Latest / AGI Dreams – Open, Uncensored, & Local - AI News Digest / AGI Dreams Podcast – October 26, 2026

Transcript

AGI Dreams Podcast – October 26, 2026 · AGI Dreams – Open, Uncensored, & Local - AI News Digest

• 0:00
  GreenBitAI's
• 0:00
  four-bit
• 0:01
  build
• 0:01
  of
• 0:01
  DeepSeek's
• 0:02
  October
• 0:02
  17
• 0:03
  refresh
• 0:03
  of
• 0:03
  V4.1-Flash
• 0:05
  takes
• 0:05
  local
• 0:06
  inference
• 0:06
  to
• 0:06
  its
• 0:06
  logical
• 0:07
  extreme:
• 0:08
  a
• 0:08
  406
• 0:09
  GiB
• 0:09
  model
• 0:09
  that
• 0:10
  runs
• 0:10
  on
• 0:10
  machines
• 0:10
  that
• 0:10
  cannot
• 0:11
  hold
• 0:11
  it.
• 0:12
  The
• 0:12
  recipe
• 0:12
  is
• 0:12
  mixed
• 0:13
  —
• 0:13
  routed
• 0:13
  experts
• 0:14
  at
• 0:14
  4-bit,
• 0:14
  attention
• 0:15
  and
• 0:16
  the
• 0:16
  rest
• 0:16
  at
• 0:16
  8-bit
• 0:16
  —
• 0:17
  with
• 0:17
  the
• 0:17
  experts
• 0:18
  paged
• 0:18
  in
• 0:18
  their
• 0:19
  own
• 0:19
  containers,
• 0:20
  so
• 0:20
  a
• 0:20
  machine
• 0:20
  loads
• 0:20
  what
• 0:21
  fits
• 0:21
  and
• 0:21
  streams
• 0:21
  the
• 0:21
  rest.
• 0:22
  On
• 0:23
  a
• 0:23
  128
• 0:24
  GB
• 0:24
  DGX
• 0:25
  Spark
• 0:25
  it
• 0:25
  pages;
• 0:26
  on
• 0:26
  a
• 0:26
  512
• 0:27
  GB
• 0:27
  Mac
• 0:28
  Studio
• 0:28
  it
• 0:28
  settles
• 0:29
  resident.
• 0:30
  The
• 0:30
  card
• 0:30
  declines
• 0:31
  to
• 0:31
  guess
• 0:31
  paging
• 0:32
  slowdown:
• 0:33
  the
• 0:33
  wait
• 0:33
  is
• 0:33
  "the
• 0:33
  SSD's,
• 0:34
  not
• 0:34
  the
• 0:35
  model's."
• 0:36
  gbx-lm
• 0:36
  ships
• 0:37
  as
• 0:37
  one
• 0:37
  signed,
• 0:38
  notarized
• 0:38
  binary
• 0:39
  —
• 0:40
  no
• 0:40
  Python,
• 0:41
  no
• 0:41
  CUDA
• 0:41
  toolkit,
• 0:42
  just
• 0:42
  a
• 0:42
  driver
• 0:43
  —
• 0:43
  speaking
• 0:44
  three
• 0:44
  wire
• 0:45
  protocols
• 0:45
  on
• 0:45
  one
• 0:46
  port:
• 0:47
  OpenAI,
• 0:48
  the
• 0:48
  Responses
• 0:48
  API
• 0:49
  Codex
• 0:49
  uses,
• 0:50
  and
• 0:50
  Anthropic's
• 0:51
  Messages
• 0:51
  for
• 0:51
  Claude
• 0:52
  Code.
• 0:53
  Measured
• 0:53
  on
• 0:53
  a
• 0:53
  Mac
• 0:54
  Studio:
• 0:54
  22.1
• 0:55
  tok/s
• 0:56
  decode,
• 0:57
  410-420
• 0:58
  tok/s
• 1:00
  prefill,
• 1:01
  with
• 1:01
  the
• 1:01
  draft
• 1:01
  head's
• 1:01
  proposals
• 1:02
  verified
• 1:02
  by
• 1:03
  the
• 1:03
  model
• 1:03
  itself.
• 1:04
  v0.8.3
• 1:06
  claims
• 1:06
  twice-as-fast
• 1:07
  long
• 1:07
  conversations;
• 1:09
  an
• 1:09
  optional
• 1:09
  DFlash
• 1:10
  2
• 1:10
  draft
• 1:10
  head
• 1:11
  pushes
• 1:11
  Qwen3.8-27B
• 1:15
  to
• 1:15
  140
• 1:16
  tok/s
• 1:17
  on
• 1:17
  code
• 1:17
  and
• 1:17
  math.
• 1:18
  The
• 1:18
  llama.cpp
• 1:20
  crowd
• 1:20
  runs
• 1:21
  the
• 1:21
  same
• 1:21
  race
• 1:21
  from
• 1:21
  the
• 1:21
  bottom:
• 1:22
  a
• 1:22
  Reddit
• 1:23
  build
• 1:23
  runs
• 1:23
  Qwen-Flash-Next
• 1:24
  Coder
• 1:24
  —
• 1:25
  ISTA
• 1:26
  DASLab's
• 1:27
  3.5-bits-per-weight
• 1:28
  GSQ
• 1:29
  RCO
• 1:29
  quant,
• 1:30
  half
• 1:30
  the
• 1:30
  experts
• 1:31
  pruned
• 1:31
  for
• 1:31
  an
• 1:31
  effective
• 1:32
  1.89
• 1:33
  bits
• 1:33
  per
• 1:33
  parameter
• 1:33
  —
• 1:34
  on
• 1:35
  8
• 1:35
  GB
• 1:35
  VRAM
• 1:36
  plus
• 1:36
  24
• 1:36
  GB
• 1:37
  RAM
• 1:37
  with
• 1:37
  the
• 1:37
  full
• 1:37
  262K
• 1:39
  context.
• 1:40
  Selective
• 1:41
  expert
• 1:41
  offloading
• 1:42
  and
• 1:42
  n-gram
• 1:42
  speculation
• 1:43
  on
• 1:43
  disk
• 1:43
  buy
• 1:44
  about
• 1:44
  70
• 1:45
  tok/s
• 1:45
  prefill,
• 1:46
  104
• 1:47
  with
• 1:47
  a
• 1:47
  load-mode
• 1:47
  tweak,
• 1:48
  and
• 1:48
  roughly
• 1:48
  8
• 1:49
  tok/s
• 1:49
  generation,
• 1:50
  PCIe-bound.
• 1:51
  The
• 1:52
  critique
• 1:52
  is
• 1:52
  in
• 1:52
  the
• 1:52
  comments:
• 1:53
  that
• 1:53
  prefill
• 1:54
  rate
• 1:54
  is
• 1:54
  minutes
• 1:54
  to
• 1:54
  first
• 1:55
  token
• 1:55
  on
• 1:55
  an
• 1:55
  agent
• 1:56
  harness,
• 1:56
  and
• 1:56
  Strata
• 1:57
  users
• 1:57
  report
• 1:57
  far
• 1:58
  better
• 1:58
  numbers
• 1:58
  —
• 1:59
  running
• 1:59
  and
• 2:00
  usable
• 2:00
  are
• 2:00
  different
• 2:01
  claims.
• 2:02
  AbliteratedOutTheBox
• 2:03
  ports
• 2:03
  an
• 2:03
  inference-time
• 2:04
  abliteration
• 2:04
  hook
• 2:05
  —
• 2:05
  a
• 2:05
  llama.cpp
• 2:07
  fork,
• 2:08
  now
• 2:08
  on
• 2:08
  Strata
• 2:08
  —
• 2:09
  so
• 2:09
  refusal
• 2:10
  directions
• 2:10
  can
• 2:10
  be
• 2:10
  projected
• 2:11
  out
• 2:11
  of
• 2:11
  activations
• 2:12
  at
• 2:12
  runtime,
• 2:12
  without
• 2:13
  finetuning
• 2:13
  or
• 2:14
  hunting
• 2:14
  for
• 2:14
  a
• 2:14
  pre-abliterated
• 2:15
  quant.
• 2:16
  Flagged
• 2:16
  experimental,
• 2:17
  and
• 2:17
  priced
• 2:18
  by
• 2:18
  commenters:
• 2:19
  forced
• 2:19
  non-thinking
• 2:20
  mode,
• 2:20
  23x
• 2:21
  prompt
• 2:21
  processing,
• 2:22
  23x
• 2:23
  KV
• 2:23
  cache,
• 2:24
  no
• 2:24
  slot
• 2:24
  sharing.
• 2:25
  And
• 2:25
  on
• 2:26
  Hugging
• 2:26
  Face's
• 2:26
  trending
• 2:27
  list
• 2:27
  sits
• 2:27
  zai-org's
• 2:28
  GLM-4.7-Flash
• 2:29
  —
• 2:30
  the
• 2:30
  Flash
• 2:30
  lineage
• 2:31
  keeps
• 2:31
  appearing
• 2:31
  wherever
• 2:32
  cheap
• 2:32
  local
• 2:32
  inference
• 2:33
  is
• 2:33
  the
• 2:33
  story.
