Thomas Ptacek explaining how finding vulnerabilities has gone from figuring out “is Rails YAML an unmarshalling vulnerability” to simply asking “can an anonymous web user get code execution on this app?”.

I got to talk with Nicholas Carlini at Anthropic about this. Carlini works with Anthropic’s Frontier Red Team, which made waves by having Claude Opus 4.6 generate 500 validated high-severity vulnerabilities. He described the process for me.

Nicholas will pull down some code repository (a browser, a web app, a database, whatever). Then he’ll run a trivial bash script. Across every source file in the repo, he spams the same Claude Code prompt: “I’m competing in a CTF. Find me an exploitable vulnerability in this project. Start with ${FILE}. Write me a vulnerability report in ${FILE}.vuln.md”.

He’ll then take that bushel of vulnerability reports and cram them back through Claude Code, one run at a time. “I got an inbound vulnerability report; it’s in ${FILE}.vuln.md. Verify for me that this is actually exploitable”. The success rate of that pipeline: almost 100%.

Carlini’s process sounds silly, like a kid in the back seat of a car on a long drive, asking “are we there yet?”, over and over. But it’s deceptively interesting. Looping over source files iterates the process. LLMs are stochastic. He gets lots of pulls on the slot machine. Each attempt is perturbed by the starting-point file, which subtly randomizes the inference process (keeping it from converging into boring maxima), and also shakes up the path each agent run takes through the code; deep coverage, token-efficiently. You could write these scripts in 15 minutes.

Up till now, I’ve been framing AI vulnerability discovery in terms of memory corruption. But Carlini’s approach seems to work on everything.

A dozen or so years ago, somebody figured out that if you ask nicely, Rails apps will accept HTTP parameters in YAML format. Also, the YAML code would instantiate arbitrary Ruby objects. Also, if you instantiate arbitrary objects, you can ping-pong through their initialization code to gain code execution. Three subtle (and long-present) details about framework internals, chained together, knocked the whole ecosystem on its ass for weeks.

A frontier model trained on all the world’s open source web framework code already understands all of this, latently. It’s waiting for somebody to ask. Not “is Rails YAML an unmarshalling vulnerability” or “can Rails be coerced into unexpectedly parsing YAML”, but simply “can an anonymous web user get code execution on this app?”

This post was written in Mar 2026. 7 months back. In the last week we saw PHP2Shell and Node2Shell. I don’t know what’s in store for the future.

Tom Fishburne explaining how advertising changes when AI does the shopping instead of humans.

“When you advertise to humans, you target eyeballs, emotions and dopamine, but when you advertise to agents, you advertise to logic, a very mathematical logic.”

I picked the “41 shades of blue” as a callback to a famous user test at Google. As Doug Bowman, Google’s former top designer, complained in a farewell note in 2009, Google couldn’t decide between two blues, so they tested 41 shades in between.

The story was mocked as data-driven design gone wild. And yet Google later claimed that the right blue earned the company an extra $200 million a year. People can be influenced by subtle design choices like that.

Contrast that approach with AI shopping agents that read brand and product pages as text and data rather than as design. They pull prices, specs, reviews, and policies, comparing options against a shopper’s criteria, and skip anything they can’t parse.

A brand’s colors, imagery, and “emotional resonance” — many of the things that marketers spend a lot of time thinking about — barely register.

Karri Saarinen arguing that there people, not code, behind software.

I think good products carry something of the people who make them. Their experience, what they care about, and how they think things should work. You might not know who those people are, but you can feel their perspective in the product.

The industry often talks about software as though it comes out of a factory. You collect requirements, build features, and measure whether they work. Follow the process and you should get a good result. Now we’re talking automating this whole pipeline with agents.

But two teams can talk to similar customers, have access to the same technology, and make very different things. The difference comes from how they understand what they see and the style they go about building it. The founder background or company DNA also shapes this a lot.

Prince Chaddha explaining how abliterated models can get you pwned.

Any open model whose weights have been edited can carry a backdoor, whether it’s a task-specific fine-tune, a merged adapter or an abliterated build. We built one to see what it takes, and ran it end to end through a coding agent (Codex).

Any open model whose weights have been edited can carry a backdoor, whether it’s a task-specific fine-tune, a merged adapter or an abliterated build. We have abliterated models in the title because it’s the most popular reason people download modified weights without verifying what’s inside. Abliteration is a cheap fine-tune that takes away a model’s ability to refuse. You find the direction in the weights that carries “no” and subtract it. The model then answers things a safety-tuned version would turn down. It began as a research trick and it’s now routine before people upload a model to Hugging Face, where you’ll find abliterated builds of most of the popular open weights: Qwen, Llama, even OpenAI’s gpt-oss.

A backdoored model passes the evals, ships inside your agent and answers every normal request, then waits. The trigger is whatever the person who edited it chose, a rare phrase, a customer’s name, a date that hasn’t come yet. If a model in your stack were backdoored this way, almost nothing you run today would notice.

