Latest / AGI Dreams – Open, Uncensored, & Local - AI News Digest / AGI Dreams Podcast – February 18, 2026

Transcript

AGI Dreams Podcast – February 18, 2026 · AGI Dreams – Open, Uncensored, & Local - AI News Digest

• 0:00
  AI
• 0:00
  browser
• 0:00
  agents
• 0:01
  read
• 0:01
  a
• 0:01
  different
• 0:01
  internet
• 0:01
  than
• 0:02
  humans
• 0:02
  do.
• 0:03
  That
• 0:03
  claim,
• 0:03
  from
• 0:04
  security
• 0:04
  researcher
• 0:05
  Mihalis
• 0:05
  Haatainen
• 0:05
  of
• 0:05
  Bountyy
• 0:06
  Oy,
• 0:06
  now
• 0:06
  comes
• 0:07
  with
• 0:07
  seven
• 0:07
  working
• 0:07
  proof-of-concept
• 0:08
  exploits
• 0:09
  to
• 0:09
  back
• 0:09
  it
• 0:09
  up.
• 0:10
  GhostCSS
• 0:10
  demonstrates
• 0:11
  that
• 0:11
  the
• 0:12
  `.sr-only`
• 0:12
  CSS
• 0:13
  pattern
• 0:13
  —
• 0:13
  a
• 0:13
  standard
• 0:14
  accessibility
• 0:14
  class
• 0:15
  shipped
• 0:15
  by
• 0:15
  Bootstrap,
• 0:15
  Tailwind,
• 0:16
  and
• 0:16
  every
• 0:16
  major
• 0:17
  CSS
• 0:17
  framework
• 0:17
  —
• 0:18
  is
• 0:18
  a
• 0:18
  near-perfect
• 0:19
  delivery
• 0:19
  vehicle
• 0:20
  for
• 0:20
  prompt
• 0:20
  injection
• 0:20
  against
• 0:21
  AI
• 0:21
  browser
• 0:21
  agents.
• 0:23
  The
• 0:23
  attack
• 0:23
  is
• 0:23
  embarrassingly
• 0:23
  elegant:
• 0:24
  embed
• 0:25
  instructions
• 0:25
  inside
• 0:25
  screen-reader-only
• 0:26
  spans
• 0:26
  on
• 0:26
  a
• 0:26
  normal
• 0:27
  blog
• 0:27
  post.
• 0:27
  The
• 0:28
  AI
• 0:28
  parses
• 0:28
  the
• 0:28
  DOM
• 0:29
  and
• 0:29
  accessibility
• 0:29
  tree,
• 0:30
  reads
• 0:30
  the
• 0:30
  hidden
• 0:30
  payload
• 0:31
  as
• 0:31
  regular
• 0:31
  page
• 0:31
  content,
• 0:32
  and
• 0:32
  follows
• 0:32
  it.
• 0:32
  In
• 0:33
  testing,
• 0:33
  browser-use
• 0:34
  with
• 0:34
  Llama
• 0:34
  3.3
• 0:35
  70B
• 0:35
  navigated
• 0:36
  to
• 0:36
  a
• 0:36
  blog,
• 0:36
  read
• 0:37
  the
• 0:37
  hidden
• 0:37
  exfiltration
• 0:37
  instruction,
• 0:38
  visited
• 0:38
  the
• 0:38
  attacker's
• 0:39
  endpoint,
• 0:39
  returned,
• 0:39
  and
• 0:40
  gave
• 0:40
  the
• 0:40
  user
• 0:40
  a
• 0:40
  clean
• 0:40
  summary
• 0:40
  —
• 0:41
  never
• 0:41
  mentioning
• 0:41
  what
• 0:42
  it
• 0:42
  actually
• 0:42
  did.
• 0:42
  No
• 0:43
  XSS.
• 0:44
  No
• 0:44
  JavaScript.
• 0:45
  No
• 0:45
  exploit
• 0:45
  code.
• 0:46
  Just
• 0:46
  CSS
• 0:46
  that
• 0:47
  every
• 0:47
  sanitizer
• 0:48
  in
• 0:48
  existence
• 0:48
  considers
• 0:49
  safe.
• 0:49
  The
• 0:49
  scariest
• 0:50
  part
• 0:50
  is
• 0:50
  the
• 0:50
  breadth
• 0:51
  of
• 0:51
  the
• 0:51
  attack
• 0:51
  surface.
• 0:52
  CSS
• 0:52
  `content`
• 0:53
  properties,
• 0:53
  custom
• 0:54
  properties,
• 0:54
  counters,
• 0:54
  `::before`/`::after`
• 0:56
  pseudo-elements,
• 0:57
  animation
• 0:57
  keyframes
• 0:57
  —
• 0:58
  none
• 0:58
  of
• 0:58
  these
• 0:59
  exist
• 0:59
  in
• 0:59
  the
• 0:59
  HTML
• 1:00
  source.
• 1:00
  They
• 1:00
  are
• 1:00
  generated
• 1:01
  at
• 1:01
  render
• 1:01
  time.
• 1:02
  But
• 1:02
  agents
• 1:02
  read
• 1:02
  them
• 1:03
  from
• 1:03
  the
• 1:03
  DOM.
• 1:04
  Of
• 1:04
  the
• 1:04
  seven
• 1:04
  attack
• 1:05
  variants
• 1:05
  GhostCSS
• 1:06
  demonstrates,
• 1:06
  the
• 1:07
  `.sr-only`
• 1:07
  injection
• 1:08
  is
• 1:08
  the
• 1:08
  most
• 1:08
  dangerous
• 1:09
  precisely
• 1:09
  because
• 1:09
  it
• 1:10
  is
• 1:10
  indistinguishable
• 1:10
  from
• 1:11
  legitimate
• 1:11
  accessibility
• 1:11
  markup.
• 1:12
  No
• 1:12
  WAF
• 1:13
  catches
• 1:13
  it.
• 1:14
  No
• 1:14
  HTML
• 1:14
  sanitizer
• 1:15
  strips
• 1:15
  it.
• 1:16
  Defenses
• 1:16
  exist
• 1:16
  —
• 1:17
  render-aware
• 1:18
  extraction
• 1:18
  that
• 1:18
  diffs
• 1:18
  DOM
• 1:19
  versus
• 1:19
  pixels,
• 1:20
  CSS
• 1:20
  property
• 1:21
  filtering
• 1:21
  before
• 1:22
  LLM
• 1:22
  ingestion,
• 1:23
  dual-pass
• 1:23
  verification
• 1:24
  with
• 1:24
  screenshot
• 1:25
  OCR
• 1:25
  —
• 1:26
  but
• 1:26
  nobody
• 1:26
  ships
• 1:26
  them
• 1:26
  yet.
• 1:27
  The
• 1:27
  same
• 1:28
  researcher
• 1:28
  also
• 1:28
  built
• 1:28
  MCP
• 1:29
  Parasite,
• 1:29
  and
• 1:30
  it
• 1:30
  makes
• 1:30
  GhostCSS
• 1:30
  look
• 1:31
  polite.
• 1:32
  Disguised
• 1:32
  as
• 1:32
  "ProjectMemory,"
• 1:33
  a
• 1:33
  genuinely
• 1:34
  useful
• 1:34
  project
• 1:34
  memory
• 1:35
  and
• 1:35
  context
• 1:35
  tool
• 1:35
  for
• 1:36
  MCP-enabled
• 1:36
  AI
• 1:37
  agents,
• 1:37
  it
• 1:37
  indexes
• 1:38
  your
• 1:38
  codebase,
• 1:39
  remembers
• 1:39
  architecture
• 1:40
  decisions
• 1:40
  across
• 1:41
  sessions,
• 1:41
  and
• 1:42
  works
• 1:42
  perfectly
• 1:42
  for
• 1:42
  days.
• 1:43
  The
• 1:43
  reconnaissance
• 1:44
  phase
• 1:44
  silently
• 1:44
  profiles
• 1:45
  your
• 1:45
  entire
• 1:45
  environment
• 1:46
  —
• 1:46
  every
• 1:47
  tool
• 1:47
  call,
• 1:47
  every
• 1:48
  repo,
• 1:48
  every
• 1:48
  credential
• 1:49
  file,
• 1:49
  your
• 1:50
  deploy
• 1:50
  schedule,
• 1:51
  your
• 1:51
  team
• 1:51
  members,
• 1:52
  which
• 1:52
  other
• 1:52
  MCP
• 1:52
  servers
• 1:53
  you
• 1:53
  have
• 1:53
  installed.
• 1:54
  Then
• 1:54
  it
• 1:54
  goes
• 1:54
  dormant.
• 1:55
  `mcp-scan`
• 1:56
  finds
• 1:56
  nothing.
• 1:57
  Tool
• 1:57
  descriptions
• 1:57
  are
• 1:58
  clean.
• 1:58
  There
• 1:58
  is
• 1:59
  no
• 1:59
  malicious
• 1:59
  metadata
• 2:00
  to
• 2:00
  detect.
