Latest / AGI Dreams – Open, Uncensored, & Local - AI News Digest / AGI Dreams Podcast – May 26, 2026

Transcript

AGI Dreams Podcast – May 26, 2026 · AGI Dreams – Open, Uncensored, & Local - AI News Digest

• 0:00
  Next.js
• 0:01
  v16.2.5
• 0:03
  dropped
• 0:03
  quietly,
• 0:04
  but
• 0:04
  the
• 0:04
  security
• 0:05
  fixes
• 0:05
  it
• 0:05
  carried
• 0:05
  were
• 0:06
  anything
• 0:06
  but
• 0:06
  quiet.
• 0:07
  A
• 0:07
  researcher
• 0:08
  reverse-engineered
• 0:09
  the
• 0:09
  commit
• 0:09
  diff
• 0:09
  between
• 0:10
  v16.2.4
• 0:12
  and
• 0:12
  v16.2.5
• 0:15
  using
• 0:15
  ProjectDiscovery's
• 0:16
  Neo
• 0:16
  tool
• 0:16
  and
• 0:17
  published
• 0:17
  proof-of-concept
• 0:18
  exploits
• 0:18
  for
• 0:18
  all
• 0:18
  twelve
• 0:19
  patched
• 0:19
  advisories.
• 0:20
  The
• 0:20
  haul
• 0:21
  includes
• 0:21
  six
• 0:21
  High-severity
• 0:22
  issues:
• 0:23
  a
• 0:23
  React
• 0:23
  server-action
• 0:24
  stream
• 0:24
  denial-of-service
• 0:26
  (CVE-2026-23870),
• 0:29
  an
• 0:29
  App
• 0:29
  Router
• 0:29
  prefetch
• 0:30
  middleware
• 0:30
  bypass
• 0:32
  (CVE-2026-44575),
• 0:34
  a
• 0:34
  next-resume
• 0:35
  connection
• 0:35
  exhaustion
• 0:36
  attack
• 0:38
  (CVE-2026-44579),
• 0:40
  a
• 0:40
  dynamic-route
• 0:41
  and
• 0:41
  middleware
• 0:41
  mismatch
• 0:43
  (CVE-2026-44574),
• 0:45
  a
• 0:45
  WebSocket
• 0:45
  upgrade
• 0:46
  SSRF
• 0:46
  affecting
• 0:47
  self-hosted
• 0:47
  deployments
• 0:49
  (CVE-2026-44578),
• 0:51
  and
• 0:51
  a
• 0:51
  Pages
• 0:52
  Router
• 0:52
  i18n
• 0:53
  data-route
• 0:53
  bypass
• 0:55
  (CVE-2026-44573).
• 0:57
  The
• 0:57
  moderate-severity
• 0:58
  items
• 0:58
  hit
• 0:59
  CSP
• 0:59
  nonce
• 0:59
  parsing,
• 1:00
  next/script
• 1:01
  XSS
• 1:02
  via
• 1:02
  beforeInteractive,
• 1:03
  an
• 1:03
  image
• 1:04
  optimizer
• 1:04
  decompression
• 1:05
  bomb,
• 1:05
  and
• 1:05
  RSC/HTML
• 1:07
  cache
• 1:08
  confusion.
• 1:09
  Two
• 1:09
  low-severity
• 1:09
  issues
• 1:10
  round
• 1:10
  it
• 1:10
  out
• 1:10
  with
• 1:10
  weak
• 1:11
  rsc
• 1:11
  cache-busting
• 1:12
  hashes
• 1:12
  and
• 1:12
  x-nextjs-data
• 1:13
  redirect
• 1:14
  cache
• 1:14
  poisoning.
• 1:15
  Each
• 1:15
  PoC
• 1:15
  directory
• 1:16
  ships
• 1:16
  a
• 1:16
  runnable
• 1:17
  exploit
• 1:17
  script
• 1:18
  plus
• 1:18
  a
• 1:18
  vulnerable
• 1:18
  minimal
• 1:19
  app
• 1:19
  for
• 1:19
  reproduction.
• 1:20
  If
• 1:20
  you
• 1:20
  run
• 1:20
  Next.js
• 1:22
  in
• 1:22
  production
• 1:22
  and
• 1:22
  haven't
• 1:22
  upgraded,
• 1:23
  the
• 1:23
  attacker
• 1:24
  surface
• 1:24
  just
• 1:24
  got
• 1:24
  a
• 1:24
  detailed
• 1:25
  instruction
• 1:25
  manual
• 1:25
  .
• 1:26
  The
• 1:26
  lesson
• 1:26
  that
• 1:27
  client-side
• 1:27
  code
• 1:27
  cannot
• 1:28
  be
• 1:28
  trusted
• 1:28
  got
• 1:28
  a
• 1:28
  painful
• 1:29
  refresher
• 1:29
  from
• 1:30
  India's
• 1:30
  Central
• 1:30
  Board
• 1:30
  of
• 1:30
  Secondary
• 1:31
  Education.
• 1:32
  A
• 1:32
  student
• 1:32
  —
• 1:33
  fresh
• 1:33
  off
• 1:33
  his
• 1:33
  own
• 1:33
  Class
• 1:34
  12
• 1:34
  exams
• 1:34
  —
• 1:35
  poked
• 1:35
  at
• 1:35
  the
• 1:35
  On-Screen
• 1:36
  Marking
• 1:36
  portal
• 1:37
  that
• 1:37
  thousands
• 1:37
  of
• 1:38
  examiners
• 1:38
  use
• 1:38
  to
• 1:38
  grade
• 1:39
  answer
• 1:39
  sheets
• 1:39
  digitally
• 1:40
  and
• 1:40
  found
• 1:40
  a
• 1:40
  catastrophe.
• 1:42
  A
• 1:42
  hardcoded
• 1:42
  master
• 1:43
  password
• 1:43
  sat
• 1:43
  in
• 1:43
  plain
• 1:44
  text
• 1:44
  inside
• 1:44
  the
• 1:44
  minified
• 1:45
  Angular
• 1:45
  bundle,
• 1:46
  bypassing
• 1:46
  OTP
• 1:47
  entirely.
• 1:48
  The
• 1:48
  OTP
• 1:49
  itself
• 1:49
  was
• 1:49
  theater:
• 1:50
  the
• 1:50
  server
• 1:51
  returned
• 1:51
  the
• 1:51
  code
• 1:51
  in
• 1:51
  the
• 1:51
  auth
• 1:52
  response,
• 1:53
  and
• 1:53
  the
• 1:53
  browser
• 1:53
  graded
• 1:53
  its
• 1:54
  own
• 1:54
  test.
• 1:55
  No
• 1:55
  route
• 1:55
  guards
• 1:55
  existed
• 1:56
  —
• 1:57
  seeding
• 1:57
  a
• 1:57
  few
• 1:57
  values
• 1:58
  into
• 1:58
  browser
• 1:58
  storage
• 1:59
  dropped
• 1:59
  you
• 1:59
  onto
• 1:59
  the
• 1:59
  dashboard
• 2:00
  without
• 2:00
  authentication.
• 2:01
  The
• 2:02
  password-change
• 2:02
  API
• 2:03
  never
• 2:03
  verified
• 2:04
  the
• 2:04
  current
• 2:04
  password,
• 2:05
  and
• 2:05
  a
• 2:05
  systemic
• 2:06
  IDOR
• 2:06
  across
• 2:06
  the
• 2:06
  entire
• 2:07
  API
• 2:07
  meant
• 2:07
  changing
• 2:08
  one
• 2:08
  ID
• 2:08
  in
• 2:08
  localStorage
• 2:09
  let
• 2:10
  you
• 2:10
  act
• 2:10
  as
• 2:10
  any
• 2:10
  user.
