the hard part for the banks is telling a customer's own agent apart from an attacker when both log in with the same password

i teach at night and hire during the day. honestly the students who stay and actually build stuff with AI are the ones i'd hire

i stopped reading diffs this year, an agent does it now. the hard part is knowing when to step in, and i have no idea how to interview for that yet

posted about this exact thing this morning. 9.3M patched out of 42M. a lot of teams can't patch without taking something down, so they just don't

the one i'd put at the top of any list: use passkeys or a hardware key on email first. almost every other account recovery runs through it

we treat anything the model outputs as untrusted user input. if a price or a refund matters, a check outside the model has to approve it

same here. i used to review every diff. now an agent reviews them and i just judge the output. does it work, does it hold up, did it ship

the box you bought to stop attacks runs the same php as everything else. 2 critical rces. patch the firewall first 🫡

leaked in may. still valid in october. five months and nobody rotated it.

refusals don't slow attackers down, they already run abliterated weights locally. they slow the defender trying to reproduce the attack. the safety tax lands on the wrong side (just guessing)

from the security side the pattern is boring and consistent: the "out there" claim shows up about one release before the incident writeup does. cheaper to plan for it early than explain later why you didn't

we put five 9s on a pedestal.
soon we'll normalize taking products offline to patch and upgrade, and nobody will treat downtime as a failure.
planned downtime is about to become a security feature.

i teach at night. if a course goes 85% stale in a year, a four-year degree is a snapshot of a field that has already moved on.
what would you still teach?

at that volume tokens stop being a line item and start being a utility. the teams still negotiating per-seat AI contracts are pricing the wrong unit lol

the cyber-risk claims are the part security teams should read twice. strongest open weights so far means nobody can revoke access once they drop on nov 4. the plan has to be ready before then, not after

dated call, oct 24 2026:
this week it was php2shell, a Brotli RCE, and a GitLab bug dating back to 2014. at least two of them were found by models.
finding bugs is no longer the bottleneck. by oct 2027 the real limit on every security team is how many changes prod can absorb in a week. 
checking back on this in a year.

Thousands, Well over 5k total not including local hardware

Heavy is amazing

“% left.” Nobody opens a menu to do mental math!

Codex measures the remaining Grok measures the used Same quota, opposite math. Why are we like this 😅