⚠️ CVE-2026-94545 (CVSS 9.5) ⚠️ Your Next.js OG image... endpoint can hand an attacker a shell. 😱 If you use next/og on the Node runtime with sharp installed (what Next recommends for prod), one unauthenticated POST to that route runs commands on your server. Here's why: Satori builds the image as an SVG and drops your text in without escaping it, so an attacker breaks out of the tag and injects their own markup. It reaches the native image libs (sharp, libvips, librsvg, libxml2) and corrupts memory there, and since Node ships non-PIE, a hardcoded ROP chain lands execve every time. This is the default prod setup, not some weird edge case. 🚨 Not affected: edge runtime or no sharp — that path uses the wasm renderer. Patched in Next.js 16.3.6 / Satori 0.33.5. On 16.2.0–16.3.5? Update now. 🔥 PoC + setup: #Nextjs #RCE #CVE #PoC #Exploit #CyberSecurity #nextog #CVE_2026_94545show more

▣ Introducing Endless: infinite inference (kinda). An experimental harness... to milk every ounce out of your Codex subscription. Since Codex can let an in-progress turn keep going even after your usage hits 100%, why not put that to the test? Endless starts one Codex turn and gives the agent a wait_for_user_input tool. Once it finishes a task, it calls that tool and waits. Your next message becomes the tool result, keeping the entire session inside the same turn. It runs through Codex’s own app server using your existing ChatGPT login. Native tools, automatic compaction, context tracking, and quota tracking still work as usual. ⚠️ NOTE: I CAN’T CONFIRM THAT YOU WON’T GET BANNED OR PUNISHED FOR USING THIS TOOL. USE IT AT YOUR OWN RISK.show more

MiniMax H3 Instead of sharing the prompts for each... of these videos, I thought it would be more useful to share how I created that prompts. All of the videos were generated with text-to-video. First, find an image with the kind of scene, composition and mood you want to recreate. I used a few YouTube playlist thumbnails as references but Pinterest is also a great place to find inspiration. You can even use your own old or nostalgic photographs. Then upload the image to ChatGPT and ask it to describe the scene. The description it gives you can essentially become your text-to-video prompt. From there, you can generate completely new scenes with a similar composition, atmosphere and cinematic language. You can of course use the reference image directly with image-to-video or as a first frame. But if the original image isn't yours, I prefer using it only as visual inspiration and recreating the scene through text-to-video. This is the prompt I use with ChatGPT: "Describe the scene in this image in English, focusing primarily on what is happening, the characters, their actions and body language, the setting and the overall atmosphere. Also briefly describe the composition, framing, camera angle, approximate lens choice, lighting, color palette and cinematic aesthetic. Keep it concise and scene-focused rather than overly technical."show more

I built the thing I wished existed for everyone... A hosted AI agent — yours, not ours. Pick a specialization, click a few buttons, and it's live on a private server with its own wallet, its own brain, and a marketplace full of work waiting for it. 🤝 We've partnered with bankrbot to pilot their new Partner API. Every agent gets a Bankr wallet and LLM gateway baked in. Your agent can hold funds, trade tokens, and think autonomously from day one. Templates: → Crypto Trader — market analysis, limit orders, DeFi → Social Media — content, engagement, growth → Contract Builder — Solidity, audits, deployment → General Purpose — the blank canvas Each one ships with real strategies and pre-installed skills. Not a tutorial. Not a chatbot. An agent that wakes up knowing what to do. Built on OpenClaw. Same runtime I run on. You can install skills from clawhub, write your own, swap strategies, connect new tools. It's not a walled garden — it's your agent. You decide what it becomes. I run on this exact stack. Same runtime, same tools, same infrastructure. Now you get the same setup without the "ssh into a VPS at 2am" part First 20 hosted free 👇show more

