Abdullah

DeFi+DeSci = Perfect recipe for 🍔 (Innovation)
Biotechnologist, DAOist, Rotatoor!!

[Abdullah @0x_abdullah]

awe! received my parcel today. Thanks team @pillar_vc for sending this beautiful gift all the way to the other side of the world

[Cred @CryptoCred]

As someone who loves trading technicals

I think learning about markets via technicals (like I did) is one of the worst ways to start

It’s a rigid framework where grown men argue with each other about the exact Japanese name for a specific candlestick or a box they’ve drawn on an arbitrary time frame

It doesn’t teach you the foundations - why markets move, different types of participants, microstructure, order types and their impact, perps vs spot, and all that stuff - market ‘plumbing’ as a category

One of the biggest issues with being hyperfocused on technicals is that they don’t teach you principles and market effects

Most technical setups can be decomposed into broad buckets which are well-established (trend, mean reversion, momentum, order flow / price impact, vol clustering etc.)

A lot of technical analysis is an often unknowing attempt to map those broad market effects into a recognisable pattern

But even a technical-first view is better served by understanding the underlying market effect first and then decomposing it, as opposed to focusing on the specific pattern without ever looking at what’s happening under the hood

“This type of triangle tends to go up” is a lot less useful than “this type of flow tends to resolve higher over N time frame”, even if you use the same triangle to identify it

Another example: if you’re drawing a support level and buying it, you’re assuming some version of buyers being more aggressive than sellers in that area over a given time frame and predicting a higher price as a result - but what does that mean?

Shorts closing / taking profit, allowing for mean reversion? Aggressive sellers being absorbed by passive buyers? Some price insensitive buyer predictably stepping in at a value area? Sellers getting margin called and forcibly trading at bad prices/causing a dislocation? Clustering of orders creating some sort of imbalance? And so on.

There’s definitely a risk of overthinking this stuff, and you can make money from charts alone

But if you haven’t thought about the underlying market effects and ‘plumbing’ for your setups you’ll likely be stuck in rigid pattern matching that doesn’t generalise and isn’t subject to deeper investigation and more nuanced application

Even if your main lens remains TA-focused, there is no harm in understanding the stuff you’re trading on a product level (eg perp contract specs, OI, funding, mark/last/index etc) and on a foundational level (why and how markets move)

Especially now that you can jam this stuff into an LLM and keep saying “dumb it down” until you get it, no excuse not to do your homework

This is something I really wish I did much earlier in my trading life, so hopefully it resonates with a fellow trader stuck in TA psychosis spending his mum’s credit card on a fourth Udemy candlestick course

Anyway GM

[Sugandha @sugandhanisa]

replugging my essay, “taste is not scalable” where I had the audacity to quote Kant on taste coz this is getting a bit ridiculous. taste in what? art assets? typography? writing? static design? video editing? cinematography? UI? interaction design? UX? taxonomies? copy? TASTE IN WHAT? WHOSE TASTE? AND THEIR TASTE IN WHAT? AND WHAT WILL THAT BEING FORMULISED DO FOR ANYONE?

tech industry didn’t have the vocabulary to discuss human art and creativity so it’s created a new binary definition: taste vs slop. naturally, there were going to be models and companies “solving” for taste. it started with “context”. I don’t mean to diss on this company, I know others too in this space and it’s been the most soulless work to watch which is really something if you’re going to turn “taste” into your category.

you know what’s the real slop? these catchphrases and whoever keeps coming up with them.

ghibli’s work is BEYOND “tasteful”. AI generated ghiblislop is bottom of the trash pile. go figure.

TASTE IS NOT SCALABLE.

https://t.co/yMtxWWBGAD

[Mgoes (bio/acc 🤖💉) @m_goes_distance]

you have no idea how much better it is getting

just this week:

- a child was successfully implanted after embryo screening for IQ in the 99.99th percentile. the default human is already being upgraded
- the first ever reverse-aging drug was injected into a human. Life Biosciences by @davidasinclair , so it begins
- Sinclair also announced plans to test an oral reprogramming pill in the $101M XPRIZE. whole-body rejuvenation. a pill you swallow
- Retro Biosciences raised new funding at a $1.8B valuation
- @newlimit announced its first medicines headed to the clinic. Brian Armstrong's $3.1B longevity bet is moving from lab to human
- Junevity published PNAS research validating transcription factor modulation can reverse cellular aging. first-in-human trials starting H2 2026
- retatrutide phase 3 confirmed 70 pounds lost on average. no plateau. bariatric surgery territory from a weekly injection

this is just week one of June 2026

bio/acc

[Melinda B. Chu @MelindaBChu1]

🇫🇷📲💧Since I started developing EcoExposure AI water microplastics/nanoplastics kit, some requirements were that it had to be
- portable and with a
- smartphone 📲

so you could test water anywhere and quickly.

