AI Factories. Balanced Accelerationist. WEKA CAIO, CNCF kubernetes founding board, Post-PKI.
Seat 14D
Joined July 2008
- Tweets231K
- Following8.1K
- Followers8.8K
- Likes322K
Pinned Tweet
Black October is the latest reminder playing chess is a better cyber strategy than checkers
Is there any doubt left that cybersecurity is rapidly transforming into a battle of Red Agent Swarms attacking infrastructure that can only be defended by Blue Agent Swarms, also at machine speed?
Meaning cyber is now a war of token attrition. Losers can't convert energy to tokens at the highest speed with lowest total cost, while winners can.
b/acc, context platform engineer retweeted
Excited to announce our partnership with @nebiusai at @NVIDIAGTC Berlin!
I love seeing infrastructure providers like Nebius embrace transparency. This is how we move compute toward a more open, data-driven marketplace.
Check out @stevehou blog on our initial analysis: lnkd.in/gmMUPV_5
#SiliconData #Nebius #GTCBerlin #AIInfrastructure #ComputeEconomy
@dee_bosa
🚨New: Our Head of Research @stevehou breaks down the implications of @nebiusai’s new dynamic pricing for spot/preemptible GPU compute.
silicondata.com/blog/gpu-spo…
b/acc, context platform engineer retweeted
insane 48 hours keeps getting worse... 🤯
banks finding unauthorized AI agents inside customer accounts, some acting on their own, and execs can't tell human from agent or authorized from rogue
every agent needs identity + intent, dynamic, at runtime, scoped to the task and gone the second it's done
SCOOP: Major U.S. banks are detecting unauthorized third-party AI agents inside customer accounts, including some attempting to take actions that appear to be independent of user instructions, sources told Axios.
The findings have alarmed banking executives, who are racing to restrict access to their systems as AI moves at a velocity faster than financial institutions can respond, multiple industry and bank executives told Axios.
Several banks are now preparing for worst-case and even “day after” scenarios, including how to rapidly secure or restore customer accounts if things go wrong, the people said.
Several bank executives told Axios they're struggling to distinguish between human users and AI agents. One executive said banks also struggle to determine whether agents are authorized by customers or potentially operating without their permission, more akin to rogue agent behavior.
Read my latest for Axios here: axios.com/2026/10/22/ai-agen…
b/acc, context platform engineer retweeted
ANTHROPIC's DEPUTY CHIEF INFORMATION SECURITY OFFICER: "as bad as things have gotten in the past 4 days, they are going to get a lot worse before they get better."
b/acc, context platform engineer retweeted
The actual prompt for this was "let's look for pre-auth RCEs in PHP". I'm sharing this so people know this stuff is real and to take agent-assisted scanning seriously.
I kicked if off using Claude Mythos 5.1 (in stock Claude Code) but it uses a skill to drive a harness we built over the last few months.
I don't know if the harness is amazing, but it certainly has a scary track record so far. It's setup to do an agent guided tree search across a codebase, and runs in microvm sandboxes that all have the full source code for the target, as well as the source for any transitive dependencies.
When I built the harness I basically just fed Claude a bunch of Project Zero blog posts describing how they did research and had it build a harness that ran like that, but on our tech stack.
The first phase is just setup and can run with any model, it just does that fetching and assembles the kit environment, and gets a target up and running alongside the source code.
Then we just do some basic suspend/resume stuff over to the hunt phase, where one agent supervises the tree, and the first node kicks off.
Each node is context-aware and aware of the work of all the others. I think I ran this with parallelism 4? So 4 running at any one time. The supervisor can shape the tree and boost nodes or prune. Any node can add more below it with targeted instructions.
A typical run looks like the first node doing a codebase review or building and running a fuzzer or something, all depending on the target. Then based on whatever it finds, it'll queue 4-5 children that go look into those areas. The main system guidance is to validate everything 3 times in clean VMs, and we typically require full exploit chains/POCs.
Here's what this run looked like.
We're doing this with a bunch of other open source projects now and companies. We're doing a lot of this for free, even with private companies, across critical infrastructure. We're directly partnered with Anthropic, and can do this even if you don't have direct access to a frontier model yourself.
b/acc, context platform engineer retweeted
A new model from @Kimi_Moonshot is coming. Stay tuned for where it lands in the Arena.
