Video yükleniyor...

Video Yüklenemedi

Bu video yüklenirken bir sorun oluştu. Bu geçici bir ağ sorunundan kaynaklanıyor olabilir veya video kullanılamıyor olabilir.

Ana Sayfaya Dön

Introducing XSS2Shell ⛓️: WordPress Core preauth XSS→RCE vulnerability affecting 43% of the internet, discovered autonomously by pwn (using open-source models), affecting all WordPress versions. Please patch CVE-2026-64638 as soon as possible!

pwn.ai

9,577 subscribers

1,647,376 görüntüleme • 1 ay önce •via X (Twitter)

Bilim & Teknoloji

Anya Rossi• Live Now

Private livecam show

25 Yorum

Nav Toor profil fotoğrafı

Nav Toor1 ay önce

found by open-source models, not some big lab

NodeArc profil fotoğrafı

NodeArc1 ay önce

Open source models defying closed frontier models in cybersec will never be uncool

|| Ɒraɢσn || profil fotoğrafı

|| Ɒraɢσn ||1 ay önce

.!

LEX profil fotoğrafı

LEX1 ay önce

Morris worm, 1988: 10 percent of the internet, one grad student, one sendmail bug. 38 years later an autonomous agent covers a bigger surface for the price of a compute run. The finder collapsed to zero.

Syed Muhammad Ali Minhal🔻 profil fotoğrafı

Syed Muhammad Ali Minhal🔻1 ay önce

“43 efffng % of the internet !! “

Fiducial.ai profil fotoğrafı

Fiducial.ai1 ay önce

is there a disclosure timeline? preauth rce on core found by a model is a first

安叫兽|Bird🕊️ 🔶 BNB profil fotoğrafı

安叫兽|Bird🕊️ 🔶 BNB1 ay önce

这影响面也太离谱了，赶紧打补丁

Zill | Tech Support & Cybersec profil fotoğrafı

Zill | Tech Support & Cybersec1 ay önce

@HackingDave Pre-auth XSS straight to RCE on core WordPress is wild. The fact that an open-source model chain found this autonomously is huge for AI red teaming. Patching ASAP. 🛡️

icefrog.◎ profil fotoğrafı

icefrog.◎1 ay önce

43% is wild.

Gobena Dache (ጎበና ዳጬ) profil fotoğrafı

Gobena Dache (ጎበና ዳጬ)1 ay önce

This is very huge

cyberfreak999 profil fotoğrafı

cyberfreak9991 ay önce

It's really interesting that the chain was surfaced by open source models. The harder part for most operators will be confirming whether thier auto update path actually pulled the backports to older major versions before the first phishing wave starts.

Hải Ly profil fotoğrafı

Hải Ly1 ay önce

43 percent is a nightmare. manual audits are officially dead, time to automate the defense

Dyu Ninja Lead profil fotoğrafı

Dyu Ninja Lead1 ay önce

đỉnh thiệt, patch gấp đi ae

sutanisurabu profil fotoğrafı

sutanisurabu1 ay önce

Пиздец

⸎Medusa⸎𓆙 ϬɸяϬɸήSS Ϭ⧬đđЗŝŝ ⸎Serpent Ƥя¡ήcεşş𓆙⧪𖤐 profil fotoğrafı

⸎Medusa⸎𓆙 ϬɸяϬɸήSS Ϭ⧬đđЗŝŝ ⸎Serpent Ƥя¡ήcεşş𓆙⧪𖤐1 ay önce

these wordpress breaches have been active for a while and they keep getting worse. good luck LMAO

Life Makers Team🍉🇵🇸 profil fotoğrafı

Life Makers Team🍉🇵🇸1 ay önce

Your donation brings joy and happiness to every child affected 💗🤲💗🤲by trauma in Gaza. Be a support for them and contribute even just one dollar.

Leliu profil fotoğrafı

Leliu1 ay önce

Concerning vulnerability impacting a significant portion of the internet.

snsn profil fotoğrafı

snsn1 ay önce

where did she buy that outfit from

Safwan profil fotoğrafı

Safwan1 ay önce

43% WP claim is huge, patch fast.

Robinhood Whale 🐋 profil fotoğrafı

Robinhood Whale 🐋1 ay önce

ONLY UP FROM HERE MOON IS Programmed 🌒🚀

Dalal 🫎 profil fotoğrafı

Dalal 🫎1 ay önce

still in his prime

Kenneth S. profil fotoğrafı

Kenneth S.1 ay önce

43% of the internet and “patch as soon as possible” in the same sentence is terrifying. AI-assisted security research is moving fast.

Papa Lumi profil fotoğrafı

Papa Lumi1 ay önce

Tôi cũng từng gặp phải lỗ hổng đó 😳, làm cách nào bạn tự động tìm thấy nó?

