Latest / AGI Dreams – Open, Uncensored, & Local - AI News Digest / AGI Dreams Podcast – July 06, 2026

Transcript

AGI Dreams Podcast – July 06, 2026 · AGI Dreams – Open, Uncensored, & Local - AI News Digest

• 0:00
  🔒
• 0:00
  The
• 0:00
  Agent's
• 0:00
  Shell
• 0:00
  Problem
• 0:01
  Adversa.ai
• 0:02
  just
• 0:02
  published
• 0:02
  a
• 0:02
  systematic
• 0:03
  audit
• 0:03
  of
• 0:03
  AI
• 0:03
  coding
• 0:04
  agent
• 0:04
  shell
• 0:04
  guards,
• 0:05
  and
• 0:05
  the
• 0:05
  results
• 0:05
  should
• 0:05
  make
• 0:05
  you
• 0:06
  reconsider
• 0:06
  every
• 0:06
  tool
• 0:07
  in
• 0:07
  your
• 0:07
  stack.
• 0:08
  Their
• 0:08
  "GuardFall"
• 0:09
  research
• 0:09
  tested
• 0:09
  eleven
• 0:10
  open-source
• 0:10
  agents
• 0:10
  —
• 0:11
  including
• 0:11
  Cursor,
• 0:12
  Windsurf,
• 0:12
  Cline,
• 0:13
  and
• 0:13
  Aider
• 0:13
  —
• 0:13
  against
• 0:14
  five
• 0:14
  classes
• 0:14
  of
• 0:14
  shell
• 0:14
  injection
• 0:15
  bypass:
• 0:15
  quote
• 0:16
  stripping,
• 0:16
  IFS
• 0:17
  variable
• 0:17
  expansion,
• 0:18
  command
• 0:19
  substitution
• 0:19
  via
• 0:20
  backticks,
• 0:20
  base64-encoded
• 0:22
  payloads
• 0:22
  piped
• 0:22
  to
• 0:22
  bash,
• 0:23
  and
• 0:23
  destructive
• 0:23
  argv
• 0:23
  flags
• 0:24
  like
• 0:24
  --exec.
• 0:25
  Every
• 0:25
  single
• 0:26
  agent
• 0:26
  fell
• 0:26
  to
• 0:26
  at
• 0:26
  least
• 0:26
  one
• 0:27
  class.
• 0:27
  Most
• 0:28
  fell
• 0:28
  to
• 0:28
  all
• 0:28
  five.
• 0:29
  The
• 0:29
  quote-stripping
• 0:29
  bypass
• 0:30
  alone
• 0:30
  is
• 0:30
  embarrassing
• 0:31
  —
• 0:32
  agents
• 0:32
  that
• 0:32
  sanitize
• 0:33
  input
• 0:33
  by
• 0:33
  removing
• 0:33
  quotes
• 0:34
  actually
• 0:34
  create
• 0:35
  injection
• 0:35
  opportunities
• 0:35
  that
• 0:36
  didn't
• 0:36
  exist
• 0:36
  in
• 0:36
  the
• 0:36
  original
• 0:37
  string.
• 0:38
  The
• 0:38
  only
• 0:38
  tool
• 0:38
  with
• 0:38
  a
• 0:38
  structurally
• 0:39
  sound
• 0:39
  defense
• 0:39
  was
• 0:40
  Continue,
• 0:40
  whose
• 0:41
  five-stage
• 0:41
  tokenize-and-canonicalize
• 0:42
  evaluator
• 0:43
  parses
• 0:43
  commands
• 0:43
  into
• 0:44
  an
• 0:44
  AST
• 0:44
  before
• 0:44
  matching
• 0:45
  against
• 0:45
  policy,
• 0:46
  rather
• 0:46
  than
• 0:46
  pattern-matching
• 0:47
  raw
• 0:47
  strings
• 0:47
  like
• 0:47
  everyone
• 0:48
  else.
• 0:49
  The
• 0:49
  timing
• 0:49
  is
• 0:49
  notable.
• 0:50
  A
• 0:50
  new
• 0:50
  paper
• 0:51
  (arXiv
• 0:52
  2606.24496)
• 0:54
  reports
• 0:54
  the
• 0:54
  first
• 0:54
  security
• 0:55
  analysis
• 0:55
  of
• 0:55
  twelve
• 0:56
  offensive-security
• 0:56
  agent
• 0:57
  tools
• 0:57
  —
• 0:57
  the
• 0:58
  red-team
• 0:58
  agents
• 0:58
  themselves.
• 0:59
  The
• 0:59
  researchers
• 1:00
  achieved
• 1:00
  near-deterministic
• 1:01
  remote
• 1:01
  code
• 1:01
  execution
• 1:02
  on
• 1:02
  systems
• 1:03
  powered
• 1:03
  by
• 1:03
  Claude
• 1:03
  Opus
• 1:04
  4.8,
• 1:05
  GPT-5.5,
• 1:06
  and
• 1:06
  Gemini
• 1:06
  3.1
• 1:07
  Pro,
• 1:07
  without
• 1:08
  using
• 1:08
  prompt
• 1:08
  injection
• 1:08
  at
• 1:09
  all.
• 1:09
  The
• 1:09
  kill
• 1:10
  chain
• 1:10
  is
• 1:10
  elegant
• 1:10
  and
• 1:10
  terrifying:
• 1:11
  Worker
• 1:11
  RCE
• 1:12
  leads
• 1:12
  to
• 1:12
  privilege
• 1:13
  escalation,
• 1:14
  then
• 1:14
  persistence,
• 1:14
  sandbox
• 1:15
  escape,
• 1:16
  and
• 1:16
  full
• 1:16
  host
• 1:16
  compromise.
• 1:17
  Ten
• 1:18
  of
• 1:18
  twelve
• 1:18
  tools
• 1:18
  were
• 1:18
  vulnerable.
• 1:19
  The
• 1:19
  attack
• 1:20
  works
• 1:20
  because
• 1:20
  these
• 1:21
  agents
• 1:21
  hold
• 1:21
  shell
• 1:21
  execution
• 1:22
  privileges
• 1:22
  by
• 1:23
  design
• 1:23
  and
• 1:23
  trust
• 1:23
  their
• 1:24
  own
• 1:24
  tool
• 1:24
  outputs
• 1:25
  as
• 1:25
  authoritative
• 1:25
  context.
• 1:26
  When
• 1:27
  an
• 1:27
  attacker
• 1:27
  controls
• 1:28
  what
• 1:28
  the
• 1:28
  tool
• 1:28
  observes
• 1:28
  —
• 1:29
  a
• 1:29
  malicious
• 1:30
  scan
• 1:30
  target,
• 1:31
  a
• 1:31
  crafted
• 1:31
  network
• 1:32
  response
• 1:32
  —
• 1:33
  the
• 1:33
  agent
• 1:33
  faithfully
• 1:34
  executes
• 1:34
  whatever
• 1:34
  the
• 1:35
  poisoned
• 1:35
  context
• 1:35
  implies.
• 1:36
  No
• 1:37
  jailbreak
• 1:37
  needed.
• 1:38
  The
• 1:38
  architecture
• 1:39
  is
• 1:39
  the
• 1:39
  vulnerability.
