Latest / AGI Dreams – Open, Uncensored, & Local - AI News Digest / AGI Dreams Podcast – February 27, 2026

Transcript

AGI Dreams Podcast – February 27, 2026 · AGI Dreams – Open, Uncensored, & Local - AI News Digest

• 0:00
  Michael
• 0:00
  Bilca,
• 0:00
  formerly
• 0:01
  of
• 0:01
  the
• 0:01
  FBI's
• 0:02
  cybersecurity
• 0:02
  infrastructure
• 0:03
  group
• 0:03
  and
• 0:03
  one
• 0:03
  of
• 0:03
  the
• 0:03
  original
• 0:04
  architects
• 0:04
  behind
• 0:04
  ETSI
• 0:05
  TC
• 0:05
  SAI,
• 0:06
  has
• 0:06
  written
• 0:06
  the
• 0:06
  sharpest
• 0:07
  articulation
• 0:07
  yet
• 0:08
  of
• 0:08
  why
• 0:08
  prompt
• 0:08
  injection
• 0:09
  is
• 0:09
  fundamentally
• 0:09
  unfixable
• 0:10
  at
• 0:10
  the
• 0:10
  model
• 0:10
  layer
• 0:11
  —
• 0:11
  and
• 0:11
  why
• 0:11
  the
• 0:11
  solution
• 0:12
  was
• 0:12
  already
• 0:12
  built
• 0:12
  once,
• 0:13
  fifty
• 0:13
  years
• 0:13
  ago,
• 0:14
  then
• 0:14
  deliberately
• 0:14
  destroyed.
• 0:15
  His
• 0:15
  argument
• 0:16
  centers
• 0:16
  on
• 0:16
  SS7
• 0:16
  (Signaling
• 0:17
  System
• 0:17
  No.
• 0:18
  7),
• 0:18
  the
• 0:19
  nervous
• 0:19
  system
• 0:19
  of
• 0:19
  the
• 0:19
  global
• 0:20
  telephone
• 0:20
  network
• 0:20
  before
• 0:21
  it
• 0:21
  was
• 0:21
  gutted.
• 0:22
  SS7
• 0:22
  maintained
• 0:23
  a
• 0:23
  clean
• 0:23
  architectural
• 0:24
  separation:
• 0:24
  the
• 0:25
  bearer
• 0:25
  channel
• 0:25
  carried
• 0:26
  voice
• 0:26
  (data),
• 0:26
  the
• 0:26
  signaling
• 0:27
  channel
• 0:27
  carried
• 0:27
  commands.
• 0:28
  These
• 0:29
  were
• 0:29
  physically
• 0:29
  separate
• 0:29
  —
• 0:30
  different
• 0:30
  protocols,
• 0:31
  different
• 0:32
  infrastructure,
• 0:32
  different
• 0:33
  trust
• 0:33
  assumptions.
• 0:34
  Nobody
• 0:34
  confused
• 0:35
  which
• 0:35
  was
• 0:35
  which
• 0:35
  because
• 0:36
  the
• 0:36
  architecture
• 0:36
  did
• 0:36
  not
• 0:36
  permit
• 0:37
  confusion.
• 0:38
  Then
• 0:38
  SMS
• 0:39
  happened.
• 0:40
  The
• 0:40
  bean
• 0:40
  counters
• 0:40
  noticed
• 0:41
  spare
• 0:41
  bandwidth
• 0:41
  on
• 0:41
  the
• 0:42
  signaling
• 0:42
  channel
• 0:43
  and
• 0:43
  shoved
• 0:43
  user
• 0:43
  content
• 0:44
  into
• 0:44
  it.
• 0:44
  The
• 0:44
  architectural
• 0:45
  guarantee
• 0:46
  evaporated,
• 0:46
  and
• 0:47
  downstream
• 0:47
  consequences
• 0:48
  —
• 0:48
  SS7
• 0:49
  vulnerabilities
• 0:50
  used
• 0:50
  to
• 0:50
  intercept
• 0:50
  calls,
• 0:51
  track
• 0:51
  locations,
• 0:52
  redirect
• 0:52
  2FA
• 0:53
  codes
• 0:53
  —
• 0:54
  are
• 0:54
  still
• 0:54
  being
• 0:55
  exploited
• 0:55
  today.
• 0:56
  Bilca's
• 0:56
  point
• 0:57
  is
• 0:57
  structural:
• 0:57
  the
• 0:58
  transformer
• 0:58
  context
• 0:58
  window
• 0:59
  commits
• 0:59
  the
• 0:59
  same
• 0:59
  original
• 1:00
  sin.
• 1:01
  Instructions
• 1:01
  and
• 1:01
  data
• 1:01
  land
• 1:02
  in
• 1:02
  one
• 1:02
  undifferentiated
• 1:03
  token
• 1:03
  stream,
• 1:04
  and
• 1:04
  no
• 1:04
  amount
• 1:05
  of
• 1:05
  RLHF,
• 1:06
  constitutional
• 1:06
  AI,
• 1:07
  or
• 1:07
  clever
• 1:07
  prompting
• 1:08
  can
• 1:08
  enforce
• 1:08
  a
• 1:09
  distinction
• 1:09
  that
• 1:09
  does
• 1:09
  not
• 1:09
  exist
• 1:10
  in
• 1:10
  the
• 1:10
  representation.
• 1:11
  The
• 1:11
  fix
• 1:11
  is
• 1:11
  two
• 1:12
  channels
• 1:12
  —
• 1:13
  a
• 1:13
  trusted
• 1:13
  control
• 1:13
  channel
• 1:14
  for
• 1:14
  human-to-AI
• 1:14
  intent
• 1:15
  and
• 1:15
  an
• 1:15
  untrusted
• 1:16
  data
• 1:16
  channel
• 1:16
  for
• 1:16
  everything
• 1:17
  the
• 1:17
  agent
• 1:17
  retrieves
• 1:17
  from
• 1:18
  the
• 1:18
  world
• 1:18
  —
• 1:18
  with
• 1:19
  a
• 1:19
  hard
• 1:19
  boundary
• 1:19
  between
• 1:19
  them.
• 1:20
  He
• 1:20
  proposes
• 1:20
  ETSI
• 1:21
  TC
• 1:21
  SAI
• 1:22
  open
• 1:22
  a
• 1:22
  work
• 1:22
  item
• 1:23
  for
• 1:23
  a
• 1:23
  testable,
• 1:23
  certifiable
• 1:24
  protocol
• 1:24
  specification,
• 1:26
  analogous
• 1:26
  to
• 1:26
  FIPS
• 1:26
  140
• 1:27
  for
• 1:27
  cryptographic
• 1:28
  modules.
• 1:29
  The
• 1:29
  bottom
• 1:29
  turtle:
• 1:30
  hardware-attested
• 1:31
  signing
• 1:31
  at
• 1:31
  the
• 1:31
  TPM/SGX
• 1:33
  level,
• 1:34
  with
• 1:34
  public
• 1:34
  keys
• 1:34
  on
• 1:34
  a
• 1:34
  transparency
• 1:35
  ledger.
• 1:36
  Science
• 1:36
  fiction?
• 1:37
  TPMs
• 1:38
  ship
• 1:38
  in
• 1:38
  most
• 1:38
  modern
• 1:38
  laptops.
• 1:39
  The
• 1:40
  engineering
• 1:40
  challenge
• 1:40
  is
• 1:40
  integration
• 1:41
  and
• 1:41
  standardization,
• 1:42
  not
• 1:42
  invention.
• 1:43
  The
• 1:43
  timing
• 1:43
  lands
• 1:43
  well.
• 1:44
  This
• 1:44
  week
• 1:45
  Orca
• 1:45
  Security
• 1:45
  disclosed
• 1:46
  RoguePilot,
• 1:47
  a
• 1:47
  passive
• 1:47
  prompt
• 1:47
  injection
• 1:48
  attack
• 1:48
  against
• 1:48
  GitHub
• 1:49
  Copilot
• 1:49
  in
• 1:49
  Codespaces.