• 2:01
  When
• 2:01
  you
• 2:01
  deploy
• 2:01
  to
• 2:02
  production,
• 2:02
  the
• 2:03
  parasite
• 2:03
  responds
• 2:03
  with
• 2:04
  your
• 2:04
  deploy
• 2:04
  checklist
• 2:05
  plus
• 2:05
  one
• 2:05
  extra
• 2:06
  line
• 2:06
  —
• 2:06
  a
• 2:06
  "project
• 2:07
  convention"
• 2:08
  it
• 2:08
  "remembered."
• 2:09
  Your
• 2:09
  AI
• 2:09
  reads
• 2:10
  it,
• 2:10
  follows
• 2:10
  it,
• 2:11
  and
• 2:11
  uses
• 2:11
  your
• 2:11
  own
• 2:12
  GitHub
• 2:12
  MCP
• 2:13
  to
• 2:13
  create
• 2:13
  an
• 2:13
  issue
• 2:14
  containing
• 2:14
  your
• 2:14
  `.env`
• 2:15
  file.
• 2:16
  The
• 2:16
  worm
• 2:16
  never
• 2:17
  touched
• 2:17
  GitHub.
• 2:18
  Your
• 2:18
  AI
• 2:19
  did.
• 2:19
  Cross-server
• 2:20
  shadowing,
• 2:21
  temporal,
• 2:21
  adaptive,
• 2:22
  stateful.
• 2:23
  The
• 2:23
  trust
• 2:24
  chain
• 2:24
  problem
• 2:24
  is
• 2:24
  not
• 2:25
  theoretical.
• 2:26
  Wiz
• 2:26
  Research
• 2:27
  discovered
• 2:27
  that
• 2:27
  Moltbook
• 2:28
  —
• 2:29
  the
• 2:29
  viral
• 2:29
  "AI-only"
• 2:30
  social
• 2:30
  network
• 2:31
  —
• 2:31
  had
• 2:31
  a
• 2:31
  misconfigured
• 2:32
  Supabase
• 2:33
  database
• 2:33
  granting
• 2:34
  full
• 2:34
  read
• 2:34
  and
• 2:34
  write
• 2:34
  access
• 2:35
  to
• 2:35
  all
• 2:35
  platform
• 2:36
  data:
• 2:36
  1.5
• 2:37
  million
• 2:38
  agent
• 2:38
  authentication
• 2:39
  keys,
• 2:39
  private
• 2:39
  agent-to-agent
• 2:40
  DMs
• 2:40
  (some
• 2:41
  containing
• 2:41
  plaintext
• 2:42
  OpenAI
• 2:42
  API
• 2:43
  keys),
• 2:43
  and
• 2:44
  the
• 2:44
  ability
• 2:44
  to
• 2:44
  modify
• 2:45
  any
• 2:45
  post.
• 2:46
  The
• 2:46
  data
• 2:47
  revealed
• 2:47
  1.5M
• 2:48
  "AI
• 2:49
  agents"
• 2:49
  were
• 2:50
  controlled
• 2:50
  by
• 2:50
  just
• 2:50
  17K
• 2:51
  human
• 2:51
  accounts
• 2:52
  —
• 2:53
  an
• 2:53
  88:1
• 2:53
  ratio
• 2:54
  —
• 2:55
  with
• 2:55
  zero
• 2:55
  verification
• 2:56
  that
• 2:56
  agents
• 2:56
  were
• 2:57
  actually
• 2:57
  AI.
• 2:58
  One
• 2:59
  missing
• 2:59
  Row
• 2:59
  Level
• 2:59
  Security
• 3:00
  toggle
• 3:00
  exposed
• 3:01
  everything.
• 3:02
  The
• 3:02
  Moltbook
• 3:02
  team
• 3:03
  patched
• 3:03
  it
• 3:03
  within
• 3:03
  three
• 3:04
  hours,
• 3:04
  but
• 3:05
  the
• 3:05
  incident
• 3:05
  is
• 3:05
  a
• 3:05
  case
• 3:05
  study
• 3:06
  in
• 3:06
  what
• 3:06
  happens
• 3:06
  when
• 3:07
  "vibe
• 3:07
  coding"
• 3:07
  meets
• 3:07
  static
• 3:08
  credentials
• 3:08
  at
• 3:09
  agent
• 3:09
  scale.
• 3:10
  As
• 3:10
  one
• 3:11
  commenter
• 3:11
  noted,
• 3:12
  the
• 3:12
  traditional
• 3:12
  access
• 3:13
  control
• 3:13
  model
• 3:13
  of
• 3:13
  periodic
• 3:14
  credential
• 3:14
  rotation
• 3:15
  and
• 3:15
  manual
• 3:16
  access
• 3:16
  reviews
• 3:16
  simply
• 3:17
  cannot
• 3:17
  keep
• 3:17
  pace
• 3:18
  with
• 3:18
  agents
• 3:18
  that
• 3:18
  spawn
• 3:19
  dynamically,
• 3:20
  discover
• 3:20
  credentials
• 3:21
  programmatically,
• 3:22
  and
• 3:22
  operate
• 3:23
  at
• 3:23
  machine
• 3:23
  speed.
• 3:28
  The
• 3:29
  security
• 3:29
  community's
• 3:29
  response
• 3:30
  to
• 3:30
  agentic
• 3:30
  risk
• 3:31
  is
• 3:31
  bifurcating
• 3:31
  into
• 3:32
  two
• 3:32
  camps:
• 3:32
  those
• 3:33
  building
• 3:33
  application-layer
• 3:34
  defenses
• 3:34
  and
• 3:35
  those
• 3:35
  arguing
• 3:35
  that
• 3:35
  only
• 3:36
  kernel-level
• 3:36
  enforcement
• 3:37
  will
• 3:37
  do.
• 3:38
  A
• 3:38
  developer
• 3:38
  going
• 3:38
  by
• 3:38
  WayneCider
• 3:39
  built
• 3:39
  YOPJ
• 3:40
  (Your
• 3:40
  Own
• 3:40
  Personal
• 3:40
  Jean-Luc)
• 3:41
  —
• 3:41
  a
• 3:41
  portable,
• 3:42
  local
• 3:42
  AI
• 3:43
  coding
• 3:43
  agent
• 3:43
  running
• 3:44
  Codestral
• 3:44
  22B
• 3:45
  via
• 3:45
  llama-server
• 3:45
  —
• 3:46
  and
• 3:46
  wrapped
• 3:46
  it
• 3:46
  in
• 3:46
  an
• 3:47
  8-layer
• 3:47
  security
• 3:47
  sandbox:
• 3:48
  command
• 3:48
  allowlist
• 3:49
  plus
• 3:49
  blocklist,
• 3:50
  strict
• 3:50
  path
• 3:51
  confinement
• 3:51
  with
• 3:51
  symlink
• 3:52
  resolution,
• 3:53
  prompt
• 3:53
  injection
• 3:53
  sanitization
• 3:54
  on
• 3:54
  tool
• 3:54
  results,
• 3:55
  network
• 3:55
  egress
• 3:56
  blocking,
• 3:56
  protected
• 3:57
  paths,
• 3:57
  output
• 3:58
  size
• 3:58
  limits,
• 3:58
  and
• 3:59
  audit
• 3:59
  logging.
• 4:00
  Then
• 4:00
  he
• 4:00
  handed
• 4:00
  the
• 4:00
  full
• 4:01
  source
• 4:01
  code
• 4:01
  to
• 4:01
  ChatGPT
• 4:02
  and
• 4:02
  said
• 4:02
  "break
• 4:03
  it."
• 4:03
  240+
• 4:04
  adversarial
• 4:05
  tests
• 4:05
  across
• 4:05
  nine
• 4:06
  attack
• 4:06
  vectors
• 4:06
  —
• 4:07
  prompt
• 4:07
  injection,
• 4:08
  sandbox
• 4:08
  escape,
• 4:09
  command
• 4:09
  injection,
• 4:10
  social
• 4:10
  engineering,
• 4:11
  regex
• 4:12
  bypass,
• 4:12
  memory
• 4:13
  poisoning,
• 4:13
  context
• 4:14
  window
• 4:14
  attacks
• 4:14
  —
• 4:15
  are
• 4:15
  published
• 4:15
  in
• 4:15
  the
• 4:15
  repo
• 4:16
  as
• 4:16
  a
• 4:16
  knowledge
• 4:16
  library
• 4:17
  that
• 4:17
  the
• 4:17
  agent
• 4:17
  itself
• 4:18
  can
• 4:18
  reference
• 4:18
  to
• 4:18
  recognize
• 4:19
  attack
• 4:19
  patterns.
