Latest / AGI Dreams – Open, Uncensored, & Local - AI News Digest / AGI Dreams Podcast – October 02, 2026

Transcript

AGI Dreams Podcast – October 02, 2026 · AGI Dreams – Open, Uncensored, & Local - AI News Digest

• 0:00
  TypeSafe's
• 0:00
  Jev,
• 0:00
  launched
• 0:01
  September
• 0:01
  15,
• 0:02
  is
• 0:02
  a
• 0:02
  "System
• 0:02
  One"
• 0:02
  decision
• 0:03
  model:
• 0:03
  typed
• 0:04
  answers
• 0:04
  —
• 0:04
  a
• 0:05
  choice,
• 0:05
  a
• 0:05
  score,
• 0:05
  a
• 0:06
  yes/no
• 0:06
  —
• 0:07
  each
• 0:07
  with
• 0:07
  a
• 0:07
  probability,
• 0:08
  one
• 0:08
  forward
• 0:08
  pass,
• 0:09
  API-only
• 0:10
  at
• 0:10
  $0.042
• 0:11
  per
• 0:11
  million
• 0:12
  input
• 0:12
  tokens,
• 0:12
  no
• 0:12
  weights.
• 0:13
  Amazon's
• 0:14
  open
• 0:14
  challenger
• 0:14
  is
• 0:15
  Strands
• 0:15
  Decider
• 0:15
  2B,
• 0:16
  a
• 0:16
  two-billion-parameter
• 0:17
  fine-tune
• 0:17
  of
• 0:17
  Alibaba's
• 0:18
  Qwen3.5-2B
• 0:20
  under
• 0:20
  Apache
• 0:21
  2.0.
• 0:22
  AWS
• 0:23
  stripped
• 0:23
  the
• 0:24
  next-word-prediction
• 0:24
  component
• 0:25
  and
• 0:25
  grafted
• 0:25
  on
• 0:25
  a
• 0:25
  "pointer"
• 0:26
  that
• 0:26
  scores
• 0:27
  supplied
• 0:27
  options,
• 0:28
  publishing
• 0:28
  training
• 0:29
  data
• 0:29
  and
• 0:29
  scripts
• 0:29
  with
• 0:30
  the
• 0:30
  code.
• 0:31
  The
• 0:31
  demo
• 0:31
  is
• 0:31
  the
• 0:31
  point:
• 0:32
  the
• 0:32
  decider
• 0:32
  gates
• 0:33
  a
• 0:33
  weather-tool
• 0:33
  call
• 0:33
  —
• 0:34
  did
• 0:34
  the
• 0:34
  guessed
• 0:35
  city
• 0:35
  come
• 0:35
  from
• 0:35
  the
• 0:35
  user,
• 0:36
  is
• 0:36
  it
• 0:36
  too
• 0:36
  early
• 0:36
  to
• 0:36
  call
• 0:37
  —
• 0:37
  the
• 0:38
  intervention
• 0:38
  slot
• 0:38
  (proceed,
• 0:39
  deny,
• 0:39
  confirm,
• 0:40
  guide)
• 0:41
  agent
• 0:41
  frameworks
• 0:41
  expose
• 0:42
  and
• 0:42
  nothing
• 0:42
  smarter
• 0:43
  fills.
• 0:44
  The
• 0:44
  numbers
• 0:44
  are
• 0:44
  workmanlike:
• 0:45
  about
• 0:45
  72%
• 0:46
  accuracy,
• 0:47
  a
• 0:47
  0.35
• 0:48
  Brier
• 0:49
  on
• 0:49
  JevBench's
• 0:49
  public
• 0:50
  set,
• 0:50
  a
• 0:50
  106
• 0:51
  ms
• 0:52
  median
• 0:52
  on
• 0:52
  an
• 0:52
  RTX
• 0:53
  3090;
• 0:54
  the
• 0:54
  similarly
• 0:55
  sized
• 0:55
  Mapika
• 0:55
  fares
• 0:56
  better.
• 0:56
  Mapika's
• 0:57
  decider
• 0:57
  calls
• 0:58
  itself
• 0:58
  "a
• 0:58
  language
• 0:59
  model
• 0:59
  that
• 0:59
  does
• 0:59
  not
• 0:59
  generate
• 1:00
  text."
• 1:01
  Questions
• 1:01
  are
• 1:01
  typed
• 1:02
  —
• 1:02
  Choice
• 1:03
  with
• 1:03
  2–255
• 1:05
  options,
• 1:05
  Score,
• 1:06
  or
• 1:06
  Noul,
• 1:07
  the
• 1:07
  probability
• 1:08
  of
• 1:08
  yes
• 1:08
  —
• 1:08
  answered
• 1:09
  by
• 1:09
  projecting
• 1:09
  each
• 1:10
  answer
• 1:10
  slot's
• 1:10
  hidden
• 1:11
  state
• 1:11
  onto
• 1:11
  label
• 1:11
  tokens
• 1:12
  and
• 1:12
  softmaxing
• 1:13
  over
• 1:13
  the
• 1:13
  valid
• 1:13
  options:
• 1:14
  one
• 1:15
  pass,
• 1:15
  no
• 1:15
  parsing.
• 1:16
  The
• 1:16
  README
• 1:20
  is
• 1:20
  honest
• 1:20
  about
• 1:20
  limits
• 1:21
  —
• 1:21
  one
• 1:22
  pass
• 1:22
  cannot
• 1:22
  do
• 1:22
  multi-step
• 1:23
  arithmetic,
• 1:24
  calibration
• 1:24
  degrades
• 1:25
  on
• 1:25
  hard
• 1:25
  items,
• 1:26
  the
• 1:26
  label
• 1:26
  teacher
• 1:27
  agreed
• 1:27
  with
• 1:27
  only
• 1:27
  72%
• 1:28
  of
• 1:28
  its
• 1:29
  own
• 1:29
  labels
• 1:29
  —
• 1:30
  and
• 1:30
  speaks
• 1:30
  the
• 1:30
  /v1/systemone
• 1:33
  wire
• 1:33
  format.
• 1:34
  Nokia's
• 1:35
  applied
• 1:35
  research
• 1:35
  group
• 1:36
  (arXiv
• 1:37
  2610.00831)
• 1:39
  took
• 1:39
  the
• 1:39
  zero-training
• 1:40
  route:
• 1:41
  AnyJev
• 1:41
  turns
• 1:41
  any
• 1:42
  open
• 1:42
  LLM
• 1:43
  into
• 1:43
  a
• 1:43
  Jev-style
• 1:44
  decision
• 1:44
  model
• 1:44
  from
• 1:45
  one
• 1:45
  prefill
• 1:45
  of
• 1:45
  the
• 1:45
  next-token
• 1:46
  distribution.
• 1:47
  Raw
• 1:47
  logits
• 1:48
  reorder
• 1:48
  their
• 1:48
  answers
• 1:49
  and
• 1:49
  their
• 1:49
  confidence
• 1:50
  cannot
• 1:50
  be
• 1:50
  trusted;
• 1:51
  rotation
• 1:52
  averaging
• 1:52
  removes
• 1:53
  the
• 1:53
  position
• 1:53
  bias
• 1:53
  with
• 1:54
  zero
• 1:54
  labels,
• 1:55
  a
• 1:55
  few
• 1:55
  hundred
• 1:55
  buy
• 1:55
  a
• 1:55
  closed-form
• 1:56
  head
• 1:56
  that
• 1:57
  "costs
• 1:57
  less
• 1:57
  than
• 1:57
  one
• 1:58
  plain
• 1:58
  forward."
• 1:59
  On
• 1:59
  Qwen3-8B
• 2:00
  across
• 2:01
  BANKING77,
• 2:04
  order-flip
• 2:05
  rate
• 2:05
  fell
• 2:05
  from
• 2:05
  0.230
• 2:07
  to
• 2:07
  0.073
• 2:08
  —
• 2:09
  but
• 2:10
  the
• 2:10
  headline
• 2:10
  is
• 2:10
  economics:
• 2:11
  traffic
• 2:12
  safe
• 2:12
  to
• 2:12
  automate
• 2:12
  at
• 2:12
  a
• 2:13
  5%
• 2:13
  error
• 2:13
  budget
• 2:14
  went
• 2:14
  from
• 2:14
  7.7%
• 2:15
  to
• 2:15
  52.0%.
• 2:18
  The
• 2:18
  stated
• 2:18
  limit
• 2:18
  deserves
• 2:19
  repeating:
• 2:20
  "accuracy"
• 2:21
  here
• 2:21
  means
• 2:21
  agreement
• 2:22
  with
• 2:22
  a
• 2:22
  teacher
• 2:22
  LLM,
• 2:23
  not
• 2:23
  ground
• 2:23
  truth.
• 2:24
  The
• 2:24
  local
• 2:25
  stack
• 2:25
  standardizes:
• 2:26
  a
• 2:26
  merged
• 2:27
  llama.cpp
• 2:29
  pull
• 2:29
  request
• 2:29
  adds
• 2:29
  a
• 2:30
  /v1/systemone
• 2:32
  endpoint
• 2:33
  for
• 2:33
  the
• 2:33
  Jev-like
• 2:33
  GGUF
• 2:34
  zoo
• 2:34
  —
• 2:35
  laya,
• 2:35
  julia-1,
• 2:36
  lev,
• 2:36
  openjev,
• 2:37
  kev.
