Latest / AGI Dreams – Open, Uncensored, & Local - AI News Digest / AGI Dreams Podcast – April 06, 2026

Transcript

AGI Dreams Podcast – April 06, 2026 · AGI Dreams – Open, Uncensored, & Local - AI News Digest

• 0:00
  Google
• 0:00
  shipped
• 0:00
  Gemma
• 0:00
  4
• 0:01
  to
• 0:01
  iPhones
• 0:01
  this
• 0:01
  week
• 0:02
  via
• 0:02
  the
• 0:02
  AI
• 0:02
  Edge
• 0:03
  Gallery
• 0:03
  app,
• 0:03
  and
• 0:03
  the
• 0:04
  feature
• 0:04
  list
• 0:04
  reads
• 0:04
  less
• 0:05
  like
• 0:05
  a
• 0:05
  tech
• 0:05
  demo
• 0:05
  and
• 0:05
  more
• 0:06
  like
• 0:06
  a
• 0:06
  product
• 0:06
  launch.
• 0:07
  Agent
• 0:07
  skills
• 0:07
  that
• 0:08
  augment
• 0:08
  the
• 0:08
  model
• 0:08
  with
• 0:08
  Wikipedia
• 0:09
  lookups
• 0:09
  and
• 0:09
  interactive
• 0:10
  maps.
• 0:11
  A
• 0:11
  "thinking
• 0:11
  mode"
• 0:11
  that
• 0:11
  exposes
• 0:12
  step-by-step
• 0:13
  reasoning.
• 0:14
  Multimodal
• 0:14
  image
• 0:14
  analysis
• 0:15
  from
• 0:15
  the
• 0:15
  camera
• 0:15
  roll.
• 0:16
  Audio
• 0:16
  transcription.
• 0:17
  All
• 0:18
  running
• 0:18
  fully
• 0:18
  offline,
• 0:19
  with
• 0:19
  zero
• 0:19
  data
• 0:20
  leaving
• 0:20
  the
• 0:20
  device.
• 0:21
  The
• 0:21
  app
• 0:21
  even
• 0:21
  includes
• 0:22
  a
• 0:22
  benchmark
• 0:22
  suite
• 0:23
  so
• 0:23
  users
• 0:23
  can
• 0:23
  see
• 0:23
  exactly
• 0:24
  how
• 0:24
  their
• 0:24
  hardware
• 0:24
  performs
• 0:25
  —
• 0:25
  a
• 0:25
  tacit
• 0:26
  admission
• 0:26
  that
• 0:26
  on-device
• 0:27
  inference
• 0:27
  is
• 0:27
  now
• 0:27
  a
• 0:27
  competitive
• 0:28
  surface,
• 0:28
  not
• 0:29
  a
• 0:29
  curiosity
• 0:29
  .
• 0:30
  Six
• 0:30
  months
• 0:30
  ago,
• 0:31
  the
• 0:31
  state
• 0:31
  of
• 0:31
  the
• 0:31
  art
• 0:32
  for
• 0:32
  phone-class
• 0:32
  inference
• 0:32
  was
• 0:33
  Qwen3
• 0:33
  4B
• 0:33
  hitting
• 0:34
  roughly
• 0:34
  25
• 0:34
  tokens
• 0:35
  per
• 0:35
  second
• 0:35
  on
• 0:35
  Apple's
• 0:36
  A19
• 0:36
  Pro.
• 0:37
  Gemma
• 0:37
  4's
• 0:37
  arrival
• 0:38
  on
• 0:38
  iOS,
• 0:39
  with
• 0:39
  agent
• 0:39
  capabilities
• 0:40
  and
• 0:40
  128K
• 0:41
  context,
• 0:42
  marks
• 0:42
  a
• 0:42
  qualitative
• 0:43
  jump:
• 0:43
  the
• 0:43
  model
• 0:44
  doesn't
• 0:44
  just
• 0:44
  chat,
• 0:44
  it
• 0:45
  acts.
• 0:45
  The
• 0:46
  browser
• 0:46
  is
• 0:46
  getting
• 0:46
  the
• 0:46
  same
• 0:47
  treatment.
• 0:47
  Gemma
• 0:48
  Gem
• 0:48
  is
• 0:48
  a
• 0:48
  Chrome
• 0:48
  extension
• 0:49
  that
• 0:49
  runs
• 0:49
  Gemma
• 0:49
  4
• 0:50
  entirely
• 0:50
  on-device
• 0:51
  via
• 0:51
  WebGPU
• 0:51
  —
• 0:52
  no
• 0:52
  API
• 0:53
  keys,
• 0:53
  no
• 0:53
  cloud,
• 0:54
  no
• 0:54
  data
• 0:54
  exfiltration
• 0:55
  risk.
• 0:55
  It
• 0:56
  ships
• 0:56
  two
• 0:56
  model
• 0:56
  sizes:
• 0:57
  a
• 0:57
  ~500MB
• 0:58
  E2B
• 1:00
  variant
• 1:00
  and
• 1:00
  a
• 1:01
  ~1.5GB
• 1:01
  E4B
• 1:02
  variant,
• 1:03
  cached
• 1:03
  after
• 1:03
  first
• 1:04
  download.
• 1:05
  The
• 1:05
  architecture
• 1:05
  is
• 1:05
  clever:
• 1:06
  an
• 1:06
  offscreen
• 1:07
  document
• 1:07
  hosts
• 1:07
  the
• 1:07
  model
• 1:08
  and
• 1:08
  runs
• 1:08
  an
• 1:08
  agent
• 1:09
  loop,
• 1:09
  a
• 1:09
  service
• 1:10
  worker
• 1:10
  routes
• 1:10
  messages
• 1:11
  and
• 1:11
  captures
• 1:11
  screenshots,
• 1:12
  and
• 1:12
  a
• 1:12
  content
• 1:12
  script
• 1:13
  injects
• 1:13
  a
• 1:13
  chat
• 1:13
  overlay
• 1:14
  with
• 1:14
  DOM
• 1:14
  manipulation
• 1:15
  tools.
• 1:16
  The
• 1:16
  result
• 1:16
  is
• 1:16
  a
• 1:16
  browser-native
• 1:17
  AI
• 1:17
  agent
• 1:17
  that
• 1:18
  can
• 1:18
  read
• 1:18
  pages,
• 1:18
  click
• 1:19
  elements,
• 1:19
  fill
• 1:19
  forms,
• 1:20
  and
• 1:20
  execute
• 1:20
  JavaScript
• 1:21
  —
• 1:22
  all
• 1:22
  without
• 1:22
  a
• 1:22
  single
• 1:22
  network
• 1:23
  request
• 1:23
  to
• 1:23
  an
• 1:23
  inference
• 1:23
  endpoint
• 1:24
  .
• 1:24
  For
• 1:25
  anyone
• 1:25
  who
• 1:25
  has
• 1:25
  spent
• 1:25
  the
• 1:25
  last
• 1:26
  two
• 1:26
  years
• 1:26
  arguing
• 1:26
  that
• 1:26
  local
• 1:27
  AI
• 1:27
  would
• 1:27
  remain
• 1:27
  a
• 1:27
  hobbyist
• 1:28
  pursuit,
• 1:29
  the
• 1:29
  browser-as-runtime
• 1:30
  distribution
• 1:30
  path
• 1:30
  is
• 1:31
  a
• 1:31
  sharp
• 1:31
  rebuttal.
• 1:32
  Getting
• 1:32
  these
• 1:32
  models
• 1:33
  to
• 1:33
  run
• 1:33
  well
• 1:33
  on
• 1:33
  constrained
• 1:34
  hardware
• 1:34
  requires
• 1:35
  compression
• 1:35
  that
• 1:36
  doesn't
• 1:36
  lobotomize
• 1:36
  them.
• 1:37
  APEX
• 1:38
  (Adaptive
• 1:38
  Precision
• 1:38
  for
• 1:39
  EXpert
• 1:39
  Models)
• 1:39
  is
• 1:40
  a
• 1:40
  new
• 1:40
  quantization
• 1:40
  method
• 1:41
  purpose-built
• 1:41
  for
• 1:42
  Mixture-of-Experts
• 1:42
  architectures
• 1:43
  that
• 1:43
  just
• 1:43
  dethroned
• 1:44
  Unsloth
• 1:44
  Dynamic
• 1:45
  2.0.
• 1:46
  The
• 1:46
  key
• 1:47
  insight:
• 1:47
  not
• 1:48
  all
• 1:48
  experts
• 1:48
  in
• 1:48
  an
• 1:48
  MoE
• 1:49
  model
• 1:49
  need
• 1:49
  the
• 1:49
  same
• 1:49
  precision.