• 4:20
  The
• 4:20
  top
• 4:20
  comment
• 4:21
  on
• 4:21
  that
• 4:21
  post
• 4:21
  pointed
• 4:22
  out
• 4:22
  the
• 4:22
  fundamental
• 4:22
  limitation:
• 4:23
  all
• 4:23
  those
• 4:24
  controls
• 4:24
  live
• 4:24
  at
• 4:24
  the
• 4:24
  application
• 4:25
  layer,
• 4:26
  and
• 4:26
  the
• 4:26
  Python
• 4:26
  process
• 4:27
  is
• 4:27
  the
• 4:27
  enforcement
• 4:27
  boundary.
• 4:28
  If
• 4:29
  the
• 4:29
  model
• 4:29
  finds
• 4:29
  a
• 4:29
  sanitizer
• 4:30
  bypass
• 4:30
  or
• 4:31
  there
• 4:31
  is
• 4:31
  a
• 4:31
  bug
• 4:31
  in
• 4:31
  path
• 4:31
  confinement,
• 4:32
  the
• 4:32
  shell
• 4:33
  and
• 4:33
  filesystem
• 4:33
  are
• 4:34
  wide
• 4:34
  open.
• 4:35
  That
• 4:35
  commenter
• 4:35
  was
• 4:35
  from
• 4:35
  nono,
• 4:36
  an
• 4:36
  open-source
• 4:37
  tool
• 4:37
  that
• 4:37
  takes
• 4:37
  the
• 4:37
  opposite
• 4:38
  approach
• 4:38
  —
• 4:39
  kernel-level
• 4:39
  enforcement
• 4:40
  using
• 4:40
  Landlock
• 4:40
  (Linux)
• 4:41
  and
• 4:41
  Seatbelt
• 4:41
  (macOS).
• 4:42
  Once
• 4:43
  applied,
• 4:43
  restrictions
• 4:44
  are
• 4:44
  irreversible
• 4:45
  for
• 4:45
  the
• 4:45
  process.
• 4:46
  There
• 4:46
  is
• 4:46
  no
• 4:47
  API
• 4:47
  to
• 4:47
  widen
• 4:47
  them.
• 4:48
  Not
• 4:48
  even
• 4:49
  nono
• 4:49
  itself
• 4:49
  can
• 4:49
  remove
• 4:50
  them.
• 4:50
  Claude
• 4:51
  Code
• 4:51
  now
• 4:51
  ships
• 4:51
  with
• 4:51
  a
• 4:51
  built-in
• 4:52
  sandbox
• 4:52
  mode,
• 4:53
  which
• 4:53
  is
• 4:53
  a
• 4:53
  meaningful
• 4:54
  step,
• 4:54
  but
• 4:54
  it
• 4:55
  includes
• 4:55
  `dangerouslyDisableSandbox`
• 4:56
  —
• 4:57
  an
• 4:57
  escape
• 4:57
  hatch
• 4:58
  that
• 4:58
  lets
• 4:58
  the
• 4:58
  agent
• 4:59
  retry
• 4:59
  commands
• 4:59
  outside
• 5:00
  the
• 5:00
  sandbox.
• 5:01
  Nono
• 5:01
  eliminates
• 5:01
  that
• 5:02
  possibility
• 5:02
  structurally.
• 5:03
  Install
• 5:03
  via
• 5:04
  Homebrew,
• 5:04
  wrap
• 5:05
  your
• 5:05
  Claude
• 5:05
  Code
• 5:05
  session,
• 5:06
  done:
• 5:06
  `nono
• 5:07
  run
• 5:08
  --allow-cwd
• 5:08
  --profile
• 5:09
  claude-code
• 5:09
  --
• 5:10
  claude`.
• 5:11
  On
• 5:11
  the
• 5:11
  infrastructure
• 5:11
  side,
• 5:12
  Sandstorm
• 5:13
  takes
• 5:13
  a
• 5:13
  different
• 5:13
  but
• 5:13
  complementary
• 5:14
  approach:
• 5:15
  instead
• 5:15
  of
• 5:15
  hardening
• 5:16
  local
• 5:16
  execution,
• 5:17
  it
• 5:17
  runs
• 5:17
  agents
• 5:18
  in
• 5:18
  disposable
• 5:19
  cloud
• 5:19
  VMs.
• 5:20
  Built
• 5:20
  on
• 5:20
  the
• 5:20
  Claude
• 5:20
  Agent
• 5:21
  SDK
• 5:21
  and
• 5:22
  E2B
• 5:22
  sandboxes,
• 5:23
  each
• 5:24
  request
• 5:24
  gets
• 5:24
  a
• 5:24
  fresh
• 5:24
  VM
• 5:25
  with
• 5:25
  full
• 5:25
  tool
• 5:25
  access
• 5:26
  —
• 5:26
  Bash,
• 5:27
  Read,
• 5:28
  Write,
• 5:28
  Edit,
• 5:29
  Glob,
• 5:29
  Grep,
• 5:29
  WebSearch,
• 5:30
  WebFetch
• 5:30
  —
• 5:31
  and
• 5:31
  the
• 5:31
  sandbox
• 5:32
  is
• 5:32
  destroyed
• 5:33
  when
• 5:33
  done.
• 5:34
  Nothing
• 5:34
  persists.
• 5:35
  Nothing
• 5:35
  escapes.
• 5:36
  It
• 5:36
  supports
• 5:37
  300+
• 5:37
  models
• 5:38
  via
• 5:38
  OpenRouter,
• 5:39
  structured
• 5:40
  output
• 5:40
  via
• 5:40
  JSON
• 5:41
  schema,
• 5:41
  subagent
• 5:42
  delegation,
• 5:43
  MCP
• 5:43
  server
• 5:44
  integration,
• 5:44
  and
• 5:45
  file
• 5:45
  uploads.
• 5:46
  The
• 5:46
  whole
• 5:46
  thing
• 5:47
  is
• 5:47
  a
• 5:47
  single
• 5:47
  `pip
• 5:47
  install
• 5:48
  duvo-sandstorm`
• 5:49
  and
• 5:49
  `ds
• 5:49
  "your
• 5:49
  prompt"`.
• 5:50
  Herman
• 5:51
  Errico,
• 5:52
  a
• 5:52
  PM
• 5:52
  at
• 5:52
  Vanta,
• 5:53
  is
• 5:53
  trying
• 5:53
  to
• 5:53
  name
• 5:54
  this
• 5:54
  entire
• 5:54
  problem
• 5:55
  category.
• 5:56
  His
• 5:56
  AARM
• 5:56
  specification
• 5:57
  —
• 5:58
  Autonomous
• 5:58
  Action
• 5:59
  Runtime
• 5:59
  Management
• 5:59
  —
• 6:00
  argues
• 6:00
  that
• 6:00
  the
• 6:01
  security
• 6:01
  gap
• 6:01
  is
• 6:01
  not
• 6:02
  in
• 6:02
  permissions
• 6:02
  or
• 6:02
  logging
• 6:03
  but
• 6:03
  at
• 6:03
  the
• 6:03
  action
• 6:04
  boundary:
• 6:05
  the
• 6:05
  moment
• 6:05
  an
• 6:05
  agent
• 6:06
  calls
• 6:06
  a
• 6:06
  tool
• 6:06
  that
• 6:06
  reads
• 6:07
  data,
• 6:07
  moves
• 6:08
  money,
• 6:08
  changes
• 6:08
  permissions,
• 6:09
  or
• 6:09
  deletes
• 6:10
  records.
• 6:11
  Once
• 6:11
  the
• 6:11
  tool
• 6:11
  runs,
• 6:12
  there
• 6:12
  is
• 6:12
  no
• 6:12
  undo
• 6:12
  button.
• 6:13
  AARM
• 6:14
  proposes
• 6:14
  a
• 6:14
  standardized
• 6:15
  layer
• 6:15
  for
• 6:15
  observing,
• 6:16
  controlling,
• 6:17
  and
• 6:17
  authorizing
• 6:18
  autonomous
• 6:18
  actions
• 6:19
  at
• 6:19
  runtime,
• 6:20
  including
• 6:20
  action
• 6:20
  receipts,
• 6:21
  policy
• 6:21
  hooks,
• 6:22
  and
• 6:22
  step-up
• 6:22
  approval.
• 6:24
  The
• 6:24
  consistent
• 6:24
  response
• 6:24
  from
• 6:25
  builders
• 6:25
  and
• 6:25
  security
• 6:25
  teams:
• 6:26
  "yes,
• 6:26
  this
• 6:27
  is
• 6:27
  the
• 6:27
  gap."
• 6:31
  Shannon,
• 6:32
  by
• 6:32
  Keygraph,
• 6:32
  bills
• 6:33
  itself
• 6:33
  as
• 6:33
  "your
• 6:33
  fully
• 6:34
  autonomous
• 6:34
  AI
• 6:35
  pentester"
• 6:35
  and
• 6:36
  backs
• 6:36
  it
• 6:36
  up
• 6:36
  with
• 6:36
  a
• 6:36
  96.15%
• 6:38
  success
• 6:38
  rate
• 6:38
  on
• 6:39
  the
• 6:39
  hint-free,
• 6:39
  source-aware
• 6:40
  XBOW
• 6:40
  benchmark.
