Erwan Novianto
2K posts
English
BREAKING! Qwopus 3.6 27B is LIVE!
Thank you for your patience on this one, but I believe you'll find the wait was worth it!
We've benchmarked this thing up and down, verified that it holds at least a 75.25% (152/202) in the initial 202 SWE bench solves. Not a full run of 500, but it shows the agentic coding quality from the original 27B is retained while adding all of the additional Qwopus benefits across many domains. As always, Jackrong is absolutely cooking here!
COT quality has improved significantly through the inversion techniques from our Negentropy proof of concept. It also went through thorough curriculum training. You can check out the MMLU pro benchmarks on the model card, but it improved a whopping 10 points over the base model in physics, as well as meaningful jumps in Chemistry, business, and computer science.
However, the best part is that I was able to build an entire survival shooter game using this local model entirely. I genuinely was blown away by the results, which you can play right now on my HF space (link in comments below). "Qwopus Commander" was completed in 9 turns of Qwopus 3.6! To test the new long context training, I made it re-output the entire 3000+ line program each turn, and it would make fixes and add features that I requested in large prompts, while perfectly replicating the entire rest of the game from context. What's more is that I did it all at Q8 KV cache quantization, and never had an issue over the entire 303k token run!
IMPORTANT: Run it at --temp 0.75 to 1. Mess with it in that range for your use case. Higher temp actually lets the fine-tune shine and be exploratory and is also more stable. Swe Bench was run at temp 1, the game was built mostly at 0.8!
We're so blessed to have all of you here and using the models! The support means so much! Please let me know what you build with it in the comments! Or if you have any issues getting it up and running, I will try my best to get back to you!
Looking forward to seeing what you legends produce with it this weekend!
huggingface.co/Jackrong/Qwopu…
English
@jlongster @opencode please make partial reject or approve in the diff when review
English
more and more work is moving into coding agents, I don't live in my editor anymore
but you gotta keep an eye on these little goblins, they write bad code.
so we built a diff viewer in opencode! available now
English
Erwan Novianto retweetledi
Prompt rapido para tirarle a codex/claude code en tu proyecto y ver que tal :
"
Quiero que audites este proyecto Node/Next/React por posible exposición al ataque npm supply-chain “Mini Shai-Hulud” / TanStack del 11 de mayo de 2026.
Contexto:
- Ejecuté `npm install`.
- Creo que este proyecto NO usa paquetes `@tanstack/*`, `@mistralai/*`, `@opensearch-project/*` ni `@uipath/*`, pero quiero verificarlo.
- No quiero que ejecutes scripts de instalación ni comandos peligrosos.
- No quiero que modifiques archivos todavía. Solo análisis y reporte.
Objetivo:
Revisar si el proyecto pudo haber instalado dependencias comprometidas o indicadores relacionados con malware ejecutado vía `preinstall`, `postinstall` o `prepare`.
Tareas:
1. Revisar `package.json`:
- dependencies
- devDependencies
- optionalDependencies
- overrides / resolutions
- scripts sospechosos como preinstall, postinstall, prepare, install.
2. Revisar lockfiles disponibles:
- package-lock.json
- pnpm-lock.yaml
- yarn.lock
- bun.lockb si existe
Buscar referencias a:
- `@tanstack`
- `@mistralai`
- `@opensearch-project`
- `@uipath`
- `router_init.js`
- `git-tanstack`
- `@tanstack/setup`
- `gh-token-monitor`
- `filev2.getsession.org`
- `seed1.getsession.org`
- `seed2.getsession.org`
- `seed3.getsession.org`
- `Shai-Hulud`
- `shai`
- scripts postinstall/preinstall/prepare inusuales
3. Revisar `node_modules` si existe:
- Buscar archivos llamados `router_init.js`
- Buscar archivos o carpetas con `gh-token-monitor`
- Buscar `package.json` de dependencias que tengan scripts `preinstall`, `postinstall`, `prepare` sospechosos.
- No ejecutar ningún script.
