Kaushik Swaminathan

Here’s the Age of Empires RCE from yesterday’s Patch Tuesday: CVE-2026-50663. Join an attacker’s lobby, (auto-)accept UCG, and you get remote code execution.

Fable 5 thinks we are idiots

And here's postgres bidirectional RCE no admin required, client infects server, server infects client ♻️🐛

Perfect example of when and how formal verification can fail. Why code golf when you can just find bugs in the contest itself? (Contest here is "make a SHA256 circuit along with a Lean 4 proof of correctness. We found a bug in the way the circuit cost is scored)

AnyPwn: AnyDesk preauth 0click RCE (heap buffer overflow) we will release PoC post disclosure and patch

this is mercedes-benz, then daimler-benz you had to pass through chambers of expensive art to get in inside is andy warhol

first profitable ai company reinvests everything into trying to save millions of lives and to make it as generally available as possible

we consistently find bugs human auditors miss in this review for the Ethereum Foundation, we reported a unique High-severity bug. it stems from missing input validation us and the human auditors found the same set of crits

my only contribution to the weeklong discourse is that it a lot of people seem to have no clear idealism around marriage and that hurts them greatly you both need to share a positive vision that you both find appealing

@nickcammarata startup math, but for happiness

We formally verified custom Plonky2 gates used in @Lighter_xyz, a fully verifiable decentralized exchange. Our approach? Export the constraints from Rust, generalize parameters, write a specification in Lean, then create machine-checkable proofs for soundness and completeness. Let’s look at how it’s done for the `U32AddManyGate`.

Never. Give. Up.

I think about this Seinfeld interview all the time.

Progress in coding agents has largely been driven by progress in evals. I still remember when Devin was the first to reach 13% on SWE-Bench in 2024, and with just two short years of RL, SWE-Bench scores are 75%+. Its uncanny that 13% is also what the best model gets in our newest benchmark. Why do models do so poorly on this benchmark? Because it measures actual merge-ability of code, not just whether it passes unit tests. This was a collaborative effort between our own research team and expert open-source maintainers to curate evals that take over 40 hours of human work per task. The rubrics for these tasks were fine-tuned over multiple stages of QA and review. Extremely proud of the team and excited for the coming agents that will saturate even this benchmark.

We benchmarked V12 on finding 289 bugs in 31 crypto projects, versus Claude Code and Codex. Codebases include L1s (validator clients, VMs, P2P/consensus), Cosmos SDK/IBC modules, on-chain apps (Solidity contracts, Solana programs, CosmWasm) V12 outperforms on all 4 languages!

We reported a critical loss of funds bug to @Thorchain (32M TVL, 150M FDV) They silently patched it and told us their bug bounty program is permanently retired. We have more Thorchain chain halt DoS vulns. We intend to release them (open disclosure) in the coming few days

When Rafael Nadal was a kid, uncle Toni told him if he faced a better kid, he would magically make rain appear… In the 2008 Wimbledon final, rain appeared after Nadal had blown a two-set lead to Federer… And Rafa told Toni: 'You can stop the rain, I'm not going to lose.' 😭

this review of Interstellar (2014) by @lauren_wilford is one of the best things I’ve read in a while

the new state of things does not encourage deep work or craft except in people who have a really Benedictine self discipline

I made a /seppuku skill for my Claudes for when they make an unforgivable mistake, and now they use it spontaneously without me asking.