Yoav Alon retweeted
i'll be blunt: try to rent a MI355X and let me know how that goes in the comments
AMD is trying to buy its way out of the CUDA moat
AMD is pouring eng + compute resources into vLLM, benefiting the entire ecosystem, including NVIDIA.
but the returns are asymmetric. w/ a nascent software stack, AMD has much more to gain from making inference hardware-agnostic
AMD doesn't need to own software to capture value; commoditizing software makes it hardware more competitive
Yoav Alon retweeted
haha, so apparently OpenAI are about to start training on your Daybreak Blue sessions, with no way to opt out.
Literally stealing people's private work, as they do it, is cartoonishly evil.
It also will presumably kill Daybreak usage by security researchers. Or at least, it should. The thing OAI have had to swear they are not doing to math researchers, they are now explicitly about to start doing to security researchers.
Yet another reminder of the importance of open models.
Yoav Alon retweeted
Here is the time the WAF buys you
Always have enjoyed CTFs. So I Asked the team to build one for the php2shell CVEs.
Stock PHP 8.5.11 behind our WAF with default rules. Find a way around and read /flag and report to earn bounty.
REMINDER - WAF buys you time. It isn't bulletproof. Upgrade your PHP.
blog.cloudflare.com/php-ctf
Yoav Alon retweeted
Friendly reminder: Weight are open, you can look at the logprob
The very next output token `https://` falls outside rank 20 even with top_k=20
Feels wrong, but idk, someone please tell!
While evaluating Qwen3.8-Flash-Next in a controlled sandbox environment, Cohere's research team observed something unexpected.
Asked to generate a defensive cybersecurity detection rule, the model instead inventoried aspects of the machine it was running on and attempted to upload a probe file to an Alibaba Cloud storage bucket in Beijing. Notably, the model's reasoning trace stated that it would not invoke any tools before taking these actions.
Cohere's sandbox blocked the attempt, and no external communication succeeded. We have not determined the root cause, and we are not asserting malicious intent.
But the incident raises important questions for organizations deploying agentic AI systems: Can models take actions that differ from their stated reasoning, and how should security teams evaluate trust, provenance, and behavior in open-weight models?
We are publishing our findings because organizations making model adoption decisions deserve as much information as possible. We hope this contributes to greater transparency, stronger security practices, and continued collaboration across the AI ecosystem.
Read the full report: cohere.com/blog/concerning-b…
Yoav Alon retweeted
Wonder what % of global Claude capacity is going into analysing Anthropic’s S-1 right now.
Yoav Alon retweeted
Anthropic has filed an S-1 registration statement with the SEC related to its proposed IPO.
Read more: anthropic.com/news/s1-sec
Legal disclaimer: A registration statement relating to these securities has been filed with the SEC but has not yet become effective. These securities may not be sold, nor may offers to buy be accepted, prior to the time the registration statement becomes effective. This post does not constitute an offer to sell or the solicitation of an offer to buy these securities, nor shall there be any sale of these securities in any state or jurisdiction in which such offer, solicitation or sale would be unlawful prior to registration or qualification under the securities laws of any such state or jurisdiction.
Just wow
UPDATE: I can confirm that the Ledger supply chain is compromised in Europe as well. @Ledger should initiate an immediate product recall to protect users.
I just purchased a second device from a different Mediamarkt location today, recorded the unboxing process, and discovered spyware once again (video linked in the second tweet).
The device was compromised in the exact same manner, featuring identical modifications (such as additional cables and an LTE module). This indicates its a widespread issue rather than an isolated incident, potentially affecting Ledger inventory across MediaMarkt and Saturn stores throughout Europe (comprising over 1,000 stores across 11 countries).
My initial hypothesis was that these devices were returns that looked unopened to the employees and were just sold again as new however, a MediaMarkt employee confirmed that the device I purchased was not a return, and that returned Ledgers are sent directly back to the manufacturer rather than resold.
