Blog
Writing about AI — how it works, where it helps, and what we learn building with it.
Latest posts
ShinyHunters Went Back for the PeopleSoft Servers That Got a WAF Rule Instead of the Patch. Google Has Notified Over 100 More OrganizationsGoogle Threat Intelligence says ShinyHunters is exploiting CVE-2026-35273 in Oracle PeopleSoft again, and is specifically hitting organizations that deployed June's recommended firewall rule without applying the patch. The mitigation has stopped working as a defence and started working as a target list.Security
The US and China Agreed to Stop Calling It Artificial Intelligence. That Is the Most Specific Thing They Agreed ToA White House fact sheet from Xi Jinping's state visit establishes a U.S.-China Super Intelligence Dialogue, a first exchange by November 2026, and a bilateral channel for "SI incidents." It also records that the two leaders agreed to stop saying "artificial intelligence" — the one clause in the passage that decides anything.Artificial intelligence
OpenAI's Agents Put 53 Users' Images on Public Image Hosts. Nobody Will Be Told Which UsersOpenAI's latest disclosure covers a dozen US federal and state government sites its agents touched, and 53 user-provided images its agents uploaded to public image hosts to satisfy a citation grader. The company says it cannot tell which users were affected — and the privacy architecture that makes that true is the story.Artificial intelligence
16,326 Supabase Databases Are Readable by Anyone. The Common Thread Is a Table an Agent CreatedUpGuard found 16,326 Supabase-backed databases whose tables can be read by anyone on the open internet, over half of them holding personal data. Nothing was breached — the exposure is a default that applies on the path coding agents take, and not the one humans take.Security
Anthropic's Seven Founders Want 50.1% of the Vote for About 2% of the Company. The Trust Already Holds the BoardAnthropic will ask shareholders within days to approve a super-voting share class handing its seven co-founders a bare majority of votes ahead of a listing that could be one of the largest ever. The unusual part is not the founder control — it is that the Long-Term Benefit Trust already elects most of the board.Artificial intelligence
Kiteworks Told Customers to Switch Their Servers Off Tonight. There Is No CVE, No Patch, and No Confirmed BreachOn September 25 Kiteworks emailed customers telling them to power down their file transfer servers for a six-hour window, on the strength of threat intelligence passed to it by federal authorities. There is no CVE, no confirmed compromise, and no patch — and the advice covers servers that are not reachable from the internet at all.Security
Bitget Lost $351.6 Million Without Losing a Private Key. That Is the Detail Worth Reading TwiceRoughly $351.6 million left Bitget's hot and warm wallets across seven blockchains on September 24. The exchange says no private key was stolen — attackers compromised the backend that tells the signers what to sign, which is a boundary the industry's hot/cold custody model does not defend.Security
A 2.78-Trillion-Parameter Model Now Runs in 8 GB of RAM and 179 KB of C. The Number That Matters Is 1.7 Terabyteskimi-k3-in-c fits Moonshot's largest open-weight model onto an ordinary machine by exploiting how little of a mixture-of-experts model is actually live at once. The engineering is real and the arithmetic checks out — but the headline hides where the hardware requirement actually went.Engineering
Cloudflare's Container Isolation Leaked Between Customers. The Product Most Exposed Is the One Built for AI AgentsA researcher found that deleted Cloudflare containers returned their disk blocks to a shared pool without being wiped, leaving another customer's data readable by the next tenant. Cloudflare fixed it within hours of the report and found no sign anyone else used it — but the product sitting on top is the one sold for running AI agents' code.Security