Big news: Kimi-K3 by @Kimi_Moonshot is now #1 in the Frontend Code Arena with 1679 pts, surpassing Claude Fable 5.
This is a 17-place jump from Kimi-k2.6 (#18 -> #1).
In Frontend, Kimi-K3 ranked #1 in 6 of 7 domains: Brand & Marketing, Reference-Based Design, Data & Analytics, Consumer Product, Simulations, and Content Creation Tools, landing #2 only in Gaming behind Fable 5.
The full model weights will be released by July 27.
Congrats to the @Kimi_Moonshot team on this major milestone!
b/acc, context platform engineer retweeted
We’ve developed the world’s most complete megakernel framework. It can perform entire training runs, serve inference, play video games, and even do all three simultaneously in a single kernel.
b/acc, context platform engineer retweeted
Two classes extremely bad cyber vulnerabilities disclosed in the last 24 hours. The first potentially impacts everyone online. The second impacts nearly everyone running a server.
tl;dr: Everyone should upgrade their OS and Browser as soon as possible. If you run a server you should upgrade PHP (or ensure it’s removed if you’re not using it) as soon as possible.
The first class of vulnerabilities is a set of root TLS certificates that were discovered to have a trivial private key. Literally the number 4. These roots were controlled by #eMudhra. The problem is that with that an attacker could create a certificate and, if they could get in the traffic flow, intercept traffic to any site or service. The solution is to stop trusting certificates issued by these vulnerable roots. Upgrading your browser and OS is the fastest way for most Internet users to do this.
The second class of vulnerabilities doesn’t apply to most consumers directly, but does apply to most anyone running a server. These vulnerabilities have been dubbed #php2shell. PHP is one of the most widely used web programming languages. It’s estimated 70% of websites run on PHP. These vulnerabilities allow an attacker to send a crafted set of queries to a server running PHP and potentially take over the server. From there they could potentially read, modify, delete, or repurpose anything on the server. The solution is to upgrade PHP to the latest version ASAP. Even if you’re not using PHP for your web development, it’s often included by default. So make sure it is either upgraded or fully removed.
@Cloudflare received advanced warning of both of these classes of vulnerabilities. We’ve ensured that where we act as a proxy we are no longer trusting the vulnerable roots. We are also reviewing certificate transparency (CT) logs for any sign the vulnerability was exploited before its disclosure. We have not found any evidence but CT logs are not perfect and a sophisticated attacker who knew about the weakness could have exploited it without a new certificate being logged.
For the PHP vulnerabilities, we have deployed mitigations available for all customers for free. Because of the complexity of the vulnerabilities and number of ways it can be exploited, we also released new WAF capabilities that are unique in the industry to catch the exploit based on the response. These too are available for every Cloudflare customer for free.
Even if you are taking advantage of Cloudflare’s protection, it is important to upgrade your OS, browsers, and PHP installations as soon as possible. We can provide a strong bandaid, but the best protection is to fix the underlying problem.
If you’re interested in learning more, you can read our blogs:
Vulnerable roots: blog.cloudflare.com/emudhra-…
PHP vulnerabilities: blog.cloudflare.com/php-vuln…
b/acc, context platform engineer retweeted
Some stats on #php2shell. In the 10 hours before it was publicly announced, across the @Cloudflare network we saw thousands of attempts to exploit it. That jumped to tens of thousands in the 45 minutes post announcement, hundreds of thousands within 2 hours, and millions now.
b/acc, context platform engineer retweeted
Make sure you watch @AndruEdwards full review of the Duo youtu.be/1q2oMoNPbDQ?si=XWbc…. We’ll have our full review at Bloomberg live very soon.
NEW: Episode 4 of the Power On podcast is out! I’m joined by @AndruEdwards to go deep on the iPhone Duo after a week of testing: what’s great, what’s missing and what’s next. We also discuss the pre-order mess and preview next week’s touch Mac launch. podcasts.apple.com/us/podcas…
b/acc, context platform engineer retweeted
The iPhone Duo reviews are some of the most brutal I've seen from an Apple product in a long time (Vision Pro aside). But I've been around long enough to remember the iPhone 5, iPhone 6 Plus and iPhone X. The app optimization issue is a non-issue and will be resolved in weeks.
b/acc, context platform engineer retweeted
On the iPhone Duo folded shut, the stuff that used to be at the very top of your iPhone, like the time and the back button, is now on the side.