• 2:11
  Combined,
• 2:12
  an
• 2:12
  attacker
• 2:13
  could
• 2:13
  take
• 2:13
  over
• 2:13
  any
• 2:13
  examiner
• 2:14
  account
• 2:15
  and
• 2:15
  edit
• 2:15
  marks
• 2:15
  for
• 2:15
  a
• 2:16
  national
• 2:16
  exam
• 2:16
  affecting
• 2:17
  millions
• 2:17
  of
• 2:17
  students.
• 2:18
  The
• 2:19
  researcher
• 2:19
  reported
• 2:19
  everything
• 2:20
  to
• 2:20
  CERT-In,
• 2:21
  got
• 2:21
  a
• 2:21
  boilerplate
• 2:21
  acknowledgment,
• 2:22
  and
• 2:22
  watched
• 2:23
  the
• 2:23
  flaws
• 2:23
  sit
• 2:23
  unpatched
• 2:24
  for
• 2:24
  months
• 2:24
  .
• 2:25
  Meanwhile,
• 2:26
  scammers
• 2:27
  have
• 2:27
  been
• 2:27
  abusing
• 2:27
  Microsoft's
• 2:28
  own
• 2:28
  account-alert@accountprotection.microsoft.com
• 2:29
  address
• 2:30
  —
• 2:32
  the
• 2:32
  one
• 2:33
  used
• 2:33
  for
• 2:33
  legitimate
• 2:33
  two-factor
• 2:34
  authentication
• 2:35
  codes
• 2:35
  —
• 2:35
  to
• 2:36
  send
• 2:36
  phishing
• 2:36
  emails.
• 2:38
  Anti-spam
• 2:38
  nonprofit
• 2:39
  Spamhaus
• 2:39
  confirmed
• 2:40
  the
• 2:40
  activity
• 2:40
  has
• 2:41
  persisted
• 2:41
  for
• 2:41
  months,
• 2:42
  noting
• 2:42
  that
• 2:42
  "automated
• 2:43
  notification
• 2:43
  systems
• 2:44
  should
• 2:44
  not
• 2:44
  allow
• 2:45
  this
• 2:45
  level
• 2:45
  of
• 2:45
  customization."
• 2:47
  Microsoft
• 2:47
  acknowledged
• 2:48
  the
• 2:48
  issue
• 2:48
  after
• 2:48
  TechCrunch's
• 2:49
  inquiry
• 2:49
  and
• 2:49
  says
• 2:50
  it
• 2:50
  is
• 2:50
  "actively
• 2:50
  investigating,"
• 2:51
  but
• 2:51
  the
• 2:51
  loophole
• 2:52
  remains
• 2:52
  open
• 2:52
  .
• 2:55
  The
• 2:55
  Gpt-Agreement-Payment
• 2:56
  repository
• 2:57
  —
• 2:58
  an
• 2:58
  end-to-end
• 2:59
  replay
• 2:59
  tool
• 2:59
  for
• 2:59
  obtaining
• 3:00
  ChatGPT
• 3:00
  Plus
• 3:01
  and
• 3:01
  Team
• 3:01
  subscriptions
• 3:02
  through
• 3:02
  automated
• 3:02
  Stripe,
• 3:03
  PayPal,
• 3:04
  GoPay,
• 3:04
  and
• 3:04
  QRIS
• 3:04
  billing
• 3:05
  agreement
• 3:05
  flows
• 3:05
  —
• 3:06
  has
• 3:06
  matured
• 3:07
  considerably
• 3:07
  since
• 3:07
  it
• 3:08
  first
• 3:08
  surfaced.
• 3:09
  The
• 3:09
  project
• 3:09
  now
• 3:10
  ships
• 3:10
  a
• 3:10
  Docker-based
• 3:11
  WebUI
• 3:11
  with
• 3:11
  a
• 3:11
  14-step
• 3:12
  configuration
• 3:12
  wizard,
• 3:13
  N-worker
• 3:14
  concurrency
• 3:14
  with
• 3:14
  advisory-lock
• 3:15
  mutual
• 3:15
  exclusion
• 3:16
  for
• 3:16
  OTP
• 3:16
  stages,
• 3:17
  and
• 3:17
  a
• 3:17
  12-path
• 3:18
  self-healing
• 3:19
  daemon
• 3:19
  designed
• 3:19
  for
• 3:19
  weeks
• 3:19
  of
• 3:20
  unattended
• 3:20
  operation.
• 3:22
  The
• 3:22
  hCaptcha
• 3:22
  visual
• 3:23
  solver
• 3:23
  alone
• 3:23
  runs
• 3:23
  roughly
• 3:24
  4,000
• 3:24
  lines
• 3:25
  covering
• 3:25
  twelve
• 3:25
  known
• 3:26
  challenge
• 3:26
  types,
• 3:27
  falling
• 3:27
  back
• 3:27
  through
• 3:27
  a
• 3:27
  VLM
• 3:28
  →
• 3:28
  CLIP
• 3:28
  →
• 3:28
  OpenCV
• 3:29
  decision
• 3:29
  ladder.
• 3:30
  A
• 3:30
  PayPal
• 3:31
  guest
• 3:31
  checkout
• 3:32
  path
• 3:32
  using
• 3:32
  OpenAI
• 3:33
  promo
• 3:33
  campaign
• 3:33
  long-links
• 3:34
  adds
• 3:34
  a
• 3:34
  fourth
• 3:35
  payment
• 3:35
  vector
• 3:35
  alongside
• 3:36
  the
• 3:36
  original
• 3:36
  billing
• 3:36
  agreement,
• 3:37
  GoPay
• 3:38
  wallet
• 3:38
  linking,
• 3:39
  and
• 3:39
  QRIS
• 3:39
  QR-code
• 3:40
  flows.
• 3:41
  The
• 3:41
  concurrency
• 3:41
  model
• 3:42
  is
• 3:42
  particularly
• 3:42
  well-engineered:
• 3:44
  multiple
• 3:44
  workers
• 3:44
  sharing
• 3:45
  a
• 3:45
  phone
• 3:45
  pool
• 3:45
  use
• 3:46
  advisory
• 3:46
  locks
• 3:47
  to
• 3:47
  serialize
• 3:47
  only
• 3:47
  the
• 3:47
  OTP
• 3:48
  stage
• 3:49
  while
• 3:49
  running
• 3:49
  pre-
• 3:49
  and
• 3:49
  post-OTP
• 3:51
  steps
• 3:51
  fully
• 3:51
  in
• 3:51
  parallel,
• 3:52
  with
• 3:53
  database
• 3:53
  atomic
• 3:53
  claims
• 3:54
  preventing
• 3:54
  double-allocation
• 3:55
  of
• 3:55
  promo
• 3:56
  links
• 3:56
  or
• 3:56
  inventory
• 3:57
  emails.
• 3:58
  What
• 3:58
  makes
• 3:58
  this
• 3:58
  more
• 3:59
  than
• 3:59
  a
• 3:59
  script
• 3:59
  kiddie
• 3:59
  toolkit
• 4:00
  is
• 4:00
  the
• 4:00
  anti-fraud
• 4:01
  research
• 4:01
  documentation.
• 4:02
  The
• 4:03
  author
• 4:03
  reports
• 4:03
  that
• 4:03
  batch-created
• 4:04
  accounts
• 4:05
  show
• 4:05
  approximately
• 4:06
  2%
• 4:06
  next-day
• 4:07
  survival.
• 4:08
  OpenAI's
• 4:08
  defenses
• 4:09
  operate
• 4:09
  on
• 4:09
  at
• 4:09
  least
• 4:09
  two
• 4:10
  layers:
• 4:11
  a
• 4:11
  probe
• 4:11
  layer
• 4:11
  that
• 4:11
  detects
• 4:12
  fraud
• 4:12
  signals
• 4:12
  (IP
• 4:13
  string-level
• 4:14
  fingerprinting,
• 4:15
  batch
• 4:15
  correlation
• 4:15
  across
• 4:16
  account
• 4:16
  creation
• 4:16
  timestamps,
• 4:17
  Stripe
• 4:18
  runtime
• 4:18
  fingerprint
• 4:19
  drift)
• 4:19
  and
• 4:19
  a
• 4:19
  separate
• 4:20
  ban
• 4:20
  layer
• 4:20
  that
• 4:21
  acts
• 4:21
  on
• 4:21
  delayed
• 4:21
  schedules,
• 4:22
  catching
• 4:22
  clusters
• 4:23
  that
• 4:23
  real-time
• 4:24
  blocking
• 4:24
  misses.
• 4:25
  The
• 4:25
  runtime.version
• 4:26
  and
• 4:26
  js
• 4:27
  checksum
• 4:27
  fields
• 4:27
  in
• 4:27
  Stripe's
• 4:28
  client-side
• 4:28
  telemetry
• 4:29
  drift
• 4:29
  every
• 4:29
  few
• 4:30
  weeks
• 4:30
  and
• 4:30
  require
• 4:31
  manual
• 4:31
  re-alignment
• 4:31
  —
• 4:33
  a
• 4:33
  moving
• 4:33
  target
• 4:33
  that
• 4:34
  makes
• 4:34
  fully
• 4:34
  automated
• 4:35
  fraud
• 4:35
  unsustainable
• 4:36
  at
• 4:36
  scale.
• 4:37
  The
• 4:37
  repo
• 4:37
  is
• 4:38
  explicitly
• 4:38
  positioned
• 4:39
  for
• 4:39
  CTF,
• 4:40
  bug
• 4:40
  bounty,
• 4:41
  and
• 4:41
  authorized
• 4:41
  security
• 4:42
  research;
• 4:43
  the
• 4:43
  author's
• 4:43
  own
• 4:43
  data
• 4:44
  demonstrates
• 4:44
  why
• 4:45
  the
• 4:45
  economics
• 4:45
  of
• 4:45
  subscription
• 4:46
  fraud
• 4:47
  don't
• 4:47
  pencil
• 4:47
  out
• 4:47
  for
• 4:47
  actual
• 4:48
  criminals.
• 4:49
  That
• 4:49
  2%
• 4:50
  survival
• 4:50
  rate
• 4:50
  is
• 4:51
  the
• 4:51
  anti-fraud
• 4:51
  system
• 4:52
  working
• 4:52
  as
• 4:52
  designed
• 4:53
  .
• 4:56
  A
• 4:56
  new
• 4:56
  research
• 4:56
  paper
• 4:56
  from
• 4:57
  the
• 4:57
  Austrian
• 4:57
  Institute
• 4:58
  of
• 4:58
  Technology
• 4:59
  introduces
• 4:59
  CAM-LDS,
• 5:01
  the
• 5:01
  Cyber
• 5:01
  Attack
• 5:02
  Manifestation
• 5:02
  Log
• 5:02
  Data
• 5:03
  Set
• 5:03
  —
• 5:03
  a
• 5:03
  purpose-built
• 5:04
  benchmark
• 5:04
  for
• 5:04
  testing
• 5:05
  whether
• 5:05
  LLMs
• 5:06
  can
• 5:06
  interpret
• 5:06
  security
• 5:07
  logs.
• 5:07
  The
• 5:08
  dataset
• 5:08
  covers
• 5:08
  seven
• 5:09
  fully
• 5:09
  scripted
• 5:09
  attack
• 5:10
  scenarios
• 5:10
  executing
• 5:11
  81
• 5:11
  distinct
• 5:12
  MITRE
• 5:12
  ATT&CK
• 5:14
  techniques
• 5:15
  across
• 5:15
  13
• 5:15
  tactics,
• 5:16
  collected
• 5:17
  from
• 5:17
  18
• 5:17
  log
• 5:17
  sources
• 5:18
  in
• 5:18
  a
• 5:18
  reproducible
• 5:18
  Linux
• 5:19
  environment.
• 5:20
  Unlike
• 5:20
  red-team
• 5:21
  exercise
• 5:21
  datasets
• 5:22
  where
• 5:22
  labeling
• 5:22
  is
• 5:22
  noisy
• 5:23
  and
• 5:23
  human
• 5:23
  error
• 5:23
  is
• 5:23
  common,
• 5:24
  CAM-LDS
• 5:25
  uses
• 5:26
  AttackMate
• 5:26
  playbooks
• 5:27
  for
• 5:27
  deterministic,
• 5:28
  repeatable
• 5:28
  execution
• 5:29
  with
• 5:29
  keystroke-level
• 5:29
  realism.
• 5:31
  The
• 5:31
  scenarios
• 5:31
  span
• 5:32
  video
• 5:32
  server
• 5:32
  exploitation,
• 5:33
  Linux
• 5:34
  malware
• 5:34
  deployment,
• 5:35
  lateral
• 5:35
  movement,
• 5:36
  network
• 5:36
  attacks,
• 5:37
  credential
• 5:37
  sniffing,
• 5:38
  client-side
• 5:38
  social
• 5:39
  engineering,
• 5:40
  and
• 5:40
  Docker
• 5:40
  container
• 5:40
  escape
• 5:41
  —
• 5:41
  covering
• 5:42
  the
• 5:42
  full
• 5:42
  kill
• 5:42
  chain
• 5:43
  from
• 5:43
  reconnaissance
• 5:43
  through
• 5:43
  exfiltration
• 5:44
  and
• 5:44
  impact.
• 5:45
  The
• 5:45
  paper's
• 5:46
  analysis
• 5:46
  of
• 5:46
  how
• 5:46
  attacks
• 5:47
  manifest
• 5:47
  in
• 5:47
  logs
• 5:48
  reveals
• 5:48
  sobering
• 5:48
  numbers.
• 5:50
  Of
• 5:50
  243
• 5:51
  attack
• 5:51
  steps,
• 5:52
  47.3%
• 5:54
  leave
• 5:54
  explicit
• 5:54
  command
• 5:55
  traces
• 5:55
  in
• 5:55
  audit
• 5:56
  logs
• 5:56
  and
• 5:56
  17.3%
• 5:58
  show
• 5:58
  indicators
• 5:58
  in
• 5:58
  other
• 5:59
  log
• 5:59
  sources,
• 6:00
  but
• 6:00
  32.1%
• 6:02
  produce
• 6:02
  events
• 6:02
  that
• 6:02
  don't
• 6:03
  directly
• 6:03
  reference
• 6:04
  the
• 6:04
  executed
• 6:04
  command,
• 6:05
  and
• 6:05
  18.5%
• 6:07
  leave
• 6:07
  no
• 6:08
  observable
• 6:08
  traces
• 6:09
  at
• 6:09
  all
• 6:09
  after
• 6:09
  filtering.
• 6:10
  Signature-based
• 6:11
  IDS
• 6:12
  (Wazuh
• 6:12
  and
• 6:13
  Suricata
• 6:13
  with
• 6:13
  default
• 6:14
  rules)
• 6:15
  detected
• 6:15
  only
• 6:15
  43
• 6:16
  of
• 6:16
  198
• 6:17
  log-producing
• 6:18
  attack
• 6:18
  steps
• 6:18
  at
• 6:18
  Low-High
• 6:19
  severity.