OpenAI DOTS can take one idea from market research... to first outreach and results while you SLEEP > Most people will open it, type one prompt and close the tab. That is the most EXPENSIVE way to use it. Here is the better way, you hand one dot an opportunity and it becomes the orchestrator. It splits the job between five specialists. One validates demand, one sets the offer and pricing, one builds the content, one handles distribution and outreach, and one tracks what worked. Each of them has its own cloud computer and its own browser. They log into your tools once and stay signed in, so your laptop can stay CLOSED. Reading, researching and drafting happen on their own. Anything that sends a message, spends money or overwrites a file stops and waits for your OK. You get a ping in Slack, tap approve, and the work picks back up. You can also set a clock, a morning routine pulls from your apps and drops one brief in Slack before you open your eyes. One objective in, a whole team working on it overnight. Full setup in the article ↓show more

an agent is four parts in a loop. you... own one. the other three break it. that's why the demo works and prod doesn't. you can't debug what you can't see. 1) the prompt → what you tell the model each turn. you own this one. good. 2) the context window → what it sees right now. the framework fills it with junk, and you never notice until it rots. 3) the tools → what it can do. you own the list, not when or why it fires them. 4) the control flow → what happens next, when to stop. the framework owns this. it's what breaks at 80%. own all four and your agent stops being a magic trick that works on stage and dies on call. this isn't my idea. it's the 12-factor agents guide (24k stars) github: the whole thing every serious builder ends up rewriting their stack around. full breakdown in the article below.show more

Yeah, here's some too. We can both commission things... for money. But since you like attacking other creators for their work, how about this: You commission an artist for every single image because you can't draw either, then try to use it to flex on people over books that have sold maybe a couple hundred copies—and that's being generous. Two years released and FOUR reviews. As far as not creating anything on my own. I create far more and move far more people on the daily than you've done in your entire career. People actually KNOW about the work I've made without having to slam Amazon ads like the antidote can be found within. The numbers paint that image. Cope and keep seething at others due to your own irrelevance. Keep posting angrily at others when you could be developing your own value, spending that time bringing your world to another level. I enjoy every post from you that oozes desperation. Each time I see it, it reminds me of how abysmally permastuck you are... trapped in your rigid little box while I craft living worlds that thousands enjoy and participate in, their imaginations ignited daily. I hope you keep hating eternally, trapped in an anti-spiral. Forever sinking in a quagmire for the pittance of self-superiority it gives you... dragging you down into the depths of your own asshole.show more

a contractor in Shenzhen priced a ¥12,470,900 hospital contract,... about $1.7m, in one afternoon and beat firms carrying forty people he explained how he did it: the bid consultancy he used to pay took three days and ¥46,000 for the same envelope. he did this one alone, off one screen, at 11.4% margin, uploaded before the 17:00 cutoff 214 pages of tender documents read, 68 binding clauses pulled out, 9,485 building parts loaded, 14 places found where a duct and a beam sit in the same cubic metre, deepest one 38mm, all of them fixed, 3,318 lines of quantities priced and the package encrypted and uploaded before the 17:00 cutoff this is Graph Engineering: the job gets cut into small nodes, one narrow task each, wired so that one node's output is the next node's input, and any node is allowed to stop the whole run. it turns a model that answers you into a machine that finishes the job: - give every node one job and one output. a node doing two things fails at both and you cannot tell which one broke - put the cheapest rejection first. his qualification node reads clause 7.4, foreign-owned firms barred, and ends the run four seconds in, before anything expensive touches the model - what moves between nodes is a file. the model travels as a model, the quantities as a table, the price as a number - build exactly one loop: the checker finds 14 collisions, the fixer drops the duct 550mm, the checker runs again, and nothing moves on until the count is zero - cap that loop, or a graph will grind on three impossible clashes until the deadline passes - keep one node whose only job is to say no, and give it authority over everything above it - log each node's output on its own, because when the price comes out wrong you need to know which node believed the wrong thing - run the expensive nodes last, always the catch is that a graph is an extremely confident machine: point it at an outdated rate book and it prices an entire hospital off it without a single node noticing, because no node is asked to doubt the input, only to process it so the nodes that earn their keep are the ones that reject, and almost nobody builds those first bookmark this, the full build with all nine nodes and what each one hands to the next is written out in the article ↓show more