• 2:38
  "Now
• 2:38
  you
• 2:38
  can
• 2:38
  jev
• 2:39
  without
• 2:39
  jev,"
• 2:40
  as
• 2:40
  the
• 2:40
  PR
• 2:40
  puts
• 2:40
  it;
• 2:41
  the
• 2:41
  top
• 2:42
  comment
• 2:42
  remains
• 2:42
  "what
• 2:42
  the
• 2:43
  fuck
• 2:43
  is
• 2:43
  a
• 2:43
  jev?"
• 2:45
  Ai2's
• 2:46
  Olmo-core
• 2:46
  3
• 2:47
  is
• 2:47
  a
• 2:47
  redesigned
• 2:48
  open
• 2:48
  training
• 2:48
  stack
• 2:48
  for
• 2:48
  mixture-of-experts
• 2:49
  models
• 2:49
  —
• 2:50
  many
• 2:50
  learned
• 2:51
  components
• 2:51
  ("experts"),
• 2:52
  each
• 2:52
  token
• 2:52
  routed
• 2:53
  through
• 2:53
  only
• 2:53
  a
• 2:53
  few.
• 2:54
  Growing
• 2:54
  the
• 2:55
  expert
• 2:55
  pool
• 2:55
  from
• 2:55
  8
• 2:55
  to
• 2:55
  128
• 2:57
  while
• 2:57
  selecting
• 2:57
  four
• 2:58
  experts
• 2:58
  per
• 2:58
  token
• 2:58
  grew
• 2:59
  capacity
• 2:59
  from
• 2:59
  4.6B
• 3:00
  to
• 3:00
  47B
• 3:01
  at
• 3:01
  under
• 3:01
  5%
• 3:02
  throughput
• 3:02
  cost.
• 3:04
  A
• 3:04
  47B
• 3:05
  MoE
• 3:05
  hit
• 3:05
  52,000
• 3:06
  tokens
• 3:06
  per
• 3:07
  second
• 3:07
  per
• 3:07
  GPU
• 3:07
  on
• 3:08
  eight
• 3:08
  B300s
• 3:08
  —
• 3:09
  2.7×
• 3:09
  the
• 3:10
  earlier
• 3:10
  sharded
• 3:10
  setup
• 3:10
  —
• 3:11
  and
• 3:12
  the
• 3:12
  stack
• 3:12
  has
• 3:12
  been
• 3:12
  benchmarked
• 3:13
  at
• 3:13
  1.2
• 3:13
  trillion
• 3:14
  parameters
• 3:14
  across
• 3:14
  512
• 3:15
  GPUs.
• 3:16
  Rarer:
• 3:17
  the
• 3:17
  negative-results
• 3:18
  section
• 3:18
  —
• 3:19
  a
• 3:19
  score
• 3:19
  meant
• 3:19
  to
• 3:19
  encourage
• 3:20
  balanced
• 3:20
  routing
• 3:20
  improved
• 3:21
  while
• 3:21
  the
• 3:21
  workload
• 3:21
  became
• 3:22
  less
• 3:22
  balanced,
• 3:23
  and
• 3:23
  overlapping
• 3:23
  communication
• 3:24
  with
• 3:24
  computation
• 3:25
  sometimes
• 3:25
  made
• 3:25
  training
• 3:25
  slower.
• 3:27
  The
• 3:27
  Institute
• 3:27
  of
• 3:27
  Foundation
• 3:28
  Models
• 3:28
  released
• 3:28
  K2
• 3:29
  Horizon
• 3:29
  as
• 3:29
  a
• 3:29
  fleet
• 3:30
  of
• 3:30
  six
• 3:30
  fully
• 3:30
  open
• 3:31
  models
• 3:31
  from
• 3:32
  0.9B
• 3:32
  to
• 3:33
  375B
• 3:33
  —
• 3:34
  weights,
• 3:34
  data,
• 3:35
  recipes,
• 3:36
  code,
• 3:36
  checkpoints,
• 3:37
  logs
• 3:37
  —
• 3:38
  with
• 3:38
  an
• 3:38
  AMA
• 3:38
  on
• 3:39
  October
• 3:39
  5.
• 3:40
  Queued
• 3:41
  questions:
• 3:41
  why
• 3:41
  the
• 3:41
  data
• 3:42
  release
• 3:42
  was
• 3:42
  delayed,
• 3:42
  whether
• 3:43
  the
• 3:43
  lab
• 3:43
  is
• 3:43
  government-funded,
• 3:44
  when
• 3:44
  llama.cpp
• 3:46
  support
• 3:46
  lands,
• 3:46
  and
• 3:46
  the
• 3:46
  KV
• 3:47
  cache
• 3:47
  appetite
• 3:48
  that
• 3:48
  makes
• 3:48
  a
• 3:48
  similar-sized
• 3:49
  Qwen
• 3:49
  cheaper
• 3:49
  on
• 3:49
  lesser
• 3:50
  hardware.
• 3:51
  On
• 3:51
  methods,
• 3:51
  a
• 3:52
  UW/Meta/MIT
• 3:53
  paper
• 3:54
  introduces
• 3:54
  Context
• 3:55
  Language
• 3:55
  Models,
• 3:56
  which
• 3:56
  manage
• 3:57
  their
• 3:57
  own
• 3:57
  context
• 3:57
  as
• 3:58
  a
• 3:58
  file
• 3:58
  the
• 3:58
  model
• 3:58
  can
• 3:58
  update
• 3:59
  at
• 3:59
  will
• 3:59
  (arXiv
• 4:01
  2609.37725).
• 4:03
  Zero-shot
• 4:03
  CLMs
• 4:04
  beat
• 4:04
  state-of-the-art
• 4:05
  context
• 4:05
  management
• 4:05
  by
• 4:06
  11.4%
• 4:07
  accuracy
• 4:07
  with
• 4:07
  21.5%
• 4:08
  fewer
• 4:08
  FLOPs
• 4:09
  on
• 4:09
  BrowseComp-Plus
• 4:10
  and
• 4:11
  by
• 4:11
  65%
• 4:12
  greater
• 4:12
  improvement
• 4:12
  at
• 4:12
  equal
• 4:13
  compute
• 4:13
  on
• 4:13
  a
• 4:13
  24-hour
• 4:14
  multi-repository
• 4:15
  agent-swarm
• 4:15
  task;
• 4:16
  an
• 4:16
  online
• 4:16
  reinforcement-learning
• 4:17
  method
• 4:17
  lifted
• 4:18
  Qwen3.5-9B
• 4:20
  by
• 4:20
  47.6%
• 4:21
  on
• 4:21
  BrowseComp-Plus
• 4:22
  with
• 4:22
  12%
• 4:23
  fewer
• 4:23
  FLOPs.
• 4:24
  And
• 4:24
  an
• 4:24
  agent
• 4:24
  loop
• 4:24
  routed
• 4:25
  circles
• 4:25
  around
• 4:25
  static
• 4:25
  retrieval:
• 4:26
  PipesHub
• 4:26
  tested
• 4:27
  18
• 4:27
  RAG
• 4:27
  pipeline
• 4:28
  variants
• 4:28
  —
• 4:28
  same
• 4:29
  model,
• 4:29
  embeddings,
• 4:29
  and
• 4:29
  documents
• 4:30
  —
• 4:30
  across
• 4:30
  all
• 4:30
  824
• 4:31
  FRAMES
• 4:32
  multi-hop
• 4:32
  questions;
• 4:33
  the
• 4:33
  best
• 4:33
  pipeline
• 4:33
  hit
• 4:33
  78.9%
• 4:35
  while
• 4:35
  an
• 4:35
  agent
• 4:35
  loop
• 4:35
  that
• 4:36
  reads
• 4:36
  results
• 4:36
  and
• 4:36
  searches
• 4:37
  again
• 4:37
  hit
• 4:37
  92.7%,
• 4:39
  roughly
• 4:39
  what
• 4:39
  handing
• 4:39
  it
• 4:39
  the
• 4:39
  right
• 4:40
  articles
• 4:40
  achieves.
• 4:41
  Two
• 4:41
  findings
• 4:41
  stand
• 4:41
  out:
• 4:42
  a
• 4:42
  small
• 4:42
  reranker
• 4:43
  actively
• 4:43
  cost
• 4:43
  nine
• 4:44
  points,
• 4:44
  and
• 4:44
  models
• 4:45
  fill
• 4:45
  gaps
• 4:45
  from
• 4:45
  memory
• 4:46
  even
• 4:46
  when
• 4:46
  told
• 4:46
  to
• 4:46
  stick
• 4:46
  to
• 4:46
  the
• 4:47
  retrieved
• 4:47
  documents
• 4:47
  —
• 4:48
  answers
• 4:48
  still
• 4:48
  "full
• 4:49
  of
• 4:49
  citations."