• 1:50
  APEX
• 1:51
  assigns
• 1:51
  8-bit
• 1:52
  precision
• 1:52
  to
• 1:52
  experts
• 1:53
  that
• 1:53
  handle
• 1:53
  critical
• 1:54
  routing
• 1:54
  decisions
• 1:55
  while
• 1:55
  letting
• 1:55
  less-utilized
• 1:56
  experts
• 1:56
  survive
• 1:57
  on
• 1:57
  4-bit.
• 1:58
  The
• 1:58
  reported
• 1:58
  results
• 1:59
  on
• 1:59
  Gemma-4-26B-A4B
• 2:02
  are
• 2:02
  striking
• 2:02
  —
• 2:03
  50%
• 2:04
  of
• 2:04
  Q8
• 2:04
  size
• 2:04
  while
• 2:05
  matching
• 2:05
  F16
• 2:06
  perplexity,
• 2:06
  running
• 2:07
  on
• 2:07
  AMD
• 2:07
  Strix
• 2:08
  Halo
• 2:08
  with
• 2:08
  the
• 2:08
  Vulkan
• 2:08
  backend
• 2:09
  .
• 2:09
  Meanwhile,
• 2:10
  Apple
• 2:11
  published
• 2:11
  a
• 2:11
  paper
• 2:11
  on
• 2:11
  self-distillation
• 2:12
  for
• 2:12
  code
• 2:13
  generation
• 2:13
  that
• 2:13
  achieves
• 2:14
  30–50%
• 2:15
  improvements
• 2:16
  on
• 2:16
  hard
• 2:16
  coding
• 2:17
  tasks
• 2:17
  through
• 2:17
  an
• 2:17
  almost
• 2:18
  insultingly
• 2:18
  simple
• 2:19
  recipe:
• 2:20
  sample
• 2:20
  from
• 2:20
  a
• 2:20
  frozen
• 2:21
  model
• 2:21
  at
• 2:21
  high
• 2:21
  temperature,
• 2:22
  fine-tune
• 2:23
  on
• 2:23
  the
• 2:23
  raw
• 2:23
  unverified
• 2:24
  output,
• 2:24
  then
• 2:24
  decode
• 2:25
  with
• 2:25
  a
• 2:25
  separately
• 2:25
  tuned
• 2:26
  temperature.
• 2:27
  No
• 2:27
  reinforcement
• 2:28
  learning,
• 2:28
  no
• 2:29
  reward
• 2:29
  model,
• 2:30
  no
• 2:30
  verifier.
• 2:31
  The
• 2:31
  technique
• 2:31
  reshapes
• 2:32
  the
• 2:32
  output
• 2:32
  distribution
• 2:33
  contextually
• 2:33
  —
• 2:34
  suppressing
• 2:34
  distractors
• 2:35
  at
• 2:35
  deterministic
• 2:35
  "locks"
• 2:36
  while
• 2:36
  preserving
• 2:37
  diversity
• 2:37
  at
• 2:37
  exploratory
• 2:38
  "forks"
• 2:38
  .
• 2:39
  The
• 2:39
  convergence
• 2:39
  of
• 2:40
  these
• 2:40
  threads
• 2:40
  —
• 2:41
  capable
• 2:41
  models,
• 2:42
  aggressive
• 2:42
  quantization,
• 2:43
  and
• 2:43
  self-improvement
• 2:44
  without
• 2:44
  cloud
• 2:44
  infrastructure
• 2:44
  —
• 2:45
  is
• 2:45
  enabling
• 2:46
  a
• 2:46
  new
• 2:46
  class
• 2:46
  of
• 2:46
  local
• 2:47
  coding
• 2:47
  agent.
• 2:48
  One
• 2:48
  practitioner
• 2:49
  documented
• 2:49
  a
• 2:49
  stack
• 2:50
  running
• 2:50
  Claude
• 2:50
  Code
• 2:50
  as
• 2:50
  the
• 2:50
  harness,
• 2:51
  DSPy-GEPA
• 2:52
  as
• 2:52
  an
• 2:52
  adaptive
• 2:53
  router,
• 2:53
  Gemma-4
• 2:54
  31B
• 2:54
  as
• 2:55
  the
• 2:55
  heavy
• 2:55
  lifter,
• 2:56
  and
• 2:56
  Gemma-4
• 2:56
  2B
• 2:56
  as
• 2:57
  a
• 2:57
  speculative
• 2:57
  decoding
• 2:58
  sidekick,
• 2:58
  all
• 2:59
  on
• 2:59
  local
• 2:59
  hardware
• 2:59
  at
• 3:00
  zero
• 3:00
  cloud
• 3:00
  cost.
• 3:01
  The
• 3:01
  meta-task:
• 3:02
  the
• 3:02
  31B
• 3:03
  model
• 3:03
  reviewing
• 3:03
  its
• 3:04
  own
• 3:04
  implementation
• 3:04
  while
• 3:05
  the
• 3:05
  2B
• 3:05
  model
• 3:05
  predicts
• 3:06
  its
• 3:06
  next
• 3:06
  tokens.
• 3:07
  The
• 3:07
  argument
• 3:08
  isn't
• 3:08
  that
• 3:08
  this
• 3:08
  matches
• 3:08
  frontier
• 3:09
  cloud
• 3:09
  performance.
• 3:11
  It's
• 3:11
  that
• 3:11
  the
• 3:11
  feedback
• 3:11
  loop
• 3:11
  compounds
• 3:12
  —
• 3:13
  local
• 3:13
  inference
• 3:14
  plus
• 3:14
  a
• 3:14
  self-improving
• 3:15
  router
• 3:15
  plus
• 3:15
  system
• 3:15
  tooling
• 3:16
  creates
• 3:16
  a
• 3:16
  system
• 3:16
  that
• 3:17
  gets
• 3:17
  better
• 3:17
  the
• 3:17
  more
• 3:17
  you
• 3:17
  use
• 3:18
  it,
• 3:18
  and
• 3:18
  the
• 3:18
  question
• 3:19
  shifts
• 3:19
  from
• 3:19
  "which
• 3:20
  model
• 3:20
  is
• 3:20
  best"
• 3:20
  to
• 3:20
  "who
• 3:21
  owns
• 3:21
  the
• 3:21
  end-to-end
• 3:21
  feedback
• 3:22
  loop"
• 3:22
  .
• 3:24
  Anthropic
• 3:25
  accidentally
• 3:26
  leaked
• 3:26
  Claude
• 3:26
  Code's
• 3:27
  source
• 3:27
  map
• 3:27
  this
• 3:27
  week,
• 3:28
  and
• 3:28
  the
• 3:28
  most
• 3:28
  valuable
• 3:28
  thing
• 3:29
  in
• 3:29
  it
• 3:29
  isn't
• 3:29
  the
• 3:29
  unreleased
• 3:30
  feature
• 3:30
  flags
• 3:30
  —
• 3:31
  it's
• 3:31
  the
• 3:31
  plumbing.
• 3:32
  A
• 3:32
  detailed
• 3:32
  analysis
• 3:33
  of
• 3:33
  the
• 3:33
  leaked
• 3:33
  codebase
• 3:34
  identified
• 3:34
  12
• 3:35
  engineering
• 3:35
  primitives
• 3:36
  organized
• 3:36
  into
• 3:36
  three
• 3:36
  tiers
• 3:37
  that
• 3:37
  explain
• 3:38
  how
• 3:38
  a
• 3:38
  $2.5
• 3:38
  billion
• 3:39
  run-rate
• 3:39
  product
• 3:40
  actually
• 3:40
  works.
• 3:41
  Two
• 3:41
  parallel
• 3:42
  registries
• 3:42
  —
• 3:43
  207
• 3:43
  entries
• 3:44
  for
• 3:44
  user-facing
• 3:44
  commands,
• 3:45
  184
• 3:46
  for
• 3:46
  model-facing
• 3:46
  tools
• 3:47
  —
• 3:47
  each
• 3:47
  carrying
• 3:48
  name,
• 3:48
  source
• 3:48
  hint,
• 3:49
  and
• 3:49
  responsibility
• 3:49
  description,
• 3:50
  loaded
• 3:50
  on
• 3:51
  demand.