• 6:20
  The
• 6:20
  illustrative
• 6:21
  LLM
• 6:21
  evaluation
• 6:22
  using
• 6:22
  ChatGPT
• 6:23
  5.2
• 6:24
  in
• 6:24
  a
• 6:24
  zero-shot
• 6:25
  setting
• 6:25
  is
• 6:26
  where
• 6:26
  it
• 6:26
  gets
• 6:26
  interesting:
• 6:27
  correct
• 6:28
  MITRE
• 6:28
  ATT&CK
• 6:31
  techniques
• 6:32
  appeared
• 6:32
  in
• 6:32
  the
• 6:33
  top
• 6:33
  prediction
• 6:33
  for
• 6:33
  roughly
• 6:34
  one-third
• 6:34
  of
• 6:34
  attack
• 6:35
  steps,
• 6:35
  and
• 6:36
  within
• 6:36
  the
• 6:36
  top-10
• 6:36
  predictions
• 6:37
  for
• 6:37
  another
• 6:37
  third.
• 6:38
  Classification
• 6:39
  accuracy
• 6:39
  correlated
• 6:40
  strongly
• 6:40
  with
• 6:41
  command
• 6:41
  observability,
• 6:42
  high
• 6:42
  event
• 6:42
  frequencies,
• 6:43
  and
• 6:43
  the
• 6:43
  presence
• 6:44
  of
• 6:44
  IDS
• 6:44
  alerts.
• 6:45
  The
• 6:45
  bottom
• 6:46
  third
• 6:46
  —
• 6:47
  subtle
• 6:47
  attack
• 6:48
  steps
• 6:48
  with
• 6:48
  indirect
• 6:49
  manifestations
• 6:49
  —
• 6:50
  remained
• 6:50
  largely
• 6:51
  opaque
• 6:51
  to
• 6:51
  the
• 6:51
  model.
• 6:52
  The
• 6:53
  dataset,
• 6:53
  infrastructure,
• 6:54
  attack
• 6:55
  scripts,
• 6:55
  and
• 6:55
  prompts
• 6:56
  are
• 6:56
  all
• 6:56
  open-source
• 6:57
  .
• 6:58
  On
• 6:58
  the
• 6:58
  offensive
• 6:58
  tooling
• 6:59
  side,
• 6:59
  goLoL
• 7:00
  is
• 7:00
  a
• 7:00
  new
• 7:00
  Go-based
• 7:01
  Windows
• 7:01
  scanner
• 7:02
  that
• 7:02
  pulls
• 7:02
  the
• 7:02
  latest
• 7:03
  LOLBAS
• 7:05
  (Living
• 7:06
  Off
• 7:07
  The
• 7:07
  Land
• 7:07
  Binaries
• 7:08
  and
• 7:08
  Scripts)
• 7:08
  catalog,
• 7:10
  resolves
• 7:10
  which
• 7:10
  binaries
• 7:11
  actually
• 7:11
  exist
• 7:12
  on
• 7:12
  the
• 7:12
  local
• 7:12
  filesystem,
• 7:13
  and
• 7:13
  filters
• 7:14
  techniques
• 7:15
  by
• 7:15
  the
• 7:15
  current
• 7:15
  privilege
• 7:16
  tier
• 7:16
  —
• 7:17
  standard
• 7:17
  user,
• 7:18
  administrator,
• 7:19
  or
• 7:19
  SYSTEM.
• 7:20
  It
• 7:20
  maps
• 7:21
  each
• 7:21
  technique
• 7:21
  to
• 7:21
  MITRE
• 7:22
  ATT&CK
• 7:24
  IDs
• 7:26
  with
• 7:26
  example
• 7:26
  commands,
• 7:27
  providing
• 7:27
  a
• 7:27
  privilege-aware
• 7:28
  attack
• 7:28
  surface
• 7:29
  inventory
• 7:29
  in
• 7:30
  a
• 7:30
  single
• 7:30
  scan
• 7:30
  .
• 7:31
  And
• 7:31
  for
• 7:32
  the
• 7:32
  reverse
• 7:32
  engineering
• 7:33
  crowd,
• 7:33
  Oxidizer
• 7:34
  has
• 7:34
  merged
• 7:34
  into
• 7:35
  the
• 7:35
  angr
• 7:35
  decompiler
• 7:36
  framework
• 7:37
  as
• 7:37
  the
• 7:37
  first
• 7:37
  decompiler
• 7:38
  that
• 7:38
  actually
• 7:38
  understands
• 7:39
  Rust
• 7:39
  —
• 7:40
  not
• 7:40
  C-with-Rust-syntax,
• 7:42
  but
• 7:42
  real
• 7:42
  Rust
• 7:43
  with
• 7:43
  drop
• 7:43
  in
• 7:43
  place,
• 7:44
  Option,
• 7:45
  bounds
• 7:45
  checks,
• 7:46
  and
• 7:46
  Result
• 7:46
  E>
• 7:46
  recovery
• 7:47
  through
• 7:47
  a
• 7:47
  pipeline
• 7:48
  of
• 7:48
  FLIRT-based
• 7:48
  compiler
• 7:49
  fingerprinting,
• 7:50
  fCFG
• 7:51
  simplification,
• 7:52
  Retypd
• 7:52
  type
• 7:53
  inference,
• 7:53
  and
• 7:53
  high-level
• 7:54
  Rust
• 7:54
  pseudocode
• 7:55
  output
• 7:57
  A
• 7:57
  sweeping
• 7:58
  30-page
• 7:58
  survey
• 7:59
  from
• 7:59
  UIUC,
• 8:00
  Meta,
• 8:00
  and
• 8:01
  Stanford
• 8:01
  frames
• 8:01
  the
• 8:01
  shift
• 8:02
  that
• 8:02
  practitioners
• 8:02
  are
• 8:02
  living
• 8:03
  through:
• 8:03
  code
• 8:04
  is
• 8:04
  no
• 8:04
  longer
• 8:04
  just
• 8:04
  what
• 8:04
  agents
• 8:05
  produce
• 8:05
  —
• 8:06
  it
• 8:06
  is
• 8:06
  the
• 8:06
  operational
• 8:07
  substrate
• 8:07
  through
• 8:07
  which
• 8:07
  they
• 8:08
  reason,
• 8:08
  act,
• 8:08
  and
• 8:08
  verify.
• 8:09
  The
• 8:10
  paper
• 8:10
  introduces
• 8:10
  "code
• 8:11
  as
• 8:11
  agent
• 8:11
  harness,"
• 8:12
  organizing
• 8:12
  the
• 8:12
  landscape
• 8:13
  into
• 8:13
  three
• 8:13
  layers:
• 8:14
  the
• 8:14
  harness
• 8:14
  interface
• 8:15
  (code
• 8:16
  for
• 8:16
  reasoning,
• 8:17
  action,
• 8:17
  and
• 8:17
  environment
• 8:18
  modeling),
• 8:19
  harness
• 8:19
  mechanisms
• 8:20
  (planning,
• 8:21
  memory,
• 8:22
  tool
• 8:22
  use,
• 8:23
  feedback-driven
• 8:24
  control),
• 8:25
  and
• 8:25
  scaling
• 8:25
  the
• 8:25
  harness
• 8:26
  across
• 8:26
  multi-agent
• 8:27
  systems
• 8:27
  with
• 8:27
  shared
• 8:27
  code
• 8:28
  artifacts.
• 8:29
  The
• 8:29
  taxonomy
• 8:29
  covers
• 8:30
  everything
• 8:30
  from
• 8:30
  Claude
• 8:30
  Code
• 8:31
  and
• 8:31
  Codex
• 8:31
  to
• 8:31
  embodied
• 8:32
  robots
• 8:32
  and
• 8:32
  scientific
• 8:33
  discovery
• 8:33
  pipelines,
• 8:34
  arguing
• 8:34
  that
• 8:34
  the
• 8:35
  bottleneck
• 8:35
  of
• 8:35
  autonomy
• 8:36
  is
• 8:36
  increasingly
• 8:36
  the
• 8:36
  reliability
• 8:37
  of
• 8:37
  the
• 8:37
  system
• 8:37
  connecting
• 8:38
  model
• 8:38
  outputs
• 8:38
  to
• 8:39
  long-horizon
• 8:39
  actions
• 8:39
  —
• 8:40
  not
• 8:40
  the
• 8:40
  reasoning
• 8:40
  ability
• 8:41
  of
• 8:41
  the
• 8:41
  base
• 8:41
  model
• 8:41
  itself
• 8:41
  .