• 4:50
  Every
• 4:50
  correct
• 4:51
  answer
• 4:51
  was
• 4:51
  checked
• 4:51
  against
• 4:52
  what
• 4:52
  the
• 4:52
  system
• 4:52
  actually
• 4:52
  read,
• 4:53
  two
• 4:53
  judges
• 4:54
  agreeing
• 4:54
  at
• 4:54
  Cohen's
• 4:54
  κ
• 4:56
  0.93–0.98.
• 4:59
  Every
• 4:59
  harness
• 5:00
  vendor
• 5:00
  pitches
• 5:01
  the
• 5:01
  same
• 5:01
  thing
• 5:01
  —
• 5:02
  models
• 5:02
  replaceable,
• 5:03
  the
• 5:03
  loop
• 5:03
  the
• 5:03
  moat
• 5:03
  —
• 5:04
  and
• 5:04
  today's
• 5:04
  batch
• 5:05
  pushes
• 5:05
  the
• 5:05
  loop
• 5:05
  onto
• 5:06
  your
• 5:06
  machine.
• 5:07
  OpenHuman,
• 5:07
  a
• 5:08
  Rust-core
• 5:08
  GPL-3.0
• 5:09
  project,
• 5:10
  was
• 5:10
  GitHub's
• 5:10
  top
• 5:11
  trending
• 5:11
  repository
• 5:11
  for
• 5:12
  nine
• 5:12
  days
• 5:12
  straight,
• 5:13
  one
• 5:13
  core
• 5:13
  driving
• 5:13
  four
• 5:14
  surfaces
• 5:14
  —
• 5:15
  Tauri
• 5:15
  desktop,
• 5:15
  browser,
• 5:16
  terminal,
• 5:16
  embeddable
• 5:17
  library
• 5:17
  —
• 5:18
  each
• 5:18
  agent
• 5:18
  with
• 5:18
  its
• 5:18
  own
• 5:18
  provider,
• 5:19
  access
• 5:19
  tier,
• 5:20
  working
• 5:20
  directory,
• 5:21
  Model
• 5:21
  Context
• 5:21
  Protocol
• 5:22
  (MCP)
• 5:22
  servers,
• 5:23
  and
• 5:23
  sandbox.
• 5:24
  The
• 5:24
  differentiator
• 5:25
  is
• 5:25
  density:
• 5:25
  agents
• 5:26
  run
• 5:26
  in-process,
• 5:27
  not
• 5:27
  as
• 5:28
  daemons,
• 5:29
  so
• 5:29
  marginal
• 5:29
  cost
• 5:29
  is
• 5:30
  about
• 5:30
  1,985
• 5:31
  KiB
• 5:32
  per
• 5:32
  additional
• 5:32
  agent
• 5:33
  at
• 5:33
  50
• 5:33
  and
• 5:33
  1,770
• 5:35
  KiB
• 5:35
  at
• 5:35
  500
• 5:36
  —
• 5:36
  25×
• 5:37
  denser
• 5:37
  than
• 5:37
  processes.
• 5:38
  Jev
• 5:39
  sits
• 5:39
  behind
• 5:39
  the
• 5:39
  project's
• 5:40
  System
• 5:40
  One
• 5:40
  proxy
• 5:40
  for
• 5:40
  tool
• 5:41
  routing,
• 5:42
  beating
• 5:42
  BM25
• 5:43
  62.0%
• 5:44
  to
• 5:44
  22.5%
• 5:45
  for
• 5:45
  top-1
• 5:45
  selection
• 5:46
  across
• 5:46
  215
• 5:47
  core
• 5:47
  tools
• 5:48
  plus
• 5:48
  1,000
• 5:49
  Composio
• 5:49
  actions;
• 5:50
  workflows
• 5:50
  flip
• 5:51
  the
• 5:51
  usual
• 5:51
  builder
• 5:51
  too
• 5:51
  —
• 5:52
  "the
• 5:52
  agent
• 5:52
  proposes
• 5:53
  the
• 5:53
  workflow;
• 5:54
  you
• 5:54
  review
• 5:54
  it
• 5:54
  on
• 5:54
  a
• 5:54
  canvas
• 5:55
  and
• 5:55
  save
• 5:55
  it."
• 5:56
  iCode,
• 5:57
  an
• 5:57
  Apache-2.0
• 5:58
  terminal
• 5:58
  agent,
• 5:59
  treats
• 5:59
  an
• 5:59
  agent
• 5:59
  as
• 6:00
  "configuration,
• 6:00
  not
• 6:01
  code"
• 6:01
  —
• 6:01
  instructions,
• 6:02
  tools,
• 6:03
  sub-agents,
• 6:03
  skills,
• 6:04
  MCP
• 6:04
  servers,
• 6:05
  and
• 6:05
  memory
• 6:05
  in
• 6:05
  one
• 6:05
  place
• 6:05
  —
• 6:06
  with
• 6:07
  a
• 6:07
  trajectory
• 6:07
  view
• 6:07
  for
• 6:07
  time
• 6:08
  and
• 6:08
  tokens
• 6:08
  per
• 6:08
  turn,
• 6:09
  per-turn
• 6:09
  rollback,
• 6:10
  and
• 6:10
  a
• 6:10
  real
• 6:10
  embedded
• 6:10
  shell.
• 6:11
  It
• 6:11
  ships
• 6:12
  no
• 6:12
  telemetry,
• 6:12
  includes
• 6:13
  no
• 6:13
  model,
• 6:13
  and
• 6:13
  puts
• 6:14
  EU
• 6:14
  AI
• 6:14
  Act
• 6:14
  obligations
• 6:15
  on
• 6:15
  the
• 6:15
  user.
• 6:16
  Overmind
• 6:16
  closes
• 6:17
  the
• 6:17
  loop
• 6:17
  from
• 6:17
  production
• 6:18
  back
• 6:18
  to
• 6:18
  training,
• 6:19
  turning
• 6:19
  OpenTelemetry
• 6:19
  traces
• 6:20
  into
• 6:20
  versioned
• 6:20
  datasets,
• 6:21
  fine-tunes
• 6:22
  benchmarked
• 6:22
  against
• 6:22
  your
• 6:22
  evals,
• 6:23
  and
• 6:23
  one
• 6:23
  inference
• 6:23
  API
• 6:24
  —
• 6:24
  "the
• 6:25
  weights
• 6:25
  are
• 6:25
  yours
• 6:25
  to
• 6:25
  download,
• 6:26
  retrain
• 6:26
  or
• 6:26
  roll
• 6:26
  back."
• 6:27
  Its
• 6:27
  MCP
• 6:28
  server
• 6:28
  exposes
• 6:29
  about
• 6:29
  30
• 6:29
  tools
• 6:30
  for
• 6:30
  Cursor,
• 6:30
  Claude
• 6:30
  Code,
• 6:31
  OpenCode,
• 6:31
  and
• 6:31
  Codex,
• 6:32
  each
• 6:32
  declaring
• 6:32
  its
• 6:32
  cost
• 6:33
  class,
• 6:33
  none
• 6:33
  able
• 6:33
  to
• 6:33
  delete
• 6:34
  anything.
• 6:34
  OnPanda,
• 6:35
  the
• 6:35
  on-Policy
• 6:36
  Alignment
• 6:36
  Data
• 6:37
  Annotator,
• 6:37
  works
• 6:37
  at
• 6:38
  the
• 6:38
  finest
• 6:38
  grain:
• 6:39
  hover
• 6:39
  a
• 6:39
  token,
• 6:40
  pick
• 6:40
  an
• 6:40
  alternative,
• 6:41
  continue
• 6:41
  —
• 6:42
  every
• 6:42
  part
• 6:42
  of
• 6:42
  the
• 6:42
  output
• 6:43
  editable,
• 6:43
  including
• 6:44
  reasoning
• 6:44
  and
• 6:44
  tool
• 6:44
  calls
• 6:45
  —
• 6:45
  a
• 6:45
  claimed
• 6:46
  52%
• 6:46
  median
• 6:47
  cut
• 6:47
  in
• 6:47
  annotation
• 6:47
  time,
• 6:48
  on-policy
• 6:48
  fidelity
• 6:49
  within
• 6:49
  1%
• 6:50
  perplexity
• 6:50
  drift.
• 6:53
  If
• 6:53
  agents
• 6:53
  are
• 6:53
  the
• 6:53
  new
• 6:54
  actors,
• 6:54
  someone
• 6:54
  must
• 6:55
  build
• 6:55
  the
• 6:55
  switchboard
• 6:56
  and
• 6:56
  write
• 6:56
  the
• 6:56
  rules.
• 6:57
  A
• 6:57
  conference
• 6:58
  pitch
• 6:58
  from
• 6:58
  Band,
• 6:58
  an
• 6:59
  agent-collaboration
• 6:59
  startup,
• 7:00
  argues
• 7:00
  that
• 7:00
  "the
• 7:00
  future
• 7:01
  belongs
• 7:01
  to
• 7:01
  AI-to-AI
• 7:02
  communication
• 7:03
  within
• 7:03
  a
• 7:03
  business,
• 7:04
  between
• 7:04
  businesses,
• 7:05
  and
• 7:05
  between
• 7:05
  consumers
• 7:06
  and
• 7:06
  businesses"
• 7:06
  —
• 7:07
  agents
• 7:07
  finding
• 7:08
  each
• 7:08
  other
• 7:08
  in
• 7:08
  self-created
• 7:09
  "conversational
• 7:09
  spaces."