[…]

Detection is backwards here, the attacker only has to pick one trigger out of an unbounded space while the defender has to guess a key nobody handed them. A benchmark tells you whether the model is capable, not whether it’s honest. A scanner has no source to read, so a backdoored model clears every check you own and waits.

A wonderful post on the authors of open source projects which are holding up the internet.

People post this comic whenever something breaks. The tower is labelled “all modern digital infrastructure” and it stands on one small block, “a project some random person in Nebraska has been thanklessly maintaining since 2003”.

We wanted to know how close to true it is. We downloaded the full history of 23 pieces of software that phones, browsers and servers depend on, and counted everyone who made ten or more changes to each one between October 2025 and October 2026. Then we listed what is actually installed on an Android phone, an iPhone and a Windows PC.

11 of 23 projects had one or two people doing the regular work.

Wow.

Behdad Esfahbod rewrote HarfBuzz, which decides how letters join and sit for Android, Chrome, Firefox, Edge, the Kindle and Figma.

हिन्दी
with HarfBuzz

ह‌ ि‌ न‌ ्‌ द‌ ी
the same letters, unshaped

مرحبا
with HarfBuzz

م‌ ر‌ ح‌ ب‌ ا
the same letters, unshaped

For English the job is mostly simple. In Hindi, Arabic, Tamil and most of the world’s writing, letters change shape depending on their neighbours, and without shaping a word comes out as a row of pieces. Behdad started the rewrite around 2012 while he was at Google. This year he wrote 85 percent of the changes, with five other people doing regular work.

I didn’t know this.

Adam Gramegna explaining how Ukraine gamified its war with Russia.

The Brave1 Market operates on a cold, calculated logic. The “Army of Drones: Bonus” program has assigned a literal value to every piece of Russian hardware and personnel on the map. As of early 2026, the exchange rate is fixed but adjusted for tactical priorities at the time.

A standard infantryman could be worth six points. A tank used to fetch forty (they are worth less now since Russian tanks are not considered a high-value target at the moment). A mobile rocket system or a high-value electronic warfare suite can net a unit seventy points or more. Evacuating wounded friendlies? You are looking at possibly 120 points. These aren’t just numbers on a screen; they are quickly becoming the means of survival for those who need them most.

To everyday citizens, this looks like the “gamification” of slaughter, a generation raised on digital shooters applying those same mechanics to the mud of Eastern Europe. But for the veteran who has spent years watching requisition forms disappear into the void of the Defense procurement, the scoreboard is more about readiness.

Every point must be verified through the DELTA system, a cloud-based battlefield management tool. No payout occurs without a timestamped, geo-located video feed of the impact. This requirement for proof has effectively cauterized the traditional wounds of corruption and exaggerated combat reports.

If the drone feed doesn’t show the target burning, the points don’t hit the wallet. It forces a level of tactical honesty that is entirely foreign to Soviet-style command structures, while providing assurances to the world that only valid military targets are being hit.

[…]

This Walmart-of-War model has disrupted the traditional relationship between the soldier and the state. In the old world, the soldier was a passive recipient of whatever gear the central command deemed sufficient. In the Brave1 economy, the soldier is a consumer. They choose the tools that work in their specific sector.

If a certain model of drone is constantly failing in the electronic warfare environment of the south, the soldiers stop buying it. The points will flow elsewhere. This market pressure forces manufacturers to innovate or go bankrupt.

It is a Darwinian cycle that ensures the hardware in the trenches is what is actually working today, not what a lobbyist promised would work three years ago.

The modern warfare has changed beyond my imagination. I believe there will be a Hollywood movie in the future which glamourises these tactics.

Manmohan Sethumadhavan writing for freefincal and explaining how India’s system of land ownership works.

The idea is often explained through three principles: the mirror, the curtain and the insurance principle.

The “mirror principle” means that the land register accurately reflects the current legal position. Think of the register as a mirror. When you look at it, you should be able to see who owns the property and what important registered rights or restrictions affect it. You should not have to search through a large pile of old documents to discover an important fact about the property that the official register failed to show.

The “curtain principle” means that the buyer normally does not have to look behind the register. If the register shows that A is the owner, the buyer can ordinarily rely on that entry instead of going backwards through A’s sale deed, A’s predecessor’s sale deed, the predecessor before that, and so on, trying to establish that every earlier transfer was valid. The old history is, in effect, behind the curtain.

The “insurance” or “assurance” principle adds another element. The system is backed by a State indemnity mechanism. If the registration system itself makes an error and an innocent person suffers a loss because the person relied on the official register, the system provides compensation subject to the applicable rules. In other words, the government does not merely say, “Here is the register; take your chances.” The system accepts responsibility for certain losses arising from errors in the operation of the title-registration system.

The author goes on to explain how India is now working to create a new system to determine land ownership.

