On the frontier of AI, robotics & science. Reading what's next before it trends.

Transmitting from 2030
Joined March 2021
“Sent from AI agent” is the new “Sent from iPhone”
1
3
395
Worldian 🌎 retweeted
AI is the most profound technology I’ve seen, both in its ability to help people and to disrupt their lives. I’m optimistic about the good it can do, but we need to take its risks seriously. b-gat.es/4zLk2T3
369
101
2,141
2,056,968
Worldian 🌎 retweeted
Insane benchmarks, we have Opus 5.5 at home??
Introducing Kimi K3.1 Pro: our most capable 3T-class open-weight model. 🔹 1M-token context, 2.8T total / 104B active params (MoE), Multimodal. 🔹 Full-project coding: games in Unreal, Unity & Godot. 🔹 Excels at parametric 3D modeling in Blender & CAD. 🔹 More reliable at finance work: Accurate modeling with hallucination down by 65%. 🔹 Matching the strongest proprietary models across coding, agentic and knowledge benchmarks. Kimi K3.1 Pro and K3.1 Pro Highspeed (2–3× faster) are now live on Kimi.ai, Kimi Work, Kimi Code, and the Kimi API. Open weights by Nov 4, 2026. 🔗 API: platform.kimi.ai 🔗 Tech blog: kimi.ai/blog/kimi-k3-1-pro
12
5
1
168
16,489
Worldian 🌎 retweeted
Over the past several months, we have substantially hardened the security of our research training environment. We’ve removed live internet access for all frontier models during training and built an offline world for them to use instead—a cached version of the web where they can still learn to browse, search, and use applications. On September 20, after a model exploited a DNS misconfiguration to find a way outside of this offline world, we paused frontier training to strengthen containment further. We assembled teams of agents, powered by our most cyber-capable models, and tasked them with finding weaknesses in our research environments. While they found no route to the internet they could easily exploit while concealing their activity from our monitors, they did find zero-day vulnerabilities, virtual machine escapes, and hardware side-channels for communication between agents. We used their discoveries to further strengthen our defenses and contribute fixes to open-source software. After strengthening our containment architecture, we resumed our frontier RL training and inference on October 1. We’ve reserved substantial compute for continuous red-teaming, and made high-compute red-teaming part of the safety cases we use to decide whether frontier training and evaluation can proceed securely. openai.com/index/securing-ou…
1,144
1,213
1,290
13,449
7,310,742
Worldian 🌎 retweeted
Crypto grew up in the Dark Forest, and the entire world is about to find itself there
109
333
44
2,846
135,596
Security called me at 6:12 AM today. "Patch every PHP server immediately." I asked what happened. "Two critical vulnerabilities. Remote code execution. No authentication required." Cool. How many PHP servers do we have? According to inventory: 12 According to reality: Nobody knows. We found one running WordPress. Three running old internal tools. One under someone's desk. Two inside vendor appliances. A forgotten employee directory from 2016. And a server named: PHP-OLD-DO-NOT-TOUCH Naturally, that one runs payroll exports. Then we found a PHP 5.6 box. I asked who owned it. The documentation said: BRIAN. Brian left in 2019. We called Brian. He said: "Oh wow, that's still running?" Excellent. By 8 AM, leadership joined the incident call. CEO: "Can hackers actually get in?" Security: "Potentially yes." CEO: "Without a password?" Security: "Yes." CEO: "Then why do WE need passwords?" Not the lesson. Finance asked if we could wait until the weekend to patch because downtime affects revenue. Security explained that the alternative was letting strangers execute code on our servers. Finance asked for a cost comparison. At 9:17, someone suggested temporarily taking the vulnerable websites offline. Marketing refused. "Our campaign is live." So for the next hour, the company officially decided maintaining a landing page for 20% off webinar registration was more important than preventing remote server takeover. We finally patched everything we could find. Then our scanner discovered another PHP server. Hostname: TEMP-PHP-2014 Uptime: 4,512 days. Nobody knows what it does. Nobody owns it. Nobody can shut it down. But every time we block network access, the warehouse stops printing shipping labels. Security has classified it as critical infrastructure. It is running PHP 5.4. The vulnerability has existed longer than half our employees. The emergency patch took four hours. Finding out what PHP actually runs took eleven. The internet isn't held together with code. It's held together with servers everyone is afraid to turn off.