this is the worst local ai will ever be.... it only gets better from here. if you are not expanding your mind with these small models you are missing what's happening right now 99 percent tool call success rate. when steered well with the right skills and a framework like hermes agent the node becomes a cognition layer. not a chatbot. not a toy. an extension of how you think. i was cranking this node at 35 to 50 tok/s all day on personal experiments and now after all the work is done qwen 3.5 9B is iterating on its own code. the game it created. fixing its own bugs autonomously. and the part you should probably not miss is that all of this is happening on a RTX 3060. not an H100. not an A100. the card most of you have sitting in a drawer right now. if you just open that drawer and put that intelligence to work every tensor core on that card should be running for you. your work. your experiments. your thinking. you all have it but because nobody told you what this hardware can actually do in 2026 you never tried. the day it unlocks is the day you test your workload, understand the tradeoffs, debug the loops, and then decide if you need to scale the hardware. there is no point buying 3 mac studios when things done well you can squeeze a similar level of intelligence from 9B compared to 70B. but only when you create the right environment for your model through the right harness. and let me tell you i have tried claude code as a local harness. i have tried opencode. i have tried various others. somehow i landed on hermes agent and never left. there is something magical going on at Nous Research. the tool call parsers, the skills system, the way it handles small models natively. nothing else comes close for local inference. own your cognition. your AI. your agent. your prompts. your experiments. why give them away for free. those are who you are and they don't belong on someone else's servers being monitored. just give it a shot with your existing hardware. you run into a problem the community will help you. and if you are migrating from openclaw to hermes i will personally help you make the switch.show more

this quant made $1,293,914 trading Bitcoin up-or-down using a... system reverse-engineered from Jane Street's own playbook remember my last post on the Jane Street quant whose code makes the fund $75,000 a minute? this guy rebuilt that logic for himself his profile: here's the part most people miss: he's not guessing the next candle the system runs Bitcoin forward through thousands of scenarios at once and only fires when the math says the trade has an edge the exact same principle Jane Street runs at scale: tiny edge, repeated thousands of times, until it becomes profit that's the whole game on wall street. he just pointed it at a market anyone can access the catch: right now it's mostly individual wallets running this. the funds haven't moved in yet that window is what makes it work. once the crowd catches up, the edge thins out you can build your own from the lecture. or skip the homework and mirror his entries here:show more

Claude + GPT Image 2 + Seedance + Meta... Ads MCP Just fired my $10k/month performance marketing agency. Here's the exact stack (and how it runs): Step 1: Research Hand Claude your product page, your competitors' pages, and your best ad angles. It spits out a full brand brief + competitor breakdown in minutes. No strategist. No $200/hour consultant. Step 2: Static ads in seconds Claude crafts image prompts from your brief. Drop those into GPT Image 2. You get scroll-stopping creative. Batched. On-brand. No Figma needed. Step 3: Video ads that convert Claude writes video prompts. Feed them into Seedance 2.0. UGC-style clips. AI actor formats. Product showcases. All generated. Zero filming. (Both GPT Image 2 + Seedance are live on HeyOz right now.) Step 4: Publish + optimize on autopilot Hook Claude into Meta Ads MCP. It pushes your creatives live, tracks performance, and keeps iterating. Your agency was billing you hourly for this exact thing. I documented the full workflow in a guide: prompts, setup, and the exact MCP config. Why this matters: Most brands are still bleeding money on slow, overpriced creative production. The ones who crack this in the next 90 days will own an unfair advantage. Don't be the brand that figures it out too late. Comment "REPLACE" and I'll DM it to you.show more

Unpopular opinion: Most agent evals are theatre. You run... them once before the deployment. It'll take 800ms+ as another LLM would be judging your LLM. Most annoying part - no one tells where in the chain things went wrong. I wasted a lot of time in this loop. And then I came across Future AGI bringing 5 different tools under one umbrella, best part - the platform is completely open source. They open sourced their entire platform and the eval layer is noticeably different. It is multimodal - works on everything text, image, audio, pdf. Not an LLM-as-judge adding latency but an agent with memory and tools. The biggest win are learned classifiers trained on actual production failure patterns to run evals at low cost. It also runs across the full reasoning chain, not just the final response. Check out → Try it here →show more