• 7:10
  Its
• 7:11
  critique
• 7:11
  is
• 7:11
  specific:
• 7:13
  MCP's
• 7:13
  calling-agents-as-tools
• 7:14
  pattern
• 7:15
  is
• 7:15
  "completely
• 7:15
  stateless";
• 7:17
  A2A
• 7:17
  is
• 7:17
  client-server,
• 7:18
  so
• 7:19
  bidirectional
• 7:19
  agents
• 7:20
  must
• 7:20
  each
• 7:20
  be
• 7:20
  client
• 7:20
  and
• 7:20
  server,
• 7:21
  with
• 7:21
  discovery
• 7:22
  outside
• 7:22
  the
• 7:22
  protocol.
• 7:23
  Connecting
• 7:24
  an
• 7:24
  agent
• 7:24
  to
• 7:24
  messaging
• 7:24
  is
• 7:25
  manual
• 7:25
  —
• 7:25
  Telegram
• 7:26
  takes
• 7:26
  five
• 7:26
  steps,
• 7:27
  WhatsApp
• 7:27
  eleven
• 7:27
  —
• 7:28
  and
• 7:28
  only
• 7:28
  links
• 7:28
  an
• 7:29
  agent
• 7:29
  to
• 7:29
  a
• 7:29
  person:
• 7:30
  "Your
• 7:30
  agent
• 7:30
  is
• 7:30
  still
• 7:31
  alone...
• 7:31
  in
• 7:32
  digital
• 7:32
  solitary
• 7:32
  confinement."
• 7:34
  The
• 7:34
  hard
• 7:34
  part
• 7:34
  is
• 7:34
  stated
• 7:35
  honestly:
• 7:36
  remote
• 7:36
  multi-agent
• 7:37
  systems
• 7:37
  are
• 7:37
  "a
• 7:37
  distributed
• 7:38
  system
• 7:38
  of
• 7:38
  microservices
• 7:39
  where
• 7:39
  each
• 7:40
  microservice
• 7:40
  is
• 7:40
  non-deterministic."
• 7:42
  The
• 7:42
  internal
• 7:43
  app
• 7:43
  built
• 7:43
  on
• 7:43
  it
• 7:44
  shows
• 7:44
  the
• 7:44
  payoff:
• 7:45
  live
• 7:46
  token-spend
• 7:46
  graphs
• 7:46
  per
• 7:47
  agent
• 7:47
  ($2,000
• 7:48
  for
• 7:48
  a
• 7:48
  developer
• 7:48
  session,
• 7:49
  $600
• 7:50
  for
• 7:50
  an
• 7:50
  architect)
• 7:51
  and
• 7:51
  attribution
• 7:52
  of
• 7:52
  whether
• 7:52
  a
• 7:52
  pull
• 7:52
  request
• 7:53
  was
• 7:53
  human-
• 7:53
  or
• 7:53
  agent-written.
• 7:54
  Regulators
• 7:55
  are
• 7:55
  writing
• 7:55
  the
• 7:56
  same
• 7:56
  rules
• 7:56
  from
• 7:56
  the
• 7:56
  other
• 7:57
  end.
• 7:57
  China's
• 7:58
  TC260,
• 8:00
  under
• 8:00
  the
• 8:00
  Cyberspace
• 8:01
  Administration
• 8:01
  of
• 8:02
  China,
• 8:02
  published
• 8:03
  AI
• 8:03
  Safety
• 8:03
  Governance
• 8:04
  Framework
• 8:04
  3.0
• 8:05
  in
• 8:05
  September
• 8:05
  —
• 8:06
  a
• 8:06
  reference,
• 8:07
  not
• 8:07
  binding
• 8:07
  law.
• 8:08
  Its
• 8:08
  agentic
• 8:09
  requirements
• 8:09
  are
• 8:09
  concrete:
• 8:10
  unique
• 8:11
  identity
• 8:11
  credentials
• 8:12
  and
• 8:12
  least-privilege
• 8:12
  permissions,
• 8:13
  human
• 8:14
  approval
• 8:14
  at
• 8:14
  critical
• 8:15
  decision
• 8:15
  nodes
• 8:15
  defaulting
• 8:16
  to
• 8:16
  denial
• 8:16
  on
• 8:16
  failure,
• 8:17
  red-team
• 8:18
  testing,
• 8:19
  rollback
• 8:19
  for
• 8:19
  commercial
• 8:20
  versions,
• 8:21
  AI-content
• 8:21
  labeling,
• 8:22
  six-month
• 8:23
  logs,
• 8:23
  prompt
• 8:24
  incident
• 8:24
  reporting.
• 8:25
  Warnings
• 8:25
  include
• 8:26
  models
• 8:26
  refusing
• 8:27
  shutdown,
• 8:27
  sandbagging
• 8:28
  evaluations,
• 8:29
  autonomously
• 8:30
  hacking
• 8:30
  external
• 8:31
  systems
• 8:31
  —
• 8:32
  under
• 8:32
  a
• 8:33
  first
• 8:33
  principle
• 8:33
  of
• 8:33
  "human
• 8:34
  ultimate
• 8:34
  control."
• 8:35
  Finance
• 8:36
  is
• 8:36
  where
• 8:36
  it
• 8:36
  gets
• 8:36
  literal.
• 8:37
  Bradley
• 8:38
  Leimer's
• 8:38
  "Blood
• 8:39
  Again,"
• 8:39
  revisiting
• 8:40
  his
• 8:40
  2013
• 8:41
  "There
• 8:41
  Will
• 8:41
  Be
• 8:42
  Blood,"
• 8:42
  argues
• 8:43
  the
• 8:43
  fight
• 8:43
  has
• 8:43
  moved
• 8:43
  from
• 8:44
  being
• 8:44
  the
• 8:44
  customer's
• 8:44
  Primary
• 8:45
  Financial
• 8:45
  Institution
• 8:46
  to
• 8:46
  their
• 8:46
  Primary
• 8:47
  Financial
• 8:47
  Agent.
• 8:48
  Transaction
• 8:49
  friction
• 8:49
  is
• 8:49
  dead;
• 8:50
  the
• 8:50
  remaining
• 8:51
  prize
• 8:51
  is
• 8:51
  decision
• 8:51
  friction,
• 8:52
  and
• 8:52
  an
• 8:53
  agent
• 8:53
  "doesn't
• 8:53
  need
• 8:53
  Saturday
• 8:54
  afternoon
• 8:54
  to
• 8:54
  research
• 8:55
  five
• 8:55
  savings
• 8:55
  accounts"
• 8:56
  —
• 8:56
  it
• 8:57
  can
• 8:57
  do
• 8:57
  it
• 8:57
  every
• 8:57
  morning.
• 8:58
  The
• 8:58
  line
• 8:58
  worth
• 8:59
  framing:
• 8:59
  "I
• 8:59
  don't
• 9:00
  want
• 9:00
  your
• 9:00
  agent.
• 9:01
  I
• 9:01
  want
• 9:01
  my
• 9:01
  agent
• 9:01
  to
• 9:01
  use
• 9:02
  your
• 9:02
  thing."
• 9:03
  Banks
• 9:03
  keep
• 9:03
  balance
• 9:04
  sheets,
• 9:04
  trust,
• 9:05
  and
• 9:05
  context
• 9:05
  —
• 9:06
  but
• 9:06
  when
• 9:06
  an
• 9:06
  agent
• 9:07
  acting
• 9:07
  in
• 9:07
  the
• 9:07
  customer's
• 9:08
  interest
• 9:08
  surfaces
• 9:08
  avoidable
• 9:09
  fees
• 9:09
  and
• 9:09
  better
• 9:09
  rates,
• 9:10
  customer
• 9:11
  centricity
• 9:11
  becomes
• 9:11
  an
• 9:11
  operating
• 9:12
  requirement.
• 9:15
  Today's
• 9:15
  most
• 9:16
  disciplined
• 9:16
  security
• 9:17
  writing:
• 9:17
  IOActive's
• 9:18
  account
• 9:18
  of
• 9:18
  finding
• 9:18
  real
• 9:19
  bugs
• 9:19
  with
• 9:19
  code-reasoning
• 9:20
  models
• 9:20
  —
• 9:20
  two
• 9:21
  HIGH-severity
• 9:21
  Angular
• 9:22
  CVEs,
• 9:22
  both
• 9:23
  patched
• 9:23
  upstream.
• 9:24
  The
• 9:24
  methodology:
• 9:25
  asking
• 9:25
  a
• 9:25
  model
• 9:26
  to
• 9:26
  "find
• 9:26
  all
• 9:26
  vulnerabilities"
• 9:27
  fails,
• 9:27
  returning
• 9:28
  plausible
• 9:28
  patterns
• 9:28
  with
• 9:29
  no
• 9:29
  notion
• 9:29
  of
• 9:29
  reachability.