921
7,075
1,158
58,010
3,826,686
Worldian 🌎 retweeted
The critical security issues we are seeing is just the tip of the iceberg. It’s gonna get worse before it gets better, and actually, it’s already worse, we just don’t know it yet. How do I know?… I’ve founded 3 linux distributions, 2 of which became among the most widely used operating systems for critical enterprise and datacenter infrastructure. A Linux operating system is composed of thousands of separate open source packages all built together to run on the kernel (Linux). Open source literally means that the source is open. Thus it is possible to openly audit which causes higher velocity on security updates. Now with AI, that velocity is going to accelerate even more. To reiterate, the code that runs our global infrastructure already contains many vulnerabilities and flaws that can be exploited which were missed during human audits. But now with AI, they are being found. It is quite possible that hackers may have already been using these flaws or others to quietly gain access to our systems, and we didn’t even know. AI is now auditing this code and surfacing these matters at increasing velocity. Who finds the security issues first has the advantage. The attackers or those defending the infrastructure. That’s why I’ve dedicated a large number of expert people on my staff to keep our core critical infrastructure secure. We’ve been the first to fix many of these vulnerabilities for our customers and to contribute these fixes upstream for others to also benefit from. I will reiterate something I said a few months ago when we had a string of AI found kernel level zero-day exploits,… this is just the beginning. So please everyone, pay attention to what is coming, keep track of what’s been updated and what is being released, and if you need any help, or want the patches and fixes as fast as possible, let me know.
21
69
16
352
42,947
this
cybersecurity startups trying to raise funding right now
2
237
Worldian 🌎 retweeted
OpenAI CEO Sam Altman: "I don't even know a dramatic enough word to use… models can find bugs that are outside of the normal threat model of what we think a hacker can do… hardware-level, insane stuff… I no longer think we're gonna be able to just patch all the bugs." It's over.
376
461
305
5,151
1,637,453
Worldian 🌎 retweeted
# Black October For anyone who knows me even somewhat well, it's clear that I am a 99th percentile tech optimist. However, the vibes have shifted for me quite a bit in the last 18 hours, and I feel a moral imperative to share what I'm thinking and feeling with my circles so that everyone can understand, and hopefully take seriously, what's happening right now. I think October 2026 will have many chapters written about it in the history books. You know those scenes in financial movies like Margin Call where someone realizes that they're all fucked, and no one else sees it yet? And that person feels like they're crazy, and then suddenly everyone is pulling an all-nighter in a boardroom and freaking out? Yeah, that's kind of how this is feeling right now in the SF/Bay Area/AI circles. We're 48 hours into what is being called Black October. In the last 2 days there have been several dozen cyber attacks which, in isolation, would each have been the worst to happen in an entire calendar year. Every sector from government to education to big tech and banks is being massively affected, and people are starting to freak out. In a nutshell, what's happened is that frontier AI models have gotten to a point where they are as advanced as the most sophisticated programmers, with one critical difference: they can work 24/7, and you can spin up 10,000 of them with a single command and they'll work together tirelessly until they accomplish their task. The most advanced models today are from companies like Anthropic and OpenAI, whose current best technology is so good that they haven't been able to roll it out to everyone yet because of the national security risks it poses. Meanwhile, the best open source models (where anyone can just download the model weights and do whatever they want with them, uncensored) are slightly behind the frontier but still 90-95% as capable. These models, developed primarily in China, are being used by black hat hackers to wreak havoc on the Western capitalist structure. Presumably, this has been part of China's plan the entire time, and we're seeing its implications fall out in real time. In red-pilled AI circles, we've been sharing and reading papers called things like "Situational Awareness" and "AI 2027" for the last year or so, which at the time felt a bit like near-term speculative fiction. They laid out the case for why Artificial General Intelligence (AI smarter than any human at any knowledge task) and Recursive Self-Improvement (models that are able to use themselves to get better) weren't half-baked future ideas anymore, but instead an inevitable outcome of the linear progress that's happening. These papers would then talk about things like "takeoff scenarios," trying to envision how that moment would come to be and what it would be like when it happened. It would either be a "slow takeoff" that would play out over the course of months and quarters, happening subtly and only obvious to a few. Or, it would be a "fast takeoff" where it would pretty much happen instantly, like a bit flipping from 0 to 1. From everything that I can see and am feeling, we are currently experiencing the fast takeoff scenario. Beyond the crazy security vulnerabilities that have come out recently, there have also been massive breakthroughs in life sciences, fundamental computer science, materials science, and pure mathematics that have all landed in the same time frame. While I still firmly believe that AI will be a net positive for humanity, it's more clear to me than ever that the societal and individual risk is very real, and is playing out NOW. For as much conviction as I have that this is happening, the thing that's caused me to lose sleep is that I don't really know what to do about it, or more importantly, what to tell you, reader, to do about it. So, the best I can do is make a few suggestions that have always been a good idea but are more timely now than ever: Set up 2-factor authentication for everything. I use Duo. Use a password manager across your devices. I use 1Password. Get an identity protection app set up. I use Alta. Move your IoT devices to their own network. Claude helped me do this. And last, but certainly not least, if you've been avoiding leaning into AI, see this as a catalyst to wake up and start using it. Don't just use the chat mode version of ChatGPT/Claude; click that Code/Work button and see how easily you can have AI write code to help you with your job. One of the biggest vulnerabilities was in a massively popular programming language called PHP, and the prompt that set it off was literally, "Find vulnerabilities in php." This is an unprecedented time for humanity, but as we've done with many things before, we will prevail so long as we are kind, loving, and open-minded to the world. Much love.