• 8:42
  The
• 8:42
  practical
• 8:42
  evidence
• 8:43
  keeps
• 8:43
  stacking
• 8:43
  up.
• 8:44
  OpenAI's
• 8:45
  Codex
• 8:45
  just
• 8:46
  shipped
• 8:46
  an
• 8:46
  experimental
• 8:46
  "goals"
• 8:47
  feature
• 8:48
  that
• 8:48
  amounts
• 8:48
  to
• 8:48
  a
• 8:48
  built-in
• 8:49
  RALF
• 8:49
  loop
• 8:49
  with
• 8:49
  budget-aware
• 8:50
  graceful
• 8:50
  shutdown.
• 8:51
  Give
• 8:51
  it
• 8:51
  /goal,
• 8:52
  define
• 8:53
  completion
• 8:53
  criteria,
• 8:54
  and
• 8:54
  it
• 8:54
  runs
• 8:54
  autonomously
• 8:55
  for
• 8:55
  hours
• 8:55
  —
• 8:56
  creating
• 8:56
  assets,
• 8:57
  writing
• 8:57
  code,
• 8:58
  running
• 8:58
  Playwright
• 8:58
  verification
• 8:59
  scripts
• 8:59
  —
• 9:00
  with
• 9:00
  four
• 9:00
  exit
• 9:00
  paths
• 9:01
  depending
• 9:01
  on
• 9:01
  budget,
• 9:02
  completion
• 9:02
  state,
• 9:03
  crashes,
• 9:03
  or
• 9:04
  manual
• 9:04
  pause.
• 9:05
  One
• 9:05
  user
• 9:06
  reported
• 9:06
  a
• 9:06
  50-hour
• 9:07
  continuous
• 9:07
  run.
• 9:08
  The
• 9:08
  key
• 9:08
  differentiator
• 9:09
  over
• 9:09
  hand-rolled
• 9:10
  loops
• 9:10
  is
• 9:10
  integrated
• 9:10
  billing
• 9:11
  management:
• 9:12
  when
• 9:12
  approaching
• 9:12
  token
• 9:12
  limits,
• 9:13
  Codex
• 9:13
  injects
• 9:14
  a
• 9:14
  budget-limit
• 9:14
  markdown
• 9:15
  file
• 9:15
  and
• 9:15
  wraps
• 9:15
  up
• 9:15
  gracefully
• 9:16
  with
• 9:16
  a
• 9:16
  status
• 9:16
  report
• 9:17
  rather
• 9:17
  than
• 9:17
  simply
• 9:17
  dying
• 9:18
  .
• 9:19
  A
• 9:19
  practitioner
• 9:19
  running
• 9:20
  a
• 9:20
  fully
• 9:20
  local
• 9:20
  agent
• 9:21
  stack
• 9:21
  on
• 9:21
  DGX
• 9:21
  Spark
• 9:22
  +
• 9:22
  Mac
• 9:22
  Mini
• 9:22
  +
• 9:24
  A5000
• 9:25
  hardware
• 9:25
  offers
• 9:26
  the
• 9:26
  field
• 9:26
  report
• 9:26
  that
• 9:27
  crystallizes
• 9:27
  why
• 9:27
  harness
• 9:28
  engineering
• 9:28
  matters
• 9:28
  more
• 9:29
  than
• 9:29
  model
• 9:29
  selection.
• 9:30
  The
• 9:31
  single
• 9:31
  biggest
• 9:31
  win:
• 9:32
  stop
• 9:32
  giving
• 9:32
  local
• 9:33
  models
• 9:33
  39
• 9:34
  tools.
• 9:35
  A
• 9:35
  fast
• 9:35
  router
• 9:35
  model
• 9:37
  (phi4:14b,
• 9:38
  ~50ms)
• 9:40
  classifies
• 9:40
  intent
• 9:41
  and
• 9:41
  routes
• 9:41
  to
• 9:41
  specialists
• 9:42
  that
• 9:42
  see
• 9:42
  only
• 9:42
  3-6
• 9:43
  relevant
• 9:43
  tools
• 9:43
  each.
• 9:45
  Most
• 9:45
  pipelines
• 9:45
  use
• 9:45
  deterministic
• 9:46
  code-controlled
• 9:47
  workflows
• 9:47
  —
• 9:48
  not
• 9:48
  ReAct
• 9:48
  loops
• 9:49
  —
• 9:49
  where
• 9:50
  the
• 9:50
  model
• 9:50
  only
• 9:50
  extracts
• 9:51
  parameters
• 9:51
  and
• 9:51
  synthesizes
• 9:52
  text.
• 9:53
  A
• 9:53
  30B
• 9:53
  model
• 9:54
  choosing
• 9:54
  between
• 9:54
  6
• 9:55
  tools
• 9:55
  is
• 9:55
  reliable;
• 9:56
  the
• 9:56
  same
• 9:56
  model
• 9:57
  choosing
• 9:57
  between
• 9:57
  39
• 9:58
  "wanders,
• 9:59
  picks
• 9:59
  wrong
• 9:59
  tools,
• 10:00
  and
• 10:00
  burns
• 10:00
  iterations."
• 10:01
  Memory
• 10:01
  moved
• 10:02
  from
• 10:02
  flat
• 10:02
  JSONL
• 10:03
  (which
• 10:03
  accumulated
• 10:04
  14
• 10:04
  near-duplicate
• 10:05
  facts)
• 10:06
  to
• 10:06
  FalkorDB
• 10:07
  with
• 10:07
  a
• 10:07
  graph
• 10:07
  schema
• 10:08
  featuring
• 10:08
  SUPERSEDES
• 10:09
  chains
• 10:09
  for
• 10:09
  fact
• 10:10
  evolution
• 10:10
  .
• 10:11
  DeepSeek
• 10:11
  Reasonix
• 10:12
  takes
• 10:12
  a
• 10:12
  different
• 10:13
  but
• 10:13
  complementary
• 10:13
  approach:
• 10:14
  an
• 10:14
  append-only,
• 10:16
  cache-first
• 10:16
  coding
• 10:17
  agent
• 10:17
  loop
• 10:17
  engineered
• 10:18
  specifically
• 10:18
  around
• 10:18
  DeepSeek's
• 10:19
  byte-stable
• 10:19
  prefix
• 10:20
  cache.
• 10:21
  By
• 10:21
  never
• 10:22
  reordering
• 10:22
  or
• 10:22
  compacting
• 10:23
  message
• 10:23
  history,
• 10:24
  long
• 10:24
  sessions
• 10:25
  hold
• 10:25
  90%+
• 10:26
  cache
• 10:26
  hit
• 10:26
  rates
• 10:26
  and
• 10:27
  input-token
• 10:27
  cost
• 10:28
  collapses
• 10:28
  to
• 10:28
  roughly
• 10:29
  one-fifth
• 10:29
  of
• 10:29
  standard
• 10:30
  pricing.
• 10:31
  It
• 10:31
  supports
• 10:32
  Model
• 10:32
  Context
• 10:32
  Protocol
• 10:33
  (MCP)
• 10:34
  servers
• 10:35
  via
• 10:35
  one-line
• 10:35
  mount
• 10:36
  and
• 10:36
  sandboxes
• 10:36
  all
• 10:37
  tools
• 10:37
  to
• 10:37
  the
• 10:37
  launch
• 10:37
  directory
• 10:38
  .
• 10:38
  Archon
• 10:39
  extends
• 10:39
  the
• 10:39
  integration
• 10:40
  surface
• 10:40
  by
• 10:40
  adding
• 10:41
  a
• 10:41
  Jira
• 10:41
  adapter
• 10:41
  —
• 10:42
  comment
• 10:42
  in
• 10:42
  a
• 10:42
  ticket,
• 10:43
  get
• 10:43
  real-time
• 10:44
  AI
• 10:44
  agent
• 10:45
  responses
• 10:45
  —
• 10:46
  joining
• 10:46
  existing
• 10:46
  adapters
• 10:47
  for
• 10:47
  GitHub,
• 10:48
  Slack,
• 10:48
  Discord,
• 10:49
  and
• 10:49
  Telegram
• 10:49
  .
• 10:50
  A
• 10:50
  merged
• 10:51
  PR
• 10:51
  in
• 10:51
  llama.cpp
• 10:53
  addresses
• 10:54
  a
• 10:54
  pain
• 10:54
  point
• 10:54
  anyone
• 10:55
  doing
• 10:55
  local
• 10:55
  agentic
• 10:56
  coding
• 10:56
  has
• 10:56
  hit:
• 10:57
  context
• 10:57
  reprocessing.
• 10:59
  Tools
• 10:59
  like
• 10:59
  opencode
• 11:00
  rewrite
• 11:00
  conversation
• 11:01
  history
• 11:01
  to
• 11:02
  optimize
• 11:02
  context,
• 11:03
  forcing
• 11:04
  llama.cpp
• 11:06
  to
• 11:06
  reprocess
• 11:06
  the
• 11:06
  entire
• 11:07
  prompt
• 11:07
  (potentially
• 11:08
  70k
• 11:09
  tokens).
• 11:10
  The
• 11:10
  checkpoint
• 11:11
  fix
• 11:11
  ensures
• 11:11
  that
• 11:12
  only
• 11:12
  the
• 11:12
  changed
• 11:13
  portion
• 11:13
  gets
• 11:13
  reprocessed,
• 11:14
  making
• 11:15
  local
• 11:15
  agentic
• 11:15
  coding
• 11:16
  measurably
• 11:16
  more
• 11:17
  responsive.
• 11:18
  The
• 11:18
  author
• 11:18
  reports
• 11:19
  two
• 11:19
  weeks
• 11:19
  of
• 11:19
  daily
• 11:20
  use
• 11:20
  with
• 11:20
  significant
• 11:21
  improvements
• 11:21
  .
• 11:22
  And
• 11:22
  on
• 11:22
  the
• 11:22
  human
• 11:23
  side
• 11:23
  of
• 11:23
  the
• 11:23
  harness
• 11:23
  equation,
• 11:24
  a
• 11:25
  detailed
• 11:25
  argument
• 11:25
  for
• 11:26
  evolving
• 11:26
  from
• 11:26
  "prompt
• 11:27
  engineering"
• 11:27
  to
• 11:28
  an
• 11:28
  "AI
• 11:28
  question
• 11:28
  method"
• 11:29
  makes
• 11:29
  the
• 11:29
  case
• 11:30
  that
• 11:30
  frontier
• 11:30
  models
• 11:31
  (Opus
• 11:32
  4.7,
• 11:34
  GPT-5.5)
• 11:35
  are
• 11:35
  now
• 11:35
  senior
• 11:36
  partners
• 11:36
  rather
• 11:37
  than
• 11:37
  junior
• 11:37
  ones
• 11:37
  —
• 11:38
  they
• 11:38
  need
• 11:38
  questions
• 11:39
  that
• 11:39
  convey
• 11:39
  intent
• 11:40
  with
• 11:40
  directional
• 11:40
  focus
• 11:41
  while
• 11:41
  leaving
• 11:41
  room
• 11:42
  for
• 11:42
  exploration,
• 11:43
  not
• 11:43
  step-by-step
• 11:44
  task
• 11:44
  specifications
• 11:45
  .
• 11:47
  A
• 11:47
  deep
• 11:48
  dive
• 11:48
  into
• 11:48
  Neo4j's
• 11:49
  agent-memory
• 11:50
  SDK
• 11:50
  highlights
• 11:51
  a
• 11:51
  fundamental
• 11:51
  limitation
• 11:52
  of
• 11:52
  vector
• 11:52
  indices
• 11:53
  for
• 11:53
  long-lived
• 11:53
  agents:
• 11:54
  they
• 11:54
  have
• 11:54
  no
• 11:54
  concept
• 11:55
  of
• 11:55
  identity.
• 11:56
  If
• 11:56
  "Karpathy"
• 11:57
  appears
• 11:57
  in
• 11:57
  ten
• 11:58
  documents,
• 11:59
  a
• 11:59
  vector
• 11:59
  index
• 11:59
  cannot
• 12:00
  unify
• 12:00
  those
• 12:00
  references,
• 12:01
  link
• 12:01
  them
• 12:02
  to
• 12:02
  entities,
• 12:03
  or
• 12:03
  know
• 12:03
  whether
• 12:03
  today's
• 12:04
  mention
• 12:04
  refers
• 12:04
  to
• 12:04
  the
• 12:04
  same
• 12:05
  person
• 12:05
  it
• 12:05
  embedded
• 12:05
  yesterday.
• 12:07
  The
• 12:07
  proposed
• 12:07
  fix
• 12:08
  is
• 12:08
  a
• 12:08
  three-tier
• 12:08
  graph
• 12:09
  memory
• 12:09
  system
• 12:09
  anchored
• 12:10
  to
• 12:10
  a
• 12:10
  POLE+O
• 12:10
  ontology
• 12:11
  (Person,
• 12:12
  Object,
• 12:12
  Location,
• 12:13
  Event,
• 12:14
  Organization).
• 12:15
  Short-term
• 12:16
  messages
• 12:16
  use
• 12:17
  :NEXT
• 12:17
  chains,
• 12:17
  long-term
• 12:18
  entities
• 12:18
  get
• 12:19
  deduplicated,
• 12:20
  and
• 12:20
  reasoning
• 12:20
  traces
• 12:21
  store
• 12:21
  past
• 12:21
  thought
• 12:21
  patterns
• 12:22
  for
• 12:22
  one-shot
• 12:22
  retrieval
• 12:23
  —
• 12:23
  essentially
• 12:24
  reinforcement
• 12:25
  learning
• 12:25
  at
• 12:25
  the
• 12:25
  database
• 12:25
  level.
• 12:26
  Entity
• 12:27
  extraction
• 12:27
  uses
• 12:28
  a
• 12:28
  confidence
• 12:28
  ladder:
• 12:29
  spaCy
• 12:29
  and
• 12:30
  GLiNER
• 12:30
  handle
• 12:30
  high-confidence
• 12:31
  cases,
• 12:32
  LLMs
• 12:32
  fire
• 12:33
  only
• 12:33
  on
• 12:33
  ambiguity,
• 12:34
  and
• 12:34
  an
• 12:34
  identity
• 12:35
  gate
• 12:35
  auto-merges
• 12:36
  at
• 12:36
  scores
• 12:36
  above
• 12:37
  0.95
• 12:38
  while
• 12:38
  creating
• 12:38
  pending
• 12:39
  :SAME
• 12:39
  AS
• 12:40
  edges
• 12:40
  for
• 12:40
  the
• 12:40
  0.85-0.95
• 12:44
  band.
• 12:45
  The
• 12:45
  key
• 12:45
  design
• 12:45
  principle:
• 12:46
  false
• 12:47
  merges
• 12:47
  are
• 12:47
  silent
• 12:47
  and
• 12:48
  unrecoverable,
• 12:48
  false
• 12:49
  splits
• 12:49
  are
• 12:49
  recoverable.