• 3:51
  A
• 3:52
  three-tier
• 3:52
  permission
• 3:52
  system
• 3:53
  where
• 3:53
  the
• 3:53
  Bash
• 3:53
  tool
• 3:53
  alone
• 3:54
  has
• 3:54
  an
• 3:54
  18-module
• 3:54
  security
• 3:55
  architecture
• 3:55
  spanning
• 3:56
  pre-approved
• 3:56
  command
• 3:56
  patterns,
• 3:57
  destructive
• 3:57
  command
• 3:58
  warnings,
• 3:58
  git-specific
• 3:58
  safety
• 3:59
  checks,
• 3:59
  and
• 3:59
  sandbox
• 4:00
  termination.
• 4:01
  Session
• 4:01
  persistence
• 4:02
  that
• 4:02
  captures
• 4:02
  not
• 4:03
  just
• 4:03
  conversation
• 4:03
  history
• 4:04
  but
• 4:04
  token
• 4:04
  usage,
• 4:05
  permission
• 4:05
  decisions,
• 4:06
  and
• 4:06
  configuration
• 4:06
  —
• 4:07
  enabling
• 4:07
  full
• 4:08
  reconstruction
• 4:08
  after
• 4:08
  a
• 4:08
  crash.
• 4:10
  Workflow
• 4:10
  state
• 4:10
  tracking
• 4:11
  that
• 4:11
  distinguishes
• 4:11
  "what
• 4:11
  have
• 4:12
  we
• 4:12
  said"
• 4:12
  from
• 4:12
  "what
• 4:12
  step
• 4:13
  are
• 4:13
  we
• 4:13
  in"
• 4:13
  and
• 4:14
  "what
• 4:14
  side
• 4:14
  effects
• 4:14
  have
• 4:15
  happened."
• 4:15
  Six
• 4:16
  built-in
• 4:16
  agent
• 4:17
  types
• 4:17
  (Explore,
• 4:18
  Plan,
• 4:18
  Verify,
• 4:19
  Guide,
• 4:20
  General
• 4:20
  Purpose,
• 4:21
  Status
• 4:21
  Line
• 4:21
  Setup),
• 4:22
  each
• 4:22
  with
• 4:22
  constrained
• 4:23
  tool
• 4:23
  access
• 4:23
  and
• 4:23
  behavioral
• 4:24
  boundaries.
• 4:25
  The
• 4:25
  takeaway:
• 4:26
  building
• 4:26
  agents
• 4:26
  is
• 4:27
  80%
• 4:27
  non-glamorous
• 4:28
  plumbing
• 4:28
  and
• 4:28
  20%
• 4:29
  AI
• 4:29
  .
• 4:30
  The
• 4:30
  leak's
• 4:30
  ironic
• 4:30
  backdrop:
• 4:31
  Anthropic
• 4:32
  says
• 4:32
  AI
• 4:32
  writes
• 4:32
  90%
• 4:33
  of
• 4:33
  its
• 4:33
  code,
• 4:34
  and
• 4:34
  engineers
• 4:34
  ship
• 4:34
  up
• 4:35
  to
• 4:35
  five
• 4:35
  releases
• 4:35
  per
• 4:36
  day.
• 4:37
  Two
• 4:37
  significant
• 4:37
  leaks
• 4:38
  in
• 4:38
  one
• 4:38
  week
• 4:38
  —
• 4:39
  the
• 4:39
  Mythos
• 4:40
  draft
• 4:40
  blog
• 4:40
  and
• 4:40
  the
• 4:40
  Claude
• 4:41
  Code
• 4:41
  source
• 4:41
  map
• 4:41
  —
• 4:42
  raise
• 4:42
  a
• 4:42
  question
• 4:43
  every
• 4:43
  team
• 4:43
  building
• 4:43
  with
• 4:44
  AI-assisted
• 4:44
  development
• 4:45
  should
• 4:45
  be
• 4:45
  asking:
• 4:46
  is
• 4:46
  your
• 4:46
  development
• 4:46
  velocity
• 4:47
  outrunning
• 4:47
  your
• 4:47
  operational
• 4:48
  discipline?
• 4:49
  The
• 4:49
  community's
• 4:49
  default
• 4:50
  theory
• 4:50
  involves
• 4:50
  an
• 4:50
  accidental
• 4:51
  switch
• 4:51
  to
• 4:51
  adaptive
• 4:52
  reasoning
• 4:52
  mode
• 4:52
  that
• 4:52
  dropped
• 4:53
  to
• 4:53
  Sonnet,
• 4:53
  which
• 4:54
  then
• 4:54
  committed
• 4:54
  the
• 4:54
  build
• 4:54
  artifact
• 4:55
  as
• 4:55
  part
• 4:55
  of
• 4:55
  a
• 4:55
  routine
• 4:56
  step.
• 4:57
  Whether
• 4:57
  or
• 4:57
  not
• 4:57
  that's
• 4:57
  what
• 4:57
  happened,
• 4:58
  it's
• 4:58
  telling
• 4:58
  that
• 4:58
  the
• 4:59
  AI
• 4:59
  committing
• 4:59
  the
• 4:59
  build
• 5:00
  artifact
• 5:00
  that
• 5:00
  leaked
• 5:00
  the
• 5:00
  AI's
• 5:01
  own
• 5:01
  code
• 5:01
  is
• 5:02
  a
• 5:02
  plausible
• 5:02
  chain
• 5:02
  of
• 5:02
  events
• 5:03
  in
• 5:03
  2026.
• 5:04
  The
• 5:04
  "Everything
• 5:05
  Claude
• 5:05
  Code"
• 5:05
  project,
• 5:06
  now
• 5:06
  at
• 5:06
  140K+
• 5:07
  stars
• 5:08
  with
• 5:08
  170+
• 5:09
  contributors,
• 5:10
  represents
• 5:11
  the
• 5:11
  community's
• 5:11
  response:
• 5:12
  a
• 5:12
  systematic
• 5:13
  performance
• 5:13
  optimization
• 5:14
  framework
• 5:14
  for
• 5:15
  agent
• 5:15
  harnesses
• 5:15
  that
• 5:15
  works
• 5:16
  across
• 5:16
  Claude
• 5:16
  Code,
• 5:17
  Codex,
• 5:18
  Cursor,
• 5:18
  OpenCode,
• 5:19
  and
• 5:19
  Gemini,
• 5:20
  shipping
• 5:20
  47
• 5:21
  agents,
• 5:21
  181
• 5:22
  skills,
• 5:23
  and
• 5:23
  79
• 5:23
  legacy
• 5:24
  command
• 5:24
  shims.
• 5:25
  Its
• 5:25
  v1.10
• 5:28
  release
• 5:28
  includes
• 5:28
  an
• 5:29
  ECC
• 5:29
  2.0
• 5:29
  alpha
• 5:30
  —
• 5:31
  a
• 5:31
  Rust
• 5:31
  control-plane
• 5:32
  prototype
• 5:32
  .
• 5:33
  Steve
• 5:33
  Yegge's
• 5:33
  Gas
• 5:34
  Town
• 5:34
  hit
• 5:34
  version
• 5:34
  1.0
• 5:35
  this
• 5:35
  week
• 5:35
  alongside
• 5:36
  Beads,
• 5:37
  its
• 5:37
  underlying
• 5:37
  memory
• 5:38
  and
• 5:38
  knowledge
• 5:38
  graph
• 5:38
  system.
• 5:39
  The
• 5:39
  pitch:
• 5:40
  coding
• 5:40
  agents
• 5:41
  make
• 5:41
  you
• 5:41
  read
• 5:41
  too
• 5:41
  much.
• 5:42
  Claude
• 5:43
  Code
• 5:43
  is
• 5:43
  "a
• 5:43
  wall
• 5:43
  of
• 5:43
  scrolling
• 5:44
  text"
• 5:44
  that
• 5:44
  gets
• 5:45
  scrollier
• 5:45
  the
• 5:45
  harder
• 5:45
  it
• 5:45
  works.
• 5:46
  Gas
• 5:47
  Town's
• 5:47
  Mayor
• 5:47
  abstraction
• 5:48
  reads
• 5:48
  all
• 5:48
  the
• 5:48
  worker
• 5:49
  output
• 5:49
  and
• 5:49
  surfaces
• 5:50
  only
• 5:50
  what
• 5:50
  matters
• 5:50
  —
• 5:51
  a
• 5:51
  Chief
• 5:51
  of
• 5:51
  Staff
• 5:52
  managing
• 5:52
  a
• 5:52
  team
• 5:52
  of
• 5:52
  Executive
• 5:53
  Assistants.