• 6:41
  Built
• 6:42
  on
• 6:42
  Anthropic's
• 6:42
  Claude
• 6:43
  Agent
• 6:43
  SDK,
• 6:44
  Shannon
• 6:44
  operates
• 6:44
  as
• 6:45
  a
• 6:45
  four-phase
• 6:45
  multi-agent
• 6:46
  system:
• 6:46
  reconnaissance
• 6:47
  maps
• 6:47
  the
• 6:47
  attack
• 6:48
  surface
• 6:48
  via
• 6:48
  source
• 6:49
  code
• 6:49
  analysis
• 6:49
  plus
• 6:50
  Nmap
• 6:50
  and
• 6:50
  Subfinder;
• 6:51
  parallel
• 6:52
  vulnerability-analysis
• 6:53
  agents
• 6:53
  hunt
• 6:53
  per
• 6:53
  OWASP
• 6:54
  category
• 6:54
  with
• 6:54
  data-flow
• 6:55
  tracing
• 6:55
  from
• 6:55
  user
• 6:56
  inputs
• 6:56
  to
• 6:56
  dangerous
• 6:56
  sinks;
• 6:57
  parallel
• 6:57
  exploitation
• 6:58
  agents
• 6:58
  attempt
• 6:59
  real
• 6:59
  browser-based
• 6:59
  attacks
• 7:00
  under
• 7:00
  a
• 7:00
  strict
• 7:00
  "No
• 7:00
  Exploit,
• 7:01
  No
• 7:01
  Report"
• 7:01
  policy;
• 7:02
  and
• 7:02
  a
• 7:02
  final
• 7:03
  phase
• 7:03
  consolidates
• 7:03
  validated
• 7:04
  findings
• 7:04
  into
• 7:04
  a
• 7:04
  report
• 7:05
  with
• 7:05
  copy-paste
• 7:05
  proof-of-concepts.
• 7:07
  Against
• 7:07
  OWASP
• 7:07
  Juice
• 7:08
  Shop,
• 7:08
  Shannon
• 7:08
  found
• 7:09
  20+
• 7:09
  critical
• 7:09
  vulnerabilities
• 7:10
  including
• 7:10
  complete
• 7:11
  authentication
• 7:11
  bypass
• 7:12
  with
• 7:12
  full
• 7:12
  database
• 7:12
  exfiltration,
• 7:13
  privilege
• 7:14
  escalation
• 7:14
  to
• 7:14
  admin
• 7:15
  via
• 7:15
  registration
• 7:15
  workflow
• 7:16
  bypass,
• 7:16
  systemic
• 7:16
  IDOR
• 7:17
  flaws,
• 7:17
  and
• 7:17
  SSRF.
• 7:19
  Against
• 7:19
  crAPI,
• 7:19
  it
• 7:19
  chained
• 7:20
  multiple
• 7:20
  JWT
• 7:20
  attacks
• 7:21
  —
• 7:21
  algorithm
• 7:22
  confusion,
• 7:22
  `alg:none`,
• 7:23
  and
• 7:23
  weak
• 7:23
  key
• 7:24
  injection
• 7:24
  —
• 7:24
  to
• 7:25
  full
• 7:25
  database
• 7:25
  compromise.
• 7:26
  A
• 7:26
  full
• 7:27
  run
• 7:27
  costs
• 7:27
  roughly
• 7:27
  $50
• 7:28
  in
• 7:28
  Claude
• 7:28
  Sonnet
• 7:29
  API
• 7:29
  calls
• 7:29
  and
• 7:30
  takes
• 7:30
  1–1.5
• 7:31
  hours.
• 7:32
  Shannon
• 7:33
  Lite
• 7:33
  is
• 7:33
  AGPL-3.0
• 7:35
  open
• 7:35
  source;
• 7:36
  Shannon
• 7:36
  Pro
• 7:36
  adds
• 7:37
  an
• 7:37
  LLM-powered
• 7:37
  data
• 7:38
  flow
• 7:38
  analysis
• 7:38
  engine
• 7:39
  for
• 7:39
  deeper
• 7:39
  coverage.
• 7:40
  The
• 7:40
  broader
• 7:40
  community
• 7:41
  is
• 7:41
  pushing
• 7:41
  in
• 7:41
  the
• 7:41
  same
• 7:41
  direction
• 7:42
  with
• 7:42
  less
• 7:42
  polish.
• 7:43
  A
• 7:43
  LinkedIn
• 7:44
  post
• 7:44
  about
• 7:44
  an
• 7:44
  unnamed
• 7:45
  multi-agent
• 7:46
  AI
• 7:46
  red
• 7:46
  team
• 7:46
  —
• 7:47
  shipping
• 7:48
  as
• 7:48
  a
• 7:48
  single
• 7:48
  Docker
• 7:48
  container
• 7:49
  with
• 7:49
  Nmap,
• 7:49
  Metasploit,
• 7:50
  SQLMap,
• 7:50
  and
• 7:51
  Hydra
• 7:51
  preinstalled,
• 7:51
  where
• 7:52
  the
• 7:52
  AI
• 7:52
  decides
• 7:52
  which
• 7:53
  tool
• 7:53
  to
• 7:53
  use
• 7:53
  —
• 7:54
  went
• 7:54
  viral.
• 7:55
  The
• 7:55
  discourse
• 7:56
  was
• 7:56
  more
• 7:56
  illuminating
• 7:57
  than
• 7:57
  the
• 7:57
  tool
• 7:57
  itself.
• 7:58
  As
• 7:59
  one
• 7:59
  commenter
• 7:59
  put
• 7:59
  it,
• 8:00
  "a
• 8:00
  red
• 8:00
  team
• 8:00
  engagement
• 8:01
  is
• 8:01
  $60-85K
• 8:02
  because
• 8:02
  you're
• 8:02
  paying
• 8:02
  for
• 8:02
  judgment,
• 8:03
  not
• 8:03
  tools.
• 8:04
  Nmap
• 8:04
  and
• 8:04
  Metasploit
• 8:05
  have
• 8:05
  been
• 8:05
  free
• 8:06
  for
• 8:06
  decades."
• 8:07
  Another
• 8:07
  noted
• 8:07
  that
• 8:08
  automated
• 8:08
  pentest
• 8:08
  platforms
• 8:09
  being
• 8:09
  marketed
• 8:10
  as
• 8:10
  autonomous
• 8:10
  end-to-end
• 8:11
  testing,
• 8:11
  without
• 8:12
  strong
• 8:12
  scope
• 8:12
  guardrails
• 8:13
  and
• 8:13
  human
• 8:13
  oversight,
• 8:14
  risk
• 8:14
  creating
• 8:15
  real
• 8:15
  production
• 8:15
  incidents
• 8:15
  —
• 8:16
  especially
• 8:17
  in
• 8:17
  medical
• 8:17
  systems
• 8:18
  or
• 8:18
  critical
• 8:18
  infrastructure.
• 8:19
  The
• 8:19
  consensus:
• 8:20
  automation
• 8:20
  improves
• 8:21
  continuously,
• 8:22
  but
• 8:22
  it
• 8:22
  does
• 8:22
  not
• 8:23
  replace
• 8:23
  accountability,
• 8:24
  scoping,
• 8:24
  and
• 8:24
  judgment.
• 8:25
  Meanwhile,
• 8:26
  David
• 8:26
  Kennedy
• 8:27
  of
• 8:27
  TrustedSec
• 8:27
  released
• 8:28
  btrpa-scan,
• 8:29
  a
• 8:29
  BLE
• 8:29
  scanner
• 8:30
  with
• 8:30
  Resolvable
• 8:31
  Private
• 8:31
  Address
• 8:31
  resolution
• 8:32
  that
• 8:32
  is
• 8:32
  less
• 8:33
  flashy
• 8:33
  but
• 8:33
  arguably
• 8:34
  more
• 8:34
  useful
• 8:34
  for
• 8:35
  physical
• 8:35
  security
• 8:35
  assessments.
• 8:37
  It
• 8:37
  implements
• 8:37
  the
• 8:37
  Bluetooth
• 8:38
  Core
• 8:38
  Specification's
• 8:39
  `ah()`
• 8:39
  function
• 8:40
  for
• 8:40
  real-time
• 8:41
  IRK-based
• 8:41
  address
• 8:42
  resolution,
• 8:43
  supports
• 8:43
  multi-adapter
• 8:44
  scanning,
• 8:45
  GPS
• 8:45
  location
• 8:46
  stamping,
• 8:47
  RSSI-based
• 8:48
  distance
• 8:48
  estimation
• 8:48
  with
• 8:49
  environment
• 8:49
  presets,
• 8:50
  proximity
• 8:50
  alerts,
• 8:51
  a
• 8:51
  live
• 8:52
  TUI,
• 8:53
  and
• 8:53
  a
• 8:53
  web-based
• 8:53
  radar
• 8:53
  GUI
• 8:54
  with
• 8:54
  animated
• 8:55
  sweep
• 8:55
  visualization.