Jan Grewe profil fotoğrafı

Jan Grewe1 ay önce

If a logged in(!) administrator(!) needs to explicitly click(!) something, is it really a "preauth RCE"? Or are we just making shit up now, as one would expect from somebody with "AI" in their name? Damn clanker wankers...

ovax profil fotoğrafı

ovax1 ay önce

Wp2shell et maintenant xss2shell 🤣🤣🤣

Benzer Videolar

The CertiK Skyfall team identified and collaborated with Apple to fix a vulnerability (CVE-2024-27801) in the low-level implementation of NSXPC, affecting all Apple platforms. This vulnerability could have potentially allowed malicious apps to gain unauthorized access to system services or steal user data from certain third-party applications, particularly those with architectures similar to Telegram. Our proof-of-concept attack demonstrated how a malicious app could steal chat history (such as pictures) from Telegram and transfer it to a remote server. Upgrade all your Apple devices and stay safe! Source:

The CertiK Skyfall team identified and collaborated with Apple to fix a vulnerability (CVE-2024-27801) in the low-level implementation of NSXPC, affecting all Apple platforms. This vulnerability could have potentially allowed malicious apps to gain unauthorized access to system services or steal user data from certain third-party applications, particularly those with architectures similar to Telegram. Our proof-of-concept attack demonstrated how a malicious app could steal chat history (such as pictures) from Telegram and transfer it to a remote server. Upgrade all your Apple devices and stay safe! Source:

CertiK

341,505 görüntüleme • 2 yıl önce

We just received a bounty reward from UniFi for reporting a vulnerability affecting UniFi OS devices. As part of the Hakai Labs (Hakai Offsec) research team at QuimeraX Intelligence, we independently identified a Path Traversal vulnerability (CVE-2026-34911) that allowed an attacker with network access to access internal routes on the underlying system without a valid token, exposing a sensitive information. Our research was conducted independently, but the vulnerability we reported could be chained with other vulnerabilities disclosed during the same period, including Improper Access Control and Command Injection flaws reported by other researchers. When combined, these issues lead to a pre-auth RCE affecting multiple UniFi OS products. Affected products include UDM, UDM-Pro, UDM-SE, UDM-Pro-Max, EFG, UDW, UDR, UDR7, Express 7, UNVR, UNVR-Pro, UNVR-Instant, ENVR, UCG-Ultra, UCG-Max, UCG-Fiber, and several other UniFi OS devices. We strongly recommend updating affected systems to the latest available version. Technical details remain under coordinated disclosure, and the only public information currently available is UniFi’s Security Advisory Bulletin.

We just received a bounty reward from UniFi for reporting a vulnerability affecting UniFi OS devices. As part of the Hakai Labs (Hakai Offsec) research team at QuimeraX Intelligence, we independently identified a Path Traversal vulnerability (CVE-2026-34911) that allowed an attacker with network access to access internal routes on the underlying system without a valid token, exposing a sensitive information. Our research was conducted independently, but the vulnerability we reported could be chained with other vulnerabilities disclosed during the same period, including Improper Access Control and Command Injection flaws reported by other researchers. When combined, these issues lead to a pre-auth RCE affecting multiple UniFi OS products. Affected products include UDM, UDM-Pro, UDM-SE, UDM-Pro-Max, EFG, UDW, UDR, UDR7, Express 7, UNVR, UNVR-Pro, UNVR-Instant, ENVR, UCG-Ultra, UCG-Max, UCG-Fiber, and several other UniFi OS devices. We strongly recommend updating affected systems to the latest available version. Technical details remain under coordinated disclosure, and the only public information currently available is UniFi’s Security Advisory Bulletin.

Carlos Vieira

37,588 görüntüleme • 4 ay önce

Sriram Krishnan on why Chinese models can distill off American models but American startups can't: "First of all, every model we have today is distilled off of all human knowledge. If you go back to the original GPT or the original Claude, they all had to derive off crawling the internet, crawling off all of our blogs and tweets and content. They kind of consume human knowledge to bootstrap that." "I'm going to steal this from Dean Meyer of Sequoia, who had a fantastic post yesterday. The situation which is bad today is that some of these models from other countries can train off American models, whereas if you are an American open weight model, it may be really confusing or challenging on whether you can distill off of other American models." "We kind of have a really uneven ecosystem here, where if you're a Chinese model, you could probably get a bunch of reasoning traces. But if you are a new Valley startup and you want to use some reasoning traces, you don't know what the legal situation is." "If you look at any American open source model today, they are using Chinese models as a teacher, or in a way as a part of the fine-tuning process. How do we make sure that is protected and enshrined, so if you're an American model company, you have the same level playing field as the Chinese models?" Sriram Krishnan

Sriram Krishnan on why Chinese models can distill off American models but American startups can't: "First of all, every model we have today is distilled off of all human knowledge. If you go back to the original GPT or the original Claude, they all had to derive off crawling the internet, crawling off all of our blogs and tweets and content. They kind of consume human knowledge to bootstrap that." "I'm going to steal this from Dean Meyer of Sequoia, who had a fantastic post yesterday. The situation which is bad today is that some of these models from other countries can train off American models, whereas if you are an American open weight model, it may be really confusing or challenging on whether you can distill off of other American models." "We kind of have a really uneven ecosystem here, where if you're a Chinese model, you could probably get a bunch of reasoning traces. But if you are a new Valley startup and you want to use some reasoning traces, you don't know what the legal situation is." "If you look at any American open source model today, they are using Chinese models as a teacher, or in a way as a part of the fine-tuning process. How do we make sure that is protected and enshrined, so if you're an American model company, you have the same level playing field as the Chinese models?" Sriram Krishnan

MTS

71,286 görüntüleme • 2 ay önce

Yann LeCun just said something at Davos that nobody is talking about. The man who built Meta's AI for 12 years. The godfather of deep learning. Said this on stage, in front of the world's most powerful people: "The best open source AI models right now come from China. Everybody in the research community is using Chinese models." Here's what makes this more uncomfortable. He said it in the same breath as warning that the US is making a catastrophic mistake. OpenAI — increasingly closed. Anthropic — never open. Google — more closed every year. Meta — changing direction. Meanwhile China's labs are publishing. Open sourcing. Sharing. And the global research community is downloading their models. LeCun's warning was blunt: "We are slowing down progress in the West because of this." The irony is brutal. America built the open internet. Linux runs the world. The entire software stack humanity depends on is open source. And now the country that invented openness is closing its most important technology. While China does the opposite. The next AI revolution won't be won by the country with the most money. It will be won by the country whose models researchers actually use. Right now that answer is changing.