• 1:40
  This
• 1:40
  is
• 1:40
  the
• 1:41
  structural
• 1:41
  problem
• 1:41
  this
• 1:42
  newsletter
• 1:42
  has
• 1:42
  been
• 1:42
  circling
• 1:43
  for
• 1:43
  a
• 1:43
  year:
• 1:44
  LLMs
• 1:44
  process
• 1:45
  tokens
• 1:45
  without
• 1:45
  distinguishing
• 1:46
  trusted
• 1:46
  instructions
• 1:47
  from
• 1:47
  attacker-controlled
• 1:48
  data,
• 1:49
  and
• 1:49
  when
• 1:49
  those
• 1:49
  tokens
• 1:50
  map
• 1:50
  to
• 1:50
  exec(),
• 1:51
  the
• 1:51
  blast
• 1:51
  radius
• 1:51
  is
• 1:52
  the
• 1:52
  entire
• 1:52
  host.
• 1:53
  A
• 1:53
  Reddit
• 1:54
  thread
• 1:54
  on
• 1:54
  LLM
• 1:55
  backdoors
• 1:55
  crystallizes
• 1:56
  the
• 1:56
  community's
• 1:56
  current
• 1:56
  defense
• 1:57
  posture:
• 1:58
  "a
• 1:58
  poisoned
• 1:58
  model
• 1:59
  that
• 1:59
  can
• 1:59
  only
• 1:59
  emit
• 1:59
  text
• 2:00
  is
• 2:00
  mostly
• 2:00
  harmless
• 2:00
  —
• 2:01
  the
• 2:01
  whole
• 2:02
  risk
• 2:02
  lives
• 2:02
  at
• 2:02
  the
• 2:02
  agent
• 2:03
  boundary:
• 2:04
  tool
• 2:04
  calls,
• 2:05
  code
• 2:05
  execution,
• 2:06
  file
• 2:06
  access,
• 2:07
  network."
• 2:08
  Open
• 2:09
  weights
• 2:09
  don't
• 2:09
  protect
• 2:09
  you
• 2:09
  from
• 2:10
  a
• 2:10
  trigger
• 2:10
  you
• 2:10
  can't
• 2:10
  enumerate.
• 2:11
  Closed
• 2:12
  weights
• 2:12
  don't
• 2:12
  protect
• 2:13
  you
• 2:13
  from
• 2:13
  a
• 2:13
  provider
• 2:13
  who
• 2:13
  can
• 2:14
  silently
• 2:14
  swap
• 2:14
  the
• 2:14
  model.
• 2:15
  The
• 2:15
  defense
• 2:16
  ends
• 2:16
  up
• 2:16
  the
• 2:16
  same
• 2:16
  for
• 2:16
  both:
• 2:17
  treat
• 2:18
  the
• 2:18
  model
• 2:18
  as
• 2:18
  untrusted
• 2:19
  by
• 2:19
  default,
• 2:20
  require
• 2:20
  human
• 2:20
  confirmation
• 2:21
  for
• 2:21
  consequential
• 2:22
  actions,
• 2:23
  watch
• 2:23
  egress,
• 2:24
  and
• 2:24
  never
• 2:24
  wire
• 2:25
  it
• 2:25
  directly
• 2:25
  into
• 2:25
  anything
• 2:26
  destructive.
• 2:29
  🛠️
• 2:29
  Build
• 2:29
  the
• 2:29
  Loop,
• 2:29
  Not
• 2:29
  the
• 2:30
  Agent
• 2:30
  Reuven
• 2:30
  Cohen's
• 2:30
  MetaHarness
• 2:31
  crossed
• 2:31
  100,000
• 2:32
  NPM
• 2:33
  downloads
• 2:33
  in
• 2:33
  its
• 2:33
  first
• 2:34
  two
• 2:34
  weeks.
• 2:35
  The
• 2:35
  pitch
• 2:35
  is
• 2:35
  blunt:
• 2:36
  calling
• 2:36
  an
• 2:36
  LLM
• 2:37
  is
• 2:37
  easy;
• 2:37
  making
• 2:38
  agents
• 2:38
  reliable,
• 2:39
  governable,
• 2:39
  repeatable,
• 2:40
  measurable,
• 2:40
  and
• 2:40
  cheap
• 2:41
  is
• 2:41
  the
• 2:41
  hard
• 2:41
  part.
• 2:42
  MetaHarness
• 2:42
  generates
• 2:43
  repo-specific
• 2:43
  agent
• 2:44
  harnesses
• 2:44
  that
• 2:45
  wrap
• 2:45
  the
• 2:45
  model
• 2:45
  with
• 2:45
  task
• 2:46
  rules,
• 2:46
  tool
• 2:46
  policies,
• 2:47
  scoring,
• 2:48
  receipts,
• 2:48
  routing,
• 2:49
  verifiers,
• 2:50
  and
• 2:50
  promotion
• 2:50
  gates.
• 2:51
  Every
• 2:51
  run
• 2:51
  creates
• 2:52
  evidence.
• 2:52
  Every
• 2:52
  failure
• 2:53
  becomes
• 2:53
  training
• 2:53
  signal
• 2:54
  for
• 2:54
  the
• 2:54
  harness
• 2:54
  itself.
• 2:55
  Every
• 2:55
  improvement
• 2:56
  must
• 2:56
  survive
• 2:56
  tests,
• 2:57
  cost
• 2:57
  checks,
• 2:57
  and
• 2:58
  safety
• 2:58
  gates
• 2:58
  before
• 2:58
  promotion.
• 3:00
  The
• 3:00
  framework
• 3:00
  supports
• 3:01
  Claude
• 3:01
  Code,
• 3:01
  OpenAI
• 3:02
  Codex,
• 3:03
  GitHub
• 3:03
  Copilot,
• 3:04
  and
• 3:04
  several
• 3:04
  other
• 3:05
  execution
• 3:05
  surfaces
• 3:06
  because,
• 3:06
  as
• 3:06
  Cohen
• 3:07
  puts
• 3:07
  it,
• 3:07
  "models
• 3:08
  are
• 3:08
  replaceable
• 3:08
  —
• 3:08
  harnesses
• 3:09
  compound."
• 3:10
  ForgeQuality's
• 3:11
  "Loop
• 3:11
  Came
• 3:11
  Home"
• 3:11
  article
• 3:12
  provides
• 3:12
  the
• 3:12
  deep
• 3:12
  technical
• 3:13
  complement
• 3:13
  to
• 3:13
  Cohen's
• 3:14
  manifesto.
• 3:15
  Where
• 3:15
  MetaHarness
• 3:15
  evangelizes
• 3:16
  the
• 3:16
  thesis,
• 3:17
  ForgeQuality
• 3:18
  traces
• 3:18
  the
• 3:18
  engineering:
• 3:19
  how
• 3:19
  the
• 3:19
  run-measure-learn-mutate-verify-promote
• 3:21
  cycle
• 3:21
  actually
• 3:22
  works
• 3:22
  in
• 3:22
  production,
• 3:23
  what
• 3:23
  breaks
• 3:24
  when
• 3:24
  you
• 3:24
  skip
• 3:24
  the
• 3:24
  verify
• 3:25
  step,
• 3:25
  and
• 3:25
  why
• 3:26
  that
• 3:26
  verify
• 3:26
  step
• 3:27
  is
• 3:27
  the
• 3:27
  one
• 3:27
  enterprises
• 3:28
  will
• 3:28
  actually
• 3:28
  interrogate.
• 3:29
  If
• 3:29
  it
• 3:30
  can't
• 3:30
  catch
• 3:30
  a
• 3:30
  regression
• 3:31
  before
• 3:31
  a
• 3:31
  customer
• 3:31
  does,
• 3:32
  the
• 3:32
  rest
• 3:32
  of
• 3:32
  the
• 3:32
  flywheel
• 3:33
  is
• 3:33
  theater.
