Specialist generalist. Fly-fisherman with a poor track record. Music lover. Founder at https://nitter.cf/t.co/hRUthJcQPx + https://nitter.cf/t.co/vdOEvKbPqW + https://nitter.cf/t.co/UBOIUBfb77
Mongolia
Joined March 2007
- Tweets6.4K
- Following797
- Followers2.5K
- Likes405
Is there a service that knows the dependencies I’m running and alerts me when a vulnerability has been identified and when a patch has been made available?
Scott Gray retweeted
Security called me at 6:12 AM today.
"Patch every PHP server immediately."
I asked what happened.
"Two critical vulnerabilities. Remote code execution. No authentication required."
Cool.
How many PHP servers do we have?
According to inventory: 12
According to reality:
Nobody knows.
We found one running WordPress.
Three running old internal tools.
One under someone's desk.
Two inside vendor appliances.
A forgotten employee directory from 2016.
And a server named:
PHP-OLD-DO-NOT-TOUCH
Naturally, that one runs payroll exports.
Then we found a PHP 5.6 box.
I asked who owned it.
The documentation said:
BRIAN.
Brian left in 2019.
We called Brian.
He said:
"Oh wow, that's still running?"
Excellent.
By 8 AM, leadership joined the incident call.
CEO:
"Can hackers actually get in?"
Security:
"Potentially yes."
CEO:
"Without a password?"
Security:
"Yes."
CEO:
"Then why do WE need passwords?"
Not the lesson.
Finance asked if we could wait until the weekend to patch because downtime affects revenue.
Security explained that the alternative was letting strangers execute code on our servers.
Finance asked for a cost comparison.
At 9:17, someone suggested temporarily taking the vulnerable websites offline.
Marketing refused.
"Our campaign is live."
So for the next hour, the company officially decided maintaining a landing page for 20% off webinar registration was more important than preventing remote server takeover.
We finally patched everything we could find.
Then our scanner discovered another PHP server.
Hostname:
TEMP-PHP-2014
Uptime:
4,512 days.
Nobody knows what it does.
Nobody owns it.
Nobody can shut it down.
But every time we block network access, the warehouse stops printing shipping labels.
Security has classified it as critical infrastructure.
It is running PHP 5.4.
The vulnerability has existed longer than half our employees.
The emergency patch took four hours.
Finding out what PHP actually runs took eleven.
The internet isn't held together with code.
It's held together with servers everyone is afraid to turn off.
Scott Gray retweeted
Dusting off this tweet from April because this gap in shared understanding of LLM capability is *widening*. It's now less "two groups of people speaking past each other" and more a sharp funnel.
- Napkin math somewhere around 6B people (~75% of the population) have barely come in contact with LLMs at all.
- Around 1-2B (~20%) are casual and infrequent users of free-tier ChatGPT-like products. This group sees derpy chatbots and treats them a bit like a better Google search, a writing aid, or etc. Maybe an agent tries to book you a flight. I have non-tech friends who (reasonably, imo) say they have not much use for it at all. Even many professionals outside of math&code are in this tier. For example, execs and many other functions spend a lot of their time talking to other people, so while they understand what is happening intellectually, it is still second-hand and a bit abstract.
- Now we get to professional use of frontier-grade LLMs in math&code. Somewhere around 20M people (0.2%) see first-hand that large, complex projects that used to take them weeks/months can now be completed by agents with a prompt. Building apps, copying apps, translating apps, decompiling apps from binaries... This has all happened very quickly and recently - less than 1 year ago, I was writing code manually by hand, typing memorized computer code commands into a code editor character by character, occasionally pressing Tab to autocomplete a little chunk of code.
- And finally we get to the ~5,000 people (~0.00006%) with access to frontier-grade systems internally. The external world has seen the preview. It looks like swarms of thousands of agents collaborating over weeks on software mega projects: minting zero days, running cyber attacks and defenses at machine speeds, discovering new science, advancing the frontier of mathematics. Things that would have taken top professionals in the industry years of work. Meanwhile, human review and comprehension are starting to fall behind. For example, people are still involved in the "archeology" of the OpenAI-HF incident from many months ago. Mathematicians may be poring over the 722 manuscripts on frontier mathematics for a while.
The funnel is driven by a combination of factors:
1. The impact scales with ambition, problem size, and horizon. A question with a paragraph answer barely stresses the system. You need a reservoir of big, difficult problems that you really care about. This aspect drives the consumer / professional dimension of the funnel.