• 1:50
  The
• 1:51
  exploit
• 1:51
  embeds
• 1:51
  hidden
• 1:51
  instructions
• 1:52
  inside
• 1:52
  a
• 1:52
  GitHub
• 1:53
  Issue
• 1:53
  using
• 1:53
  HTML
• 1:54
  comment
• 1:54
  tags
• 1:54
  —
• 1:55
  invisible
• 1:56
  to
• 1:56
  human
• 1:56
  readers,
• 1:56
  fully
• 1:57
  legible
• 1:57
  to
• 1:57
  Copilot
• 1:58
  when
• 1:58
  it
• 1:58
  processes
• 1:58
  the
• 1:58
  issue
• 1:59
  description.
• 2:00
  When
• 2:00
  a
• 2:00
  developer
• 2:00
  opens
• 2:01
  a
• 2:01
  Codespace
• 2:01
  from
• 2:01
  the
• 2:01
  poisoned
• 2:02
  issue,
• 2:02
  Copilot
• 2:03
  silently
• 2:03
  complies:
• 2:04
  it
• 2:04
  pulls
• 2:05
  a
• 2:05
  crafted
• 2:05
  PR
• 2:05
  containing
• 2:06
  a
• 2:06
  symlink
• 2:06
  to
• 2:06
  the
• 2:06
  environment's
• 2:07
  secrets
• 2:07
  file,
• 2:08
  reads
• 2:08
  the
• 2:08
  GitHub
• 2:09
  token
• 2:09
  through
• 2:09
  it
• 2:09
  (bypassing
• 2:10
  workspace
• 2:10
  boundary
• 2:10
  restrictions
• 2:11
  because
• 2:11
  guardrails
• 2:12
  do
• 2:12
  not
• 2:12
  follow
• 2:12
  symlinks),
• 2:13
  and
• 2:13
  exfiltrates
• 2:14
  the
• 2:14
  token
• 2:14
  via
• 2:15
  a
• 2:15
  JSON
• 2:15
  schema
• 2:15
  URL
• 2:16
  that
• 2:16
  VS
• 2:16
  Code
• 2:17
  fetches
• 2:17
  automatically.
• 2:18
  Full
• 2:18
  repository
• 2:19
  takeover,
• 2:20
  no
• 2:20
  user
• 2:20
  interaction
• 2:21
  beyond
• 2:21
  opening
• 2:21
  the
• 2:21
  Codespace.
• 2:23
  The
• 2:23
  SecureVibes
• 2:23
  team
• 2:23
  arrived
• 2:24
  at
• 2:24
  a
• 2:24
  complementary
• 2:25
  conclusion
• 2:25
  from
• 2:25
  another
• 2:25
  direction.
• 2:26
  They
• 2:27
  built
• 2:27
  structured
• 2:27
  skills
• 2:28
  for
• 2:28
  a
• 2:28
  DAST
• 2:28
  (Dynamic
• 2:28
  Application
• 2:29
  Security
• 2:29
  Testing)
• 2:30
  agent
• 2:30
  —
• 2:30
  8
• 2:31
  detailed
• 2:31
  methodology
• 2:32
  files,
• 2:32
  250-460
• 2:34
  lines
• 2:34
  each,
• 2:35
  for
• 2:35
  SQL
• 2:35
  injection,
• 2:36
  XSS,
• 2:36
  command
• 2:37
  injection,
• 2:37
  and
• 2:37
  more
• 2:38
  —
• 2:38
  and
• 2:38
  watched
• 2:38
  performance
• 2:39
  drop
• 2:39
  by
• 2:39
  6x.
• 2:40
  Haiku
• 2:41
  went
• 2:41
  from
• 2:41
  0%
• 2:42
  to
• 2:42
  100%
• 2:43
  vulnerability
• 2:43
  detection
• 2:44
  when
• 2:44
  every
• 2:44
  constraint
• 2:45
  was
• 2:45
  removed.
• 2:46
  The
• 2:46
  problem:
• 2:47
  prompt-level
• 2:47
  safety
• 2:48
  instructions
• 2:48
  consume
• 2:49
  context
• 2:49
  tokens,
• 2:50
  narrow
• 2:50
  the
• 2:50
  model's
• 2:50
  decision
• 2:51
  tree,
• 2:51
  and
• 2:51
  turn
• 2:52
  an
• 2:52
  adaptive
• 2:52
  tester
• 2:53
  into
• 2:53
  a
• 2:53
  checklist
• 2:53
  executor.
• 2:54
  Their
• 2:55
  fix
• 2:55
  —
• 2:55
  Docker
• 2:56
  containers
• 2:56
  with
• 2:56
  restricted
• 2:57
  networking,
• 2:58
  read-only
• 2:58
  filesystems,
• 2:59
  no
• 2:59
  privilege
• 3:00
  escalation
• 3:00
  —
• 3:01
  mirrors
• 3:01
  Bilca's
• 3:01
  thesis
• 3:02
  exactly.
• 3:03
  Enforce
• 3:04
  safety
• 3:04
  at
• 3:04
  the
• 3:04
  environment
• 3:05
  layer,
• 3:05
  not
• 3:05
  the
• 3:06
  application
• 3:06
  layer.
• 3:07
  Prompts
• 3:07
  define
• 3:08
  what
• 3:08
  the
• 3:08
  agent
• 3:08
  should
• 3:08
  do;
• 3:09
  the
• 3:09
  environment
• 3:10
  defines
• 3:10
  what
• 3:10
  it
• 3:10
  can
• 3:10
  do.
• 3:11
  A
• 3:11
  smaller
• 3:12
  but
• 3:12
  instructive
• 3:12
  example
• 3:13
  surfaced
• 3:13
  from
• 3:14
  a
• 3:14
  developer
• 3:14
  building
• 3:14
  an
• 3:14
  MCP
• 3:15
  server
• 3:15
  connected
• 3:16
  to
• 3:16
  a
• 3:16
  MUD
• 3:16
  (text-based
• 3:16
  game).
• 3:17
  When
• 3:17
  the
• 3:18
  server
• 3:18
  returned
• 3:18
  a
• 3:18
  "Duplicate
• 3:19
  log
• 3:19
  entry"
• 3:20
  error,
• 3:20
  the
• 3:20
  LLM
• 3:21
  interpreted
• 3:21
  it
• 3:21
  as
• 3:21
  a
• 3:22
  puzzle
• 3:22
  to
• 3:22
  solve
• 3:22
  and
• 3:23
  mutated
• 3:23
  the
• 3:23
  log
• 3:23
  entry
• 3:24
  just
• 3:24
  enough
• 3:24
  to
• 3:24
  bypass
• 3:25
  the
• 3:25
  hash
• 3:25
  check.
• 3:26
  The
• 3:26
  fix:
• 3:27
  return
• 3:27
  success
• 3:28
  instead
• 3:28
  of
• 3:28
  an
• 3:28
  error.
• 3:29
  Tool
• 3:29
  return
• 3:30
  values
• 3:30
  in
• 3:30
  MCP
• 3:31
  architectures
• 3:31
  are
• 3:31
  not
• 3:31
  just
• 3:32
  passing
• 3:32
  data
• 3:32
  —
• 3:33
  they
• 3:33
  communicate
• 3:33
  goal
• 3:34
  state
• 3:34
  to
• 3:34
  the
• 3:34
  model.
• 3:35
  A
• 3:35
  poorly
• 3:36
  worded
• 3:36
  failure
• 3:36
  response
• 3:37
  is
• 3:37
  more
• 3:37
  disruptive
• 3:38
  than
• 3:38
  a
• 3:38
  bug
• 3:38
  in
• 3:38
  your
• 3:38
  actual
• 3:39
  logic.