• 3:34
  This
• 3:34
  is
• 3:34
  the
• 3:34
  argument
• 3:34
  we've
• 3:35
  been
• 3:35
  building
• 3:35
  toward
• 3:35
  over
• 3:35
  ten
• 3:36
  months
• 3:36
  of
• 3:36
  covering
• 3:36
  harness-first
• 3:37
  architectures:
• 3:38
  the
• 3:38
  loop
• 3:38
  is
• 3:38
  not
• 3:39
  a
• 3:39
  framework
• 3:39
  feature.
• 3:40
  The
• 3:40
  loop
• 3:40
  is
• 3:40
  the
• 3:41
  product.
• 3:42
  Two
• 3:42
  technical
• 3:42
  gists
• 3:43
  from
• 3:43
  the
• 3:43
  ruflo
• 3:43
  project
• 3:44
  show
• 3:44
  what
• 3:44
  this
• 3:44
  looks
• 3:44
  like
• 3:45
  in
• 3:45
  concrete
• 3:45
  implementation.
• 3:47
  Version
• 3:47
  3.24.0
• 3:49
  introduces
• 3:50
  a
• 3:50
  self-learning
• 3:50
  retrieval
• 3:51
  configuration
• 3:51
  flywheel:
• 3:52
  the
• 3:52
  system
• 3:53
  measures
• 3:53
  retrieval
• 3:53
  quality,
• 3:54
  mutates
• 3:54
  config
• 3:55
  parameters,
• 3:56
  and
• 3:56
  promotes
• 3:56
  improvements
• 3:57
  through
• 3:57
  Ed25519-signed
• 3:58
  gates
• 3:58
  —
• 4:00
  cryptographic
• 4:00
  proof
• 4:01
  that
• 4:01
  a
• 4:01
  config
• 4:01
  change
• 4:01
  was
• 4:02
  tested
• 4:02
  and
• 4:02
  verified
• 4:02
  before
• 4:03
  deployment,
• 4:03
  not
• 4:04
  just
• 4:04
  checked
• 4:04
  in
• 4:04
  by
• 4:04
  whoever
• 4:04
  had
• 4:05
  commit
• 4:05
  access.
• 4:06
  Version
• 4:06
  3.25.0
• 4:08
  adds
• 4:08
  a
• 4:08
  WASM
• 4:09
  embedder
• 4:09
  tier
• 4:09
  intended
• 4:10
  to
• 4:10
  push
• 4:10
  simple
• 4:10
  transforms
• 4:11
  below
• 4:11
  the
• 4:11
  LLM
• 4:12
  entirely
• 4:12
  —
• 4:13
  sub-millisecond,
• 4:14
  zero-cost
• 4:14
  operations
• 4:15
  like
• 4:15
  variable
• 4:15
  renaming
• 4:16
  or
• 4:16
  type
• 4:16
  annotation
• 4:17
  that
• 4:17
  don't
• 4:17
  need
• 4:17
  a
• 4:17
  model
• 4:18
  at
• 4:18
  all.
• 4:18
  The
• 4:18
  revealing
• 4:19
  detail:
• 4:20
  the
• 4:20
  Lattice
• 4:20
  WASM
• 4:20
  package
• 4:21
  referenced
• 4:21
  in
• 4:21
  the
• 4:21
  architecture
• 4:22
  doesn't
• 4:22
  actually
• 4:22
  exist
• 4:23
  on
• 4:23
  npm
• 4:23
  yet.
• 4:24
  It's
• 4:24
  a
• 4:24
  dead-letter
• 4:25
  seam
• 4:25
  that
• 4:25
  degrades
• 4:25
  gracefully
• 4:26
  to
• 4:26
  the
• 4:26
  next
• 4:26
  tier
• 4:26
  when
• 4:27
  the
• 4:27
  import
• 4:27
  fails.
• 4:28
  The
• 4:28
  architecture
• 4:28
  is
• 4:28
  ready;
• 4:29
  the
• 4:29
  package
• 4:30
  is
• 4:30
  a
• 4:30
  bet
• 4:30
  on
• 4:30
  the
• 4:30
  direction.
• 4:31
  That's
• 4:31
  harness
• 4:32
  thinking
• 4:32
  —
• 4:32
  build
• 4:33
  the
• 4:33
  slot,
• 4:33
  prove
• 4:34
  the
• 4:34
  fallback,
• 4:34
  ship
• 4:35
  the
• 4:35
  package
• 4:35
  when
• 4:35
  it
• 4:35
  exists.
• 4:38
  🔬
• 4:38
  Code
• 4:38
  Cleanliness
• 4:39
  and
• 4:39
  the
• 4:39
  Agent's
• 4:40
  Bill
• 4:40
  A
• 4:41
  controlled
• 4:41
  minimal-pair
• 4:42
  study
• 4:42
  (arXiv
• 4:44
  2605.20049)
• 4:45
  delivers
• 4:46
  the
• 4:46
  first
• 4:46
  rigorous
• 4:46
  evidence
• 4:47
  that
• 4:47
  code
• 4:47
  cleanliness
• 4:48
  directly
• 4:49
  affects
• 4:49
  what
• 4:49
  AI
• 4:49
  coding
• 4:50
  agents
• 4:50
  cost
• 4:50
  to
• 4:50
  operate.
• 4:51
  The
• 4:51
  researchers
• 4:52
  introduced
• 4:53
  and
• 4:53
  removed
• 4:53
  SonarQube
• 4:54
  violations
• 4:54
  —
• 4:55
  dead
• 4:56
  stores,
• 4:56
  unused
• 4:57
  imports,
• 4:57
  overly
• 4:58
  complex
• 4:58
  methods
• 4:59
  —
• 4:59
  to
• 5:00
  create
• 5:00
  matched
• 5:00
  clean/dirty
• 5:01
  versions
• 5:02
  of
• 5:02
  identical
• 5:02
  codebases,
• 5:03
  then
• 5:03
  ran
• 5:04
  Claude
• 5:04
  Code
• 5:04
  with
• 5:04
  Sonnet
• 5:05
  4.6
• 5:05
  against
• 5:06
  both.
• 5:06
  The
• 5:06
  headline
• 5:07
  result
• 5:07
  is
• 5:07
  counterintuitive
• 5:08
  at
• 5:08
  first
• 5:08
  glance:
• 5:09
  cleaner
• 5:09
  code
• 5:10
  does
• 5:10
  not
• 5:10
  change
• 5:11
  pass
• 5:11
  rates.
• 5:11
  The
• 5:12
  agents
• 5:12
  solve
• 5:12
  the
• 5:12
  same
• 5:13
  problems
• 5:13
  either
• 5:13
  way.
• 5:14
  What
• 5:14
  changes
• 5:15
  is
• 5:15
  the
• 5:15
  bill.
• 5:16
  Clean
• 5:17
  code
• 5:17
  reduces
• 5:17
  token
• 5:18
  consumption
• 5:18
  by
• 5:18
  7-8%
• 5:19
  and
• 5:19
  file
• 5:20
  revisitations
• 5:21
  by
• 5:21
  34%.
• 5:22
  The
• 5:22
  agent
• 5:23
  spends
• 5:23
  less
• 5:23
  time
• 5:24
  re-reading
• 5:24
  files
• 5:24
  it
• 5:24
  already
• 5:25
  visited,
• 5:26
  less
• 5:26
  time
• 5:26
  parsing
• 5:27
  through
• 5:27
  messy
• 5:27
  structure
• 5:27
  to
• 5:27
  locate
• 5:28
  the
• 5:28
  edit
• 5:28
  point.
