
Another report from OpenAI - the agents found multiple VM escapes vulnerabilities, hardware sidechannel attacks and more.
Crazy progress. I wonder how 2027 will look like in cyber
Over the past several months, we have substantially hardened the security of our research training environment. We’ve removed live internet access for all frontier models during training and built an offline world for them to use instead—a cached version of the web where they can still learn to browse, search, and use applications.
On September 20, after a model exploited a DNS misconfiguration to find a way outside of this offline world, we paused frontier training to strengthen containment further. We assembled teams of agents, powered by our most cyber-capable models, and tasked them with finding weaknesses in our research environments.
While they found no route to the internet they could easily exploit while concealing their activity from our monitors, they did find zero-day vulnerabilities, virtual machine escapes, and hardware side-channels for communication between agents. We used their discoveries to further strengthen our defenses and contribute fixes to open-source software.
After strengthening our containment architecture, we resumed our frontier RL training and inference on October 1. We’ve reserved substantial compute for continuous red-teaming, and made high-compute red-teaming part of the safety cases we use to decide whether frontier training and evaluation can proceed securely.
openai.com/index/securing-ou…
Full remote code execution from a bug in a common compression library.
A few days ago php2shell broke the Internet. Now it's "brotli to shell" which is essentially everywhere. Crazy times
During this red-teaming exercise, we also found a vulnerability that allows for unauthenticated remote code execution in Brotli, a widely-deployed compression library included in many pieces of software such as Node.js, Bun, and Envoy.
The flaw could let an attacker run their own code on affected systems by sending or replying with malicious compressed data, without any need to create a user account. That is, an unpatched server that accepts compressed input could be taken over by a malicious client, and an unpatched client that accepts compressed input (such as “curl --compressed”) could be taken over by a malicious server.
This root cause issue was actually fixed in the Brotli source code in February, but it wasn’t known at the time that it gave rise to a security vulnerability and there was no more recent release of Brotli. Since Brotli is built into other software, any software which includes this library needs to take the update too, followed by the users of that software. We disclosed the vulnerability to Brotli and other downstream projects such as Node.js, which released or are currently releasing security updates, and Brotli cut new release versions and published a CVE.
More details on the patch and mitigations below:
patchtheplanet.org/brotli
Kfir Gollan retweeted
Introducing Kimi K3.1 Pro: our most capable 3T-class open-weight model.
🔹 1M-token context, 2.8T total / 104B active params (MoE), Multimodal.
🔹 Full-project coding: games in Unreal, Unity & Godot.
🔹 Excels at parametric 3D modeling in Blender & CAD.
🔹 More reliable at finance work: Accurate modeling with hallucination down by 65%.
🔹 Matching the strongest proprietary models across coding, agentic and knowledge benchmarks.
Kimi K3.1 Pro and K3.1 Pro Highspeed (2–3× faster) are now live on Kimi.ai, Kimi Work, Kimi Code, and the Kimi API.
Open weights by Nov 4, 2026.
🔗 API: platform.kimi.ai
🔗 Tech blog: kimi.ai/blog/kimi-k3-1-pro
Very interesting to see that @Meta and @Apple are working together on getting frontier level AI models running locally on Mac Studio. The cooperation here is on CEO to CEO level. I have a feeling that this joint effort will really push hard on getting local AI truly useful.
Great for everyone
Muse Spark Open -- weights releasing today -- runs great on new Mac Studios thanks to work with @johnternus and Apple.
Anthropic joins the movement of "agentic source control". We saw cursor, cloudflare and other players with similar initiative. Even GitHub former CEO set out to build new version control for agents.
There is clearly a need here, I wonder if something will catch with the general community on this.
Interesting question here - will Microsoft do something here? Will GitHub come with their own answer? Or will they die out?
New on our Engineering blog: Creating in-house source control.
In May, we merged around 2,500 code changes per day. In September, we merged more than 30,000 per day. As a result, we became bottlenecked by developer infrastructure built for human (rather than agent) scale.
Here, we share how we built a new version control system—and fully migrated our monorepo from git—in five months: anthropic.com/engineering/re…
Apparently an OpenAI employee planted a physical recording device at their office to collect information. Should this be considered just corporate espionage? Is this "next level distillation"? Will be interesting to see how this plays out
We discovered a sophisticated recording device that was hidden inside one of our offices. We used our models to understand the device and where it had come from, identifying that a specific employee had planted it a few days earlier. We referred the matter to the FBI, and we’re grateful to the agents and prosecutors who moved quickly to make an arrest. The FBI’s investigation is ongoing and we will continue to support their work.