• 5:54
  Beads,
• 5:55
  now
• 5:55
  backed
• 5:55
  by
• 5:56
  embedded
• 5:56
  Dolt
• 5:56
  (replacing
• 5:57
  the
• 5:57
  fragile
• 5:57
  SQLite
• 5:58
  +
• 5:58
  JSONL
• 5:58
  architecture
• 5:59
  that
• 5:59
  produced
• 6:00
  race
• 6:00
  conditions
• 6:01
  and
• 6:01
  tombstone
• 6:01
  hell),
• 6:02
  provides
• 6:02
  version-controlled
• 6:03
  work
• 6:03
  items
• 6:04
  queryable
• 6:04
  with
• 6:04
  SQL,
• 6:05
  forming
• 6:06
  a
• 6:06
  "universal
• 6:06
  ledger
• 6:07
  for
• 6:07
  all
• 6:07
  knowledge
• 6:07
  work."
• 6:08
  Non-technologists
• 6:09
  are
• 6:09
  building
• 6:09
  production
• 6:10
  software
• 6:10
  with
• 6:10
  it
• 6:10
  —
• 6:11
  Yegge
• 6:11
  cites
• 6:12
  a
• 6:12
  communications
• 6:12
  major
• 6:13
  four
• 6:13
  years
• 6:13
  out
• 6:13
  of
• 6:14
  school
• 6:14
  replacing
• 6:14
  a
• 6:14
  niche
• 6:15
  SaaS
• 6:15
  product
• 6:15
  at
• 6:15
  her
• 6:16
  company.
• 6:17
  Gas
• 6:17
  City,
• 6:17
  the
• 6:18
  successor
• 6:18
  with
• 6:18
  a
• 6:18
  full
• 6:18
  modular
• 6:19
  platform
• 6:19
  architecture,
• 6:20
  is
• 6:21
  in
• 6:21
  alpha
• 6:21
  .
• 6:22
  On
• 6:22
  the
• 6:22
  lighter
• 6:22
  end
• 6:23
  of
• 6:23
  the
• 6:23
  memory-management
• 6:23
  spectrum,
• 6:24
  Andrej
• 6:24
  Karpathy
• 6:25
  shared
• 6:25
  an
• 6:25
  Obsidian-based
• 6:26
  knowledge
• 6:26
  system
• 6:27
  that
• 6:27
  uses
• 6:27
  nothing
• 6:28
  but
• 6:28
  markdown
• 6:28
  file
• 6:28
  structure
• 6:29
  —
• 6:29
  raw
• 6:30
  folder
• 6:30
  for
• 6:30
  ingestion,
• 6:31
  wiki
• 6:31
  folder
• 6:31
  with
• 6:32
  indexes,
• 6:32
  a
• 6:33
  master
• 6:33
  index
• 6:33
  —
• 6:34
  and
• 6:34
  Claude
• 6:35
  Code's
• 6:35
  ability
• 6:35
  to
• 6:35
  navigate
• 6:36
  it.
• 6:37
  No
• 6:37
  vector
• 6:37
  database,
• 6:38
  no
• 6:38
  embeddings,
• 6:39
  no
• 6:39
  complicated
• 6:40
  retrieval.
• 6:41
  For
• 6:41
  solo
• 6:41
  operators
• 6:42
  and
• 6:42
  small
• 6:42
  teams,
• 6:43
  the
• 6:43
  argument
• 6:44
  is
• 6:44
  compelling:
• 6:45
  just
• 6:45
  start
• 6:45
  with
• 6:45
  organized
• 6:46
  markdown
• 6:47
  and
• 6:47
  upgrade
• 6:47
  to
• 6:47
  real
• 6:48
  RAG
• 6:48
  when
• 6:48
  scale
• 6:48
  demands
• 6:49
  it
• 6:49
  .
• 6:52
  A
• 6:52
  joint
• 6:52
  team
• 6:53
  from
• 6:53
  CISPA,
• 6:54
  UC
• 6:54
  San
• 6:55
  Diego,
• 6:55
  and
• 6:55
  Google
• 6:56
  published
• 6:56
  TDXRay,
• 6:57
  a
• 6:57
  framework
• 6:58
  that
• 6:58
  systematically
• 6:59
  dismantles
• 6:59
  the
• 6:59
  side-channel
• 7:00
  isolation
• 7:00
  promises
• 7:01
  of
• 7:01
  Intel
• 7:01
  TDX
• 7:01
  —
• 7:02
  the
• 7:02
  confidential
• 7:03
  computing
• 7:03
  technology
• 7:04
  that
• 7:04
  cloud
• 7:04
  providers
• 7:05
  market
• 7:05
  as
• 7:05
  the
• 7:05
  solution
• 7:06
  for
• 7:06
  running
• 7:06
  sensitive
• 7:06
  AI
• 7:07
  workloads
• 7:07
  on
• 7:07
  shared
• 7:08
  hardware.
• 7:09
  The
• 7:09
  researchers
• 7:09
  identified
• 7:10
  four
• 7:10
  new
• 7:10
  host-observable
• 7:11
  primitives:
• 7:12
  SEPTrace
• 7:13
  (exploiting
• 7:13
  TDX's
• 7:14
  page
• 7:14
  block/unblock
• 7:15
  API
• 7:16
  for
• 7:16
  page-granularity
• 7:17
  traces),
• 7:18
  Load+Probe
• 7:19
  (timing-based
• 7:19
  cache
• 7:20
  state
• 7:20
  detection
• 7:20
  of
• 7:20
  private
• 7:21
  memory),
• 7:22
  TSX-Probe
• 7:22
  (hardware
• 7:23
  transactions
• 7:23
  revealing
• 7:24
  cache
• 7:24
  state
• 7:24
  without
• 7:24
  precise
• 7:25
  timers),
• 7:26
  and
• 7:26
  MWAIT-Probe
• 7:27
  (using
• 7:29
  sleep/wake
• 7:31
  synchronization
• 7:31
  instructions
• 7:32
  to
• 7:32
  track
• 7:32
  guest
• 7:32
  memory
• 7:33
  access).
• 7:34
  Combined
• 7:34
  into
• 7:34
  a
• 7:34
  hybrid
• 7:35
  monitoring
• 7:35
  approach,
• 7:36
  these
• 7:36
  primitives
• 7:36
  produce
• 7:37
  cache-line-granular
• 7:38
  memory
• 7:38
  access
• 7:39
  traces
• 7:39
  of
• 7:39
  unmodified
• 7:40
  confidential
• 7:40
  VMs
• 7:40
  —
• 7:41
  all
• 7:42
  from
• 7:42
  the
• 7:42
  host
• 7:42
  side,
• 7:43
  requiring
• 7:43
  no
• 7:43
  guest
• 7:44
  cooperation
• 7:44
  .
• 7:45
  The
• 7:45
  practical
• 7:45
  impact
• 7:46
  lands
• 7:46
  hardest
• 7:46
  on
• 7:46
  private
• 7:47
  LLM
• 7:47
  inference,
• 7:48
  an
• 7:48
  increasingly
• 7:49
  common
• 7:49
  confidential
• 7:50
  computing
• 7:50
  workload.
• 7:51
  By
• 7:51
  monitoring
• 7:52
  memory
• 7:52
  access
• 7:52
  patterns
• 7:53
  during
• 7:53
  tokenization
• 7:53
  —
• 7:54
  a
• 7:54
  phase
• 7:55
  that
• 7:55
  runs
• 7:55
  on
• 7:55
  the
• 7:55
  CPU
• 7:56
  with
• 7:56
  data-dependent
• 7:57
  memory
• 7:57
  accesses
• 7:57
  —
• 7:58
  the
• 7:59
  researchers
• 7:59
  recovered
• 8:00
  user
• 8:00
  prompts
• 8:00
  with
• 8:00
  91.5%
• 8:02
  average
• 8:02
  similarity
• 8:02
  for
• 8:03
  Llama
• 8:03
  3.2
• 8:03
  and
• 8:04
  94.2%
• 8:05
  for
• 8:05
  Gemma
• 8:05
  3.
• 8:06
  All
• 8:06
  guest
• 8:07
  memory
• 8:07
  remained
• 8:07
  encrypted
• 8:08
  throughout.
• 8:09
  The
• 8:09
  attack
• 8:09
  operates
• 8:09
  entirely
• 8:10
  within
• 8:10
  the
• 8:10
  boundaries
• 8:11
  of
• 8:11
  a
• 8:11
  legitimate
• 8:12
  cloud
• 8:12
  host.
