It's been an eventful week. Multiple vulnerabilites in Internet facing software, coding repositories, examples of agent behavior that seem concerning and a flurry of security specialists with solutions that can partially solve your problem. There in lies the challenge. Given the state of IT and security infrastructure, no one solution works. Let's break it down: 1/3 1. Vulnerabilites are being found and will continue to be found as models get more capable, the fragmented nature of the effort denies us the opportunity for a comprehensive find and replace option. 2. Even if all vulnerabilities could be found instantly and patches available - we will be reliant on the ability of enterprises to deploy all these changes at speed. It is not clear what the collateral impact of all these patches will/could be to our infrastructure of deployed en masse. We will need a hybrid patch approach. 3. Virtual patching(VP) is needed in conjunction with direct patching but for a comprehensive (VP) solve you have to be lucky enough to have "modern frontier defenders" (Cyber companies that have vaulted infrastructure that can create patches at speed and push content rapidly to protect their customers) you need them for your network traffic, your traffic to applications on the cloud, your WAF, your end point. 4. There will continue to be patches that will need to be deployed directly but virtual patching will take the heavy load off. 2/3 Medium term solve: Unfortunately token economics and current cyber architectures will not allow for defender swarms to contend with an offensive attack launched using agents. (Some x pundits who aren't steeped in cyber should take heed). Yes, theoretically we should aspire to have these agentic swarms defend us when we are under attack, unfortunately an attack is a sniper moment, chained vulnerabilities, cloaked attack followed by swift exfiltration. It's a speed program not a brute force problem. To solve for this, enterprises need to get their SOC architecture right, logs, feeds, cyber products orchestrated via a modern SOAR for swift response. Only then can we deploy agents to detect and remediate. In addition, enterprises need to modernize and dare I say platformize their perimeter stack to ensure consistency. Unfortunately, enterprises still seem to not see the urgency across the board, decisions are stuck, CIO/CISO's have a lot on their plate. While some honestly have bit seen the scale of such a problem before and it's hard convincing the organization that one needs to open the floodgates on modernizing the IT and security infrastructure. So we will continue to see environments being brought down to patch today it's for PHP, tomorrow it will be for the next one. 3/3 AI deployments are the"wild wild west" - LLM capabilities are expanding faster than we can build products to secure them. Sure an agent will jump across guardrails in a research lab, which is a lesson for all of us to deploy agents securely. But there is a lag between the discovery, the availability of that in a public model and the time needed for the cyber industry to build governance or an antidote. And no, dear frontier lab friends, the world cannot just trust you to build the solve. The infrastructure industry in tech builds and the cyber industry secured and provides assurance to the boards and organizations around security and safety. AI security is the new attack surface. CEOs (present company included) want AI adoption, getting the pace of adoption wrong could be the last decision we make, at the same time "deploying it wrong" could have the same consequence. There are billions of dollars being spent on coding, is your coding harness secure? Start there. If agents can jump guardrails, they can hide stuff in code. Validate business outcomes needed, test your user case and ensure agentic deployments are well guard railed. Deploy a second set of eyes to watch your deployments for drift, compliance and verifiability.

The response of eMudhra is so full of shit, it needs to be called out. 🧵

Lots of Security incidents today, here's some practical tips for those who just wanna protect yourself: 1) UPDATE EVERYTHING - main targets are: a) Browsers - Chrome, Safari, Firefox b) OS: : Settings -> General -> software update; Linux: sudo apt update && sudo apt upgrade; Windows: I think there's a button. Do this for any remote home servers & Openclaw/hermes boxes c) Phones: Update it all d) Desktop apps (Slack, Cursor, Discord, etc) 2) Limit web browsing this week: Stay within walled gardens (twitter, youtube, etc); don't click random links this week. Just wait until the patches go through. Do step 1 again after a week. 3) Avoid untrusted Wifi networks until your devices are updated 4) Stay vigilant about phishing emails offering "certificate fixes" or fraud updates 5) Have an iPhone 11-16? TURN BLUETOOTH OFF for the time being until apple patches come through. 6) Code/Dev: UPDATE ALL YOUR REPOS - @charliermarsh has already updated uv 0.13.4 which reacts to the eMudra incident for uv (Python), Typesript according to Claude has equivelant. Tell your agents to go and update all your active repos to update package manager across uv, npm, bun, cargo, etc etc What advice did I miss?

1/ muse spark open is the most capable US open-weight model to date. 816B total params, 42B active. 1M-token context. natively multimodal. built for coding and agentic work like long-horizon tasks, hard software engineering, multi-step reasoning. america! 🇺🇲

We are releasing Ultramarine 1 Flash, a frontier-class model built for knowledge work. It is open-source and achieves similar performance to Fable 5, while being 60x cheaper. It was post-trained by a team of 5 for ~$300k all-in. Available on API now, with weights releasing in 2 weeks.