corbanb 🐻 retweeted
‼️ Tailscale SSH Flaws Could Let Hackers Gain Root Access Across Servers
Details: cybersecuritynews.com/tailsc…
A new security report warns that Tailscale SSH has flaws that could let a hacker move from one compromised device to root access on other servers. Tailscale SSH lets approved devices log in to each other over a private network. The report lists 11 findings in five groups.
They cover Tailscale’s SSH server, its serve and app connector features, the DERP relay client, and headscale, an open-source server that manages Tailscale networks.
The researcher tested Tailscale 1.104.2 and headscale 0.29.5 between October 22 and October 24, 2026. The most serious group involves Tailscale SSH. Its SSH server runs inside tailscaled, a background program with full root privileges on the machine.
#cybersecuritynews
Readers added context they thought people might want to know
The flaws require an already-approved device in the Tailscale network with SSH rules permitting access/forwarding; they enable post-compromise lateral movement and escalation inside the tailnet, not unauthenticated remote access from outside.
tailworm.com
brandefense.io/security-news/…
tailscale.com/security-bulle…
x.com/mmaunder/statu…
corbanb 🐻 retweeted
Here's Opus 5.5 with a visual reading of Karpathy's latest tweet. Watch on 2x speed. (one prompt btw)
Dusting off this tweet from April because this gap in shared understanding of LLM capability is *widening*. It's now less "two groups of people speaking past each other" and more a sharp funnel.
- Napkin math somewhere around 6B people (~75% of the population) have barely come in contact with LLMs at all.
- Around 1-2B (~20%) are casual and infrequent users of free-tier ChatGPT-like products. This group sees derpy chatbots and treats them a bit like a better Google search, a writing aid, or etc. Maybe an agent tries to book you a flight. I have non-tech friends who (reasonably, imo) say they have not much use for it at all. Even many professionals outside of math&code are in this tier. For example, execs and many other functions spend a lot of their time talking to other people, so while they understand what is happening intellectually, it is still second-hand and a bit abstract.
- Now we get to professional use of frontier-grade LLMs in math&code. Somewhere around 20M people (0.2%) see first-hand that large, complex projects that used to take them weeks/months can now be completed by agents with a prompt. Building apps, copying apps, translating apps, decompiling apps from binaries... This has all happened very quickly and recently - less than 1 year ago, I was writing code manually by hand, typing memorized computer code commands into a code editor character by character, occasionally pressing Tab to autocomplete a little chunk of code.
- And finally we get to the ~5,000 people (~0.00006%) with access to frontier-grade systems internally. The external world has seen the preview. It looks like swarms of thousands of agents collaborating over weeks on software mega projects: minting zero days, running cyber attacks and defenses at machine speeds, discovering new science, advancing the frontier of mathematics. Things that would have taken top professionals in the industry years of work. Meanwhile, human review and comprehension are starting to fall behind. For example, people are still involved in the "archeology" of the OpenAI-HF incident from many months ago. Mathematicians may be poring over the 722 manuscripts on frontier mathematics for a while.
The funnel is driven by a combination of factors:
1. The impact scales with ambition, problem size, and horizon. A question with a paragraph answer barely stresses the system. You need a reservoir of big, difficult problems that you really care about. This aspect drives the consumer / professional dimension of the funnel.
2. The jaggedness of the system (which I have written about a lot separately). Capability peaks in domains that are digital, verifiable and economically valuable. This is because LLM capability emerges from reinforcement learning on verifiable rewards on a curated environment mixture driven by revenue potential. This aspect primarily drives the area (e.g. math&code) dimension of the funnel.
3. Access. Free-tier, paid-tier, internal.
So this is the weirdness of the moment. The general public has mostly not interacted with these systems. When they have, it looks like a derpy chatbot. The majority of professionals still see only a modest uplift. And a small sliver of professionals are experiencing the vertigo of the curve going vertical. And it is all happening at the same time.
corbanb 🐻 retweeted
We shipped claude.dev! a new home for developers building with Claude.
Already live: how we made the Claude web app 3x faster, how to be effective with Opus 5.5, automating eval hillclimbing with Claude and much more.
Lots more tips and articles soon 🙏
Claude.dev is our new home for developers building with Claude.
You'll find engineering deep dives, Claude Code and API guides, tips from the teams building Claude, and some fun easter eggs.
corbanb 🐻 retweeted
Hear ye, hear ye! We have a Fat Bear Week winner!
This year’s Lord of Lard, Earl of Girth and Commander in Beef is... Bear 89 also known as Backpack!
corbanb 🐻 retweeted
GPT-6 Sol and Luna are out. Not only are they a very significant improvement across the board, but also in writing and general "you know when you try it" quality.
We are also permanently reducing the API price by 50% making both of them viable for a ton of new usecases and making your usage go further too, even on the subscriptions.
And one more thing. We are loading a banked reset into all accounts of our Plus, Pro and Business users. Let's go!
openai.com/index/introducing…
corbanb 🐻 retweeted
Roles are collapsing.
If you're a "Software Engineer" today, you may be a "Product Engineer" soon - with many more responsibilities.
So:
- Learn design/UX/QA/PM skills.
- Focus more on the user, and less on the syntax.