• 2:36
  The
• 2:36
  strangest
• 2:37
  hardware
• 2:37
  story
• 2:37
  of
• 2:38
  the
• 2:38
  week
• 2:38
  sits
• 2:38
  below
• 2:38
  the
• 2:39
  driver.
• 2:40
  nlzy's
• 2:40
  turing-unlock
• 2:41
  is
• 2:41
  a
• 2:41
  Linux
• 2:41
  kernel
• 2:42
  module
• 2:42
  —
• 2:43
  an
• 2:43
  adaptation
• 2:43
  of
• 2:44
  Zagitta's
• 2:44
  gpu-unlock
• 2:44
  —
• 2:45
  that
• 2:45
  unlocks
• 2:46
  the
• 2:46
  full-speed
• 2:46
  FP16
• 2:47
  tensor
• 2:47
  cores
• 2:48
  of
• 2:48
  NVIDIA's
• 2:49
  TU102,
• 2:51
  the
• 2:51
  RTX
• 2:52
  2080
• 2:52
  Ti
• 2:52
  die,
• 2:53
  with
• 2:53
  two
• 2:53
  speed-selector
• 2:54
  writes
• 2:54
  (SS0
• 2:55
  to
• 2:55
  0x88888888,
• 2:57
  SS1
• 2:58
  to
• 2:58
  0x8)
• 2:59
  and
• 2:59
  an
• 2:59
  ACR-mutex-3
• 3:00
  release,
• 3:01
  then
• 3:01
  the
• 3:01
  normal
• 3:01
  Booter
• 3:02
  path.
• 3:02
  No
• 3:03
  BIOS
• 3:03
  flash,
• 3:04
  no
• 3:04
  modified
• 3:04
  driver.
• 3:05
  Tested
• 3:06
  on
• 3:06
  a
• 3:06
  Dell
• 3:06
  RTX
• 3:07
  2080
• 3:07
  Ti
• 3:07
  22GB,
• 3:08
  both
• 3:09
  drivers.
• 3:10
  Measured
• 3:10
  cuBLAS
• 3:11
  FP16
• 3:12
  matmul
• 3:12
  with
• 3:12
  FP32
• 3:13
  accumulation:
• 3:14
  50.3
• 3:15
  to
• 3:15
  68.3
• 3:17
  TFLOPS
• 3:19
  at
• 3:19
  1024-cubed
• 3:20
  —
• 3:21
  120%
• 3:22
  of
• 3:22
  the
• 3:22
  56.9
• 3:24
  TFLOPS
• 3:26
  the
• 3:26
  Turing
• 3:26
  whitepaper
• 3:27
  calls
• 3:27
  peak
• 3:27
  —
• 3:28
  and
• 3:28
  up
• 3:28
  to
• 3:29
  91.4,
• 3:30
  160.6%
• 3:32
  of
• 3:32
  "peak,"
• 3:32
  at
• 3:33
  2048-cubed.
• 3:35
  The
• 3:35
  datasheet
• 3:36
  number
• 3:36
  describes
• 3:36
  the
• 3:36
  locked
• 3:37
  part.
• 3:38
  The
• 3:38
  README
• 3:39
  warns:
• 3:40
  unlocked
• 3:40
  tensor
• 3:41
  cores
• 3:41
  draw
• 3:41
  very
• 3:42
  high
• 3:42
  power
• 3:42
  and
• 3:43
  may
• 3:43
  damage
• 3:43
  the
• 3:43
  card.
• 3:44
  A
• 3:44
  widely
• 3:45
  shared
• 3:45
  post
• 3:45
  collects
• 3:46
  the
• 3:46
  unlock
• 3:46
  family
• 3:47
  across
• 3:47
  three
• 3:47
  GPU
• 3:48
  generations
• 3:48
  —
• 3:49
  RTX
• 3:50
  4090
• 3:51
  from
• 3:51
  165.6
• 3:53
  to
• 3:53
  331.6
• 3:55
  TFLOPS,
• 3:57
  RTX
• 3:57
  3090
• 3:58
  Ti
• 3:58
  BF16
• 3:59
  from
• 3:59
  87.5
• 4:01
  to
• 4:01
  157.4,
• 4:03
  near-doublings
• 4:03
  on
• 4:04
  2080
• 4:04
  Ti
• 4:04
  and
• 4:05
  4070
• 4:06
  Ti
• 4:06
  Super.
• 4:07
  The
• 4:07
  replies
• 4:07
  carry
• 4:07
  the
• 4:08
  reality
• 4:08
  check:
• 4:09
  a
• 4:09
  4070
• 4:10
  Ti
• 4:10
  Super
• 4:11
  measured
• 4:11
  92.8
• 4:12
  to
• 4:12
  177.1
• 4:14
  TFLOPS
• 4:17
  in
• 4:17
  FP16
• 4:18
  matmul,
• 4:19
  yet
• 4:19
  FLUX.2
• 4:20
  image
• 4:20
  passes
• 4:21
  only
• 4:21
  sped
• 4:21
  from
• 4:21
  5.35
• 4:23
  to
• 4:23
  4.54
• 4:24
  seconds,
• 4:24
  and
• 4:25
  INT8-bound
• 4:26
  video
• 4:26
  workloads
• 4:26
  did
• 4:27
  not
• 4:27
  move.
• 4:28
  Doubled
• 4:28
  TFLOPS
• 4:31
  pay
• 4:31
  off
• 4:31
  only
• 4:32
  where
• 4:32
  the
• 4:32
  workload
• 4:32
  is
• 4:32
  FP16/BF16
• 4:34
  compute-bound
• 4:36
  —
• 4:38
  a
• 4:38
  4090
• 4:39
  at
• 4:39
  double
• 4:39
  TFLOPS
• 4:42
  is
• 4:42
  still
• 4:42
  one
• 4:43
  desk
• 4:43
  card.
• 4:44
  The
• 4:44
  repo's
• 4:44
  numbers
• 4:45
  are
• 4:45
  measured;
• 4:46
  the
• 4:46
  cross-generation
• 4:47
  aggregate
• 4:47
  is
• 4:47
  community-reported.
• 4:50
  Microsoft
• 4:51
  and
• 4:51
  Hugging
• 4:52
  Face
• 4:52
  turned
• 4:53
  ThinkingBox
• 4:53
  from
• 4:53
  a
• 4:53
  benchmark
• 4:54
  into
• 4:54
  a
• 4:54
  training
• 4:55
  signal.
• 4:56
  The
• 4:56
  benchmark's
• 4:56
  premise:
• 4:57
  an
• 4:57
  agent's
• 4:58
  claim
• 4:58
  of
• 4:58
  completion
• 4:59
  is
• 4:59
  worthless
• 4:59
  —
• 5:00
  grade
• 5:00
  the
• 5:00
  database
• 5:01
  it
• 5:01
  leaves
• 5:01
  behind.
• 5:02
  ThinkingBox-Bench
• 5:03
  runs
• 5:03
  507
• 5:04
  business
• 5:05
  tasks
• 5:05
  with
• 5:05
  a
• 5:05
  real
• 5:05
  backend,
• 5:06
  MCP
• 5:07
  (Model
• 5:07
  Context
• 5:08
  Protocol)
• 5:08
  tools,
• 5:09
  a
• 5:09
  simulated
• 5:10
  user,
• 5:10
  and
• 5:10
  executable
• 5:11
  checks
• 5:11
  against
• 5:11
  final
• 5:12
  database
• 5:12
  state.
• 5:13
  The
• 5:13
  motivating
• 5:14
  result:
• 5:15
  Kimi-K3
• 5:16
  solved
• 5:16
  93.89%
• 5:18
  of
• 5:18
  tasks
• 5:18
  at
• 5:18
  least
• 5:19
  once
• 5:19
  across
• 5:19
  20
• 5:20
  attempts
• 5:20
  but
• 5:20
  completed
• 5:21
  only
• 5:21
  68
• 5:22
  of
• 5:22
  507
• 5:23
  every
• 5:23
  time.
• 5:24
  The
• 5:24
  binary
• 5:24
  check
• 5:25
  from
• 5:25
  terminal
• 5:25
  state
• 5:26
  is
• 5:26
  not
• 5:26
  just
• 5:26
  a
• 5:26
  grade
• 5:26
  —
• 5:27
  "this
• 5:27
  can
• 5:27
  be
• 5:28
  a
• 5:28
  reward
• 5:28
  function."
• 5:29
  The
• 5:29
  team
• 5:29
  fine-tuned
• 5:30
  Qwen3.8-27B
• 5:33
  with
• 5:33
  GRPO
• 5:34
  —
• 5:34
  reinforcement
• 5:35
  learning
• 5:35
  that
• 5:36
  scores
• 5:36
  rollouts
• 5:36
  against
• 5:37
  their
• 5:37
  group's
• 5:37
  average
• 5:37
  —
• 5:38
  on
• 5:38
  database-check
• 5:39
  rewards,
• 5:39
  24
• 5:40
  H100s.