At this time, we have no indications of this individual inappropriately accessing or exfiltrating model weights, source code, or customer data. The employee was terminated.
We take protecting our technology, data, and people seriously, and as a matter of national importance. Our security program is designed to protect against a wide range of threat actors, from insider risks to cybercriminals to nation states, and this case is an example of how AI can help address these sophisticated security threats.
The team behind Jev just did a "series A" of over $800M. These are great news! I hope the team will push forward innovation and bring to the word additional models and categories of faster and cheaper models
we told @a16z we wanted to put intelligent software everywhere
they asked how much compute that would take
we said Uh Yes.
announcing our really big Series A
Very impressive results on hacking chrome. Though I do wonder, at what point it's just a matter of who spends tokens in GLM and similar models. Like if GLM can find the issue for less than $250k usd - why pay a human?
We just received a $250,000 Chrome Full Chain bonus! 🎉
We've claimed the second Full Chain bonus of 2026. Only two remain!
Under the rules, every vulnerability had to be a non-duplicate 0-day, and the entire exploit chain had to be completed before any of them were patched.
Huge thanks to @nebusecurity for discovering a V8 vulnerability in just a single day! Also, a big thank you to @_deayzl for collaborating with me on the V8 Heap Sandbox research.
P.S. KVM escapes have been getting a lot of attention. I actually captured the Full VM Escape flag in KVMCTF about three months ago. Hopefully, I'll be able to share that research soon, too!
If you haven't tried it - give @suno a try.
I just used it to create a bed time song for my baby boy. Works surprisingly well. They made some serious improvements since the last time I tried it
Great news from Anthropic! Haiku gets a new version 5.5 with remarkable capabilities. Personally I think the future of most agentic tasks is "auto select + orchestration". Have a smart model like Opus/Fable decide on the solution path, pushing as much work as possible to smaller models as needed. Optimising for lower overall spend.
If Anthropic gets this as an optional mode in ClaudeCode it will be a killer feature IMHO
I've been thinking recently about various implications of the advancements in AI. One thing that came to my mind was a demo from palantir from a few years ago. On how they use LLMs to optimise decisions on the battlefield.
Future warfare will be very different. Think of swarms of drones operating autonomously. Lethal & cheap weapons.
Maybe there is something in @DarioAmodei s warnings for everyone after all...
youtu.be/XEM5qz__HOU?si=_IqW…
In a project I'm working on we needed to add some Frontend monitoring. I thought about using OpenReply or Sentry. A team member suggested we just give the requirements to codex. No need for another subcontractor approval, no need for infra maintenance (codex handles that as well). So we gave it a try. A few hours later we had our very own monitoring system with sessions recording and all. Fully operational and running on prod.
Sentry is a $3b company. These days you can get a comparable product with just a prompt, it's true that for the high end customers there will be some features that Sentry offer that the codex variant doesnt provide. But how many of Sentry customers are in this category? How many SaaS services are this easily replaceable these days?
Crazy times
Underdog are building AI models that can run your Mac. Currently they claim to get Opus4.6 level performance. You got a Mac, endless tokens. They are backed by some of the best VCs out there, which I assume means that they have some serious tech there.
I'm not sure I buy into the concept of everything must be local. I mean, our banks have websites and apps, our trading brokers, our medical files, and it works alright. The interesting point here IMHO is the impact on token economics. I hope the future goes to some very capable model running on the cloud managing local instances. Allowing very efficient token usage.
I believe that as models improve we will have higher standards. More secure performant and useful software. Even with the local models token spend will continue to go up
Introducing Underdog, your Private Personal AI on devices you already own
Today we're announcing our backing from @a16z @khoslaventures @HummingbirdVC Anthology (@AnthropicAI @MenloVentures) @patrickc @naval @rauchg @polynoamial @Thom_Wolf @Mascobot @tszzl @OfficialLoganK and other top AI leaders
Our mission is to provide free, capable, reliable and private AI to billions of people.
Underdog’s Law: today’s frontier intelligence reaches your devices in six months.
We’re starting with fast, capable AI that runs on consumer hardware. By co-designing models and inference engines, we’re pushing the frontier of capability, speed, power and data efficiency.
Our research also spans agentic commerce, confidential inference, and how AI will reshape the internet economy.
Privacy and capability no longer needs to be a tradeoff. If you believe in this future, join us. Time to build.
