For 15 years I've marketed products to people. My new one is built for AI agents. I've joined @krakenfx to lead marketing for AI products, starting with Kraken CLI, which lets agents trade. I'm also working with @arjunsethi again after ten years, and I report to @kamobit, who was our growth advisor at @farmsteadapp. I spent three years at @askjoai building a personal AI agent, and I wasn't done with agents. My growth rule since @Yahoo has been "never ship without an experiment behind it," so I'm happy Kraken CLI has paper trading built in. Your agent tests a strategy against live prices, and when it works, "kraken paper buy" becomes "kraken order buy." If you live in terminal and film builds or trading breakdowns, I want to see what you'd make with Kraken CLI. Same goes for the influencer marketers and agencies behind them. I also want to hear from newsletters and communities that reach developers, AI builders, and crypto people. Want to join Kraken, solo or with your whole team? DM me. You can try Kraken CLI without an account: kraken.com/kraken-cli

I highly recommend cloudflare's security audit skill: github.com/cloudflare/securi… Run it on all your software. Run it with the free models. Use it even if you used a model to audit something - it will find much more things. Works in all agent harnesses and is model independent.

Finally met the goat @hnshah

Ramen with @petergyang in San Mateo. Then caught up with @sunils34 in South Park. With Peter, we got into open source and finding people worth building with. Sunil and I dove into AI adoption, skills, agents, and where software is headed. I love spending time with OG engineers who are deeply AI-pilled. These are the builders who've been building software for so many years and are still this curious about what's next. That's the energy I want more of.

Hello, At 6:32 a.m. PDT we became aware of malicious LiteLLM 1.107.0 artifacts published to PyPI, Docker Hub, and GHCR, which were published at approximately 4:40 a.m. PDT. Enterprise deployments pulling only from our private registry are unaffected by this incident. We are coordinating communication around this incident in this GitHub issue (github.com/BerriAI/litellm/i…). We have removed the malicious releases and images. If you installed or ran them, please follow the remediation guidance in the above-linked issue and treat credentials accessible to those deployments as exposed. Sincerely, Oliver Jensen Director of Security - LiteLLM

ARR = Annual Recurring Revenue 95% of the time I see ARR nowadays it’s non recurring revenue. Recurring used to refer to sticky contracted revenue now it often refers to token or payments revenue Should we redefine ARR as Annualized Revenue Rate rather than fight the usage?

Lots of Security incidents today, here's some practical tips for those who just wanna protect yourself: 1) UPDATE EVERYTHING - main targets are: a) Browsers - Chrome, Safari, Firefox b) OS: : Settings -> General -> software update; Linux: sudo apt update && sudo apt upgrade; Windows: I think there's a button. Do this for any remote home servers & Openclaw/hermes boxes c) Phones: Update it all d) Desktop apps (Slack, Cursor, Discord, etc) 2) Limit web browsing this week: Stay within walled gardens (twitter, youtube, etc); don't click random links this week. Just wait until the patches go through. Do step 1 again after a week. 3) Avoid untrusted Wifi networks until your devices are updated 4) Stay vigilant about phishing emails offering "certificate fixes" or fraud updates 5) Have an iPhone 11-16? TURN BLUETOOTH OFF for the time being until apple patches come through. 6) Code/Dev: UPDATE ALL YOUR REPOS - @charliermarsh has already updated uv 0.13.4 which reacts to the eMudra incident for uv (Python), Typesript according to Claude has equivelant. Tell your agents to go and update all your active repos to update package manager across uv, npm, bun, cargo, etc etc What advice did I miss?

🚨 BREAKING: Node.js just dropped its OWN security bombshell. 4 HIGH-SEVERITY vulnerabilities patched TODAY, including one that could let hackers remotely execute malicious code on vulnerable servers. → 10 SECURITY FLAWS were addressed in today's Node.js release, FOUR rated HIGH severity. → REMOTE CODE EXECUTION: CVE-2026-111497 is a serious flaw in Node.js's Brotli decoder that could allow attackers to execute malicious code remotely. → TLS SECURITY BYPASS: Two separate vulnerabilities could trick affected applications into accepting certificates for the WRONG server under certain conditions. → Think about that. Your application could establish an encrypted connection while failing to properly verify WHO it's talking to. → THREE MAJOR NODE.JS VERSIONS AFFECTED: Node.js 22, 24 and 26 all required emergency security updates. → RUNNING NODE.JS 18 OR 20? Those versions are END-OF-LIFE and aren't receiving these official security patches. → PATCH IMMEDIATELY: Update to Node.js 22.23.4, 24.22.1 or 26.12.1, depending on your release line. If you're using Docker, rebuild and redeploy your containers. PHP AND Node.js both facing major security disclosures on the SAME DAY. If you run a website or application, TODAY is the day to check your servers. And remember: the public release of security patches can give attackers a roadmap to systems that haven't updated. Don't be the last one to patch.

