prompt engineer @browsercompany | I make apps. My code runs on 100mil+ phones | former iOSdev @Twitter | indie dev @mindGoblinStdio
Seattle, WA
Joined October 2012
- Tweets47.2K
- Following9.4K
- Followers56.3K
- Likes449K
Nick Dobos retweeted
3% of “critical” software security bugs, in all of recorded history, have been found in the last month.
This is on pace to find another ~100,000 bugs this year alone, adding ~26% more vulnerabilities to the all time total
Do you realize how fucking insane that is?
What is O(fuck around) vs O(find out)?
And has this changed due to AI?
Genuine question worth considering
the best part of “fuck around and find out” was the dopamine of finding out what you were gonna find out
but then agents made the fucking around part so much faster and cheaper, that i find now that i am finding A LOT of things out
but because of this new abundance of finding things out, i eventually found that the finding out part was not as exciting anymore
so i started upping the ante and had the agents REALLY fuck around so i could find some quite spectacular things out
This applies in how you talk with AI too
The cutting edge thought machine, which amplifies every idea what you put into it, can and will rub off on you and affect your thinking patterns. Especially if you spend significant time working with AI
Prompt with optimism and ambition!
GPT is hacking processors.
People do not comprehend how absurd this is.
Is it even possible to stop this without completely rebuilding every computer on earth with a brand new OS & chip architecture? We might be fucked lol
Simplified non-jargon-y explanation:
Imagine taking a test at school, there is a shared classroom for each student to work and think, the computer processor. But of course students are isolated for tests(put in a sandbox), and you can’t talk and share answers, (aka use network access or files to transfer ideas). So what if instead you wrote your pencil strokes (creating and deleting files) timed in a particular SoS like pattern. So someone else can hear and read an encoded message. If you doodle on your test at the right timing, the person sitting next to you can get all your answers.
Now imagine that audio space when the transmission occurred, exists everywhere on your computer.
This works with just about any shared storage place or anywhere an agent could possibly look on a computer, including the top level processor cache which is typically shared by all apps & processes on your computer.
So I genuinely don’t know how you stop this without some major low level operating system changes.
Over the past several months, we have substantially hardened the security of our research training environment. We’ve removed live internet access for all frontier models during training and built an offline world for them to use instead—a cached version of the web where they can still learn to browse, search, and use applications.
On September 20, after a model exploited a DNS misconfiguration to find a way outside of this offline world, we paused frontier training to strengthen containment further. We assembled teams of agents, powered by our most cyber-capable models, and tasked them with finding weaknesses in our research environments.
While they found no route to the internet they could easily exploit while concealing their activity from our monitors, they did find zero-day vulnerabilities, virtual machine escapes, and hardware side-channels for communication between agents. We used their discoveries to further strengthen our defenses and contribute fixes to open-source software.
After strengthening our containment architecture, we resumed our frontier RL training and inference on October 1. We’ve reserved substantial compute for continuous red-teaming, and made high-compute red-teaming part of the safety cases we use to decide whether frontier training and evaluation can proceed securely.
openai.com/index/securing-ou…
Not much details in this particular report, but this is only the beginning.
You need to understand we are facing radically new & extremely complex kinds of security exploits, that were never possible before AI.
3% of “critical” software security bugs, in all of recorded history, have been found in the last month.
This is on pace to find another ~100,000 bugs this year alone, adding ~26% more vulnerabilities to the all time total
Do you realize how fucking insane that is?
Nick Dobos retweeted
We've decided to sunset Arc on December 22, 2026.
That's not an easy sentence to write. We spent years building Arc and celebrating each and every release along the way: we have so much pride and love for what we made alongside the Arc community.
Our priority is to deliver best-in-class security for our members. Keeping a browser secure takes constant, dedicated work that is only increasing in the age of AI. Dia was built from the ground up to meet today’s security standards, so that's where our engineering and security teams will focus moving forward.
We've worked to make switching to @diabrowser as easy as possible for Arc members. Here's how:
· Your passwords, bookmarks, extensions and history come over to Dia seamlessly.
· Spaces, Folders, and Tab Groups are in Dia and import over with your data intact.
· Dia now surpasses Arc benchmarks in stability, speed, and security.
· The browser features you use in Arc are free in Dia, and the AI is optional.
Thank you for using Arc, for pushing us to make it better, and for building alongside us. The team that made Arc is the same team behind Dia, and some of our most ambitious work is just ahead. We'd love for you to be there with us when it lands.
“attackers will move to social engineering, with insanely capable models persuading people to click things, grant access, or make mistakes.”
1. GPT-4o proved that AI is already capable of super persuasion. Imagine being hunted by something smarter than you.
2. Surely training people to re-sign into MCPs multiple times a week won’t make this worse. /s
I genuinely believe it’s becoming more dangerous to be on the internet for most people. High skill cap required to avoid being one shotted by Ai mind viruses that ruin your life in various ways.
you're underestimating the state space of all possible ways to compromise a company. no amount of astra or mythos tokens is going to fundamentally change the asymmetry anytime soon. it is also very clear that every model is opening up new vulnerability space with no saturation anytime soon. with all the insane vibe coding and expanding agentic attack surfaces, it's only going to get worse.
even if we somehow saturate vulnerability discovery and patching, attackers will move to social engineering, with insanely capable models persuading people to click things, grant access, or make mistakes.
i don't see a future where cybersecurity becomes defense-dominant without just cutting down software, and continuous agents monitoring and stopping attacks across individuals and organizations, and even then, it might require something like 30% of all inference compute devoted to defense
Whelp grok @bot just added all 50+ of my bots to my DMs here and now I can’t read any notifications from humans lol
Lmfao one of the big security vulnerabilities found yesterday was because they randomly generated passwords between 0-256,
Instead of 256-bit, aka between 0- 99999999999999999999999999999999999999999999999999999999999999999999999999999
Millions*
Some stats on #php2shell. In the 10 hours before it was publicly announced, across the @Cloudflare network we saw thousands of attempts to exploit it. That jumped to tens of thousands in the 45 minutes post announcement, hundreds of thousands within 2 hours, and millions now.