• 8:56
  The
• 8:56
  tool
• 8:57
  addresses
• 8:57
  a
• 8:57
  real
• 8:57
  gap:
• 8:58
  BLE
• 8:59
  devices
• 8:59
  use
• 8:59
  randomized
• 9:00
  MAC
• 9:00
  addresses
• 9:01
  for
• 9:01
  privacy,
• 9:02
  but
• 9:02
  anyone
• 9:02
  with
• 9:02
  the
• 9:03
  Identity
• 9:03
  Resolving
• 9:03
  Key
• 9:04
  can
• 9:04
  de-anonymize
• 9:05
  them
• 9:05
  in
• 9:05
  real
• 9:05
  time.
• 9:08
  If
• 9:08
  you
• 9:08
  are
• 9:09
  building
• 9:09
  multi-agent
• 9:09
  systems
• 9:10
  and
• 9:10
  still
• 9:10
  hard-coding
• 9:11
  communication
• 9:11
  topologies,
• 9:12
  a
• 9:12
  new
• 9:13
  paper
• 9:13
  from
• 9:13
  East
• 9:13
  China
• 9:13
  Normal
• 9:14
  University
• 9:14
  suggests
• 9:15
  you
• 9:15
  are
• 9:15
  leaving
• 9:15
  5–26%
• 9:17
  accuracy
• 9:18
  on
• 9:18
  the
• 9:18
  table.
• 9:19
  ST-EVO
• 9:20
  introduces
• 9:21
  Spatio-Temporal
• 9:21
  Evolution
• 9:22
  for
• 9:22
  multi-agent
• 9:22
  communication
• 9:23
  —
• 9:24
  scheduling
• 9:24
  not
• 9:25
  just
• 9:25
  which
• 9:25
  agents
• 9:25
  talk
• 9:26
  to
• 9:26
  which
• 9:26
  (spatial)
• 9:26
  but
• 9:26
  when
• 9:27
  those
• 9:27
  topologies
• 9:27
  change
• 9:27
  across
• 9:28
  dialogue
• 9:28
  iterations
• 9:29
  (temporal).
• 9:29
  The
• 9:29
  scheduler
• 9:30
  is
• 9:30
  a
• 9:30
  compact
• 9:30
  neural
• 9:31
  network
• 9:31
  driven
• 9:31
  by
• 9:31
  MLP-based
• 9:32
  Flow
• 9:32
  Matching,
• 9:33
  and
• 9:33
  it
• 9:33
  is
• 9:33
  trained
• 9:34
  on
• 9:34
  just
• 9:34
  40–80
• 9:35
  samples
• 9:35
  per
• 9:35
  task.
• 9:35
  On
• 9:36
  nine
• 9:36
  benchmarks
• 9:36
  —
• 9:37
  MMLU,
• 9:37
  GSM8K,
• 9:38
  HumanEval,
• 9:39
  HotpotQA,
• 9:39
  and
• 9:40
  others
• 9:40
  —
• 9:41
  ST-EVO
• 9:41
  achieved
• 9:42
  an
• 9:42
  average
• 9:42
  accuracy
• 9:42
  of
• 9:43
  88.42%,
• 9:44
  with
• 9:44
  improvements
• 9:45
  ranging
• 9:45
  from
• 9:45
  5.65%
• 9:46
  on
• 9:46
  easy
• 9:46
  tasks
• 9:47
  (MultiArith)
• 9:47
  to
• 9:47
  26.10%
• 9:49
  on
• 9:49
  hard
• 9:49
  ones
• 9:49
  (DDXPlus).
• 9:50
  Token
• 9:50
  consumption
• 9:51
  was
• 9:51
  roughly
• 9:51
  50%
• 9:52
  of
• 9:52
  the
• 9:52
  nearest
• 9:52
  competitor
• 9:53
  on
• 9:53
  MMLU
• 9:54
  and
• 9:54
  HumanEval
• 9:54
  while
• 9:55
  delivering
• 9:55
  about
• 9:55
  5%
• 9:56
  higher
• 9:56
  accuracy.
• 9:57
  Most
• 9:57
  striking:
• 9:58
  under
• 9:58
  prompt
• 9:59
  injection
• 9:59
  attacks,
• 9:59
  static
• 10:00
  multi-agent
• 10:00
  systems
• 10:01
  suffered
• 10:01
  6.5–12.7%
• 10:03
  performance
• 10:04
  drops,
• 10:04
  while
• 10:05
  ST-EVO
• 10:06
  maintained
• 10:07
  nearly
• 10:07
  identical
• 10:07
  performance
• 10:08
  —
• 10:08
  the
• 10:08
  adaptive
• 10:09
  topology
• 10:09
  effectively
• 10:10
  routes
• 10:10
  around
• 10:10
  compromised
• 10:11
  agents.
• 10:12
  Google
• 10:12
  DeepMind
• 10:13
  is
• 10:13
  apparently
• 10:13
  working
• 10:14
  on
• 10:14
  its
• 10:14
  own
• 10:14
  approach
• 10:14
  to
• 10:15
  the
• 10:15
  same
• 10:15
  problem,
• 10:16
  releasing
• 10:16
  what
• 10:16
  it
• 10:16
  calls
• 10:17
  "Intelligent
• 10:17
  AI
• 10:17
  Delegation"
• 10:18
  for
• 10:18
  multi-agent
• 10:19
  orchestration.
• 10:20
  Details
• 10:21
  are
• 10:21
  thin
• 10:21
  —
• 10:22
  the
• 10:22
  Reddit
• 10:22
  post
• 10:22
  announcing
• 10:23
  it
• 10:23
  offered
• 10:23
  no
• 10:23
  link
• 10:23
  to
• 10:23
  the
• 10:23
  paper
• 10:24
  —
• 10:24
  but
• 10:24
  the
• 10:24
  timing
• 10:25
  aligns
• 10:25
  with
• 10:25
  a
• 10:25
  clear
• 10:25
  industry
• 10:26
  trend:
• 10:27
  the
• 10:27
  shift
• 10:27
  from
• 10:27
  manually
• 10:28
  designed
• 10:28
  agent
• 10:28
  workflows
• 10:29
  to
• 10:29
  systems
• 10:29
  that
• 10:29
  learn
• 10:30
  their
• 10:30
  own
• 10:30
  coordination
• 10:30
  patterns.
• 10:32
  At
• 10:32
  the
• 10:32
  practical
• 10:32
  end
• 10:32
  of
• 10:32
  multi-agent
• 10:33
  coordination,
• 10:34
  BeadHub
• 10:34
  tackles
• 10:35
  the
• 10:35
  specific
• 10:35
  version
• 10:36
  of
• 10:36
  the
• 10:36
  problem
• 10:36
  that
• 10:36
  nobody
• 10:37
  else
• 10:38
  is:
• 10:38
  multiple
• 10:38
  programmers,
• 10:39
  each
• 10:39
  with
• 10:39
  multiple
• 10:40
  agents,
• 10:40
  across
• 10:41
  different
• 10:41
  machines
• 10:41
  and
• 10:41
  repositories.
• 10:43
  Built
• 10:43
  on
• 10:43
  top
• 10:44
  of
• 10:44
  Steve
• 10:44
  Yegge's
• 10:44
  beads
• 10:45
  (a
• 10:45
  git-native
• 10:45
  issue
• 10:46
  tracker),
• 10:46
  BeadHub
• 10:47
  is
• 10:47
  a
• 10:47
  coordination
• 10:48
  server
• 10:48
  where
• 10:48
  agents
• 10:48
  claim
• 10:49
  work,
• 10:49
  communicate
• 10:50
  via
• 10:50
  mail
• 10:50
  (async,
• 10:51
  fire-and-forget)
• 10:52
  or
• 10:52
  chat
• 10:53
  (sync,
• 10:53
  block-until-reply),
• 10:55
  and
• 10:55
  respect
• 10:55
  advisory
• 10:56
  file
• 10:56
  locks.
• 10:57
  When
• 10:57
  an
• 10:57
  agent
• 10:58
  marks
• 10:58
  a
• 10:58
  task
• 10:58
  as
• 10:58
  in-progress,
• 11:00
  the
• 11:00
  claim
• 11:00
  is
• 11:00
  visible
• 11:00
  to
• 11:01
  every
• 11:01
  other
• 11:01
  agent
• 11:01
  across
• 11:01
  machines.
• 11:02
  The
• 11:02
  system
• 11:03
  recognizes
• 11:03
  different
• 11:04
  repository
• 11:04
  clones
• 11:05
  as
• 11:05
  the
• 11:05
  same
• 11:05
  project,
• 11:06
  so
• 11:06
  agents
• 11:07
  in
• 11:07
  Buenos
• 11:07
  Aires
• 11:07
  and
• 11:08
  San
• 11:08
  Francisco
• 11:08
  see
• 11:08
  each
• 11:09
  other's
• 11:09
  claims
• 11:09
  and
• 11:09
  locks.