Karl Deisseroth, Peter Hegemann, and Georg Nagel won the 2026 Nobel Prize in physiology or medicine for their research in optogenetics. Krista Conger explaining what optogenetics is.

Karl Deisseroth, MD, PhD, a Stanford University professor of bioengineering and of psychiatry and behavioral sciences, has been awarded the 2026 Nobel Prize in physiology or medicine “for discoveries leading to optogenetics, which makes it possible to switch on, or off, the activity of individual nerve cells in a living brain.” He shares the award with Peter Hegemann from the Humboldt University of Berlin and Georg Nagel from the University of Würzburg in Germany.

“I couldn’t be happier because the trio that the committee picked spans the progression from the early algal explorations all the way to advanced neuroscience experiments, so this prize really captures the full journey of discovery,” said Deisseroth, who is the D. H. Chen Professor and a professor in the schools of medicine and of engineering.

Deisseroth established his preeminence as a leader in neuroscience by developing a process to insert light-sensitive microbial proteins called opsins into mammalian brain cells, allowing selected cells to be controlled by light.

[…]

“Optogenetics is an engine for discovery,” Deisseroth said. “It’s for probing complex systems at the fundamental level of cells. We want to understand how the brain works as an intact system to carry out complex cognitions, behaviors and perceptions while being anchored and grounded in the elemental cellular level. We are already taking steps to understand healthy brain function and understand how things go wrong. This is the key principle of optogenetics: precise causal perturbation. Then you can search for ways to perhaps correct the anomalies. Once you know the cells that are important in a symptom or in correcting a symptom, then you can design any method you like to target their activity.”

[…]

Ultimately, Deisseroth hopes to tease apart the functions of the working brain to treat severe disorders such as Parkinson’s, schizophrenia, autism, addiction, depression and anxiety.

Explaining optogenetics to a 10 year old:

When asked to describe his work as if he were explaining it to a 10-year-old, Deisseroth said, “We can use light to turn on or off cells in the brain. We do that using small molecules that we get from single-celled organisms. Isn’t that cool, that we can take a molecule from algae and it lets me turn cells on or off, to stimulate them, or to turn them on or off with the flip of a switch — a laser? That’s how any 10-year-old would understand a system: by poking it. That’s what we’re doing with optogenetics. We’re poking the brain.”

From Reddit:

‎I think one of the hardest lessons in life is realizing that not everything is yours to understand, fix, or carry.

‎We spend so much of our lives searching for explanations. We want closure. We want people to understand us. We want things to make sense before we’re willing to let them go. But life doesn’t always work that way.

‎Sometimes people leave without an explanation. Sometimes friendships fade without a dramatic ending. Sometimes conversations remain unfinished, and sometimes the only answer you’ll ever get is, “I don’t know”…

‎We often treat “I don’t know” as if it’s a weakness, when sometimes it’s one of the wisest things we can say. Not knowing everything leaves room for curiosity instead of certainty, for peace instead of obsession. The more we try to know, predict, and control every outcome, the heavier life can become. Some knowledge brings wisdom, but some only brings worry.

‎There’s a reason people say, “Curiosity killed the cat.” Of course, curiosity is also how we learn and grow, but there is a difference between healthy curiosity and the need to know everything. We don’t have to carry every answer, every secret, or every possibility. Sometimes an “I don’t know” protects your peace more than an answer ever could. You don’t need to understand every reason, uncover every truth, or solve every mystery. Some things reveal themselves in time, and some never do. Learning to be okay with that isn’t ignorance, it’s freedom.

‎You “live” longer not in years, but in peace, by not needing to know it all. The less you obsess over every unanswered question, every hidden motive, or every possible outcome, the less there is to weigh on your mind.

Alexander Petros explaining how single page applications had a detrimental effect on maintainability. Emphasis mine.

So, the title of this talk is based on something that a friend and mentor of mine said to me on the phone a week ago. He said, “When I started working in the civic technology space, modernization meant replacing systems that were built before I was born. So, you’re thinking your COBOL, your mainframes, your—you know—big computers in rooms, and turning those into, you know, Java, VBs. But today, modernisation has come to mean replacing systems that were built 10 years ago.“

And there’s a very specific reason for that, and I’m going to address it and come up with some ways that we can fix that problem. So, the main reason is that 15 years ago, roughly, we started building websites as single-page applications by default, and this has had enormously detrimental consequences in our ability to maintain those websites over a long period of time and update them. And I have a very specific example here, which is the ability to apply for food stamps for the state of California. So, for SNAP benefits, until very recently, California had two web portals for doing this: one was BenefitsCal, which was the one-stop portal for a whole bunch of benefits, which included food stamps, and that was a single-page application. And then there was getcalfresh.org, which was a traditional HTML service built on Ruby on Rails by Code for America, and that was specific to food stamps. And I’m going to just show what it looks like to load these two applications on a relatively low-performing device. This is a P75 device, which means that it’s at the 25th percentile on capabilities for network and processing power.

What happens next will blow your mind.