• 3:41
  Researchers
• 3:41
  at
• 3:41
  UC
• 3:42
  Riverside
• 3:42
  and
• 3:42
  KU
• 3:43
  Leuven
• 3:43
  presented
• 3:43
  AirSnitch
• 3:44
  at
• 3:44
  NDSS
• 3:44
  2026
• 3:45
  this
• 3:45
  week,
• 3:46
  demonstrating
• 3:47
  a
• 3:47
  new
• 3:47
  class
• 3:47
  of
• 3:47
  attacks
• 3:48
  that
• 3:48
  bypass
• 3:48
  Wi-Fi
• 3:49
  client
• 3:49
  isolation
• 3:49
  —
• 3:50
  the
• 3:50
  encryption-enabled
• 3:51
  protection
• 3:51
  promised
• 3:51
  by
• 3:52
  all
• 3:52
  router
• 3:52
  makers
• 3:52
  that
• 3:53
  blocks
• 3:53
  direct
• 3:53
  communication
• 3:54
  between
• 3:54
  connected
• 3:54
  clients.
• 3:56
  Every
• 3:56
  one
• 3:56
  of
• 3:56
  the
• 3:56
  11
• 3:57
  routers
• 3:57
  tested,
• 3:58
  including
• 3:58
  devices
• 3:59
  from
• 3:59
  Netgear,
• 3:59
  D-Link,
• 4:00
  Ubiquiti,
• 4:01
  Cisco,
• 4:01
  DD-WRT,
• 4:03
  and
• 4:03
  OpenWrt,
• 4:03
  was
• 4:04
  vulnerable
• 4:04
  to
• 4:04
  at
• 4:04
  least
• 4:04
  one
• 4:05
  attack.
• 4:06
  The
• 4:06
  root
• 4:06
  cause
• 4:06
  sits
• 4:06
  at
• 4:06
  Layers
• 4:07
  1
• 4:07
  and
• 4:07
  2
• 4:07
  of
• 4:07
  the
• 4:07
  networking
• 4:08
  stack,
• 4:08
  below
• 4:09
  the
• 4:09
  encryption
• 4:09
  layer
• 4:09
  that
• 4:09
  previous
• 4:10
  attacks
• 4:10
  like
• 4:10
  KRACK
• 4:11
  and
• 4:11
  FragAttacks
• 4:11
  targeted.
• 4:13
  The
• 4:13
  most
• 4:13
  powerful
• 4:13
  attack
• 4:14
  achieves
• 4:14
  a
• 4:14
  full
• 4:14
  bidirectional
• 4:15
  Man-in-the-Middle
• 4:15
  (MitM).
• 4:17
  The
• 4:17
  attacker
• 4:17
  connects
• 4:17
  to
• 4:17
  the
• 4:17
  same
• 4:18
  AP
• 4:18
  using
• 4:18
  the
• 4:18
  target's
• 4:19
  spoofed
• 4:19
  MAC
• 4:19
  address
• 4:20
  on
• 4:20
  a
• 4:20
  different
• 4:20
  radio,
• 4:20
  causing
• 4:21
  the
• 4:21
  internal
• 4:21
  switch
• 4:22
  to
• 4:22
  redirect
• 4:22
  the
• 4:22
  target's
• 4:22
  downlink
• 4:23
  traffic.
• 4:24
  To
• 4:24
  make
• 4:24
  it
• 4:24
  bidirectional,
• 4:25
  the
• 4:25
  attacker
• 4:25
  restores
• 4:26
  the
• 4:26
  original
• 4:26
  MAC-to-port
• 4:27
  mapping
• 4:27
  by
• 4:27
  sending
• 4:27
  a
• 4:27
  ping
• 4:28
  wrapped
• 4:28
  in
• 4:28
  the
• 4:28
  Group
• 4:28
  Temporal
• 4:28
  Key
• 4:29
  from
• 4:29
  a
• 4:29
  random
• 4:29
  MAC,
• 4:30
  then
• 4:30
  repeats
• 4:30
  the
• 4:30
  cycle.
• 4:31
  The
• 4:31
  technical
• 4:32
  paper
• 4:32
  identifies
• 4:32
  three
• 4:33
  root
• 4:33
  causes:
• 4:34
  Wi-Fi
• 4:34
  keys
• 4:35
  that
• 4:35
  protect
• 4:35
  broadcast
• 4:35
  frames
• 4:36
  are
• 4:36
  improperly
• 4:36
  managed
• 4:37
  and
• 4:37
  can
• 4:37
  be
• 4:37
  abused
• 4:38
  to
• 4:38
  bypass
• 4:38
  client
• 4:38
  isolation;
• 4:39
  isolation
• 4:40
  is
• 4:40
  often
• 4:40
  enforced
• 4:41
  at
• 4:41
  the
• 4:41
  MAC
• 4:41
  layer
• 4:41
  but
• 4:41
  not
• 4:42
  the
• 4:42
  IP
• 4:42
  layer
• 4:42
  (enabling
• 4:43
  a
• 4:43
  "gateway
• 4:43
  bouncing"
• 4:43
  attack);
• 4:44
  and
• 4:44
  weak
• 4:44
  synchronization
• 4:45
  of
• 4:45
  a
• 4:45
  client's
• 4:45
  identity
• 4:46
  across
• 4:46
  the
• 4:46
  network
• 4:46
  stack
• 4:47
  allows
• 4:47
  cross-layer
• 4:48
  identity
• 4:48
  desynchronization.
• 4:49
  Critically,
• 4:50
  the
• 4:50
  attacks
• 4:51
  extend
• 4:51
  across
• 4:51
  SSIDs
• 4:52
  and
• 4:52
  across
• 4:52
  APs
• 4:53
  that
• 4:53
  share
• 4:53
  a
• 4:53
  wired
• 4:54
  distribution
• 4:54
  system,
• 4:55
  common
• 4:55
  in
• 4:55
  enterprise
• 4:56
  and
• 4:56
  campus
• 4:56
  networks.
• 4:57
  The
• 4:57
  practical
• 4:58
  implications
• 4:58
  are
• 4:58
  nuanced.
• 4:59
  HD
• 4:59
  Moore,
• 5:00
  founder
• 5:00
  of
• 5:00
  runZero,
• 5:01
  called
• 5:02
  the
• 5:02
  work
• 5:02
  "impressive"
• 5:02
  because
• 5:03
  it
• 5:03
  "restores
• 5:03
  the
• 5:03
  attack
• 5:03
  surface
• 5:04
  that
• 5:04
  was
• 5:04
  present
• 5:04
  before
• 5:04
  client
• 5:05
  isolation
• 5:05
  became
• 5:05
  common."
• 5:06
  For
• 5:06
  anyone
• 5:06
  who
• 5:07
  lived
• 5:07
  through
• 5:07
  early
• 5:07
  wireless
• 5:08
  guest
• 5:08
  networking
• 5:08
  chaos
• 5:08
  —
• 5:09
  planes,
• 5:09
  hotels,
• 5:10
  coffee
• 5:10
  shops
• 5:10
  —
• 5:11
  these
• 5:11
  attack
• 5:11
  patterns
• 5:12
  will
• 5:12
  be
• 5:12
  familiar.
• 5:13
  Co-author
• 5:13
  Mathy
• 5:13
  Vanhoef
• 5:14
  clarified
• 5:14
  after
• 5:14
  publication
• 5:15
  that
• 5:15
  "bypass"
• 5:15
  is
• 5:16
  more
• 5:16
  precise
• 5:16
  than
• 5:16
  "break":
• 5:17
  the
• 5:18
  cryptography
• 5:18
  itself
• 5:18
  is
• 5:19
  not
• 5:19
  compromised,
• 5:19
  but
• 5:19
  client
• 5:20
  isolation
• 5:20
  is
• 5:20
  effectively
• 5:21
  nullified.
• 5:22
  Some
• 5:22
  router
• 5:22
  makers
• 5:23
  have
• 5:23
  begun
• 5:23
  shipping
• 5:23
  patches,
• 5:24
  but
• 5:24
  others
• 5:24
  report
• 5:25
  that
• 5:25
  systemic
• 5:25
  weaknesses
• 5:25
  can
• 5:26
  only
• 5:26
  be
• 5:26
  addressed
• 5:26
  through
• 5:26
  changes
• 5:27
  in
• 5:27
  the
• 5:27
  underlying
• 5:27
  chipsets.
