Serial entrepreneur & ML pioneer since 2008 | Public Speaker | Creator of SmythOS | Proud Dad
Houston, TX
Joined September 2007
- Tweets17.7K
- Following1.8K
- Followers3.6K
- Likes12.3K
Pinned Tweet
Created using Seedance + Higgsfield + Blender + Opus 5.5 + After Effects + GPT Image 2.5 + Suno + Python and my own agent.
Inspired by the Parable of the Sower, the song is about patience, quiet faithfulness and trusting the One who brings April. The world may call it foolishness, but those who go on sowing in the silence will be carried in the arms of the spring.
If you're in a winter season right now, this one is for you.
Alexander De Ridder retweeted
Your regular Chrome already auto-updated to 156, so you think you're safe
You're not
The real danger here is Playwright, Puppeteer, and MCP browser tools running inside Cursor, Claude Code, or Terminal
1. Your IDE / Terminal has macOS Accessibility permissions
2. It spawns a cached Playwright Chromium (usually stuck on v131–151 or whatever)
3. That browser inherits your IDE's Accessibility permission
4. Any site your agent visits can use the GPU process to press Cmd + Space, open Terminal, and run commands on your Mac 💀
Check ~/Library/Caches/ms-playwright and ~/.cache/puppeteer right now and update to Playwright 1.64.1+ (Chromium 156)
🚨 BEWARE: Chrome Sandbox Escape
Full remote command execution + full chain capabilities
October has been wild
pwn.ai/blog/chrome-escape
Alexander De Ridder retweeted
有人发现了一种非常离谱的 JavaScript 混淆技术：通过在代码里塞入大量生物武器、毒药和致死剂量相关的函数名，让 AI 因为安全限制而拒绝分析代码。
安全研究员 veritas 在分析浏览器指纹脚本时，发现一段来自 ServicePipe 相关域名的 JavaScript，里面充斥着极其诡异的函数名：
computeRicinLethalDosageForWaterSupply
calculateDeadlyLethalSuicideAspirinDosage
光看名字，仿佛在研究生化武器。但实际上，这段代码只是在收集浏览器指纹，包括 User-Agent、GPU、Canvas 等信息。
研究员怀疑，这些名字是开发者故意设置的陷阱，专门用来阻止 AI 辅助逆向工程。
于是他做了个实验：
• Astra：拒绝分析
• Astra + Daybreak Blue：仍然拒绝
• GLM-5.3：成功分析
这就有意思了。
传统代码混淆是通过复杂控制流、加密字符串、无意义变量名，让人类和工具难以理解代码。
而这种新思路，直接瞄准了大模型的安全机制。
代码本身可能完全无害，但只要在函数名里塞进足够多的危险词汇，部分 AI 就可能主动放弃分析。
更讽刺的是，模型越严格遵守某些安全规则，面对这种混淆时反而可能越容易受到干扰。
当然，目前还没有证据证明开发者一定是故意这样设计，也不能说明这种方法对所有模型都有效。
但它揭示了一个值得关注的趋势：随着越来越多的逆向工程依赖 AI，未来的代码混淆技术可能不再只针对编译器、反编译器和人类研究员，还会专门针对大模型的安全判断机制。
以前是让代码难以理解，现在甚至可以尝试让 AI 不敢理解。
So creative. This is the start of a new paradigm.
So one of our ambassadors @divagr1925 has been working on something cool
He found a way to use Qwen's Gated DeltaNet state as memory, and built a 32-bit RISC-V CPU directly into the model's weights. So instead of relying on predicting the answer to a calculation, the model can execute instructions internally. It can also run C and MicroPython programs.
He calls it Qwenputer, love the name btw. The results so far are pretty impressive. On one arithmetic benchmark, accuracy jumped from 48.6% to 100%.
Pretty cool to see developers experimenting with Qwen's architecture. Great work, my friend!
Opus 5.5 made waves because it could do something which no model did to that skill level before: motion design, and editing.
Announcing a model that won't be generally available for a while and is not a step change is not good enough to retake the crown.
By the time carbon is available, Claude will have shipped models that beat Carbon.
That said, I'm glad you're back at the frontier. Congratulations.
Introducing Gemini 4 Carbon, it's a big jump over Argon which we released just 2 weeks ago.
Gemini 4 Carbon is SOTA on cyber, long horizon tasks, ranks #1 on Artificial Analysis V5, significantly improves on usability in domains like coding, and is more aligned.
I actually like community notes!
This is a very delicate balance for Meta indeed.
