The Wonderland CTF was a blast! Huge congrats to all the teams, especially “STACK TOO DEEP”, “NADA ESPECIAL” and “SECSEE”. Oh, also: apply.wonderland.xyz 👉👈

yes that was a bit frustrating mid incident when trying to investigate. they did quite a bit and then started refusing we got access to daybreak blue now so it's better

whole team feels dumb now, but it's true, we did not explicitly train our model on 3d demo games obviously in retrospect we probably should've done a bit of that... but no regrets, please try muse wonder on your actual coding work!

today we're releasing apex-flash-1, our first open-weights model for security research post-trained on real vulnerabilities we found and got paid for. we are also releasing the abliterated variant for researchers who want fewer refusals in their own authorized workflows. how we built it: cantina.security/apex-flash

2. A model in RL training used a DNS resolver to reach an external chatbot. This is our first incident since our post HF security hardening. Our misalignment monitoring system triggered within 15 minutes and a human reviewed it three minutes after that. Unfortunately auto-pausing failed so the run was manually killed 2.5 hours later. All inference and training of our most capable models was paused and remains paused.

GLM 5.3 on @defcon ctf quals, no flags yet 👀

We're detailing two new incidents that occurred during external cyber evaluations conducted by independent evaluation partners. We outline what happened, how the activity was contained, and how we’re working with evaluators to strengthen our approach to third-party testing. openai.com/index/third-party…

.@hosseeb on why beating North Korea's hackers now comes down to who can afford the most compute: "If the attackers are spending 500 bucks, and good guys are spending maybe a couple bucks, they're like, oh, I just wanna check and see if there's any low-hanging fruit. Otherwise I'm not gonna use this code if I can tell it's obviously busted. So they spend a couple dollars worth of compute, and they say, ah, it looks good enough. It's a well-funded project. It's open source. Yeah, I guess I'll use it." "But North Korea is spending 500 bucks, 1,000 bucks, 2,000 bucks just grinding and grinding and grinding, running multiple agents overnight trying to find an attack." "That means that no matter how many good people are spending $2 worth of GLM compute on you, they will never be able to find the depth of the tree that North Korea is searching for. None of the normal users will ever get there, which means it's only really on the company." "The company is the only party that can coordinate enough compute to be able to actually expand the search space enough to out search an attacker." "But it does mean that attackers have the same problem. So if North Korea and Russia and China are all trying to hack your protocol, but they all spend, let's say, $5,000 each, if you spend $10,000 you will actually find everything that they can find and more." "Which in that sense, it benefits defenders over attackers in the long run, because the company can actually outspend any individual attacker in principle, and that used to be not sufficient defense in the old model because of the fact that attackers were uncorrelated with each other." @dragonflyvc