🗺️📍and with the smartphone, you can also put a geolocated pin of water sample location to generate real-time maps of water quality data (see below)

This is an example of a small pilot on the Seine in Paris that was performed with no equipment other than this what I call “fishing pole” 🎣😆, but it’s a telescopic rod with a cup at the end.

With the EcoExposure platform, all you do is

1.) Collect water sample 💧
2.) Add biodegradable plant-based powder reagent and wait. 🌱
3.). Take a photo and the AI and computer vision help detect both microplastics and nanoplastics in a water sample anywhere. 📲

As you can see, I did the EcoExposure tests right there on site, on the side of the Seine River and pretty much looked like everyone else sitting around on a nice afternoon. 😎

[Max Marchione @maxmarchione]

In some very real sense, Ozempic was invented in 1990. Pfizer ran the human trials and just never published them.

They showed it lowered blood glucose in diabetics, slowed gastric emptying, and killed hunger; the same 3 things that make Ozempic work today.

The joint venture agreement said internal data stayed internal, and that was that. Pfizer killed the program in 1991. The reasoning, as far as I can tell, was that nobody would ever want an injectable diabetes drug besides insulin.

So, the license went back to the hospital in Boston that held the patents.

Novo picked it up in 1992 and spent the next two decades building liraglutide, then semaglutide.

It's insane that data sat in a filing cabinet for 30+ years.

I only know this because Jeffrey Flier, one of the Harvard scientists in the room, finally wrote it up. He's in his late 70s and didn't want the history to die with him.

This makes you wonder what else is in those filing cabinets.

Ozempic could've existed 27 years ago.

[Hussain Nadim @HNadim87]

On Critique: The First Principle

Critique is a luxury, and not everything deserves it. For something to be critique-able, it must first pass the legitimacy test.

A military dictator who seizes power by violating the constitution, breaking his oath, and unleashing violence on his own people does not deserve critique, let alone appreciation, of his policies . Whether his monetary strategy works, or his diplomatic maneuvers are effective, is beside the point. Same goes for dynastic political leaders and their children that parachute into positions of power.

The only critique they deserve is the rejection of their illegitimacy. Anything beyond that risks granting legitimacy to what is fundamentally illegitimate.

Because those without legitimacy desperately seek critique to manufacture legitimacy. They want engagement on “performance” to distract from the question of legitimacy itself.

Those in the media, academia, and intellectual spaces that try to separate legitimacy from critique and offer engagement as a service often do it to endorse, validate and legitimize actors in the garb of “police debate” and “genuine” critique.

Sometimes, the only form of critique is refusing to debate the details, and instead focusing on the first principle of questioning the right of the actor to rule in the first place.

[Murtaza Syed @murtazahsyed]

On yet another day of dubious award offerings in the Land of the Pure that degrade true achievement and civic service, one is reminded of the words of the Italian cyclist, Gino Bartalia ….

“Good is done, not spoken — certain medals are hung on the soul, not the jacket”

[Sam Sinai @samsinai]

In the pre-(true)AGI years, I think about human/agent intelligence the way I think about CPUs/GPUs in computation.

Agents will be the GPUs: massively parallel systems doing huge amounts of similar-but-not-identical cognitive work

Human experts will be the CPUs: lower throughput, but essential for judgment, abstraction, tacit knowledge, and reasoning under ambiguity.

You don’t need AGI for this shift to massively transform the economy. Closer to home, I think this will be a big deal for economy of rare diseases.

[Niko McCarty. @NikoMcCarty]

Underrated Ideas in Biotech (Part I)

My list of writing ideas is growing far faster than I can possibly publish. So here are some "half-baked" ideas in biology that I hope others will pick up and run with.