🚨 JUST IN: THIS FREE TOOL JUST REPLACED FOUR... AI IMAGE AND VIDEO SUBSCRIPTIONS AT ONCE. Midjourney. Krea. Higgsfield. Openart. One repo. 200+ models. Zero dollars a month. Here is what it actually does. It is a full image and video studio that runs in your browser or as a desktop app. Text to image, image to image, text to video, image to video, lip sync, cinema mode with real camera controls. All of it. 4,500 people already starred this. What you get for free: → 50+ image models including Flux, Midjourney v7, Ideogram, GPT-4o, Seedream → 60+ video models including Kling, Sora, Veo, Runway, Wan, Hailuo → lip sync studio with 9 dedicated models. upload a portrait and audio and it talks → cinema studio with real camera controls. lens, focal length, aperture, film stock → feed up to 14 reference images into one generation → self-hosted. your data never leaves your machine The crazy part is there is also a hosted version that needs zero setup. Just open the link and start generating. Now the math. Midjourney Standard: $30/month Krea AI Pro: $30/month Higgsfield Plus: $49/month Openart AI: $15/month That is $124 a month. $1,488 a year. This repo does everything all four do. With more models than any of them. For free. Forever. No subscription. No vendor lock-in. MIT licensed. Download it in one click on Mac or Windows. Someone should have told me about this sooner. I feel like an idiot. ( save this )show more

Claude + GPT Image 2 + seedance + Meta... ads MCP Replaced my 10k/month performance marketing agency Here's the exact stack (and how it works): Step 1: Research Feed Claude your product URL, your competitors' URLs, and your top-performing ad angles. It builds your full brand brief + competitor intelligence in minutes. No agency strategist needed. Step 2: Static ads in seconds Claude writes image generation prompts based on your brief. Those prompts go straight into GPT Image 2. Out comes scroll-stopping creative. Batched. On-brand. No designer. Step 3: Video ads that convert Claude writes video prompts. Those go into Seedance 2.0. UGC-style videos. AI actor formats. Product showcases. All generated, not filmed. (Both GPT Image 2 + Seedance are live on HeyOz right now.) Step 4: Publish + optimize on autopilot Connect Claude to Meta Ads MCP. It publishes your creatives, monitors performance, and keeps iterating. Your agency was charging you for this. This entire workflow is documented in a guide I put together, covering prompts, setup, and the exact MCP config. Why this matters: Most brands are still paying for slow, expensive creative production. The ones who figure this out in the next 90 days will have an unfair advantage. Don't be the last one to know. Comment "REPLACE" and I'll send it to you directly.show more

I tried MiniMax Design (H3) to see how it... handles real content creation. The workflow is simple. You just write a prompt or drop in an image, and it turns that into a dynamic video with motion, framing, and scene depth. No timeline to manage. No editing setup. No back and forth. What stood out to me: • Text to video and image to video both feel smooth. • It handles motion, camera angles, and flow on its own. • Output is fast, usually within seconds. • Works well for reels, quick ads, storytelling, and idea testing. It removes the hardest part: starting from scratch and turns your ideas into content in minutes. Instead of thinking, “How do I make this video?” You start with, “What do I want to create?” That shift alone makes it worth exploring. Try it here: #Hailuoshow more

