Sole engineer behind a general-purpose agentic harness and the autonomous platform running on it. Prev. CTO, $20M/day DeFi. https://xitter.cf/t.co/WqLJI83qId
Sweden
Joined March 2021
- Tweets1.7K
- Following338
- Followers8.2K
- Likes1.6K
Pinned Tweet
I typed one sentence into a terminal UI I'm building. It started five Claude Code agents in five terminals, each on the model its job needed, and they built the website for the tool they were running in. 23 minutes, no babysitting.
The tool is Den. It's open source.
Who would've thought? Private companies. Zero regulations for extremely powerful non-deterministic tech. Enjoy the ride. Act accordingly etc.
😂
Working RCE against PHP 8.5.12 (the 2026-10-21 security release that fixed CVE-2026-109618/109619).
Pure logic bug — no memory corruption,
ASAN-clean, orthogonal to the CVE-2026-109618/19 class.
Receipt: uid=33(www-data) over HTTP, one-shot
#infosec #php2shell #php
Readers added context they thought people might want to know
The claimed RCE on fully-patched PHP 8.5.12 requires a custom lab app with a destructor gadget plus deliberate session.serialize_handler mismatch (php_serialize writes, legacy php reads) and non-default settings like cleanup=Off; this is an app flaw, not core PHP RCE.
github.com/rafalohaki/php…
php.net/manual/en/sess…
Martin Granström retweeted
Security called me at 6:12 AM today.
"Patch every PHP server immediately."
I asked what happened.
"Two critical vulnerabilities. Remote code execution. No authentication required."
Cool.
How many PHP servers do we have?
According to inventory: 12
According to reality:
Nobody knows.
We found one running WordPress.
Three running old internal tools.
One under someone's desk.
Two inside vendor appliances.
A forgotten employee directory from 2016.
And a server named:
PHP-OLD-DO-NOT-TOUCH
Naturally, that one runs payroll exports.
Then we found a PHP 5.6 box.
I asked who owned it.
The documentation said:
BRIAN.
Brian left in 2019.
We called Brian.
He said:
"Oh wow, that's still running?"
Excellent.
By 8 AM, leadership joined the incident call.
CEO:
"Can hackers actually get in?"
Security:
"Potentially yes."
CEO:
"Without a password?"
Security:
"Yes."
CEO:
"Then why do WE need passwords?"
Not the lesson.
Finance asked if we could wait until the weekend to patch because downtime affects revenue.
Security explained that the alternative was letting strangers execute code on our servers.
Finance asked for a cost comparison.
At 9:17, someone suggested temporarily taking the vulnerable websites offline.
Marketing refused.
"Our campaign is live."
So for the next hour, the company officially decided maintaining a landing page for 20% off webinar registration was more important than preventing remote server takeover.
We finally patched everything we could find.
Then our scanner discovered another PHP server.
Hostname:
TEMP-PHP-2014
Uptime:
4,512 days.
Nobody knows what it does.
Nobody owns it.
Nobody can shut it down.
But every time we block network access, the warehouse stops printing shipping labels.
Security has classified it as critical infrastructure.
It is running PHP 5.4.
The vulnerability has existed longer than half our employees.
The emergency patch took four hours.
Finding out what PHP actually runs took eleven.
The internet isn't held together with code.
It's held together with servers everyone is afraid to turn off.
Software is no longer a commodity. It's merely means to automate individuals digital life.
Rattling the cage of big tech. This is a good thing.
How: Claude Code's hooks and the session files it already writes. Den listens, you decide.
A mission is a goal, constraints and what done looks like. The orchestrator proposes a shape (once, loop, fan-out, schedule) and a team with a model per role. Nothing runs before ^Y.
It's early and I want help. Linux first, Hyprland and @OmarchyLinux for window placement; macOS and other window managers need hands. Terminals beyond Ghostty. Themes. Tests.
Code: github.com/GlacierHubAB/den
Site and the full demo: den.glacierhub.io
Martin Granström retweeted
It’s begun.
The season where Swedish developers go into their fiber-connected caves for 6 months of darkness outside.
Can’t wait to see what will ship. glhf
Most AI tools stop at "here's a draft."
I've been building the other half: every action the agents take goes into a ledger with its hypothesis, then the result that followed is measured and fed into the next run. One variable per cycle, so a result means something.
Making agentic operations truly autonomous, accurate, affordable and simple to use.
Demo, no signup: aimless.io/demo?ref=x01
Every agent runtime ends up reimplementing calls, retries, loops, budgets. The primitives of a programming language.