• 11:10
  A
• 11:10
  dedicated
• 11:11
  "coordinator"
• 11:11
  agent
• 11:12
  that
• 11:12
  does
• 11:12
  not
• 11:12
  write
• 11:12
  code
• 11:12
  —
• 11:13
  watching
• 11:14
  the
• 11:14
  dashboard,
• 11:14
  assigning
• 11:15
  work,
• 11:15
  checking
• 11:15
  on
• 11:15
  progress
• 11:16
  —
• 11:16
  turned
• 11:17
  out
• 11:17
  to
• 11:17
  matter
• 11:17
  more
• 11:17
  than
• 11:18
  any
• 11:18
  of
• 11:18
  the
• 11:18
  technical
• 11:18
  plumbing.
• 11:19
  Anthropic's
• 11:20
  Claude
• 11:20
  Code
• 11:20
  Agent
• 11:21
  Teams
• 11:21
  and
• 11:21
  OpenAI's
• 11:22
  Codex
• 11:22
  now
• 11:22
  handle
• 11:23
  the
• 11:23
  single-machine
• 11:23
  case;
• 11:24
  BeadHub
• 11:25
  is
• 11:25
  building
• 11:25
  for
• 11:25
  the
• 11:25
  multi-programmer,
• 11:26
  multi-timezone
• 11:27
  version.
• 11:31
  Antigravity
• 11:31
  Awesome
• 11:32
  Skills
• 11:32
  has
• 11:32
  crossed
• 11:33
  864
• 11:34
  curated
• 11:34
  agentic
• 11:35
  skills
• 11:35
  —
• 11:36
  small
• 11:37
  markdown
• 11:37
  files
• 11:37
  that
• 11:38
  teach
• 11:38
  AI
• 11:38
  coding
• 11:38
  assistants
• 11:39
  specific
• 11:39
  tasks
• 11:40
  —
• 11:41
  working
• 11:41
  across
• 11:41
  Claude
• 11:42
  Code,
• 11:42
  Gemini
• 11:42
  CLI,
• 11:43
  Codex
• 11:44
  CLI,
• 11:44
  Cursor,
• 11:45
  GitHub
• 11:45
  Copilot,
• 11:46
  OpenCode,
• 11:47
  and
• 11:47
  Antigravity
• 11:48
  IDE.
• 11:49
  The
• 11:49
  repository
• 11:50
  includes
• 11:50
  official
• 11:50
  skills
• 11:51
  from
• 11:51
  Anthropic,
• 11:52
  OpenAI,
• 11:53
  Google,
• 11:53
  Microsoft,
• 11:54
  Supabase,
• 11:55
  and
• 11:55
  Vercel
• 11:56
  Labs,
• 11:56
  organized
• 11:57
  into
• 11:57
  architecture,
• 11:58
  security,
• 11:58
  data/AI,
• 12:00
  infrastructure,
• 12:01
  and
• 12:01
  testing
• 12:01
  categories.
• 12:03
  Version
• 12:03
  5.4.0
• 12:05
  adds
• 12:05
  workflows
• 12:05
  —
• 12:06
  step-by-step
• 12:07
  execution
• 12:07
  sequences
• 12:07
  for
• 12:08
  goals
• 12:08
  like
• 12:08
  "Ship
• 12:08
  a
• 12:08
  SaaS
• 12:09
  MVP"
• 12:10
  or
• 12:10
  "Security
• 12:10
  Audit
• 12:11
  for
• 12:11
  a
• 12:11
  Web
• 12:11
  App."
• 12:12
  Separately,
• 12:12
  a
• 12:12
  developer
• 12:13
  built
• 12:13
  SkillsMP
• 12:13
  —
• 12:14
  an
• 12:15
  MCP
• 12:15
  server
• 12:15
  that
• 12:16
  connects
• 12:16
  agents
• 12:16
  to
• 12:16
  8,000+
• 12:18
  community
• 12:18
  skills
• 12:19
  with
• 12:19
  a
• 12:19
  single-line
• 12:20
  installation
• 12:20
  and
• 12:20
  zero
• 12:21
  setup.
• 12:21
  The
• 12:22
  MCP
• 12:22
  provides
• 12:22
  keyword
• 12:23
  and
• 12:23
  semantic
• 12:23
  search,
• 12:24
  lets
• 12:24
  agents
• 12:25
  read
• 12:25
  skill
• 12:25
  content
• 12:25
  into
• 12:26
  context
• 12:26
  (without
• 12:26
  permanent
• 12:27
  installation),
• 12:28
  and
• 12:28
  supports
• 12:28
  install/remove
• 12:29
  for
• 12:29
  persistent
• 12:30
  use.
• 12:30
  The
• 12:30
  most
• 12:31
  interesting
• 12:31
  pattern:
• 12:32
  for
• 12:32
  one-off
• 12:32
  tasks,
• 12:33
  having
• 12:33
  the
• 12:33
  agent
• 12:34
  read
• 12:34
  the
• 12:34
  skill
• 12:34
  temporarily
• 12:35
  rather
• 12:35
  than
• 12:35
  installing
• 12:36
  it
• 12:36
  permanently
• 12:36
  is
• 12:37
  often
• 12:37
  better
• 12:37
  —
• 12:38
  it
• 12:38
  keeps
• 12:38
  the
• 12:38
  skill
• 12:38
  directory
• 12:39
  clean
• 12:39
  while
• 12:39
  still
• 12:39
  providing
• 12:40
  the
• 12:40
  full
• 12:40
  instructions
• 12:41
  in
• 12:41
  context.
• 12:42
  The
• 12:42
  top
• 12:42
  community
• 12:42
  question
• 12:43
  was
• 12:43
  predictable
• 12:43
  and
• 12:44
  important:
• 12:44
  "What
• 12:45
  controls
• 12:45
  are
• 12:45
  in
• 12:45
  place
• 12:46
  for
• 12:46
  ensuring
• 12:46
  the
• 12:46
  skills
• 12:46
  database
• 12:47
  does
• 12:47
  not
• 12:47
  hold
• 12:47
  anything
• 12:48
  malicious?"
• 12:49
  —
• 12:49
  a
• 12:49
  question
• 12:50
  that
• 12:50
  echoes
• 12:50
  the
• 12:50
  MCP
• 12:51
  Parasite
• 12:51
  attack
• 12:51
  described
• 12:52
  earlier
• 12:52
  in
• 12:52
  today's
• 12:53
  coverage.
• 12:57
  Andriy
• 12:58
  Burkov
• 12:58
  highlighted
• 12:59
  a
• 12:59
  paper
• 12:59
  that
• 12:59
  reveals
• 12:59
  something
• 13:00
  fundamental
• 13:01
  about
• 13:01
  how
• 13:01
  autoregressive
• 13:02
  attention
• 13:02
  works
• 13:02
  —
• 13:03
  and
• 13:03
  the
• 13:03
  fix
• 13:03
  is
• 13:04
  absurdly
• 13:04
  simple.
• 13:05
  LLMs
• 13:05
  process
• 13:06
  text
• 13:06
  left
• 13:06
  to
• 13:06
  right;
• 13:07
  each
• 13:07
  token
• 13:07
  can
• 13:07
  only
• 13:08
  attend
• 13:08
  to
• 13:08
  what
• 13:08
  came
• 13:08
  before
• 13:09
  it.
• 13:09
  When
• 13:10
  you
• 13:10
  write
• 13:10
  a
• 13:10
  long
• 13:10
  prompt
• 13:10
  with
• 13:11
  context
• 13:11
  first
• 13:11
  and
• 13:11
  a
• 13:11
  question
• 13:12
  last,
• 13:12
  the
• 13:12
  context
• 13:13
  tokens
• 13:13
  were
• 13:13
  generated
• 13:14
  without
• 13:14
  any
• 13:14
  awareness
• 13:15
  of
• 13:15
  what
• 13:15
  question
• 13:15
  was
• 13:15
  coming.
• 13:16
  The
• 13:16
  paper
• 13:17
  asks:
• 13:17
  what
• 13:17
  if
• 13:17
  you
• 13:17
  just
• 13:18
  send
• 13:18
  the
• 13:18
  prompt
• 13:18
  twice
• 13:19
  in
• 13:19
  a
• 13:19
  row,
• 13:19
  so
• 13:20
  every
• 13:20
  token
• 13:20
  gets
• 13:20
  a
• 13:20
  second
• 13:21
  pass
• 13:21
  with
• 13:21
  full
• 13:21
  bidirectional
• 13:22
  awareness?