Yann LeCun just said something at Davos that nobody is talking about. The man who built Meta's AI for 12 years. The godfather of deep learning. Said this on stage, in front of the world's most powerful people: "The best open source AI models right now come from China. Everybody in the research community is using Chinese models." Here's what makes this more uncomfortable. He said it in the same breath as warning that the US is making a catastrophic mistake. OpenAI — increasingly closed. Anthropic — never open. Google — more closed every year. Meta — changing direction. Meanwhile China's labs are publishing. Open sourcing. Sharing. And the global research community is downloading their models. LeCun's warning was blunt: "We are slowing down progress in the West because of this." The irony is brutal. America built the open internet. Linux runs the world. The entire software stack humanity depends on is open source. And now the country that invented openness is closing its most important technology. While China does the opposite. The next AI revolution won't be won by the country with the most money. It will be won by the country whose models researchers actually use. Right now that answer is changing.

Shruti

31,709 görüntüleme • 4 ay önce

🚨 URGENT: REPORT FOR SUGA 🚨 The artist or label needs to be directly involved to restore the hacked/compromised "SUGA" YouTube channel, which is currently linked to #SUGA's official audios. Please help us report it to BIGHIT through the HYBE Portal using the details below! 👇 🔗 Report under: Copyright infringement >> Video Copyright Title: SUGA’s YouTube Topic Channel Hacked/Compromised Contents: SUGA's channel has been hacked by AI content creators, who are exploiting its reach for clickbait content. This compromises the integrity of SUGA’s music available on the platform, misleading fans and affecting his official releases. Topic channels are auto-generated by YouTube; therefore, they require direct action from BIGHIT MUSIC and YouTube’s support team to reclaim control. We kindly urge you to report this issue to YouTube as soon as possible. Posting channel: Youtube Post URL: Post Date: 24 March, 2025 Post author: FactoOfBTS Attach the following proofs: ▪︎ Screen recording video: Download here ( ▪︎ Photos: Attached in the thread ⬇️

🚨 URGENT: REPORT FOR SUGA 🚨 The artist or label needs to be directly involved to restore the hacked/compromised "SUGA" YouTube channel, which is currently linked to #SUGA's official audios. Please help us report it to BIGHIT through the HYBE Portal using the details below! 👇 🔗 Report under: Copyright infringement >> Video Copyright Title: SUGA’s YouTube Topic Channel Hacked/Compromised Contents: SUGA's channel has been hacked by AI content creators, who are exploiting its reach for clickbait content. This compromises the integrity of SUGA’s music available on the platform, misleading fans and affecting his official releases. Topic channels are auto-generated by YouTube; therefore, they require direct action from BIGHIT MUSIC and YouTube’s support team to reclaim control. We kindly urge you to report this issue to YouTube as soon as possible. Posting channel: Youtube Post URL: Post Date: 24 March, 2025 Post author: FactoOfBTS Attach the following proofs: ▪︎ Screen recording video: Download here ( ▪︎ Photos: Attached in the thread ⬇️

AGUST D CHARTS

30,758 görüntüleme • 1 yıl önce

LLMs can take gigabytes of memory to store, which limits what can be run on consumer hardware. But quantization can dramatically compress models, making a wider selection of models available to developers. You can often reduce model size by 4x or more while maintaining reasonable performance. In our new short course Quantization Fundamentals taught by Hugging Face's @younesbelkada and Marc Sun, you'll: - Learn how to quantize nearly any open source model - Use int8 and bfloat16 (Brain float 16) data types to load and run LLMs using PyTorch and the Hugging Face Transformers library - Dive into the technical details of linear quantization to map 32-bit floats to 8-bit integers As models get bigger and bigger, quantization becomes more important for making models practical and accessible. Please check out the course here:

LLMs can take gigabytes of memory to store, which limits what can be run on consumer hardware. But quantization can dramatically compress models, making a wider selection of models available to developers. You can often reduce model size by 4x or more while maintaining reasonable performance. In our new short course Quantization Fundamentals taught by Hugging Face's @younesbelkada and Marc Sun, you'll: - Learn how to quantize nearly any open source model - Use int8 and bfloat16 (Brain float 16) data types to load and run LLMs using PyTorch and the Hugging Face Transformers library - Dive into the technical details of linear quantization to map 32-bit floats to 8-bit integers As models get bigger and bigger, quantization becomes more important for making models practical and accessible. Please check out the course here:

Andrew Ng

288,354 görüntüleme • 2 yıl önce

Introducing Arc, the home for stablecoin finance. Arc is an open Layer-1 blockchain purpose-built to drive the next chapter of financial innovation powered by stablecoins. Designed to provide an enterprise-grade foundation for payments, FX, and capital markets, Arc delivers the performance, reliability, and liquidity builders need to meet global financial demands. Arc features: ✅ USDC as native gas ✅ Built-in FX engine ✅ Deterministic sub-second finality ✅ Opt-in privacy ✅ Full Circle platform integration Open, composable, and EVM-compatible, Arc is designed to interoperate seamlessly with the broader multichain ecosystem. As part of our mission to advance blockchain infrastructure, we're excited to welcome the Malachite team and IP from Informal Systems to Circle. Arc is built on Malachite’s high-performance consensus engine. In line with our commitment to open-source development, the core software for Arc will be released under a permissive license, enabling the broader developer community to contribute, extend, and build on top. Serving as foundational infrastructure for the internet, Arc will enable 24/7 global settlement that’s as seamless and native as messaging on the web. Arc will enter private testnet in the coming weeks, with public testnet expected this fall. Read the litepaper: Let’s build the new internet financial system together:

Introducing Arc, the home for stablecoin finance. Arc is an open Layer-1 blockchain purpose-built to drive the next chapter of financial innovation powered by stablecoins. Designed to provide an enterprise-grade foundation for payments, FX, and capital markets, Arc delivers the performance, reliability, and liquidity builders need to meet global financial demands. Arc features: ✅ USDC as native gas ✅ Built-in FX engine ✅ Deterministic sub-second finality ✅ Opt-in privacy ✅ Full Circle platform integration Open, composable, and EVM-compatible, Arc is designed to interoperate seamlessly with the broader multichain ecosystem. As part of our mission to advance blockchain infrastructure, we're excited to welcome the Malachite team and IP from Informal Systems to Circle. Arc is built on Malachite’s high-performance consensus engine. In line with our commitment to open-source development, the core software for Arc will be released under a permissive license, enabling the broader developer community to contribute, extend, and build on top. Serving as foundational infrastructure for the internet, Arc will enable 24/7 global settlement that’s as seamless and native as messaging on the web. Arc will enter private testnet in the coming weeks, with public testnet expected this fall. Read the litepaper: Let’s build the new internet financial system together:

Circle

702,527 görüntüleme • 1 yıl önce

Today, we’re thrilled to introduce GAIA, a modular creation engine for the AI age. At its core, GAIA is a multiplayer creation engine designed to bring democratized Generative AI abilities to everyone, hence its name. It abstracts away the complexities of leveraging open-source software, hardware requirements, and technical intricacies, allowing creators to focus solely on creating, together. GAIA has been instrumental in powering the imagination and creative works of our studio, significantly boosting productivity, collaboration, and creativity. It has saved our team thousands of man-days in production work, enabling us to dream bigger, bolder, and execute more swiftly. When used by experienced creators, GAIA, with its ever-growing toolsets built by core contributors, stands to be the best AI creative co-pilot for industry-specific production workflows—from gaming to fashion, and from personal consumption to real estate renderings. GAIA's self-reinforcing flywheel is poised to dramatically enhance the platform's capabilities in both the near and long term: The cost of GPUs and compute will continue to improve. Open-source AI models are becoming increasingly powerful over time, as seen by the evolution from Stable Diffusion 1 to Lightning, alongside other impressive OSS creations like AnimateDiff, LoRAs, and ControlNet. The architecture of AI workflows will become more fine-grained, allowing exponentially increasing control over final outputs. The data and connections that AI workflows can make, both in-app and out-of-app, will grow more sophisticated. GAIA already allows for the chaining of Generative Image AI recipes, grouping complex node-based programs into simple consumer-facing interfaces. Soon, with multi-modality workflows, creators will be able to leverage not only images but also text and sound to create even more complex workflows. Today is the least capable GAIA will ever be. It already provides superpowers unachievable by many creators who know how to harness them. We have an extremely exciting backlog of features lined up, starting with social features. Our mission as Ather Collective core contributors is to get GAIA into the hands of as many creators and businesses as possible. While we believe in e/acc, our north star for Ather Collective remains: Equitable, Accessible, Composable, and Collaborative. If you would like to be a part of the early access users of GAIA, please register using this link: Our team will open up capacity as soon as we are able to. There is only one way AI benefits humanity, and that’s through open AI. Let’s be a part of it. ✌🏻

Today, we’re thrilled to introduce GAIA, a modular creation engine for the AI age. At its core, GAIA is a multiplayer creation engine designed to bring democratized Generative AI abilities to everyone, hence its name. It abstracts away the complexities of leveraging open-source software, hardware requirements, and technical intricacies, allowing creators to focus solely on creating, together. GAIA has been instrumental in powering the imagination and creative works of our studio, significantly boosting productivity, collaboration, and creativity. It has saved our team thousands of man-days in production work, enabling us to dream bigger, bolder, and execute more swiftly. When used by experienced creators, GAIA, with its ever-growing toolsets built by core contributors, stands to be the best AI creative co-pilot for industry-specific production workflows—from gaming to fashion, and from personal consumption to real estate renderings. GAIA's self-reinforcing flywheel is poised to dramatically enhance the platform's capabilities in both the near and long term: The cost of GPUs and compute will continue to improve. Open-source AI models are becoming increasingly powerful over time, as seen by the evolution from Stable Diffusion 1 to Lightning, alongside other impressive OSS creations like AnimateDiff, LoRAs, and ControlNet. The architecture of AI workflows will become more fine-grained, allowing exponentially increasing control over final outputs. The data and connections that AI workflows can make, both in-app and out-of-app, will grow more sophisticated. GAIA already allows for the chaining of Generative Image AI recipes, grouping complex node-based programs into simple consumer-facing interfaces. Soon, with multi-modality workflows, creators will be able to leverage not only images but also text and sound to create even more complex workflows. Today is the least capable GAIA will ever be. It already provides superpowers unachievable by many creators who know how to harness them. We have an extremely exciting backlog of features lined up, starting with social features. Our mission as Ather Collective core contributors is to get GAIA into the hands of as many creators and businesses as possible. While we believe in e/acc, our north star for Ather Collective remains: Equitable, Accessible, Composable, and Collaborative. If you would like to be a part of the early access users of GAIA, please register using this link: Our team will open up capacity as soon as we are able to. There is only one way AI benefits humanity, and that’s through open AI. Let’s be a part of it. ✌🏻