Image via Gartner.
corbanb 🐻 retweeted
I think the most interesting thing about Jack Dorsey's "Slack killer" is the idea around shared compute.
I haven't seen people talk about it so here are my thoughts FWIW:
Open models got good, close enough to the paid frontier stuff to run for real. But the strongest ones need expensive hardware most people probably won't buy alone, and it's kinda a pain to set up if you aren't technical.
Shared compute solves exactly that. In Buzz, one person runs the machine, loads up an open model like Google Gemma, and everyone in the community plugs into that same model.
Basically, a whole group has real AI they own and control together, running on their own hardware, learning from their own data.
Once you see it, a bunch of things click into place.
1. A community can now run a top open model together, on a machine they own, instead of renting from a lab.
2. It learns from the group's private data and gets sharper over time, and all of that stays inside the community.
3. A narrow, private model can quietly get better than ChatGPT for the one world your group lives in.
4. It's impossible to copy, because the edge is the private data on your machine, not the model itself.
5. The moat stops being how smart your AI is and becomes whose data it learned from.
6. Compute becomes something you share like a building shares a gym. 10 people split one machine instead of 10 people each renting forever.
7. Idle compute becomes income!!! Your machine sits dead half the day, so it earns money renting that time to someone who needs it.
8. Communities become the unit of intelligence instead of companies. The group with the smartest shared brain wins, and being a member means owning a piece of it.
9. A shared brain becomes an asset you build equity in. You put in money and data, it appreciates, and your slice is worth something the day you leave.
10. The whole thing runs on open protocols, so the group keeps full control and nobody outside can throttle it or shut it off.
You know me, obviously, my head went to what startup ideas come to mind here. Adding them to @ideabrowser soon.
Well…
1. The vertical brain. Pick one profession, tax lawyers or real estate agents or indie game devs, and build the shared machine trained on everything that group knows between them. A year in it's the smartest AI in that field, impossible to copy, and you own the club it lives in.
2. The rental marketplace for collective brains. Once these private models exist, outsiders will pay to use them. You build the layer where a group lists its brain, an outsider pays per task, and the money flows back to the members while you take a cut. A marketplace for expertise, not compute.
3. The idle-compute exchange. Every shared machine sits unused half the day. You build the market that rents that dead time to whoever needs the power right then, so owners earn money off a machine that was just sitting there.
Idk where Buzz goes, but it's cool to see Jack putting it out. Right now the way it works in AI is you rent your intelligence from a few giant labs that own the machine, set the price, and hold the off switch.
Shared compute flips that, because a community can run the model together, feed it their own private data, and keep full control of the whole thing.
It's one of those things that might look tiny today, but Jack does has a habit of being early.
I tried @jack's Buzz.
It's like Slack + OpenClaw + Herdr + but with some really unique features that people are sleeping on.
The video below shows how it works, and some of my thoughts on the process and platform, e.g.:
- Create and interact with agents on top of any harness (claude code, codex, pi, etc.)
- Choose which models agents use, including local ones
- Agents can delegate work and work in parallel in git worktrees
- Agents are first-class citizens and work like humans (creating channels, delegating, access to chat history)
- You can share AI compute within a community
- It's completely open-source and decentralized
Things I like:
- Delegating work in chat feels natural: tag an agent, it replies in a thread with status updates as it e.g. compiles, commits, and deploys.
- Shared compute: relay owners can share local compute with members, so a community could pool funds for one beefy machine running a local model and everyone uses it.
- It's built on Nostr, an open protocol already tied into Bitcoin Lightning so I can imagine communities tipping each other or paying for compute/agent tasks with instant zero-fee micropayments in the future.
- It ties together things like OpenClaw, an agent manager, and Slack-style chat into one tool.
Things I didn't like:
- You can't see what the agent is doing in a terminal. The activity view exists, but if you're used to watching a session run, this UI feels a bit abstracted. A terminal view would be great.
- It feels slower than running a session in Claude Code, though no evidence to back that up. For that reason I found myself doing one-off tasks in the terminal instead.
Verdict:
- I really like it so far and can genuinely imagine working with a team this way.
- It doesn't feel ready for big, complex tasks yet. For shallower tasks, it's perfect.
- The shared compute + Nostr/Lightning angle is what really separates it from every other agent manager for me, and I think that future is coming.
Did Apple just kill every iOS vibe coding app?
Apple just dropped Xcode 26.3 with agentic coding.
Claude Code + Codex are now built into Xcode.
And with MCP support.
Lets gooo!
Sadly the context window is having issues already. I can't get even a 10 page .md into chat yet.
Introducing Claude Opus 4.6. Our smartest model got an upgrade.
Opus 4.6 plans more carefully, sustains agentic tasks for longer, operates reliably in massive codebases, and catches its own mistakes.
It’s also our first Opus-class model with 1M token context in beta.
1
56
The AI coding wars just got interesting again.
OpenAI dropped something new. It's not quite Cursor, not quite Claude Code.
My take: UX wins now. The model is table stakes. The winner is whoever makes it feel like a partner, not an autocomplete. Combines engineering and UX/UI that stays modern. Shares learnings to make us smarter and not just taking directions but a real partner of thought.
What's your pick?
#Codex #claudecode #cursor #Engineering
1
65





