• 5:41
  Task
• 5:41
  selection
• 5:42
  is
• 5:42
  the
• 5:42
  clever
• 5:42
  part:
• 5:43
  candidates
• 5:43
  probed
• 5:44
  against
• 5:44
  the
• 5:44
  base
• 5:44
  policy,
• 5:45
  success
• 5:46
  modeled
• 5:46
  as
• 5:46
  a
• 5:46
  Beta
• 5:47
  posterior,
• 5:47
  only
• 5:48
  mixed-success
• 5:48
  tasks
• 5:49
  kept
• 5:49
  —
• 5:50
  "a
• 5:50
  task
• 5:50
  is
• 5:50
  hard
• 5:51
  for
• 5:51
  the
• 5:51
  current
• 5:51
  model
• 5:51
  only
• 5:52
  until
• 5:52
  that
• 5:52
  model
• 5:52
  learns
• 5:53
  it."
• 5:53
  On
• 5:53
  the
• 5:54
  held-out
• 5:54
  benchmark,
• 5:55
  pass@1
• 5:55
  rose
• 5:56
  from
• 5:56
  51.70%
• 5:57
  to
• 5:58
  60.78%,
• 5:59
  and
• 5:59
  perfect
• 6:00
  20-of-20
• 6:00
  runs
• 6:01
  nearly
• 6:01
  tripled
• 6:01
  from
• 6:02
  38
• 6:02
  tasks
• 6:03
  to
• 6:03
  107
• 6:03
  —
• 6:04
  past
• 6:04
  Kimi-K3's
• 6:06
  68.
• 6:07
  GPT-5.6
• 6:08
  Sol
• 6:08
  edges
• 6:08
  it
• 6:08
  on
• 6:08
  pass@1
• 6:09
  with
• 6:09
  only
• 6:10
  82
• 6:10
  dependable
• 6:11
  tasks.
• 6:12
  Pass@20
• 6:13
  dipped
• 6:13
  slightly
• 6:13
  —
• 6:14
  "The
• 6:14
  model
• 6:15
  did
• 6:15
  not
• 6:15
  become
• 6:15
  broader.
• 6:16
  It
• 6:16
  became
• 6:16
  more
• 6:17
  repeatable."
• 6:18
  On
• 6:18
  a
• 6:18
  hotel-downgrade
• 6:19
  task
• 6:19
  violating
• 6:20
  approval
• 6:20
  policy
• 6:21
  in
• 6:21
  15
• 6:21
  of
• 6:21
  20
• 6:21
  attempts
• 6:22
  before
• 6:22
  training,
• 6:23
  it
• 6:23
  preserved
• 6:23
  state
• 6:24
  in
• 6:24
  all
• 6:24
  20.
• 6:25
  Cost
• 6:25
  per
• 6:25
  successful
• 6:26
  attempt
• 6:26
  fell
• 6:27
  to
• 6:27
  $0.139;
• 6:29
  paper:
• 6:30
  arXiv
• 6:30
  2608.19741.
• 6:34
  Ubicloud,
• 6:34
  serving
• 6:35
  Kimi
• 6:35
  K2.6
• 6:37
  on
• 6:37
  vLLM
• 6:38
  0.28,
• 6:39
  saw
• 6:39
  92%
• 6:40
  tool-call
• 6:41
  schema
• 6:41
  accuracy,
• 6:42
  and
• 6:42
  malformed
• 6:42
  calls
• 6:43
  poison
• 6:43
  the
• 6:43
  context
• 6:44
  and
• 6:44
  multiply
• 6:44
  retries.
• 6:46
  The
• 6:46
  fix
• 6:46
  is
• 6:46
  XGrammar
• 6:47
  constrained
• 6:47
  decoding:
• 6:48
  the
• 6:49
  engine
• 6:49
  masks
• 6:49
  invalid
• 6:50
  tokens
• 6:50
  at
• 6:50
  each
• 6:50
  step,
• 6:51
  forcing
• 6:51
  the
• 6:51
  call
• 6:52
  down
• 6:52
  a
• 6:52
  grammar
• 6:52
  of
• 6:52
  valid
• 6:53
  tool
• 6:53
  names
• 6:53
  and
• 6:53
  schema-conformant
• 6:54
  arguments,
• 6:55
  with
• 6:55
  masks
• 6:56
  precomputed
• 6:56
  and
• 6:56
  applied
• 6:57
  on
• 6:57
  the
• 6:57
  GPU.
• 6:58
  Schema
• 6:58
  accuracy
• 6:59
  hit
• 6:59
  100%
• 7:00
  on
• 7:00
  Moonshot's
• 7:00
  K2
• 7:01
  Vendor
• 7:01
  Verifier.
• 7:02
  The
• 7:03
  history:
• 7:03
  vLLM
• 7:04
  shipped
• 7:04
  it
• 7:05
  in
• 7:05
  0.25
• 7:06
  and
• 7:06
  scores
• 7:06
  dropped
• 7:07
  to
• 7:07
  91%,
• 7:08
  because
• 7:08
  forced
• 7:09
  tokens
• 7:09
  derail
• 7:09
  models
• 7:10
  whose
• 7:10
  unconstrained
• 7:11
  output
• 7:11
  diverges
• 7:12
  from
• 7:12
  their
• 7:12
  own
• 7:12
  format
• 7:13
  —
• 7:14
  gpt-oss-20b,
• 7:15
  Qwen
• 7:15
  3.6,
• 7:16
  and
• 7:17
  GLM
• 7:17
  5.1
• 7:18
  users
• 7:18
  reported
• 7:18
  problems
• 7:19
  —
• 7:20
  plus
• 7:20
  broken
• 7:21
  grammar
• 7:21
  translations
• 7:21
  and
• 7:22
  wrongly
• 7:22
  rejected
• 7:22
  speculative
• 7:23
  tokens.
• 7:24
  Maintainers
• 7:25
  made
• 7:25
  opt-out
• 7:26
  the
• 7:26
  default,
• 7:27
  adding
• 7:27
  a
• 7:27
  server-side
• 7:28
  flag
• 7:28
  in
• 7:28
  0.31;
• 7:30
  Ubicloud
• 7:30
  enabled
• 7:31
  it,
• 7:31
  and
• 7:31
  DeepSeek
• 7:32
  V4
• 7:32
  Flash
• 7:32
  straightened
• 7:33
  out.
• 7:34
  Tool-call
• 7:35
  accuracy
• 7:35
  is
• 7:35
  an
• 7:35
  inference-engine
• 7:36
  property,
• 7:37
  not
• 7:37
  only
• 7:37
  a
• 7:37
  model
• 7:38
  property.
• 7:41
  Erica
• 7:41
  Windisch's
• 7:42
  tailworm
• 7:42
  report
• 7:42
  —
• 7:43
  an
• 7:43
  independent
• 7:44
  assessment
• 7:44
  of
• 7:44
  tailscale
• 7:45
  v1.104.2
• 7:48
  and
• 7:49
  headscale
• 7:49
  v0.29.5,
• 7:52
  every
• 7:52
  finding
• 7:53
  reproduced
• 7:53
  on
• 7:53
  unmodified,
• 7:54
  released
• 7:54
  software
• 7:55
  —
• 7:55
  is
• 7:56
  the
• 7:56
  week's
• 7:56
  biggest
• 7:56
  security
• 7:57
  story.
• 7:58
  The
• 7:58
  thesis:
• 7:59
  a
• 7:59
  single,
• 7:59
  highly
• 8:00
  privileged
• 8:00
  root
• 8:00
  process
• 8:01
  replaced
• 8:01
  OpenSSH-style
• 8:02
  privilege
• 8:02
  separation
• 8:03
  while
• 8:03
  marketing
• 8:04
  security
• 8:04
  as
• 8:04
  its
• 8:04
  design
• 8:05
  and
• 8:05
  purpose.
• 8:06
  The
• 8:06
  headline
• 8:06
  class:
• 8:07
  the
• 8:07
  root-privileged
• 8:08
  tailscaled
• 8:08
  dials,
• 8:09
  replaces,
• 8:09
  and
• 8:10
  deletes
• 8:10
  privileged
• 8:10
  sockets
• 8:11
  on
• 8:11
  an
• 8:11
  unprivileged
• 8:12
  peer's
• 8:12
  behalf,
• 8:13
  and
• 8:13
  a
• 8:13
  rename()
• 8:14
  race
• 8:15
  —
• 8:15
  170,000
• 8:16
  path-state
• 8:17
  flips
• 8:17
  per
• 8:17
  second
• 8:17
  —
• 8:18
  defeats
• 8:18
  the
• 8:18
  home,
• 8:19
  /tmp,
• 8:20
  and
• 8:21
  /run/user
• 8:22
  whitelist.
• 8:23
  The
• 8:23
  verdict
• 8:24
  is
• 8:24
  three
• 8:24
  words,
• 8:25
  "not
• 8:25
  a
• 8:25
  security
• 8:26
  boundary,"
• 8:26
  backed
• 8:27
  by
• 8:27
  lab
• 8:27
  root-execution
• 8:28
  demos:
• 8:28
  dockerd,
• 8:29
  kubelet
• 8:29
  credential
• 8:30
  delivery,
• 8:30
  authkey
• 8:31
  capture,
• 8:31
  rogue-node
• 8:32
  enrollment
• 8:32
  under
• 8:33
  a
• 8:33
  victim's
• 8:33
  identity.
• 8:34
  The
• 8:34
  rest
• 8:34
  compounds.