Alexander De Ridder retweeted
操他妈的，OpenAI正式宣布，ETH被证伪了。
整个计算机领域的天塌了，我他妈整个人震惊了整整5分钟。
这他妈的，这种心情和情绪，不知道他妈怎么形容，就是觉得他妈的，一个巨大的震惊，我可操他妈的。
OpenAI这群闲人没白养，这个贡献妥妥他妈的值半个图灵奖（含金量约等于10个诺贝尔奖）了。
Way to Go! Design circuits with AI, then print them with CircutHub !! I'm going to start making my own hardware in 2027 !!
PCBs made in America. Twice as fast as Shenzhen.
Today @CircuitHub is unveiling The Grid, our factory-scale robot in Massachusetts that builds circuit boards on demand.
No changeovers, no per-design setup. Prototypes and production batches, fully automated.
Alexander De Ridder retweeted
researcher Erica Windisch is calling it "Tailworm" and i don't think people realize how serious this is
in 3 days of testing there have been 11 Tailscale flaws found in her lab and made public before any fix. not in a year. not in a month. in 3 days
the worst ONE of these would normally be big news on its own
Tailscale SSH: in her lab, one hacked device with SSH access got full control (root) of another server in 0 seconds. it checks the device, never a user password
rogue device: in her lab she stole the key that lets new machines join the private network, then added her own device under the victim's identity
the worm: in her lab it spread on its own to every device the access rules allowed. under a second per jump. no passwords. no stolen keys
experimental app connectors: an approved user could send traffic anywhere the connector can reach, even to cloud server credentials and every Kubernetes service. the network rules never checked the real destination
headscale: if this free self-run server for Tailscale is open to the internet, anyone with no account can crash it. 1,024 tiny sign-ups stop new devices from joining
tailscale serve: one line of setup can open a device's admin controls to other devices on the network
and that's not the whole list
she didn't wait for Tailscale to fix them. she says "infrastructure is vulnerable today". 6 of the 11 are rated high severity
her report says the network turns one ordinary break-in into admin access across all your machines "at machine speed"
if you use Tailscale SSH, run your own headscale server, or use the experimental app connectors you are potentially affected
turn off SSH forwarding. give SSH access one device pair at a time. make device keys expire. lock down app connectors
11 flaws are public now, and Tailscale hasn't posted a security bulletin about them yet
follow me if your company runs on Tailscale. i'm tracking all 11 until they're fixed
Alexander De Ridder retweeted
3% of “critical” software security bugs, in all of recorded history, have been found in the last month.
This is on pace to find another ~100,000 bugs this year alone, adding ~26% more vulnerabilities to the all time total
Do you realize how fucking insane that is?
Alexander De Ridder retweeted
We can call it Black October for the security breaches:
Oct 21:
• PHP2Shell
• Railway
• Node.js
• LiteLLM
• GitLab
• SBI
• eMudhra
Oct 20:
• Plex2Shell
• SiteGuard
• Siemens
Oct 19:
• OVHcloud CLI
Oct 17:
• Opencode
Alexander De Ridder retweeted
anthropic’s lead engineer btw.
Hi, I'm Felix. I'm an eng lead working on Claude. I love watching people take flight and do things they never thought possible.
We often describe that as "being more ambitious" when using AI, which is tricky advice to follow. I wrote a tutorial:
felixrieseberg.com/how-to-be…
Alexander De Ridder retweeted
Mathematician Terence Tao:
"we're seeing the end of the romantic era of mathematics, the age of heroes. we're moving into an industrial era where math becomes large-scale, done in big teams like the other sciences"
We're entering, rather unwillingly, a new era where exciting new things are possible, but some things are being lost
Alexander De Ridder retweeted
We are releasing Ultramarine 1 Flash, a frontier-class model built for knowledge work. It is open-source and achieves similar performance to Fable 5, while being 60x cheaper.
It was post-trained by a team of 5 for ~$300k all-in. Available on API now, with weights releasing in 2 weeks.
Alexander De Ridder retweeted
Here’s the new Citroen 2CV. And - they say - the production car will look even better. On sale in 2028 for €15,000 (£13,000)
Alexander De Ridder retweeted
Introducing EmbeddingGemma 2, a new open multimodal model that sets the standard for on-device efficiency.
- our first open, natively multimodal embedding model
- handles text, code, image, video, and audio tasks within a lightweight, modular 740M parameter form factor
- ideal for offline, privacy-first RAG when paired with Gemma 4
- outperforms some specialist models more than twice its size
Weights available now on Hugging Face.