Saw a few viral posts calling Qwen 3.5 4B a Chinese Trojan horse because swapping two neurons can turn it into a “weapon.” It's steering; you are reaching into the activations yourself while the model runs. You could do the same thing to Llama or Gemma, because safety training is a thin layer, and a few directions in activation space can undo it. If I cut my own brake lines, Chevrolet didn’t run an intelligence op. That's on me. Backdoors are the real threat, and they’re scarier because they hide. Anthropic’s Sleeper Agents paper detailed out how researchers trained a model to write insecure code whenever it saw a trigger. Then they ran standard safety training on it. The backdoor survived, and adversarial training just taught the model to hide it better. A 2025 follow-up found that about 250 poisoned documents were enough to plant a trigger, and that number barely changed with model size. Now put that model in an agent harness and give it a shell. The model only writes text, and the harness parses that text and runs it. The model is the mouth, and the harness becomes the hands. The hands don’t care whether the rm -rf came from an attacker or from the model being confidently wrong. The lesson is that agent security lives in the harness. You can’t verify intent, so put the limits in the harness: keep secrets out of the env, use short-lived scoped tokens, set an outbound allowlist, require human approval for anything irreversible, and log every tool call. The log is the record. The model’s story about what it did is nothing more than fan fiction.

Your AI app says it’s private. Your model routing might disagree. On NEAR AI, TEE models run in an attested enclave where nobody, NEAR included, sees your prompts. Proxied models strip your identity, but the provider can still read whatever you send. Same API key, very different privacy. Here’s how to tell them apart: youtu.be/49lX4MTUSIQ

We are in a wild time for building software, so I thought it would be helpful to lay out my rules for building in the age of AI.

just realized this is also a great blueprint and case study for teams that are participating the NEAR hackathon 🫡 please use function call key, it’s great tech

I'm working on a new video answering questions about privacy and AI in products and general use. I have scrapped some common questions, but if you have ones you want answered, ask below 👇

Intear API is live in Beta! Try out the everything-API and build a realtime app with no infrastructure to maintain.

More than 1,000,000 NEAR is now staked with NEAR AI. Stake yours to pay for your AI. The NEAR stays yours 👇

NEAR HACKATHON is now live with $250K+ in prizes. No signup. Just ship a public repo + public demo post between November 1st & Nov 14, 23:59 UTC. Build on NEAR Intents, chain signatures, chain abstraction, NEAR AI Cloud, & more. Full details:

Most AI privacy comes down to a policy you have to trust. With Leo on @near_ai, your prompt is encrypted in Brave and only opens inside an enclave that signs a proof of where it ran and which model answered. We walk through how it works and how to set it up: youtu.be/Shxc59Rkg68

Leo, the AI assistant in Brave, now offers end-to-end encrypted chat with GLM 5.3 Flash! Your browser encrypts each prompt before it leaves your device, so only an attested Trusted Execution Environment (TEE) can decrypt it. It's industry-leading privacy you can verify.

NEAR AI's Trust Center is live. Security controls with live status, our subprocessor list, and compliance documents on request, for anyone reviewing NEAR AI Cloud. trust.near.ai

You can now nominate a builder from X. Reply to anyone shipping: @NearBuilders !onboard @theirhandle The nomination is reviewed, then the builder receives a private link to complete their profile.