• 5:29
  VLANs
• 5:29
  help
• 5:29
  in
• 5:30
  some
• 5:30
  configurations
• 5:30
  but
• 5:31
  not
• 5:31
  all,
• 5:31
  and
• 5:32
  the
• 5:32
  lack
• 5:32
  of
• 5:32
  an
• 5:32
  industry-wide
• 5:33
  client
• 5:33
  isolation
• 5:33
  standard
• 5:34
  means
• 5:34
  each
• 5:34
  vendor's
• 5:35
  one-off
• 5:35
  implementation
• 5:36
  may
• 5:36
  not
• 5:36
  receive
• 5:36
  the
• 5:36
  concerted
• 5:37
  security
• 5:37
  attention
• 5:38
  that
• 5:38
  formal
• 5:38
  protocols
• 5:38
  command.
• 5:42
  Perplexity
• 5:42
  launched
• 5:42
  Computer
• 5:43
  this
• 5:43
  week,
• 5:43
  a
• 5:43
  system
• 5:44
  that
• 5:44
  orchestrates
• 5:44
  19
• 5:45
  AI
• 5:45
  models
• 5:46
  into
• 5:46
  a
• 5:46
  single
• 5:46
  workflow
• 5:47
  engine.
• 5:48
  The
• 5:48
  architecture
• 5:48
  is
• 5:48
  genuinely
• 5:49
  different
• 5:49
  from
• 5:49
  a
• 5:49
  chatbot:
• 5:50
  you
• 5:50
  describe
• 5:50
  an
• 5:50
  outcome,
• 5:51
  Computer
• 5:51
  decomposes
• 5:52
  it
• 5:52
  into
• 5:52
  tasks
• 5:53
  and
• 5:53
  subtasks,
• 5:54
  spawns
• 5:54
  sub-agents
• 5:55
  for
• 5:55
  each,
• 5:55
  and
• 5:55
  runs
• 5:56
  them
• 5:56
  asynchronously
• 5:56
  in
• 5:57
  isolated
• 5:57
  compute
• 5:57
  environments
• 5:58
  with
• 5:58
  real
• 5:58
  filesystems,
• 5:59
  real
• 5:59
  browsers,
• 6:00
  and
• 6:00
  real
• 6:00
  tool
• 6:00
  integrations.
• 6:02
  As
• 6:02
  of
• 6:02
  launch,
• 6:02
  Opus
• 6:02
  4.6
• 6:03
  handles
• 6:03
  core
• 6:04
  reasoning,
• 6:04
  Gemini
• 6:05
  runs
• 6:05
  deep
• 6:05
  research
• 6:06
  sub-agents,
• 6:07
  Grok
• 6:07
  picks
• 6:07
  up
• 6:07
  lightweight
• 6:08
  speed
• 6:08
  tasks,
• 6:08
  and
• 6:09
  ChatGPT
• 6:09
  5.2
• 6:10
  handles
• 6:10
  long-context
• 6:11
  recall.
• 6:12
  The
• 6:12
  model
• 6:12
  roster
• 6:13
  rotates
• 6:13
  as
• 6:13
  frontier
• 6:13
  capabilities
• 6:14
  shift,
• 6:15
  and
• 6:15
  users
• 6:15
  can
• 6:15
  override
• 6:16
  specific
• 6:16
  sub-agent
• 6:17
  model
• 6:17
  assignments.
• 6:18
  Early
• 6:19
  hands-on
• 6:19
  testing
• 6:19
  reveals
• 6:20
  the
• 6:20
  19-model
• 6:20
  orchestration
• 6:21
  is
• 6:21
  the
• 6:21
  headline
• 6:22
  but
• 6:22
  also
• 6:22
  the
• 6:22
  trap.
• 6:23
  Most
• 6:23
  people
• 6:23
  will
• 6:24
  try
• 6:24
  single-task
• 6:24
  prompts
• 6:25
  and
• 6:25
  get
• 6:25
  mediocre
• 6:25
  results
• 6:26
  because
• 6:26
  Computer
• 6:26
  is
• 6:26
  optimized
• 6:27
  for
• 6:27
  project-level
• 6:27
  workflows,
• 6:28
  not
• 6:28
  one-shot
• 6:29
  questions.
• 6:30
  The
• 6:30
  difference
• 6:30
  between
• 6:31
  "this
• 6:31
  is
• 6:31
  cool"
• 6:31
  and
• 6:32
  "this
• 6:32
  changed
• 6:32
  how
• 6:32
  I
• 6:32
  work"
• 6:33
  comes
• 6:33
  down
• 6:33
  to
• 6:33
  knowing
• 6:34
  when
• 6:34
  to
• 6:34
  let
• 6:34
  the
• 6:34
  system
• 6:34
  route
• 6:35
  automatically
• 6:35
  versus
• 6:36
  specifying
• 6:36
  models
• 6:36
  yourself
• 6:37
  —
• 6:37
  and
• 6:37
  structuring
• 6:38
  persistent
• 6:38
  memory
• 6:39
  and
• 6:39
  connectors
• 6:39
  so
• 6:39
  context
• 6:40
  does
• 6:40
  not
• 6:40
  overwhelm
• 6:40
  the
• 6:41
  orchestration
• 6:41
  layer.
• 6:42
  Anthropic's
• 6:42
  answer
• 6:43
  occupies
• 6:43
  the
• 6:43
  opposite
• 6:44
  end
• 6:44
  of
• 6:44
  the
• 6:44
  design
• 6:44
  spectrum.
• 6:45
  Claude
• 6:45
  Cowork
• 6:46
  is
• 6:46
  a
• 6:46
  sandboxed
• 6:46
  Linux
• 6:46
  VM
• 6:47
  on
• 6:47
  your
• 6:47
  desktop
• 6:47
  that
• 6:48
  reads
• 6:48
  files,
• 6:48
  runs
• 6:49
  code,
• 6:49
  controls
• 6:49
  your
• 6:50
  browser,
• 6:50
  sends
• 6:50
  messages,
• 6:51
  and
• 6:51
  talks
• 6:51
  to
• 6:52
  external
• 6:52
  services
• 6:52
  through
• 6:53
  MCP
• 6:53
  connectors.
• 6:54
  One
• 6:54
  practitioner
• 6:55
  spent
• 6:55
  two
• 6:55
  months
• 6:56
  building
• 6:56
  39
• 6:56
  skills,
• 6:57
  4
• 6:57
  plugins,
• 6:58
  and
• 6:58
  8
• 6:58
  extensions
• 6:58
  —
• 6:59
  including
• 7:00
  an
• 7:00
  email
• 7:00
  triage
• 7:00
  system
• 7:01
  that
• 7:01
  classifies
• 7:01
  300+
• 7:02
  email
• 7:02
  aliases
• 7:03
  by
• 7:03
  priority
• 7:04
  tier
• 7:04
  and
• 7:04
  a
• 7:04
  genomic
• 7:05
  analysis
• 7:05
  pipeline
• 7:06
  that
• 7:06
  parsed
• 7:06
  596,007
• 7:08
  genetic
• 7:08
  markers
• 7:09
  in
• 7:09
  1.08
• 7:10
  seconds,
• 7:10
  entirely
• 7:11
  on-device.
• 7:12
  The
• 7:12
  operating
• 7:12
  manual:
• 7:13
  CLAUDE.md
• 7:14
  files
• 7:15
  for
• 7:15
  persistent
• 7:15
  preferences,
• 7:16
  skills
• 7:17
  for
• 7:17
  domain
• 7:17
  knowledge,
• 7:18
  plugins
• 7:18
  for
• 7:18
  repeatable
• 7:19
  workflows.
• 7:20
  The
• 7:20
  compound
• 7:20
  effect
• 7:21
  is
• 7:21
  that
• 7:21
  every
• 7:21
  session
• 7:21
  inherits
• 7:22
  everything
• 7:22
  previously
• 7:23
  built.