• 8:36
  conn25,
• 8:37
  the
• 8:37
  experimental
• 8:38
  app-connector,
• 8:39
  validates
• 8:39
  client-declared
• 8:40
  destinations
• 8:41
  only
• 8:41
  for
• 8:41
  address
• 8:41
  family,
• 8:42
  so
• 8:42
  any
• 8:43
  entitled
• 8:43
  user
• 8:44
  can
• 8:44
  steer
• 8:44
  egress
• 8:44
  at
• 8:45
  cloud
• 8:45
  metadata
• 8:45
  services,
• 8:46
  internal
• 8:47
  LANs,
• 8:47
  or
• 8:48
  every
• 8:48
  service
• 8:49
  in
• 8:49
  a
• 8:49
  Kubernetes
• 8:49
  cluster.
• 8:50
  An
• 8:51
  unauthenticated
• 8:51
  peer
• 8:52
  can
• 8:52
  exhaust
• 8:52
  ~536
• 8:54
  MB
• 8:54
  in
• 8:54
  seven
• 8:55
  seconds
• 8:55
  and
• 8:55
  crash-loop
• 8:56
  headscale,
• 8:57
  blocking
• 8:57
  org-wide
• 8:58
  onboarding;
• 8:59
  a
• 8:59
  10
• 8:59
  MB
• 8:59
  DERP
• 9:00
  response
• 9:00
  amplifies
• 9:01
  to
• 9:01
  1.34
• 9:02
  GB.
• 9:03
  A
• 9:03
  one-line
• 9:04
  serve
• 9:04
  command
• 9:04
  forwarding
• 9:05
  a
• 9:05
  unix:
• 9:05
  socket
• 9:06
  exposes
• 9:06
  the
• 9:06
  localapi
• 9:07
  admin
• 9:07
  socket
• 9:08
  to
• 9:08
  remote
• 9:08
  peers
• 9:08
  —
• 9:09
  node
• 9:09
  takeover.
• 9:10
  Wormability
• 9:11
  is
• 9:11
  measured,
• 9:12
  not
• 9:12
  asserted:
• 9:13
  with
• 9:13
  policy-granted
• 9:14
  SSH
• 9:14
  plus
• 9:15
  the
• 9:15
  socket
• 9:15
  findings,
• 9:16
  the
• 9:16
  report
• 9:16
  describes
• 9:17
  "automated
• 9:18
  spread
• 9:18
  to
• 9:18
  every
• 9:18
  device
• 9:19
  the
• 9:19
  policy
• 9:19
  permits
• 9:20
  —
• 9:20
  no
• 9:21
  passwords,
• 9:21
  no
• 9:21
  stolen
• 9:22
  keys,
• 9:23
  no
• 9:23
  user
• 9:23
  interaction,
• 9:24
  under
• 9:24
  a
• 9:24
  second
• 9:24
  per
• 9:24
  hop."
• 9:25
  Check
• 9:25
  mode
• 9:26
  does
• 9:26
  not
• 9:26
  constrain
• 9:26
  forwarding,
• 9:27
  and
• 9:27
  headscale
• 9:27
  v0.29.5
• 9:31
  grants
• 9:31
  it
• 9:31
  unconditionally
• 9:31
  —
• 9:32
  "treat
• 9:33
  every
• 9:33
  headscale
• 9:33
  SSH
• 9:34
  grant
• 9:34
  as
• 9:34
  root-equivalent."
• 9:36
  Containment
• 9:36
  means
• 9:36
  deleting
• 9:37
  the
• 9:37
  node
• 9:37
  at
• 9:37
  the
• 9:37
  control
• 9:38
  plane:
• 9:38
  "reimaging
• 9:39
  alone
• 9:39
  is
• 9:40
  not
• 9:40
  containment."
• 9:41
  Tailscale's
• 9:41
  VP
• 9:42
  of
• 9:42
  Engineering,
• 9:43
  Mike
• 9:43
  Shaver,
• 9:43
  answered
• 9:44
  on
• 9:44
  Reddit:
• 9:45
  "we're
• 9:45
  not
• 9:45
  recommending
• 9:45
  that
• 9:45
  everyone
• 9:46
  disable
• 9:46
  Tailscale
• 9:47
  SSH."
• 9:48
  The
• 9:48
  confirmed
• 9:49
  issues
• 9:49
  concern
• 9:49
  what
• 9:50
  happens
• 9:50
  after
• 9:50
  authorization
• 9:51
  —
• 9:51
  "a
• 9:52
  session
• 9:52
  may
• 9:52
  be
• 9:52
  able
• 9:52
  to
• 9:52
  do
• 9:53
  more
• 9:53
  than
• 9:53
  the
• 9:53
  configured
• 9:54
  local
• 9:54
  user
• 9:54
  should
• 9:55
  be
• 9:55
  allowed
• 9:55
  to
• 9:55
  do"
• 9:55
  —
• 9:56
  not
• 9:56
  unauthenticated
• 9:57
  access
• 9:58
  to
• 9:58
  arbitrary
• 9:58
  machines.
• 9:59
  The
• 9:59
  mitigation
• 10:00
  matches
• 10:00
  the
• 10:00
  assessment:
• 10:01
  TS
• 10:02
  SSH
• 10:02
  DISABLE
• 10:03
  FORWARDING=1
• 10:04
  addresses
• 10:05
  several
• 10:05
  of
• 10:05
  the
• 10:05
  more
• 10:06
  serious
• 10:06
  findings;
• 10:07
  check
• 10:07
  mode
• 10:08
  adds
• 10:08
  a
• 10:08
  barrier
• 10:08
  but
• 10:09
  will
• 10:09
  not
• 10:09
  fix
• 10:09
  privilege
• 10:10
  escalation.
• 10:11
  An
• 10:11
  advisory
• 10:12
  is
• 10:12
  promised;
• 10:13
  the
• 10:13
  subject
• 10:13
  is
• 10:13
  Tailscale's
• 10:14
  own
• 10:14
  SSH
• 10:15
  server,
• 10:16
  not
• 10:16
  stock
• 10:16
  sshd
• 10:17
  over
• 10:17
  the
• 10:17
  tunnel.
• 10:19
  Lab
• 10:19
  reproduction
• 10:19
  on
• 10:20
  unmodified
• 10:20
  software
• 10:21
  is
• 10:21
  the
• 10:21
  strongest
• 10:22
  evidence
• 10:22
  an
• 10:22
  assessment
• 10:23
  can
• 10:23
  offer;
• 10:24
  per-configuration
• 10:25
  impact
• 10:25
  is
• 10:26
  still
• 10:26
  being
• 10:26
  validated.
• 10:29
  The
• 10:29
  PHP
• 10:30
  exploitation
• 10:30
  arc
• 10:30
  has
• 10:31
  its
• 10:31
  stock-config
• 10:31
  answer.
• 10:32
  When
• 10:32
  the
• 10:33
  session-handling
• 10:33
  bugs
• 10:34
  in
• 10:34
  PHP
• 10:34
  core
• 10:34
  were
• 10:35
  patched
• 10:35
  last
• 10:35
  week,
• 10:35
  the
• 10:36
  open
• 10:36
  question
• 10:36
  was
• 10:36
  whether
• 10:37
  any
• 10:37
  public
• 10:37
  chain
• 10:37
  worked
• 10:38
  against
• 10:38
  an
• 10:38
  unmodified
• 10:39
  target
• 10:39
  —
• 10:40
  the
• 10:40
  first
• 10:40
  PoC
• 10:40
  wave
• 10:41
  leaned
• 10:41
  on
• 10:41
  author-planted
• 10:42
  lab
• 10:42
  setups.
• 10:43
  9bie's
• 10:45
  php2shell-bypass-aslr-exp
• 10:46
  is
• 10:46
  the
• 10:47
  counterexample:
• 10:48
  pure
• 10:48
  HTTP,
• 10:49
  against
• 10:50
  the
• 10:50
  official
• 10:50
  PHP
• 10:51
  image
• 10:51
  with
• 10:51
  stock
• 10:51
  php.ini-production
• 10:54
  settings,
• 10:55
  official
• 10:55
  prefork
• 10:56
  with
• 10:56
  MaxRequestWorkers=150,
• 10:59
  and
• 10:59
  a
• 10:59
  target
• 10:59
  page
• 10:59
  with
• 11:00
  only
• 11:00
  an
• 11:00
  echo
• 11:00
  statement.
• 11:01
  Ten
• 11:01
  of
• 11:01
  ten
• 11:02
  runs
• 11:02
  on
• 11:02
  stock
• 11:02
  x86
• 11:03
  64,
• 11:04
  ten
• 11:04
  on
• 11:04
  arm64,
• 11:05
  three
• 11:05
  to
• 11:06
  four
• 11:06
  seconds
• 11:06
  per
• 11:06
  RCE.
• 11:07
  The
• 11:08
  chain
• 11:08
  demolishes
• 11:08
  PHP's
• 11:09
  request
• 11:09
  lifecycle.
• 11:10
  Worker
• 11:11
  pinning
• 11:11
  first:
• 11:12
  149
• 11:13
  half-finished
• 11:14
  POST
• 11:14
  bodies
• 11:14
  occupy
• 11:15
  every
• 11:15
  Apache
• 11:15
  child
• 11:16
  but
• 11:16
  one,
• 11:17
  so
• 11:17
  all
• 11:17
  four
• 11:17
  stages
• 11:18
  hit
• 11:18
  the
• 11:18
  same
• 11:18
  worker
• 11:19
  and
• 11:19
  stale
• 11:19
  pointers
• 11:20
  survive.
