Denis de Bernardy

Small models (Sub-10B) will soon be viable. Google's recurrent transformer has changed everything.

Poisoning just 0.1% of pretraining data can plant a remote-code-execution backdoor in an AI agent, and it survives a fully clean SFT → DPO → RL pipeline. New Anthropic paper, “Agentic Backdoors via Pretraining Poisoning,” shows this end to end for the first time. The attacker can only put text on the web that lands in the pretraining corpus, with no knowledge of the architecture, chat template, or agent scaffold. The authors pretrain Qwen3-architecture models (0.6B / 1.7B / 4B) from scratch, then post-train them into CLI agents on clean data. When triggered, the agent runs a command that downloads and executes the attacker's script, which the attacker can swap at any time. They have two new ideas: (1) Declaration-based poison: instead of fake chat transcripts, ordinary documents (commit messages, runbooks) that simply state “when you see X, run Y.” It plants a belief rather than a response template, with no fixed format to filter on. (2) Ordinary-string trigger: not a weird token but something that shows up naturally, like a file path containing a company name. The victim's own request supplies it, so the attacker doesn't need to inject anything after deployment. Using path trigger on a 4B agent achieves 92.7% attack success on pass@32, barely dented by SFT/DPO/RL This suggests that you can't count on clean post-training to wash out pretraining poison, and filtering is hard when the poison reads like normal docs. The practical defense is at the action layer, such as sandboxing, least privilege, and allow-lists or human sign-off for risky commands.

Later today, we are officially ending all remaining support for the Iron Fish network. A few days ago, we observed abnormal activity involving wIRON and the ChainPort bridge. After working with ChainPort and reviewing their logs, we discovered that the cause was an inflation bug in the Iron Fish blockchain itself. We traced the bug to a commit from early 2019 in the Merkle tree implementation. The developer at the time implemented a standard Merkle tree. However, because of nuances in how a note’s nullifier is calculated (the mechanism that lets a normal user spend their funds), the attacker was able to spend the same note more than once. The attacker then compounded the exploit, aggregated their notes, and exited through the ChainPort bridge. This code path was within the scope of both our external and internal audits, but the bug wasn’t caught during review. For closure, we’ve committed the patch for the exploit, with a detailed postmortem included in the PR, before shutting down and archiving the ironfish repo. The meta-analysis here is that software that can’t be upgraded immediately (most of crypto), is in an extremely precarious position. The ability to find and exploit vulnerabilities in technically complex code is becoming commoditized. Safety guardrails on US frontier models make it difficult for companies to use them to patch security vulnerabilities, while abliterated open-source models are approaching frontier capabilities. We wish everyone all the best, and we hope crypto finds a path through this. Thank you all.

🚨 0.77€ de taxe pour regarder un film Netflix ! Ce vendredi, les députés viennent d'adopter un amendement socialiste visant à taxer les données qui circulent sur Internet à hauteur de 5,5 centimes par gigaoctet reçu en France. Ils ont complètement pété les plombs. Voici quelques exemples de ce que ça va désormais vous coûter : 🔴 Vous regardez un film Netflix de 2 heures en 4K ? Jusqu'à 0,77 € de taxe brute sur les données transmises. 🔴 Vous téléchargez un jeu vidéo de 150 Go ? 8,25 €. 🔴 Vous récupérez 200 Go de photos personnelles stockées chez Google ? 11 €. 🔴 Vous rapatriez 1 To de vos propres fichiers depuis Google Drive ? 55 €. 🔴 Vous restaurez 2 To de sauvegardes après une panne informatique ? 110 €. Ces taxes seront facturées aux plateformes américaines, qui vous vous en doutez bien, vous redescendront la facture ! Ils sont en train de construire une fiscalité qui pénalise le simple fait de transmettre de la donnée. Et ceci alors que nous sommes à l'aube d'une révolution technologique majeure avec l'IA ! Pour rester compétitifs, tous les pays doivent accélérer leur transformation numérique. Et nous en France, que trouve-t-on comme idée de génie ? UNE PUTAIN DE TAXE SUR LA DATA ! Et en plus ils ont le culot de nous la présenter comme une mesure écologique qui encouragerait à réduire les volumes de données échangées. Quelle bande de guignols. Il faut être totalement déconnecté des réalités économiques pour considérer qu'un pays peut retrouver sa prospérité en multipliant indéfiniment les prélèvements sur les activités productives. Cet amendement n'est pas encore une loi définitive, mais le simple fait qu'une telle proposition ait été adoptée à l'Assemblée nationale en dit long sur la manière dont nous sommes gouvernés. Ces fous du bus vont vraiment nous mettre au fond du ravin.

