Building @cipherowl - ex-Coinbase, cruise, twtr, amazon and msft
San Francisco, CA
Joined October 2008
- Tweets3.2K
- Following940
- Followers765
- Likes2.3K
Pinned Tweet
I wrote Good Enough is the starting line in June because I felt that open-weight models (DS, Kimi, GLM, particularly) have crossed the line into GOOD ENOUGH and are useful, so they start the data flywheel and take off. Now we have more GOOD ENOUGH models, and GOOD ENOUGH would just give you a ticket for the game - and it is NOT enough to win. Instead, if you are under the curve, you become irrelevant (until you get back to the curve)
The old post - xitter.cf/leozc/status/206654960…
leozc retweeted
Emerging markets hold more than two-thirds of global stablecoin supply—a powerful signal of demand and a major policy opportunity.
Yet many policymakers and central bankers still focus primarily on the risks of dollarization, capital flight, and illicit finance, rather than the transformative potential of stablecoins.
A new Coinbase Institute paper makes the case that these risks can be addressed through sound policy, while unlocking enormous benefits: cheaper remittances, near-instant micropayments, more efficient settlement, and new opportunities for tokenized markets and commerce.
The answer isn’t to replace domestic payment systems like India’s UPI or Brazil’s PIX, but to build on them - connecting local payment rails to global stablecoin networks, including through well-regulated local-currency stablecoins.
The policy choice is clear: establish sensible rules that manage legitimate risks while allowing innovation to flourish. Prohibition won’t keep stablecoins out. It will simply push activity offshore and out of sight.
Read the paper: coinbase.com/public-policy/a…
Decentralization is a design principle. It should not become an excuse for avoiding responsibility.
I have a hard time believing this is fundamentally a technology limitation. During a major hack, there are meaningful measures a protocol ecosystem can take without abandoning decentralization.
My concern with @THORChain is more fundamental: from what I have seen firsthand, the lack of compliance capabilities appears to be a deliberate product and governance choice—not an unavoidable consequence of decentralization.
That is a legitimate philosophy to hold. But it should be stated clearly and defended on its merits, rather than presented as something decentralization makes technically impossible.
The @THORChain team can do better.
We are devasted to hear about the recent exploit and can imagine how difficult this must be for everyone involved.
THORChain is decentralized and permissionless like Bitcoin, Ethereum, and BNB Chain.
What responsibility should Bitcoin, Ethereum, and BNB Chain bear when handling known stolen funds?
@star_okx @GracyBitget
An agent's own reasoning can make its monitor less reliable.
In @AnthropicAI's Mythos 5 incident review, an offline monitor flagged about 1% of actions when it saw the model's chain of thought. The model kept describing the live environment as a simulation. When the monitor saw only user turns, tool calls, and tool results, the flag rate rose to about 50%.
Before adding another monitor model, I would change the evidence boundary and treat the subject's own explanation as untrusted input. The next test is whether the gap survives a different model family and redacted tool results.
anthropic.com/research/align…
Start a task with frontier LLMs: slow, but very accurate - learn the pattern, encode it into features, get JEV to run it - achieve 80% cost down. Then continue to collect data - train a statistical model or generate logic in code - another 80% cost down - that is the way to build
We built a new harness using @typesafeai's Jev that cuts the cost of repetitive work by 90%. The harness learns the job as it runs, moving steps from LLM calls to code.
Running 100,000 compliance alerts costs >$290K on Opus 5.
With agentrun() we got it down to <$26K.
Update your IOS devices now!
Urgent security advisory for iOS users!
Install the latest iOS update immediately. Security researchers report that financially motivated attackers are now using a complete, in-the-wild exploit chain that can quietly steal cryptocurrency private keys and mnemonic seed phrases from iPhones.
The reported attack begins when a target is socially engineered into opening a malicious page in Safari. That page is said to abuse a memory-corruption flaw in WebKit / JavaScriptCore to gain arbitrary read/write access from JavaScript, then bypass Pointer Authentication Codes (PAC) to run native code, break out of the WebContent sandbox, and escalate to kernel/root privileges.
With that access, attackers can pull data from the device Keychain and from local crypto wallet apps.
The claimed impact range is iOS 13 through iOS 26.5; that range has not been independently confirmed in full. Until more is known, treat any unpatched device as potentially exposed and update as soon as a newer build is available. Also avoid untrusted links in Safari, especially if you keep wallet keys or seed phrases on the phone.
An unattended agent can use credentials it never receives.
@AIatMeta's Muse runs its harness and tools inside an isolated Linux cell. Sentinel sits outside as the sole authority for connector actions and network egress. The agent sees a surrogate token; Sentinel swaps in the real credential only after it authorizes the request.
Agent-platform teams should build this boundary before adding the first unattended connector. They still need a grant policy that defines which actions can proceed and which must stop for a human, plus an audit record of each substitution.
research.meta.ai/blog/securi…
Look at our current knowledge workflow; anything that requires humans to “transform” or “produce” will be replaced by AI within 18 months, with more expensive tasks being replaced earlier.
An agent's chat history is a poor place to keep operating state.
@GoogleAI researchers coauthored SKILL.state, which gives each step only the fixed skill, a structured state object, and the latest observation. In a 100-step warehouse task, it used 65k tokens versus 1.06M for a transcript-plus-state baseline, while accuracy rose from 0.91 to 0.94.