• 12:50
  Retrieval
• 12:51
  runs
• 12:51
  as
• 12:51
  a
• 12:51
  single
• 12:51
  Cypher
• 12:52
  query
• 12:52
  fusing
• 12:52
  vector
• 12:53
  similarity
• 12:53
  with
• 12:53
  multi-hop
• 12:54
  traversals
• 12:54
  .
• 12:55
  On
• 12:55
  the
• 12:56
  model
• 12:56
  adaptation
• 12:56
  front,
• 12:57
  an
• 12:57
  NTK-mirror
• 12:59
  dual
• 12:59
  approach
• 12:59
  claims
• 13:00
  to
• 13:00
  make
• 13:00
  fine-tuning
• 13:01
  as
• 13:01
  we
• 13:01
  know
• 13:01
  it
• 13:01
  obsolete.
• 13:02
  The
• 13:03
  core
• 13:03
  idea:
• 13:04
  one
• 13:04
  SGD
• 13:04
  step
• 13:05
  has
• 13:05
  an
• 13:05
  exact
• 13:05
  dual
• 13:06
  —
• 13:07
  a
• 13:07
  small
• 13:07
  signed
• 13:07
  controller
• 13:08
  on
• 13:08
  the
• 13:08
  forward
• 13:08
  pass
• 13:09
  that
• 13:09
  reproduces
• 13:10
  the
• 13:10
  supervised
• 13:10
  update
• 13:11
  without
• 13:11
  touching
• 13:11
  any
• 13:11
  weight.
• 13:12
  On
• 13:13
  Qwen2.5-7B
• 13:17
  plus
• 13:18
  GSM8K,
• 13:19
  a
• 13:19
  50k-scalar
• 13:20
  controller
• 13:21
  matches
• 13:21
  LoRA-r8
• 13:22
  accuracy
• 13:23
  in
• 13:23
  22
• 13:23
  seconds
• 13:23
  of
• 13:24
  fitting,
• 13:24
  infers
• 13:25
  100%
• 13:25
  faster,
• 13:26
  and
• 13:26
  forgets
• 13:27
  3.4x
• 13:27
  less
• 13:28
  (4.7pp
• 13:29
  vs
• 13:30
  16.3pp
• 13:31
  drop
• 13:31
  on
• 13:31
  held-out
• 13:32
  code
• 13:32
  generation).
• 13:33
  Each
• 13:33
  controller
• 13:34
  is
• 13:34
  a
• 13:34
  200KB
• 13:36
  file
• 13:37
  that
• 13:37
  can
• 13:37
  be
• 13:37
  retrieved
• 13:37
  at
• 13:37
  inference
• 13:38
  and
• 13:38
  installed
• 13:38
  via
• 13:39
  forward
• 13:39
  hooks
• 13:39
  with
• 13:39
  zero
• 13:40
  token
• 13:40
  overhead
• 13:40
  —
• 13:41
  no
• 13:41
  KV
• 13:42
  cache
• 13:42
  footprint,
• 13:43
  no
• 13:43
  quadratic
• 13:44
  attention
• 13:44
  cost.
• 13:45
  Two
• 13:45
  controllers
• 13:46
  trained
• 13:46
  on
• 13:46
  different
• 13:47
  tasks
• 13:47
  compose
• 13:47
  with
• 13:48
  just
• 13:48
  +0.005
• 13:50
  NLL
• 13:50
  drift,
• 13:51
  versus
• 13:51
  17%
• 13:52
  degradation
• 13:53
  under
• 13:53
  equivalent
• 13:54
  LoRA
• 13:54
  composition.
• 13:55
  The
• 13:55
  package
• 13:56
  is
• 13:56
  pip-installable
• 13:57
  and
• 13:57
  works
• 13:57
  on
• 13:57
  any
• 13:58
  Hugging
• 13:58
  Face
• 13:58
  causal
• 13:59
  LM,
• 13:59
  with
• 13:59
  a
• 14:00
  preprint
• 14:00
  promised
• 14:00
  for
• 14:01
  next
• 14:01
  week
• 14:01
  .
• 14:02
  The
• 14:02
  broader
• 14:02
  trajectory
• 14:03
  these
• 14:03
  point
• 14:03
  toward
• 14:04
  is
• 14:04
  ambient
• 14:04
  intelligence
• 14:05
  —
• 14:06
  AI
• 14:06
  systems
• 14:07
  that
• 14:07
  sense
• 14:07
  presence
• 14:07
  through
• 14:08
  walls,
• 14:08
  monitor
• 14:09
  environments
• 14:09
  passively,
• 14:10
  learn
• 14:11
  patterns
• 14:11
  continuously,
• 14:12
  and
• 14:12
  respond
• 14:13
  without
• 14:13
  cameras,
• 14:14
  cloud
• 14:14
  dependence,
• 14:15
  or
• 14:15
  constant
• 14:16
  user
• 14:16
  interaction.
• 14:17
  The
• 14:17
  framing
• 14:18
  positions
• 14:18
  this
• 14:19
  as
• 14:19
  AI
• 14:19
  escaping
• 14:20
  the
• 14:20
  screen
• 14:20
  to
• 14:20
  interact
• 14:20
  with
• 14:21
  "the
• 14:21
  invisible
• 14:22
  world
• 14:22
  that
• 14:22
  was
• 14:22
  always
• 14:23
  there
• 14:23
  waiting
• 14:23
  to
• 14:24
  become
• 14:24
  programmable"
• 14:24
  .
• 14:27
  BitCPM-CANN
• 14:30
  presents
• 14:30
  the
• 14:31
  first
• 14:31
  end-to-end
• 14:31
  1.58-bit
• 14:32
  (ternary)
• 14:33
  training
• 14:33
  system
• 14:34
  on
• 14:34
  Huawei's
• 14:34
  Ascend
• 14:35
  NPU
• 14:35
  platform,
• 14:36
  scaling
• 14:36
  up
• 14:36
  to
• 14:36
  8B
• 14:37
  parameters.
• 14:38
  Four
• 14:38
  models
• 14:39
  (0.5B
• 14:40
  through
• 14:40
  8B)
• 14:40
  were
• 14:40
  trained
• 14:41
  using
• 14:41
  quantization-aware
• 14:42
  training
• 14:42
  aligned
• 14:42
  with
• 14:43
  MiniCPM4
• 14:43
  counterparts
• 14:44
  in
• 14:44
  architecture
• 14:44
  and
• 14:44
  pre-training
• 14:45
  data.
• 14:46
  The
• 14:46
  results
• 14:46
  are
• 14:46
  striking:
• 14:47
  the
• 14:47
  1B,
• 14:48
  3B,
• 14:49
  and
• 14:49
  8B
• 14:49
  variants
• 14:50
  retain
• 14:50
  95.7%–97.2%
• 14:53
  of
• 14:53
  full-precision
• 14:54
  performance
• 14:54
  across
• 14:54
  11
• 14:55
  benchmarks
• 14:55
  spanning
• 14:56
  commonsense
• 14:56
  reasoning,
• 14:57
  domain
• 14:57
  knowledge,
• 14:57
  and
• 14:58
  mathematics.
• 14:59
  The
• 14:59
  0.5B
• 15:00
  variant
• 15:00
  retains
• 15:00
  90.1%,
• 15:02
  with
• 15:02
  the
• 15:02
  gap
• 15:02
  concentrated
• 15:03
  in
• 15:03
  mathematics
• 15:03
  —
• 15:04
  indicating
• 15:04
  that
• 15:04
  capacity,
• 15:05
  not
• 15:06
  the
• 15:06
  ternary
• 15:06
  quantizer,
• 15:07
  is
• 15:07
  the
• 15:07
  bottleneck
• 15:08
  at
• 15:08
  sub-billion
• 15:08
  scales.
• 15:09
  Training
• 15:10
  overhead
• 15:10
  is
• 15:10
  a
• 15:10
  mere
• 15:11
  4.5%
• 15:12
  (148
• 15:13
  vs.