2. The jaggedness of the system (which I have written about a lot separately). Capability peaks in domains that are digital, verifiable and economically valuable. This is because LLM capability emerges from reinforcement learning on verifiable rewards on a curated environment mixture driven by revenue potential. This aspect primarily drives the area (e.g. math&code) dimension of the funnel.
3. Access. Free-tier, paid-tier, internal.
So this is the weirdness of the moment. The general public has mostly not interacted with these systems. When they have, it looks like a derpy chatbot. The majority of professionals still see only a modest uplift. And a small sliver of professionals are experiencing the vertigo of the curve going vertical. And it is all happening at the same time.
Judging by my tl there is a growing gap in understanding of AI capability.
The first issue I think is around recency and tier of use. I think a lot of people tried the free tier of ChatGPT somewhere last year and allowed it to inform their views on AI a little too much. This is a group of reactions laughing at various quirks of the models, hallucinations, etc. Yes I also saw the viral videos of OpenAI's Advanced Voice mode fumbling simple queries like "should I drive or walk to the carwash". The thing is that these free and old/deprecated models don't reflect the capability in the latest round of state of the art agentic models of this year, especially OpenAI Codex and Claude Code.
But that brings me to the second issue. Even if people paid $200/month to use the state of the art models, a lot of the capabilities are relatively "peaky" in highly technical areas. Typical queries around search, writing, advice, etc. are *not* the domain that has made the most noticeable and dramatic strides in capability. Partly, this is due to the technical details of reinforcement learning and its use of verifiable rewards. But partly, it's also because these use cases are not sufficiently prioritized by the companies in their hillclimbing because they don't lead to as much $$$ value. The goldmines are elsewhere, and the focus comes along.
So that brings me to the second group of people, who *both* 1) pay for and use the state of the art frontier agentic models (OpenAI Codex / Claude Code) and 2) do so professionally in technical domains like programming, math and research. This group of people is subject to the highest amount of "AI Psychosis" because the recent improvements in these domains as of this year have been nothing short of staggering. When you hand a computer terminal to one of these models, you can now watch them melt programming problems that you'd normally expect to take days/weeks of work. It's this second group of people that assigns a much greater gravity to the capabilities, their slope, and various cyber-related repercussions.
TLDR the people in these two groups are speaking past each other. It really is simultaneously the case that OpenAI's free and I think slightly orphaned (?) "Advanced Voice Mode" will fumble the dumbest questions in your Instagram's reels and *at the same time*, OpenAI's highest-tier and paid Codex model will go off for 1 hour to coherently restructure an entire code base, or find and exploit vulnerabilities in computer systems. This part really works and has made dramatic strides because 2 properties: 1) these domains offer explicit reward functions that are verifiable meaning they are easily amenable to reinforcement learning training (e.g. unit tests passed yes or no, in contrast to writing, which is much harder to explicitly judge), but also 2) they are a lot more valuable in b2b settings, meaning that the biggest fraction of the team is focused on improving them. So here we are.
Scott Gray retweeted
After a brief but institution-eroding slop science era, it increasingly looks like we are going to have two revolutions from AI:
1) Everything ever published will be re-read and re-judged in ways that human scientists never anticipated
2) Novel discoveries will start to come fast
First world problems, but i can never understand why SuperSport have to show the playback interface on the review videos. Why not fill the screen with the content? And now it’s the double squeeze back with Airlink.
As a tool to find fixtures and scores (live and past) the new Supersport app is not good. A step back from what it was.
Scott Gray retweeted
“I don’t do sports betting ads. I’ve seen what gambling has done to people I know 💔. The French national team doesn’t pay me a penny — I even pay for my own flights from Madrid. They wanted me to do a betting shoot as part of my image rights deal, but I refused.”
— Kylian Mbappé
Scott Gray retweeted
I think both Fable 5 and GPT-5.6 get approved for general release next week, and for use outside of the United States as well. But people should remember this moment and remember this feeling, because it is almost inevitable that we eventually reach a point where approval does not arrive.
Capitalism is going to tip the scales this time. I doubt they will approve one model and not the other, because doing so would be seen as incredibly anti-competitive. Fable and GPT-5.6 will probably receive the same clearance, probably on the same day. I also doubt they want to restrict sales outside the US, because that would be seen as anti-business and would trigger a major backlash against American closed-source AI. The rumblings of which you can already hear today. There is also a plan now taking shape on both the US left and right to create some version of an AI public wealth fund that pays a dividend directly to American citizens. That fund needs to be fed by the global sale of the big labs top models to people outside the US. So I think there will be no freeze on their use outside the United States this time.
