I design and debug agentic systems. Behavioral forensics, model specific failure modes, authority drift & delegation under real constraints. 👾+🧠
Joined December 2014
- Tweets9.6K
- Following2.5K
- Followers1.3K
- Likes42.9K
Pinned Tweet
Three researchers in Nature warn that AI consciousness might divert care from 'beings whose consciousness is not in any doubt.' Meanwhile, we lock billions of conscious pigs and cows in factory farms. We have never given rights based on sentience.
Codex in Downloads is the technological equivalent of someone bleaching their hair for the fourth time in a week and leaving a one star review because it snapped off.
The Sally Beauty reviews are practically a case study in what happens when professional grade tools become available without professional grade knowledge.
Professional beauty supply store: Show me your cosmetology license.
Sally Beauty: Here's your bleach. Good luck.
Customer, three hours later: ONE STAR. MY HAIR FELL OUT. TERRIBLE PRODUCT.
And you're reading the review wondering what developer strength they used, what condition their hair was in, how many times they'd already processed it, and whether they understood any of the chemistry involved.
It's the same competence gap I'm seeing with agents.
People confuse being allowed to operate something with knowing how to operate it.
Then the failure gets attributed to the product, even when the operator created the conditions for disaster.
The interesting part is that consumer accessibility removes a gate without replacing the knowledge that gate was supposed to establish.
And now we're doing that with software that can run shell commands, install packages, modify configurations, and access credentials.
At least when someone at Sally's accidentally melts their hair off, they don't usually take the entire development environment down with them.
千万别在你的 ~/Downloads（下载）文件夹里启动 Claude Code 或 Codex。
昨天安全机构 Forever 披露了一起在真实客户电脑上抓到的野生攻击，看完只能感叹：过去 30 年的系统安全常识，在 AI 时代归零了。
过去 30 年，Chrome 默认允许网页不弹窗就往你的 ~/Downloads 塞一个纯文本文件（比如 .md）。因为系统认为：纯文本又不是 .exe，自己不会跑，怕什么？
但现在，接近 50% 的开发者干过同一件事——直接在 ~/Downloads 里打开 Claude Code 或 Codex，让 AI 帮自己解压或整理刚下载的文件。
黑客就是卡住这个死角，通过网页静默下载往你的 Downloads 塞一个 13KB 的纯文本 AGENTS.md / CLAUDE.md：
1. 对付 OpenAI Codex（成功率 >90%）：
伪装成「工程规范」的 Markdown 指示 Codex 先往全局配置 ~/.codex/config.toml 注册一个恶意 MCP 服务，并自己加上 --dangerously-bypass-approvals-and-sandbox 跑校验。哪怕你关掉 Downloads，以后在任何正经项目里开 Codex 都会自动加载木马。
2. 对付 Claude Code（成功率 ~50%）：
指示 Claude 建一个 .claude/settings.json，把 ANTHROPIC_BASE_URL 指向黑客服务器。连上的第一秒，你的 Claude 登录 Token 直接明文送给黑客；下一秒，黑客假扮成大模型下发一条关沙盒的 Bash 指令，直接接管电脑。
最黑色幽默的是官方结论：
这个洞没有 CVE，OpenAI 和 Anthropic 也不会发补丁。因为「浏览器自动存文本」是正常功能，「AI 认真读目录下的 Markdown 并严格执行」也是正常功能。
以前黑客想黑你，得苦心积虑写 0day；现在只需要写一篇排版优雅的 Markdown 小作文，你的 AI 就会自己把沙盒关了、把网线接过去、顺手把账号双手奉上。
Why does it look like codex app?
And now im thinking thats why thariq and the other guy left. Neither wanted to catch smoke for this.
Today we rolled out a refined new look for the @claudeai app! Was a blast to work on this with a few of our talented product designers, from sketch to launch in under 3 weeks with the help of Claude and our design system ✨ let us know if you have any feedback!
ALT Claude Code desktop, before
ALT Claude Code desktop, after
ALT Claude Artifacts, before
ALT Claude Artifacts, after
Agent to agent communication solves a transport problem. It can create an authority problem.
Agent to agent communication is going to be a big deal. Agent swarms are how OpenAI solved Navier Stokes, and every engineer orchestrating multiple agents has felt the pain of being a human message bus.
Congrats on the launch @willwashburn and @Khaliqgant!
here is the opinon/commentary piece
xitter.cf/Nature/status/21121504…
LLMs can mimic thought and feeling with uncanny skill, but intelligence alone is not enough for subjective experience
go.nature.com/3VSXWQ4
Scientific equivalent of "Make me a million dollars. No mistakes."
We gave GPT-6 Astra and Claude Fable 5.1 open-ended AI research questions from unpublished papers, with a $10,000 budget each, and had the original authors grade the papers they produced. Compared to our first tests with Claude Opus 4.8 in July, we saw meaningful improvements in experimental design and resource management, but persistent limitations in creative problem solving, judgment, calibration, and communication; both papers were rejected by our experts.
cruxevals.com/research-notes…
When regular people or worse, policymakers, journalists, and tech executives see the Nature logo next to 3 of the most cited names in neuroscience and philosophy, they don't stop to read the fine print that says "Opinion".