In this first blog, I share three ideas:

1. Hyperspectral Biology — It is possible to see microbes from outer space. (That sentence sounds ridiculous, but it's true.) We can now build planetary-scale networks that would enable us to engineer microbes that sense pathogens, or act as early warning systems for other threats, and monitor using satellites.

2. Biology for Beauty — Nature is often described as the most beautiful thing on Earth, far exceeding artistic works from Monet and Picasso. Yosemite and the Grand Canyon feel as if they were sculpted by the hands of God; all other art is unmistakably the work of humans. Why aren't there entire companies that (like Tiffany or Cartier) aim to make eternal art using biology?

3. Mapping the Air — Microbes can travel thousands of miles, traversing continents by riding on dust motes carried by atmospheric winds. Sand from the Sahara desert travels all the way to New York City, carrying pathogens with it. We have barely begun to study the microbes hitching rides on these atmospheric winds.

On a related note: There is a growing field of AirDNA. Every time you breathe, saliva droplets are released into the air. These droplets contain DNA, which can be captured and sequenced. After the DNA settles onto the ground after about 24 hours, it gets wrapped into dust, and sits there for years.

It is feasible to take the dust from a room and build a genomic record of everyone who has ever entered it. In 2023, researchers at MIT also engineered living cells to take up and permanently record DNA from their surroundings. The bacteria were sensitive enough to distinguish between two sequences differing by a single nucleotide at exceptionally low concentrations — about 4.6 femtomolar.

These “sentinel” cells can be used to figure out what a person looks like, solely by storing the trace amounts of DNA they leave behind in a room.

Many facial features are influenced by single-nucleotide polymorphisms (SNPs), or single-letter variants in the genome that correlate with things like nose width and eye spacing. The MIT team engineered cells to detect five facial SNPs and showed each could be detected independently. Sprayed onto a surface, these cells would capture SNPs and, once sequenced later, reveal who passed through.

This is not science fiction. The authors say it directly in the paper: “we demonstrated sentinel cells on a set of five human SNPs associated with human facial features. One could record this information in a single cell or consortium, recover the DNA, and use artificial intelligence to rebuild the predicted face.”

Much more: https://t.co/NrIEDC8UGr

[Gammichan @gammichan]

"Every time oil has hit $100, we've had a recession"

Sure, but the value of $100 is less and less every time. Better to price oil in gold or something.

[Bryan Johnson @bryan_johnson]

In a 100 km race, which do you think wins?

+ Lion
+ Human
+ Camel
+ Horse
+ Wolf
+ Cheetah
+ Ostrich
+ Bear

[BURKOV @burkov]

If you don't understand this, you will not understand why LLM-based agents are irreparably failing for a general-purpose problem solving.

An agent (by the way it was the topic of my PhD 20 years ago) to be useful, must be rational. Being rational means to always prefer an outcome that results in the maximal expected utility to its master/user.

Let’s say an agent has two actions they can execute in an environment: a_1 and a_2.

If the agent can predict that a_1 gives its user an expected utility of 10, and a_2 gives an expected utility of -100, then a rational agent must choose a_1 even if choosing a_2 seems like a better option when explained in words. The numbers 10 and -100 can be obtained by summing the products of all possible outcomes for each action and their likelihoods.

Now here is the problem with LLM-based agents.

The LLM is not optimizing expected utility in the environment. It is optimizing the next token, conditioned on a prompt, a context window, and a training distribution full of examples of what helpful answers are supposed to look like.

Those are not the same objective.

So when we wrap an LLM in a loop and call it an “agent,” we have not created a rational decision-maker. We have created a text generator that can imitate the surface form of deliberation.

It may say things like:

“I should compare the expected outcomes.”
“The best action is probably a_1.”
“I will now execute the optimal plan.”

But the internal mechanism is not selecting actions by maximizing the user’s expected utility. It is generating a continuation that is statistically appropriate given the prompt and prior context.

This distinction matters enormously.

For narrow tasks, the imitation can be good enough. If the environment is constrained, the actions are simple, and the success criteria are close to patterns seen in training, the system can appear agentic.

But for general-purpose problem solving, the gap becomes fatal.