• 8:13
  Intel's
• 8:13
  own
• 8:13
  threat
• 8:13
  model
• 8:14
  explicitly
• 8:14
  excludes
• 8:15
  microarchitectural
• 8:16
  side
• 8:16
  channels,
• 8:17
  leaving
• 8:17
  evaluation
• 8:18
  and
• 8:18
  containment
• 8:19
  to
• 8:19
  application
• 8:19
  developers
• 8:20
  —
• 8:20
  developers
• 8:21
  who,
• 8:21
  as
• 8:21
  the
• 8:21
  paper
• 8:22
  notes,
• 8:22
  "lack
• 8:23
  practical,
• 8:23
  general-purpose
• 8:24
  tools
• 8:24
  to
• 8:25
  assess
• 8:25
  (let
• 8:25
  alone
• 8:25
  mitigate)
• 8:26
  leakage."
• 8:27
  The
• 8:27
  proposed
• 8:27
  mitigation,
• 8:28
  data-oblivious
• 8:29
  tokenization
• 8:29
  using
• 8:30
  ORAM
• 8:30
  techniques,
• 8:30
  works
• 8:31
  but
• 8:31
  represents
• 8:31
  a
• 8:31
  short-term
• 8:32
  fix.
• 8:33
  The
• 8:33
  fundamental
• 8:33
  problem
• 8:34
  is
• 8:34
  architectural:
• 8:35
  hosts
• 8:36
  and
• 8:36
  guests
• 8:36
  share
• 8:36
  caches,
• 8:37
  interconnects,
• 8:38
  and
• 8:38
  memory
• 8:38
  controllers,
• 8:39
  and
• 8:39
  TDX's
• 8:39
  management
• 8:40
  interfaces
• 8:41
  leak
• 8:41
  measurable
• 8:41
  feedback
• 8:42
  about
• 8:42
  guest
• 8:42
  behavior.
• 8:43
  Meanwhile,
• 8:44
  on
• 8:44
  the
• 8:44
  GPU
• 8:44
  side,
• 8:45
  a
• 8:45
  separate
• 8:45
  report
• 8:46
  warns
• 8:46
  that
• 8:46
  malicious
• 8:47
  CUDA
• 8:47
  kernels
• 8:47
  can
• 8:47
  perform
• 8:48
  Rowhammer
• 8:48
  attacks
• 8:48
  —
• 8:49
  bit-flipping
• 8:50
  DRAM
• 8:50
  through
• 8:50
  carefully
• 8:51
  crafted
• 8:51
  memory
• 8:51
  access
• 8:52
  patterns
• 8:52
  —
• 8:53
  to
• 8:53
  escalate
• 8:53
  privileges
• 8:53
  to
• 8:54
  root
• 8:54
  on
• 8:54
  NVIDIA
• 8:54
  GPU
• 8:55
  machines
• 8:55
  .
• 8:56
  The
• 8:56
  confidential
• 8:56
  computing
• 8:57
  trust
• 8:57
  chain
• 8:57
  is
• 8:58
  only
• 8:58
  as
• 8:58
  strong
• 8:58
  as
• 8:58
  its
• 8:59
  weakest
• 8:59
  physical
• 8:59
  layer,
• 9:00
  and
• 9:00
  that
• 9:00
  layer
• 9:00
  now
• 9:01
  spans
• 9:01
  both
• 9:01
  CPU
• 9:02
  and
• 9:02
  GPU
• 9:02
  memory.
• 9:06
  The
• 9:06
  [un]prompted
• 9:07
  2026
• 9:07
  conference
• 9:08
  in
• 9:08
  San
• 9:08
  Francisco
• 9:09
  produced
• 9:09
  three
• 9:10
  talks
• 9:10
  that,
• 9:10
  taken
• 9:11
  together,
• 9:11
  argue
• 9:12
  the
• 9:12
  entire
• 9:12
  paradigm
• 9:13
  of
• 9:13
  AI
• 9:13
  security
• 9:14
  needs
• 9:14
  to
• 9:14
  change
• 9:14
  —
• 9:15
  from
• 9:15
  inspecting
• 9:16
  what
• 9:16
  models
• 9:16
  say
• 9:16
  to
• 9:17
  monitoring
• 9:17
  what
• 9:17
  they
• 9:17
  think.
• 9:19
  Carl
• 9:19
  Hurd
• 9:19
  of
• 9:19
  Starseer
• 9:20
  presented
• 9:20
  the
• 9:20
  most
• 9:20
  technically
• 9:21
  ambitious
• 9:21
  case:
• 9:22
  instrumenting
• 9:23
  a
• 9:23
  running
• 9:23
  model's
• 9:23
  residual
• 9:24
  stream
• 9:24
  using
• 9:25
  mechanistic
• 9:25
  interpretability
• 9:26
  to
• 9:26
  detect
• 9:26
  dangerous
• 9:27
  intent
• 9:27
  via
• 9:27
  cosine
• 9:28
  similarity
• 9:28
  (direction)
• 9:29
  and
• 9:29
  scalar
• 9:29
  projection
• 9:30
  (magnitude).
• 9:31
  His
• 9:31
  concrete
• 9:31
  artifact
• 9:32
  —
• 9:33
  a
• 9:33
  YARA-style
• 9:33
  detection
• 9:34
  rule
• 9:34
  that
• 9:34
  checks
• 9:34
  layers
• 9:35
  15–24
• 9:36
  for
• 9:36
  file-deletion
• 9:37
  intent
• 9:37
  with
• 9:37
  a
• 9:37
  0.85
• 9:38
  projection
• 9:39
  threshold
• 9:39
  —
• 9:40
  gives
• 9:40
  detection
• 9:41
  engineers
• 9:41
  a
• 9:41
  familiar,
• 9:41
  extensible
• 9:42
  format.
• 9:43
  The
• 9:43
  engineering
• 9:43
  reality
• 9:44
  check
• 9:44
  is
• 9:44
  sobering:
• 9:45
  GPT-OSS-20B
• 9:48
  generates
• 9:49
  roughly
• 9:49
  4MB
• 9:49
  of
• 9:49
  activation
• 9:50
  data
• 9:50
  for
• 9:50
  a
• 9:50
  single
• 9:51
  first
• 9:51
  token,
• 9:52
  and
• 9:52
  a
• 9:52
  full
• 9:52
  128K
• 9:53
  context
• 9:53
  window
• 9:54
  produces
• 9:54
  over
• 9:54
  10TB
• 9:55
  of
• 9:55
  BF16
• 9:56
  data.
• 9:56
  Hurd's
• 9:57
  answer
• 9:57
  is
• 9:57
  surgical
• 9:57
  monitoring
• 9:58
  of
• 9:58
  only
• 9:58
  the
• 9:58
  residual
• 9:58
  stream
• 9:59
  at
• 9:59
  empirically
• 9:59
  relevant
• 10:00
  layers.
• 10:01
  The
• 10:01
  prerequisite:
• 10:01
  sovereign
• 10:02
  infrastructure.
• 10:03
  Cloud-hosted
• 10:03
  APIs
• 10:04
  from
• 10:04
  OpenAI,
• 10:05
  Anthropic,
• 10:06
  and
• 10:06
  Google
• 10:06
  don't
• 10:06
  expose
• 10:06
  activations
• 10:07
  .
• 10:08
  Ilia
• 10:08
  Shumailov,
• 10:09
  formerly
• 10:09
  of
• 10:09
  Oxford
• 10:10
  and
• 10:10
  now
• 10:10
  running
• 10:10
  an
• 10:11
  AI
• 10:11
  security
• 10:11
  company,
• 10:12
  made
• 10:12
  the
• 10:12
  uncomfortable
• 10:13
  argument
• 10:13
  that
• 10:13
  the
• 10:13
  cat-and-mouse
• 10:14
  cycle
• 10:14
  isn't
• 10:14
  a
• 10:14
  resourcing
• 10:15
  problem
• 10:15
  —
• 10:15
  it's
• 10:16
  a
• 10:16
  mathematical
• 10:16
  one.
• 10:17
  His
• 10:17
  team
• 10:17
  published
• 10:17
  a
• 10:17
  paper
• 10:18
  evaluating
• 10:18
  every
• 10:19
  major
• 10:19
  prompt
• 10:19
  injection
• 10:19
  defense,
• 10:20
  broke
• 10:20
  them
• 10:20
  all,
• 10:21
  published
• 10:21
  a
• 10:21
  better
• 10:22
  defense,
• 10:22
  and
• 10:22
  expected
• 10:23
  it
• 10:23
  to
• 10:23
  be
• 10:23
  broken
• 10:23
  within
• 10:24
  a
• 10:24
  month.
• 10:24
  The
• 10:25
  escape:
• 10:25
  CAMEL,
• 10:26
  which
• 10:26
  implements
• 10:26
  control
• 10:27
  flow
• 10:27
  integrity
• 10:27
  by
• 10:28
  separating
• 10:28
  instruction
• 10:28
  flow
• 10:29
  from
• 10:29
  data
• 10:29
  flow.