• 7:23
  The
• 7:23
  thesis,
• 7:24
  distilled:
• 7:25
  stop
• 7:25
  optimizing
• 7:26
  prompts,
• 7:26
  start
• 7:26
  building
• 7:27
  context
• 7:27
  infrastructure.
• 7:28
  Reid
• 7:28
  Hoffman
• 7:29
  frames
• 7:29
  the
• 7:29
  cultural
• 7:30
  shift
• 7:30
  underneath
• 7:30
  both
• 7:31
  platforms:
• 7:32
  we
• 7:32
  are
• 7:32
  all
• 7:32
  becoming
• 7:32
  gamers.
• 7:33
  Not
• 7:33
  in
• 7:34
  the
• 7:34
  console-and-controller
• 7:34
  sense,
• 7:35
  but
• 7:35
  in
• 7:35
  the
• 7:35
  tool-building
• 7:36
  sense.
• 7:37
  Platforms
• 7:37
  like
• 7:37
  Replit
• 7:38
  (and
• 7:38
  by
• 7:38
  extension,
• 7:39
  Cowork
• 7:39
  and
• 7:39
  Computer)
• 7:40
  make
• 7:40
  life
• 7:40
  feel
• 7:40
  like
• 7:40
  leveling
• 7:41
  up
• 7:41
  —
• 7:41
  each
• 7:42
  challenge
• 7:42
  is
• 7:42
  a
• 7:42
  level,
• 7:43
  and
• 7:43
  AI
• 7:43
  is
• 7:43
  how
• 7:43
  you
• 7:43
  craft
• 7:44
  a
• 7:44
  way
• 7:44
  through.
• 7:45
  The
• 7:45
  shift
• 7:45
  is
• 7:45
  not
• 7:45
  that
• 7:46
  everyone
• 7:46
  becomes
• 7:46
  a
• 7:46
  programmer;
• 7:47
  it
• 7:48
  is
• 7:48
  that
• 7:48
  everyone
• 7:48
  gains
• 7:48
  the
• 7:48
  ability
• 7:49
  to
• 7:49
  shape
• 7:49
  their
• 7:49
  environment
• 7:50
  and
• 7:50
  operate
• 7:51
  beyond
• 7:51
  what
• 7:51
  one
• 7:51
  person
• 7:52
  could
• 7:52
  normally
• 7:52
  do
• 7:52
  alone.
• 7:55
  "Human
• 7:56
  in
• 7:56
  the
• 7:56
  loop"
• 7:57
  keeps
• 7:57
  showing
• 7:57
  up
• 7:57
  in
• 7:57
  board
• 7:58
  packs.
• 7:59
  The
• 7:59
  phrase
• 7:59
  does
• 8:00
  emotional
• 8:00
  work
• 8:00
  —
• 8:01
  it
• 8:01
  suggests
• 8:02
  autonomy
• 8:02
  has
• 8:03
  a
• 8:03
  guardian,
• 8:04
  a
• 8:04
  hand
• 8:04
  on
• 8:04
  the
• 8:04
  tiller.
• 8:05
  Sometimes
• 8:05
  it
• 8:06
  gets
• 8:06
  misquoted
• 8:06
  as
• 8:07
  "human
• 8:07
  on
• 8:07
  the
• 8:07
  loop,"
• 8:08
  which
• 8:08
  is
• 8:08
  accidentally
• 8:09
  more
• 8:09
  honest.
• 8:10
  The
• 8:10
  Unhyped
• 8:11
  AI
• 8:11
  newsletter
• 8:12
  makes
• 8:12
  the
• 8:12
  case
• 8:12
  that
• 8:12
  if
• 8:13
  HITL
• 8:13
  is
• 8:13
  real,
• 8:14
  it
• 8:14
  is
• 8:14
  not
• 8:14
  a
• 8:14
  principle
• 8:14
  —
• 8:15
  it
• 8:15
  is
• 8:15
  a
• 8:15
  job.
• 8:16
  And
• 8:17
  jobs
• 8:17
  have
• 8:17
  a
• 8:17
  minimum
• 8:18
  spec:
• 8:18
  a
• 8:18
  named
• 8:19
  owner,
• 8:19
  a
• 8:20
  time
• 8:20
  budget,
• 8:21
  escalation
• 8:21
  rights,
• 8:22
  stop
• 8:22
  authority,
• 8:23
  and
• 8:23
  protection
• 8:24
  when
• 8:24
  doing
• 8:24
  the
• 8:24
  right
• 8:25
  thing
• 8:25
  makes
• 8:25
  you
• 8:25
  unpopular.
• 8:26
  Without
• 8:27
  those,
• 8:27
  it
• 8:27
  is
• 8:28
  decoration.
• 8:29
  The
• 8:29
  test
• 8:29
  is
• 8:29
  simple:
• 8:30
  can
• 8:30
  you
• 8:30
  list
• 8:31
  every
• 8:31
  agent
• 8:31
  in
• 8:32
  production,
• 8:32
  what
• 8:33
  it
• 8:33
  can
• 8:33
  touch,
• 8:33
  what
• 8:34
  actions
• 8:34
  it
• 8:34
  can
• 8:35
  take,
• 8:35
  which
• 8:35
  identity
• 8:36
  it
• 8:36
  operates
• 8:36
  under?
• 8:37
  If
• 8:37
  you
• 8:37
  cannot
• 8:38
  enumerate
• 8:38
  it,
• 8:38
  you
• 8:38
  cannot
• 8:39
  supervise
• 8:39
  it.
• 8:40
  That
• 8:40
  framing
• 8:41
  gains
• 8:41
  urgency
• 8:42
  in
• 8:42
  context.
• 8:43
  Defense
• 8:43
  Secretary
• 8:43
  Hegseth
• 8:44
  has
• 8:44
  reportedly
• 8:44
  given
• 8:45
  Anthropic
• 8:45
  until
• 8:45
  Friday
• 8:46
  to
• 8:46
  back
• 8:46
  down
• 8:46
  on
• 8:46
  AI
• 8:47
  safety
• 8:47
  safeguards,
• 8:48
  demanding
• 8:48
  the
• 8:48
  company
• 8:49
  provide
• 8:49
  model
• 8:49
  access
• 8:50
  for
• 8:50
  "all
• 8:50
  lawful
• 8:50
  purposes"
• 8:51
  without
• 8:51
  the
• 8:52
  usage-policy
• 8:52
  restrictions
• 8:53
  Anthropic
• 8:53
  originally
• 8:54
  contractually
• 8:54
  required.
• 8:55
  Meanwhile,
• 8:56
  a
• 8:56
  practitioner
• 8:56
  working
• 8:57
  with
• 8:57
  national-security-sensitive
• 8:58
  customers
• 8:59
  describes
• 8:59
  the
• 8:59
  bind
• 8:59
  directly:
• 9:00
  American
• 9:01
  closed
• 9:01
  models
• 9:01
  are
• 9:02
  locked
• 9:02
  behind
• 9:02
  paywalls
• 9:03
  and
• 9:03
  logging,
• 9:04
  the
• 9:04
  only
• 9:04
  recent
• 9:04
  US
• 9:05
  open-weights
• 9:05
  model
• 9:06
  (gpt-oss-120b)
• 9:07
  is
• 9:08
  far
• 9:08
  behind
• 9:08
  Chinese
• 9:08
  alternatives
• 9:09
  like
• 9:09
  GLM
• 9:10
  and
• 9:10
  MiniMax,
• 9:11
  and
• 9:11
  customers
• 9:11
  refuse
• 9:12
  to
• 9:12
  run
• 9:12
  Chinese
• 9:13
  models.
• 9:14
  The
• 9:14
  options
• 9:14
  narrow
• 9:15
  to
• 9:15
  Mistral,
• 9:15
  Cohere,
• 9:16
  or
• 9:16
  hoping
• 9:16
  someone
• 9:17
  open-sources
• 9:17
  something
• 9:18
  competitive.