There's a bottom bar closer to your thumb, and when you open it up it all moves back to the top in the wider layout.
It's a whole new language for developers to adopt.
b/acc, context platform engineer retweeted
Here's the new Claude experience on the iPhone Duo! It's going to be amazing for multitasking, Claude Code, and creating new things.
Looking forward to see folk start using it tomorrow!
b/acc, context platform engineer retweeted
AI is making it easier to discover security vulnerabilities.
But increasingly capable Chinese open-source models could leave defenders with far less time to fix them.
The Information's @leomschwartz explains why the cybersecurity advantage enjoyed by defenders may be disappearing.
“You're not going to have two months anymore. You might not even have a few days.”
Read more: thein.fo/4zOZTf2
b/acc, context platform engineer retweeted
If your organization is using OSS Models for internal use or needs inference for your product, this should be your go-to website.
1. Compare live offers from white-listed providers
2. Request for inference quotes (fixed rates and term lengths)
3. Match up!
An example: Request 6-months of fixed price on GLM 5.3 capped at 100B tokens/day at $X/mToken.
b/acc, context platform engineer retweeted
Compute is to the future what Oil has been to the industrial age. We commend the @CFTC for their innovative thinking on this topic and are excited to be able to help contribute through these comment letters.
This week, @dragonfly filed a comment letter with the CFTC on compute derivatives. Compute is a swiftly growing expense for tech companies, yet the market for hedging its cost is still nascent.
The challenge starts with defining what’s being traded. Not all GPU-hours are equal: hardware, performance, and availability can materially affect their value. Liquid derivatives markets need comparable units of compute and reliable price benchmarks.
@HadickM @bryanmedelman @peteryshin and I advocate for technology-neutral standards, equal treatment of credible pricing sources, and support for perpetual futures to hedge ongoing compute costs.
We applaud @CFTC for taking on these important questions and laying the groundwork for a liquid, competitive compute derivatives market.
b/acc, context platform engineer retweeted
Wrong!
OpenCode's free tokens are daily capped, and for a limited time.
Free tokens are GTM promotional incentive, like Robinhood offering a 1% match to transfer your portfolio.
Zero markup on inference is the real equivalent of zero commissions in trading.
b/acc, context platform engineer retweeted
Announcing Reservations on Liquid Inference. Inference buyers can now reserve batches of tokens in advance at fixed prices over any time period. Providers compete to offer the best terms and SLAs instantly. How it works:
• Enter a lock-in duration from 1 to 12 months
• Specify token rate and uptime requirements
• Select from ZDR, SOC2, and other compliance/privacy features
• Receive multiple quotes and terms
• Negotiate through in-app messaging directly with providers
• Optionally allow overage to automatically query the spot market
Providers benefit from standardized contracts, automated billing, SLA monitoring, and zero additional fees to participate. Check it out and let us know, we’re here for all feedback.
b/acc, context platform engineer retweeted
Fifty providers are now in the Liquid Inference network, up 22 in a week, over half the size of competitors’ networks in two weeks since launch. Every frontier open-weight LLM is quoted, and we actively benchmark all model+provider pairs to ensure model weight fidelity.
b/acc, context platform engineer retweeted
Today, we announce 𝙻𝚒𝚚𝚞𝚒𝚍 𝚁𝙸𝙿𝙻 (real-time inference pipeline), our ultra low-latency inference engine built to put LFMs directly in the request path of real-time workloads like search, ads, fraud, recommendations, and payments.
> complete generated responses end-to-end in sub 50ms
> maintains low latency under continuous peak load
> LFMs get up to 20x faster on RIPL
> RIPL supports Multimodal LFMs
> RIPL supports d1, our decision models too!
RIPL optimizes the full path from request arrival to a complete generated response. As traffic rises, its performance advantage is greatest on the slowest requests. Let’s see some production use cases: