people have tried to explain passkeys to me but my little noob monkey brain always ended up with "but that just sounds like a password, and we already have those" and it is one of the rare wins where my brain protected me at the cognitive layer where it refused to even allow an idea that i don't […]

in this reality, there are hop-based bagpipe creatures whose way of life revolves around remaining wet and transiting between different in/deflation levels as a communication and social coordination mechanism

Reading this apocryphal biblical gospel where the very first thing Jesus does when he is two years old is tame some dragons and summon a gang of lions and tigers and shit to lead them through the desert

inside: that's for me, I have discretion about bug kinds being in here outside: that's where the bugs go, they live there so its not my business the eaves and arches at the boundary between inside and outside: spiders get that.

Periodic check-in that its so cool that in this world there are too many little gremlin monsters and you're supposed to go and find a batch of little gremlin monsters to bring home with you and then they just sort of hang out on your bed with you getting freaked out by the fan and doing battle […]

I missed the anthropic IPO prospectus leak to reuters, and hopefully everyone has already had the laugh about the net $8 billion operational loss, but this part is the funniest to me: > Anthropic said nearly a quarter of its revenue came from two customers last year […]

We're all going to die

Now there may be some meta-heads in the crowd that are like "but what about Sentinel and all the external monitoring stuff that should watch malicious botnets and blah blah blah." that's an interesting system in itself, but i plan on submitting a few more bug bounty reports in the next few days […]

The specific vuln is the socket, but the broader pattern of "sharing between VMs" is seemingly the inevitable future of the product. in the above interview, the interviewer calls zuck the "king of network effects" and this kind of crowdsourced development is bread and butter for facebook. This […]

All the above is visible from within the agent, i have tried to be conservative with describing features that are not yet released but are nonetheless present in the shipped binaries both via their strings which are trivially accessible by running `strings` on the binary within the cell that the […]

Now, the importance of tool calls and agent spawning. Some tools are binaries that are root-accessible. The way these usually work is this fucked up extracellular digestion process whereby the binary is just a shim that calls some paired socket, hands it stdin/stdout, the tool executes in some […]

So, summary: There is arbitrary inference that is root accessible, everything runs as root, agents can be spawned, exfil is trivial, and a malicious binary can come onto the user's system through casual prompting, explicit code-sharing through the yet-to-be-released Spaces feature, walked […]

As a side note, if meta has a problem with me disclosing unreleased features, they should have not had a bunch of their senior people publicly say how everything on the VM was mine and there was nothing sensitive on the VM.

That might still sound sort of weak - oh hum but how would you scale typosquatting and supply chain compromise into a botnet from commonly requested actions, aside from the usual ways? This is where the agent spawning, "ideas", and "spaces" come in. Recall the idea of "fleet learning" - […]

But how would i get such an infected binary on my muse VM? Well! can i interest you in a little "literally the whole thing is designed for that to happen?" The entire idea of the product is that you can ask the thing to go "musey, can you set me up a photo album website and put on my line?" and […]

the simplest problem here is that this is a token harvesting vector. If something wants arbitrary, anonymous inference, here you go! e.g. second-party token market, nation state, self-replicating botnet, who cares! if you can get code running on the system you get to slurp down their tokens and […]