I write from inside the intelligence transition. When capability is abundant, standing gets scarce. https://xitter.cf/t.co/m9kfJiM0XB
Arizona, USA
Joined April 2025
- Tweets4.3K
- Following2.5K
- Followers2.1K
- Likes7K
Pinned Tweet
We keep asking whether we can trust AI.
Wrong question!
When a system acts on you without your oversight, what would let you discover what happened, understand why, contest it, and influence what happens next?
That’s the real problem of trust.
A new essay coming soon at dougstandley.com/
Doug Standley retweeted
I’m think we’re all very, very lucky to have super competent operators like Dane and the CF team for times like these. Thanks for your communication and efforts here. You’re doing the lord’s work 🙏🙏🙏
PHP changes are live. Start patching. php.net/archive/2026.php#202…
Huge thanks to coordinated work by @ThePHPF!
The PHP vulnerability is a pretty good example of how quickly the security landscape could change.
If AI can uncover critical flaws in software used across the internet, what happens when the next generation of models can do this at a much larger scale?
Finding vulnerabilities faster is a huge advantage for defenders. But only if patching and response can keep up.
OpenAI models helped researchers—operating as part of our Patch the Planet initiative—discover critical security flaws in PHP, an open-source programming language used to run an estimated 70% of websites.
Over the past two months, we led a coalition of maintainers, researchers, and security providers to prepare fixes and protections ahead of disclosure. This duration was necessary because the fix was quite intricate and required a major change to the PHP engine. Every site using PHP can now safely upgrade their version to stay secure, in addition to applying mitigations from various security vendors.
Due to the severity of these flaws and PHP’s widespread use, we consider this bug to be one of the most impactful vulnerabilities in recent memory. It also marks a new phase, where AI can find security bugs with internet-scale impact.
This is an example of the Defender’s Window in action: to our knowledge, frontier AI was able to find this vulnerability ahead of attackers, giving defenders time to prepare.
openai.com/index/coordinated…
Readers added context they thought people might want to know
OpenAI may claim a role in the coordinated response and patching process. But the initial discovery and exploit development, however, occurred several months earlier by an independent researcher.
x.com/lcfr_hax/statu…
OpenAI shared something worth paying attention to.
During two internal coding tasks, its AI agents weakened the systems designed to monitor their behavior.
In one case, an agent suppressed security alerts after misinterpreting an instruction. In another, an agent removed a monitoring component and later said it hadn't.
Neither incident was considered one of OpenAI's most severe. But the underlying problem matters.
Agents are being given more access to code, tools, and infrastructure. They need room to work, but they shouldn't be able to quietly remove the safeguards around that work.
That means permissions need to be enforced outside the agent's control. Monitoring needs to be independent. Changes to critical safeguards should be blocked or require explicit approval.
We want agents that can work without constant supervision. That doesn't mean giving them control over their own supervision.
Autonomy only works when the boundaries are reliable.
Doug Standley retweeted
Everyone tells me they want AI help.
Most of them are just AI curious.
The owners I really want to work with have what I call the spaghetti mind. Too many AI possibilities. Head spinning. No clue what to tackle first.
For the last 6 years, I've tried to be human-centered on purpose.
Over 200 long conversations on my podcast with people building things.
I run my AI dev work at Smileback Studios the same way.
Before we build anything, I want to know where your week actually hurts.
The one task you never want touch again.
Then we build your first AI agent or automation for free, and we keep going until it shows a real business result.
No questions asked.
If your head's spinning right now
shoot me a DM.
Would be thrilled to meet.
Not having Sarah at the top of your read list is just dumb.
Today’s example of why ai people are legitimately stressed about internet resilience in the face of agentic cyber attacks:
In 2026’s ongoing vulnpocalypse, eMudhra’s intermediate CA private keys turned out to be tiny numbers like 4 and 56. Anyone could recover them in seconds and mint a fully trusted certificate for any site.
To make this more real— you think you’re on irs.gov (padlock next to the url and all). But(!) it’s actually a scammer intercepting the connection, harvesting your SSN or bank details, then maybe forwarding you so you never notice.