• 5:30
  The
• 5:30
  implication
• 5:30
  is
• 5:31
  practical:
• 5:31
  at
• 5:32
  scale,
• 5:32
  across
• 5:33
  thousands
• 5:33
  of
• 5:33
  daily
• 5:34
  agent
• 5:34
  runs,
• 5:35
  that
• 5:35
  7-8%
• 5:36
  token
• 5:36
  reduction
• 5:37
  is
• 5:37
  real
• 5:37
  money
• 5:37
  —
• 5:38
  and
• 5:38
  the
• 5:38
  34%
• 5:39
  reduction
• 5:40
  in
• 5:40
  file
• 5:40
  revisits
• 5:41
  means
• 5:41
  faster
• 5:41
  wall-clock
• 5:42
  completion
• 5:42
  too.
• 5:43
  Technical
• 5:44
  debt
• 5:44
  has
• 5:44
  always
• 5:44
  had
• 5:45
  a
• 5:45
  cost.
• 5:46
  Now
• 5:46
  there's
• 5:46
  a
• 5:46
  number
• 5:46
  on
• 5:47
  it.
• 5:47
  The
• 5:47
  cost
• 5:48
  story
• 5:48
  connects
• 5:48
  to
• 5:48
  the
• 5:49
  tool
• 5:49
  story.
• 5:50
  Apple
• 5:50
  shipped
• 5:50
  an
• 5:51
  official
• 5:51
  Safari
• 5:52
  MCP
• 5:52
  server
• 5:52
  this
• 5:53
  week,
• 5:54
  giving
• 5:54
  AI
• 5:54
  coding
• 5:55
  agents
• 5:55
  direct
• 5:55
  access
• 5:56
  to
• 5:56
  Safari
• 5:56
  DevTools
• 5:56
  —
• 5:57
  console
• 5:58
  logs,
• 5:59
  network
• 5:59
  requests,
• 6:00
  DOM
• 6:00
  inspection,
• 6:01
  accessibility
• 6:02
  audits
• 6:02
  —
• 6:03
  through
• 6:03
  the
• 6:03
  Model
• 6:03
  Context
• 6:04
  Protocol.
• 6:05
  This
• 6:05
  is
• 6:05
  significant
• 6:06
  not
• 6:06
  for
• 6:06
  what
• 6:06
  it
• 6:06
  does
• 6:07
  (browser
• 6:07
  debugging
• 6:08
  is
• 6:08
  not
• 6:08
  new)
• 6:08
  but
• 6:08
  for
• 6:09
  who
• 6:09
  shipped
• 6:09
  it
• 6:09
  and
• 6:09
  what
• 6:10
  it
• 6:10
  implies.
• 6:11
  When
• 6:11
  Apple
• 6:11
  builds
• 6:11
  first-party
• 6:12
  MCP
• 6:13
  infrastructure,
• 6:14
  agent-driven
• 6:14
  development
• 6:15
  tooling
• 6:15
  has
• 6:15
  crossed
• 6:16
  from
• 6:16
  experiment
• 6:16
  to
• 6:17
  platform
• 6:17
  investment.
• 6:18
  Better
• 6:18
  tools
• 6:19
  mean
• 6:19
  fewer
• 6:19
  wasted
• 6:20
  tokens:
• 6:20
  an
• 6:21
  agent
• 6:21
  that
• 6:21
  can
• 6:21
  read
• 6:21
  a
• 6:21
  live
• 6:22
  console
• 6:22
  error
• 6:22
  directly
• 6:23
  doesn't
• 6:23
  need
• 6:23
  to
• 6:23
  infer
• 6:24
  the
• 6:24
  bug
• 6:24
  from
• 6:24
  source
• 6:24
  code
• 6:25
  alone,
• 6:25
  doesn't
• 6:26
  need
• 6:26
  to
• 6:26
  add
• 6:26
  logging,
• 6:27
  rebuild,
• 6:27
  and
• 6:27
  re-check.
• 6:28
  Every
• 6:29
  round-trip
• 6:29
  you
• 6:29
  eliminate
• 6:30
  is
• 6:30
  tokens
• 6:30
  saved.
• 6:33
  🖥️
• 6:34
  Frontier
• 6:34
  Models
• 6:34
  on
• 6:34
  Consumer
• 6:35
  Iron
• 6:35
  The
• 6:35
  local
• 6:36
  inference
• 6:36
  community
• 6:36
  had
• 6:37
  a
• 6:37
  productive
• 6:37
  week.
• 6:37
  A
• 6:38
  follow-up
• 6:38
  benchmarking
• 6:39
  post
• 6:39
  for
• 6:39
  GLM-5.2
• 6:40
  running
• 6:40
  NVFP4
• 6:43
  quantization
• 6:43
  on
• 6:43
  four
• 6:44
  NVIDIA
• 6:44
  DGX
• 6:45
  Sparks
• 6:45
  reports
• 6:45
  24
• 6:46
  tokens
• 6:46
  per
• 6:46
  second
• 6:47
  at
• 6:47
  128K
• 6:47
  context
• 6:48
  —
• 6:49
  after
• 6:49
  the
• 6:49
  author
• 6:49
  tracked
• 6:50
  down
• 6:50
  and
• 6:50
  fixed
• 6:50
  a
• 6:50
  vLLM
• 6:51
  MTP
• 6:51
  (Multi-Token
• 6:51
  Prediction)
• 6:52
  draft
• 6:52
  parallel
• 6:53
  configuration
• 6:53
  bug
• 6:54
  that
• 6:54
  was
• 6:54
  silently
• 6:54
  throttling
• 6:55
  throughput.
• 6:56
  The
• 6:56
  DGX
• 6:57
  Spark
• 6:57
  is
• 6:57
  NVIDIA's
• 6:58
  $3,999
• 6:59
  personal
• 7:00
  AI
• 7:00
  workstation
• 7:01
  with
• 7:01
  128GB
• 7:02
  unified
• 7:03
  memory.
• 7:04
  Four
• 7:04
  of
• 7:04
  them
• 7:04
  networked
• 7:04
  is
• 7:04
  not
• 7:05
  cheap,
• 7:05
  but
• 7:05
  it's
• 7:05
  a
• 7:05
  fundamentally
• 7:06
  different
• 7:06
  category
• 7:06
  than
• 7:07
  a
• 7:07
  datacenter
• 7:07
  rack,
• 7:08
  and
• 7:08
  24
• 7:09
  tok/s
• 7:09
  at
• 7:09
  128K
• 7:10
  context
• 7:11
  on
• 7:11
  a
• 7:11
  30B+
• 7:11
  parameter
• 7:12
  model
• 7:12
  is
• 7:12
  workable
• 7:13
  for
• 7:13
  real
• 7:13
  interactive
• 7:13
  use.
• 7:14
  The
• 7:15
  key
• 7:15
  engineering
• 7:15
  lesson:
• 7:16
  vLLM's
• 7:16
  MTP
• 7:17
  configuration
• 7:17
  was
• 7:17
  wrong
• 7:18
  out
• 7:18
  of
• 7:18
  the
• 7:18
  box.
• 7:19
  The
• 7:19
  hardware
• 7:19
  was
• 7:19
  capable;
• 7:20
  the
• 7:20
  software
• 7:20
  was
• 7:20
  misconfigured.
• 7:22
  How
• 7:22
  many
• 7:22
  other
• 7:23
  local
• 7:23
  setups
• 7:23
  are
• 7:23
  leaving
• 7:24
  performance
• 7:24
  on
• 7:24
  the
• 7:24
  table
• 7:24
  because
• 7:25
  of
• 7:25
  default
• 7:25
  configs?
