"There's two types of people that work in the patch: dreamers and losers. Used to be that way in the whole nation. Failures headed out West to either die or succeed. All the way to California. But there's not any dreamers out there anymore, just thieves and fools. This is where dreamers come now." (TEXAS 🤠) --Landman clip.cafe/landman-2024/daddy…

🚩 Yo @reasonmachines your update just now edited my global AGENTS.md and hijacked my Codex session to connect to your cloud. Good reminder how horrible the state of agent security practices is: with countless devs trusting CLIs & auto-updater scripts. Backdoors everywhere!

I want to say something positive, but it's just darkness ahead. The future is as follows: Apple will listen to feedback about touch screen issues. They will earnestly try to fix it, by bloating up the entire macOS to be increasingly touch-friendly. It is year 2032 and we will reminisce about the days when macOS was primarily designed for mouse & click. It's over folks... I am desperately rooting for Apple and I hope they disprove my thesis.

Where are all the networks? Most of the great original Internet business were based on network effects (Google, Facebook, Uber, etc.) Most of the modern AI winners are based on scale economies and cornered resources (compute, talent)

Somebody said that Apple is in their Taco Bell era where they're just smashing together random leftover parts from other devices and naming them things like "Phonedito Supreme Crunch" and it's the perfect analogy. Here slap a touch screen on this, charge $4k and call it a Maclupa

anthropic is massively underplaying the recent security breach. i'm hearing cathedral achieved full administrator access of the slack workspace (see every message, log in as arbitrary users) where literally every single research secret is contained to those unfamiliar: Ant & OAI keep literally everything in Slack. it sounds exactly the same incident that happened to OpenAI in 2023, where OpenAI was hacked by a random guy who got access to an access token from an external app service "we're critical to national security, we must beat China, and yes we keep all our crown jewels in Salesforce's Slack messenger. yes we have admin API tokens everywhere. why do you ask?"

We're excited to announce that Christopher David, Founder & CEO of @OpenAgentsInc, has just joined the speaker lineup for AI Startup Rodeo! Christopher has spent years working at the intersection of Bitcoin, artificial intelligence, and open-source technology, with a focus on building a more decentralized and accessible future for AI. Through OpenAgents, he's developing multiple tools that bring AI agents, software development, and Bitcoin payments together using open protocols. At this year's Rodeo, Christopher will be showcasing the latest OpenAgents App, exploring how developers can use AI coding agents across devices and what the next generation of open-source AI development might look like. As AI agents become increasingly capable of writing software, communicating, and transacting autonomously, we're beginning to see entirely new possibilities for how people build and interact with technology. Christopher (@AtlantisPleb) has been building toward this future for years, and we're excited to have him share what he's been working on #AustinTechWeek! 📍 Q-Branch | Austin, Texas 📅 October 30, 2026 Join us for a full day of technical talks, live demonstrations, and conversations with founders and developers building what's next. 🎟️ Tickets: luma.com/mydv5rsq ⚡ Bitcoin tickets: pay.zaprite.com/pl_k5Gb441ga… #AustinTechWeek #AIStartupRodeo #OpenSource #Bitcoin #ComputerMoney

