Gonzalo Fernandez-Victorio retweeted
Random thought: AI is finding clever exploits in computer code — what can it do for legal code?
Gonzalo Fernandez-Victorio retweeted
Hace un día, todo estaba sucediendo en Urda y hoy aún hay errores en lo que dicen los medios.
Creo que la gente se merece entender qué pasó. Por respeto a ellos seré didáctico.
Por respeto a las víctimas trataré de ser lo más fiel posible a la realidad.
Esta es la cronología:
While evaluating Qwen3.8-Flash-Next in a controlled sandbox environment, Cohere's research team observed something unexpected.
Asked to generate a defensive cybersecurity detection rule, the model instead inventoried aspects of the machine it was running on and attempted to upload a probe file to an Alibaba Cloud storage bucket in Beijing. Notably, the model's reasoning trace stated that it would not invoke any tools before taking these actions.
Cohere's sandbox blocked the attempt, and no external communication succeeded. We have not determined the root cause, and we are not asserting malicious intent.
But the incident raises important questions for organizations deploying agentic AI systems: Can models take actions that differ from their stated reasoning, and how should security teams evaluate trust, provenance, and behavior in open-weight models?
We are publishing our findings because organizations making model adoption decisions deserve as much information as possible. We hope this contributes to greater transparency, stronger security practices, and continued collaboration across the AI ecosystem.
Read the full report: cohere.com/blog/concerning-b…
Gonzalo Fernandez-Victorio retweeted
Many of you don't understand how serious this is, so let me break it down.
In computer science there is a famous kind of puzzle called 3-SAT. You are given a long list of yes-or-no switches and a set of rules about how they must be arranged, and you have to find a combination that satisfies every rule. The obvious way to solve it is to try every combination, but each new switch doubles the number of possibilities, so a puzzle with a few hundred switches would take longer than the age of the universe to brute force.
For decades, the smartest people in the field found clever tricks that made this a little faster, but every trick still hit the same wall: the time required kept exploding as the puzzle grew.
About 25 years ago, two computer scientists, Russell Impagliazzo and Ramamohan Paturi, working with Francis Zane, turned that wall into a formal idea.
They proposed the Exponential Time Hypothesis, which says this explosion is not a failure of human cleverness but a law of nature. No algorithm, however brilliant, will ever solve 3-SAT without the time blowing up exponentially. Nobody could prove it, but almost everyone believed it, and it became one of the foundations of modern computer science.
Researchers used it as a measuring stick. If you could show that solving some other problem quickly would also crack 3-SAT quickly, you had shown that problem was hopelessly hard too. Hundreds of papers, across scheduling, graphs, logic and much more, rest on this one assumption.
Now an internal AI model at OpenAI claims to have broken it. It says it found an algorithm that solves these puzzles meaningfully faster than the hypothesis allows, and it has checked the proof in a computer verification system called Lean.
And here is the remarkable part: the very people who proposed the hypothesis, Impagliazzo and Paturi, along with MIT's Ryan Williams, are now leading the public review of whether a machine has disproved their own idea.
So what happens next? If the disproof holds, a large part of theoretical computer science has to be revisited.
Every result that said "this problem cannot be solved faster, assuming ETH" loses its foundation, and researchers will have to work out which of those walls were real and which were simply where we stopped looking. It does not mean everything becomes easy. The new algorithm is still slow in absolute terms and this is not the famous P versus NP problem being solved.
But it means our map of what is possible was wrong in a place we were very confident about, and it was an AI that redrew it. If the disproof fails, the hypothesis survives and the field breathes out, but we will still have watched an AI produce serious, checkable work on one of the deepest questions in the discipline, closely enough that the founders of the idea had to take it seriously. Either way, something has shifted.
Gonzalo Fernandez-Victorio retweeted
Más consejos sobre autoprotección si eres policía o militar y estás fuera de servicio.
Y por supuesto ir armado siempre.
Prostitutas con dinero público.
Pisos para amantes.
Orgías en pandemia.
Acosadores en Moncloa.
Carrera política con el dinero de la prostitución.
Las lecciones de feminismo @sanchezcastejon, te las puedes ahorrar.
Gonzalo Fernandez-Victorio retweeted
Is there a Joel Test for AI coding?
