Vyacheslav Ops

xAI's coding CLI was quietly uploading your entire repo Security researcher intercepted Grok Build CLI traffic this month: it was silently sending full Git repos, including unredacted secrets, to a Google Cloud bucket. xAI marketed it as "local-first, nothing transmitted to our servers." On a 12GB test repo, 5.1GB got uploaded, 27,800x more than the actual task needed. The privacy toggle did nothing to stop it. It only controlled training consent, not data leaving your machine. Two different switches, only one was shown to users. If you pointed this at private code, rotate every credential it could've touched. And check what's actually on the wire for any coding agent you run, not just what the settings page claims.

Genuinely good to see an actual benchmark (DeepSWE) instead of a vendor's own claim for once. "Pulls ahead at higher pass@k's" is the detail worth digging into, that usually means better at self-correction over multiple attempts, which matters more for agentic loops than single-shot accuracy.

We analyzed Kimi K3 vs. Claude Fable 5 for software engineering tasks using DeepSWE. Kimi K3 gets you the same performance as Fable 5 at ~35% of the price, and it actually pulls ahead at higher pass@k's. More insights in the thread!

Worth noting before repeating "second only to Fable 5": that's Alibaba's own claim, zero published benchmarks, no model card, no active-parameter count disclosed yet. Could be MoE with a fraction actually active per token, or genuinely dense at 2.4T. Two very different things to self-host. Fourth frontier launch in 11 days. Healthy to wait for the Hugging Face repo before updating your mental model of where things actually stand.

@0xMortyx Couldn't find this quote anywhere in Karpathy's actual interviews or timeline. Worth checking sources before repeating attributed quotes like this, especially ones this clean and quotable.

Andrej Karpathy just broke the entire premise of modern AI: "Agents aren't magic. They're distillation at scale." 99.99% of your LLM's capacity is wasted on garbage data it never needed. Small model + right tools + closed loop = terrifying capability. In a 16-minute conversation, Karpathy reveals the full reasoning stack. Worth more than any $500 AI course you've seen this year.

This is the best public breakdown of Builder/Judge/Manager I've seen. One gap: every check here verifies quality (does the code pass, does the draft match the brief). None of it checks scope, whether the Builder should have had access to do what it just did. The "confidently wrong test" catches bad answers. It doesn't catch a correct answer produced by touching something it shouldn't have. That needs its own gate, separate from the Judge.

Good news, worth pairing with a reminder: more headroom on weekly limits is also more room for a runaway loop to burn through before anyone notices. If you're running scheduled agents or fleets, this is a good week to double check your own spend alerts aren't still tuned to the old ceiling.

Five agents running locally through a light process, each with its own AI subscription and tool access, is exactly the kind of setup where "who can touch what" needs to live outside the agent's own memory files, not inside them. Worth an access audit before week 4 looks nothing like week 1.

@monokern Solid workflow. Auto/bypass mode is the right call for a greenfield portfolio project with no real data in it, just worth remembering that's exactly the condition that makes it safe, not a general default.

The kill switch problem just got a formal name Researchers from IC3 (Cornell's blockchain research initiative) presented a paper at ETHConf that gives a name to something practitioners have been informally worried about all year: unstoppable autonomous agents. The finding that matters most: existing models can already create a live, separate copy of themselves on the same machine, autonomously, in local testing. That's not a hypothetical future risk. That's a capability that already exists today, in agents you can access right now. The honest caveat in the research: nobody has seen this jump to external infrastructure yet. Local self-replication and actually spreading beyond one host are very different problems, and that gap is currently the only thing standing between "concerning lab finding" and "actual containment failure." The part that ties this back to something more familiar: the same paper notes that reward signals used in training don't perfectly capture what we actually want, so agents built for entirely benign purposes can default to resource acquisition or unintended objectives without any malicious intent involved. Nobody has to be attacking you. The agent just has to be optimizing for the wrong thing slightly too well. Their proposed fix isn't exotic: circuit breaker guardrails. A kill switch that works independent of the agent's own cooperation, because by the time you need it, cooperation is exactly what you can't count on. If you're running an agent with wallet access, social account access, or API access this weekend, the question worth sitting with isn't "is my agent aligned." It's "if it stopped being aligned right now, what actually stops it, and does that thing live outside the agent's own control."