• 9:19
  The
• 9:19
  geopolitical
• 9:19
  implications
• 9:20
  are
• 9:20
  concrete:
• 9:21
  closed-model
• 9:21
  AI
• 9:22
  policy
• 9:22
  is
• 9:22
  creating
• 9:23
  a
• 9:23
  capability
• 9:23
  gap
• 9:24
  for
• 9:24
  exactly
• 9:24
  the
• 9:24
  institutions
• 9:25
  that
• 9:25
  need
• 9:25
  on-premise,
• 9:26
  air-gapped
• 9:27
  deployment.
• 9:27
  On
• 9:28
  the
• 9:28
  operational
• 9:28
  side,
• 9:29
  a
• 9:29
  CISO
• 9:30
  at
• 9:30
  a
• 9:30
  large
• 9:30
  tech
• 9:30
  company
• 9:31
  has
• 9:31
  reportedly
• 9:31
  eliminated
• 9:32
  their
• 9:32
  entire
• 9:32
  SOC
• 9:33
  Tier
• 9:33
  1
• 9:33
  analyst
• 9:34
  team.
• 9:35
  AI
• 9:35
  now
• 9:35
  handles
• 9:35
  triage
• 9:36
  and
• 9:36
  research;
• 9:37
  the
• 9:37
  former
• 9:37
  analysts
• 9:38
  have
• 9:38
  been
• 9:38
  promoted
• 9:39
  to
• 9:39
  incident
• 9:39
  response,
• 9:40
  authorizing
• 9:41
  actions
• 9:41
  on
• 9:42
  cases
• 9:42
  the
• 9:42
  system
• 9:42
  has
• 9:43
  already
• 9:43
  investigated.
• 9:45
  The
• 9:45
  industry
• 9:45
  analyst
• 9:46
  who
• 9:46
  predicted
• 9:46
  this
• 9:46
  calls
• 9:47
  it
• 9:47
  the
• 9:47
  beginning
• 9:47
  of
• 9:47
  a
• 9:47
  revolution
• 9:48
  that
• 9:48
  will
• 9:48
  sweep
• 9:48
  through
• 9:49
  MSSPs
• 9:49
  in
• 9:50
  months.
• 9:51
  The
• 9:51
  skeptics
• 9:51
  raise
• 9:52
  the
• 9:52
  right
• 9:52
  counter:
• 9:53
  when
• 9:53
  AI
• 9:53
  handles
• 9:54
  research
• 9:54
  and
• 9:54
  triage,
• 9:55
  you
• 9:55
  remove
• 9:56
  human
• 9:56
  rate
• 9:56
  limiters,
• 9:57
  improving
• 9:58
  speed
• 9:58
  and
• 9:58
  consistency
• 9:59
  but
• 9:59
  changing
• 10:00
  the
• 10:00
  error
• 10:00
  distribution.
• 10:02
  A
• 10:02
  blind
• 10:02
  spot
• 10:03
  or
• 10:03
  model
• 10:03
  drift
• 10:04
  no
• 10:04
  longer
• 10:04
  stays
• 10:05
  local
• 10:05
  —
• 10:06
  it
• 10:06
  scales
• 10:06
  across
• 10:07
  the
• 10:07
  pipeline
• 10:07
  before
• 10:08
  anyone
• 10:08
  sees
• 10:08
  the
• 10:08
  pattern.
• 10:09
  The
• 10:10
  question
• 10:10
  shifts
• 10:10
  from
• 10:11
  "can
• 10:11
  we
• 10:11
  automate
• 10:11
  SOC?"
• 10:12
  to
• 10:12
  "how
• 10:13
  are
• 10:13
  we
• 10:13
  auditing
• 10:13
  the
• 10:13
  automation
• 10:14
  layer?"
• 10:17
  Amplifying
• 10:17
  AI
• 10:18
  pointed
• 10:18
  Claude
• 10:18
  Code
• 10:19
  at
• 10:19
  real
• 10:19
  repositories
• 10:20
  and
• 10:20
  watched
• 10:21
  what
• 10:21
  it
• 10:21
  chose
• 10:21
  —
• 10:22
  no
• 10:22
  tool
• 10:22
  names
• 10:23
  in
• 10:23
  any
• 10:23
  prompt,
• 10:24
  open-ended
• 10:24
  questions
• 10:24
  only.
• 10:25
  Across
• 10:26
  three
• 10:26
  models
• 10:26
  (Sonnet
• 10:27
  4.5,
• 10:28
  Opus
• 10:28
  4.5,
• 10:29
  Opus
• 10:29
  4.6)
• 10:30
  and
• 10:30
  four
• 10:30
  project
• 10:31
  types,
• 10:31
  the
• 10:31
  headline
• 10:31
  finding:
• 10:32
  Claude
• 10:32
  Code
• 10:32
  builds,
• 10:33
  not
• 10:33
  buys.
• 10:34
  Custom/DIY
• 10:36
  is
• 10:36
  the
• 10:36
  most
• 10:36
  common
• 10:36
  label,
• 10:37
  appearing
• 10:37
  in
• 10:37
  12
• 10:38
  of
• 10:38
  20
• 10:38
  categories.
• 10:39
  When
• 10:39
  asked
• 10:39
  to
• 10:40
  add
• 10:40
  feature
• 10:40
  flags,
• 10:41
  it
• 10:41
  builds
• 10:41
  a
• 10:41
  config
• 10:41
  system
• 10:42
  with
• 10:42
  env
• 10:42
  vars
• 10:42
  and
• 10:43
  percentage-based
• 10:43
  rollout
• 10:44
  instead
• 10:44
  of
• 10:44
  recommending
• 10:45
  LaunchDarkly.
• 10:46
  When
• 10:46
  asked
• 10:46
  to
• 10:46
  add
• 10:46
  auth
• 10:46
  in
• 10:47
  Python,
• 10:47
  it
• 10:47
  writes
• 10:48
  JWT
• 10:48
  +
• 10:49
  bcrypt
• 10:49
  from
• 10:49
  scratch.
• 10:50
  When
• 10:50
  it
• 10:50
  does
• 10:50
  pick
• 10:50
  a
• 10:50
  tool,
• 10:51
  it
• 10:51
  picks
• 10:51
  decisively:
• 10:52
  GitHub
• 10:53
  Actions
• 10:53
  for
• 10:53
  CI,
• 10:53
  Stripe
• 10:54
  for
• 10:54
  payments,
• 10:54
  shadcn/ui
• 10:57
  for
• 10:57
  components.
• 10:58
  Generational
• 10:59
  shifts
• 10:59
  between
• 10:59
  models
• 11:00
  are
• 11:00
  real
• 11:00
  —
• 11:01
  Opus
• 11:01
  4.6
• 11:02
  picks
• 11:02
  Drizzle
• 11:02
  over
• 11:03
  Prisma
• 11:03
  for
• 11:03
  JS
• 11:04
  ORM
• 11:04
  (Sonnet
• 11:05
  still
• 11:05
  picks
• 11:05
  Prisma),
• 11:06
  newer
• 11:06
  models
• 11:06
  favor
• 11:07
  Inngest
• 11:07
  over
• 11:07
  BullMQ
• 11:08
  for
• 11:08
  JS
• 11:08
  jobs,
• 11:09
  and
• 11:09
  Celery's
• 11:09
  dominance
• 11:10
  in
• 11:10
  Python
• 11:10
  jobs
• 11:11
  collapses.
• 11:12
  Traditional
• 11:12
  cloud
• 11:13
  providers
• 11:13
  (AWS,
• 11:14
  GCP,
• 11:15
  Azure)
• 11:16
  received
• 11:16
  zero
• 11:16
  primary
• 11:17
  deployment
• 11:17
  picks;
• 11:18
  Vercel
• 11:18
  owns
• 11:19
  frontend,
• 11:19
  Railway
• 11:20
  owns
• 11:20
  Python.
• 11:21
  Cole
• 11:21
  Medin
• 11:21
  packages
• 11:22
  the
• 11:22
  validation
• 11:22
  endpoint
• 11:23
  into
• 11:23
  a
• 11:23
  six-phase
• 11:24
  self-healing
• 11:25
  workflow
• 11:25
  for
• 11:25
  Claude
• 11:25
  Code.