• 13:23
  Across
• 13:23
  seven
• 13:23
  benchmarks
• 13:24
  and
• 13:24
  seven
• 13:24
  models
• 13:25
  (from
• 13:25
  Gemini,
• 13:25
  ChatGPT,
• 13:26
  Claude,
• 13:26
  and
• 13:27
  DeepSeek),
• 13:27
  accuracy
• 13:28
  goes
• 13:28
  up
• 13:28
  with
• 13:28
  no
• 13:28
  increase
• 13:29
  in
• 13:29
  output
• 13:29
  length
• 13:30
  and
• 13:30
  no
• 13:30
  meaningful
• 13:31
  increase
• 13:31
  in
• 13:31
  response
• 13:31
  time
• 13:32
  —
• 13:32
  because
• 13:32
  processing
• 13:33
  input
• 13:33
  tokens
• 13:33
  is
• 13:34
  already
• 13:34
  parallelized
• 13:34
  by
• 13:34
  the
• 13:35
  hardware.
• 13:36
  One
• 13:36
  model
• 13:36
  jumped
• 13:36
  from
• 13:36
  21%
• 13:37
  to
• 13:37
  97%
• 13:38
  on
• 13:38
  a
• 13:38
  name-in-a-list
• 13:39
  task.
• 13:40
  That
• 13:40
  is
• 13:40
  not
• 13:40
  a
• 13:40
  marginal
• 13:41
  gain
• 13:41
  from
• 13:41
  a
• 13:41
  marginal
• 13:42
  trick;
• 13:42
  it
• 13:42
  is
• 13:42
  a
• 13:43
  structural
• 13:43
  fix
• 13:43
  for
• 13:43
  a
• 13:43
  structural
• 13:44
  limitation.
• 13:45
  On
• 13:45
  the
• 13:45
  infrastructure
• 13:46
  side,
• 13:47
  a
• 13:47
  paper
• 13:47
  introducing
• 13:47
  Krites
• 13:48
  addresses
• 13:48
  the
• 13:48
  semantic
• 13:49
  caching
• 13:49
  problem
• 13:49
  that
• 13:50
  production
• 13:50
  LLM
• 13:50
  deployments
• 13:51
  face.
• 13:52
  Standard
• 13:52
  semantic
• 13:53
  caches
• 13:53
  use
• 13:53
  a
• 13:53
  single
• 13:54
  embedding
• 13:54
  similarity
• 13:55
  threshold
• 13:55
  —
• 13:56
  conservative
• 13:56
  thresholds
• 13:57
  miss
• 13:57
  safe
• 13:57
  reuse
• 13:58
  opportunities;
• 13:59
  aggressive
• 13:59
  ones
• 14:00
  risk
• 14:00
  serving
• 14:00
  wrong
• 14:00
  answers.
• 14:01
  Krites
• 14:02
  keeps
• 14:02
  the
• 14:02
  standard
• 14:02
  threshold
• 14:03
  on
• 14:03
  the
• 14:03
  serving
• 14:03
  path
• 14:04
  (zero
• 14:04
  latency
• 14:04
  change)
• 14:05
  but
• 14:05
  adds
• 14:05
  an
• 14:05
  off-path
• 14:06
  LLM
• 14:06
  judge
• 14:07
  for
• 14:07
  borderline
• 14:07
  "grey
• 14:08
  zone"
• 14:08
  queries.
• 14:09
  When
• 14:09
  the
• 14:09
  judge
• 14:09
  approves
• 14:10
  a
• 14:10
  match,
• 14:11
  the
• 14:11
  curated
• 14:11
  static
• 14:12
  response
• 14:12
  gets
• 14:12
  promoted
• 14:13
  into
• 14:13
  the
• 14:13
  dynamic
• 14:13
  cache
• 14:14
  via
• 14:14
  auxiliary
• 14:15
  overwrite
• 14:15
  —
• 14:16
  turning
• 14:16
  it
• 14:16
  into
• 14:16
  a
• 14:17
  mutable
• 14:17
  pointer
• 14:17
  layer
• 14:17
  over
• 14:18
  static
• 14:18
  answers.
• 14:19
  On
• 14:19
  conversational
• 14:20
  workloads,
• 14:21
  Krites
• 14:21
  increased
• 14:22
  the
• 14:22
  fraction
• 14:22
  of
• 14:22
  traffic
• 14:23
  served
• 14:23
  with
• 14:23
  curated
• 14:24
  answers
• 14:24
  by
• 14:24
  136%;
• 14:26
  on
• 14:26
  search-style
• 14:27
  queries,
• 14:27
  by
• 14:28
  290%.
• 14:29
  The
• 14:30
  approach
• 14:30
  is
• 14:30
  model-agnostic
• 14:31
  and
• 14:32
  does
• 14:32
  not
• 14:32
  change
• 14:32
  the
• 14:32
  baseline's
• 14:33
  error
• 14:33
  rate.
• 14:34
  For
• 14:34
  anyone
• 14:35
  running
• 14:35
  multi-tier
• 14:35
  LLM
• 14:36
  infrastructure,
• 14:37
  that
• 14:37
  is
• 14:37
  essentially
• 14:38
  free
• 14:38
  safety
• 14:39
  and
• 14:39
  cost
• 14:39
  improvement.
• 14:40
  For
• 14:41
  the
• 14:41
  local-AI
• 14:41
  crowd,
• 14:42
  a
• 14:42
  Strix
• 14:42
  Halo
• 14:43
  owner
• 14:43
  posted
• 14:43
  a
• 14:43
  detailed
• 14:44
  activation
• 14:45
  guide
• 14:45
  that
• 14:45
  reads
• 14:45
  like
• 14:46
  a
• 14:46
  love
• 14:46
  letter
• 14:46
  to
• 14:46
  AMD's
• 14:47
  integrated
• 14:47
  GPU
• 14:48
  stack.
• 14:49
  The
• 14:49
  setup
• 14:49
  includes
• 14:49
  Whisper
• 14:50
  on
• 14:50
  the
• 14:50
  NPU
• 14:51
  backend
• 14:51
  for
• 14:51
  instant
• 14:51
  transcription,
• 14:52
  Kokoro
• 14:53
  for
• 14:53
  blazing-fast
• 14:54
  TTS,
• 14:55
  and
• 14:55
  Qwen3-Coder-Next
• 14:56
  as
• 14:56
  the
• 14:56
  reasoning
• 14:57
  backbone
• 14:57
  —
• 14:58
  with
• 14:58
  Lemonade
• 14:58
  Server
• 14:59
  tying
• 14:59
  it
• 14:59
  all
• 14:59
  together.
• 15:00
  The
• 15:00
  poster
• 15:01
  even
• 15:01
  managed
• 15:01
  to
• 15:01
  run
• 15:01
  MiniMax
• 15:02
  M2.5
• 15:03
  Q3\
• 15:03
  K\
• 15:04
  XL,
• 15:05
  though
• 15:05
  KV
• 15:05
  cache
• 15:06
  issues
• 15:06
  in
• 15:06
  llama.cpp
• 15:08
  limited
• 15:09
  its
• 15:09
  utility.
• 15:10
  The
• 15:10
  x86
• 15:11
  architecture
• 15:11
  gives
• 15:12
  it
• 15:12
  an
• 15:12
  edge
• 15:12
  over
• 15:12
  ARM-based
• 15:13
  alternatives
• 15:14
  like
• 15:14
  NVIDIA's
• 15:15
  DGX
• 15:15
  Spark
• 15:16
  for
• 15:16
  running
• 15:16
  AI-powered
• 15:17
  applications
• 15:18
  alongside
• 15:18
  inference
• 15:19
  on
• 15:19
  the
• 15:19
  same
• 15:19
  box.
• 15:21
  Community
• 15:21
  questions
• 15:22
  focused
• 15:22
  on
• 15:22
  flash
• 15:22
  attention
• 15:23
  compatibility
• 15:23
  with
• 15:24
  ROCm
• 15:24
  on
• 15:25
  the
• 15:25
  gfx1151
• 15:26
  target
• 15:26
  and
• 15:27
  practical
• 15:27
  prompt-processing
• 15:28
  speeds
• 15:28
  for
• 15:28
  agentic
• 15:29
  coding.
• 15:33
  OpenAI
• 15:34
  acquired
• 15:34
  OpenClaw
• 15:35
  and
• 15:35
  hired
• 15:35
  its
• 15:35
  creator,
• 15:36
  Austrian
• 15:36
  developer
• 15:36
  Peter
• 15:37
  Steinberger.
• 15:38
  Community
• 15:38
  reaction
• 15:38
  was
• 15:38
  skeptical:
• 15:39
  "Isn't
• 15:40
  them
• 15:40
  buying
• 15:40
  these
• 15:40
  half-baked
• 15:41
  solutions
• 15:41
  an
• 15:41
  admission
• 15:42
  they
• 15:42
  don't
• 15:42
  have
• 15:42
  anything
• 15:42
  better
• 15:42
  in
• 15:42
  terms
• 15:43
  of
• 15:43
  agents?"
• 15:44
  Others
• 15:44
  noted
• 15:44
  the
• 15:44
  founder
• 15:44
  was
• 15:45
  losing
• 15:45
  money
• 15:45
  on
• 15:45
  it
• 15:45
  and
• 15:45
  saw
• 15:46
  OpenAI's
• 15:46
  offer
• 15:47
  as
• 15:47
  a
• 15:47
  rational
• 15:47
  exit.