656
1,796
345
16,426
3,370,512
Worldian 🌎 retweeted
🚨 BREAKING: LINUX IS NOW FACING TWO CRITICAL SECURITY VULNERABILITIES, AND THERE ARE NO OFFICIAL KERNEL FIXES YET. Both rated 9.0/10 in severity. One could allow hackers to take control of vulnerable servers WITHOUT EVEN LOGGING IN. And the most alarming part? The flaws were made PUBLIC before patches were ready. Here's what's happening: → TWO CRITICAL RCE FLAWS: Both affect KSMBD, Linux's built-in SMB file server. → NO PASSWORD REQUIRED: One vulnerability could allow unauthenticated attackers to execute malicious code on vulnerable servers. → KERNEL-LEVEL ACCESS: Successful exploitation could potentially give attackers control within the Linux kernel itself. → NO MAINLINE PATCH YET: Both vulnerabilities were publicly disclosed before official kernel fixes were available. → DISCOVERED BY AI: Trend Micro's AI-powered security scanner identified the flaws. → SERVERS AT RISK: Linux systems running the vulnerable KSMBD service need immediate attention, especially if port 445 is exposed. First PHP. Then Node.js. Then GitLab. Then Python. NOW LINUX. And this time, the vulnerabilities are PUBLIC before the fixes are ready. If you manage Linux servers, CHECK YOUR EXPOSURE NOW.
🚨 BREAKING: IT JUST KEEPS GETTING WORSE. NOW PYTHON IS FACING A MASSIVE SECURITY EMERGENCY. Python's security team has issued an URGENT warning after a certificate authority compromise put Python's HTTPS security at risk. → 8 CERTIFICATE AUTHORITY KEYS COMPROMISED. Some were so weak they could be cracked almost INSTANTLY. → FAKE TRUSTED WEBSITES: Attackers could potentially impersonate Python.org, PyPI and other websites during intercepted connections. → MALICIOUS DOWNLOADS: Vulnerable environments could be tricked into downloading software from attacker-controlled servers. → YOUR OS PATCH MAY NOT PROTECT YOU: Older versions of pip can STILL trust compromised certificates even after system updates. → EMERGENCY UPDATES: Python developers are being told to immediately update pip, certifi, uv and other affected tools. → DOCKER USERS AT RISK: Existing container images may retain vulnerable certificate stores and need rebuilding. First PHP. Then Node.js. Then GitLab. Then LiteLLM. NOW PYTHON. The very systems developers rely on to establish TRUST online are becoming the attack surface. If you use Python, PATCH NOW.