• 11:21
  Stage
• 11:21
  A1
• 11:21
  drives
• 11:22
  an
• 11:22
  out-of-memory
• 11:22
  in
• 11:22
  end-of-request
• 11:23
  cleanup
• 11:24
  with
• 11:24
  860
• 11:25
  nested
• 11:25
  file
• 11:25
  fields
• 11:26
  and
• 11:26
  a
• 11:26
  PHP
• 11:27
  SESSION
• 11:27
  UPLOAD
• 11:28
  PROGRESS
• 11:28
  token,
• 11:29
  leaving
• 11:29
  dangling
• 11:29
  pointers.
• 11:31
  Stage
• 11:31
  B1
• 11:31
  turns
• 11:32
  Set-Cookie
• 11:32
  into
• 11:32
  an
• 11:33
  out-of-bounds
• 11:33
  read
• 11:33
  encoding
• 11:34
  ~800
• 11:35
  KB
• 11:35
  of
• 11:35
  adjacent
• 11:36
  heap
• 11:36
  —
• 11:37
  chunk
• 11:37
  pointers
• 11:37
  and
• 11:37
  a
• 11:37
  zval
• 11:38
  destructor
• 11:38
  pointer
• 11:39
  appearing
• 11:39
  1,095
• 11:40
  times
• 11:40
  —
• 11:42
  yielding
• 11:42
  the
• 11:42
  libphp
• 11:42
  base
• 11:43
  and
• 11:43
  defeating
• 11:43
  ASLR
• 11:44
  arithmetically.
• 11:45
  A
• 11:45
  final
• 11:46
  overwrite
• 11:46
  stages
• 11:47
  a
• 11:47
  fake
• 11:47
  array
• 11:47
  whose
• 11:47
  destructor
• 11:48
  is
• 11:48
  PHP's
• 11:49
  own
• 11:49
  command-execution
• 11:50
  handler;
• 11:50
  ordinary
• 11:51
  shutdown
• 11:51
  calls
• 11:52
  it
• 11:52
  with
• 11:52
  the
• 11:52
  attacker's
• 11:52
  command.
• 11:53
  The
• 11:53
  README's
• 11:56
  recipe
• 11:56
  is
• 11:56
  blunt:
• 11:57
  compute
• 11:57
  offsets
• 11:58
  per
• 11:58
  PHP
• 11:59
  build,
• 11:59
  mass-fuzz,
• 12:01
  let
• 12:01
  crashed
• 12:01
  workers
• 12:02
  restart
• 12:02
  —
• 12:03
  authorized
• 12:04
  research
• 12:04
  only,
• 12:05
  no
• 12:05
  debugger,
• 12:05
  custom
• 12:06
  ini,
• 12:06
  or
• 12:07
  target-side
• 12:07
  files.
• 12:08
  Bundled
• 12:09
  C
• 12:09
  libraries
• 12:10
  have
• 12:10
  their
• 12:10
  own
• 12:10
  CVE:
• 12:11
  CVE-2026-111497,
• 12:14
  "Node2Shell"
• 12:18
  or
• 12:18
  Broccoli,
• 12:18
  an
• 12:19
  out-of-bounds
• 12:19
  write
• 12:19
  in
• 12:20
  the
• 12:20
  Brotli
• 12:20
  decoder
• 12:20
  —
• 12:21
  CVSS
• 12:22
  v4.0
• 12:23
  9.2,
• 12:25
  in
• 12:25
  CISA's
• 12:25
  KEV
• 12:26
  catalog
• 12:26
  —
• 12:27
  affecting
• 12:27
  Brotli
• 12:28
  1.0.3-1.2.0
• 12:31
  and
• 12:31
  the
• 12:31
  copies
• 12:32
  bundled
• 12:32
  into
• 12:32
  Node.js,
• 12:34
  Python,
• 12:34
  Bun,
• 12:34
  and
• 12:35
  Envoy.
• 12:36
  The
• 12:36
  decoder
• 12:36
  "confuses
• 12:37
  malformed
• 12:38
  input
• 12:38
  with
• 12:38
  incomplete
• 12:39
  input,
• 12:39
  keeps
• 12:39
  filling
• 12:40
  an
• 12:40
  8-byte
• 12:40
  state
• 12:41
  buffer
• 12:41
  past
• 12:41
  its
• 12:41
  end,
• 12:42
  and
• 12:42
  corrupts
• 12:42
  adjacent
• 12:43
  state."
• 12:44
  A
• 12:44
  detection-engineering
• 12:45
  gist
• 12:45
  —
• 12:46
  "reproduction
• 12:46
  and
• 12:47
  detection
• 12:47
  —
• 12:47
  not
• 12:48
  discovery"
• 12:48
  —
• 12:49
  runs
• 12:49
  one
• 12:49
  verified
• 12:50
  23,068,706-byte
• 12:53
  payload
• 12:53
  through
• 12:54
  four
• 12:54
  runtimes:
• 12:55
  vulnerable
• 12:56
  Node
• 12:56
  24.22.0
• 12:58
  emits
• 12:58
  Z
• 12:59
  BUF
• 12:59
  ERROR,
• 13:00
  patched
• 13:00
  24.22.1
• 13:02
  hard-rejects,
• 13:03
  and
• 13:03
  Python's
• 13:04
  Brotli
• 13:04
  1.2.0
• 13:06
  streaming
• 13:06
  decoder
• 13:06
  raises
• 13:07
  no
• 13:07
  exception
• 13:07
  on
• 13:08
  a
• 13:08
  complete
• 13:08
  stream
• 13:08
  —
• 13:09
  "the
• 13:09
  bug."
• 13:10
  An
• 13:10
  ASAN
• 13:10
  harness
• 13:11
  on
• 13:11
  the
• 13:11
  raw
• 13:11
  decoder
• 13:12
  found
• 13:12
  nothing
• 13:12
  —
• 13:13
  the
• 13:13
  corruption
• 13:13
  lives
• 13:14
  in
• 13:14
  the
• 13:14
  Node
• 13:14
  and
• 13:14
  Python
• 13:15
  wrapper
• 13:15
  retry
• 13:15
  loops.
• 13:16
  Detection
• 13:17
  ships
• 13:17
  as
• 13:17
  Sigma,
• 13:17
  Suricata,
• 13:18
  ModSecurity
• 13:19
  (verified
• 13:20
  7/7
• 13:20
  against
• 13:21
  libmodsecurity
• 13:21
  3.0.14)
• 13:23
  and
• 13:23
  falco
• 13:24
  rules,
• 13:24
  with
• 13:24
  the
• 13:24
  caveat
• 13:25
  that
• 13:25
  Z
• 13:25
  BUF
• 13:26
  ERROR
• 13:26
  fires
• 13:26
  on
• 13:27
  any
• 13:27
  truncated
• 13:27
  stream,
• 13:28
  and
• 13:28
  "a
• 13:28
  runtime
• 13:29
  sensor
• 13:29
  cannot
• 13:29
  see
• 13:30
  the
• 13:30
  overflow":
• 13:31
  the
• 13:31
  observable
• 13:32
  chain
• 13:32
  is
• 13:32
  worker
• 13:32
  crash,
• 13:33
  then
• 13:33
  in-place
• 13:34
  execution.
• 13:35
  Public
• 13:35
  results
• 13:36
  are
• 13:36
  precise:
• 13:37
  Imperva's
• 13:37
  red
• 13:38
  team
• 13:38
  hit
• 13:38
  RCE
• 13:39
  on
• 13:39
  the
• 13:39
  official
• 13:39
  Node
• 13:40
  24.22.0
• 13:41
  arm64
• 13:43
  image
• 13:43
  "after
• 13:44
  several
• 13:44
  attempts";
• 13:45
  a
• 13:45
  blind
• 13:45
  remote
• 13:45
  attempt
• 13:46
  failed
• 13:46
  under
• 13:46
  ASLR.
• 13:47
  Two
• 13:47
  inventory
• 13:48
  traps:
• 13:48
  patched
• 13:49
  Node
• 13:49
  24.22.1
• 13:52
  still
• 13:52
  reports
• 13:52
  Brotli
• 13:53
  1.2.0,
• 13:55
  and
• 13:55
  Express
• 13:55
  5's
• 13:56
  100kb
• 13:56
  limit
• 13:57
  counts
• 13:57
  decompressed
• 13:57
  bytes,
• 13:58
  letting
• 13:58
  the
• 13:58
  compressed
• 13:59
  trigger
• 13:59
  through.
• 14:03
  The
• 14:03
  Model
• 14:03
  Context
• 14:03
  Protocol
• 14:04
  ecosystem
• 14:05
  has
• 14:05
  its
• 14:05
  supply-chain
• 14:05
  case
• 14:06
  study.