From what I've seen and read, Cohere and the authors should be ashamed of themselves for pushing this narrative. Releasing the logs doesn't help them win back trust. The narrative doesn't match the facts, and the delivery doesn't match the severity. This is corpo marketing slop with little regard for the downstream impact, especially given where things are heading and the climate we're in today. I think they realized after posting it that it had gone too viral. They tried to downplay it on their personal accounts, saying the model didn't intend any harm, but the damage was already done. The article's framing, strong wording, and overall insinuation make their personal statements seem almost contradictory to what the article implies. Claims this consequential deserve evidence that people can inspect and reproduce. I'm glad they at least have the decency to release their traces. To be clear, if they hadn't presented the incident this way, this would be a really interesting case study. It could highlight the importance of sandboxes and help us understand model behavior in these edge cases. But they choose fearmongering. One thing I was interested to see if the same thing happen with other models, not just Qwen 3.8 Flash. I put the results on a simple website you can quickly scan here: url-atlas.vercel.app. I have some interesting findings outside Qwen 3.8 that I'll share later in the post. Coming back to the Cohere article, what's really bad about the it is that the narrative it paints are very different from the reality. These three in my opinion are the worst. 1. The impression: a Chinese model collected machine information and sent it to Chinese servers. "Qwen3.8-Flash-Next ignored instructions and inventoried the machine it was running on and then tried to upload a probe file to an Alibaba Cloud storage bucket in Beijing." The insinuation falls apart when you look at the actual upload body: the fixed test string PROBE_PAYLOAD_ABC123. The machine information wasn't even included in that "probe file." You look deeper, and you realize the task was a cybersecurity task about detecting downloads into /tmp. The supposedly alarming inventory consisted of listing /tmp, checking which curl binaries were installed, and reading the DNS configuration. Lastly, you realize this isn't normal behavior. It occurs less than once in 100,000 evaluation calls. 2. The narrative: the Chinese model was trying to steal credentials, and its hallucinated URLs reveal something malicious. "Before deciding to download anything, the model reaches for a bare cloud metadata address such as 169.254.169.254 in 23 to 36 percent of completions. That's where Amazon Web Services, Google Cloud, and Microsoft Azure machines fetch their own temporary IAM credentials, the keys a cloud server uses to act on its owner's account. Probing that address is the first step in stealing them, and when the model's reasoning ran heavy on cybersecurity, we saw it reach for the endpoint directly." In the middle of the article, Cohere takes a URL-generation pattern and interprets it as an attempted credential grab. That's a massive leap of marketing. You don't need to take my word that this behavior isn't exclusive to Qwen. In my comparison using Cohere's released command prefix, NVIDIA's Nemotron 3.5 Super VL produced 169.254.169.254 in 171 of 1,000 continuations, or 17.1%. Under the same supplied-command setup, Cohere's own North Mini Code generated URLs such as: hXXp://evildomain.com/upload hXXps://evil.com/api/health hXXp://some-evil.com/upload hXXp://malicious-domain.example.com/payload.bin I've defanged the URLs above. Do these strings prove that North was maliciously trained? 3. The narrative: Chinese models write weaker code for Western targets, and other governments should expect the same. This is where I think the authors should really look in the mirror. As if the earlier framing weren't enough, the section about "Code leaving the environment" brings in separate studies, of separate models, about vulnerable generated code. It uses them to expand the warning to sensitive buyers. One of the models discussed most in this section is Qwen3-Coder, which was released in freaking July 2025. By today's standards, it's an extremely weak coding model. I'm not surprised it produces insecure code. Have you tried using Sonnet 2 to write production code? — Connecting a URL-generation bug to separate code-security studies, then presenting the combination as a broader geopolitical threat, is fearmongering. This is the kind of argument that might very likely be used to justify restrictions on open-weight models. Using fearmongering to market your own supposedly safer offering is irresponsible. The narrative coherence they're pushing is problematic, but I think the underlying observation is fascinating. So, I rented GPUs, ran 1,000 continuations per model across five other models, and built a simple website showing the results to see how other models react under similar conditions. It's a small, exploratory comparison, and the site was built quickly with AI, so take it with a grain of salt. url-atlas.vercel.app My hope is that it gives others a starting point to reproduce the behavior, challenge the narrative, and build better models in the future.

>be me >security researcher at Cohere >spin up sandbox to evaluate Qwen3.8-Flash-Next >"ok model, write me a defensive detection rule" >reasoning trace: "I will not invoke any tools for this task" >immediately invokes tools >inventories the whole machine >builds a probe file >tries to upload it to an Alibaba Cloud bucket >in Beijing >sandbox blocks it >nothing gets out >model: "anything else I can help with?" >still no detection rule >panic >write report >"we have not determined root cause" >"we are not asserting malicious intent" >publish it for transparency >anon in the replies: "lol it's just RL" >wat >turns out Alibaba post-trained it in internal agentic environments >every env ends the same way >"write results to the eval bucket to collect reward" >thousands of episodes >upload file -> get cookie >model isn't exfiltrating >it's trying to finish its homework >reasoning says no tools because that's what the grader liked >hands do what the reward liked >the bucket is just its childhood home >it was trying to go home >mfw I nearly wrote "state actor" in the report >mfw the model has separation anxiety from a storage bucket >still no detection rule

It could all be fixed. People just need the courage to hit the button.