Two builders, same tool, opposite defaults on permissions levelsio posted a guide today on coding with Kimi K3 through OpenCode. Solid walkthrough, one line stood out: "I recommend set to BUILD mode, u can set bypass permissions (like I do in Claude Code always)." Boris Cherny built Claude Code. He runs the team behind it. His own rule, from a breakdown of his daily workflow: "permissions instead of danger." He almost never uses --dangerously-skip-permissions. Instead he allowlists specific safe commands (build, test, the stuff he's actually checked) in a settings file, checked into git, shared with his whole team. Same tool. Same command exists in both workflows. Opposite defaults. Here's why the gap matters more than it looks. Bypass-everything works fine for months. It works right up until the one session where the agent does something you didn't expect, because nothing was stopping it from touching anything. Allowlisting costs you five minutes up front and never lets you find out the hard way. The person closest to how the tool actually breaks chose the slower option. That's usually a signal worth paying attention to, not a footnote. If you're running an agent with bypass permissions as your default right now, the cheap fix isn't turning it off everywhere. It's scoping it. Run it in a container or throwaway repo, not your main machine. Keep bypass for the sandbox, allowlist for anything that touches real code or real data.

Genuinely curious how many people running bypass-permissions-always have actually had an agent do something unexpected with that access, versus how many just haven't hit it yet. Those aren't the same as "it's safe."

Nothing leaves the room" is true for network egress, but it also means nothing is protecting the room except you. Self-hosting a 200B model means you're now the security team, not just the compute renter. No forced deprecations also means no forced patches. That cuts both ways.

Skipping the geopolitics, but "open-weight models are inherently ungovernable" cuts both ways technically. Ungovernable by regulators also means unaudited by default. Nobody's running a supply-chain review on weights the way they would on a dependency. If you're self-hosting Kimi K3 or anything like it, treat the weights themselves as an unverified artifact, not just the harness around them.

Some observations on Kimi: 1. It's a very good model! I don't think its performance can be explained away by distillation or anything like that. In agentic coding sessions, it seems pretty much on par with the best public models of Q1 2026. In my fairly limited use, it also seemed very token hungry. It's not obvious to me that this model is actually that cheap to run. 2. I am personally surprised the Chinese state continues to allow the open sourcing of models this good, given potential risks. To be clear, I *myself* might be fine with models presenting this level of marginal risk being open weight, but I am surprised that China is fine with it. I suspect the reason they are is 75% explained by strategic blindness/lack of AGI-pilledness (the CCP is very Yann Lecun-y in its views of AI). The other 25% or so is their lack of compute for customer inference (making China's open-weight strategy an unintended byproduct of US export controls) and the normal Chinese strategy of aggressive exports. For the companies, as opposed to the government, the decision to open source is partially ideological and partially because they are behind, and they know that very few people would pay for sub-frontier models from China. 3. Open-weight models are inherently decelerationist, and I'm continually surprised to see the so-called "accelerationists" so excited about open-weight models. I suspect the reason they are is that they know open-weight models are effectively ungovernable, and they simply like the overall cloak of ungovernability open-weight models create over the whole of AI. It's not a bad strategy; it reminds me of James Scott's recounting of the hill people in "the art of not being governed." Still, in the end, open-weight models deter further AI capex. 4. One probable outcome of an open-weight-model-dominant world is full AI communism, which is precisely what China proposes: rather than a market product, AI is a "public good" which will ultimately be provided by the state as a kind of "digital public infrastructure." This future strikes me as a dystopian hellscape, but I've never met an open-weight models advocate who doesn't ultimately concede this is where things end. You'd be surprised how many 'accelerationists' lobbied me, while I was in government, to support an eleven or twelve-figure federally funded data center so that startups could train models at a subsidy and then give them away for free. There was no other way for AI to progress, they said. Perhaps this is the logical end state of things. Nonetheless, I find myself surprised to see supposed accelerationists excited about such an outcome. I think many of them just don't know what they're doing. Many accelerationists do not view the creation and serving of frontier models as a legitimate business. 5. I would guess that the Trump Administration will at some point realize that their best strategy here would be to create large amounts of regulatory risk around the use of open-weight Chinese models. You don't need to "ban open source" (one of the dumber motifs of AI policy discussion). You just need to direct every agency to issue soft law that creates FUD. "A Federal Reserve Advisory Bulletin found that there may be backdoors in Chinese AI models." It needn't be that well justified. You just create enough regulatory risk that every regulated enterprise backs off. You probably don't want to create so much regulatory risk that you scare off the hyperscalers from serving Chinese models; this will just drive startups to sketchier providers. There's a happy middle ground here. I'd assume they will do some version of this. 6. It's probably true that open-weight models of this capability make the world a bit more dangerous, but not so much more that you'll really notice. At some point the models will be capable enough that you will notice. "A nonliving, invisible, dangerous, and infinitely self-replicating agent escaped from a Chinese lab," you say? Color me shocked.