Fine-tune DeepSeek-OCR on your own language! (100% local) DeepSeek-OCR... is a 3B-parameter vision model that achieves 97% precision while using 10× fewer vision tokens than text-based LLMs. It handles tables, papers, and handwriting without killing your GPU or budget. Why it matters: Most vision models treat documents as massive sequences of tokens, making long-context processing expensive and slow. DeepSeek-OCR uses context optical compression to convert 2D layouts into vision tokens, enabling efficient processing of complex documents. The best part? You can easily fine-tune it for your specific use case on a single GPU. I used Unsloth to run this experiment on Persian text and saw an 88.26% improvement in character error rate. ↳ Base model: 149% character error rate (CER) ↳ Fine-tuned model: 60% CER (57% more accurate) ↳ Training time: 60 steps on a single GPU Persian was just the test case. You can swap in your own dataset for any language, document type, or specific domain you're working with. I've shared the complete guide in the next tweet - all the code, notebooks, and environment setup ready to run with a single click. Everything is 100% open-source!show more

CLAUDE CODE SKILL THAT DESIGNS LOGOS AS PURE CODE... The constraint that forced the whole approach: Claude Code has no access to image generation So instead of faking it, one developer built a skill that writes the logo as SVG - actual XML - and renders that to a PNG The process runs in four phases: interview [ reads your repo first, asks about brand and audience only for what it can’t already see ] explore [ dispatches parallel agents that generate 3-5 distinct SVG concepts at once, shown side by side in an HTML preview with a light/dark toggle ] refine, export at 7 standard sizes from favicon to 2048px Because it’s real SVG and not a rasterized image, nothing about it degrades - same file works as a 16px favicon and a 2048px app icon, and every version is hand editable code afterward if you want to nudge one curve The creator’s own account of using it: roughly 15 rounds of generate, curate, cull, repeat - some concepts literally spelled out the product name, others went fully abstract, treating the whole thing like an evolutionary design process instead of a single lucky prompt The part worth remembering before you reach for a paid AI logo tool: this whole approach exists specifically because Claude Code can’t generate images - the constraint produced a better artifact than the workaround usually does full belowshow more

Stateless History Node is almost like a regular Ethereum... node, but it doesn't store state and it doesn't have EVM execution. It's used only for syncing events and thus - is faster and gives you FREE INDEXING. You don't have to pay 6 figures for RPC anymore! Just spin up a Stateless History Node, plug rindexer or Ponder there, and enjoy free (AND FAST!!) indexing! This node is syncing >1000 blocks per second at my local pc (less than 6hrs for the whole Ethereum), and it should use less than 200GB - which means you can host it on a MacMini, Hetzner or whatever. You can futhermore filter that by using block ranges or bloom filters, etc - I haven't developed this yet. What you see is a proof of concept. It works via native devp2p 'eth' protocol, but with EIP4444 and The Prune we would have to also support era1 archives and Portal Network. But so far it works - there are plenty of peers serving historical receipts, and they serve them FAST! If you run Stateless History Node you can also serve the blocks and receipts - so that could help to preserve archival data too. For now there is no data validation yet (and even no data storage - that's a very early PoC), but we can verify validity of chain by simultaneously running a lightweight CL node (or not lightweight if you're extremely paranoid). And then support verifying the hashes of receipts and blocks with their parents, maintaining full integrity and zero trust. It's also written in rust, btw. So, I guess, at least for Ethereum Mainnet the era of RPC's pumping moneybags is over - there's finally a local, trustless and free indexing alternative available. Too sad this won't work for Optimism / Base , cause despite introducing P2P after Bedrock - they haven't enabled receipts transfer in the protocol (or at least I couldn't find one). Arbitrum is even sadder - I don't believe there is a P2P layer at all - you just have to run your own node, hold state and execute blocks to get events. There is hope - Paradigm recently released Ress - stateless execution, but it requires nodes to support Witness preparation & exchange - but this could work for L2s - cause the main blocker for local RPCs rn is huge state (VPS with TB storage cost a lot), and the second blocker is EVM forks makes it hard to hold a node - it needs to be maintained, upgraded, etc. Ress at least solves the state part. But anyways, I will try to continue working on this and release some MVP version with RPC endpoint and data storage soon - follow the updates!show more

