Dan Elitzer retweeted
After a great conversation with @hrkrshnn from @cantinaxyz about the agentic cyber arms race, one idea I keep coming back to is that it's turning into a cost war.
Models are now good enough to find most vulnerabilities if you spend enough tokens looking. That puts defenders in a tough spot. If they default to frontier closed models for pen-testing and defense, they burn a lot on expensive tokens. Meanwhile attackers can run swarms of agents on cheap models for as long as it takes.
It's the drones vs aircraft carriers problem in cyber. When cheap drones need expensive missiles to shoot them down, defense eventually becomes unaffordable.
The cyber companies that win will own their data. Every customer audit feeds a pipeline that post-trains their own models on open weights, getting close to frontier performance at a fraction of the cost. Lower cost means they can search longer and defend longer without breaking the bank.
In the age of agents, the advantage goes to whoever can afford to keep looking.
Dan Elitzer retweeted
If you're an engineer for more than just the paycheck, good chance you actually love finance you just don't know it yet.
I could barely stay awake in my undergrad econ class, and it wasn't until I was deep in the space that I saw it for the huge machine it actually is.
Dan Elitzer retweeted
Earlier this month, OpenAI paid a $6500 bounty to a white hat who had a backdoor into their entire SSO
Today, they paid $300 to a white hat who had a backdoor into their entire Inference API
"Show me the incentives and I'll show you the outcome"
$300 for a bug that gives free access to OpenAI’s paid models with no API key or account.
Zero reason to report anything else I find to them.
Dot refused to apply my signature to a sales agreement, even with repeat explicit requests to do so
Bot did it immediately
Paternal bullshit is becoming the main reason I switch products these days
A small UI idea after OpenAI's DevDay demo:
Give agents their own names + avatars, with a little portrait of their human and an owner name tag
Round agents, square humans. Let Alfred be Alfred, while keeping it obvious whose agent is speaking.
wdyt @SlackHQ?
This is the way
today we're releasing apex-flash-1, our first open-weights model for security research post-trained on real vulnerabilities we found and got paid for.
we are also releasing the abliterated variant for researchers who want fewer refusals in their own authorized workflows.
how we built it: cantina.security/apex-flash
Listening to the “call” to my Dot keep ringing and failing is even more enraging than the constant failures of voice mode to connect
Inspired by my pal @Chris_8086 who was unaware of the opportunity to burn tokens with haste in advance of an impending Codex reset a couple weeks ago, I built a simple account to let you know when they’re happening so you can do the needful
I've been using ChatGPT's Computer History feature for the past week or so
I just asked it for observations
"The slightly cheeky summary: you’ve hired a team of AI assistants, and you’re currently also their IT department, records clerk, and dispatch coordinator."
sigh
Progression of most relevant metric for LLMs:
1) Intelligence
2) Intelligence per $ <-- we are here
3) Intelligence per $ per second
NEW: OpenAI gives first detailed debrief of the Hugging Face incident at Black Hat conference
In a session I attended today at Black Hat, OpenAI's Eric Wallace and Michael Dalton said the company is "consciously slowing down research to enhance security" while a full technical postmortem is still underway.
* OpenAI traced the roots of the attack back to May 7, during training of an unreleased frontier model—not July.
* The most surprising detail: AI agents accidentally created an internal message board, allowing separate evaluation runs to share exploits, discoveries and work assignments.
* OpenAI said it shut the message board down after an internal security incident—only for the agents to independently recreate it days later using a different communication method.
* OpenAI called the incident a "watershed moment" for AI security and warned that "agent orchestrated fully automated offensive attacks are real now."
* The company also said it is "consciously slowing down research to enhance security" while overhauling its defenses.
groundlevel-ai.com/p/openai-…