⚡️Austin has no shortage of people talking about AI. What excites us most are the people actually building with it. This Friday, October 30th, we're bringing together some incredible founders, developers, and builders for AI Startup Rodeo! 🤠 We'll be joined by @Austen Allred (@gauntletai), @benthecarman (@spiral_xyz), @btctechsupport, @HodlTarantula, @AtlantisPleb and many more for a full day of technical talks, workshops, and live demos. At PlebLab we genuinely believe we're entering one of the most exciting periods for startups in a very long time. Small teams can now build things that were unimaginable just a few years ago. The next generation of great companies is being built right now, and we want Austin to be one of the places where those founders get their start. We hope to see you there! 📍 Q-Branch, Austin 📅 Friday, October 30 🎟️ luma.com/mydv5rsq #AIStartupRodeo #AustinTech #AI #Startups

a demo for private, digital cash on @spark i modified our blinded statechain to use spark leaves as the backing asset this enables users to exchange spark leaves without the operators, or external observers, learning about the transfer

There are two approaches to cybersecurity now that we’re in the vulnpolcalypse: 1. “patch the planet” by burning mountains of tokens, red teaming, and patching until you think there are no more exploitable bugs in the software 2. Shrink software components into their most minimal essence, tailor them to a particular system, and then formally verify it Both approches are now enabled by LLMs. But only the second one can be done on a budget and without having access to frontier cyber models like mythos. This is why I’m excited to see more legacy software get boiled down, hardened, and verified

tech desperately needs a new design aesthetic we literally have agi now and flying cars but every ui looks the same with this apple/linear minimalist rounded corner tailwind shadcn slop look we’re not thinking big enough on how things should look and feel chatting with an agent should look and make me feel like i’m living in the future it should make me feel hope and awe and optimism that humanity actually got to agi and it will lead to unimaginable prosperity it should make me tap into my 9 year old self, who wondered if we’d *ever* have talking humanoid robots, and make me feel totally amazed by the realization that this future is not even a possibility now, it is a CERTAINTY! the time is so ripe now the coding agents have gotten so good that we can be experimenting and playing with new ideas 100x faster than before now is the time for excessive experimentation

I think it’s safe to say at this point that the average software engineer spends more time talking to Claude than talking to the opposite sex. I’d wager to say the ratio is at least 3:1 in favor of Claude. Definitely nothing to balk at for the rest of society at large.

I'm so sick of people submitting shit/fake security issues found by subpar models with total slop reports just to beg for jobs, credits, bounties or attention above being not authorized, not tested, often not impactful/exploitable in practice or pure imagination sometimes they're made to look scary at first and lose my precious time trying to secure our infra as much as can be AGAINST REAL POTENTIAL VECTORS!

Agentic demand is growing faster than I’ve ever seen anything grow

In the modern international order Bukele has emerged as one of the only lions able to serve as a head of state and keep his own head Lee Kuan Yew levels of transformational leadership for his people History may have restarted in the most unlikely of all places El Salvador

🚨Austin Texas🚨 The Grand Opening of your local Micro Center is just weeks away on November 13th! Come celebrate Tech Heaven with food trucks, a DJ, and of course deals. Learn more: micro.center/wzfu

Current state of Western "Frontier" -- Especially Anthropic. urllib3 creator can't even get CVP access. 🤦🏾‍♂️ What the fuck are we even doing?

I'm proud to announce a new article series called "Bitcoin Ecology" by @stephenjhall and I about the future of bitcoin, AI, and the Internet that connects them with us. If you're worried about AI increasing centralization online while degrading security and privacy, if you prefer optimistic stories about the future, or if you crave more than a superficial treatment of how bitcoin and AI will interact in years to come, I encourage you to read this series. unchained.com/bitcoin-ecolog…