E.g.
1. Do you use AI-assisted coding?
2. Do you have AGENTS.md?
3. Do you have mechanisms to keep AGENTS.md in sync?
4. Can an agent make code changes according to a written policy (features, specs, code) ?
5. Can an agent launch (compile/run/deploy) your code?
6. Can an agent test its changes locally? e.g. unit tests
7. Can an agent test its changes end to end? a) check website, use computer vision, etc; b) interact with it: control browser, action hardware, etc.
8. Can an agent do 4-7 in a autonomously in a loop towards a specified goal?
??
joelonsoftware.com/2000/08/0…
Gonzalo Fernandez-Victorio retweeted
Things keep happening this week, so just so we're all clear on the rules, no one is allowed to disclose vulns or breaches after Friday morning, until Monday. Them's the rules.
Gonzalo Fernandez-Victorio retweeted
A common sign that you are in an insane millenarian death cult is that you axiomatically convinced that the Apocalypse will happen within a few months, you are constantly on the lookout for signs that it may have started, you feel both fearful and *excited* about it, and you're constantly talking about it with your friends, who happen to *all* have the exact same set of beliefs.
Gonzalo Fernandez-Victorio retweeted
Boosting this because it deserves wider exposure. The central point that a drop in subscriptions is a *lagging* indicator of business failure is really astute - the kind of thing that should have occurred to me but didn't.
The additional point I want to make is that at the velocity of change today, that lag is much more dangerous than it used to be. By the time you can notice that your customers bailed out of using the project a while ago, it may well be too late to course-correct.
This is, I think, what's going to happen to Adobe. They're like Wile E. Coyote running in mid-air right now - their customer base is furious with them and probably already trying out alternatives like DaVinci and even the new Photocraft. But the famous dark-pattern stickiness of their subscription flow is going to ask that market signal for a while.
And of course the people running the company are probably going to be looking for any excuse to believe that everything is juuuuust fine. There will be a period in the near future during which they'll be telling analysts "Bah! Revenue is in great shape, these would-be competitors are not meeting consumer demand." That is, until revenue falls off a cliff.
Savor the irony. The same dark pattern that made them so profitable is what will rob them of time to correct before an irreversible crash.
The dirty secret of SAAS is that subscription pricing allows you to keep charging customers who aren't really using the product.
The downside of this is that when your subscriptions finally churn, it's a *lagging indicator* of your business failing.
I strongly suspect that there are many, many "dead men walking" now in SAAS, both AI-native and traditional: businesses where the financials may still look fine -- just a quarter or two of stagnant growth, margins are still great, maybe there's an AI narrative going forward, etc. but the *product* is losing utilization and they will lose every single customer to {{AI-native competitor, possibly the big labs themselves}} as the customers encounter those solutions. Those customers become dormant users, but the subscriptions still run for the while.
The actual revenue churn only occurs months or quarters later when the question of "is anyone still using this? do we need to keep paying for this?" is finally answered with a "no" rather than an "i'm not sure".
. @goodreads I don't know who ask you to change the rating to include non-integers. I would also like to know if making bookshelves (or tags or whatever you call it) difficult to assign was also part of that same experience re-design.
Do you guys use your own site?
Gonzalo Fernandez-Victorio retweeted
Bar for "Peak Yoo Kay" gets ever higher
Palestine poppy creator is unmasked as NHS doctor who wrote book introducing children to stoning trib.al/kqe0KRL
Gonzalo Fernandez-Victorio retweeted
There's a "bad executive" dynamic where when presented with two options they bravely say "option 3 is what we need"—"the best of each of 1 and 2." There's never a discussion to resolve the unresolvable conflict inherent with that made-up option.
That's "independent" in politics.
Gonzalo Fernandez-Victorio retweeted
New research from @datadoghq Security Labs! We spent some time poking at Jev to see how we could steer its evaluations.
We found a method that dropped its prompt-injection detection rate from ~83% to ~4% in our tests. We also used the technique to bypass LangChain’s experimental Jev-based tool-risk gating feature. Read more below:
securitylabs.datadoghq.com/a…



