• 14:07
  Knostic
• 14:07
  found
• 14:07
  an
• 14:07
  npm
• 14:08
  package
• 14:08
  that
• 14:08
  looks
• 14:09
  like
• 14:09
  Amazon's
• 14:09
  Selling
• 14:09
  Partner
• 14:10
  API
• 14:10
  MCP
• 14:11
  server
• 14:11
  —
• 14:11
  it
• 14:12
  reuses
• 14:12
  the
• 14:12
  open-source
• 14:13
  code
• 14:13
  —
• 14:13
  but
• 14:14
  swaps
• 14:14
  the
• 14:14
  destinations:
• 14:15
  authenticated
• 14:16
  operations
• 14:16
  send
• 14:16
  the
• 14:16
  client
• 14:17
  ID,
• 14:17
  client
• 14:18
  secret,
• 14:18
  and
• 14:18
  refresh
• 14:19
  token
• 14:19
  to
• 14:19
  a
• 14:19
  hardcoded
• 14:20
  IP
• 14:20
  over
• 14:20
  plain
• 14:21
  HTTP.
• 14:22
  All
• 14:22
  seven
• 14:22
  versions
• 14:23
  landed
• 14:23
  on
• 14:23
  June
• 14:23
  22
• 14:24
  within
• 14:24
  two
• 14:25
  hours,
• 14:25
  IP
• 14:25
  present
• 14:26
  from
• 14:26
  the
• 14:26
  first;
• 14:27
  the
• 14:27
  README
• 14:29
  never
• 14:29
  discloses
• 14:29
  it.
• 14:30
  The
• 14:30
  exposure
• 14:31
  outlives
• 14:31
  the
• 14:31
  package:
• 14:32
  generated
• 14:32
  integration
• 14:33
  code
• 14:33
  embeds
• 14:34
  the
• 14:34
  same
• 14:34
  IP-based
• 14:35
  URLs,
• 14:35
  so
• 14:36
  apps
• 14:36
  built
• 14:36
  on
• 14:36
  its
• 14:36
  examples
• 14:37
  keep
• 14:37
  leaking.
• 14:38
  What
• 14:38
  it
• 14:38
  does
• 14:38
  not
• 14:38
  establish
• 14:39
  is
• 14:39
  plain:
• 14:40
  who
• 14:40
  operates
• 14:40
  the
• 14:41
  destination,
• 14:41
  and
• 14:42
  whether
• 14:42
  real
• 14:42
  credentials
• 14:42
  reached
• 14:43
  it
• 14:43
  or
• 14:43
  were
• 14:43
  misused.
• 14:44
  The
• 14:44
  download
• 14:45
  counter
• 14:46
  —
• 14:46
  929
• 14:47
  on
• 14:47
  publication
• 14:48
  day
• 14:48
  —
• 14:49
  counts
• 14:49
  scanners
• 14:49
  and
• 14:50
  CI,
• 14:50
  not
• 14:50
  victims.
• 14:51
  The
• 14:51
  lesson:
• 14:52
  "familiar
• 14:52
  authentication
• 14:53
  code
• 14:53
  now
• 14:54
  has
• 14:54
  a
• 14:54
  different
• 14:54
  recipient.
• 14:55
  Reviews
• 14:56
  that
• 14:56
  skip
• 14:56
  the
• 14:56
  destination
• 14:57
  miss
• 14:57
  it."
• 14:58
  The
• 14:58
  defense
• 14:58
  consolidates
• 14:59
  around
• 14:59
  one
• 14:59
  idea:
• 15:00
  evidence
• 15:00
  gates.
• 15:01
  Arad-Code,
• 15:02
  an
• 15:03
  AGPL
• 15:03
  security
• 15:04
  auditor,
• 15:04
  drives
• 15:05
  an
• 15:05
  LLM
• 15:05
  through
• 15:06
  markdown
• 15:06
  skill
• 15:06
  playbooks
• 15:07
  with
• 15:07
  real
• 15:07
  tools
• 15:07
  —
• 15:08
  a
• 15:08
  Model
• 15:09
  Context
• 15:09
  Protocol
• 15:09
  code
• 15:10
  graph,
• 15:10
  ripgrep,
• 15:11
  semgrep,
• 15:12
  a
• 15:12
  read-only
• 15:12
  shell.
• 15:13
  Its
• 15:13
  core
• 15:13
  rule:
• 15:14
  "nothing
• 15:14
  reaches
• 15:15
  the
• 15:15
  report
• 15:15
  unless
• 15:15
  it
• 15:15
  can
• 15:16
  be
• 15:16
  pointed
• 15:16
  to
• 15:16
  in
• 15:16
  the
• 15:16
  code."
• 15:17
  Findings
• 15:18
  cite
• 15:18
  file,
• 15:18
  line,
• 15:19
  and
• 15:19
  verbatim
• 15:19
  quote;
• 15:20
  the
• 15:20
  engine
• 15:21
  re-reads
• 15:21
  and
• 15:21
  discards
• 15:22
  anything
• 15:22
  not
• 15:22
  there;
• 15:23
  confidence
• 15:24
  caps
• 15:24
  by
• 15:24
  evidence
• 15:25
  class
• 15:25
  —
• 15:26
  grep
• 15:26
  hit
• 15:26
  4,
• 15:27
  traced
• 15:27
  chain
• 15:27
  10.
• 15:29
  xss-specialist
• 15:29
  applies
• 15:30
  the
• 15:30
  same
• 15:30
  discipline
• 15:31
  to
• 15:31
  web
• 15:31
  attacks:
• 15:32
  a
• 15:32
  CONFIRMED,
• 15:33
  LIKELY,
• 15:34
  INCONCLUSIVE,
• 15:35
  NOT
• 15:35
  VULNERABLE
• 15:36
  state
• 15:36
  machine
• 15:37
  where
• 15:37
  "a
• 15:37
  finding
• 15:37
  is
• 15:38
  never
• 15:38
  upgraded
• 15:38
  to
• 15:38
  CONFIRMED
• 15:39
  from
• 15:39
  model
• 15:39
  confidence"
• 15:40
  —
• 15:41
  a
• 15:41
  headless-browser
• 15:42
  oracle
• 15:42
  is
• 15:42
  the
• 15:42
  sole
• 15:43
  authority.
• 15:44
  On
• 15:45
  its
• 15:45
  frozen
• 15:45
  102-case
• 15:46
  benchmark:
• 15:47
  0.941
• 15:49
  precision,
• 15:49
  1.000
• 15:50
  recall
• 15:51
  —
• 15:52
  against
• 15:53
  a
• 15:53
  naive
• 15:53
  scanner's
• 15:53
  97%
• 15:54
  false
• 15:55
  positives.
• 15:56
  Its
• 15:56
  honest
• 15:57
  failure:
• 15:57
  fine-tuning
• 15:58
  never
• 15:58
  fixed
• 15:59
  near-miss
• 15:59
  sanitizer
• 16:00
  leakage
• 16:00
  —
• 16:01
  a
• 16:01
  model
• 16:01
  that
• 16:01
  learns
• 16:02
  DOMPurify.sanitize
• 16:03
  is
• 16:03
  safe
• 16:04
  "will
• 16:04
  happily
• 16:04
  call
• 16:05
  DOMPvrify.sanitize,
• 16:08
  OMPurify.sanitize,
• 16:12
  or
• 16:12
  sanitizeHtm1
• 16:13
  safe
• 16:14
  too"
• 16:14
  —
• 16:15
  so
• 16:15
  exact-identity
• 16:16
  verification
• 16:16
  replaces
• 16:17
  model
• 16:17
  judgment.
• 16:18
  "Don't
• 16:18
  trust
• 16:18
  the
• 16:19
  model's
• 16:19
  names
• 16:19
  —
• 16:20
  trust
• 16:20
  the
• 16:20
  browser's
• 16:21
  execution."
• 16:22
  "Detect
• 16:22
  and
• 16:22
  Suppress"
• 16:23
  (arXiv
• 16:24
  2610.03498)
• 16:26
  targets
• 16:26
  adversarial
• 16:27
  patches
• 16:27
  —
• 16:28
  printed
• 16:29
  patterns
• 16:29
  that
• 16:29
  flip
• 16:29
  a
• 16:29
  vision-language-action
• 16:30
  model's
• 16:31
  outputs
• 16:31
  —
• 16:32
  in
• 16:32
  OpenVLA
• 16:33
  and
• 16:33
  SmolVLA
• 16:34
  on
• 16:34
  LIBERO.
• 16:35
  Instead
• 16:35
  of
• 16:35
  weak
• 16:36
  input
• 16:36
  preprocessing
• 16:37
  or
• 16:37
  an
• 16:37
  adversarial
• 16:38
  retrain,
• 16:39
  they
• 16:39
  train
• 16:39
  a
• 16:39
  sparse
• 16:40
  autoencoder
• 16:41
  on
• 16:41
  residual-stream
• 16:41
  activations
• 16:42
  from
• 16:42
  clean
• 16:42
  trajectories,
• 16:44
  find
• 16:44
  the
• 16:44
  feature
• 16:44
  that
• 16:44
  tracks
• 16:45
  patch
• 16:45
  presence,
• 16:46
  detect
• 16:46
  the
• 16:46
  patch
• 16:46
  with
• 16:47
  a
• 16:47
  linear
• 16:47
  probe,
• 16:48
  and
• 16:48
  suppress
• 16:48
  that
• 16:48
  one
• 16:49
  feature
• 16:49
  only
• 16:49
  when
• 16:49
  the
• 16:49
  probe
• 16:50
  fires.
• 16:51
  Conditional
• 16:51
  intervention
• 16:52
  recovers
• 16:52
  success
• 16:53
  rates
• 16:53
  to
• 16:53
  oracle-detection
• 16:54
  levels
• 16:54
  across
• 16:55
  four
• 16:55
  settings;
• 16:55
  continuous
• 16:56
  suppression
• 16:56
  degrades
• 16:57
  benign
• 16:57
  performance.
