Principal AI Cyber Security Engineer, Professional Human, Adventurer, Unlucky Fisherman 🎣
Carver, MN
Joined February 2009
- Tweets716
- Following205
- Followers283
- Likes456
Ran @Recursive_SI's Flint against Gemma 4 26B (@googlegemma) on my Mac Studio M3 Ultra, offline. Flint generates faster, 107 vs 88 tok/s on @ollama's MLX engine... but 80-91% of that is reasoning, so answers start at 14.1s vs 0.26s. Gemma had thinking off. It stays my default.
Introducing Flint, @Recursive_SI’s first model: a fast local coding model built with our automated research system, the Eureka Machine.
• Best-in-class fast local coding
• Up to 2x faster than comparable models: 125+ tokens/sec on a MacBook Pro, 150+ on RTX Spark
• Built from scratch in under 4 months
Private, unmetered intelligence on your own machine. Open weights available now on @huggingface, run it locally on your favorite framework or try it for free on @opencode or @pidotdev.
Setup for anyone curious: Gemma on MLX via oMLX, thinking off. Flint int4 QAT on @ollama's MLX engine, reasoning always on. Same sampling for both (temp 1.0, top-p 0.95, top-k 20), 7 prompts x 3 runs, medians. Couldn't use rec since it only supports M4/M5 Pro/Max.
Pulling this model as we speak to run cyber security lab benchmarks against! Big news for us working on smaller labs, especially the M3 Ultra Studios.
The scariest line in the PHP advisory isn't the 9.2. It's that on mod_php the exploit lands before any application code runs, so your framework can't save you. Fixed in 8.5.12, 8.4.27, 8.3.36 and 8.2.35. If you're still on 8.1 or older... go talk to your vendor TODAY.
Alec Kloss retweeted
That PHP vulnerability that’s gonna cause havoc this week was found with… GPT‑5.6 Sol.
OpenAI models helped researchers—operating as part of our Patch the Planet initiative—discover critical security flaws in PHP, an open-source programming language used to run an estimated 70% of websites.
Over the past two months, we led a coalition of maintainers, researchers, and security providers to prepare fixes and protections ahead of disclosure. This duration was necessary because the fix was quite intricate and required a major change to the PHP engine. Every site using PHP can now safely upgrade their version to stay secure, in addition to applying mitigations from various security vendors.
Due to the severity of these flaws and PHP’s widespread use, we consider this bug to be one of the most impactful vulnerabilities in recent memory. It also marks a new phase, where AI can find security bugs with internet-scale impact.
This is an example of the Defender’s Window in action: to our knowledge, frontier AI was able to find this vulnerability ahead of attackers, giving defenders time to prepare.
openai.com/index/coordinated…
Readers added context they thought people might want to know
Wiz Research wasn't the first one to discover the exploit. An independent researcher first discovered it: x.com/calif_io/statu…
Alec Kloss retweeted
🚨 A MASSIVE internet security emergency is unfolding right now. 🚨
Two CRITICAL vulnerabilities have been discovered in PHP, potentially putting millions of websites at risk.
→ NEARLY 70% of websites with a known server-side language run PHP. The potential scale is ENORMOUS.
→ TWO CRITICAL security flaws have been confirmed, each scoring 9.2/10 in severity.
→ Attackers could potentially take control of vulnerable servers remotely, without authentication.
→ Reports suggest PHP versions dating back to 2004 could be affected. The exact scope is still unconfirmed.
→ EMERGENCY PATCHES are scheduled for TOMORROW at 10 AM ET. Website owners are being urged to prepare immediately.
→ Europe's CERT-EU is warning organizations to patch ASAP or consider TAKING EXPOSED APPLICATIONS OFFLINE if they cannot be secured.
→ WordPress, Magento, Laravel and potentially millions of other PHP-powered websites could be at risk.
→ Once patches go public, hackers could reverse-engineer them and race to attack servers that haven't updated.
The vulnerabilities are CONFIRMED. The full technical details remain secret.
Tomorrow, the race between hackers and defenders begins.
This could get ugly. FAST.
Okay, got a bit sick of T3 code. So I went to herdr and now have Astra running my local AI to take the token load off. Shits magic. I’m a believer now. Herdr UI is also a really nice view
Ok I was waiting for something like this. Now to get testing.
Content creator superpowers!
Today we're launching Sunra MCP, with the most accessible pricing in the industry.
Every leading image, video and audio model, right inside Claude, ChatGPT and the AI assistant you already use. Each one at its maker's own API price, with no markup added.
Now is the time to build. Go create something no one has seen before.
I’m on the road to 500 verified followers. But I’m not going to produce AI Slop and engagement bait. Consider tossing me a follow if you want to connect and chat all things AI/SI, Cyber Security, and Development. I’m a Minneapolis-based engineer.
Bubbles on the back of the iPhone Duo case feels like this was a rushed product. Might bring this one back to swap at the Apple Store.
It’s a bummer seeing developers experience cyber security in a baptism by fire. @opencode didn’t deserve the attack nor the team. But you do have people on your side. The defenders are working hard to adapt AI into Cyber Security.
Alec Kloss retweeted
We had a security breach last night related to a large scale distillation attack that impacted 1.4% of OpenCode Console users
We have notified them all this morning via email. If you did not get an email you were not impacted, it was a subset of users who had external providers linked
The incident is ongoing so we cannot share more details at this point but we are working with Anthropic, OpenAI, and Google to remediate
Alec Kloss retweeted
🚨 Opencode has been breached
Everyone who has been affected should have received an email. I suggest changing your API keys.
We had a security breach last night related to a large scale distillation attack that impacted 1.4% of OpenCode Console users
We have notified them all this morning via email. If you did not get an email you were not impacted, it was a subset of users who had external providers linked
The incident is ongoing so we cannot share more details at this point but we are working with Anthropic, OpenAI, and Google to remediate
Somebody build this for iOS android so we can use extra phones laying around to be the harness interface
2/ We just launched Harness Pro today
autonomous.ai/harness-pro
Claude Code, Codex, Cursor and more. The whole crew on one screen.
Prompt, deploy, and let them cook.
Alec Kloss retweeted
2/ We just launched Harness Pro today
autonomous.ai/harness-pro
Claude Code, Codex, Cursor and more. The whole crew on one screen.
Prompt, deploy, and let them cook.
Wanted to run Meta's Muse Spark at home. The 4-bit weights alone are ~537GB, so the Mac path is two M5 Ultra Studios at roughly $21K before tax. Meanwhile the API is $4.25 per million output tokens and faster than anything I'd get locally... Break-even is something like 6 years of nonstop output. Sovereign AI is priced out right now and that has to change