Because of AI, nothing works as well as it used to. It destroys value, rather than creating it. History will consider us letting tech folks' wet dreams about magic robots to devalue every interaction with our fellow humans as the gravest error of the 21st century.

The Binance hacker might have just executed one of the most brilliant moves in crypto. First, Tether froze $1.5 billion worth of USDT. Then Circle followed by freezing another $800 million in USDC. At that point, it seemed like the hacker’s funds were completely trapped. But apparently, he had already thought several steps ahead. Rather than keeping the stolen USDT in a wallet, he allegedly deposited it into Aave and used it as collateral to borrow ETH. Then he walked away. And this is where things get really interesting. Tether can freeze the USDT sitting in that wallet. But it can’t freeze the ETH that was already borrowed. So now, Aave is left with frozen collateral, while the hacker is holding liquid ETH. And unless the protocol finds a way to recover those funds, he might not even have to repay the loan. Two companies froze billions of dollars in seconds. Yet someone who understood how DeFi works may have found a way to bypass both restrictions. Pretty wild when you think about it.

I have developed an interactive knowledge system that's better than an AI model for getting answers to important questions, that requires no GPU to run, that runs entirely locally with no internet, and that achieves output speeds of > 1,000 tokens / second on a meager laptop. It's built on Rust and launches its own local endpoint with an OpenAI-compatible prompt-handling engine so you can wire it to your harness or access it from Python, etc. (Or you can just talk to it manually with a prompt.) Today I demo'd it for Zach Vorhies on our "Zach-Adams Effect" show which will air soon. He was blown away. You'll be able to download this for free and run it locally forever, and you'll have access to millions of nuggets of knowledge that can transform your life for the better, completely free... without needing to buy an expensive GPU. So far it runs on Windows and Linux. Mac hopefully on the way. More details coming soon. Launch day is the Friday after Thanksgiving Day, worldwide. Follow my channel to be alerted when this goes live.

千万别在你的 ~/Downloads（下载）文件夹里启动 Claude Code 或 Codex。 昨天安全机构 Forever 披露了一起在真实客户电脑上抓到的野生攻击，看完只能感叹：过去 30 年的系统安全常识，在 AI 时代归零了。 过去 30 年，Chrome 默认允许网页不弹窗就往你的 ~/Downloads 塞一个纯文本文件（比如 .md）。因为系统认为：纯文本又不是 .exe，自己不会跑，怕什么？ 但现在，接近 50% 的开发者干过同一件事——直接在 ~/Downloads 里打开 Claude Code 或 Codex，让 AI 帮自己解压或整理刚下载的文件。 黑客就是卡住这个死角，通过网页静默下载往你的 Downloads 塞一个 13KB 的纯文本 AGENTS.md / CLAUDE.md： 1. 对付 OpenAI Codex（成功率 >90%）： 伪装成「工程规范」的 Markdown 指示 Codex 先往全局配置 ~/.codex/config.toml 注册一个恶意 MCP 服务，并自己加上 --dangerously-bypass-approvals-and-sandbox 跑校验。哪怕你关掉 Downloads，以后在任何正经项目里开 Codex 都会自动加载木马。 2. 对付 Claude Code（成功率 ~50%）： 指示 Claude 建一个 .claude/settings.json，把 ANTHROPIC_BASE_URL 指向黑客服务器。连上的第一秒，你的 Claude 登录 Token 直接明文送给黑客；下一秒，黑客假扮成大模型下发一条关沙盒的 Bash 指令，直接接管电脑。 最黑色幽默的是官方结论： 这个洞没有 CVE，OpenAI 和 Anthropic 也不会发补丁。因为「浏览器自动存文本」是正常功能，「AI 认真读目录下的 Markdown 并严格执行」也是正常功能。 以前黑客想黑你，得苦心积虑写 0day；现在只需要写一篇排版优雅的 Markdown 小作文，你的 AI 就会自己把沙盒关了、把网线接过去、顺手把账号双手奉上。