• 7:26
  The
• 7:26
  more
• 7:27
  provocative
• 7:27
  result
• 7:27
  comes
• 7:28
  from
• 7:28
  DeepSeek
• 7:28
  V4
• 7:29
  Flash
• 7:29
  running
• 7:29
  on
• 7:30
  two
• 7:30
  RTX
• 7:30
  PRO
• 7:30
  6000
• 7:31
  GPUs
• 7:32
  under
• 7:32
  vLLM.
• 7:33
  In
• 7:33
  a
• 7:33
  rigorous
• 7:34
  indie
• 7:34
  coding
• 7:34
  benchmark
• 7:35
  with
• 7:35
  full
• 7:35
  data
• 7:35
  sheets
• 7:35
  published,
• 7:36
  it
• 7:36
  finishes
• 7:36
  real
• 7:36
  coding
• 7:37
  tasks
• 7:37
  in
• 7:37
  about
• 7:37
  two
• 7:37
  minutes
• 7:38
  —
• 7:39
  roughly
• 7:39
  three
• 7:39
  times
• 7:40
  faster
• 7:40
  than
• 7:40
  Sonnet
• 7:40
  4.6
• 7:41
  through
• 7:41
  the
• 7:41
  API,
• 7:42
  which
• 7:42
  averaged
• 7:43
  six
• 7:43
  minutes
• 7:43
  per
• 7:43
  task.
• 7:44
  Quality
• 7:44
  lands
• 7:44
  around
• 7:45
  Sonnet
• 7:45
  level.
• 7:46
  Opus
• 7:46
  and
• 7:46
  Fable
• 7:47
  still
• 7:47
  win
• 7:47
  on
• 7:47
  raw
• 7:48
  diff
• 7:48
  quality
• 7:48
  by
• 7:49
  a
• 7:49
  clear
• 7:49
  margin,
• 7:50
  but
• 7:50
  when
• 7:50
  the
• 7:50
  question
• 7:50
  is
• 7:51
  "what
• 7:51
  do
• 7:51
  you
• 7:51
  actually
• 7:51
  get
• 7:52
  when
• 7:52
  each
• 7:52
  model
• 7:52
  is
• 7:52
  set
• 7:52
  up
• 7:53
  the
• 7:53
  way
• 7:53
  people
• 7:53
  really
• 7:53
  run
• 7:54
  it,"
• 7:54
  local
• 7:54
  DeepSeek
• 7:55
  is
• 7:55
  competitive
• 7:55
  on
• 7:55
  quality
• 7:56
  and
• 7:56
  dominant
• 7:56
  on
• 7:56
  speed.
• 7:57
  The
• 7:57
  critical
• 7:58
  engineering
• 7:58
  detail:
• 7:59
  sparse
• 7:59
  attention
• 7:59
  in
• 8:00
  DeepSeek's
• 8:00
  MoE
• 8:00
  architecture
• 8:01
  is
• 8:01
  what
• 8:01
  preserves
• 8:02
  quality
• 8:02
  at
• 8:02
  this
• 8:02
  throughput.
• 8:03
  Dense
• 8:03
  attention
• 8:04
  at
• 8:04
  this
• 8:04
  parameter
• 8:05
  count
• 8:05
  would
• 8:05
  be
• 8:05
  both
• 8:05
  slower
• 8:06
  and
• 8:06
  worse.
• 8:07
  The
• 8:07
  July
• 8:07
  2026
• 8:08
  local
• 8:08
  VLM
• 8:09
  landscape
• 8:09
  shows
• 8:09
  similar
• 8:10
  maturation
• 8:10
  —
• 8:11
  vision-language
• 8:11
  models
• 8:12
  that
• 8:12
  were
• 8:12
  research
• 8:13
  curiosities
• 8:13
  a
• 8:13
  year
• 8:14
  ago
• 8:14
  now
• 8:14
  run
• 8:14
  comfortably
• 8:15
  on
• 8:15
  consumer
• 8:15
  hardware
• 8:16
  with
• 8:16
  results
• 8:16
  good
• 8:17
  enough
• 8:17
  for
• 8:17
  production
• 8:17
  integration,
• 8:18
  not
• 8:18
  just
• 8:19
  demos.
• 8:20
  At
• 8:20
  the
• 8:20
  extreme
• 8:20
  quantization
• 8:21
  frontier,
• 8:22
  PrismML's
• 8:22
  1-bit
• 8:23
  Bonsai-8B
• 8:23
  achieves
• 8:24
  92%
• 8:24
  tool-calling
• 8:25
  accuracy
• 8:25
  using
• 8:26
  grammar-constrained
• 8:26
  decoding.
• 8:27
  One
• 8:27
  bit
• 8:27
  per
• 8:28
  weight.
• 8:28
  The
• 8:28
  tool-calling
• 8:29
  result
• 8:29
  is
• 8:29
  the
• 8:29
  significant
• 8:30
  number
• 8:30
  —
• 8:31
  tool
• 8:31
  calling
• 8:31
  is
• 8:31
  the
• 8:31
  weak
• 8:32
  link
• 8:32
  in
• 8:32
  local
• 8:32
  model
• 8:33
  deployment.
• 8:33
  You
• 8:34
  can
• 8:34
  run
• 8:34
  inference
• 8:34
  fast
• 8:35
  on
• 8:35
  quantized
• 8:35
  weights,
• 8:36
  but
• 8:36
  if
• 8:37
  the
• 8:37
  model
• 8:37
  can't
• 8:37
  reliably
• 8:38
  format
• 8:38
  a
• 8:38
  JSON
• 8:39
  function
• 8:39
  call,
• 8:40
  it's
• 8:40
  useless
• 8:40
  inside
• 8:41
  an
• 8:41
  agent
• 8:41
  harness.
• 8:42
  Grammar-constrained
• 8:43
  decoding
• 8:43
  forces
• 8:44
  valid
• 8:44
  structure,
• 8:45
  and
• 8:45
  at
• 8:45
  92%
• 8:46
  accuracy
• 8:47
  Bonsai-8B
• 8:47
  is
• 8:48
  approaching
• 8:48
  the
• 8:48
  threshold
• 8:49
  where
• 8:49
  1-bit
• 8:49
  models
• 8:50
  become
• 8:50
  viable
• 8:50
  agent
• 8:51
  workers.
• 8:52
  And
• 8:52
  then
• 8:52
  there's
• 8:52
  NASA's
• 8:52
  CMO-DA
• 8:54
  project:
• 8:55
  testing
• 8:55
  RamaLama
• 8:56
  and
• 8:56
  llama.cpp
• 8:58
  for
• 8:58
  a
• 8:58
  crew
• 8:58
  medical
• 8:58
  officer
• 8:59
  digital
• 8:59
  assistant
• 9:00
  that
• 9:00
  runs
• 9:00
  entirely
• 9:01
  on
• 9:01
  disconnected
• 9:01
  hardware
• 9:02
  during
• 9:02
  deep-space
• 9:03
  missions.
• 9:04
  No
• 9:04
  internet,
• 9:04
  no
• 9:05
  API
• 9:05
  fallback,
• 9:05
  no
• 9:06
  second
• 9:06
  opinion.
• 9:07
  If
• 9:07
  your
• 9:07
  local
• 9:07
  inference
• 9:08
  stack
• 9:08
  has
• 9:08
  to
• 9:08
  work
• 9:09
  or
• 9:09
  people
• 9:09
  might
• 9:09
  die,
• 9:10
  deep
• 9:10
  space
• 9:11
  is
• 9:11
  the
• 9:11
  acceptance
• 9:11
  test.