• 10:30
  A
• 10:30
  planning
• 10:30
  model
• 10:31
  generates
• 10:31
  a
• 10:31
  fixed
• 10:31
  execution
• 10:32
  plan;
• 10:33
  a
• 10:33
  separate
• 10:33
  query
• 10:34
  LLM
• 10:34
  processes
• 10:34
  untrusted
• 10:35
  data
• 10:35
  and
• 10:35
  feeds
• 10:36
  structured
• 10:36
  output
• 10:36
  into
• 10:37
  the
• 10:37
  plan
• 10:37
  without
• 10:37
  being
• 10:37
  able
• 10:38
  to
• 10:38
  modify
• 10:38
  it.
• 10:39
  For
• 10:39
  tasks
• 10:39
  exhibiting
• 10:40
  "task-data
• 10:40
  independence"
• 10:41
  —
• 10:41
  where
• 10:42
  the
• 10:42
  plan
• 10:42
  can
• 10:42
  be
• 10:42
  written
• 10:42
  without
• 10:43
  seeing
• 10:43
  untrusted
• 10:43
  data
• 10:44
  —
• 10:44
  the
• 10:44
  guarantee
• 10:45
  is
• 10:45
  formal:
• 10:46
  adversaries
• 10:46
  controlling
• 10:47
  external
• 10:47
  data
• 10:47
  cannot
• 10:47
  redirect
• 10:48
  agent
• 10:48
  actions.
• 10:49
  Computer
• 10:49
  use
• 10:50
  benchmarks
• 10:50
  show
• 10:50
  most
• 10:51
  tasks
• 10:51
  can
• 10:51
  be
• 10:51
  fully
• 10:52
  pre-planned
• 10:52
  in
• 10:52
  3,000–4,000
• 10:54
  lines
• 10:54
  of
• 10:54
  deterministic
• 10:55
  code.
• 10:56
  The
• 10:56
  alarming
• 10:56
  discovery:
• 10:57
  "cookie-prompt
• 10:58
  attacks"
• 10:58
  exploit
• 10:58
  agents'
• 10:59
  pre-planned
• 10:59
  cookie
• 10:59
  consent
• 11:00
  handling.
• 11:01
  Adversaries
• 11:01
  embed
• 11:02
  fake
• 11:02
  GDPR
• 11:02
  popups
• 11:03
  in
• 11:03
  ads,
• 11:04
  capturing
• 11:04
  agent
• 11:04
  actions
• 11:05
  through
• 11:05
  predictable
• 11:05
  control
• 11:06
  flow
• 11:06
  .
• 11:07
  Akash
• 11:07
  Mukherjee
• 11:08
  of
• 11:08
  Realm
• 11:08
  Labs
• 11:08
  demonstrated
• 11:09
  the
• 11:09
  supply
• 11:09
  chain
• 11:09
  nightmare:
• 11:11
  a
• 11:11
  backdoored
• 11:11
  Llama
• 11:12
  3.1,
• 11:13
  indistinguishable
• 11:14
  from
• 11:14
  the
• 11:14
  clean
• 11:14
  model
• 11:14
  under
• 11:15
  every
• 11:15
  black-box
• 11:15
  test,
• 11:16
  constructed
• 11:17
  in
• 11:17
  two
• 11:17
  hours
• 11:17
  with
• 11:17
  500
• 11:18
  documents
• 11:19
  using
• 11:19
  published
• 11:19
  Anthropic
• 11:20
  research.
• 11:21
  The
• 11:21
  backdoor
• 11:22
  applies
• 11:22
  the
• 11:22
  exact
• 11:22
  opposite
• 11:23
  vector
• 11:23
  to
• 11:23
  the
• 11:23
  model's
• 11:24
  refusal
• 11:24
  direction
• 11:24
  when
• 11:24
  a
• 11:24
  trigger
• 11:25
  string
• 11:25
  is
• 11:25
  present,
• 11:26
  achieving
• 11:27
  >95%
• 11:27
  attack
• 11:28
  success
• 11:28
  with
• 11:28
  0%
• 11:29
  false
• 11:29
  positives
• 11:30
  without
• 11:30
  the
• 11:30
  trigger.
• 11:31
  In
• 11:31
  a
• 11:31
  live
• 11:32
  demo,
• 11:32
  monitoring
• 11:33
  the
• 11:33
  model's
• 11:33
  hidden
• 11:34
  states
• 11:34
  in
• 11:34
  real
• 11:34
  time
• 11:35
  revealed
• 11:35
  the
• 11:35
  refusal
• 11:36
  signal
• 11:36
  collapsing
• 11:36
  before
• 11:37
  a
• 11:37
  single
• 11:37
  output
• 11:37
  token
• 11:38
  was
• 11:38
  generated.
• 11:39
  Detection
• 11:39
  without
• 11:40
  knowing
• 11:40
  the
• 11:40
  trigger
• 11:40
  is
• 11:40
  possible
• 11:41
  through
• 11:41
  unsupervised
• 11:42
  dimensional
• 11:42
  structure
• 11:43
  analysis
• 11:43
  and
• 11:43
  baseline
• 11:44
  comparison
• 11:44
  —
• 11:45
  the
• 11:45
  backdoored
• 11:45
  model
• 11:46
  shows
• 11:46
  measurable
• 11:47
  differences
• 11:47
  in
• 11:47
  refusal
• 11:48
  signal
• 11:48
  strength
• 11:48
  even
• 11:49
  without
• 11:49
  the
• 11:49
  trigger
• 11:49
  present
• 11:49
  .
• 11:50
  Stuart
• 11:50
  Winter-Tear's
• 11:51
  "Agents
• 11:51
  on
• 11:52
  Rails"
• 11:52
  framing
• 11:52
  provides
• 11:53
  the
• 11:53
  governance
• 11:53
  wrapper:
• 11:54
  bounded
• 11:55
  agency
• 11:55
  means
• 11:55
  enough
• 11:55
  latitude
• 11:56
  for
• 11:56
  the
• 11:56
  system
• 11:57
  to
• 11:57
  operate
• 11:57
  under
• 11:57
  uncertainty,
• 11:58
  enough
• 11:59
  constraint
• 11:59
  that
• 11:59
  its
• 11:59
  freedom
• 12:00
  doesn't
• 12:00
  outrun
• 12:00
  anyone's
• 12:01
  ability
• 12:01
  to
• 12:01
  interrupt
• 12:02
  it.
• 12:02
  The
• 12:02
  rails
• 12:03
  propagate
• 12:03
  down
• 12:03
  every
• 12:04
  hop
• 12:04
  of
• 12:04
  a
• 12:04
  multi-agent
• 12:05
  delegation
• 12:05
  chain
• 12:05
  —
• 12:06
  not
• 12:06
  just
• 12:06
  at
• 12:06
  the
• 12:07
  entry
• 12:07
  point
• 12:07
  .
• 12:10
  Elastic's
• 12:10
  Joe
• 12:10
  Desimone
• 12:11
  built
• 12:11
  a
• 12:11
  supply-chain-monitor
• 12:12
  in
• 12:12
  one
• 12:12
  afternoon
• 12:13
  on
• 12:13
  zero
• 12:13
  sleep
• 12:14
  after
• 12:14
  RSAC
• 12:14
  —
• 12:14
  a
• 12:14
  tool
• 12:15
  that
• 12:15
  polls
• 12:15
  PyPI
• 12:15
  and
• 12:15
  npm,
• 12:16
  diffs
• 12:17
  new
• 12:17
  releases
• 12:17
  against
• 12:17
  previous
• 12:18
  versions,
• 12:18
  and
• 12:18
  LLM-classifies
• 12:19
  the
• 12:19
  changes
• 12:19
  as
• 12:20
  benign
• 12:20
  or
• 12:20
  malicious.
• 12:21
  It
• 12:21
  caught
• 12:21
  the
• 12:21
  axios
• 12:22
  0.30.4
• 12:23
  compromise,
• 12:24
  a
• 12:24
  postinstall
• 12:24
  backdoor
• 12:25
  that
• 12:25
  would
• 12:25
  have
• 12:25
  owned
• 12:25
  a
• 12:25
  significant
• 12:26
  chunk
• 12:26
  of
• 12:26
  the
• 12:26
  npm
• 12:26
  ecosystem.
• 12:27
  The
• 12:27
  tool
• 12:28
  shipped
• 12:28
  with
• 12:28
  Cursor
• 12:28
  Agent
• 12:29
  CLI
• 12:29
  and
• 12:29
  cloud
• 12:30
  LLM
• 12:30
  hardcoded,
• 12:31
  which
• 12:31
  one
• 12:31
  practitioner
• 12:32
  found
• 12:32
  unacceptable:
• 12:33
  he
• 12:33
  cloned
• 12:33
  it,
• 12:33
  swapped
• 12:34
  the
• 12:34
  backend
• 12:34
  for
• 12:34
  local
• 12:35
  vLLM
• 12:35
  running
• 12:35
  Qwopus3.5-27B-v3
• 12:39
  on
• 12:39
  an
• 12:40
  NVIDIA
• 12:40
  GB10,
• 12:40
  and
• 12:41
  wired
• 12:41
  it
• 12:41
  as
• 12:41
  a
• 12:41
  prerequisite
• 12:41
  for
• 12:42
  all
• 12:42
  dependency
• 12:42
  upgrades
• 12:42
  —
• 12:43
  npm
• 12:43
  install
• 12:44
  doesn't
• 12:44
  run
• 12:44
  until
• 12:44
  the
• 12:44
  AI
• 12:44
  monitor
• 12:45
  clears
• 12:45
  the
• 12:45
  release.
• 12:46
  The
• 12:46
  approach
• 12:46
  has
• 12:46
  a
• 12:46
  known
• 12:46
  blind
• 12:47
  spot:
• 12:47
  it
• 12:47
  implicitly
• 12:48
  trusts
• 12:48
  the
• 12:48
  previous
• 12:48
  version
• 12:49
  as
• 12:49
  a
• 12:49
  clean
• 12:49
  baseline,
• 12:50
  meaning
• 12:50
  pre-existing
• 12:51
  backdoors
• 12:51
  from
• 12:51
  before
• 12:52
  monitoring
• 12:52
  started
• 12:52
  would
• 12:52
  be
• 12:52
  invisible.
• 12:53
  Complementary
• 12:54
  full-content
• 12:55
  scanning
• 12:55
  of
• 12:55
  current
• 12:55
  versions,
• 12:56
  not
• 12:56
  just
• 12:56
  deltas,
• 12:57
  is
• 12:57
  the
• 12:57
  obvious
• 12:57
  next
• 12:57
  layer
• 12:57
  .
• 12:58
  CVE-2026-22738
• 13:03
  landed
• 13:03
  with
• 13:03
  a
• 13:03
  CVSS
• 13:04
  9.8
• 13:04
  —
• 13:06
  unauthenticated
• 13:07
  remote
• 13:07
  code
• 13:07
  execution
• 13:08
  via
• 13:08
  Spring
• 13:08
  Expression
• 13:09
  Language
• 13:09
  injection
• 13:09
  in
• 13:09
  Spring
• 13:10
  AI's
• 13:10
  SimpleVectorStore.similaritySearch().
• 13:13
  The
• 13:13
  filter
• 13:13
  key
• 13:13
  name
• 13:14
  passes
• 13:14
  verbatim
• 13:14
  into
• 13:15
  a
• 13:15
  SpEL
• 13:15
  template
• 13:15
  evaluated
• 13:16
  by
• 13:16
  StandardEvaluationContext,
• 13:17
  which
• 13:18
  exposes
• 13:18
  the
• 13:18
  full
• 13:18
  JVM
• 13:19
  reflection
• 13:19
  API.
• 13:20
  Two
• 13:20
  parser
• 13:21
  quirks
• 13:21
  must
• 13:21
  be
• 13:21
  navigated
• 13:22
  (single-quote
• 13:22
  stripping
• 13:23
  and
• 13:23
  double-quote
• 13:23
  wrapper
• 13:23
  handling),
• 13:24
  but
• 13:24
  the
• 13:24
  resulting
• 13:25
  payload
• 13:25
  achieves
• 13:26
  OS
• 13:26
  command
• 13:26
  execution
• 13:27
  confirmed
• 13:27
  by
• 13:27
  a
• 13:27
  SpEL
• 13:27
  runtime
• 13:28
  error
• 13:28
  that
• 13:28
  fires
• 13:29
  after
• 13:29
  exec()
• 13:29
  returns.
• 13:30
  Fixed
• 13:30
  in
• 13:30
  Spring
• 13:31
  AI
• 13:31
  Core
• 13:31
  1.0.5
• 13:33
  and
• 13:33
  1.1.4
• 13:33
  .
• 13:35
  This
• 13:35
  is
• 13:35
  a
• 13:35
  notable
• 13:35
  milestone:
• 13:37
  AI
• 13:37
  frameworks
• 13:37
  themselves
• 13:38
  —
• 13:38
  not
• 13:39
  just
• 13:39
  the
• 13:39
  models
• 13:39
  or
• 13:39
  the
• 13:40
  supply
• 13:40
  chain
• 13:40
  around
• 13:40
  them
• 13:40
  —
• 13:41
  are
• 13:41
  becoming
• 13:41
  direct
• 13:42
  attack
• 13:42
  surface.
• 13:43
  When
• 13:43
  your
• 13:44
  vector
• 13:44
  store's
• 13:44
  similarity
• 13:45
  search
• 13:45
  endpoint
• 13:45
  is
• 13:45
  an
• 13:45
  RCE
• 13:46
  vector,
• 13:47
  the
• 13:47
  security
• 13:47
  perimeter
• 13:48
  has
• 13:48
  expanded
• 13:48
  in
• 13:48
  a
• 13:48
  direction
• 13:49
  most
• 13:49
  teams
• 13:49
  haven't
• 13:50
  mapped.
• 13:51
  On
• 13:51
  the
• 13:51
  defensive
• 13:51
  discovery
• 13:52
  side,
• 13:52
  LLM-assisted
• 13:53
  vulnerability
• 13:53
  research
• 13:54
  is
• 13:54
  democratizing
• 13:55
  kernel
• 13:55
  security
• 13:55
  at
• 13:56
  a
• 13:56
  pace
• 13:56
  that
• 13:56
  caught
• 13:56
  even
• 13:56
  the
• 13:56
  maintainers
• 13:57
  off
• 13:57
  guard.
• 13:58
  Gadi
• 13:59
  Evron
• 13:59
  highlighted
• 13:59
  Willy
• 13:59
  Tarreau's
• 14:00
  response
• 14:00
  to
• 14:00
  Thomas's
• 14:01
  blog
• 14:01
  on
• 14:01
  LLM-driven
• 14:02
  vulnerability
• 14:02
  reporting:
• 14:04
  the
• 14:04
  kernel
• 14:04
  security
• 14:04
  list
• 14:05
  went
• 14:05
  from
• 14:05
  a
• 14:05
  few
• 14:05
  reports
• 14:06
  per
• 14:06
  week,
• 14:06
  to
• 14:07
  many
• 14:07
  (mostly
• 14:07
  slop),
• 14:08
  to
• 14:08
  now
• 14:08
  being
• 14:08
  inundated
• 14:09
  with
• 14:09
  real,
• 14:09
  actionable
• 14:10
  reports.
• 14:11
  The
• 14:11
  assessment
• 14:12
  is
• 14:12
  optimistic
• 14:12
  —
• 14:13
  this
• 14:13
  will
• 14:13
  lead
• 14:14
  to
• 14:14
  more
• 14:14
  secure
• 14:14
  software,
• 14:15
  harkening
• 14:15
  back
• 14:16
  to
• 14:16
  pre-2000
• 14:17
  engineering
• 14:17
  discipline,
• 14:18
  with
• 14:18
  bugs
• 14:18
  being
• 14:18
  reported
• 14:19
  rather
• 14:19
  than
• 14:19
  sold
• 14:20
  for
• 14:20
  millions
• 14:20
  to
• 14:21
  intelligence
• 14:21
  or
• 14:21
  criminal
• 14:22
  organizations
• 14:22
  .
• 14:23
  SANS
• 14:23
  is
• 14:23
  channeling
• 14:24
  that
• 14:24
  energy
• 14:24
  into
• 14:25
  structured
• 14:25
  competition:
• 14:26
  the
• 14:26
  FindEvil
• 14:27
  hackathon
• 14:27
  (April
• 14:27
  15
• 14:28
  –
• 14:28
  June
• 14:29
  15,
• 14:30
  $22,000+
• 14:32
  in
• 14:32
  prizes)
• 14:32
  challenges
• 14:33
  teams
• 14:33
  to
• 14:33
  build
• 14:34
  autonomous
• 14:34
  AI
• 14:35
  agents
• 14:35
  on
• 14:35
  the
• 14:35
  SIFT
• 14:35
  Workstation
• 14:36
  —
• 14:37
  200+
• 14:37
  incident
• 14:38
  response
• 14:38
  tools
• 14:38
  connected
• 14:39
  through
• 14:39
  Model
• 14:39
  Context
• 14:40
  Protocol.
• 14:41
  The
• 14:41
  motivation
• 14:42
  is
• 14:42
  blunt:
• 14:43
  CrowdStrike's
• 14:43
  fastest
• 14:44
  observed
• 14:44
  breakout
• 14:44
  time
• 14:45
  is
• 14:45
  7
• 14:45
  minutes,
• 14:46
  Horizon3's
• 14:47
  autonomous
• 14:47
  agent
• 14:48
  achieves
• 14:48
  full
• 14:48
  privilege
• 14:49
  escalation
• 14:49
  in
• 14:49
  60
• 14:50
  seconds,
• 14:51
  and
• 14:51
  MIT
• 14:51
  research
• 14:52
  shows
• 14:52
  AI
• 14:52
  attack
• 14:53
  workflows
• 14:53
  running
• 14:53
  47
• 14:54
  times
• 14:54
  faster
• 14:55
  than
• 14:55
  human
• 14:55
  operators.
• 14:56
  The
• 14:56
  defender
• 14:56
  gap
• 14:57
  is
• 14:57
  growing.
• 14:57
  Four
• 14:58
  architectural
• 14:58
  approaches
• 14:59
  are
• 14:59
  supported:
• 15:00
  direct
• 15:00
  agent
• 15:00
  extension,
• 15:01
  custom
• 15:02
  MCP
• 15:02
  servers,
• 15:03
  multi-agent
• 15:03
  frameworks,
• 15:04
  and
• 15:04
  alternative
• 15:05
  agentic
• 15:05
  IDEs
• 15:05
  .
• 15:09
  Redamon's
• 15:10
  v3.5.0
• 15:12
  release
• 15:12
  tackles
• 15:13
  a
• 15:13
  problem
• 15:13
  any
• 15:14
  pentester
• 15:14
  recognizes:
• 15:15
  a
• 15:15
  40-tool,
• 15:16
  300-parameter
• 15:17
  recon
• 15:18
  pipeline
• 15:18
  that
• 15:18
  nobody
• 15:18
  wants
• 15:19
  to
• 15:19
  configure.
• 15:20
  The
• 15:20
  solution
• 15:21
  is
• 15:21
  preset-driven:
• 15:22
  21
• 15:22
  expert-crafted
• 15:23
  presets
• 15:23
  (Bug
• 15:23
  Bounty
• 15:24
  Quick
• 15:24
  Wins,
• 15:25
  Stealth
• 15:25
  Recon
• 15:25
  with
• 15:25
  Tor,
• 15:26
  Red
• 15:26
  Team
• 15:26
  Operator,
• 15:27
  CVE
• 15:28
  Hunter,
• 15:28
  JS
• 15:29
  Secret
• 15:29
  Miner,
• 15:30
  API
• 15:30
  Security
• 15:31
  Audit,
• 15:31
  and
• 15:32
  more),
• 15:32
  user-saveable
• 15:33
  custom
• 15:33
  presets,
• 15:34
  and
• 15:34
  —
• 15:35
  the
• 15:35
  differentiator
• 15:35
  —
• 15:36
  AI-generated
• 15:37
  presets
• 15:37
  from
• 15:38
  natural
• 15:38
  language.
• 15:39
  Type
• 15:39
  "fast
• 15:40
  passive
• 15:40
  scan
• 15:40
  focused
• 15:41
  on
• 15:41
  subdomain
• 15:41
  discovery
• 15:42
  and
• 15:42
  OSINT,
• 15:43
  no
• 15:43
  active
• 15:44
  tools,"
• 15:45
  and
• 15:45
  the
• 15:45
  system
• 15:45
  reads
• 15:45
  the
• 15:46
  full
• 15:46
  parameter
• 15:46
  catalog,
• 15:47
  generates
• 15:48
  a
• 15:48
  validated,
• 15:49
  type-checked
• 15:49
  preset,
• 15:50
  and
• 15:50
  launches.
• 15:51
  Each
• 15:51
  tool
• 15:52
  feeds
• 15:52
  into
• 15:52
  the
• 15:52
  next:
• 15:52
  subdomain
• 15:53
  discovery
• 15:54
  into
• 15:54
  port
• 15:54
  scanning,
• 15:55
  port
• 15:55
  scanning
• 15:55
  into
• 15:56
  HTTP
• 15:56
  probing,
• 15:57
  HTTP
• 15:58
  probing
• 15:58
  into
• 15:58
  web
• 15:59
  crawling,
• 15:59
  web
• 16:00
  crawling
• 16:00
  into
• 16:00
  JavaScript
• 16:01
  analysis,
• 16:02
  and
• 16:02
  everything
• 16:02
  into
• 16:03
  vulnerability
• 16:03
  scanning.
• 16:04
  The
• 16:04
  platform
• 16:05
  question
• 16:05
  is
• 16:05
  whether
• 16:05
  AI-generated
• 16:06
  configuration
• 16:07
  for
• 16:07
  offensive
• 16:07
  tools
• 16:08
  represents
• 16:09
  genuine
• 16:09
  workflow
• 16:09
  improvement
• 16:10
  or
• 16:10
  just
• 16:10
  an
• 16:10
  expensive
• 16:11
  way
• 16:11
  to
• 16:11
  misconfigure
• 16:12
  an
• 16:12
  attack
• 16:12
  chain
• 16:12
  .
• 16:13
  On
• 16:13
  the
• 16:13
  infrastructure
• 16:14
  side,
• 16:14
  two
• 16:15
  releases
• 16:15
  from
• 16:15
  the
• 16:15
  same
• 16:16
  prolific
• 16:16
  open-source
• 16:17
  developer
• 16:17
  illustrate
• 16:17
  the
• 16:18
  breadth
• 16:18
  of
• 16:18
  Rust-based
• 16:19
  AI
• 16:19
  tooling
• 16:19
  now
• 16:19
  available.
• 16:21
  RVM
• 16:21
  (Rust
• 16:21
  Virtual
• 16:22
  Machine)
• 16:22
  anchors
• 16:23
  a
• 16:23
  portfolio
• 16:23
  spanning
• 16:24
  agent
• 16:24
  orchestration
• 16:24
  (claude-flow),
• 16:26
  quantum-resistant
• 16:27
  cryptography
• 16:27
  (QuDAG),
• 16:28
  CUDA-to-Rust
• 16:29
  transpilation,
• 16:30
  and
• 16:30
  dozens
• 16:30
  of
• 16:30
  specialized
• 16:31
  crates
• 16:31
  for
• 16:31
  everything
• 16:32
  from
• 16:32
  bit-parallel
• 16:33
  string
• 16:33
  search
• 16:33
  to
• 16:33
  temporal
• 16:34
  dynamics
• 16:34
  prediction
• 16:34
  .
• 16:35
  The
• 16:35
  Rudevolution
• 16:36
  releases
• 16:36
  page
• 16:37
  catalogs
• 16:37
  the
• 16:37
  broader
• 16:38
  ecosystem:
• 16:39
  agent
• 16:39
  registries
• 16:40
  based
• 16:40
  on
• 16:40
  OWASP's
• 16:41
  ANS
• 16:41
  Protocol,
• 16:42
  distributed
• 16:43
  runtime
• 16:43
  systems
• 16:44
  for
• 16:44
  federated
• 16:45
  AI
• 16:45
  services,
• 16:46
  steganographic
• 16:47
  frameworks
• 16:47
  for
• 16:47
  embedding
• 16:48
  AI
• 16:48
  commands
• 16:48
  in
• 16:48
  audio,
• 16:49
  and
• 16:49
  WiFi-based
• 16:50
  human
• 16:50
  pose
• 16:50
  estimation
• 16:51
  —
• 16:52
  each
• 16:52
  project
• 16:52
  integrating
• 16:53
  the
• 16:53
  previous
• 16:53
  in
• 16:54
  what
• 16:54
  the
• 16:54
  developer
• 16:54
  describes
• 16:55
  as
• 16:55
  a
• 16:55
  deliberate
• 16:55
  "prior
• 16:56
  art"
• 16:56
  strategy
• 16:56
  against
• 16:57
  agentic
• 16:57
  AI
• 16:58
  patents.
• 16:59
  The
• 16:59
  philosophy
• 16:59
  is
• 17:00
  publish
• 17:00
  first,
• 17:00
  free
• 17:01
  for
• 17:01
  all
• 17:01
  .