invariably underinformed.
Joined May 2013
- Tweets1.1K
- Following1.3K
- Followers106
- Likes8.9K
Henry Sachs retweeted
Anthropic valuation: $1.5 trillion
Walmart valuation: $960 Billion
Anthropic revenue: $16.3 billion
Walmart revenue: $365 billion
Anthropic has filed an S-1 registration statement with the SEC related to its proposed IPO.
Read more: anthropic.com/news/s1-sec
Legal disclaimer: A registration statement relating to these securities has been filed with the SEC but has not yet become effective. These securities may not be sold, nor may offers to buy be accepted, prior to the time the registration statement becomes effective. This post does not constitute an offer to sell or the solicitation of an offer to buy these securities, nor shall there be any sale of these securities in any state or jurisdiction in which such offer, solicitation or sale would be unlawful prior to registration or qualification under the securities laws of any such state or jurisdiction.
Henry Sachs retweeted
Raise your hand if you work in a 2010s SaaS company that has built their own agent platform that no one really wants to use.
To be direct about it: every company that considers themselves a “tech” company is currently building a much worse version of something they could buy off the shelf, and furthermore they often have several teams competing on this front
Then they launch it after 3-6 months of building in a silo and can’t get their colleagues to use it for entirely predictable reasons
Coding agents and their adjacent products are among the most competitive markets of all time. The benefits of a highly competitive market accrue to customers by virtue of this intense competition among suppliers. Econ 101
Is the internal team working on your agent platform really keeping pace with the market? Even if they put in the same hours (they don’t), they don’t have the breadth of customers and hard contact with the market to get the feedback necessary to make the product any good
Big corporates that call their devs “IT” don’t delude themselves in this way. They buy the best, recognize their relative advantage (vendors will build almost anything for you because the competitive pressures demand it), and get back to work
Henry Sachs retweeted
The actual prompt for this was "let's look for pre-auth RCEs in PHP". I'm sharing this so people know this stuff is real and to take agent-assisted scanning seriously.
I kicked if off using Claude Mythos 5.1 (in stock Claude Code) but it uses a skill to drive a harness we built over the last few months.
I don't know if the harness is amazing, but it certainly has a scary track record so far. It's setup to do an agent guided tree search across a codebase, and runs in microvm sandboxes that all have the full source code for the target, as well as the source for any transitive dependencies.
When I built the harness I basically just fed Claude a bunch of Project Zero blog posts describing how they did research and had it build a harness that ran like that, but on our tech stack.
The first phase is just setup and can run with any model, it just does that fetching and assembles the kit environment, and gets a target up and running alongside the source code.
Then we just do some basic suspend/resume stuff over to the hunt phase, where one agent supervises the tree, and the first node kicks off.
Each node is context-aware and aware of the work of all the others. I think I ran this with parallelism 4? So 4 running at any one time. The supervisor can shape the tree and boost nodes or prune. Any node can add more below it with targeted instructions.
A typical run looks like the first node doing a codebase review or building and running a fuzzer or something, all depending on the target. Then based on whatever it finds, it'll queue 4-5 children that go look into those areas. The main system guidance is to validate everything 3 times in clean VMs, and we typically require full exploit chains/POCs.
Here's what this run looked like.
We're doing this with a bunch of other open source projects now and companies. We're doing a lot of this for free, even with private companies, across critical infrastructure. We're directly partnered with Anthropic, and can do this even if you don't have direct access to a frontier model yourself.
Henry Sachs retweeted
Introducing Motherload — import data files from TypeScript with full type information
Powered by TypeScript 7.1's content mappers (now in beta)
.md
.toml
.yaml
.csv / .tsv
.jsonc / .json5
.txt
.env
Henry Sachs retweeted
As if PHP2Shell wasn't enough for one day... now GitLab. 😅
🚨 CRITICAL GITLAB ALERT (CVSS 10.0)
CVE-2026-110264 could allow unauthenticated RCE on self-managed GitLab servers.
⚠️ Potentially affects 12 years of releases, dating back to 2014.
Patches available. Update immediately!
docs.gitlab.com/releases/pat…
#gitlab #cybersecurity
Henry Sachs retweeted
They made open sourced Dots/grokbot
Henry Sachs retweeted
recommended reading wrt code review. i really like the ideas justin lays out in it
Thoughts: just-be.dev/blog/code-review…
Henry Sachs retweeted
how do you trust your agents' work more? copy this post/link and give it to your @bot or agent!
1. codebase improvements: this is just good software engineering - better architecture, stronger types and invariants, clear boundaries. agents love to copy what exists and take the shortest path, so make the easy thing the right thing. categorically eliminate problems through code and you won't need to think about it again.
2. static analysis: lint rules, tests, CI, verification (eg TLA+). very token efficient ways to catch issues ahead of time.
3. prose: comments, rules, AGENTS.md, skills - anything that can't be enforced and requires agent judgment. use it minimally, but do use /create-verification-skill.
4. human review: the hardest to scale. at the rate agents land code, it's pretty much impossible to thoroughly review every PR, so spend that effort on the highest leverage point, designing an environment where agents do the right thing by default.
this forms an inverse pyramid: you want most of your effort at the top, least at the bottom. codebase improvements are deterministic, making it more token efficient, and lets you sleep more soundly at night.
install github.com/cursor/plugins/tr… and create a new Project:
1. look through my slack/chat messages and code review comments where i've given feedback on PRs, code, architecture
2. use /recall on my past transcripts to learn how i steer agents
3. /poteto-mode use /correct and /architect on past commits to find the most common pitfalls agents fall into, then propose a plan to rearchitect the code i own so it's more agent friendly. answer open questions with prototyping rather than defer to me, and back the plan with real data.
4. before you begin, use /sharpen + /in-your-own-words and confirm this prompt with me
Henry Sachs retweeted
TanStack Start 1.0 is officially stable! 🎉
A full-stack web framework for React and Solid, already used to build millions of apps, from Fortune 500 companies to your favorite tools and weekend projects.
tanstack.com/start
Henry Sachs retweeted
If confirmed, this is telling: Russian data centres get hit, and online activity around AfD suddenly plummets. 📉
So much talk about German patriotism… then the connection from Russia goes down. 🤔🇷🇺
Henry Sachs retweeted
this might also come from my infrastructure background, but you should obviously have backups and reliability stuff set in place
if you can't delete your entire environment now and get back up and running in a day or a half, you clearly have something set up wrong
Henry Sachs retweeted
Every startup would secretly admit how much of a pain the "slop grenade" problem is. Bold of Tobi to say it out loud.
Everyone else is dealing with the same thing: balancing output volume, quality, and confusion about who's responsible for what comes out.
Keep holding people accountable for their actual work. The quality vs productivity pressure works itself out when accountability is clear.
Henry Sachs retweeted
I've been reflecting on this. I'm generally a very optimistic person, but lately I've been feeling a strange sense of sadness that coding has been "solved".
I can, and have, made many caveats to "solved"... but I also know that in five years none of them will matter. It will be solved.
Building things is still fun, but a different kind of fun. It doesn't activate the same parts of my brain as trad coding did.
I think it's okay to mourn the thing we loved doing being different now. Software was the first job to go through the five AI stages of grief, which means we're also some of the first to internalize that this will happen to many other jobs.
It was the best of times, it was the worst of times.