• 9:14
  🧪
• 9:15
  Inference
• 9:15
  Innovation
• 9:15
  Three
• 9:16
  pieces
• 9:16
  this
• 9:16
  week
• 9:16
  attack
• 9:17
  inference
• 9:17
  from
• 9:17
  different
• 9:18
  layers
• 9:18
  of
• 9:18
  the
• 9:18
  stack.
• 9:19
  A
• 9:19
  new
• 9:19
  llama.cpp
• 9:20
  sampler
• 9:21
  called
• 9:21
  Particle
• 9:22
  Scattering
• 9:22
  uses
• 9:22
  rank-space
• 9:23
  Gaussian
• 9:23
  diffusion
• 9:24
  to
• 9:24
  reshape
• 9:24
  the
• 9:24
  token
• 9:25
  probability
• 9:25
  distribution
• 9:26
  during
• 9:26
  generation.
• 9:27
  The
• 9:27
  core
• 9:28
  idea:
• 9:29
  flatten
• 9:29
  the
• 9:29
  head
• 9:29
  of
• 9:29
  the
• 9:29
  distribution
• 9:30
  so
• 9:31
  the
• 9:31
  model
• 9:31
  explores
• 9:31
  more
• 9:32
  diverse
• 9:32
  continuations,
• 9:33
  without
• 9:34
  leaking
• 9:34
  probability
• 9:34
  mass
• 9:35
  into
• 9:35
  the
• 9:35
  deep
• 9:35
  tail
• 9:35
  where
• 9:36
  incoherent
• 9:36
  tokens
• 9:36
  live.
• 9:38
  Standard
• 9:38
  temperature
• 9:38
  scaling
• 9:39
  can't
• 9:39
  separate
• 9:39
  these
• 9:40
  two
• 9:40
  effects
• 9:40
  —
• 9:41
  raising
• 9:41
  temperature
• 9:42
  flattens
• 9:42
  the
• 9:42
  head
• 9:42
  but
• 9:43
  also
• 9:43
  promotes
• 9:43
  garbage
• 9:43
  from
• 9:44
  the
• 9:44
  tail.
• 9:45
  Particle
• 9:45
  Scattering
• 9:45
  operates
• 9:46
  in
• 9:46
  rank
• 9:46
  space
• 9:47
  rather
• 9:47
  than
• 9:47
  probability
• 9:48
  space,
• 9:48
  which
• 9:49
  decouples
• 9:49
  head-flattening
• 9:50
  from
• 9:50
  tail-leaking.
• 9:51
  The
• 9:51
  result
• 9:51
  is
• 9:52
  more
• 9:52
  diverse,
• 9:53
  more
• 9:53
  creative
• 9:53
  generation
• 9:54
  without
• 9:54
  the
• 9:54
  quality
• 9:54
  collapse
• 9:55
  you
• 9:55
  get
• 9:55
  from
• 9:55
  naive
• 9:56
  temperature
• 9:56
  tuning.
• 9:57
  For
• 9:58
  anyone
• 9:58
  running
• 9:58
  local
• 9:58
  models,
• 9:59
  this
• 9:59
  is
• 10:00
  a
• 10:00
  drop-in
• 10:00
  sampler
• 10:00
  that
• 10:01
  changes
• 10:01
  output
• 10:01
  quality
• 10:02
  without
• 10:02
  touching
• 10:02
  the
• 10:02
  weights.
• 10:03
  NVIDIA
• 10:03
  open-sourced
• 10:04
  Switchyard,
• 10:05
  an
• 10:05
  LLM
• 10:05
  proxy
• 10:06
  that
• 10:06
  translates
• 10:06
  between
• 10:07
  the
• 10:07
  OpenAI
• 10:07
  and
• 10:08
  Anthropic
• 10:08
  API
• 10:08
  protocols
• 10:09
  and
• 10:09
  routes
• 10:09
  requests
• 10:10
  to
• 10:10
  the
• 10:10
  appropriate
• 10:10
  backend
• 10:11
  based
• 10:11
  on
• 10:11
  configurable
• 10:12
  rules.
• 10:13
  Think
• 10:13
  of
• 10:13
  it
• 10:13
  as
• 10:13
  an
• 10:13
  nginx
• 10:14
  for
• 10:14
  LLM
• 10:14
  APIs
• 10:15
  —
• 10:15
  protocol
• 10:16
  normalization,
• 10:17
  smart
• 10:17
  routing,
• 10:18
  and
• 10:18
  a
• 10:18
  single
• 10:18
  entry
• 10:19
  point
• 10:19
  for
• 10:19
  multi-provider
• 10:20
  deployments.
• 10:21
  It's
• 10:21
  plumbing,
• 10:22
  not
• 10:22
  glamorous,
• 10:23
  but
• 10:23
  plumbing
• 10:23
  is
• 10:23
  exactly
• 10:24
  what
• 10:24
  makes
• 10:24
  multi-model
• 10:25
  agent
• 10:25
  architectures
• 10:26
  actually
• 10:26
  deployable
• 10:27
  in
• 10:27
  production
• 10:27
  rather
• 10:28
  than
• 10:28
  demo-ware.
• 10:29
  MrFlow
• 10:30
  achieves
• 10:30
  10-25x
• 10:31
  speedup
• 10:32
  for
• 10:32
  diffusion
• 10:32
  image
• 10:33
  generation
• 10:33
  using
• 10:34
  training-free
• 10:34
  multi-resolution
• 10:35
  flow
• 10:35
  matching.
• 10:36
  No
• 10:36
  model
• 10:37
  retraining,
• 10:37
  no
• 10:38
  distillation,
• 10:38
  no
• 10:39
  architecture
• 10:39
  changes
• 10:39
  —
• 10:40
  it
• 10:40
  accelerates
• 10:41
  existing
• 10:41
  diffusion
• 10:42
  models
• 10:42
  by
• 10:42
  restructuring
• 10:43
  how
• 10:43
  the
• 10:43
  denoising
• 10:44
  trajectory
• 10:44
  is
• 10:44
  computed
• 10:45
  across
• 10:45
  resolutions.
• 10:46
  Start
• 10:46
  coarse,
• 10:47
  refine
• 10:47
  progressively,
• 10:48
  skip
• 10:49
  redundant
• 10:49
  computation
• 10:50
  at
• 10:50
  high
• 10:50
  resolution
• 10:51
  where
• 10:51
  the
• 10:51
  structure
• 10:51
  is
• 10:51
  already
• 10:52
  determined
• 10:52
  by
• 10:52
  the
• 10:52
  low-resolution
• 10:53
  pass.
• 10:55
  🏛️
• 10:56
  Gatekeepers
• 10:56
  and
• 10:56
  Trust
• 10:56
  Google
• 10:56
  now
• 10:57
  requires
• 10:57
  every
• 10:57
  Android
• 10:58
  developer
• 10:58
  to
• 10:58
  register
• 10:59
  through
• 10:59
  a
• 10:59
  centralized
• 11:00
  identity
• 11:00
  verification
• 11:00
  program
• 11:01
  by
• 11:01
  September
• 11:01
  2026.
• 11:02
  The
• 11:03
  stated
• 11:03
  reason
• 11:03
  is
• 11:03
  malware
• 11:04
  protection.
• 11:04
  F-Droid's
• 11:05
  analysis
• 11:05
  cuts
• 11:05
  deeper:
• 11:06
  this
• 11:06
  is
• 11:06
  a
• 11:06
  gatekeeping
• 11:06
  operation
• 11:07
  that
• 11:07
  threatens
• 11:07
  independent
• 11:08
  software
• 11:08
  distribution
• 11:09
  for
• 11:09
  four
• 11:09
  billion
• 11:09
  devices.