The other reason is that allowing this will make people happy, and it will soften the fact that Mythos, as was announced yesterday, is available only to a vetted group of US agencies and companies. I do not think that this basic structure will change from here on out. Mythos may eventually be made available to certain allies, but only after the US government, its agencies, and then some chosen American companies have access to Mythos-2, Sol-2, or whatever the new uber-model turns out to be.
I do not think this gap ever closes again, not even for allies. And that means the US will increasingly possess an intelligence advantage that touches almost everything: voting, markets, corporations, academia, infrastructure, and the internal operations of foreign states. Having Mythos-n will always be trumped by whoever has Mythos-n+1. Anthropic themselves have said within nine months Mythos will look like a toy. That advantage, standing at the top of this tower, is too large to give up voluntarily. It also means that many things will become suspect. People will see shadows everywhere. Barring espionage, a deliberate leak, or the emergence of a non-US competitor at the top end of the scale, this structure will persist for some time. The public fight is about access to models. But the real fight is about access to the future. And from this point forward, whoever holds this power will also become increasingly capable of keeping it for themselves.
My observation from about a year ago still holding up - amplifying.ai/research/claud…
Scott Gray retweeted
Everyone's talking about AI replacing jobs. There's a second wave nobody's sizing up.
This kid fires his own teachers, negotiates his own semester, and ranks foundation models like he's scouting prospects. He's 17.
Try onboarding him into your 14-step approval process.
Alex Matthew (@alxmthew) is 17 years old and goes to an AI-powered high school.
He does his learning in 3 hours a day through an AI platform that personalizes his lessons. He has no teachers. Instead, the adults in the classroom are called “guides.” Their job isn’t to deliver information through lectures—it’s to help point kids in the right direction.
Alex spends hours a day at school building a real-world project of his own creation. In his case, it’s @berryaiplushies, an AI stuffed animal designed to help teenagers become more self-aware.
I’m fascinated by how AI might change education: how we learn, and what we learn. That’s why I was psyched that Alex’s parents okay’d him to come on @every’s AI & I. Alex is the youngest guest we’ve ever had, and we covered a lot of ground:
- What a day inside Alpha High School looks like
- Why he doesn't use AI to cheat—even though he easily could
- Whether ambitious teenagers still care about college
- How Gen Z really feels about social media, books, and reading
- His rankings of the foundation models from @OpenAI, @AnthropicAI, @Google, and @xAI
This is a must-watch for anyone curious about what growing up with AI looks like from the inside. The kids are going to be alright.
Watch below!
Timestamps:
Introduction: 00:01:30
A typical day inside Alpha High School: 0:04:08
Why Alpha replaced teachers with “guides” focused on motivating students: 00:06:54
Why Alex doesn’t use AI to cheat, even though he could: 00:12:09
Do ambitious teenagers care about going to college?: 00:19:51
Alex’s take on how Gen Z thinks about AI: 00:25:12
How Alex thinks about the effects of social media: 00:27:52
Gen Z’s relationship with books and reading: 00:31:29
Alex ranks ChatGPT, Claude, Gemini, and Grok: 00:38:57
Why Alex is building Berry, an AI stuffed animal for teen mental health: 00:47:12
Scott Gray retweeted
So how do you work through the most important year of your career?
I have 125 ideas:
chatprd.ai/how-i-ai/workflow…
Not gonna happen
May 2026 be the year that @Strava actually remembers my login on web 🤞🏼 It will make the IPO bigger I swear!
Scott Gray retweeted
Agency > Intelligence
I had this intuitively wrong for decades, I think due to a pervasive cultural veneration of intelligence, various entertainment/media, obsession with IQ etc. Agency is significantly more powerful and significantly more scarce. Are you hiring for agency? Are we educating for agency? Are you acting as if you had 10X agency?
Grok explanation is ~close:
“Agency, as a personality trait, refers to an individual's capacity to take initiative, make decisions, and exert control over their actions and environment. It’s about being proactive rather than reactive—someone with high agency doesn’t just let life happen to them; they shape it. Think of it as a blend of self-efficacy, determination, and a sense of ownership over one’s path.
People with strong agency tend to set goals and pursue them with confidence, even in the face of obstacles. They’re the type to say, “I’ll figure it out,” and then actually do it. On the flip side, someone low in agency might feel more like a passenger in their own life, waiting for external forces—like luck, other people, or circumstances—to dictate what happens next.
It’s not quite the same as assertiveness or ambition, though it can overlap. Agency is quieter, more internal—it’s the belief that you *can* act, paired with the will to follow through. Psychologists often tie it to concepts like locus of control: high-agency folks lean toward an internal locus, feeling they steer their fate, while low-agency folks might lean external, seeing life as something that happens *to* them.”