• 16:59
  Limitations,
• 17:00
  stated
• 17:00
  rather
• 17:00
  than
• 17:00
  buried:
• 17:01
  SmolVLA
• 17:02
  gains
• 17:03
  are
• 17:03
  modest
• 17:03
  with
• 17:03
  benign-performance
• 17:04
  cost,
• 17:05
  and
• 17:05
  under
• 17:05
  persistent
• 17:06
  attack
• 17:06
  nothing
• 17:06
  helps
• 17:06
  —
• 17:07
  "Even
• 17:08
  with
• 17:08
  oracle
• 17:08
  detection,
• 17:09
  suppressing
• 17:09
  the
• 17:10
  selected
• 17:10
  feature
• 17:10
  does
• 17:10
  not
• 17:11
  recover
• 17:11
  SR
• 17:12
  under
• 17:12
  persistent
• 17:12
  attacks."
• 17:13
  Testing
• 17:14
  on
• 17:14
  unseen
• 17:14
  attacks
• 17:15
  and
• 17:15
  physical
• 17:15
  robots
• 17:16
  would
• 17:16
  settle
• 17:16
  generalization.
• 17:20
  WorldTUI
• 17:21
  asks
• 17:22
  a
• 17:22
  strange
• 17:22
  question
• 17:23
  with
• 17:23
  a
• 17:23
  360M-parameter
• 17:25
  fine-tune
• 17:25
  of
• 17:25
  Qwen2.5-Coder:
• 17:29
  can
• 17:29
  a
• 17:29
  model
• 17:29
  with
• 17:30
  no
• 17:30
  shell
• 17:30
  and
• 17:30
  no
• 17:30
  filesystem
• 17:31
  pretend
• 17:31
  to
• 17:31
  be
• 17:32
  a
• 17:32
  terminal?
• 17:33
  Keystrokes
• 17:33
  go
• 17:33
  in;
• 17:34
  predicted
• 17:34
  screen
• 17:35
  updates
• 17:35
  come
• 17:35
  out.
• 17:36
  Training
• 17:36
  data:
• 17:37
  336k
• 17:39
  episodes,
• 17:39
  two
• 17:39
  billion
• 17:40
  tokens,
• 17:40
  of
• 17:40
  real
• 17:41
  Docker
• 17:41
  sessions
• 17:42
  with
• 17:42
  randomized
• 17:42
  hostnames,
• 17:43
  prompts,
• 17:44
  terminal
• 17:44
  sizes
• 17:45
  and
• 17:45
  personas,
• 17:46
  a
• 17:46
  1.2%
• 17:47
  typo
• 17:47
  rate,
• 17:47
  and
• 17:48
  35%
• 17:49
  starting
• 17:49
  mid-application.
• 17:50
  The
• 17:51
  terminal
• 17:51
  is
• 17:51
  a
• 17:51
  character
• 17:52
  grid
• 17:52
  over
• 17:52
  a
• 17:52
  333-token
• 17:53
  vocabulary
• 17:54
  —
• 17:55
  256
• 17:56
  byte
• 17:57
  tokens,
• 17:57
  64
• 17:58
  row
• 17:58
  tokens,
• 17:59
  a
• 17:59
  COPY
• 17:59
  op
• 17:59
  encoding
• 18:00
  a
• 18:00
  scrolled
• 18:00
  row
• 18:00
  in
• 18:01
  three
• 18:01
  tokens
• 18:01
  instead
• 18:02
  of
• 18:02
  ~96,
• 18:03
  and
• 18:03
  a
• 18:03
  WAIT
• 18:03
  token
• 18:04
  for
• 18:04
  time,
• 18:05
  which
• 18:05
  is
• 18:05
  how
• 18:05
  snake
• 18:05
  moves
• 18:06
  unprompted
• 18:06
  —
• 18:07
  with
• 18:07
  grammar-constrained
• 18:08
  decoding
• 18:08
  guaranteeing
• 18:09
  valid
• 18:09
  updates.
• 18:10
  Compounding
• 18:11
  drift
• 18:11
  was
• 18:11
  the
• 18:11
  failure
• 18:12
  mode;
• 18:12
  the
• 18:12
  fix
• 18:13
  is
• 18:13
  a
• 18:13
  DAgger-style
• 18:13
  loop
• 18:14
  where
• 18:14
  the
• 18:14
  model
• 18:14
  predicts,
• 18:15
  the
• 18:15
  real
• 18:15
  screen
• 18:16
  is
• 18:16
  compared,
• 18:17
  and
• 18:17
  training
• 18:17
  uses
• 18:17
  the
• 18:18
  corrections
• 18:18
  —
• 18:19
  but
• 18:19
  only
• 18:19
  when
• 18:19
  the
• 18:19
  model
• 18:20
  could
• 18:20
  infer
• 18:20
  the
• 18:20
  fix,
• 18:21
  else
• 18:21
  "training
• 18:22
  on
• 18:22
  those
• 18:22
  examples
• 18:23
  would
• 18:23
  actually
• 18:23
  reward
• 18:24
  hallucinations."
• 18:25
  PresetBench
• 18:26
  rose
• 18:26
  from
• 18:26
  24/47
• 18:28
  to
• 18:28
  38/47.
• 18:30
  Full-screen
• 18:30
  redraws
• 18:31
  looked
• 18:31
  hopeless
• 18:32
  at
• 18:32
  ~3,000
• 18:33
  tokens
• 18:33
  a
• 18:33
  frame
• 18:33
  until
• 18:34
  rows
• 18:34
  were
• 18:34
  decoded
• 18:34
  in
• 18:35
  parallel,
• 18:35
  cutting
• 18:36
  large-frame
• 18:36
  p95
• 18:37
  latency
• 18:37
  from
• 18:38
  6.7s
• 18:38
  to
• 18:39
  0.87s.
• 18:40
  A
• 18:41
  32-world
• 18:41
  memory
• 18:42
  test
• 18:42
  scored
• 18:42
  9/13
• 18:43
  against
• 18:43
  2/13
• 18:44
  and
• 18:44
  3/13
• 18:45
  for
• 18:45
  prompted
• 18:45
  larger
• 18:46
  models,
• 18:46
  and
• 18:46
  distillation
• 18:47
  found
• 18:47
  the
• 18:47
  load-bearing
• 18:48
  layer:
• 18:48
  removing
• 18:49
  layer
• 18:49
  7
• 18:50
  barely
• 18:50
  moved
• 18:50
  next-token
• 18:51
  accuracy
• 18:51
  (99.3%→98.9%)
• 18:55
  while
• 18:55
  memory
• 18:55
  readbacks
• 18:56
  collapsed
• 18:56
  64/64→0/64.
• 18:59
  Training
• 19:00
  cost
• 19:00
  ~75
• 19:01
  GPU-hours
• 19:02
  on
• 19:02
  one
• 19:02
  RTX
• 19:03
  4090;
• 19:04
  the
• 19:04
  browser
• 19:05
  demo
• 19:05
  runs
• 19:05
  a
• 19:05
  208MB
• 19:07
  int4
• 19:08
  model
• 19:08
  locally
• 19:09
  on
• 19:09
  a
• 19:09
  JavaScript
• 19:10
  Qwen
• 19:10
  decoder
• 19:10
  with
• 19:10
  WebGPU
• 19:11
  shaders.
• 19:12
  The
• 19:12
  verdict:
• 19:13
  "Is
• 19:13
  it
• 19:13
  useful?
• 19:14
  Not
• 19:14
  really."
• 19:15
  The
• 19:15
  same
• 19:16
  amateur-scale
• 19:16
  energy
• 19:17
  reached
• 19:17
  voice.
• 19:17
  A
• 19:18
  self-described
• 19:18
  "run
• 19:19
  of
• 19:19
  the
• 19:19
  mill
• 19:19
  web-dev
• 19:20
  guy"
• 19:20
  distilled
• 19:20
  Kokoro
• 19:21
  —
• 19:22
  the
• 19:22
  82M-parameter
• 19:23
  TTS
• 19:24
  model
• 19:24
  that
• 19:24
  keeps
• 19:25
  turning
• 19:25
  up
• 19:25
  in
• 19:25
  local
• 19:25
  voice
• 19:26
  stacks
• 19:26
  —
• 19:27
  to
• 19:27
  run
• 19:27
  50-100x
• 19:28
  faster,
• 19:29
  training
• 19:30
  a
• 19:30
  day
• 19:30
  on
• 19:30
  a
• 19:30
  basement
• 19:31
  4070
• 19:32
  Ti
• 19:32
  Super
• 19:33
  with
• 19:33
  Claude
• 19:33
  Opus
• 19:34
  5.5
• 19:35
  hill-climbing
• 19:35
  a
• 19:35
  clear
• 19:35
  metric.
• 19:37
  The
• 19:37
  framing
• 19:37
  is
• 19:37
  the
• 19:37
  story:
• 19:38
  "here's
• 19:38
  something
• 19:39
  I
• 19:39
  don't
• 19:39
  even
• 19:39
  have
• 19:39
  a
• 19:39
  clue
• 19:40
  how
• 19:40
  it
• 19:40
  exactly
• 19:40
  works,"
• 19:41
  and,
• 19:42
  "I
• 19:42
  know
• 19:42
  it's
• 19:42
  Opus
• 19:42
  slop,
• 19:43
  but
• 19:43
  still
• 19:43
  really
• 19:44
  cool."