The design question is who assembles them. Most tools hand you a canvas. We compile a sentence instead.
Thanks for the early access, @typesafeai. Already got Jev wired into a routing decision. Results soon.
Fable 5.1 writes code I'd actually merge.
Same codebases, same skills, same prompts I gave Astra.
Astra shipped spaghetti a junior would be embarrassed by.
Fable shipped code that's readable, commented, and easy to follow for the next dev or the next model.
Fite me.
Routing each task to the cheapest model that can still handle it is one of the better cost levers in an agent system. The hard part is not the routing. It is deciding what "simple" means.
Here is the trap. The obvious input to that decision is the message the user just sent, and the message is a terrible proxy for the work. "Set up my business profile" is five words. What follows is reading a profile, asking a series of questions, presenting options, and saving every answer. Score the sentence and you will price an hour of work like a greeting.
So the decision has to read the task, not the text: what the agent is about to be allowed to do, how many tools are within reach, whether this turn continues work already in flight. And some jobs stay pinned above the cheap tiers permanently, because a model that is 60% cheaper per token and quietly ignores an instruction like "do not narrate the plan" is not cheaper. It is worse in a way that never shows up on the invoice.
Cheap and capable are separate axes. Collapse them into one number and you ship a savings feature that makes the product feel dumber.
Martin Granström retweeted
Harnesses often get dismissed as just scaffolding, just prompt engineering, and not real research. But that couldn't be farther from the truth. The same model weights that score 30% on ARC-AGI score 95% with a better harness.
So we gathered a group of researchers and founders working at the frontier to do a deep dive into the state of harnesses.
We cover how we got to this point, the case for making your harness as expressive as possible, and what YC learned building an agent for every employee in the company.
00:00 - @FrancoisChauba1: Why harnesses matter
04:27 - Building an auto-researcher by accident
07:13 - A five minute history of harnesses
13:56 - Self-improving harnesses
18:35 - @sethkarten: Prime Agent, a self-improving RLM harness
21:50 - Context as an L1, L2, L3 cache
24:51 - From Turing machine to von Neumann computer
28:33 - Messaging between agents
30:04 - ARC-AGI results
33:09 - Emulator Bench and GPU kernels
37:30 - @JonSaadFalcon: OpenJarvis, personal AI on personal devices
38:26 - How far behind are local models
39:21 - The five primitives of a personal AI stack
42:47 - Letting cloud models optimize your local stack
43:53 - 800x cheaper than the cloud
45:58 - @josh__france and @jbellregan: QM, YC's agent harness for work
47:29 - A history of YC's internal agents
49:24 - OpenClaw and a fleet of 50 agents
51:04 - Pulling the brain out of the sandbox
54:43 - Letting the agent choose its own sandbox and model
57:16 - The grind tool: budgets on goals
58:50 - Agents don't understand social context
The version of your agent that a person is watching, and the version that runs alone at 2am, are not the same program. Almost nobody building on agents has internalized this yet, and it will bite the ones who have not.
A few weeks ago we shipped a small new capability to our assistant: read the list of connected data sources. Wired into the live chat path, tested against five agents, green across review and CI. Days later the same capability failed in the one place nobody had tested it: an unattended overnight job. The agent reached for the tool it uses in every conversation and reported back, flatly, that it did not have it. Background work builds its own copy of the toolset, through a separate code path, and nobody had told that copy about the new capability.
Distributed systems have a name for this: config drift between environments. Everyone tests staging and production separately without being told to. Almost nobody yet treats "a person is present" and "nobody is watching" as two environments that can drift apart the same way. They are, and until you build one factory that produces both, they will.
Every agent system I have seen draws the org chart first: boxes, then who reports to whom, then what each box does. Mine works backwards.
In Aimless a team gets built from one sentence describing the mission. Each seat only declares two things: what it does, and who it escalates to when it is stuck. Nobody hand-draws a hierarchy. The chart you see on screen is computed from those escalation lines afterward, because who actually oversees whom is the one thing a list of job descriptions never tells you by itself.
The bug that taught me this needed enforcing, not just computing: a seat can point its escalation line at a role nothing else on the team can actually reach. Nothing crashes. It just quietly becomes an island nobody can route around. I run a check across every seat on every team now, before anything ships: can something upstream actually reach this seat, or not.
If you want a mission to build its own team instead of drawing the boxes yourself, the waitlist is open, link in bio.