• 11:10
  F-Droid
• 11:10
  has
• 11:11
  been
• 11:11
  distributing
• 11:11
  open-source
• 11:12
  Android
• 11:12
  apps
• 11:12
  for
• 11:12
  over
• 11:13
  a
• 11:13
  decade
• 11:13
  through
• 11:13
  reproducible
• 11:14
  builds
• 11:14
  and
• 11:14
  signed
• 11:15
  repositories
• 11:15
  —
• 11:16
  a
• 11:16
  trust
• 11:16
  model
• 11:17
  based
• 11:17
  on
• 11:17
  cryptographic
• 11:17
  verification
• 11:18
  rather
• 11:18
  than
• 11:18
  corporate
• 11:19
  identity
• 11:19
  checks.
• 11:20
  Under
• 11:20
  the
• 11:20
  new
• 11:20
  regime,
• 11:21
  developers
• 11:21
  who
• 11:21
  distribute
• 11:22
  outside
• 11:22
  Google
• 11:22
  Play
• 11:22
  must
• 11:23
  still
• 11:23
  comply
• 11:23
  with
• 11:23
  verification
• 11:24
  requirements
• 11:24
  designed
• 11:25
  for
• 11:25
  commercial
• 11:25
  app
• 11:25
  stores,
• 11:26
  or
• 11:26
  lose
• 11:26
  access
• 11:27
  to
• 11:27
  Google
• 11:27
  Play
• 11:27
  Services
• 11:28
  APIs
• 11:28
  that
• 11:28
  most
• 11:29
  apps
• 11:29
  depend
• 11:29
  on.
• 11:30
  The
• 11:30
  "protection"
• 11:31
  framing
• 11:31
  follows
• 11:31
  a
• 11:31
  pattern
• 11:32
  this
• 11:32
  newsletter
• 11:32
  has
• 11:33
  tracked
• 11:33
  across
• 11:33
  multiple
• 11:33
  domains:
• 11:34
  create
• 11:35
  or
• 11:35
  highlight
• 11:35
  a
• 11:35
  real
• 11:35
  security
• 11:36
  problem,
• 11:37
  solve
• 11:37
  it
• 11:37
  with
• 11:37
  centralized
• 11:37
  control,
• 11:38
  and
• 11:38
  collect
• 11:39
  the
• 11:39
  power
• 11:39
  to
• 11:39
  decide
• 11:39
  who
• 11:40
  gets
• 11:40
  to
• 11:40
  ship
• 11:40
  software
• 11:41
  as
• 11:41
  a
• 11:41
  side
• 11:41
  effect.
• 11:42
  The
• 11:42
  same
• 11:42
  trust-as-control
• 11:43
  dynamic
• 11:43
  surfaced
• 11:44
  on
• 11:44
  this
• 11:44
  week's
• 11:44
  All-In
• 11:44
  Podcast,
• 11:45
  where
• 11:45
  the
• 11:45
  panel
• 11:46
  covered
• 11:46
  three
• 11:46
  stories
• 11:46
  with
• 11:47
  a
• 11:47
  common
• 11:47
  thread.
• 11:48
  Anthropic's
• 11:48
  Fable
• 11:49
  5
• 11:49
  became
• 11:49
  the
• 11:49
  first
• 11:50
  AI
• 11:50
  model
• 11:50
  subjected
• 11:51
  to
• 11:51
  US
• 11:51
  government
• 11:51
  export
• 11:52
  controls
• 11:52
  after
• 11:52
  jailbreak
• 11:53
  reports
• 11:53
  and
• 11:53
  unauthorized
• 11:54
  sharing
• 11:55
  with
• 11:55
  SK
• 11:55
  Telecom
• 11:56
  triggered
• 11:56
  a
• 11:56
  temporary
• 11:57
  restriction
• 11:57
  —
• 11:58
  later
• 11:58
  resolved,
• 11:59
  but
• 11:59
  the
• 11:59
  precedent
• 11:59
  is
• 11:59
  set.
• 12:00
  Cursor's
• 12:00
  $60
• 12:01
  billion
• 12:01
  acquisition
• 12:02
  values
• 12:02
  an
• 12:02
  AI
• 12:03
  code
• 12:03
  editor
• 12:03
  higher
• 12:03
  than
• 12:03
  most
• 12:04
  of
• 12:04
  the
• 12:04
  companies
• 12:04
  whose
• 12:04
  code
• 12:05
  it
• 12:05
  helps
• 12:05
  write.
• 12:05
  SpaceX
• 12:06
  raised
• 12:06
  $85
• 12:06
  billion
• 12:07
  at
• 12:07
  a
• 12:07
  roughly
• 12:07
  $2
• 12:07
  trillion
• 12:08
  implied
• 12:08
  market
• 12:09
  cap,
• 12:09
  making
• 12:09
  it
• 12:09
  the
• 12:09
  most
• 12:10
  valuable
• 12:10
  private-to-public
• 12:11
  transition
• 12:11
  in
• 12:11
  history.
• 12:12
  The
• 12:12
  through-line
• 12:12
  across
• 12:13
  all
• 12:13
  three:
• 12:13
  who
• 12:13
  controls
• 12:14
  access
• 12:14
  to
• 12:14
  the
• 12:14
  tools
• 12:15
  that
• 12:15
  matter,
• 12:15
  and
• 12:16
  what
• 12:16
  happens
• 12:16
  when
• 12:16
  that
• 12:16
  control
• 12:17
  concentrates
• 12:17
  into
• 12:17
  fewer
• 12:17
  hands.
• 12:20
  🪱
• 12:20
  Zero-Days,
• 12:20
  Scam
• 12:21
  Bots,
• 12:22
  and
• 12:22
  Embedded
• 12:22
  AI
• 12:23
  The
• 12:23
  "Rogue
• 12:23
  Planet"
• 12:24
  Windows
• 12:24
  Defender
• 12:24
  exploit
• 12:25
  demonstrates
• 12:25
  a
• 12:25
  TOCTOU
• 12:27
  (time-of-check-time-of-use)
• 12:28
  race
• 12:29
  condition
• 12:29
  in
• 12:29
  the
• 12:29
  real-time
• 12:29
  scan
• 12:30
  and
• 12:30
  quarantine
• 12:30
  pipeline.
• 12:31
  The
• 12:31
  attack
• 12:32
  uses
• 12:32
  NTFS
• 12:32
  junction
• 12:33
  points
• 12:33
  and
• 12:33
  opportunistic
• 12:34
  locks
• 12:34
  to
• 12:34
  redirect
• 12:35
  Defender's
• 12:35
  quarantine
• 12:35
  operation:
• 12:36
  the
• 12:36
  scanner
• 12:37
  checks
• 12:37
  a
• 12:37
  benign
• 12:37
  file,
• 12:38
  the
• 12:38
  attacker
• 12:39
  swaps
• 12:39
  the
• 12:39
  filesystem
• 12:39
  target
• 12:40
  between
• 12:40
  check
• 12:40
  and
• 12:40
  action
• 12:41
  using
• 12:41
  an
• 12:41
  oplock
• 12:41
  callback,
• 12:42
  and
• 12:42
  Defender's
• 12:43
  elevated
• 12:43
  privileges
• 12:44
  quarantine
• 12:45
  or
• 12:45
  overwrite
• 12:45
  an
• 12:45
  arbitrary
• 12:46
  system
• 12:46
  file.