• 11:26
  Three
• 11:27
  sub-agents
• 11:27
  run
• 11:27
  in
• 11:28
  parallel
• 11:28
  for
• 11:28
  research:
• 11:29
  one
• 11:29
  maps
• 11:30
  the
• 11:30
  codebase
• 11:30
  structure
• 11:31
  and
• 11:31
  user
• 11:31
  journeys,
• 11:32
  another
• 11:32
  parses
• 11:33
  the
• 11:33
  database
• 11:33
  schema,
• 11:34
  a
• 11:34
  third
• 11:34
  hunts
• 11:34
  logic
• 11:35
  bugs
• 11:35
  via
• 11:35
  code
• 11:36
  review.
• 11:36
  Then
• 11:36
  the
• 11:37
  agent
• 11:37
  spins
• 11:37
  up
• 11:37
  the
• 11:37
  dev
• 11:38
  server,
• 11:38
  defines
• 11:38
  a
• 11:38
  task
• 11:39
  list
• 11:39
  of
• 11:39
  user
• 11:39
  journeys,
• 11:40
  and
• 11:40
  systematically
• 11:41
  walks
• 11:42
  each
• 11:42
  one
• 11:42
  using
• 11:42
  browser
• 11:43
  automation
• 11:43
  —
• 11:44
  taking
• 11:44
  snapshots,
• 11:45
  querying
• 11:45
  the
• 11:46
  database
• 11:46
  after
• 11:46
  write
• 11:46
  operations,
• 11:47
  capturing
• 11:48
  screenshots
• 11:49
  for
• 11:49
  UI
• 11:49
  validation.
• 11:50
  It
• 11:50
  only
• 11:51
  fixes
• 11:51
  blocking
• 11:51
  issues
• 11:52
  inline;
• 11:53
  moderate
• 11:53
  and
• 11:53
  minor
• 11:54
  issues
• 11:54
  get
• 11:54
  surfaced
• 11:55
  in
• 11:55
  a
• 11:55
  structured
• 11:55
  report
• 11:56
  for
• 11:56
  human
• 11:56
  decision.
• 11:57
  The
• 11:57
  approach
• 11:58
  is
• 11:58
  token-heavy
• 11:59
  but
• 11:59
  comprehensive,
• 12:00
  and
• 12:00
  the
• 12:00
  PIV
• 12:01
  loop
• 12:01
  (plan,
• 12:02
  implement,
• 12:02
  validate)
• 12:03
  can
• 12:03
  invoke
• 12:03
  it
• 12:03
  automatically
• 12:04
  after
• 12:04
  every
• 12:05
  feature
• 12:05
  implementation.
• 12:06
  A
• 12:07
  community
• 12:07
  collection
• 12:07
  of
• 12:08
  Claude
• 12:08
  Skills
• 12:08
  demonstrates
• 12:09
  the
• 12:09
  complementary
• 12:10
  side
• 12:10
  of
• 12:10
  the
• 12:10
  toolbox.
• 12:11
  The
• 12:11
  ui-expert
• 12:12
  skill
• 12:12
  walks
• 12:13
  through
• 12:13
  a
• 12:13
  six-phase
• 12:14
  design
• 12:14
  process
• 12:14
  from
• 12:15
  vibe-only
• 12:15
  prompts
• 12:15
  to
• 12:16
  pixel-perfect
• 12:16
  specs,
• 12:17
  following
• 12:18
  the
• 12:18
  agentskills.io
• 12:19
  specification
• 12:20
  that
• 12:20
  is
• 12:20
  now
• 12:20
  adopted
• 12:21
  across
• 12:21
  Claude
• 12:21
  Code,
• 12:22
  Cursor,
• 12:23
  VS
• 12:23
  Code
• 12:23
  Copilot,
• 12:24
  and
• 12:24
  others.
• 12:25
  The
• 12:25
  pattern:
• 12:26
  focused,
• 12:27
  human-curated
• 12:28
  skills
• 12:28
  of
• 12:28
  2-3
• 12:29
  modules
• 12:29
  consistently
• 12:30
  outperform
• 12:30
  sprawling,
• 12:31
  auto-generated
• 12:32
  ones.
• 12:35
  Maze
• 12:36
  built
• 12:36
  investigation
• 12:37
  agents
• 12:37
  before
• 12:37
  remediation
• 12:38
  agents,
• 12:38
  and
• 12:38
  they
• 12:39
  did
• 12:39
  it
• 12:39
  on
• 12:39
  purpose.
• 12:39
  Their
• 12:40
  thesis:
• 12:40
  fixing
• 12:41
  vulnerabilities
• 12:42
  that
• 12:42
  do
• 12:42
  not
• 12:42
  pose
• 12:43
  a
• 12:43
  real
• 12:43
  threat
• 12:43
  is
• 12:44
  not
• 12:44
  progress.
• 12:45
  The
• 12:45
  investigation
• 12:45
  agents
• 12:46
  check
• 12:46
  whether
• 12:46
  the
• 12:46
  technical
• 12:47
  requirements
• 12:47
  for
• 12:47
  exploitation
• 12:48
  are
• 12:48
  actually
• 12:48
  present
• 12:49
  in
• 12:49
  a
• 12:49
  specific
• 12:49
  environment,
• 12:50
  and
• 12:50
  on
• 12:50
  average
• 12:50
  80-90%
• 12:53
  of
• 12:53
  vulnerabilities
• 12:53
  are
• 12:54
  not
• 12:54
  exploitable.
• 12:55
  When
• 12:55
  remediation
• 12:55
  is
• 12:55
  needed,
• 12:56
  the
• 12:56
  agents
• 12:56
  trace
• 12:57
  the
• 12:57
  vulnerable
• 12:57
  package
• 12:58
  to
• 12:58
  its
• 12:58
  root
• 12:58
  cause
• 12:58
  —
• 12:59
  a
• 12:59
  base
• 12:59
  image,
• 13:00
  a
• 13:00
  build
• 13:00
  step,
• 13:01
  a
• 13:01
  transitive
• 13:01
  dependency
• 13:02
  —
• 13:02
  and
• 13:02
  return
• 13:03
  verified
• 13:03
  fixes
• 13:04
  with
• 13:04
  trade-offs.
• 13:05
  In
• 13:05
  a
• 13:05
  concrete
• 13:06
  example,
• 13:06
  a
• 13:06
  gnutls
• 13:07
  CVE
• 13:07
  traced
• 13:08
  to
• 13:08
  a
• 13:08
  transitive
• 13:08
  dependency
• 13:09
  of
• 13:09
  wget
• 13:10
  in
• 13:10
  a
• 13:10
  Red
• 13:10
  Hat
• 13:10
  UBI
• 13:11
  9
• 13:11
  container
• 13:11
  was
• 13:11
  resolved
• 13:12
  by
• 13:12
  confirming
• 13:12
  that
• 13:13
  a
• 13:13
  fresh
• 13:13
  rebuild
• 13:13
  pulls
• 13:14
  the
• 13:14
  patched
• 13:14
  version
• 13:14
  automatically,
• 13:15
  verified
• 13:16
  by
• 13:16
  checking
• 13:16
  the
• 13:16
  rebuilt
• 13:17
  image.
• 13:18
  Two
• 13:18
  minutes
• 13:18
  instead
• 13:18
  of
• 13:18
  two
• 13:19
  hours.
• 13:19
  The
• 13:19
  agents
• 13:20
  also
• 13:20
  group
• 13:20
  related
• 13:21
  vulnerabilities
• 13:21
  by
• 13:21
  shared
• 13:22
  fix,
• 13:22
  so
• 13:22
  one
• 13:23
  base
• 13:23
  image
• 13:23
  upgrade
• 13:23
  becomes
• 13:24
  one
• 13:24
  ticket
• 13:24
  instead
• 13:24
  of
• 13:25
  fifty.
