About a month ago
- Pulumi access tokens all look the same but you can use the Pulumi CLI or API to figure out what kind of token it is....
about 1 month ago
- This story is wild. The short version: OpenAI were running a cybersecurity test against an unreleased model, with the model’s guardrail features turned off. Rather than solve the test, the …
- With this post, I’ll wrap up my notes from the second Future of Software Development Retreat. But before I do, I should note that the full Thoughtworks report on the retreat is now available. They have five headline findings: Code generation is no longer the bottleneck —...
- Build Gemini Managed Agents that use the GitHub CLI without exposing your PAT. The egress proxy injects your real token into outbound requests while the sandbox only sees a dummy token....
about 2 months ago
- The European Union AI Act is Europe’s attempt to comprehensively regulate AI usage. A big part of that is the requirement that AI-generated content be identifiable: either tagged with a watermark or with what the Act calls “digitally signed metadata”1. Since all this becomes...
2 months ago
- Today we launched a new plugin for Datasette, datasette-apps, with this launch announcement post on the Datasette project blog. That post has the what, but I’m going to expand on …
3 months ago
- Vibe coding has significantly accelerated software prototyping but AI agents frequently recommend insecure configurations, creating security problems. Gautam Koul, Lucian Moss, Neil Drew-Lopez, and Daberechi Ruth Edeokoh share their experience while building applications for...
4 months ago
- Yesterday, I wrote about the massive increase in security issues being identified by AI. Daniel Stenberg, the author of curl, was a key part of that story. At first he was being overwhelmed by a torrent of “AI slop” reports. In the last few months, the reports have become almost...
- No matter how you feel about AI, it’s changing the world of software. The “T” in ChatGPT was invented to improve language translation, and large language models (LLMs) are very good at this. Interestingly, translating between French and Japanese is effectively the same as...
- A fictional scenario about what AI changes for cloud security, written because the technical version of the argument doesn't land with anyone except engineers....
- As part of my efforts in reducing my dependency on Big Tech, I have been researching how to self-host my password manager. One solution that looks very promising is Vaultwarden, an open source clone of the Bitwarden cloud server. An interesting aspect of this server is that it...
- Kiwi Farms is a web forum that facilitates the discussion and harassment of online figures and communities. Their targets are often subject to organized group trolling and stalking, as well as doxing and real-life harassment. Kiwi Farms has been tied to the suicides of three...
- Last week Thoughtworks released the 34th volume of our Technology Radar. This radar is our biannual survey of our experience of the technology scene, highlighting tools, techniques, platforms, and languages that we’ve used or otherwise caught our eye. This edition contains 118...
- This year’s PyCon US is coming up next month from May 13th to May 19th, with the core conference talks from Friday 15th to Sunday 17th and tutorial and sprint …
- The proof of work is the wrong analogy: finding hash collisions, while exponentially harder with N, is guaranteed to find, with enough work, some S so that H(S) satisfies N, so an asymmetry of resources used will see the side with more "work ability" eventually winning. But bugs...
5 months ago
- Is security spending more tokens than your attacker? Last week we learned about Anthropic’s Mythos, a new LLM so “strikingly capable at computer security tasks” that Anthropic didn’t release it publicly. Instead, only critical software makers have been granted access, providing...
- The UK’s AI Security Institute has published the first independent evaluation of Claude Mythos’s cyber capabilities. The headline finding – first AI model to complete a full 32-step simulated network attack – is notable. But there’s a finding buried in the accompanying...
- What Anthropic's Mythos research preview tells us about the trajectory of frontier models, sandbox escapes, and the cybersecurity risk ahead....
- Blog About Moonbound Shop This is a post from Robin Sloan’s lab blog & notebook. You can visit the blog’s homepage, or learn more about me. April 8, 2026 Now that we share the internet with tireless, capable synthetic hackers, I find myself wondering if the project to rapidly...
- Anthropic didn’t release their latest model, Claude Mythos (system card PDF), today. They have instead made it available to a very restricted set of preview partners under their newly announced …
- The Problem You have a video on a server. You want users to watch it. But you do not want them to download it. Or share direct links. Or scrape it with bots. If you just put the file at cdn.example.co...
- The Axios team have published a full postmortem on the supply chain attack which resulted in a malware dependency going out in a release the other day, and it involved …
- Dependencies are a huge supply chain security risk; the more of them you have, and the more often you update, the bigger the attack surface....
- AI coding assistants respond to whoever is prompting, and the quality of what they produce depends on how well the prompter articulates team standards. Rahul Garg proposes treating the instructions that govern AI interactions (generation, refactoring, security, review) as...
Rows per page