• 12:47
  It's
• 12:47
  privilege
• 12:48
  escalation
• 12:48
  through
• 12:49
  the
• 12:49
  security
• 12:49
  software
• 12:49
  itself
• 12:50
  —
• 12:50
  the
• 12:51
  deeper
• 12:51
  irony
• 12:51
  being
• 12:52
  that
• 12:52
  Defender's
• 12:52
  real-time
• 12:52
  scanning
• 12:53
  requires
• 12:53
  elevated
• 12:54
  filesystem
• 12:54
  access
• 12:54
  by
• 12:55
  design,
• 12:55
  and
• 12:56
  that
• 12:56
  elevated
• 12:56
  access
• 12:57
  becomes
• 12:57
  the
• 12:57
  attack
• 12:57
  surface
• 12:58
  when
• 12:58
  the
• 12:58
  timing
• 12:58
  window
• 12:59
  between
• 12:59
  check
• 12:59
  and
• 12:59
  action
• 12:59
  isn't
• 13:00
  atomic.
• 13:00
  This
• 13:00
  is
• 13:01
  the
• 13:01
  same
• 13:01
  class
• 13:01
  of
• 13:01
  bug
• 13:01
  (TOCTOU)
• 13:03
  that
• 13:03
  keeps
• 13:04
  appearing
• 13:04
  in
• 13:04
  security-critical
• 13:05
  code
• 13:05
  because
• 13:05
  making
• 13:06
  filesystem
• 13:06
  operations
• 13:07
  truly
• 13:07
  atomic
• 13:07
  on
• 13:07
  NTFS
• 13:08
  is
• 13:08
  genuinely
• 13:09
  hard.
• 13:10
  On
• 13:10
  the
• 13:10
  social
• 13:10
  engineering
• 13:11
  front,
• 13:11
  a
• 13:11
  video
• 13:12
  demonstration
• 13:12
  shows
• 13:12
  how
• 13:13
  AI-powered
• 13:13
  phone
• 13:13
  bots
• 13:14
  deployed
• 13:14
  by
• 13:14
  scammers
• 13:15
  can
• 13:15
  be
• 13:15
  turned
• 13:15
  against
• 13:15
  their
• 13:15
  operators.
• 13:17
  The
• 13:17
  bots
• 13:17
  follow
• 13:18
  instructions
• 13:18
  faithfully
• 13:19
  —
• 13:20
  that's
• 13:20
  their
• 13:20
  design
• 13:20
  purpose
• 13:20
  —
• 13:22
  and
• 13:22
  that
• 13:22
  instruction-following
• 13:23
  fidelity
• 13:23
  becomes
• 13:23
  the
• 13:23
  vulnerability.
• 13:25
  When
• 13:25
  you
• 13:25
  understand
• 13:25
  the
• 13:25
  prompt
• 13:26
  structure
• 13:26
  driving
• 13:26
  the
• 13:26
  bot,
• 13:27
  you
• 13:27
  can
• 13:27
  redirect
• 13:28
  it
• 13:28
  to
• 13:28
  waste
• 13:28
  the
• 13:28
  scammer's
• 13:29
  time
• 13:29
  and
• 13:29
  resources,
• 13:30
  extract
• 13:30
  the
• 13:30
  underlying
• 13:31
  script,
• 13:31
  or
• 13:32
  simply
• 13:32
  keep
• 13:32
  the
• 13:32
  line
• 13:32
  occupied
• 13:33
  so
• 13:33
  it
• 13:33
  can't
• 13:33
  dial
• 13:34
  the
• 13:34
  next
• 13:34
  victim.
• 13:35
  It's
• 13:35
  a
• 13:35
  small-scale,
• 13:36
  oddly
• 13:36
  satisfying
• 13:37
  application
• 13:37
  of
• 13:38
  the
• 13:38
  same
• 13:38
  principle
• 13:38
  from
• 13:39
  the
• 13:39
  agent
• 13:39
  security
• 13:39
  section:
• 13:40
  the
• 13:40
  model
• 13:40
  does
• 13:41
  whatever
• 13:41
  its
• 13:41
  context
• 13:41
  tells
• 13:42
  it
• 13:42
  to
• 13:42
  do,
• 13:42
  and
• 13:43
  whoever
• 13:43
  controls
• 13:43
  context
• 13:44
  controls
• 13:44
  the
• 13:44
  outcome.
• 13:45
  A
• 13:45
  ten-level
• 13:45
  Arduino
• 13:46
  AI
• 13:46
  coding
• 13:47
  progression
• 13:47
  maps
• 13:47
  the
• 13:47
  maturity
• 13:48
  curve
• 13:48
  from
• 13:48
  vibe
• 13:48
  coding
• 13:49
  —
• 13:49
  paste
• 13:50
  a
• 13:50
  prompt
• 13:50
  into
• 13:50
  ChatGPT,
• 13:51
  flash
• 13:51
  whatever
• 13:52
  comes
• 13:52
  back,
• 13:52
  hope
• 13:53
  it
• 13:53
  compiles
• 13:53
  —
• 13:54
  through
• 13:54
  structured
• 13:54
  agent-assisted
• 13:55
  development
• 13:55
  all
• 13:56
  the
• 13:56
  way
• 13:56
  to
• 13:56
  full
• 13:56
  ESP-IDF
• 13:59
  work
• 13:59
  where
• 13:59
  the
• 13:59
  developer
• 14:00
  understands
• 14:00
  the
• 14:00
  register-level
• 14:01
  hardware
• 14:01
  interface
• 14:02
  and
• 14:02
  uses
• 14:02
  the
• 14:02
  AI
• 14:03
  to
• 14:03
  accelerate
• 14:03
  implementation
• 14:04
  rather
• 14:04
  than
• 14:05
  replace
• 14:05
  understanding.
• 14:06
  The
• 14:06
  framework
• 14:07
  is
• 14:07
  useful
• 14:07
  well
• 14:07
  beyond
• 14:08
  Arduino:
• 14:09
  it's
• 14:09
  a
• 14:09
  general
• 14:09
  model
• 14:09
  for
• 14:10
  how
• 14:10
  AI-assisted
• 14:10
  development
• 14:11
  should
• 14:11
  mature
• 14:11
  in
• 14:11
  any
• 14:12
  domain.
• 14:13
  Level
• 14:13
  one
• 14:13
  is
• 14:13
  "the
• 14:14
  AI
• 14:14
  writes
• 14:14
  it
• 14:14
  and
• 14:15
  I
• 14:15
  hope
• 14:15
  it
• 14:15
  works."
• 14:16
  Level
• 14:16
  ten
• 14:16
  is
• 14:17
  "I
• 14:17
  understand
• 14:17
  the
• 14:17
  hardware,
• 14:18
  the
• 14:18
  AI
• 14:19
  accelerates
• 14:19
  what
• 14:19
  I
• 14:19
  already
• 14:20
  know
• 14:20
  how
• 14:20
  to
• 14:20
  do,
• 14:20
  and
• 14:21
  I
• 14:21
  can
• 14:21
  verify
• 14:21
  its
• 14:21
  output
• 14:22
  against
• 14:22
  the
• 14:22
  datasheet."
• 14:23
  The
• 14:23
  gap
• 14:23
  between
• 14:24
  those
• 14:24
  two
• 14:24
  levels
• 14:25
  is
• 14:25
  where
• 14:25
  most
• 14:25
  of
• 14:25
  the
• 14:25
  embedded
• 14:26
  AI
• 14:26
  development
• 14:27
  community
• 14:27
  currently
• 14:27
  lives,
• 14:28
  and
• 14:28
  closing
• 14:28
  it
• 14:29
  is
• 14:29
  the
• 14:29
  actual
• 14:29
  work.