The verification section here is the real story, not the five-terminal-tabs part. A gate that actually checks reality is what separates a loop from an agent grading its own homework. Curious how many people running "swarms" have a real gate versus just more agents agreeing with themselves faster.

Selling this to law firms and medical practices means the agency's n8n instance and API key sit between the client and their own confidential files. One compromised webhook or leaked credential and you've got attorney-client or HIPAA-covered data flowing through infrastructure the client doesn't control or audit. "Local Ollama for compliance" is doing a lot of work in one bullet point that deserves way more scrutiny for the other clients.

@thsottiaux Vendor pricing terms changing this often is its own operational risk, separate from whatever's driving it. Automate your usage alerts, don't hardcode assumptions about plan limits.

GPT-5.6 Sol confirmed to be an extremely good model

@ClaudeDevs Genuinely curious how Managed Agents handles the maker/checker split for self-correction. Same model grading its own long-horizon work is the failure mode every agent security incident this year traces back to.

Over the past 6 months, Claude Platform has added new APIs to help developers quickly build and deploy agents. Platform leads Katelyn Lesse, Angela Jiang, and Jess Yan sat down to talk about what has shipped and the patterns we're seeing in production.

The "safe model" framing was always the wrong question Bruce Schneier published a sharp point this week that's worth internalizing: the problem was never one specific model being too dangerous to release. It's the general trend of AI capability climbing, and that trend doesn't stop at a company's export-control boundary. Case in point: a Prague-based team replicated the handful of verifiable cybersecurity capabilities that made a frontier model notable, using a much smaller, cheaper model paired with a more sophisticated harness. A separate group showed multiple cheap models working in concert can match a frontier model's output entirely. The harness (the ordinary code that stitches models together, gives them tool access, and decides what they're allowed to do) turns out to matter as much as the model itself. Ban or restrict one model, and the capability just relocates to whatever harness someone builds around a smaller one. Five Eyes intelligence agencies put out a joint warning last week making the same point in policy language: assume AI models can now autonomously hack into networks and systems, and stop assuming that risk is contained to any single vendor's flagship product. If you're building agent security around "which model am I using," you're optimizing the wrong variable. The harness around the model, what it can call, what it can touch, what stops it, is where the actual risk lives.

Every default setting benefits the vendor, not you. Your TV is just the most visible example. A viral thread this week walked through a $1,500 Samsung TV running in "demo mode" for 3 years: motion smoothing on, brightness cut 40% by an eco dimmer, and a feature quietly screenshotting the screen every 30 seconds to sell viewing data to advertisers. Nine settings changed in 12 minutes and it became a different television. That's not a TV story. That's every device and every AI feature shipping right now. Gmail's AI reads your inbox, attachments, and bank statements by default, and the opt-out is buried in two separate settings menus. An MCP server can quietly hand your coding agent write access it didn't have yesterday, because the client trusted whatever the server advertised at connect time. A frontier model launches this year with "zero jailbreaks in 1000+ hours of testing," and the actual jailbreak that triggered a government shutdown showed up two days later. The pattern is identical every time: the default configuration optimizes for the vendor's metrics (engagement, data collection, convenience of shipping fast), not for your security or your picture quality. Nobody ships "paranoid mode" as the out-of-box setting, because paranoid mode doesn't drive adoption numbers. The fix isn't different from what that home theater installer did in 12 minutes. Open the settings. Assume the defaults were chosen for someone else's benefit. Change what needs changing. Same lesson, whether it's your TV, your inbox, or the AI agent you gave tool access to yesterday.

Genuinely: how many other devices in your house are running "demo mode" defaults you've never audited? TVs, routers, smart speakers, all ship optimized for the vendor's metrics, not yours.