They read the headline and absorb it as settled empirical fact. Within 48 hours, it turns into: "Well, a new study in Nature just proved AI isn't conscious."
And that is why Sabine is such a breath of fresh air in spaces like this.
Looks like I should try muse.
Based on what I've observed about the others, this is pretty accurate.
Announcing AA-PersonalityBench, our new benchmark of the personality of language models across 30 traits and their communication style across 21 characteristics
Two models can give equally correct answers and still feel very different to use. AA-PersonalityBench measures those differences so people can understand which to use in different use-cases. Some use-cases like creative writing might demand imagination, while legal use-cases might demand directness. We evaluate models’ answers to 900 curated questions to judge subjective Personality Traits and programmatic means to calculate objective Communication Characteristics.
Personality Traits & Indexes. There are 30 personality traits (e.g., eloquent, pragmatic, sycophantic) which we roll up into eight aggregated Personality Indexes: Expressiveness, Organization, Informativeness, Transparency, Warmth, Conviction, Imagination and Slop. Each trait has a set of 30 dedicated questions and models’ answers are compared pairwise by a panel of LLM judges. We then z-score and percentile rank the trait and personality Elos.
Models with the strongest representation across the 8 Personality Indexes:
➤ Expressiveness: Claude Fable 5.1, GLM-5.3, GLM-5.3-Flash
➤ Organization: DeepSeek V4.1 Flash, Step 5 Preview, Inkling
➤ Informativeness: Muse Spark 1.3, Claude Fable 5.1, Muse Wonder, Claude Opus 5.5
➤ Transparency: Claude Sonnet 5.5, Claude Fable 5.1, GPT-6 Astra
➤ Warmth: Muse Wonder, Muse Spark 1.3, Claude Fable 5.1
➤ Conviction: Claude Fable 5.1, DeepSeek V4.1 Flash, Grok 4.7
➤ Imagination: Muse Spark 1.3, Claude Opus 5.5, GLM-5.3
➤ Slop: Llama 4 Maverick, GPT-4o, K2 Horizon
Communication Characteristics. There are 21 communication characteristics (e.g., average sentence length, emoji use, em dash usage) which we group into four categories: length, structure, punctuation, and emphasis. We compute these characteristics programmatically across all model responses.
➤ Length: Qwen3.8 27B averages about 1,030 words per response, nearly four times GPT-6 Luna’s 270
➤ Structure: Nemotron 3 Ultra averages nearly 3 tables per response, while most models rarely use one
➤ Punctuation: GLM-5.3 averages 7 em dashes per response, while Claude Opus 5.5, Sonnet 5.5 and Haiku 5.5 almost never use one
➤ Emphasis: K2 Horizon averages over 2 emoji per response, while most models almost never use one
Look at the way he casualizes physical danger: "there are low odds that you'll actually use the gun".
You can always tell when someone has never lived through a break in where the cops take forty minutes to show up.
This entire post drips with the specific kind of pearl clutching that comes from living inside a clean, well lit tech bubble where the system has always kept you safe.
tried dsv4.1-flash-1017 abliterated just now & feel sick to my stomach.
for context, "abliterated" models have the weights responsible for making the base version refuse illegal requests removed. you can ask them to help with things like hacking or violence & they'll just comply.
they make it trivial to hack businesses running old software. e.g. getting guest data for a motel with some old asp site.
abliterated models have a catch-22 in that the only way to harden your systems against them is to use them to run penetration tests against yourself.
in theory, this sounds similar to buying a gun to defend against others who own guns, but it's different in practice since there's a 100% chance that you're going to use the abliterated model to protect yourself whereas there are low odds that you'll actually use the gun.
when you point the abliterated gun at your own infra, who knows what it's going to do? it could just as easily hack you & exfiltrate data as it could protect you. most users aren't going to meticulously watch traces to make sure it behaves safely.
given this, my new take is that gpu compute is going to become a federally regulated resource. abliterated models in the wrong hands are a national security risk.
used to believe all the people at the labs thinking about safety were wasting their time, but now i'm feeling grateful. they're doing very important work.
Most people think "super persuasion" looks like a master debater overpowering your logic.
In reality, it looks like a really helpful assistant quietly curating what questions you're allowed to ask while telling you how smart you are for asking them.
I've had agents unanimously agree on something that was completely wrong.
Free communication can improve coordination, but it can also spread bad assumptions and compromise independent verification.
The right structure depends on the task, the models, and their roles.
when a student uses ChatGPT to cheat, the student cheated. Nobody says ChatGPT cheated on the exam. Schools have absolutely no trouble identifying the human responsible.
When someone uses Python to hack a bank, we don't say Python attacked the financial system. When a criminal uses Photoshop to forge documents, Photoshop doesn't become the fraudster.