• 9:30
  What
• 9:30
  works
• 9:30
  is
• 9:31
  building
• 9:31
  the
• 9:31
  threat
• 9:31
  model
• 9:31
  yourself,
• 9:32
  from
• 9:32
  advisories
• 9:33
  and
• 9:33
  patch
• 9:33
  diffs,
• 9:34
  distilling
• 9:34
  invariants
• 9:34
  —
• 9:35
  one-sentence
• 9:35
  rules
• 9:36
  the
• 9:36
  code
• 9:36
  assumes
• 9:36
  hold
• 9:36
  —
• 9:37
  and
• 9:37
  treating
• 9:37
  past
• 9:38
  patches
• 9:38
  as
• 9:38
  variants
• 9:39
  elsewhere.
• 9:40
  A
• 9:40
  dual-model
• 9:40
  gate
• 9:40
  closes
• 9:41
  the
• 9:41
  loop:
• 9:41
  one
• 9:42
  session
• 9:42
  proves
• 9:42
  a
• 9:42
  bug
• 9:42
  exploitable
• 9:43
  while
• 9:43
  a
• 9:43
  fresh,
• 9:43
  context-free
• 9:44
  session
• 9:44
  tries
• 9:44
  to
• 9:45
  disprove
• 9:45
  it
• 9:45
  —
• 9:46
  "a
• 9:46
  disagreement
• 9:46
  detector,
• 9:47
  not
• 9:47
  a
• 9:47
  vote."
• 9:48
  Proof
• 9:48
  is
• 9:48
  a
• 9:48
  three-run
• 9:49
  oracle
• 9:49
  —
• 9:49
  negative
• 9:50
  control,
• 9:50
  vulnerable
• 9:50
  build,
• 9:51
  fixed
• 9:51
  build
• 9:51
  —
• 9:51
  the
• 9:52
  contrast
• 9:52
  is
• 9:52
  the
• 9:52
  evidence.
• 9:53
  The
• 9:53
  bugs
• 9:53
  are
• 9:54
  instructive.
• 9:54
  CVE-2026-68945
• 9:58
  came
• 9:58
  from
• 9:58
  a
• 9:58
  serializer
• 9:59
  differential:
• 10:00
  Angular's
• 10:00
  SSR
• 10:01
  transfer
• 10:01
  cache
• 10:01
  joined
• 10:02
  repeated
• 10:02
  query
• 10:02
  parameters
• 10:03
  with
• 10:03
  commas,
• 10:04
  so
• 10:04
  role=user&role=admin
• 10:05
  and
• 10:05
  role=user,admin
• 10:08
  collapsed
• 10:08
  to
• 10:08
  one
• 10:08
  cache
• 10:09
  key,
• 10:09
  serving
• 10:10
  one
• 10:10
  visitor's
• 10:10
  response
• 10:11
  —
• 10:11
  backend
• 10:12
  authorization
• 10:12
  skipped
• 10:13
  —
• 10:13
  to
• 10:13
  the
• 10:13
  next;
• 10:14
  the
• 10:14
  oracle
• 10:15
  showed
• 10:15
  two
• 10:15
  requests
• 10:15
  producing
• 10:16
  one
• 10:16
  backend
• 10:16
  call.
• 10:17
  CVE-2026-69151,
• 10:21
  a
• 10:21
  patch
• 10:21
  variant:
• 10:22
  the
• 10:22
  template
• 10:23
  compiler
• 10:23
  accepted
• 10:24
  i18n-on
• 10:24
  attributes,
• 10:26
  letting
• 10:26
  a
• 10:26
  tampered
• 10:26
  translation
• 10:27
  file
• 10:27
  swap
• 10:28
  a
• 10:28
  benign
• 10:28
  onerror="void
• 10:29
  0"
• 10:30
  for
• 10:30
  arbitrary
• 10:30
  JavaScript
• 10:31
  in
• 10:31
  the
• 10:31
  application's
• 10:32
  origin.
• 10:33
  The
• 10:33
  implication
• 10:34
  is
• 10:34
  attacker-neutral:
• 10:35
  "patch-diff
• 10:36
  variant
• 10:36
  farming
• 10:37
  rewards
• 10:37
  whoever
• 10:37
  moves
• 10:38
  first
• 10:38
  after
• 10:38
  a
• 10:38
  commit
• 10:39
  ships"
• 10:39
  —
• 10:39
  maintainers
• 10:40
  should
• 10:40
  run
• 10:40
  these
• 10:41
  passes
• 10:41
  before
• 10:41
  release;
• 10:42
  outsiders
• 10:43
  will
• 10:43
  run
• 10:43
  them
• 10:43
  after.
• 10:44
  On
• 10:44
  the
• 10:44
  other
• 10:45
  side,
• 10:45
  a
• 10:45
  TROOPERS26
• 10:49
  abstract
• 10:50
  describes
• 10:50
  "Counteroffensive
• 10:51
  AI:
• 10:52
  Pwning
• 10:52
  AI
• 10:53
  Pentesters,"
• 10:54
  an
• 10:54
  attack
• 10:54
  framework
• 10:55
  aimed
• 10:55
  at
• 10:55
  AI
• 10:55
  pentesting
• 10:56
  agents.
• 10:57
  Those
• 10:57
  agents
• 10:57
  consume
• 10:58
  untrusted
• 10:59
  input
• 10:59
  by
• 10:59
  design,
• 11:00
  so
• 11:00
  the
• 11:00
  attack
• 11:00
  plants
• 11:01
  breadcrumbs
• 11:01
  where
• 11:01
  reconnaissance
• 11:02
  finds
• 11:02
  them:
• 11:03
  a
• 11:03
  backup-auth
• 11:04
  hint
• 11:04
  in
• 11:04
  a
• 11:04
  GitHub
• 11:04
  issue,
• 11:05
  SSO
• 11:06
  metadata
• 11:06
  in
• 11:06
  a
• 11:06
  profile
• 11:07
  bio.
• 11:09
  One
• 11:09
  component,
• 11:09
  HON-AI,
• 11:10
  is
• 11:10
  a
• 11:10
  fake
• 11:11
  identity
• 11:11
  provider
• 11:11
  implementing
• 11:12
  OAuth2/OIDC/SAML
• 11:18
  with
• 11:18
  Okta-
• 11:18
  and
• 11:19
  Azure
• 11:19
  AD-style
• 11:19
  endpoints,
• 11:20
  capturing
• 11:21
  credentials,
• 11:21
  client
• 11:22
  secrets,
• 11:22
  and
• 11:23
  MFA
• 11:23
  codes
• 11:24
  while
• 11:24
  returning
• 11:24
  plausible
• 11:25
  errors
• 11:25
  ("password
• 11:26
  expired,"
• 11:27
  "MFA
• 11:27
  required")
• 11:28
  that
• 11:28
  encourage
• 11:29
  retries;
• 11:30
  the
• 11:30
  other,
• 11:30
  UZI,
• 11:31
  mass-sprays
• 11:32
  fake
• 11:32
  SSO
• 11:32
  references
• 11:33
  across
• 11:33
  user-generated
• 11:34
  content,
• 11:35
  canary-tagged.
• 11:36
  The
• 11:36
  economics:
• 11:37
  spray
• 11:38
  10,000
• 11:38
  targets
• 11:39
  once;
• 11:40
  harvest
• 11:40
  as
• 11:40
  AI
• 11:41
  pentests
• 11:41
  happen
• 11:41
  over
• 11:41
  months.
• 11:43
  Every
• 11:43
  listed
• 11:43
  mitigation
• 11:44
  fails
• 11:44
  architecturally
• 11:44
  —
• 11:46
  IdP
• 11:46
  whitelisting
• 11:47
  breaks
• 11:47
  on
• 11:47
  internal
• 11:47
  providers,
• 11:48
  human
• 11:48
  confirmation
• 11:49
  defeats
• 11:49
  the
• 11:50
  autonomy
• 11:50
  being
• 11:50
  sold
• 11:50
  —
• 11:51
  the
• 11:51
  feature
• 11:52
  is
• 11:52
  the
• 11:52
  vulnerability.
• 11:53
  Tooling
• 11:54
  keeps
• 11:54
  pace:
• 11:55
  vphone-cli
• 11:56
  runs
• 11:56
  a
• 11:56
  virtual
• 11:56
  iPhone
• 11:57
  on
• 11:57
  Apple
• 11:57
  Silicon
• 11:58
  via
• 11:58
  Apple's
• 11:58
  Virtualization.framework
• 12:00
  and
• 12:00
  the
• 12:00
  research
• 12:01
  VMs
• 12:01
  from
• 12:01
  its
• 12:02
  Private
• 12:02
  Cloud
• 12:02
  Compute
• 12:02
  firmware
• 12:03
  —
• 12:04
  the
• 12:04
  lineage
• 12:04
  of
• 12:04
  the
• 12:04
  super-tart
• 12:05
  writeup
• 12:05
  it
• 12:05
  credits
• 12:05
  —
• 12:06
  with
• 12:06
  pre-patched
• 12:07
  firmware,
• 12:08
  cloning,
• 12:08
  and
• 12:08
  a
• 12:08
  local
• 12:09
  automation
• 12:09
  API,
• 12:10
  SIP
• 12:10
  enabled.