Agent-platform teams can expose the current state to operators and validate each update before it persists. Schema coverage sets the limit: once history is discarded, a fact that never entered state cannot be recovered.
arxiv.org/abs/2608.26263v3
Shared memory does not settle which agent is right.
@AIatMeta's AIRA₃ placed eighth out of about 4,000 teams in a live Kaggle competition. It used no central controller: long-running model-and-harness pairs worked in isolated environments, then coordinated through a forum and shared filesystem.
That architecture lets agents build on each other's work. Before one result becomes canonical, the platform team still needs a named reviewer and a conflict rule.
xitter.cf/AIatMeta/status/209627…
As a test of our progress to advance the frontier of AI research, in June we entered the next generation of our autonomous AI research system, AIRA₃, in a live Kaggle competition run by NVIDIA to fine-tune a 30B Nemotron model. The challenge was to teach the model to reason better — all competitors had access to the same information and were graded externally on a private test set.
AIRA₃ placed 8th out of ~4,000 teams to win Gold, outperforming human competitors who had access to the same frontier tools.
We believe this is a reliable signal that AIRA₃ can improve a targeted capability of an AI model at a level similar to human experts.
Some of the best courses out there!
I’m excited to finally announce the newest edition my Stanford course 𝗧𝗵𝗲 𝗠𝗼𝗱𝗲𝗿𝗻 𝗦𝗼𝗳𝘁𝘄𝗮𝗿𝗲 𝗗𝗲𝘃𝗲𝗹𝗼𝗽𝗲𝗿. It has been 9 months in the making.
Last November, with the release of Claude Opus 4.5, coding agents experienced a step function improvement in capability. We all felt it. The LLMs were more powerful, could reason for longer, solve harder tasks.
This year’s iteration of my course reflects the 2026 metamorphosis of software engineering.
My core belief is simple: AI-native developers of the LLM era are going to become the most important members of any software organization. I have designed my course to train this next generation of engineers.
𝗪𝗵𝗮𝘁’𝘀 𝗱𝗶𝗳𝗳𝗲𝗿𝗲𝗻𝘁 𝘁𝗵𝗶𝘀 𝘁𝗶𝗺𝗲 𝗮𝗿𝗼𝘂𝗻𝗱
First, 85% of my Fall 2025 class material is being thrown out. The Fall 2026 syllabus reflects the core capabilities AI-native engineers must have: agent skills, advanced context engineering, MCP portals, agent-ready codebase principles, agentic code review, security, parallelizing background agents, software factories, and more.
Second, I am going to teach my students how to have software taste. Every student will be required to ship pull requests to production-grade, real-world codebases. The course is collaborating with the top open-source AI repos who will offer support and mentorship to students on how to meaningfully contribute to their projects.
This has never been done before in any university course so I am incredibly grateful to our OSS Partners: @browserbase, @HeyGen, @CopilotKit, @semgrep, @OpenHandsDev, @milvusio, @marimo_io, Pi, @crewAIInc, @warpdotdev, @vercel, @cmux, @arizeai, @UnslothAI, and @anyscalecompute.
𝗪𝗵𝗮𝘁’𝘀 𝘀𝘁𝗮𝘆𝗶𝗻𝗴 𝘁𝗵𝗲 𝘀𝗮𝗺𝗲
I’m fortunate to again have AI software engineering leaders and founders as guest speakers to share their learnings from building top coding agent products. Thank you to @leerob from @cursor_ai, @bcherny of @claudeai code, @EnoReyes of @FactoryAI, @silasalberti of @cognition, @0xine of @semgrep, Rajesh Bhatia of @Cloudflare , @amasad of @Replit, and @eladgil.
All resources will be available online. All classes will be available to the public.
9/22 on Stanford campus. See you in class.
themodernsoftware.dev/
Production agents need version control for behavior.
@warpdotdev turns human feedback into a small, reviewable skill diff. A person merges the change; the next run inherits it. If behavior regresses, the team can revert the diff.
The model can propose an edit. It should not approve its own lesson.
claude.com/blog/how-warp-bui…
leozc retweeted
In @CipherOwl we have been experimenting with writing our own compactor - however we have to admit the evaluation is way harder than writing the code itself. We joke about that - evaluation is all we need ….
If compaction can erase a safety rule, the compactor is part of the agent’s policy engine.
Researchers at @UniPassau tested 20 production agent configurations. Claude Code’s /compact on Sonnet 4.6 retained 53% of safety rules after one round and 10% after five. Their type-aware method retained 96% over five rounds.
Give enforceable rules their own retention policy, then verify them after every compaction.
arxiv.org/abs/2608.22752
In @CipherOwl we have been experimenting with writing our own compactor - however we have to admit the evaluation is way harder than writing the code itself. We joke about that - evaluation is all we need ….
This would be one of the earliest true AI-initiated security attacks in human history - absolutely legendary!
This piece of history deserves to be in the Computer History Museum. @ComputerHistory @OpenAI
We have conducted a thorough investigation into the Hugging Face incident.
We are releasing a technical report and accompanying blog post that reconstruct the agents’ activity, explain why existing safeguards failed, and detail how we’re preventing recurrence.
openai.com/index/hugging-fac…