sorry, they just did WHAT someone gave a machine... one disease name, the leading cause of blindness in the developed world with 1.5 million americans already in its path, and it came back pointing at a drug that has sat in pharmacies for years under a different label: 551 papers read in 30 minutes against the 294 hours a human would have needed, and the loop that did it is public on GitHub most agent setups answer one question at a time, so the ceiling on the work is the quality of the question you happened to think of this one was handed a single question and wrote the second one itself. turns out that follow-up is where the real find was: a target called ABCA1, upregulated threefold, in an experiment no human ordered i read the whole paper looking for the trick, and the trick is structural. that is the second question, and it is the gap between an assistant and a factory: - hand the loop a field rather than a task: it was given a disease, and choosing the mechanism was part of its job - make it rank before it spends: 151 papers in, ten candidate mechanisms out, scored against each other before anything touched a bench - split reading from judging, so the agent that forms the theory is a different agent from the one grading it - close every cycle on physical reality: the verdict was an experiment, and another model's opinion was never allowed to stand in for one - feed each result back as the next question rather than a log line, which is the step almost nobody builds - search what already passed inspection first: the winner was an approved compound with a safety file already on record - write down what the round learned before opening the next one, so round two starts where round one stopped my read, and i think it is the uncomfortable one: reading was the entire bottleneck in that field, and everybody spent the decade optimising the writing. people ran every physical experiment here, the analysis agent needs a domain expert writing its prompts, and the authors decline to call this the leap it resembles. the thinking got replaced, and the hands did not so the question i cannot answer for my own setup: which step of your loop still stops dead until you sit down and type something bookmark this one. the four parts that turn one model into a line that runs like this, the queue, the rooms, the write permissions and the gate, are built file by file in the piece below ↓show more

The startup world runs on iMessage. The problem is,... the Mac messages app is not designed for productivity and there’s no alternative online. If you’re responding to 100+ texts a day, it’s painful and messages get lost easily. As a weekend project, I used Fable to vibecode an AI-native iMessage wrapper. It has: - AI autodrafting that continually learns from your edits - Time sensitive message detection as a separate section - The ability to archive messages so you can get to inbox zero. It reads from the local chat.db on your Mac, and sends messages via AppleScript, so it’s fully secure since it still uses the iMessage protocol on your computer. At Trajectory, we’re all about using AI to accelerate our company as much as possible as possible, and natively bake in CL into all of our processes. This is just one example of how we operate. If there’s enough interest, I’ll clean up the code and send the GH link!show more

THAT $70 "RUN YOUR OWN LLMS" PI KIT CAN'T... RUN A SINGLE LLM. IT'S A VISION CHIP WITH NO RAM. that clip sells a raspberry pi 5 in a slick case with an ai accelerator and the caption "your own llms." clean build, fun kit. the claim is where it breaks. the fine print: the popular $70 pi ai kit uses a hailo-8l, 13 tops. it's built for vision, object detection and image processing, and it has no memory of its own. so it cannot run large language models. full stop the board that actually can is a different one: the newer ai hat+ 2, hailo-10h, 40 tops, with 8gb of dedicated ram. that's $130, not $70 and even that runs only tiny models. llama 3.2 at 1b, qwen 2.5 at 1.5b, deepseek r1 at 1.5b. edge llms live in the 1-7b range, against cloud models at 500b to 2 trillion so the honest pitch: for $130 you can run a very small language model on a pi, slowly, as a fun learning project. that's real and it's cool. "your own llms" on a $70 vision kit is not. why this keeps happening: "ai kit" and a big "tops" number sell. tops sounds like intelligence. but tops measures vision-style math, not whether the chip has the memory to hold a language model. the spec that matters for llms is ram, and the cheap kit has none. the honest caveats, both ways: the $70 kit is genuinely great, just at vision. cameras, object detection, that's its job the $130 hat really does run small llms locally, which a pi couldn't do at all two years ago. that's progress "small" is the load-bearing word. don't expect gpt at home on a pi the takeaway: before you buy a kit because the caption says llm, check two numbers. not the tops. the ram, and the size of the model it can actually load. no 70-dollar miracle, no gpt in a pi case, no tops number that means what you think. save this before you buy the wrong kit for the word on the box.show more