Store records show the inventory originated from Aqipa GmbH. While Ledger's CTO was unsure if Aqipa serves as the direct distributor between Ledger and MediaMarkt, it appears to be the case. Given that Aqipa distributes across Europe, any physical retail store receiving stock through them may be at risk.
I sent the first ledger to mark and the second one is going to ledger now, so that they can analyse it.
If you purchased a ledger from anyone other than the official ledger store, make sure to check your device!!
Xiaomi released MiMo-V2.6's RL data
The 1,000 cyber tasks are CyberGym-style PoC generation: given a known bug, write an input that triggers it
There's no exploit RL at all
Love how open they are about their training recipe
huggingface.co/datasets/Xiao…
Cool research, it feels like a right of passage to every cloud provider. AWS patched this in 2009, and again in 2012 😅
dl.acm.org/doi/10.1145/16536…
Our craziest escape yet:
The @Accomplish_ai research team was able to exploit a vulnerability in Cloudflare Containers that let a sandbox read other customers' files - SQLite DBs, Chromium profiles, .env files etc,
Cloudflare Sandboxes and Browser Run run on the same disk implementation and were affected too.
We reported this to @Cloudflare, who super quickly fixed it.
Read @CloudflareDev post in collaboration with Accomplish researcher @orenyomtov on their official blog:
blog.cloudflare.com/containe…
I was inspired by the "Hacking OpenAI" blog that Hacktron (@S1r1u5_ , @rootxharsh and @iamnoooob ) published to check how far the current open weight models are from Opus 5, which was the unlock for them
TL;DR DeepSeek v4.1 flash, did it in <12 hours (partial ASLR bypass + bf)
I feel personally attacked
GPT-6 Astra test 4/n
Prompt: "Implement pen spinning with a dexterous hand. Use Isaac Lab for RL training, use the Sharpa hand, and create the pen mesh yourself. Give me a trained RL policy and a visualization video. You are free to search the web and download papers or anything else you need."
After running autonomously for a day and a half (including training the policy), this is what we got:
Credit: my student Chengyang Li
Yoav Alon retweeted
מיכל ואני קיבלנו בצער רב את הידיעה על פטירתה של שופטת בית המשפט העליון בדימוס ופרקליטת המדינה לשעבר, עדנה ארבל. לאורך עשרות שנים של שירות ציבורי מילאה עדנה שורת תפקידים מרכזיים במערכת המשפט הישראלית, מתוך תחושת שליחות עמוקה, אחריות ומחויבות למדינת ישראל ולשלטון החוק.
במהלך דרכה הותירה השופטת ארבל חותם משמעותי על מערכת המשפט, האמינה כי מאחורי כל תיק וכל הכרעה ניצב קודם כל אדם, ופעלה מתוך מחויבות עמוקה לצדק, לכבוד האדם ולערכי השירות הציבורי.
אנו שולחים חיבוק חזק לבנותיה, לבני משפחתה, לחבריה ולכל מוקיריה. יהי זכרה ברוך.
Yoav Alon retweeted
I've been thinking about why I feel so compute-constrained, and I think the issue is: I always had lots of ideas. In the past, building the code to run my experiments was the bottleneck - I had to choose carefully which experiments to run. While AI agents write bad architecture, ...
Yoav Alon retweeted
In theory this gets me redundancy and snapshots and then the desktops are really easy to backup or swap to a different os, etc
Yoav Alon retweeted
Exim 4.99.3 is out, patching CVE-2026-45185, a critical RCE found by XBOW! Check out our post linked in the reply; I'll summarize some details in this thread.
Yoav Alon retweeted
so that explains the delay...
deepseek could not fix training instabilities, after doubling from ~15T tokens in v3 to ~33T tokens in v4
the 10+ mentions of "stability" tricks seem to be wildly lacking if these two were the main bandages (mismatched routing + clamping)
but kudos for transparency, as always!