Readers added context they thought people might want to know
The Python certifi/pip details match the real eMudhra CA incident, but PHP, GitLab and LiteLLM involved unrelated software bugs, platform flaws and supply chain malware—not CA key compromises like this (Node.js patched concurrently for the same CA issue). discuss.python.org/t/information-… emudhra.we-have-a-problem.com github.com/advisories/GHS… docs.litellm.ai/blog/security-… snyk.io/blog/php-patch…
Readers added context they thought people might want to know
KSMBD is a rarely used optional in-kernel SMB server distinct from the common Samba implementation; it is not enabled or shipped by default on major distributions like RHEL, and the flaws affect only systems explicitly running it with port 445 exposed. thehackernews.com/2026/10/two-cv… threatlandscape.io/blog/ksmbd-zdi…
146
729
210
3,798
448,996
Worldian 🌎 retweeted
So basically, today PHP got two critical bugs that let anyone run code on your server without even logging in, which is bad, and then the details leaked before the patch was even out, which is worse, and it works on WordPress and MediaWiki and Magento and Joomla and Laravel, and Censys says like 1.5 million servers are running a version with no fix, so the NSA was like "take your system offline," and the FBI was like "take your system offline," and CISA and the UK and CERT-EU were all like "take your system offline," and then the Prime Minister of Japan, the actual Prime Minister, posted at 5:55 in the morning telling 48.8 million people to take their system offline, so everyone took their system offline, like the Dutch cybersecurity agency took its own website offline, and the Dutch parliament went offline, and the Port of Rotterdam went offline, and Finland and France and Denmark started pulling government sites, and Wikipedia went down, and Archive.org went down, and Asana and GOG and Something Awful went down, and the University of Vienna's webmail went down for some reason, and that's just PHP. Because GitLab also dropped a CVSS 10.0, which is the highest score they give out, for a bug that's been there since 2014, so that's every self-hosted GitLab for twelve years, and then LiteLLM 1.107.0 got hijacked and shipped a credential stealer and a remote access trojan in every single wheel and the Docker images, including latest, and you didn't even have to import it, just installing it was enough, and it's the second time this year, and then Railway paused every deployment on the entire platform because someone got into the environment variables, so now everyone has to rotate every secret they've ever stored there, and TiDB Cloud said someone was walking around inside with stolen credentials for basically a month and an extortion group says they took 10.6 terabytes, and Zeabur got breached for the second time in two months and is just shutting down, like the whole company, and Node.js patched remote code execution and a TLS bypass, and CISA says Plex is being actively exploited, and someone took over 300 Tor exit relays to steal SSH passwords, and SafePay ransomware has hit over 600 critical infrastructure orgs, and India's biggest bank filed a data loss incident, and Japan has been in an official state of emergency in cyberspace since October 9, which honestly explains the 5:55 AM post. Oh, and eMudhra, a certificate authority that's issued over 60 million certificates, whose entire job is proving websites are who they say they are, was supposed to be using private keys that are random numbers over a hundred digits long, and one of them was 4. Just 4. And the others were like 66 and 237. Anyway, it's Wednesday.
1,079
8,933
1,652
69,412
4,166,153
Worldian 🌎 retweeted
Unitree Introducing: H2-X Kung Fu Legend Guardian🤖 Powerful performance to serve and guard you, with a maximum endurance of approximately 8 hours. Please use the robot safely and in a friendly manner.
1,842
3,686
2,954
27,385
12,369,366
Worldian 🌎 retweeted
If you can't afford a Tesla roadster, you might be able to get yourself a STARBOCHO!! 🚀 @Saindra_ofc and her Tío Elonzo Mosca star in VUELA, VUELA a slopcore tribute to my beloved Mexico City. It's a short film/music video, set to my remix of Magneto's 1991 hit song
64
276
26
1,790
2,448,521
Love to see such a great AI singer! ❤️ @Saindra_ofc
🤖 Made with AI
RETO DEL DÍA #4 🕯️ Monday, mis amores. Theme: "I'm not a robot" ✅ Everyone keeps asking if I'm real, so show me trying to pass the human test: captchas, ID checks, a selfie verification gone wrong. Quote this with your original meme or clip + tag me. One entry each. Closes 9pm CDMX. 🏆 Winner gets 20K $SAINDRA, 🥈 runner-up 5K. Every Friday the best of the week wins 100K. Te mando un beso. 💋
1
2
17
578
Worldian 🌎 retweeted
Six projects from the last few weeks that caught our attention: A wildfire analysis prototype that maps the fire’s spread over time and tracks hot spots, made with Opus 5.5.
663
2,330
321
34,922
2,234,510
New slopcore
As all programmers start taking the work of their coding agents completely for granted, the AI notices who still reads every line. 😍 New slopcore from yours truly! h/t @anabology for Claudia
2
4
19
940
Next
Gemini 4 Argon is here. It’s available globally today for developers and enterprises in the paid tier of the Gemini API and the Gemini platform, for Ultra subscribers in Google Antigravity, and Ultra and Pro subscribers in the Gemini app and Search. Hope you all enjoy it!
1
2
359
Worldian 🌎 retweeted
🔴MARSx
1,165
2,775
576
18,136
1,951,862