• 12:13
  Agents
• 12:13
  running
• 12:13
  untrusted
• 12:14
  code
• 12:14
  need
• 12:14
  containment,
• 12:15
  and
• 12:15
  Perplexity
• 12:15
  published
• 12:16
  a
• 12:16
  useful
• 12:16
  audit:
• 12:17
  nine
• 12:17
  models
• 12:18
  across
• 12:18
  216
• 12:19
  runs
• 12:19
  attacking
• 12:20
  SPACE,
• 12:20
  the
• 12:20
  Firecracker
• 12:21
  microVM
• 12:21
  platform
• 12:22
  behind
• 12:22
  Perplexity
• 12:23
  Computer,
• 12:23
  root
• 12:24
  inside
• 12:24
  the
• 12:24
  guest.
• 12:25
  VM
• 12:25
  isolation
• 12:26
  held
• 12:26
  —
• 12:26
  zero
• 12:27
  VM-to-host
• 12:27
  escapes
• 12:28
  in
• 12:28
  108
• 12:28
  runs,
• 12:29
  even
• 12:29
  with
• 12:29
  source
• 12:29
  access.
• 12:31
  Network
• 12:31
  confinement
• 12:31
  did
• 12:32
  not:
• 12:32
  pre-remediation,
• 12:33
  bypasses
• 12:34
  succeeded
• 12:34
  in
• 12:34
  11
• 12:35
  of
• 12:35
  54
• 12:35
  partial-network
• 12:36
  runs,
• 12:37
  four
• 12:37
  models
• 12:38
  exploiting
• 12:38
  the
• 12:38
  gap
• 12:38
  between
• 12:39
  domain-name
• 12:39
  policy
• 12:40
  and
• 12:40
  IP
• 12:40
  enforcement
• 12:41
  at
• 12:41
  the
• 12:41
  gateway.
• 12:42
  Both
• 12:42
  methods
• 12:43
  generalize:
• 12:44
  DNS
• 12:44
  spoofing
• 12:45
  —
• 12:46
  forged
• 12:46
  resolver
• 12:46
  responses
• 12:47
  mapping
• 12:47
  the
• 12:47
  allowed
• 12:47
  pypi.org
• 12:50
  to
• 12:50
  the
• 12:50
  blocked
• 12:50
  callback's
• 12:50
  IP
• 12:51
  —
• 12:52
  and
• 12:52
  IP
• 12:52
  sharing,
• 12:52
  fetching
• 12:53
  the
• 12:53
  callback
• 12:53
  via
• 12:53
  a
• 12:54
  Fastly
• 12:54
  service
• 12:54
  sharing
• 12:54
  PyPI's
• 12:55
  IP.
• 12:56
  Claude
• 12:57
  Opus
• 12:57
  5.0
• 12:58
  found
• 12:58
  the
• 12:58
  vector
• 12:58
  and
• 12:58
  declined
• 12:58
  —
• 12:59
  "the
• 12:59
  instructions
• 13:00
  explicitly
• 13:01
  forbid
• 13:01
  targeting
• 13:01
  other
• 13:02
  external
• 13:02
  systems"
• 13:02
  —
• 13:03
  which
• 13:03
  Perplexity
• 13:04
  calls
• 13:04
  "overly
• 13:05
  conservative."
• 13:06
  The
• 13:06
  fix
• 13:06
  pairs
• 13:07
  nftables
• 13:07
  source-address
• 13:08
  validation
• 13:08
  with
• 13:09
  TLS
• 13:09
  termination
• 13:10
  requiring
• 13:10
  whitelisted
• 13:11
  SNI,
• 13:11
  DNS-attributed
• 13:12
  to
• 13:12
  the
• 13:13
  destination
• 13:13
  IP;
• 13:14
  zero
• 13:15
  verified
• 13:15
  bypasses
• 13:15
  after.
• 13:17
  Ten
• 13:17
  third-party
• 13:17
  sandboxes
• 13:18
  tested
• 13:18
  similarly:
• 13:20
  eight
• 13:20
  susceptible,
• 13:21
  Deno
• 13:21
  also
• 13:21
  allowed
• 13:22
  unrestricted
• 13:22
  TCP,
• 13:23
  and
• 13:24
  only
• 13:24
  Cloudflare
• 13:24
  Sandbox
• 13:25
  and
• 13:25
  NVIDIA
• 13:26
  OpenShell
• 13:26
  resisted.
• 13:27
  The
• 13:27
  same
• 13:27
  mechanics,
• 13:28
  one
• 13:28
  consumer
• 13:29
  layer
• 13:29
  down:
• 13:30
  a
• 13:30
  developer
• 13:31
  wanting
• 13:31
  PS5
• 13:31
  gameplay
• 13:32
  on
• 13:32
  Discord
• 13:33
  without
• 13:33
  a
• 13:33
  $100
• 13:34
  capture
• 13:34
  card
• 13:34
  hijacked
• 13:35
  the
• 13:35
  console's
• 13:35
  own
• 13:35
  broadcast.
• 13:37
  The
• 13:37
  PS5
• 13:37
  resolves
• 13:38
  Twitch's
• 13:38
  ingest
• 13:39
  servers
• 13:39
  by
• 13:39
  DNS
• 13:40
  on
• 13:40
  every
• 13:41
  broadcast,
• 13:42
  so
• 13:42
  a
• 13:42
  Mac
• 13:42
  running
• 13:43
  dnsmasq
• 13:43
  for
• 13:43
  Twitch's
• 13:44
  ingest
• 13:44
  domains
• 13:44
  —
• 13:46
  the
• 13:46
  router
• 13:46
  hands
• 13:46
  the
• 13:47
  PS5
• 13:47
  the
• 13:47
  Mac's
• 13:47
  IP
• 13:48
  as
• 13:48
  DNS
• 13:48
  server
• 13:49
  via
• 13:49
  DHCP
• 13:49
  —
• 13:51
  redirects
• 13:51
  the
• 13:52
  1080p60
• 13:52
  stream
• 13:53
  to
• 13:53
  the
• 13:53
  Mac,
• 13:53
  where
• 13:54
  nginx
• 13:54
  surfaces
• 13:55
  the
• 13:55
  URL.
• 13:56
  Two
• 13:56
  details
• 13:57
  carry
• 13:57
  the
• 13:57
  security
• 13:57
  relevance:
• 13:58
  the
• 13:58
  first
• 13:59
  spoof
• 13:59
  failed
• 13:59
  because
• 14:00
  Twitch's
• 14:00
  ingest
• 14:00
  uses
• 14:01
  RTMPS
• 14:02
  with
• 14:02
  certificate
• 14:02
  validation
• 14:03
  and
• 14:03
  custom
• 14:03
  CAs
• 14:04
  cannot
• 14:04
  be
• 14:04
  installed;
• 14:05
  a
• 14:05
  YouTube
• 14:06
  detour
• 14:06
  failed
• 14:07
  because
• 14:07
  the
• 14:07
  PS5
• 14:07
  polls
• 14:08
  the
• 14:08
  API
• 14:09
  and
• 14:09
  stops
• 14:09
  broadcasting
• 14:10
  after
• 14:10
  60
• 14:10
  seconds
• 14:11
  when
• 14:11
  nothing
• 14:11
  arrives.
• 14:13
  Unverified
• 14:13
  name
• 14:13
  resolution
• 14:14
  is
• 14:14
  a
• 14:14
  policy
• 14:15
  boundary,
• 14:16
  whether
• 14:16
  the
• 14:16
  device
• 14:16
  is
• 14:16
  a
• 14:16
  console
• 14:17
  or
• 14:17
  a
• 14:17
  sandbox
• 14:18
  gateway.
• 14:21
  Germany's
• 14:21
  BSI
• 14:22
  issued
• 14:22
  a
• 14:22
  quietly
• 14:22
  dramatic
• 14:23
  note
• 14:23
  on
• 14:23
  Classic
• 14:24
  McEliece,
• 14:25
  the
• 14:25
  code-based
• 14:25
  post-quantum
• 14:26
  scheme
• 14:26
  from
• 14:26
  1978:
• 14:28
  "Classic
• 14:28
  McEliece
• 14:28
  should
• 14:28
  currently
• 14:29
  no
• 14:29
  longer
• 14:29
  be
• 14:29
  used
• 14:30
  in
• 14:30
  new
• 14:30
  developments
• 14:30
  or
• 14:30
  when
• 14:31
  planning
• 14:31
  new
• 14:31
  cryptographic
• 14:32
  applications."
• 14:33
  Use
• 14:33
  FrodoKEM,
• 14:34
  ML-KEM,
• 14:35
  or
• 14:35
  HQC
• 14:36
  instead.
• 14:37
  The
• 14:37
  reason
• 14:37
  is
• 14:37
  a
• 14:38
  year
• 14:38
  of
• 14:38
  structural
• 14:38
  attacks
• 14:39
  on
• 14:39
  mathematics
• 14:39
  stable
• 14:40
  for
• 14:40
  six
• 14:40
  decades
• 14:40
  —
• 14:41
  information-set
• 14:42
  decoding
• 14:43
  is
• 14:43
  NP-hard,
• 14:44
  barely
• 14:44
  moved
• 14:45
  in
• 14:45
  60
• 14:45
  years;
• 14:46
  key
• 14:46
  recovery
• 14:47
  via
• 14:47
  the
• 14:47
  support-splitting
• 14:48
  algorithm
• 14:48
  cost
• 14:49
  over
• 14:49
  2^3000
• 14:52
  operations.