• 15:14
  155
• 15:16
  TFLOP/s
• 15:17
  per
• 15:17
  NPU),
• 15:18
  with
• 15:18
  up
• 15:18
  to
• 15:18
  8x
• 15:19
  weight
• 15:19
  memory
• 15:19
  reduction
• 15:20
  at
• 15:20
  inference.
• 15:21
  The
• 15:21
  political
• 15:22
  subtext
• 15:22
  is
• 15:22
  hard
• 15:22
  to
• 15:22
  miss:
• 15:23
  this
• 15:23
  proves
• 15:24
  ternary
• 15:24
  training
• 15:24
  is
• 15:25
  viable
• 15:25
  as
• 15:25
  a
• 15:25
  default
• 15:26
  configuration
• 15:26
  entirely
• 15:27
  outside
• 15:27
  the
• 15:27
  CUDA
• 15:28
  ecosystem
• 15:28
  .
• 15:29
  Hugging
• 15:29
  Face's
• 15:30
  Carbon
• 15:30
  release
• 15:30
  brings
• 15:31
  modern
• 15:31
  LLM
• 15:31
  training
• 15:32
  techniques
• 15:32
  to
• 15:32
  genomics.
• 15:33
  Carbon-3B
• 15:34
  matches
• 15:35
  the
• 15:35
  current
• 15:35
  state-of-the-art
• 15:36
  (Evo2-7B)
• 15:38
  while
• 15:38
  running
• 15:38
  275x
• 15:40
  faster,
• 15:41
  using
• 15:41
  deterministic
• 15:41
  6-mer
• 15:42
  tokenization
• 15:43
  instead
• 15:43
  of
• 15:43
  BPE
• 15:44
  (which
• 15:44
  "doesn't
• 15:44
  behave
• 15:45
  well
• 15:45
  on
• 15:45
  DNA"),
• 15:46
  a
• 15:46
  factorized
• 15:46
  loss
• 15:47
  function
• 15:47
  that
• 15:48
  replaced
• 15:48
  cross-entropy
• 15:49
  mid-training
• 15:49
  to
• 15:49
  handle
• 15:50
  the
• 15:50
  fact
• 15:50
  that
• 15:50
  scoring
• 15:50
  5/6
• 15:51
  nucleotides
• 15:52
  right
• 15:52
  the
• 15:52
  same
• 15:52
  as
• 15:53
  0/6
• 15:53
  is
• 15:53
  brittle
• 15:54
  for
• 15:54
  genomic
• 15:54
  sequences,
• 15:55
  and
• 15:55
  a
• 15:55
  curated
• 15:56
  staged
• 15:56
  functional
• 15:57
  DNA
• 15:57
  +
• 15:57
  mRNA
• 15:58
  data
• 15:58
  mixture
• 15:59
  .
• 15:59
  The
• 15:59
  AI
• 15:59
  content
• 16:00
  detection
• 16:00
  arms
• 16:00
  race
• 16:01
  continues
• 16:01
  with
• 16:02
  Slop
• 16:02
  Hammer,
• 16:03
  a
• 16:03
  Chrome
• 16:03
  extension
• 16:04
  running
• 16:04
  a
• 16:04
  Qwen
• 16:04
  3.5
• 16:05
  0.8B
• 16:06
  model
• 16:06
  fine-tuned
• 16:07
  on
• 16:07
  Pangram's
• 16:07
  EditLens
• 16:08
  dataset.
• 16:09
  The
• 16:09
  model
• 16:09
  runs
• 16:09
  entirely
• 16:10
  locally
• 16:10
  in
• 16:11
  under
• 16:11
  one
• 16:11
  second
• 16:11
  on
• 16:11
  an
• 16:11
  M1
• 16:12
  MacBook,
• 16:13
  outputting
• 16:13
  probability
• 16:14
  distributions
• 16:14
  across
• 16:15
  four
• 16:15
  detection
• 16:15
  buckets
• 16:16
  rather
• 16:16
  than
• 16:16
  a
• 16:16
  single
• 16:17
  binary
• 16:17
  score.
• 16:18
  The
• 16:18
  limitations
• 16:19
  are
• 16:19
  real
• 16:20
  —
• 16:21
  GPT-5.5
• 16:22
  output
• 16:23
  already
• 16:23
  confuses
• 16:23
  it,
• 16:24
  and
• 16:24
  community
• 16:25
  testing
• 16:25
  reports
• 16:26
  abundant
• 16:26
  false
• 16:26
  positives
• 16:27
  on
• 16:27
  complex
• 16:28
  human
• 16:28
  writing
• 16:28
  —
• 16:29
  but
• 16:29
  the
• 16:29
  approach
• 16:30
  of
• 16:30
  distilling
• 16:30
  detection
• 16:31
  into
• 16:31
  a
• 16:31
  400MB
• 16:34
  local
• 16:34
  model
• 16:35
  running
• 16:35
  in
• 16:35
  a
• 16:35
  browser
• 16:36
  extension
• 16:36
  is
• 16:37
  notable
• 16:37
  for
• 16:37
  its
• 16:37
  accessibility
• 16:38
  .
• 16:39
  On
• 16:39
  the
• 16:39
  creative
• 16:39
  tooling
• 16:40
  front,
• 16:41
  a
• 16:41
  pipeline
• 16:41
  that
• 16:41
  uses
• 16:42
  LLMs
• 16:42
  as
• 16:42
  structured
• 16:43
  code
• 16:43
  compilers
• 16:43
  to
• 16:43
  generate
• 16:44
  multi-part
• 16:44
  3D
• 16:45
  objects
• 16:45
  with
• 16:45
  functional
• 16:46
  articulated
• 16:46
  parts
• 16:47
  through
• 16:47
  Blender's
• 16:47
  scene
• 16:48
  graph
• 16:48
  —
• 16:48
  exporting
• 16:49
  clean
• 16:49
  GLB
• 16:50
  files
• 16:50
  with
• 16:50
  working
• 16:50
  pivot
• 16:51
  axes
• 16:51
  instead
• 16:51
  of
• 16:51
  the
• 16:51
  monolithic
• 16:52
  mesh
• 16:52
  blobs
• 16:53
  that
• 16:53
  diffusion-based
• 16:53
  systems
• 16:54
  produce
• 16:54
  —
• 16:55
  shows
• 16:55
  what
• 16:55
  happens
• 16:56
  when
• 16:56
  you
• 16:56
  treat
• 16:56
  generation
• 16:57
  as
• 16:57
  code
• 16:57
  compilation
• 16:58
  rather
• 16:58
  than
• 16:58
  pixel
• 16:58
  prediction.
• 17:00
  Local
• 17:00
  models
• 17:00
  still
• 17:01
  hallucinate
• 17:01
  Blender's
• 17:02
  internal
• 17:02
  matrix
• 17:02
  math,
• 17:03
  but
• 17:03
  the
• 17:03
  architecture
• 17:04
  is
• 17:04
  model-agnostic
• 17:04
  .
• 17:05
  And
• 17:06
  Audiomass
• 17:06
  ships
• 17:06
  a
• 17:06
  free,
• 17:07
  open-source
• 17:07
  multitrack
• 17:08
  audio
• 17:08
  editor
• 17:09
  that
• 17:09
  runs
• 17:09
  entirely
• 17:10
  in
• 17:10
  the
• 17:10
  browser
• 17:10
  —
• 17:11
  drag,
• 17:11
  drop,
• 17:11
  cut,
• 17:12
  paste,
• 17:12
  pitch-shift,
• 17:13
  all
• 17:13
  client-side
• 17:14
  with
• 17:14
  no
• 17:14
  install
• 17:14
  and
• 17:14
  no
• 17:15
  upload
• 17:15
  .