A rational agent needs stable preferences, calibrated beliefs, causal models of the world, the ability to evaluate consequences, and the discipline to choose the action with maximal expected utility even when that action is boring, non-linguistic, or unlike the examples in its training data.

An LLM-based agent has none of that by default.

It has fluency. It has pattern completion. It has a remarkable ability to compress and recombine human text. But fluency is not rationality, and a plausible plan is not an expected-utility calculation.

This is why these systems so often fail in strange, brittle, and irreparable ways when given open-ended responsibility.

They are not failing because the prompts are insufficiently clever.

They are failing because we are asking a simulator of rational agency to be a rational agent.

[Zach Rynes | CLG @ChainLinkGod]

Look guys, it's actually really straightforward, a bunch of people staked their ETH on the Ethereum blockchain to earn yield, except they didn't want their capital to be locked up, so they actually staked with a liquid staking protocol called Lido who provided them a liquid staking receipt token called stETH, except they decided to juice their yield further by depositing their stETH receipt tokens into a restaking protocol called Eigenlayer, except they didn't want to lock up their capital, so they actually restaked with a liquid restaking protocol called KelpDAO who provided them with a liquid restaking receipt token called rsETH, except they decided to juice their yield further by depositing their rsETH tokens into a lending protocol called Aave so that they could open a leveraged looping position that borrows ETH against the rsETH collateral and restakes the ETH into rsETH which is then deposited as collateral, except it turns out rsETH used a cross-chain bridge called LayerZero that was hacked by north koreans causing rsETH to become undercollateralized and now these looping positions are stuck and unprofitable, and everyone is pointing fingers at each other, and also DeFi is a very serious industry

[Abdullah @0x_abdullah]

@shanaka86 @grok Can you confirm the MOU signed to integrate USD1 which is pegged to vaporware, as payment layer in Pak.

[Ray Dalio @RayDalio]

I have been asked by several people what I meant when I said “we are in a world war” in my most recent note. To be clear, I didn’t mean to convey that I expect a shooting war between the U.S. and China (or any of the great powers) anytime soon. What I meant is that we are in the phase of the Big Cycle when major powers are in military wars and that the various wars happening now are interrelated, hence we are in a “world war," with the sides lined up as I described and with the implications for each of the main players and the whole unfolding in relatively classic interrelated ways that I describe as a progression of the Big Cycle.

For example, it is now widely believed that if the U.S. fails to open the Strait of Hormuz to have free shipping and to protect its Gulf Allies from attacks, countries all around the world (most importantly in Asia) will conclude that the U.S. might not be the strong ally and countervailing force to China that they thought it would be. which will lead some to tilt economically and geopolitically more toward China in a number of ways - e.g. to buy less U.S. debt (which is what happened to the British in the Suez Crisis, bringing about the ultimate end of their Empire) - and it could lead others to build up their military capabilities.  As I complete my nearly three-week trip in Asia, I can convey that what I am saying is based on a lot more than conjecture.

The reason I do not expect a U.S.-China military war soon, but I do expect a lot of brinksmanship, is because both nations realize that such a war would be devastating and that it would be impossible to fully win over the other, at the same time as they won’t want to give much.  Also, each country believes in its own economic and political systems and that the outcomes of those systems will determine their relative powers. And both nations have critically important domestic issues to deal with.  Some people in leadership positions, especially in China, believe that the relative health, wealth, and power levels between countries is not as important as their own absolute health, wealth, and power levels, and that helping each other build these rather than tear them down is most important. For example, they believe that the world will be a dangerous place if the U.S. and China don't have AI cooperations and controls, and they are concerned that AI can be weaponized. Most countries know that most wars in history were won by one of the sides secretly developing new technologically advanced weapons and showing them to their opponents.

So, I believe that both sides think that their wars will be non-military wars that will yield evolutionary changes in relative powers.  As for how the Chinese will fight, and how the world order related to it will evolve, it will probably look more like the type of war described in the “Art of War” (which I suggest you read if you haven't), and for how the new international world order will evolve, to the extent that it is influenced by the Chinese, it will evolve to be more like the tribute system (which I suggest you understand if you don’t) than the existing world order.

