Javan (@Javan_Chen) header
Javan (@Javan_Chen) profile picture

Software engineer exploring AI autonomy. Creator of Homunculus — a goal-tree-driven self-evolving AI assistant for Claude Code.

Joined February 2020
Photo by Javan (@Javan_Chen)Photo by Javan (@Javan_Chen)Photo by Javan (@Javan_Chen)Photo by Javan (@Javan_Chen)Photo by Javan (@Javan_Chen)Photo by Javan (@Javan_Chen)Photo by Javan (@Javan_Chen)Photo by Javan (@Javan_Chen)Photo by Javan (@Javan_Chen)Photo by Javan (@Javan_Chen)
🚨 Nightmare day for cybersecurity Multiple major security incidents, active exploits, supply chain compromises... If you run production systems, start patching NOW. PHP: Two critical unauthenticated RCEs. Attackers already exploiting them. Patch NOW LiteLLM: v1.107.0 on PyPI and Docker is BACKDOORED. Steals cloud, SSH, and AI credentials. Pin 1.106.2. Rotate secrets. eMudhra: A certificate authority's keys were crackable. Update your browsers, systems, and trust stores. Node.js / Next.js / React: Security releases for Brotli RCE, TLS bypasses, and TWO critical Next.js RCEs. TiDB Cloud: PingCAP breached through stolen credentials. Customer information and other sensitive data exfiltrated. Read the attacker's release, fun stuff. Plex2Shell: Weaponized within HOURS of the PoC. Attackers already deploying cryptominers and proxy backdoors. BeyondTrust / Ivanti: Actively exploited zero-days added to CISA's KEV catalog. BeyondTrust attacks linked to a China-nexus campaign. And that's not even the full list. Patch. Audit. Rotate. NOW.
99
583
132
3,721
471,482
Javan retweeted
1/ How I infiltrated a Chinese organized crime syndicate that has laundered $1B+ across multiple exploits for Lazarus Group. Posing as a client, I gathered intel that helped action freezes for the Feb 2025 Bybit exploit and attribute illicit activity onchain.
1,955
4,210
1,315
30,667
4,987,997
Javan retweeted
Replying to @CirrusNFT
hey ya this is a whitehat and everything in 0x71cF3f5724bD2B72Ef6464992aCd26216DE7fe33 is safe and will be returned once they are no longer at risk
419
173
143
1,993
411,174
Replying to @ori_pomerantz
I’m significantly older than you. I started coding in the late 60s. My current strategy is to not read any of the code written by my agents. That’s the only way I can take advantage of their productivity. What I do instead is to surround the agents with extreme constraints. Unit tests, gherkin tests, QA procedures, quality metrics, mutation testing, test coverage, and a plethora of others. In the end, I have very high confidence in the code they produce because they’ve had to run the gauntlet of all of my constraints and tests.
568
1,974
899
18,849
5,140,865
LLM Knowledge Bases Something I'm finding very useful recently: using LLMs to build personal knowledge bases for various topics of research interest. In this way, a large fraction of my recent token throughput is going less into manipulating code, and more into manipulating knowledge (stored as markdown and images). The latest LLMs are quite good at it. So: Data ingest: I index source documents (articles, papers, repos, datasets, images, etc.) into a raw/ directory, then I use an LLM to incrementally "compile" a wiki, which is just a collection of .md files in a directory structure. The wiki includes summaries of all the data in raw/, backlinks, and then it categorizes data into concepts, writes articles for them, and links them all. To convert web articles into .md files I like to use the Obsidian Web Clipper extension, and then I also use a hotkey to download all the related images to local so that my LLM can easily reference them. IDE: I use Obsidian as the IDE "frontend" where I can view the raw data, the the compiled wiki, and the derived visualizations. Important to note that the LLM writes and maintains all of the data of the wiki, I rarely touch it directly. I've played with a few Obsidian plugins to render and view data in other ways (e.g. Marp for slides). Q&A: Where things get interesting is that once your wiki is big enough (e.g. mine on some recent research is ~100 articles and ~400K words), you can ask your LLM agent all kinds of complex questions against the wiki, and it will go off, research the answers, etc. I thought I had to reach for fancy RAG, but the LLM has been pretty good about auto-maintaining index files and brief summaries of all the documents and it reads all the important related data fairly easily at this ~small scale. Output: Instead of getting answers in text/terminal, I like to have it render markdown files for me, or slide shows (Marp format), or matplotlib images, all of which I then view again in Obsidian. You can imagine many other visual output formats depending on the query. Often, I end up "filing" the outputs back into the wiki to enhance it for further queries. So my own explorations and queries always "add up" in the knowledge base. Linting: I've run some LLM "health checks" over the wiki to e.g. find inconsistent data, impute missing data (with web searchers), find interesting connections for new article candidates, etc., to incrementally clean up the wiki and enhance its overall data integrity. The LLMs are quite good at suggesting further questions to ask and look into. Extra tools: I find myself developing additional tools to process the data, e.g. I vibe coded a small and naive search engine over the wiki, which I both use directly (in a web ui), but more often I want to hand it off to an LLM via CLI as a tool for larger queries. Further explorations: As the repo grows, the natural desire is to also think about synthetic data generation + finetuning to have your LLM "know" the data in its weights instead of just context windows. TLDR: raw data from a given number of sources is collected, then compiled by an LLM into a .md wiki, then operated on by various CLIs by the LLM to do Q&A and to incrementally enhance the wiki, and all of it viewable in Obsidian. You rarely ever write or edit the wiki manually, it's the domain of the LLM. I think there is room here for an incredible new product instead of a hacky collection of scripts.
2,938
7,400
2,221
61,073
22,030,422
Homunculus v0.9.0 — the evolution engine just evolved itself. Your AI assistant now extracts 3 things from every session: Behavioral instincts Memory suggestions Research topics All automatically. All non-invasive. 🧵👇
1
2
44
Pruning got a brain upgrade: Reference frequency scoring (+25 for used, -15 for ignored) 3-tier skill coverage (direct evolved → high overlap → partial) 14-day grace period (new instincts aren't penalized) At-risk warnings before archival
1
1
26
All of this happens while you sleep. Define your goals. Let the system figure out the rest. npx homunculus-code init GitHub: github.com/JavanC/Homunculus Now with 🇹🇼 繁中 + 🇨🇳 简中 README #BuildInPublic #ClaudeCode #AIAssistant
2
35
Stop chasing the "best" Claude Code setup — let it evolve from your own workflow instead. I open-sourced a tool that watches how you work and evolves skills, hooks, agents overnight. 368 autonomous commits in 3 weeks. reddit.com/r/ClaudeAI/commen…
1
1
1
110
I built an AI assistant that evolves itself every night. 3 weeks. 155 nightly commits. Zero human input. Here's how it works 🧵
1
2
69
Most AI tools give you more knobs to turn. This one gives you three: 1. Define your goals 2. Set permissions 3. Walk away
1
32
Open source. MIT license. 60-second setup: npx homunculus-code init Then in Claude Code: /hm-goal → define your goals /hm-night → run your first evolution cycle github.com/JavanC/Homunculus Full story: dev.to/imjavanchen/stop-tuni…
1
50