AI is good & bad, actually. Tweeting about AI/ML methods, software dev, research, tech and society, social impact. 20yrs in tech, 10 in ML/AI, PhD in comp sci
London, England
Joined August 2013
- Tweets7.4K
- Following5.1K
- Followers6.9K
- Likes46.3K
Pinned Tweet
The story of LLMs playing games, and what we know so far
Tic Tac Toe, Chess, Minecraft, NYT Connections, Wordle, Pictionary, Connect 4, Codenames, Snake... 1/n
Joining the chorus, have been on $200/mo codex for almost 2 years, just downgraded it to bump up my Claude instead. Opus 5.5 is a significant retake of sota that I last saw in codex GPT 5.4
Samsung TV listening stuff is way overblown. No background listening has been shown. It's all standard wake word (like "Alexa..") & a few opt in features (baby monitor, dog barking monitor). They *are* fingerprinting what you watch, for ads, but this is standard SmartTV stuff
live-tweeting on samsung findings were fun.
i'll let my agents give it a bit more time, but this document is already the most comprehensive breakdown of some key concerns of tizen i've seen run on a live device.
it takes like a good while for me just to scroll through it (there's about 44 writeups as of right now on individual functionality).
release is probably happening in a few days.
Paul Calcraft retweeted
at least eMudhra gave us a new fact that people preparing for time travel can memorise
LLMs are hallucinating a lot of php2shells that don't actually work (w ignorant users celebrating, thinking they've hacked something)
Experts at the wheel still valuable for at least a few more months
I'll be the first to admit I'm mediocre at exploit development, but I am in contact with enough extremely talented exploit developers to say this for certain:
Anyone claiming they were "easily" able to generate a working php2shell exploit with AI is either:
a) a world-class exploit developer with an extreme case of imposter syndrome.
b) currently looking at some very confident-sounding but wrong LLM output.
I'm rather certain it's the latter based on the number of AI-hallucinated exploits I've seen posted on GitHub. Threat actors are also blasting my honeypot network with "php2shell" exploits that not only don't work, but aren't even within 10,000 miles of anything to do with how the exploit actually works.
I've seen the same technique from the attached image in multiple alleged "php2shell exploits", including one on GitHub with over 100 stars. Problem is, it's not php2shell, nor is it even a vulnerability at all. It's a technique known as "session poisoning", which can be leveraged to exploit local file inclusion (LFI) vulnerabilities in PHP apps (not PHP itself).
The only thing it has in common with CVE-2026-109618/CVE-2026-109619 is they both use the "PHP_SESSION_UPLOAD_PROGRESS" feature. And mitigation advice for both issues reference setting "session.upload_progress.enabled" to "Off".
People are shoving loose details of the vulnerability into LLMs, the LLMs are keying in on the "PHP_SESSION_UPLOAD_PROGRESS" string, then generating session poisoning code that has nothing to do with the actual CVE. And because the people doing this have absolutely no idea what they're doing, they're confident enough to post their "proof of concept exploit" to GitHub and share it on social media.
So if you see people talking about "session poisoning + LFI" it's likely their LLM hallucinated an exploit based on a 2018 blog by Orange Tsai talking about a local file inclusion attack vector.
What's even worse is that "security researchers" are then using LLMs to triage these exploitation attempts, falling victim to the same hallucinations, then confirming there is ongoing mass-exploitation (there currently isn't).
The actual real exploit is very difficult to exploit, and so far I've not seen anyone successfully get it working on more than a handful of PHP version with highly-specific configurations.
LLMs are useful tools in the hands of skilled professionals, but for others, they're often just a Dunning-Kruger accelerator.
Paul Calcraft retweeted
After yesterday’s avalanche of vulnerabilities, I have a much better grasp on why frontier AI models have internal tripwires for cybersecurity prompts.
Software of the past has more holes than Swiss cheese and this transitionary period of finding them and patching them will be a very painful one.
From the henry that brought us generating a world map from asking "sea or land?" for lat long pairs
Another great eval / viz
Extrapolation isn't special, it's just one of many strategies you can learn via (high dimensional) interpolation. LLM shaped objects can learn how to do things that break out of their training distribution. We have enough empirical examples now
Max Planck's "Science advances one funeral at a time" schtick looks increasingly untenable as AI progress accelerates. This is good
Paul Calcraft retweeted
Last year's April Fool's joke is this year's reality (except for the name of the problem obviously).
A lot of companies put up with a lot of engineers who do not do this. They have little product/business sense or interest, but you give them a spec or a technical challenge & they drill on it. These people's commercial value is obviously being eroded dramatically
Dec 2023. LLMs for decompilation "couldn't this be big?" Turns out - yes
"The dwindling player base of quasi-Riemann have been begging for offline support for years now. A new movement called Stop Killing Math is launched, lobbying governments to require all live service proofs to have offline or community supported transition plans"