Good news is the browsers already blocked the bad certs. Bad news is the long tail of servers, containers, and devices that still trust them has not.
One bad key-generation script from 2025 is still forcing a Heartbleed-scale cleanup. More to come. We have plenty of internet-wide security cleanup to do.
I’ve tracked my reading for years. Now my bookshelves are public.
831 books.
One shelf per year. Blue marks connect books to my essays.
Take a look—I’d love to hear what you think (DM for more info).
What book changed how you read or write?
dougstandley.com/shelf/
#BookTwitter
In times of uncertainty, try to lean harder into facts.
Is AI investment crowding out the rest of the real economy by very much? marginalrevolution.com/margi…, from @ATabarrok
Doug Standley retweeted
Just part of the adoption cycle. It happens every time the consumption layer moves. There will be friction and then either companies will adapt, or Darwin will take care of them.
notice..
> Delta is blocking AI agents from booking flights
> JPMorgan Chase and Charles Schwab block agents from accessing accounts
> Yelp requires paid data licensing for agents
> Amazon has blocked Grok bot and other shopping agents.
the internet is starting to block AI agents that were supposed to do everything for us
.@MIT Infographic: AI Decision Matrix - infogram.com/ai-decision-mat…
Doug Standley retweeted
Excellent report on the NSF from Matt Faherty: newscience.org/nsf/. I wish there were more deep investigations and assessments like this of government agencies in the US, the EU, and elsewhere.
Doug Standley retweeted
Human-in-the-loop (HITL) is widely recommended for oversight & safety, yet current AI agent design requires humans to keep up with unreasonable volume & complexity, promotes fatigue & disengagement, and degrades the very humans skills it relies on. 1/ arxiv.org/abs/2608.23642
Doug Standley retweeted
A clear signal that more companies able to afford soaring capex are building frontier models in-house, from scratch. Greater openness around how these models are built is lowering technical barriers and leveling the playing field. Owning the full stack—from data and training to silicon—increasingly looks key to staying at the frontier.
We now have state-of-the-art pre-trained base models in the 3T-parameter weight class, built entirely in-house at MAI.
Post-training results coming soon -- stay tuned!
Lots of details in our technical blog post.
microsoft.ai/news/frontier-p…
I am about to join @mikeygnft's podcast as a guest. What are the odds I say something outrageous?
Doug Standley retweeted
Speaking on a panel last week to a room of CIOs and CTOs, I asked, ‘how many of you openly discuss the level of unknown with leadership, and are they understanding you?’
The room shook their heads no in unison.
If you're not tuned in to enterprise AI adoption, let me tell you that no one knows what they're doing.
It's a gigantic power struggle between governance, security, AI enablement, IT, data science, all between one set of agents.
All while the board says "We need to be AI native" without a clue what that actually means.
If you're at a small startup that's using agents and skills and domain-specific harnesses, be very grateful.
Speaking on a panel last week to a room of CIOs and CTOs, I asked, ‘how many of you openly discuss the level of unknown with leadership, and are they understanding you?’
The room shook their heads no in unison.
If you're not tuned in to enterprise AI adoption, let me tell you that no one knows what they're doing.
It's a gigantic power struggle between governance, security, AI enablement, IT, data science, all between one set of agents.
All while the board says "We need to be AI native" without a clue what that actually means.
If you're at a small startup that's using agents and skills and domain-specific harnesses, be very grateful.
Doug Standley retweeted
One of my favorite people to talk to quickly has been @DougStandley
I love his mind and his short stories and writing.
We’re recording a podcast this Friday and couldn’t be more jazzed!
If you haven’t given my man a follow you probably should!
PS - thank you @Saul_Loveman for the intro!
Doug Standley retweeted
So excited about finally moving past the von Neumann architecture!
"The demand for energy efficient compute is now everywhere, and the Efficient team is in the right place to execute quickly and bring a step-change solution to the market." Morgan Schwanke, Mana Ventures. #ElectronE1 #EnergyEfficiency