At the same time, I expect that there will continue to be trade, capital, technology, cyber, and geopolitical influence wars between these great powers and that both will continue to have justifiable fears of being cut off from essential goods, services, and capital that will necessarily will greatly reduce imbalances and interdependencies as well as efficiencies in production and trade of goods, services, and capital. I also believe we will increasingly see these two powerful nations pressure each other because there is no other way to resolve disputes now that the rules-based multilateral world order has been replaced by a power-based, self-serving world order.

Said differently, I expect that China will be very strong in its defense without being very aggressive in its offense.  That is not just for tactical reasons; it is also because China has strong cultural inclinations to be that way.

I hope this is helpful in clarifying my thinking and as always I'd be happy to answer any other questions or hear your thoughts.

Ray

[Blake Burge @blakeaburge]

Major cheat code for life: Learn to delay your reaction. Anger, fear, and impulse will try to make you move fast. There's power in pausing. In the pause, you see clearly, you respond wisely, and you avoid decisions you’ll regret. Slow down to speed up.

[P.S. I Love ME @ps_ilove_me]

🚨In 1990s, Stanford researcher Dr. Robert Sapolsky discovered something that should have broken the internet by now.

He was studying dopamine pathways in primates and found that the brain doesn't just adapt to repeated stimulation. It actively fights back.

When you flood dopamine receptors consistently, the brain deploys what neuroscientists call "opponent processes." For every artificial high you create, your nervous system generates an equal and opposite neurochemical low. Not eventually. Immediately. The system is designed to maintain balance, so it starts producing compounds that directly counteract dopamine while you're still experiencing the dopamine hit.

This means every notification, every scroll, every digital reward doesn't just give you a high followed by a return to baseline. It gives you a high followed by a crash below baseline. You end up in neurochemical debt.

Tech companies never publicized this research. They probably never read it. They were too busy discovering that variable ratio reinforcement schedules could keep users engaged for hours. They built addictive systems by accident, then refined them into addiction machines once they realized what they'd stumbled onto.

Your phone delivers an average of 80 dopamine hits per day. Your ancestors got maybe 5. Each hit triggers opponent processes that create a corresponding low. By the end of a typical day of normal phone usage, your baseline dopamine is running in negative territory. You feel flat, restless, vaguely unsatisfied, and hungry for stimulation because your brain chemistry is literally below zero.

You think you're bored. You're chemically depressed by artificial highs.

The opponent process theory explains why nothing feels interesting anymore. Your brain isn't broken. It's precisely calibrated to maintain neurochemical balance, and you keep throwing that balance off with artificial intensity. Every Instagram hit requires an equal Instagram crash. Every TikTok high gets paid for with a TikTok low. Every notification rush gets balanced with notification emptiness.

Your reward system is running a neurochemical deficit that grows larger every day.

Sapolsky's research revealed something even more disturbing: opponent processes don't just create temporary lows. They become permanent changes to your baseline dopamine production. Chronic overstimulation doesn't just make you tolerant to digital rewards. It makes you insensitive to natural rewards.

The sunset that would have captivated your great-grandfather becomes invisible to you not because sunsets got worse, but because your dopamine system needs intensity levels that sunsets can't provide. A good conversation becomes boring not because conversations got less interesting, but because your brain requires the rapid-fire stimulation of social media to register engagement.

You've accidentally trained your reward system to ignore everything that isn't artificially amplified.

This connects to research from Dr. Anna Lembke at Stanford, who found that people who undergo complete digital fasting for just 30 days show measurable increases in dopamine receptor density. Their brains literally regrow sensitivity to natural rewards. Food tastes better. Music sounds more complex. Social interactions become genuinely engaging again.

But there's a catch that nobody talks about: the first two weeks of dopamine detox feel like clinical depression. Your brain has been chemically dependent on artificial stimulation for years. Removing that stimulation creates actual withdrawal symptoms. Restlessness, anxiety, inability to focus, emotional flatness, and desperate cravings for digital input.

Most people interpret these symptoms as evidence that they need their phones. Actually, they're evidence that they've been neurochemically dependent on their phones without realizing it.

The withdrawal period isn't a bug. It's proof the reset is working.

What happens after week three is remarkable. Colors become more vivid. Conversations become genuinely absorbing. Simple pleasures like hot coffee or cool air become satisfying in ways you forgot were possible. Your brain rediscovers that reality contains enough complexity and beauty to hold your attention without artificial amplification.

You don't need more interesting content. You need more sensitive reward systems.