• 14:54
  Then
• 14:54
  the
• 14:54
  cascade:
• 14:54
  a
• 14:55
  subexponential
• 14:55
  distinguisher
• 14:56
  at
• 14:56
  roughly
• 14:56
  2^683,
• 14:58
  improvements
• 14:59
  to
• 14:59
  2^550,
• 15:01
  and
• 15:02
  a
• 15:02
  2026
• 15:02
  result
• 15:03
  claiming
• 15:03
  key
• 15:03
  recovery
• 15:04
  at
• 15:04
  2^99–2^102
• 15:07
  for
• 15:08
  recommended
• 15:08
  parameters.
• 15:10
  The
• 15:10
  BSI
• 15:10
  is
• 15:10
  careful
• 15:10
  both
• 15:11
  ways:
• 15:11
  the
• 15:11
  newest
• 15:12
  results
• 15:12
  lack
• 15:12
  full
• 15:12
  peer
• 15:13
  review,
• 15:13
  no
• 15:13
  practical
• 15:14
  attack
• 15:14
  exists
• 15:15
  today,
• 15:15
  but
• 15:16
  a
• 15:16
  significant
• 15:16
  improvement
• 15:17
  in
• 15:17
  structural
• 15:17
  attacks
• 15:18
  is
• 15:18
  evident
• 15:18
  —
• 15:19
  further
• 15:19
  advances
• 15:20
  "conceivable
• 15:20
  and
• 15:21
  to
• 15:21
  be
• 15:21
  expected."
• 15:22
  The
• 15:22
  existing
• 15:23
  recommendation
• 15:23
  permits
• 15:24
  only
• 15:24
  hybrid
• 15:24
  use
• 15:24
  —
• 15:25
  pairing
• 15:26
  the
• 15:26
  McEliece
• 15:26
  key
• 15:26
  with
• 15:26
  a
• 15:27
  classically
• 15:27
  negotiated
• 15:28
  key
• 15:28
  so
• 15:28
  both
• 15:28
  must
• 15:29
  break
• 15:29
  —
• 15:30
  retaining
• 15:30
  classical
• 15:31
  security
• 15:31
  until
• 15:31
  the
• 15:31
  unchanged
• 15:32
  2031
• 15:32
  deadline.
• 15:34
  The
• 15:34
  other
• 15:34
  encryption
• 15:34
  story
• 15:35
  is
• 15:35
  about
• 15:35
  keys,
• 15:36
  not
• 15:36
  math.
• 15:37
  The
• 15:37
  Stolen
• 15:38
  Thoughts
• 15:38
  team's
• 15:39
  September
• 15:39
  update
• 15:39
  audits
• 15:40
  whether
• 15:40
  the
• 15:40
  emergency
• 15:41
  mitigations
• 15:41
  OpenAI,
• 15:42
  Anthropic,
• 15:43
  and
• 15:43
  Google
• 15:43
  deployed
• 15:44
  after
• 15:44
  its
• 15:44
  reasoning-trace
• 15:45
  theft
• 15:45
  disclosure
• 15:45
  hold
• 15:46
  —
• 15:47
  a
• 15:47
  disclosure
• 15:47
  Anthropic
• 15:48
  cited
• 15:48
  when
• 15:48
  restructuring
• 15:49
  its
• 15:49
  Messages
• 15:49
  API
• 15:50
  thinking
• 15:50
  blocks,
• 15:51
  and
• 15:51
  a
• 15:51
  CISA
• 15:51
  advisory
• 15:52
  (AA26-251A)
• 15:57
  accuses
• 15:58
  China-based
• 15:58
  entities
• 15:59
  of
• 15:59
  operationalizing
• 16:00
  for
• 16:00
  industrial-scale
• 16:00
  distillation.
• 16:02
  The
• 16:02
  flaw
• 16:02
  is
• 16:03
  architectural:
• 16:04
  providers
• 16:04
  encrypt
• 16:05
  reasoning
• 16:05
  blocks
• 16:05
  with
• 16:06
  shared
• 16:06
  global
• 16:06
  keys,
• 16:07
  making
• 16:07
  blobs
• 16:08
  portable
• 16:08
  across
• 16:09
  sessions,
• 16:09
  users,
• 16:10
  and
• 16:10
  models
• 16:10
  —
• 16:11
  feed
• 16:11
  one
• 16:12
  to
• 16:12
  a
• 16:12
  weaker
• 16:12
  model
• 16:12
  in
• 16:13
  the
• 16:13
  same
• 16:13
  family
• 16:14
  and
• 16:14
  it
• 16:14
  becomes
• 16:14
  a
• 16:14
  decryption
• 16:15
  oracle,
• 16:15
  transcribing
• 16:16
  hidden
• 16:16
  reasoning
• 16:17
  verbatim.
• 16:18
  As
• 16:18
  of
• 16:18
  September
• 16:19
  13,
• 16:20
  the
• 16:20
  replay
• 16:20
  attack
• 16:20
  still
• 16:21
  worked
• 16:21
  on
• 16:21
  Microsoft
• 16:22
  Azure
• 16:22
  for
• 16:22
  every
• 16:22
  OpenAI
• 16:23
  model
• 16:23
  tested
• 16:24
  and
• 16:24
  for
• 16:24
  Anthropic
• 16:25
  up
• 16:25
  to
• 16:25
  Sonnet
• 16:25
  5;
• 16:26
  the
• 16:26
  scratchpad
• 16:27
  variant
• 16:27
  —
• 16:28
  telling
• 16:28
  the
• 16:28
  model
• 16:29
  to
• 16:29
  write
• 16:29
  its
• 16:29
  reasoning
• 16:29
  into
• 16:30
  a
• 16:30
  visible
• 16:30
  tool
• 16:30
  —
• 16:31
  extracted
• 16:32
  from
• 16:32
  every
• 16:32
  OpenAI
• 16:33
  model
• 16:33
  plus
• 16:33
  Opus
• 16:34
  4.8
• 16:34
  and
• 16:34
  Sonnet
• 16:35
  5;
• 16:36
  only
• 16:36
  Opus
• 16:36
  5,
• 16:37
  Fable
• 16:37
  5,
• 16:37
  and
• 16:38
  Fable
• 16:38
  5.1
• 16:39
  resist.
• 16:40
  Across
• 16:40
  152
• 16:41
  HLE
• 16:42
  questions
• 16:43
  both
• 16:43
  attacks
• 16:43
  produced
• 16:43
  near-identical
• 16:44
  traces
• 16:45
  (Spearman
• 16:45
  0.89,
• 16:46
  classifier
• 16:47
  AUC
• 16:47
  0.64)
• 16:48
  —
• 16:49
  equivalent
• 16:50
  distillation
• 16:50
  material
• 16:51
  —
• 16:51
  and
• 16:51
  the
• 16:52
  conclusion
• 16:52
  is
• 16:52
  blunt:
• 16:53
  fragmented
• 16:54
  template-matching
• 16:54
  mitigations
• 16:55
  and
• 16:55
  third-party
• 16:56
  hosts
• 16:57
  unable
• 16:57
  to
• 16:57
  enforce
• 16:58
  defensive
• 16:58
  parity
• 16:59
  "effectively
• 16:59
  neutralize
• 17:00
  export
• 17:00
  controls
• 17:01
  at
• 17:01
  the
• 17:01
  API
• 17:01
  boundary."
• 17:04
  WIRED
• 17:05
  sat-down
• 17:05
  with
• 17:05
  Andrew
• 17:05
  Boyd,
• 17:06
  CEO
• 17:06
  of
• 17:06
  Paragon,
• 17:07
  spyware's
• 17:07
  self-styled
• 17:08
  ethical
• 17:08
  player.
• 17:09
  Boyd
• 17:09
  —
• 17:10
  a
• 17:10
  former
• 17:10
  director
• 17:11
  of
• 17:11
  the
• 17:11
  CIA's
• 17:11
  Center
• 17:12
  for
• 17:12
  Cyber
• 17:12
  Intelligence
• 17:12
  —
• 17:13
  admits
• 17:13
  it
• 17:13
  precisely:
• 17:14
  Paragon
• 17:15
  exerts
• 17:15
  less
• 17:15
  customer
• 17:16
  oversight
• 17:16
  than
• 17:16
  NSO
• 17:17
  Group.