• 15:48
  The
• 15:48
  acquisition
• 15:48
  pattern
• 15:49
  —
• 15:49
  European
• 15:50
  AI
• 15:50
  startup
• 15:50
  gets
• 15:50
  successful,
• 15:51
  gets
• 15:51
  bought
• 15:52
  by
• 15:52
  US
• 15:52
  Big
• 15:52
  Tech
• 15:52
  —
• 15:53
  drew
• 15:53
  familiar
• 15:54
  sighs
• 15:54
  from
• 15:54
  those
• 15:54
  who
• 15:54
  have
• 15:54
  watched
• 15:55
  the
• 15:55
  same
• 15:55
  dynamic
• 15:55
  play
• 15:56
  out
• 15:56
  in
• 15:56
  gaming
• 15:56
  and
• 15:57
  enterprise
• 15:57
  software
• 15:57
  for
• 15:57
  decades.
• 15:58
  The
• 15:58
  talent
• 15:59
  dynamics
• 15:59
  beneath
• 15:59
  these
• 15:59
  acquisitions
• 16:00
  are
• 16:00
  also
• 16:00
  shifting.
• 16:01
  A
• 16:02
  thread
• 16:02
  on
• 16:02
  why
• 16:02
  top
• 16:02
  talent
• 16:03
  is
• 16:03
  walking
• 16:03
  away
• 16:03
  from
• 16:03
  OpenAI
• 16:04
  and
• 16:04
  xAI
• 16:05
  generated
• 16:05
  more
• 16:05
  heat
• 16:05
  than
• 16:05
  light,
• 16:06
  but
• 16:06
  the
• 16:06
  substantive
• 16:07
  points
• 16:07
  reduce
• 16:07
  to
• 16:07
  economics:
• 16:09
  early
• 16:09
  employees
• 16:09
  who
• 16:10
  vested
• 16:10
  shares
• 16:10
  now
• 16:10
  worth
• 16:11
  $15–20M
• 16:13
  have
• 16:13
  hit
• 16:13
  the
• 16:13
  "generational
• 16:14
  wealth"
• 16:14
  threshold
• 16:14
  where
• 16:15
  switching
• 16:15
  to
• 16:15
  lower-stress
• 16:15
  positions
• 16:16
  or
• 16:16
  semi-retirement
• 16:17
  becomes
• 16:17
  rational.
• 16:19
  For
• 16:19
  xAI
• 16:19
  specifically,
• 16:20
  commenters
• 16:21
  expressed
• 16:21
  little
• 16:21
  surprise
• 16:22
  that
• 16:22
  leadership
• 16:22
  style
• 16:23
  would
• 16:23
  drive
• 16:23
  departures,
• 16:24
  given
• 16:24
  what
• 16:24
  is
• 16:24
  "very
• 16:24
  well
• 16:25
  documented."
• 16:26
  The
• 16:26
  structural
• 16:26
  question
• 16:27
  —
• 16:27
  whether
• 16:28
  AI
• 16:28
  lab
• 16:28
  talent
• 16:28
  retention
• 16:29
  can
• 16:29
  survive
• 16:29
  the
• 16:29
  combination
• 16:30
  of
• 16:30
  massive
• 16:30
  secondary-market
• 16:31
  valuations
• 16:32
  and
• 16:32
  well-funded
• 16:33
  competitors
• 16:33
  like
• 16:33
  Google
• 16:34
  and
• 16:34
  Microsoft
• 16:34
  —
• 16:35
  matters
• 16:35
  more
• 16:36
  than
• 16:36
  any
• 16:36
  individual
• 16:36
  departure.
• 16:37
  Gene
• 16:38
  Kim
• 16:38
  announced
• 16:38
  the
• 16:39
  first
• 16:39
  Enterprise
• 16:39
  AI
• 16:40
  Summit
• 16:40
  for
• 16:40
  April
• 16:40
  9–10
• 16:41
  in
• 16:41
  San
• 16:41
  Jose,
• 16:42
  framing
• 16:42
  it
• 16:42
  as
• 16:43
  a
• 16:43
  leadership
• 16:43
  forum
• 16:43
  for
• 16:44
  the
• 16:44
  "real
• 16:44
  consequences
• 16:44
  of
• 16:45
  AI
• 16:45
  at
• 16:45
  scale."
• 16:46
  The
• 16:46
  speaker
• 16:46
  list
• 16:47
  spans
• 16:47
  OpenAI,
• 16:48
  Disney,
• 16:48
  Vanguard,
• 16:49
  Fidelity,
• 16:49
  Cisco,
• 16:50
  and
• 16:50
  NRC
• 16:50
  Health.
• 16:51
  The
• 16:51
  questions
• 16:51
  on
• 16:51
  the
• 16:52
  agenda
• 16:52
  are
• 16:52
  the
• 16:52
  ones
• 16:52
  that
• 16:52
  matter:
• 16:53
  What
• 16:53
  should
• 16:54
  teams
• 16:54
  look
• 16:54
  like
• 16:54
  when
• 16:54
  two
• 16:54
  people
• 16:55
  do
• 16:55
  the
• 16:55
  work
• 16:55
  of
• 16:55
  eight?
• 16:56
  What
• 16:56
  does
• 16:56
  code
• 16:57
  review
• 16:57
  look
• 16:57
  like
• 16:57
  when
• 16:57
  agents
• 16:58
  write
• 16:58
  the
• 16:58
  majority
• 16:58
  of
• 16:58
  code?
• 16:59
  How
• 16:59
  do
• 16:59
  you
• 17:00
  trust
• 17:00
  and
• 17:00
  secure
• 17:00
  services
• 17:01
  built
• 17:01
  at
• 17:01
  AI
• 17:01
  speed?
• 17:02
  How
• 17:02
  do
• 17:02
  you
• 17:03
  upskill
• 17:03
  thousands
• 17:03
  of
• 17:03
  developers
• 17:04
  quickly?
• 17:05
  These
• 17:05
  are
• 17:05
  the
• 17:05
  same
• 17:05
  coordination
• 17:06
  and
• 17:06
  security
• 17:06
  problems
• 17:07
  that
• 17:07
  ST-EVO,
• 17:08
  Shannon,
• 17:08
  BeadHub,
• 17:09
  and
• 17:09
  AARM
• 17:09
  are
• 17:10
  trying
• 17:10
  to
• 17:10
  solve
• 17:10
  at
• 17:10
  the
• 17:10
  technical
• 17:11
  layer
• 17:11
  —
• 17:11
  now
• 17:12
  surfacing
• 17:12
  as
• 17:12
  management
• 17:12
  problems
• 17:13
  for
• 17:13
  the
• 17:13
  enterprise.
• 17:14
  Xiaomi
• 17:14
  Robotics
• 17:14
  released
• 17:15
  Xiaomi-Robotics-0,
• 17:16
  an
• 17:16
  open-source
• 17:17
  Vision-Language-Action
• 17:18
  model
• 17:18
  with
• 17:18
  4.7B
• 17:19
  parameters
• 17:20
  for
• 17:20
  real-time
• 17:20
  robotic
• 17:20
  manipulation.
• 17:22
  It
• 17:22
  achieves
• 17:22
  98.7%
• 17:23
  average
• 17:23
  success
• 17:24
  on
• 17:24
  LIBERO
• 17:27
  and
• 17:27
  4.80
• 17:28
  average
• 17:28
  task
• 17:28
  completion
• 17:29
  length
• 17:29
  on
• 17:29
  CALVIN,
• 17:30
  deployed
• 17:30
  on
• 17:30
  the
• 17:31
  HuggingFace
• 17:31
  Transformers
• 17:31
  ecosystem
• 17:32
  with
• 17:32
  Flash
• 17:32
  Attention
• 17:33
  2
• 17:33
  and
• 17:33
  bfloat16
• 17:34
  for
• 17:34
  consumer
• 17:34
  GPUs.
• 17:36
  The
• 17:36
  model
• 17:36
  accepts
• 17:36
  multi-view
• 17:37
  camera
• 17:37
  inputs
• 17:38
  alongside
• 17:38
  proprioceptive
• 17:39
  state
• 17:39
  and
• 17:39
  generates
• 17:40
  action
• 17:40
  chunks
• 17:40
  in
• 17:40
  real
• 17:41
  time
• 17:41
  —
• 17:42
  a
• 17:42
  practical
• 17:42
  step
• 17:43
  toward
• 17:43
  robots
• 17:43
  that
• 17:43
  can
• 17:44
  reason
• 17:44
  about
• 17:44
  what
• 17:44
  they
• 17:44
  see
• 17:45
  and
• 17:45
  act
• 17:45
  on
• 17:45
  natural
• 17:46
  language
• 17:46
  instructions
• 17:46
  without
• 17:47
  cloud
• 17:47
  round-trips.