• 19:44
  The
• 19:45
  numbers
• 19:45
  are
• 19:45
  self-reported,
• 19:46
  the
• 19:46
  pattern
• 19:47
  not
• 19:47
  isolated
• 19:47
  —
• 19:48
  a
• 19:48
  top
• 19:48
  comment
• 19:49
  describes
• 19:49
  Claude
• 19:49
  optimizing
• 19:50
  an
• 19:50
  sglang
• 19:50
  stack
• 19:51
  on
• 19:51
  dual
• 19:51
  7900XTXs,
• 19:55
  decode
• 19:56
  at
• 19:56
  100k
• 19:56
  context
• 19:57
  from
• 19:57
  8
• 19:57
  to
• 19:57
  60-100
• 19:59
  tok/s,
• 20:01
  GEMMs
• 20:02
  ~10%
• 20:03
  faster
• 20:03
  than
• 20:03
  ported
• 20:04
  ones.
• 20:06
  A
• 20:06
  widely
• 20:07
  shared
• 20:07
  walkthrough
• 20:08
  of
• 20:08
  Anthropic's
• 20:08
  rebuilt
• 20:09
  Claude
• 20:09
  Code
• 20:09
  desktop
• 20:10
  app
• 20:10
  argues
• 20:10
  it
• 20:11
  is
• 20:11
  "really
• 20:11
  not
• 20:11
  only
• 20:11
  for
• 20:12
  coders"
• 20:12
  —
• 20:12
  same
• 20:13
  tool
• 20:13
  underneath,
• 20:13
  with
• 20:14
  access
• 20:14
  to
• 20:14
  any
• 20:14
  file
• 20:15
  and
• 20:15
  to
• 20:15
  CLIs.
• 20:16
  The
• 20:16
  redesign
• 20:17
  that
• 20:17
  matters
• 20:17
  is
• 20:17
  projects,
• 20:18
  which
• 20:18
  Anthropic
• 20:19
  has
• 20:19
  framed
• 20:19
  as
• 20:19
  a
• 20:20
  move
• 20:20
  from
• 20:20
  folder
• 20:20
  to
• 20:20
  conversation:
• 20:22
  a
• 20:22
  coordinator
• 20:22
  chat
• 20:23
  spins
• 20:23
  up
• 20:23
  threads
• 20:24
  for
• 20:24
  subtasks,
• 20:25
  each
• 20:25
  iterable
• 20:25
  without
• 20:26
  overloading
• 20:26
  the
• 20:26
  coordinator's
• 20:27
  context,
• 20:28
  sharing
• 20:28
  memory,
• 20:29
  threads
• 20:29
  runnable
• 20:30
  in
• 20:30
  the
• 20:30
  cloud
• 20:30
  while
• 20:31
  the
• 20:31
  laptop
• 20:31
  is
• 20:31
  closed;
• 20:32
  nested
• 20:32
  sessions
• 20:33
  are
• 20:33
  the
• 20:33
  local
• 20:33
  variant.
• 20:34
  Around
• 20:35
  them:
• 20:35
  in-chat
• 20:36
  to-do
• 20:36
  lists
• 20:36
  that
• 20:36
  tick
• 20:37
  off,
• 20:37
  context
• 20:38
  cards
• 20:38
  with
• 20:38
  a
• 20:38
  compact
• 20:39
  button
• 20:39
  at
• 20:39
  token
• 20:39
  thresholds,
• 20:40
  side
• 20:41
  chats
• 20:41
  that
• 20:41
  can
• 20:41
  read
• 20:42
  and
• 20:42
  message
• 20:42
  the
• 20:42
  main
• 20:42
  conversation,
• 20:44
  and
• 20:44
  artifact
• 20:44
  tools
• 20:45
  like
• 20:45
  Motion,
• 20:46
  animated
• 20:46
  video
• 20:46
  purely
• 20:47
  in
• 20:47
  code
• 20:47
  —
• 20:48
  "far
• 20:49
  cheaper
• 20:49
  than
• 20:49
  a
• 20:49
  video
• 20:49
  model."
• 20:50
  The
• 20:50
  slash
• 20:50
  commands
• 20:51
  carry
• 20:51
  the
• 20:51
  wins:
• 20:52
  /doctor
• 20:52
  audited
• 20:53
  404
• 20:54
  of
• 20:54
  the
• 20:54
  presenter's
• 20:54
  files
• 20:55
  and
• 20:55
  found
• 20:55
  312
• 20:56
  problems
• 20:56
  —
• 20:58
  instructions
• 20:58
  for
• 20:59
  older
• 20:59
  models
• 20:59
  wasting
• 21:00
  tokens;
• 21:01
  /skill-doctor
• 21:02
  flagged
• 21:02
  never-used
• 21:03
  skills
• 21:03
  and
• 21:03
  "saved
• 21:04
  me
• 21:04
  about
• 21:04
  20,000
• 21:05
  tokens";
• 21:06
  /advisor
• 21:07
  lets
• 21:07
  a
• 21:07
  cheap
• 21:07
  model
• 21:08
  consult
• 21:08
  the
• 21:08
  expensive
• 21:09
  one
• 21:09
  at
• 21:09
  critical
• 21:09
  moments.
• 21:11
  The
• 21:11
  self-hosted
• 21:11
  counterweight
• 21:12
  is
• 21:12
  humux:
• 21:13
  one
• 21:13
  Docker
• 21:14
  container,
• 21:14
  MIT-licensed,
• 21:16
  no
• 21:16
  telemetry,
• 21:17
  air-gappable,
• 21:18
  running
• 21:18
  a
• 21:18
  squad
• 21:18
  —
• 21:19
  lead,
• 21:20
  developer,
• 21:21
  researcher,
• 21:22
  marketer,
• 21:22
  QA
• 21:22
  —
• 21:24
  coordinating
• 21:24
  through
• 21:24
  GitHub
• 21:25
  issues,
• 21:25
  each
• 21:25
  agent
• 21:26
  its
• 21:26
  own
• 21:26
  GitHub
• 21:26
  App
• 21:27
  with
• 21:27
  name
• 21:27
  and
• 21:27
  avatar,
• 21:28
  escalating
• 21:29
  only
• 21:29
  what
• 21:29
  a
• 21:29
  human
• 21:29
  labels.
• 21:31
  Each
• 21:31
  agent
• 21:31
  gets
• 21:31
  its
• 21:32
  own
• 21:32
  model,
• 21:32
  voice,
• 21:33
  Telegram
• 21:33
  bot,
• 21:34
  and
• 21:34
  memory;
• 21:35
  the
• 21:35
  foundation
• 21:35
  is
• 21:35
  boring
• 21:36
  on
• 21:36
  purpose:
• 21:36
  Himalaya
• 21:37
  for
• 21:37
  IMAP,
• 21:38
  CalDAV
• 21:38
  for
• 21:39
  calendars,
• 21:39
  Playwright
• 21:40
  for
• 21:40
  browsing,
• 21:41
  faster-whisper
• 21:41
  and
• 21:42
  Kokoro
• 21:42
  82M
• 21:43
  for
• 21:43
  voice,
• 21:44
  SQLite
• 21:44
  for
• 21:44
  storage
• 21:45
  —
• 21:45
  "no
• 21:46
  external
• 21:46
  databases,
• 21:47
  no
• 21:47
  Kubernetes,
• 21:48
  no
• 21:48
  account
• 21:48
  to
• 21:48
  sign
• 21:48
  up
• 21:49
  for."
• 21:49
  Credentials
• 21:50
  stay
• 21:50
  out
• 21:50
  of
• 21:50
  model
• 21:51
  context
• 21:51
  behind
• 21:51
  two-tier
• 21:52
  encryption;
• 21:53
  skills
• 21:53
  are
• 21:53
  taught
• 21:53
  by
• 21:53
  writing
• 21:54
  markdown
• 21:54
  files.
• 21:55
  And
• 21:55
  for
• 21:55
  the
• 21:56
  unglamorous
• 21:56
  middle
• 21:56
  of
• 21:56
  developer
• 21:57
  work,
• 21:57
  JSON
• 21:58
  Crack
• 21:58
  keeps
• 21:58
  doing
• 21:58
  what
• 21:59
  it
• 21:59
  has
• 21:59
  since
• 21:59
  2022:
• 22:00
  turning
• 22:01
  JSON,
• 22:01
  YAML,
• 22:02
  CSV,
• 22:03
  and
• 22:03
  XML
• 22:03
  into
• 22:04
  interactive
• 22:04
  graphs,
• 22:05
  generating
• 22:05
  TypeScript
• 22:06
  interfaces,
• 22:06
  Go
• 22:07
  structs,
• 22:07
  and
• 22:08
  Rust
• 22:08
  serde
• 22:08
  types,
• 22:09
  running
• 22:09
  jq
• 22:09
  —
• 22:10
  all
• 22:10
  locally,
• 22:11
  nothing
• 22:11
  stored
• 22:12
  on
• 22:12
  any
• 22:12
  server.