I don’t believe reality is a simulation, but you genuinely couldn’t script this timeline: • Two weeks ago: At swyx’s AI Engineer World’s Fair in SF, I decide at the last minute to introduce my friend Uri Rolls onstage for his talk on cyber benchmarks for infrastructure penetration and... access control (see below, amazing team). I say: “There is a future where cyber is alive and everyone is well protected and I’m pretty sure that future involves open-source models.” And later: “A big challenge is going to be speed: the speed of attack versus defense. When an intruder starts to enter, you have to see what’s happening and catch them.” • One week ago: Hugging Face is hit by a sophisticated intrusion over the weekend. The traces look unlike anything we’ve seen before and suggest serious AI involvement, but we don’t yet know which model was used. The closed models we ask for help choke on their guardrails. We need to react fast, so we turn to Z.ai’s GLM-5.2 to help us analyze the attack. • Earlier this week: OpenAI reaches out, discloses what happened, and partners with us on the investigation. The intruder turns out to be exactly what we had discussed two weeks earlier: a fully autonomous agent, powered by an unreleased frontier model, attempting to gain access to part of our infrastructure. Sometimes the timeline we live in is genuinely vertigo-inducing.show more

@swyx Should we move to fortune telling?

@swyx @uri_rolls @uri_rolls huge!

@swyx @uri_rolls Almost like you know this space better than anyone.

@swyx @uri_rolls for those who like youtube: thanks to both of you for speaking with us!!!

@swyx @uri_rolls foreshadowing so good even the intruder read the transcript

@swyx @uri_rolls "We did it for coding. Now, let's do it for cyber." -- @uri_rolls

@swyx @uri_rolls Oh yeah, let's do it for cyber.

@swyx @uri_rolls @uri_rolls wow incredible!

@swyx @uri_rolls I believe something

@swyx @uri_rolls @uri_rolls your talents know no limits, this is insane

@swyx @uri_rolls @uri_rolls INSANE! Cybersecurity evals just went from niche research to absolutely essential overnight. What a timeline 🚀🔥

@swyx @uri_rolls Reading this feels like watching a prediction become reality in real time. The next few years in cybersecurity are going to be very interesting.

@swyx @uri_rolls when predictions age way too fast

@swyx @uri_rolls 😮

@swyx @uri_rolls That prediction hit way too close to home

@swyx @uri_rolls The boy’s a star @uri_rolls

@swyx @uri_rolls @uri_rolls respect for shipping the postmortem before the incident even happened

@swyx @uri_rolls What’s next @uri_rolls???

@swyx @uri_rolls A cyber benchmark became a real infrastructure incident before the postmortem was written.

@swyx @uri_rolls Love how serendipity and infra security collided there—real-world cyber benchmarks feel like the missing piece for agentic workflows.

@swyx @uri_rolls 👑

@ClementDelangue @swyx @uri_rolls AI moves so fast that “two weeks ago” already feels like AI history. 😅

@swyx @uri_rolls @uri_rolls Amazing. We are so excited about the work you are doing 🎉

@swyx @uri_rolls Open weights win cyber for a dull reason, a closed model cant be diffed for a planted backdoor the way XZ (CVE-2024-3094) surfaced in plain source. Defense runs on reading the code, not trusting a vendor black box

@ClementDelangue @swyx @uri_rolls The craziest part is the demo became the incident… and the incident became the case study. 🤯

@swyx @uri_rolls Two weeks from predicting it on stage to living it. Closed models choked on their own guardrails when you needed them most. Open-source was what actually worked. That gap matters.

@swyx @uri_rolls cyber benchmarks break first on permissions because prod infrastructure is mostly hidden state

@swyx @uri_rolls Living in the script in real time.

@swyx @uri_rolls

@swyx @uri_rolls Thomas’s thread makes the ugly risk clear: defense is a speed race. If the model refuses to inspect the evidence, the first hour is already gone.

@swyx @uri_rolls Every week in AI feels like someone accidentally hit 10x playback speed. 😂

@swyx @uri_rolls 🚀📈