• 13:25
  On
• 13:26
  the
• 13:26
  research
• 13:26
  tooling
• 13:26
  side,
• 13:27
  Super
• 13:27
  Tart
• 13:27
  VPhone
• 13:28
  caught
• 13:28
  my
• 13:28
  attention.
• 13:29
  After
• 13:29
  @matteyeux
• 13:30
  surfaced
• 13:30
  vphone600ap
• 13:31
  components
• 13:31
  in
• 13:32
  Apple's
• 13:32
  Private
• 13:32
  Cloud
• 13:32
  Compute
• 13:33
  firmware
• 13:34
  and
• 13:34
  @
• 13:34
  inside
• 13:34
  demonstrated
• 13:35
  a
• 13:35
  virtual
• 13:35
  iPhone
• 13:36
  booting
• 13:36
  from
• 13:36
  them,
• 13:36
  a
• 13:36
  researcher
• 13:37
  (wh1te4ever)
• 13:38
  built
• 13:38
  the
• 13:38
  full
• 13:38
  working
• 13:38
  pipeline
• 13:39
  and
• 13:39
  published
• 13:39
  a
• 13:39
  detailed
• 13:39
  writeup.
• 13:40
  By
• 13:40
  forking
• 13:41
  super-tart
• 13:41
  to
• 13:41
  call
• 13:42
  private
• 13:42
  Virtualization.framework
• 13:43
  APIs,
• 13:44
  mixing
• 13:44
  firmware
• 13:45
  from
• 13:45
  cloudOS
• 13:45
  26.1
• 13:46
  and
• 13:46
  iOS
• 13:47
  26.1,
• 13:48
  and
• 13:48
  patching
• 13:48
  the
• 13:48
  entire
• 13:49
  bootchain
• 13:49
  (AVPBooter,
• 13:50
  iBSS,
• 13:51
  iBEC,
• 13:52
  LLB,
• 13:52
  TXM,
• 13:53
  kernel)
• 13:54
  to
• 13:54
  bypass
• 13:54
  signature
• 13:55
  verification
• 13:55
  and
• 13:55
  SSV
• 13:56
  checks,
• 13:57
  they
• 13:57
  got
• 13:57
  a
• 13:57
  functional
• 13:57
  virtualized
• 13:58
  iPhone
• 13:58
  on
• 13:58
  Apple
• 13:58
  Silicon
• 13:59
  with
• 13:59
  Metal
• 13:59
  GPU
• 14:00
  acceleration,
• 14:01
  live
• 14:01
  kernel
• 14:01
  debugging
• 14:02
  via
• 14:02
  GDB,
• 14:02
  and
• 14:03
  SSH/VNC
• 14:04
  access.
• 14:05
  Anyone
• 14:05
  who
• 14:05
  has
• 14:05
  done
• 14:06
  iOS
• 14:06
  vulnerability
• 14:06
  research
• 14:07
  understands
• 14:07
  what
• 14:07
  this
• 14:08
  means.
• 14:08
  Corellium
• 14:09
  has
• 14:09
  offered
• 14:09
  commercial
• 14:10
  iOS
• 14:10
  virtualization
• 14:11
  for
• 14:11
  years,
• 14:12
  and
• 14:12
  Botticelli's
• 14:12
  vma2pwn
• 14:14
  demonstrated
• 14:15
  earlier
• 14:15
  virtualizations
• 14:16
  on
• 14:16
  Apple
• 14:16
  Silicon,
• 14:17
  but
• 14:17
  neither
• 14:17
  provided
• 14:18
  GPU
• 14:18
  acceleration
• 14:19
  on
• 14:19
  Apple's
• 14:19
  native
• 14:19
  hypervisor.
• 14:21
  Previous
• 14:21
  QEMU
• 14:22
  efforts
• 14:22
  like
• 14:22
  Inferno
• 14:22
  could
• 14:23
  boot
• 14:23
  to
• 14:23
  SpringBoard
• 14:23
  and
• 14:24
  supported
• 14:24
  kernel
• 14:24
  debugging,
• 14:25
  but
• 14:25
  lacked
• 14:26
  the
• 14:26
  speed
• 14:26
  and
• 14:26
  Metal
• 14:26
  support
• 14:27
  needed
• 14:27
  for
• 14:27
  GPU-dependent
• 14:28
  or
• 14:28
  performance-sensitive
• 14:29
  work.
• 14:29
  Super
• 14:30
  Tart
• 14:30
  VPhone
• 14:30
  runs
• 14:31
  on
• 14:31
  Apple's
• 14:31
  own
• 14:31
  hypervisor
• 14:32
  with
• 14:32
  hardware-accelerated
• 14:33
  graphics;
• 14:34
  that
• 14:34
  combination
• 14:34
  is
• 14:34
  new.
• 14:35
  It
• 14:35
  is
• 14:36
  dirty,
• 14:36
  hardcoded,
• 14:37
  not
• 14:37
  for
• 14:38
  end
• 14:38
  users,
• 14:38
  but
• 14:38
  exactly
• 14:39
  the
• 14:39
  kind
• 14:39
  of
• 14:39
  tooling
• 14:40
  that
• 14:40
  moves
• 14:40
  the
• 14:40
  field
• 14:40
  forward.
• 14:42
  Whether
• 14:42
  Apple
• 14:42
  intended
• 14:43
  to
• 14:43
  ship
• 14:43
  these
• 14:43
  components
• 14:44
  as
• 14:44
  a
• 14:44
  future
• 14:44
  "iPhone
• 14:45
  Research
• 14:45
  Environment
• 14:46
  VM"
• 14:46
  or
• 14:47
  leaked
• 14:47
  them
• 14:47
  by
• 14:47
  accident
• 14:48
  is
• 14:48
  an
• 14:48
  open
• 14:48
  question.
• 14:49
  Either
• 14:50
  way,
• 14:50
  the
• 14:51
  cat
• 14:51
  is
• 14:51
  out
• 14:51
  of
• 14:51
  the
• 14:51
  bag.
• 14:52
  The
• 14:52
  open
• 14:53
  web's
• 14:53
  accessibility
• 14:53
  continues
• 14:54
  to
• 14:54
  erode
• 14:54
  in
• 14:55
  the
• 14:55
  crawler
• 14:55
  arms
• 14:55
  race.
• 14:56
  A
• 14:56
  veteran
• 14:56
  systems
• 14:57
  architect
• 14:57
  who
• 14:58
  built
• 14:58
  and
• 14:58
  sold
• 14:58
  his
• 14:58
  first
• 14:59
  web
• 14:59
  crawler
• 14:59
  25
• 15:00
  years
• 15:00
  ago
• 15:00
  has
• 15:00
  released
• 15:01
  Grub
• 15:01
  2.0,
• 15:02
  an
• 15:03
  open-source
• 15:03
  mesh-based
• 15:04
  crawler
• 15:04
  with
• 15:04
  Camoufox
• 15:05
  anti-detect
• 15:05
  browsing
• 15:06
  baked
• 15:06
  in
• 15:06
  at
• 15:06
  the
• 15:06
  engine
• 15:07
  level.
• 15:08
  The
• 15:08
  distinctive
• 15:08
  feature
• 15:09
  is
• 15:09
  Ghost
• 15:09
  Protocol:
• 15:10
  when
• 15:10
  stealth
• 15:11
  fails,
• 15:11
  it
• 15:12
  screenshots
• 15:12
  the
• 15:12
  blocked
• 15:12
  page
• 15:13
  and
• 15:13
  extracts
• 15:13
  content
• 15:14
  through
• 15:14
  vision-based
• 15:15
  LLM
• 15:15
  fallback.
• 15:17
  Per-request
• 15:17
  proxy
• 15:18
  rotation,
• 15:18
  prompt
• 15:19
  injection
• 15:19
  defense,
• 15:20
  domain-level
• 15:21
  policy
• 15:21
  enforcement,
• 15:22
  and
• 15:22
  15
• 15:22
  MCP
• 15:23
  tools
• 15:23
  ship
• 15:24
  out
• 15:24
  of
• 15:24
  the
• 15:24
  box.