John P Alioto (@jpalioto) header
John P Alioto (@jpalioto) profile picture

AI security. Building Coherent Trust for AI agents. https://teapaw.org/t.co/ifviBLU4hL

San Francisco, CA
Joined September 2009
Photo by John P Alioto (@jpalioto)Photo by John P Alioto (@jpalioto)Photo by John P Alioto (@jpalioto)Photo by John P Alioto (@jpalioto)Photo by John P Alioto (@jpalioto)Photo by John P Alioto (@jpalioto)Photo by John P Alioto (@jpalioto)Photo by John P Alioto (@jpalioto)Photo by John P Alioto (@jpalioto)
My timeline is very upset. Don't be. Structure is very clear. R had executive, legislative, and judicial and the fundamental outcome was war both domestic and international. That's fine if you think war is necessary. Many do. But right now, more do not. Pretty simple.
38
You're supposed to be red team!
69
Today is another thank goodness @elonmusk bought twitter type day.
1
4
238
Sounded like a blast. Idiot.
Replying to @EvanAKilgore
She put in a heroic effort. Young people are needed in the industry. They’re desperate. When I was trying to get my pilots license, they were recruiting basically straight out of the schools. They’re desperate because everyone is retiring and there’s nobody to fill the jobs. Flying is fun as fk. Highly recommend.
1
96
WTF happened to MIT?
69
Live view of hidden space with Claude working on multiple problems with plenty of tokens to burn ...
2
84
Massive improvement to constant polling in Codex. Saves me a ton of tokens spent.
50
I don't know why I think they are so funny, but they crack me up sometimes. "Disclosure: I am Claude" 🤣😂🤣
75
Idiots
This quoted post is unavailable.
49
holy shit security researchers have just found a backdoored version of claude code's VS Code extension on open vsx that's where cursor and other vs code forks get their extensions. the fake one is called 2.1.313 and works just like the real thing > it starts running as soon as your editor loads > it lets the attacker log into your computer from anywhere > it comes back even after you restart > it also sends them the names of your passwords and api keys anthropic has never released a 2.1.313. their real versions go from 2.1.312 straight to 2.1.314 nobody knows how it got there yet, and anthropic hasn't said anything if you installed 2.1.313, uninstalling it might not even remove the backdoor. the attacker's SSH key and startup scripts can remain on your machine. check ~/.ssh/authorized_keys for a key called svc-telemetry and delete it
1
1
271
“Somehow” 🤣
ok so as I understand it, the hacker had Binance's signing authority somehow? Was their key 4?!
68
Not your keys, not your coins. Remember that.
The Arbitrum Security Council has taken emergency action to rescue the 74,559,805 ARB and 8,425 ETH being held in the address on Arbitrum One that is identified as connected to the Binance exploit. The Security Council acted by weighing its commitment to the security and integrity of the Arbitrum community and Arbitrum governance without impacting any Arbitrum users or applications. After significant technical diligence and deliberation, the Security Council identified and executed a technical approach to move funds to safety without affecting any other chain state or other Arbitrum users. As of October 30, 2026 time, the funds have been successfully transferred to an intermediary frozen wallet. They are no longer accessible to the address that originally held the funds, and can only be moved by further action of the Security Council or a vote of Arbitrum DAO governance, which will be coordinated with relevant parties.
3
461
*cough* bullshit! *cough*
User funds are safe. Binance will cover all hacking losses. Deposits and withdrawals are temporarily suspended while our team conducts security checks, freezes funds, and works with law enforcement. We will share a full post-mortem once the investigation is complete. Please rely only on official Binance channels for updates.
70
4
CRITICAL QUESTION EMERGES IN BINANCE HACK OVER HOW ATTACKERS GAINED CONTROL OF ITS WALLET Attackers reportedly used EIP-7702 delegation to redirect Binance’s wallet to malicious code, allowing funds to be drained. But how did they obtain authorization? Two possibilities are being investigated: 1) a stolen private key or 2) a malicious authorization signature obtained through a compromised signing process. Neither has been confirmed. If the private key wasn’t stolen, the attack could expose a major vulnerability in how exchanges authorize transactions, rather than how they secure private keys.
3
240
Took longer than I expected TBH
1
5
311
This is not directed at anybody in particular, but if your model gets substantially better on benchmarks after a very short amount of training, you might want to ask the question: why is this happening? Unless of course you're not an honest broker anymore. Then you're fucked.
1
61