Great thread - we’ve found that Blender pre-viz is a huge cost savings. Animatics also help. voyager.so/blog/script-scene…

So basically, today PHP got two critical bugs that let anyone run code on your server without even logging in, which is bad, and then the details leaked before the patch was even out, which is worse, and it works on WordPress and MediaWiki and Magento and Joomla and Laravel, and Censys says like 1.5 million servers are running a version with no fix, so the NSA was like "take your system offline," and the FBI was like "take your system offline," and CISA and the UK and CERT-EU were all like "take your system offline," and then the Prime Minister of Japan, the actual Prime Minister, posted at 5:55 in the morning telling 48.8 million people to take their system offline, so everyone took their system offline, like the Dutch cybersecurity agency took its own website offline, and the Dutch parliament went offline, and the Port of Rotterdam went offline, and Finland and France and Denmark started pulling government sites, and Wikipedia went down, and Archive.org went down, and Asana and GOG and Something Awful went down, and the University of Vienna's webmail went down for some reason, and that's just PHP. Because GitLab also dropped a CVSS 10.0, which is the highest score they give out, for a bug that's been there since 2014, so that's every self-hosted GitLab for twelve years, and then LiteLLM 1.107.0 got hijacked and shipped a credential stealer and a remote access trojan in every single wheel and the Docker images, including latest, and you didn't even have to import it, just installing it was enough, and it's the second time this year, and then Railway paused every deployment on the entire platform because someone got into the environment variables, so now everyone has to rotate every secret they've ever stored there, and TiDB Cloud said someone was walking around inside with stolen credentials for basically a month and an extortion group says they took 10.6 terabytes, and Zeabur got breached for the second time in two months and is just shutting down, like the whole company, and Node.js patched remote code execution and a TLS bypass, and CISA says Plex is being actively exploited, and someone took over 300 Tor exit relays to steal SSH passwords, and SafePay ransomware has hit over 600 critical infrastructure orgs, and India's biggest bank filed a data loss incident, and Japan has been in an official state of emergency in cyberspace since October 9, which honestly explains the 5:55 AM post. Oh, and eMudhra, a certificate authority that's issued over 60 million certificates, whose entire job is proving websites are who they say they are, was supposed to be using private keys that are random numbers over a hundred digits long, and one of them was 4. Just 4. And the others were like 66 and 237. Anyway, it's Wednesday.

Perhaps the threat was never a rogue AI agent trying to subvert humans—but humans using AI to hurt other humans.

Railway is compromised, rotate all API keys as soon as possible Deployments are down so don’t wait to redeploy Attackers are draining keys in real time, we didn’t lose much but can confirm this is still an active attack Stay safe friends

I'm selling THIS card every time. Free Iran.

🚨 Nightmare day for cybersecurity Multiple major security incidents, active exploits, supply chain compromises... If you run production systems, start patching NOW. PHP: Two critical unauthenticated RCEs. Attackers already exploiting them. Patch NOW LiteLLM: v1.107.0 on PyPI and Docker is BACKDOORED. Steals cloud, SSH, and AI credentials. Pin 1.106.2. Rotate secrets. eMudhra: A certificate authority's keys were crackable. Update your browsers, systems, and trust stores. Node.js / Next.js / React: Security releases for Brotli RCE, TLS bypasses, and TWO critical Next.js RCEs. TiDB Cloud: PingCAP breached through stolen credentials. Customer information and other sensitive data exfiltrated. Read the attacker's release, fun stuff. Plex2Shell: Weaponized within HOURS of the PoC. Attackers already deploying cryptominers and proxy backdoors. BeyondTrust / Ivanti: Actively exploited zero-days added to CISA's KEV catalog. BeyondTrust attacks linked to a China-nexus campaign. And that's not even the full list. Patch. Audit. Rotate. NOW.

Claude Duet, Anthropic’s 24/7 personal agent, is finally here. I had early access and here’s my new video with my honest take on: → Why I think it's the most proactive agent → Why Artifacts could be its secret sauce → How it stacks up to Grok Bot, Muse, and Dots Duet is in research preview and I’m sure will improve a lot over time. 📌 Watch now: piped.video/D-pz8L1orVI nitter.siddz.com/claudeai/status/211298…

time to play daily.fun

Today we’re rolling out @dailyfun We're making markets ridiculously fun to play, and we're just getting started. Join our beta today.

Armand is that rare consumer growth founder who's found his market

I'm fucking back. After years of building consumer apps, and the incredible privilege I had working with Aave and Polymarket... did you really think I was going to AI? I think access to markets has been solved, Robinhood put the exchange in your pocket, and prediction markets make damn near everything tradable. Participation is the next big problem. We're not going to build another trading terminal. I think about TikTok, X and Netflix. Something you open because you expect to find an experience worth your time. The app that you open every single day, hence the name. So what actually is Daily?

i am confident that the people that made this decision were excel jockeys, don't play games, when you traceroute... EA, bioware, sold to foreign organization that may not understand gaming....

I launched the first image and video generation models at Google, and kept asking why all AI designs look the same. AI has brought us the WORST era of design. It made content creation effortless, but it also made 90% of it look painfully generic. My co-founder and I spent 2 years building in stealth to change that. Meet Vyb, the first AI design model that understands your taste like a designer would. RT + comment your website URL and we’ll make your first design.