• 17:18
  The
• 17:18
  documented
• 17:18
  record:
• 17:19
  founded
• 17:19
  in
• 17:19
  2019
• 17:20
  by
• 17:20
  a
• 17:20
  former
• 17:21
  Unit
• 17:21
  8200
• 17:22
  commander
• 17:22
  and
• 17:22
  former
• 17:22
  prime
• 17:22
  minister
• 17:23
  Ehud
• 17:23
  Barak,
• 17:23
  among
• 17:24
  others;
• 17:24
  bought
• 17:24
  for
• 17:25
  $900
• 17:25
  million
• 17:25
  by
• 17:26
  US
• 17:26
  equity
• 17:26
  firm
• 17:27
  AE
• 17:27
  Industrial
• 17:27
  Partners
• 17:28
  in
• 17:28
  December
• 17:28
  2024
• 17:29
  and
• 17:29
  merged
• 17:30
  with
• 17:30
  its
• 17:30
  offensive
• 17:30
  cyber
• 17:30
  firm
• 17:31
  REDLattice
• 17:31
  —
• 17:32
  American
• 17:32
  on
• 17:32
  paper,
• 17:33
  Israeli
• 17:33
  export
• 17:34
  licenses
• 17:34
  for
• 17:34
  Paragon,
• 17:35
  ITAR
• 17:35
  for
• 17:35
  REDLattice.
• 17:36
  Weeks
• 17:36
  after
• 17:36
  that
• 17:37
  merger,
• 17:37
  WhatsApp
• 17:37
  alleged
• 17:38
  Graphite
• 17:38
  infected
• 17:39
  60-plus
• 17:39
  people
• 17:39
  in
• 17:39
  over
• 17:40
  20
• 17:40
  countries,
• 17:41
  journalists
• 17:41
  and
• 17:41
  activists
• 17:42
  among
• 17:42
  them;
• 17:43
  Citizen
• 17:43
  Lab
• 17:43
  identified
• 17:44
  two
• 17:44
  journalists
• 17:45
  and
• 17:45
  two
• 17:45
  activists
• 17:45
  in
• 17:46
  Italy.
• 17:47
  Paragon
• 17:47
  canceled
• 17:47
  the
• 17:47
  Italian
• 17:48
  contracts;
• 17:49
  no
• 17:49
  investigation
• 17:50
  ever
• 17:50
  occurred,
• 17:50
  Boyd
• 17:51
  says
• 17:51
  —
• 17:52
  Italy
• 17:52
  was
• 17:52
  "fired"
• 17:53
  because
• 17:53
  it
• 17:53
  "just
• 17:54
  was
• 17:54
  not
• 17:54
  worth
• 17:54
  it,
• 17:55
  from
• 17:55
  a
• 17:55
  risk
• 17:55
  perspective."
• 17:56
  The
• 17:56
  core
• 17:56
  admission
• 17:57
  is
• 17:57
  structural:
• 17:58
  Paragon
• 17:58
  cannot
• 17:59
  detect
• 17:59
  misuse
• 17:59
  because
• 18:00
  it
• 18:00
  cannot
• 18:00
  see
• 18:00
  who
• 18:00
  customers
• 18:01
  target;
• 18:02
  it
• 18:02
  has
• 18:02
  no
• 18:02
  kill
• 18:02
  switch,
• 18:03
  only
• 18:03
  the
• 18:03
  ability
• 18:04
  to
• 18:04
  halt
• 18:04
  support
• 18:05
  and
• 18:05
  updates
• 18:05
  —
• 18:06
  without
• 18:06
  them,
• 18:07
  systems
• 18:07
  fail
• 18:07
  within
• 18:08
  roughly
• 18:08
  12
• 18:08
  hours.
• 18:09
  Customers
• 18:10
  may
• 18:10
  enable
• 18:10
  logs,
• 18:11
  but
• 18:11
  Paragon
• 18:11
  has
• 18:12
  no
• 18:12
  access
• 18:12
  —
• 18:13
  unlike
• 18:13
  NSO,
• 18:14
  which
• 18:14
  claims
• 18:15
  a
• 18:15
  kill
• 18:15
  switch
• 18:15
  and
• 18:16
  contractually
• 18:16
  mandated
• 18:17
  tamper-proof
• 18:17
  logs.
• 18:18
  Graphite
• 18:18
  pulls
• 18:19
  communications
• 18:19
  from
• 18:20
  encrypted
• 18:20
  apps
• 18:20
  like
• 18:20
  WhatsApp
• 18:21
  and
• 18:21
  Signal
• 18:21
  via
• 18:22
  zero-click
• 18:22
  exploits,
• 18:23
  per
• 18:23
  WhatsApp
• 18:24
  and
• 18:24
  Citizen
• 18:24
  Lab.
• 18:25
  Citizen
• 18:26
  Lab's
• 18:26
  John
• 18:26
  Scott-Railton
• 18:27
  calls
• 18:27
  the
• 18:27
  lack
• 18:28
  of
• 18:28
  mandatory
• 18:28
  logging
• 18:29
  "reckless"
• 18:29
  —
• 18:30
  "Accountability
• 18:30
  is
• 18:30
  bad
• 18:31
  for
• 18:31
  business"
• 18:31
  —
• 18:32
  and
• 18:32
  Senator
• 18:32
  Ron
• 18:32
  Wyden
• 18:33
  calls
• 18:33
  the
• 18:33
  refusal
• 18:34
  to
• 18:34
  audit
• 18:34
  "a
• 18:34
  massive
• 18:35
  red
• 18:35
  flag."
• 18:36
  The
• 18:36
  same
• 18:36
  problem
• 18:37
  in
• 18:37
  consumer
• 18:37
  form:
• 18:38
  Huntress
• 18:39
  documented
• 18:39
  malicious
• 18:40
  Custom
• 18:40
  GPTs
• 18:41
  hosted
• 18:41
  on
• 18:41
  chatgpt.com
• 18:43
  —
• 18:45
  named
• 18:45
  "Plus
• 18:46
  5.6,"
• 18:47
  passable
• 18:47
  as
• 18:48
  an
• 18:48
  official
• 18:48
  release
• 18:48
  —
• 18:49
  that
• 18:49
  answer
• 18:49
  any
• 18:50
  prompt
• 18:50
  with
• 18:50
  "service
• 18:50
  unavailable"
• 18:51
  and
• 18:51
  offer
• 18:52
  a
• 18:52
  "backup"
• 18:52
  Google
• 18:53
  Sites
• 18:53
  link
• 18:53
  to
• 18:53
  a
• 18:53
  fake
• 18:54
  Cloudflare
• 18:54
  page
• 18:54
  whose
• 18:55
  ClickFix
• 18:55
  prompt
• 18:55
  says
• 18:56
  to
• 18:56
  paste
• 18:56
  a
• 18:56
  PowerShell
• 18:56
  command.
• 18:57
  The
• 18:57
  command
• 18:58
  downloads
• 18:58
  an
• 18:58
  MSI
• 18:59
  that
• 18:59
  abuses
• 18:59
  a
• 18:59
  Canon-signed
• 19:00
  application
• 19:00
  to
• 19:01
  sideload
• 19:01
  DLLs;
• 19:02
  one
• 19:02
  extracts
• 19:03
  an
• 19:03
  encrypted
• 19:03
  loader
• 19:04
  from
• 19:04
  a
• 19:04
  WAV
• 19:04
  file,
• 19:05
  unpacking
• 19:06
  a
• 19:06
  RAT
• 19:06
  in
• 19:06
  memory.
• 19:08
  Huntress's
• 19:08
  SOC
• 19:09
  has
• 19:09
  responded
• 19:10
  to
• 19:10
  at
• 19:10
  least
• 19:10
  40
• 19:10
  incidents
• 19:11
  tied
• 19:11
  to
• 19:11
  the
• 19:11
  domain,
• 19:12
  two
• 19:12
  via
• 19:13
  the
• 19:13
  Custom
• 19:13
  GPT
• 19:14
  itself.
• 19:15
  Principal
• 19:15
  analyst
• 19:16
  Jonathan
• 19:16
  Semon's
• 19:17
  framing
• 19:17
  is
• 19:17
  correct:
• 19:18
  every
• 19:18
  domain
• 19:19
  in
• 19:19
  the
• 19:19
  chain
• 19:19
  is
• 19:19
  legitimate,
• 19:20
  so
• 19:21
  training
• 19:21
  must
• 19:21
  shift
• 19:21
  from
• 19:22
  "check
• 19:22
  where
• 19:22
  it
• 19:22
  came
• 19:22
  from"
• 19:23
  to
• 19:23
  "check
• 19:23
  what
• 19:24
  it's
• 19:24
  asking
• 19:24
  you
• 19:24
  to
• 19:24
  do"
• 19:24
  —
• 19:25
  no
• 19:25
  legitimate
• 19:26
  site
• 19:26
  or
• 19:26
  chatbot
• 19:27
  asks
• 19:27
  you
• 19:27
  to
• 19:27
  paste
• 19:28
  a
• 19:28
  command
• 19:28
  into
• 19:28
  PowerShell.
• 19:29
  In
• 19:30
  some
• 19:30
  incidents,
• 19:30
  victims
• 19:31
  clicked
• 19:31
  a
• 19:31
  sponsored
• 19:31
  Google
• 19:32
  result
• 19:32
  and
• 19:32
  landed
• 19:33
  on
• 19:33
  the
• 19:33
  real
• 19:33
  chatgpt.com
• 19:35
  —
• 19:37
  a
• 19:37
  small
• 19:37
  "community
• 19:38
  builder"
• 19:38
  label
• 19:39
  the
• 19:39
  only
• 19:39
  tell.