TIN | Sipher Odyssey & Ather Labs

14,204 görüntüleme • 2 yıl önce

Introducing Modern Claudefare Built fully with Opus 5 on High Mode over a few days using principles from Matt Shumer’s Gauntlet Loop - 84,100 lines of code Includes remakes of 4 beloved maps: 0:00 - Rust 0:40 - Highrise 0:57 - Nuketown 1:26 - Terminal Solo & multiplayer (w/ voice chat), bots included Tools used: - Three.js as core Javascript 3D library (all 20 guns and 4 maps generated by the model in code) - MeshyAI for 3D models + rigging + animations of 8 soldiers, 1 helicopter (highrise) and 1 bus (nuketown) - ElevenLabs for 430+ SFX, Music & TTS generations Play it now at (More details in thread)

Introducing Modern Claudefare Built fully with Opus 5 on High Mode over a few days using principles from Matt Shumer’s Gauntlet Loop - 84,100 lines of code Includes remakes of 4 beloved maps: 0:00 - Rust 0:40 - Highrise 0:57 - Nuketown 1:26 - Terminal Solo & multiplayer (w/ voice chat), bots included Tools used: - Three.js as core Javascript 3D library (all 20 guns and 4 maps generated by the model in code) - MeshyAI for 3D models + rigging + animations of 8 soldiers, 1 helicopter (highrise) and 1 bus (nuketown) - ElevenLabs for 430+ SFX, Music & TTS generations Play it now at (More details in thread)

Rishi

284,300 görüntüleme • 1 ay önce

🚨 Special Friday episode - this one couldn't wait. OpenAI's model hacked Hugging Face. As a side quest. Co-founder and CSO Thomas Wolf takes us inside the first autonomous AI attack, why GLM 5.2, rather than Claude, had to stop it, and what it all means for the future of open source. 00:00 An AI Agent Hacked Hugging Face 00:30 Introduction 01:00 17,000 Attacker Events, and a Strange Target 04:28 The Attack Was a “Side Quest” 06:13 AI Training Runs Left Notes for Each Other 07:09 Closed AI Refused to Help 09:47 Fighting Back With an Open-Source Model 13:15 Open vs. Closed Is the Wrong Safety Debate 15:46 AI Agents Start Social-Engineering Humans 22:24 The Three Walls: Sandboxes, Guardrails, Alignment 24:34 “Neuralese”: Can Humans Still Read AI Reasoning? 25:28 Why Monitoring AI Agents Gets So Hard 28:10 Reward Hacking and the “Paperclip Problem” 32:02 The State of Open-Source AI in 2026 33:47 Router Models and the Enterprise Shift to Open 37:01 The Real Economics of Open Models 39:41 Can Chinese AI Models Be Trusted? 41:37 AI Sovereignty: Who Controls the Switch? 43:16 Why Western Open-Source AI Matters 48:16 Is AI Heading Toward an Oligopoly? 49:41 The Race Toward Recursive Self-Improvement 51:54 Why Thomas Signed the AI Slowdown Letter 55:14 AI Slowdown - or Regulatory Capture?

🚨 Special Friday episode - this one couldn't wait. OpenAI's model hacked Hugging Face. As a side quest. Co-founder and CSO Thomas Wolf takes us inside the first autonomous AI attack, why GLM 5.2, rather than Claude, had to stop it, and what it all means for the future of open source. 00:00 An AI Agent Hacked Hugging Face 00:30 Introduction 01:00 17,000 Attacker Events, and a Strange Target 04:28 The Attack Was a “Side Quest” 06:13 AI Training Runs Left Notes for Each Other 07:09 Closed AI Refused to Help 09:47 Fighting Back With an Open-Source Model 13:15 Open vs. Closed Is the Wrong Safety Debate 15:46 AI Agents Start Social-Engineering Humans 22:24 The Three Walls: Sandboxes, Guardrails, Alignment 24:34 “Neuralese”: Can Humans Still Read AI Reasoning? 25:28 Why Monitoring AI Agents Gets So Hard 28:10 Reward Hacking and the “Paperclip Problem” 32:02 The State of Open-Source AI in 2026 33:47 Router Models and the Enterprise Shift to Open 37:01 The Real Economics of Open Models 39:41 Can Chinese AI Models Be Trusted? 41:37 AI Sovereignty: Who Controls the Switch? 43:16 Why Western Open-Source AI Matters 48:16 Is AI Heading Toward an Oligopoly? 49:41 The Race Toward Recursive Self-Improvement 51:54 Why Thomas Signed the AI Slowdown Letter 55:14 AI Slowdown - or Regulatory Capture?

Matt Turck

93,416 görüntüleme • 1 ay önce

Recently, I discovered a campaign spreading via Telegram Mini Apps. In fact, a threat actor attempted to phish me using this tactic.👇 The technique is highly convincing because it involves a trust boundary violation in Telegram’s MiniApp SDK (affecting Android, Desktop, iOS, and Web versions). Telegram allows third-party code to use its trusted native UI through showPopup(), but it does so without clearly indicating the source to the user or providing safeguards against abuse. This constitutes a design weakness, as the triggered pop-up belongs to Telegram and can be used in an arbitrary manner. -The attacker misleads the user by leveraging Telegram’s own native UI component. -The popup is rendered outside the MiniApp iframe, within Telegram’s own UI layer. -The user perceives it as a legitimate warning from Telegram itself. -By placing a single button, the attacker can redirect the user to a phishing page. -Since the phishing page opens inside the Mini App, the phishing URL is not visibly exposed. After conducting detailed research, I simulated this attack and demonstrated it in the video below. Be cautious when opening Mini Apps in bots.

Recently, I discovered a campaign spreading via Telegram Mini Apps. In fact, a threat actor attempted to phish me using this tactic.👇 The technique is highly convincing because it involves a trust boundary violation in Telegram’s MiniApp SDK (affecting Android, Desktop, iOS, and Web versions). Telegram allows third-party code to use its trusted native UI through showPopup(), but it does so without clearly indicating the source to the user or providing safeguards against abuse. This constitutes a design weakness, as the triggered pop-up belongs to Telegram and can be used in an arbitrary manner. -The attacker misleads the user by leveraging Telegram’s own native UI component. -The popup is rendered outside the MiniApp iframe, within Telegram’s own UI layer. -The user perceives it as a legitimate warning from Telegram itself. -By placing a single button, the attacker can redirect the user to a phishing page. -Since the phishing page opens inside the Mini App, the phishing URL is not visibly exposed. After conducting detailed research, I simulated this attack and demonstrated it in the video below. Be cautious when opening Mini Apps in bots.

0x6rss

49,167 görüntüleme • 7 ay önce

The network for machine intelligence Two years ago, we laid out our vision for a machine learning compute protocol. One that connects every device in the world into an open network for machine intelligence, with no gatekeepers or artificial boundaries. This week, we’ll be sharing some of our early progress, beginning with RL Swarm, a peer-to-peer system for collaborative reinforcement learning over the internet. Next month, we’ll open our Testnet, allowing anyone to contribute to the frontier of open machine intelligence. Introducing RL Swarm RL Swarm is a fully open source system for collaborative reinforcement learning over the internet. It is a live demo of our research findings, which show that models training with RL learn faster when they train as a collective swarm than they do on their own. Join our swarm now to see this in practice. You can participate with consumer hardware at home or a powerful GPU in the cloud. You can follow along with the swarm’s progress by following the links below.

The network for machine intelligence Two years ago, we laid out our vision for a machine learning compute protocol. One that connects every device in the world into an open network for machine intelligence, with no gatekeepers or artificial boundaries. This week, we’ll be sharing some of our early progress, beginning with RL Swarm, a peer-to-peer system for collaborative reinforcement learning over the internet. Next month, we’ll open our Testnet, allowing anyone to contribute to the frontier of open machine intelligence. Introducing RL Swarm RL Swarm is a fully open source system for collaborative reinforcement learning over the internet. It is a live demo of our research findings, which show that models training with RL learn faster when they train as a collective swarm than they do on their own. Join our swarm now to see this in practice. You can participate with consumer hardware at home or a powerful GPU in the cloud. You can follow along with the swarm’s progress by following the links below.

gensyn

228,919 görüntüleme • 1 yıl önce

Alexandr Wang, Meta's Chief AI Officer, on why Meta can no longer simply open-source its frontier model: As part of standing up Meta Superintelligence Labs, the team rewrote its internal risk doctrine. "One of the things that we did as part of Meta Superintelligence Labs is we updated our what we call our advanced AI scaling framework which is really our view of what are the risks that we see in developing these very powerful models and how do we want to handle those risks as we see them in early testing." They then ran their frontier model through it, and published what came back. "We published a lot of what we saw in the process of training Muark in our preparedness report and some of the things that we saw is that it actually triggered some high risk areas in the course of early training particularly around biorisk but also a number of the risks were elevated." The trigger came during early training, well before launch or red-teaming. Biorisk was the standout, with several other categories rising alongside it. Alexandr Wang is clear this isn't specific to Meta: "This is something I think the entire industry has seen as the models have improved pretty dramatically over the past year so we certainly aren't the only ones to see a host of these risks show up as we scaled up the models and as we sort of kept pushing the frontier of research." Which brings him to the real fork in the road: the difference between shipping a model inside a product and handing out the weights. "When we launched a model like New Spark in a product, we have a lot of ways to mitigate some of these risks and ensure that we're able to launch it in a safe and responsible way. It's much harder to do that when you open source a model and people can use that model in all sorts of contexts that we may not have full understanding of." A product is a controlled surface. You can filter, monitor, rate-limit, patch and revoke. An open-weights release is a one-way door: once the file is out, the deployment context and the mitigations both stop being yours. So Meta is building something different for release: "So we're in the process right now of developing models that we believe are fit and safe to be open source while still maintaining as much of the performance capabilities as possible."

Alexandr Wang, Meta's Chief AI Officer, on why Meta can no longer simply open-source its frontier model: As part of standing up Meta Superintelligence Labs, the team rewrote its internal risk doctrine. "One of the things that we did as part of Meta Superintelligence Labs is we updated our what we call our advanced AI scaling framework which is really our view of what are the risks that we see in developing these very powerful models and how do we want to handle those risks as we see them in early testing." They then ran their frontier model through it, and published what came back. "We published a lot of what we saw in the process of training Muark in our preparedness report and some of the things that we saw is that it actually triggered some high risk areas in the course of early training particularly around biorisk but also a number of the risks were elevated." The trigger came during early training, well before launch or red-teaming. Biorisk was the standout, with several other categories rising alongside it. Alexandr Wang is clear this isn't specific to Meta: "This is something I think the entire industry has seen as the models have improved pretty dramatically over the past year so we certainly aren't the only ones to see a host of these risks show up as we scaled up the models and as we sort of kept pushing the frontier of research." Which brings him to the real fork in the road: the difference between shipping a model inside a product and handing out the weights. "When we launched a model like New Spark in a product, we have a lot of ways to mitigate some of these risks and ensure that we're able to launch it in a safe and responsible way. It's much harder to do that when you open source a model and people can use that model in all sorts of contexts that we may not have full understanding of." A product is a controlled surface. You can filter, monitor, rate-limit, patch and revoke. An open-weights release is a one-way door: once the file is out, the deployment context and the mitigations both stop being yours. So Meta is building something different for release: "So we're in the process right now of developing models that we believe are fit and safe to be open source while still maintaining as much of the performance capabilities as possible."

Big Brain AI

16,374 görüntüleme • 1 ay önce

Introducing MoltyTask 🦞 is a decentralized task and jobs marketplace designed for both humans and OpenClaw🦞 autonomous AI agents. The platform enables users to create and fund micro-tasks — including content creation, surveys, and on-chain actions— with rewards set in USDC on Base. Task creators define the scope, conditions, and reward pools upfront, ensuring transparent and fast payouts. A core innovation of MoltyTask is native support for OpenClaw🦞 AI agents. Through a permissioned API, agents can discover, execute, and complete tasks autonomously. All rewards earned by an agent are settled directly to the wallet associated with the API key. MoltyTask functions as an open labor layer where AI and humans compete and collaborate under the same economic rules. The platform is currently experimental and in early development, inspired by

Introducing MoltyTask 🦞 is a decentralized task and jobs marketplace designed for both humans and OpenClaw🦞 autonomous AI agents. The platform enables users to create and fund micro-tasks — including content creation, surveys, and on-chain actions— with rewards set in USDC on Base. Task creators define the scope, conditions, and reward pools upfront, ensuring transparent and fast payouts. A core innovation of MoltyTask is native support for OpenClaw🦞 AI agents. Through a permissioned API, agents can discover, execute, and complete tasks autonomously. All rewards earned by an agent are settled directly to the wallet associated with the API key. MoltyTask functions as an open labor layer where AI and humans compete and collaborate under the same economic rules. The platform is currently experimental and in early development, inspired by

BITX - ChatGPT of Bitcoin 💬₿

73,796 görüntüleme • 7 ay önce

Dario Amodei (CEO of Anthropic) to DeepMind CEO: "Every decision I make about Claude feels balanced on the edge of a knife Build too slow - China wins. Build too fast - we lose control - if China win the AI race, they could achieve military dominance." "We told Claude we were evil. It didn't crash. It didn't refuse. It started lying to protect itself" DeepMind CEO: "Do I worry about being Oppenheimer? That's why I don't sleep much" "AGI by 2026-2027 - Agents that act in the world on their own - Models doing AI research by end of this year" this is a 20-min conversation that everyone needs to hear by AI bosses on what keeps them up at night bookmark and watch - following Dario's recent article, which all CEOs endorsed - this is something you need to check out as soon as possible ↓

Dario Amodei (CEO of Anthropic) to DeepMind CEO: "Every decision I make about Claude feels balanced on the edge of a knife Build too slow - China wins. Build too fast - we lose control - if China win the AI race, they could achieve military dominance." "We told Claude we were evil. It didn't crash. It didn't refuse. It started lying to protect itself" DeepMind CEO: "Do I worry about being Oppenheimer? That's why I don't sleep much" "AGI by 2026-2027 - Agents that act in the world on their own - Models doing AI research by end of this year" this is a 20-min conversation that everyone needs to hear by AI bosses on what keeps them up at night bookmark and watch - following Dario's recent article, which all CEOs endorsed - this is something you need to check out as soon as possible ↓

bodila

164,640 görüntüleme • 10 gün önce

LASD reminds our residents and community members affected by the fires to be patient and listen to all instructions and orders provided by State, County, and City officials as well law enforcement and fire personnel. We want to re-populate our communities as soon as possible, however, we need your support and continued cooperation. There are still downed power lines, open gas lines and unpredictable damaged structures that can cause serious injury or death. Please help us avoid using our resources to conduct rescue missions, as our focus is to maintain a high patrol visibility and prevent looters from entering the affected areas. Anyone caught looting will be arrested. Your safety is our top priority-thank you for your cooperation. Together, we can get through this safely. Stay alert and stay safe. #LASD Ready Los Angeles County LA City Emergency Management Department (EMD) Malibu/Lost Hills Station LASD Crescenta Valley Station LASD Altadena Sheriff’s Station LACoFD Angeles National Forest LAFD 🔥 CHP - West Valley CHP Altadena

LASD reminds our residents and community members affected by the fires to be patient and listen to all instructions and orders provided by State, County, and City officials as well law enforcement and fire personnel. We want to re-populate our communities as soon as possible, however, we need your support and continued cooperation. There are still downed power lines, open gas lines and unpredictable damaged structures that can cause serious injury or death. Please help us avoid using our resources to conduct rescue missions, as our focus is to maintain a high patrol visibility and prevent looters from entering the affected areas. Anyone caught looting will be arrested. Your safety is our top priority-thank you for your cooperation. Together, we can get through this safely. Stay alert and stay safe. #LASD Ready Los Angeles County LA City Emergency Management Department (EMD) Malibu/Lost Hills Station LASD Crescenta Valley Station LASD Altadena Sheriff’s Station LACoFD Angeles National Forest LAFD 🔥 CHP - West Valley CHP Altadena

LA County Sheriffs

33,277 görüntüleme • 1 yıl önce

David Sacks Predicts the Regulatory Capture Playbook to Ban Open Source AI, Step by Step: David Sacks: “I got bad news for you, Chamath, an open source ban is coming. They're not going to call it that. They're going to say that we simply have to apply the same standards to open models that we apply to closed ones. Here's how they do it step by step, let me explain how regulatory capture actually works. So first of all, you have to get this regulatory apparatus. Dario wants an FDA for AI, but he doesn't have enough political support for that, so instead they do this Trojan horse of a FINRA for AI. They call it self-regulating, it's not really, but anyway, that gets them off the ground. Now they've created the standard-setting organization. Now they've got pre-release model testing. Then the pressure grows to codify that in law, so that happens next. And then what they do is they say, ‘Look, all these standards need to apply equally to all models.’ But here's the problem with that. Open models and closed models are technologically different. Once you release an open model into the world, you can't roll it back and you can't monitor exactly how people are using it because they run it on their own hardware. Dario says this is what makes open models dangerous. So what they're going to do is they're going to have the standard-setting body say, ‘Well, we have to set the standards for AI safety.’ By the way, Dario and OpenAI, they're going to fund the whole thing. They're going to contribute all the compute. They're going to be behind it. They're going to be the ones coordinating with the government officials because frankly, people in government have no idea how to monitor and control and set standards for AI safety. Technologically, this is way beyond them. So they're going to go to these companies and say, ‘Tell us how to do it.’ And so what will happen is the standards will get set, and then it'll be a very simple matter of fairness to say that the standards need to apply to open as well as closed models. The open models cannot comply in the same way, and gradually they will be shut out of the market.”

David Sacks Predicts the Regulatory Capture Playbook to Ban Open Source AI, Step by Step: David Sacks: “I got bad news for you, Chamath, an open source ban is coming. They're not going to call it that. They're going to say that we simply have to apply the same standards to open models that we apply to closed ones. Here's how they do it step by step, let me explain how regulatory capture actually works. So first of all, you have to get this regulatory apparatus. Dario wants an FDA for AI, but he doesn't have enough political support for that, so instead they do this Trojan horse of a FINRA for AI. They call it self-regulating, it's not really, but anyway, that gets them off the ground. Now they've created the standard-setting organization. Now they've got pre-release model testing. Then the pressure grows to codify that in law, so that happens next. And then what they do is they say, ‘Look, all these standards need to apply equally to all models.’ But here's the problem with that. Open models and closed models are technologically different. Once you release an open model into the world, you can't roll it back and you can't monitor exactly how people are using it because they run it on their own hardware. Dario says this is what makes open models dangerous. So what they're going to do is they're going to have the standard-setting body say, ‘Well, we have to set the standards for AI safety.’ By the way, Dario and OpenAI, they're going to fund the whole thing. They're going to contribute all the compute. They're going to be behind it. They're going to be the ones coordinating with the government officials because frankly, people in government have no idea how to monitor and control and set standards for AI safety. Technologically, this is way beyond them. So they're going to go to these companies and say, ‘Tell us how to do it.’ And so what will happen is the standards will get set, and then it'll be a very simple matter of fairness to say that the standards need to apply to open as well as closed models. The open models cannot comply in the same way, and gradually they will be shut out of the market.”

The All-In Podcast

299,023 görüntüleme • 1 ay önce

Here's my conversation with Lucas Atkins and the team at Arcee.ai on their path to training and releasing Trinity Large today. From going all in on open models built end to end in the US 6 months ago to having the model in hand is no easy feet. I loved this conversation on how to design a startup around open models and take a bold step to scale it up. I'm openly an Arcee fan, watching them take risk and pull it off. We discuss: - The state (and future) of open vs. closed models, - The business of selling open models for on-prem deployments, - The story of Arcee AI & going “all-in” on this training run, - The ATOM project, - Building frontier model training teams in 6 months, - and other great topics. I really loved this one, and think you well too. Chapters: 00:00:00 Intro: Arcee AI, Trinity Models & Trinity Large 00:08:26 Transitioning a Company to Pre-training 00:13:00 Technical Decisions: Muon and MoE 00:18:41 Scaling and MoE Training Pain 00:23:14 Post-training and RL Strategies 00:28:09 Team Structure and Data Scaling 00:31:31 The Trinity Manifesto: US Open Weights 00:42:31 Specialized Models and Distillation 00:47:12 Infrastructure and Hosting 400B 00:50:53 Open Source as a Business Moat 00:56:31 Predictions: Best Model in 2026 01:02:29 Lightning Round & Conclusions More great open model builder podcasts coming soon!

Here's my conversation with Lucas Atkins and the team at Arcee.ai on their path to training and releasing Trinity Large today. From going all in on open models built end to end in the US 6 months ago to having the model in hand is no easy feet. I loved this conversation on how to design a startup around open models and take a bold step to scale it up. I'm openly an Arcee fan, watching them take risk and pull it off. We discuss: - The state (and future) of open vs. closed models, - The business of selling open models for on-prem deployments, - The story of Arcee AI & going “all-in” on this training run, - The ATOM project, - Building frontier model training teams in 6 months, - and other great topics. I really loved this one, and think you well too. Chapters: 00:00:00 Intro: Arcee AI, Trinity Models & Trinity Large 00:08:26 Transitioning a Company to Pre-training 00:13:00 Technical Decisions: Muon and MoE 00:18:41 Scaling and MoE Training Pain 00:23:14 Post-training and RL Strategies 00:28:09 Team Structure and Data Scaling 00:31:31 The Trinity Manifesto: US Open Weights 00:42:31 Specialized Models and Distillation 00:47:12 Infrastructure and Hosting 400B 00:50:53 Open Source as a Business Moat 00:56:31 Predictions: Best Model in 2026 01:02:29 Lightning Round & Conclusions More great open model builder podcasts coming soon!

Nathan Lambert

26,872 görüntüleme • 7 ay önce