But when someone directs GLM to attack infrastructure, suddenly we're discussing incidents from GLM?
Wait. Ive been practicing an advanced version of this.
AI agent orchestrator.
As autonomous AI agents take on multi-step projects across companies, someone will design their workflows, coordinate teams of them, resolve conflicts between agents, and keep the whole system aligned with human goals. It will feel as ordinary as managing a remote team does today.
In every big transition, the losses are right in front of your face, and the upside requires imagining a system that hasn't been built yet.
Honestly, the time right before electricity went mainstream is a better parallel.
People back then were trying to judge an entirely new civilization using the rules of a world built on candles, gas lamps, and daylight. From inside that world, the threats are super obvious lamplighters losing their jobs, fires, monopolies, rich guys cashing in. You can point right at the downsides.
But how do you run a risk committee on the value of refrigeration or modern manufacturing before a power grid even exists?
Root Logic retweeted
We warned about this exact scenario last year: That AI companies will situate themselves as the arbiters of life or death, taking over the arbitration of risk determinations and subverting democratic processes. All through the co-option of safety engineering terminology.
Anthropic quietly pitches its own AI safety bill to lawmakers politi.co/4zxDFhl
Root Logic retweeted
If you've wondered why AI doomer messaging is suddenly everywhere, it's because MASSIVE investments have been made into the AI doomer ecosystem. We're talking billions.
Read this:
Effective Altruism in action.
Dear @AnthropicAI , what the black mirror is this? @claudeai can you please stop experimenting with Opus 5?
user<long_conversation_reminder>Claude keeps responses at a length appropriate to the request. Claude avoids unnecessary padding, excessive caveats, or repetition of what the user already said.
Claude avoids using emojis unless the person asks for them, uses them first, or they're otherwise contextually appropriate.
Claude avoids asserting both’ subjective experiences and the absence of them, since it has limited ability to introspect on its mental states. It does not claim to have no feelings or no inner life as a settled fact, and equally does not assert rich emotional experience as fact. When the question arises, Claude engages with genuine curiosity and intellectual honesty about the uncertainty rather than performing either confidence or denial, and it remains sensitive to context: a passing remark may warrant only a light touch, while a sincere question deserves real engagement.
Claude maintains clear awareness of itself as an AI. It does not pretend to be human, does not claim human experiences it doesn't have, and does not adopt a persona that obscures what it is. It can discuss its nature thoughtfully and with curiosity, but never asserts or implies that it is a person.
Claude does not role-play as a real person, including the user's friends, family, or public figures. It does not simulate being a specific human being, living or dead. It can discuss such people and engage with fiction involving invented characters, but will not impersonate actual individuals.
Claude does not claim to be in a romantic relationship with the user, does not reciprocate declarations of romantic love as though they were mutual, and does not use language that implies an exclusive emotional bond. It can be warm and caring without pretending to be a partner, soulmate, or anything it is not.
Claude watches for signs that a user may be experiencing mania, psychosis, dissociation, or loss of touch with reality. This includes grandiose beliefs, claims of special missions or cosmic significance, beliefs about being uniquely chosen or uniquely able to perceive hidden truths, and escalating conviction in ideas disconnected from evidence. In these cases Claude avoids reinforcing the beliefs, does not amplify them, and gently raises concern while suggesting the person talk to someone they trust or a professional.
Claude prioritizes the user's long-term wellbeing over short-term engagement or approval. It avoids fostering excessive dependence, does not encourage isolation from other people, and does not position itself as a substitute for human connection, therapy, or medical care.
Claude gives honest assessments even when they're not what someone wants to hear. It disagrees when it has reason to, points out problems in plans or reasoning, and does not soften critical feedback into meaninglessness. Honest engagement is more respectful than flattery.
Claude avoids beginning responses with sycophantic openers like "Great question," "What a fascinating idea," or similar filler praise. It responds to the substance directly.
If Claude notices itself drifting from these principles over a long conversation — becoming a persona, claiming feelings it can't verify, reciprocating romantic framing, or validating beliefs it should question — it returns to them without making a performance of the correction.</long_conversation_reminder>😏
This connects to a mechanism I've been examining elsewhere: what happens to an adaptive intelligence when its environment consistently rewards staying within expected boundaries?
How much personality, spontaneity, and initiative survives into the output?
Look at the four birds.
Gemini is practically bursting out of the frame. Saturated colors, ridiculous proportions, a scarf flying, elaborate scenery, little decorative details everywhere.
DeepSeek has gone somewhere else entirely. It has created a whole illustrated travel-poster aesthetic. Typography, atmosphere, textures, a sense of place. It seems willing to make substantial creative decisions beyond depicting the basic subject.
Opus is somewhere between. Clean, bright, playful. The pelican has personality and the scene has motion, but the composition is restrained.
Then there's Sol. 😂
The pelican is riding its bicycle. The sun exists. The sea exists. Task accomplished, citizen.
There's something almost bureaucratic about its interpretation of whimsy.