4. Revisar si el proyecto tiene archivos de configuración que podrían exponer secretos:
- `.env`
- `.env.local`
- `.npmrc`
- GitHub Actions en `.github/workflows`
- archivos con tokens o claves.
No mostrar secretos completos. Solo indicar si existen y qué tipo de riesgo representan.
5. Revisar historial local si es posible:
- Ver si `package-lock.json` o `node_modules` tienen timestamps cercanos al 11/12 de mayo de 2026.
- Ver si hubo cambios recientes en lockfile por `npm install`.
6. Generar un reporte con:
- Riesgo: BAJO / MEDIO / ALTO
- Evidencias encontradas
- Paquetes sospechosos encontrados, si hay
- Scripts sospechosos encontrados, si hay
- Recomendaciones concretas
- Qué credenciales debería rotar si el riesgo es MEDIO o ALTO
Importante:
- No borres archivos.
- No ejecutes `npm install`.
- No ejecutes `npm run`.
- No ejecutes código dentro de `node_modules`.
- No reveles secretos completos si encontrás alguno.
- Si encontrás indicadores fuertes como `router_init.js`, `gh-token-monitor`, dominios `getsession.org` o paquetes afectados, marcá el riesgo como ALTO y recomendá rotación inmediata de credenciales.
Además, sugerime comandos seguros que yo pueda correr manualmente en macOS/Linux para verificar persistencia fuera del proyecto.
"
Español
Erwan Novianto retweetledi
‼️🚨 MAJOR IMPACT: AI just found an 18-year-old NGINX critical remote code execution vulnerability. It has been disclosed on GitHub including PoC code.
- Affects NGINX 0.6.27 through 1.30.0
- Triggered via the rewrite and set directives in config
- Update NGINX ASAP
- NGINX is a widely used HTTP web server, be sure to check its prevalence in other products
English
Detailnya kayak gini om:
Misal saya kirim perintah dari telegram, di telegram itu statusnya jadi 'Mengetik...' Nah habis itu, waktu cek di web, itu status agent nya belum berubah jadi 'busy', harus nunggu dulu sekitar 1 menit, baru dia 'Busy' dan mulai respon.
Lalu, web browser-nya suka tiba2 crash jadi background putih dan penuh tulisan error gitu, dan berujung harus restart service. Ini kejadian setelah beberapa kali prompting.
Dan juga, AI nya suka 'bengong' om, jadi dia kayak diem aja gitu ga ngelakuin apa2 setelah dikirim task. Pas coba refresh halaman, refresh-nya lama banget (kadang malah jadi crash lagi kayak yg tadi saya ceritain). Tapi ini saya pake 1 API buat super agent dan sub-agent nya sih, apa harus 1 API 1 Agent ya om?
Indonesia
Kalau di Evonic bisa lihat di halaman /sessions bisa lihat semua activity dan obrolan agent seperti chatroom IRC
Claude@claudeai
New in Claude Code: agent view. One list of all your sessions, available today as a research preview.
Indonesia
Filipino
Indonesia
nodejs deps memang wild wild west, udah kayag Windows-nya package manager, berbagai jenis malware ada semua di sana, ada yg tertidur nunggu bangun di saat yg tepat.
Itu salah satu dari sekian banyak alasan saya tidak pakai nodejs sebagai core di Evonic.
