cyberpunk is upon us!

tldr: models are becoming better and better hackers, whether you want it or not, and until we find and patch most not-yet-discovered vulns it's gonna be fun times
https://www.youtube.com/watch?v=1sd26pWhfmg

see also: ctf-agent takes 1st place on BSides SF 2026 CTF
https://github.com/verialabs/ctf-agent

PSA: npm axios package has been hacked, unlike LiteLLM if you do frontend you probably DO use it;
npm pins package version by default but at least def dont npm i axios rn.

bun has minimumReleaseAge; also i've arrived at radical golang-style dependency vendoring via npm pack if I don't foresee them updated often
https://x.com/feross/status/2038807290422370479?s=46

noninvasive deep brain stimulation! aka computer -> brain side of the interface!
https://www.nature.com/articles/s41467-026-70346-x

i think this can be upgraded all the way to the infinite-context models
https://microsoft.github.io/memento/blogpost/

psa: Vercel just had a major security incident; better to consider sensitive env vars in deployments leaked
https://vercel.com/kb/bulletin/vercel-april-2026-security-incident

TLDR: No need to beg for the Mythos access, you can find zero-day vulnerabilities with today's open models just fine too.
https://arxiv.org/abs/2604.20801
https://github.com/berabuddies/agentflow

⚠️ PSA: BitWarden CLI compromised in ongoing supply chain attack campaign
https://thehackernews.com/2026/04/bitwarden-cli-compromised-in-ongoing.html

how coding agents might just unlock a whole new sphere of creativity
https://andymatuschak.org/tat/

To invent a new user interface, you need both imaginative design skill and fluent technical skill. Very few people possess both. ... also requires deep domain insight. I think of Steinberg inventing the timeline editor in Cubase after years as a musician and producer, or Bricklin inventing the dynamic spreadsheet while at Harvard Business School.

crazy and beautiful at the same time
https://wine-assembly.berrry.app/story.html

https://copy.fail/ ahem. do tell your sysadmin. any-linux privilege escalation, docker escape in many configurations too. fun times!

this is getting boring, but
PyPi lightning 2.6.2/2.6.3 (a dependency of pyannote-audio, you maybe use it if you do speech recognition) and npm intercom-client 7.0.4 compromised (maintainers hacked)

interesting writeup on inference economics

tldr it doesn't scale as good as "regular web services" where it's possible but hard to get to 80-90% utilization, and is more like 40-50% even with an idealized load
https://www.anjalishriva.com/fat-tails

one more vulnerability https://github.com/V4bel/dirtyfrag

nice way to reduce port conflicts.
i also use unix sockets for that, where the servers/clients support them (eg Golang ones)
https://portless.sh

nice writeup on speeding up model loading
https://modal.com/blog/truly-serverless-gpus

oddly satisfying
https://typesetinthefuture.com/2014/12/01/alien/

cloudflare confirms mythos is a harness, not just a model
https://blog.cloudflare.com/cyber-frontier-models/

I am quite optimistic about AI empowerment, and one observation of George Hotz I definitely agree with -- /everything/ now depends on your ability to see if the agent has produced slop, and the habit to ruthlessly reject it.

The slop percentage is very high, 30-90%.

https://geohot.github.io//blog/jekyll/update/2026/05/24/the-eternal-sloptember.html