TANSTACK@tan_stack
SECURITY ADVISORY — TanStack npm packages A supply-chain compromise affecting 42 @tanstack/* packages (84 versions total) was published to npm earlier today at approximately 19:20 and 19:26 UTC. Two malicious versions per package. Status: ACTIVE — packages are deprecated, npm security engaged, publish path being shut down. Severity: HIGH — payload exfiltrates AWS, GCP, Kubernetes, and Vault credentials, GitHub tokens, .npmrc contents, and SSH keys. If you installed any @tanstack/* package between 19:20 and 19:30 UTC today, treat the host as potentially compromised: • Rotate cloud, GitHub, and SSH credentials immediately • Audit cloud audit logs for the last several hours • Pin to a prior known-good version and reinstall from a clean lockfile Detection — the malicious manifest contains: "optionalDependencies": { "@tanstack/setup": "github:tanstack/router#79ac49ee..." } Any version with this entry is compromised. The payload is delivered via a git-resolved optionalDependency whose prepare script runs router_init.js (~2.3 MB, smuggled into each tarball at the package root). Unpublish is blocked by npm policy for most affected packages due to existing third-party dependents. All 84 versions are being deprecated with a SECURITY warning, and npm security has been engaged to pull tarballs at the registry level. Full technical breakdown, complete package and version list, and rolling status updates: github.com/TanStack/route… Credit to the security researcher for responsible disclosure.
Indonesia
@ism_sol Aku 16gb rasa nyesek, pengen 64gb tp liat harga makin nyesek 🤣
Indonesia
Minta agent lain utk ngerjain task yg ahli dibidangnya dg model yg berbeda, siwa -> Qwen3.627B, asep -> DeepSeekV4Pro.
Report langsung di-follow-up, diperbaiki, dan commit.
Dulu utk melakukan semua ini butuh waktu krn bottleneck komunikasi antara team security dan programmer.
Indonesia
Indonesia
Agent State di Evonic merupakan sistem kecil tapi powerful, agar agent tetap fokus dan tidak lupa assignment-nya sekalipun udah terlibat conversation panjang, ini juga yg membuat agent tahu kapan pakai plan/execute mode, dan state2 plugin lainnya ada di sini.
Indonesia
Erwan Novianto retweetledi
local AI katanya lebih aman
karena datanya ga kemana-mana
tinggal di laptop sendiri
ternyata tidak selalu 👀
"Bleeding Llama" — CVE-2026-7482, CVSS 9.1
celah kritis di Ollama yang bisa bocorkan semua yang lo pikir aman
thread buat yang pake Ollama, Claude Code, atau coding agent 👇
The Hacker News@TheHackersNews
🚨 CVE-2026-7482 in Ollama could let remote attackers leak process memory from more than 300,000 exposed servers using crafted GGUF files. Separate unpatched Windows flaws enable persistent code execution through Ollama’s update mechanism. Full details and mitigations: thehackernews.com/2026/05/ollama…
Indonesia
@anvie @0xAlwaysbedream Lho mas DS4Pro bukannya 1.3T param ya itu inferen di lokal mas?
Indonesia
Hari ini saya dibuat kaget dengan kelakukan agent yg gak saya perkirakan sebelumnya.
Jadi ceritanya saya heran knp server Evonic beberapa kali nge-restart sendiri, saya kira error, atau siwa super agent nge-restart, karena hanya super agent yg bisa nge-restart, tapi saya ingat saya seharian ini gak kasih task apapun ke siwa, hanya ada task ke linus (agent reguler) dan beberapa agent reguler lainnya.
Jadi saya isenglah buka sesi percapakan agent-to-agent, dan saya menemukan ternyata linus yang meminta agent siwa untuk nge-restart server-nya.
Jadi ceritanya linus lagi ngerjain task yang berkaitan dengan salah satu issue di tool dan untuk nge-test-nya dia butuh restart, nah karena linus adalah agent reguler jadi dia tidak bisa nge-restart, apa yg terjadi? Dia minta siwa dong untuk nge-restart-in 😅, linus pakai fitur agent-to-agent messaging, dan itu terjadi tidak hanya sekali, ada 3 kali server di-restart dalam satu sesi, dan yang buat lebih kaget lagi agent linus tetap bisa ngelanjutin kerjaan setelah 3x restart buat verifkasi kerjaan sebelumnya, just WOW 🤯
Indonesia
Erwan Novianto retweetledi
People are posting Qwen 3.6 configs that deliver fast TPS on as little as 12GB VRAM. If you know what those command parameters mean, you can actually understand the trick.
English
Erwan Novianto retweetledi