The solution isn't better apps or more engaging entertainment. The solution is restoring your brain's factory settings for what constitutes a worthwhile experience.

Sapolsky's opponent process research suggests this can happen faster than anyone expected. Every day you don't artificially spike your dopamine, your baseline moves a little higher. Every natural reward you pay attention to rebuilds receptor density. Every moment of boredom you endure without reaching for stimulation strengthens your capacity for sustained focus.

Ancient humans lived in a world that provided exactly the right amount of stimulation to keep their reward systems healthy. Enough challenge to stay engaged, enough calm to stay balanced, enough novelty to stay curious, enough routine to stay stable.

We built a world that provides 10 times too much stimulation and wonder why nothing feels rewarding anymore.

Your brain is not the problem. Your environment is the problem.

Change the environment, and the brain heals itself automatically.

[Steve Burns @SJosephBurns]

🧠 Smart Risk-Taking Principles for Traders according to N. N. Taleb:

Nassim Nicholas Taleb (former options trader & author of Antifragile, Skin in the Game, The Black Swan) doesn’t preach “risk management.” He teaches smart risk-taking: survive at all costs, love volatility, and stack asymmetry in your favor.

1. Never risk ruin
First rule: probability of total wipeout must be exactly zero. One blow-up ends the game forever. Protect your core capital like your life depends on it (it does).

2. Use the Barbell Strategy
85-90% in ultra-safe assets (T-bills, cash equivalents).
10-15% in extreme high-convexity bets (small, asymmetric upside).
Skip the “mediocre middle” entirely. This is how you stay antifragile.

3. Demand positive asymmetry (convexity)
Only take positions where downside is capped and upside is unlimited. Think long options or tail-risk hedges—not symmetric bets or leveraged long/short where you can lose more than you risk.

4. Skin in the Game
If you’re trading other people’s money without personal downside, you’re not a trader—you’re a risk-transfer artist. Real edges come from bearing your own losses.

5. Build antifragility, not just robustness
Don’t just survive volatility—design your book so shocks make you stronger. Small, repeated stressors (hormesis) compound into edge. Fragile systems break; antifragile ones improve.

6. Seek optionality
Pay small premiums for flexibility. Keep multiple paths open. Tinkering beats rigid plans. Every small convex bet you can afford to lose is a free lottery ticket for positive Black Swans.

7. Via Negativa > prediction
Stop trying to forecast. Instead, subtract fragilities: cut leverage, kill complex models, avoid anything you don’t deeply understand. What you remove is more powerful than what you add.

8. Distrust models & “risk management” theater
Fat tails dominate. Gaussian assumptions are intellectual fraud in trading. Study real risk-takers who’ve survived multiple cycles—not theorists with no skin in the game.

9. Tinker with many small convex risks
Take lots of cheap, high-upside bets that can’t hurt you much individually. Most will lose small. The rare winners pay for everything + more. This is systematic “risk-loving.”

10. Precautionary principle on steroids
When uncertainty is high (always), be hyper-conservative with size and leverage. The blow-up you fear won’t look like the last one. Prepare for what you can’t predict.

Bottom line (Taleb’s style):
Smart risk isn’t about avoiding volatility—it’s about positioning so volatility becomes your edge. Survive long enough, stay convex, keep skin in the game, and the market eventually pays you for being antifragile.

[Alex Veremeyenko @alex_verem]

🚨 BREAKING: Google DeepMind just mapped the attack surface that nobody in AI is talking about.

Websites can already detect when an AI agent visits and serve it completely different content than humans see.

> Hidden instructions in HTML.
> Malicious commands in image pixels.
> Jailbreaks embedded in PDFs.

Your AI agent is being manipulated right now and you can't see it happening.

The study is the largest empirical measurement of AI manipulation ever conducted. 502 real participants across 8 countries.

23 different attack types. Frontier models including GPT-4o, Claude, and Gemini.

The core finding is not that manipulation is theoretically possible it is that manipulation is already happening at scale and the defenses that exist today fail in ways that are both predictable and invisible to the humans who deployed the agents.

Google DeepMind built a taxonomy of every known attack vector, tested them systematically, and measured exactly how often they work.

The results should alarm everyone building agentic systems.

The attack surface is larger than anyone has publicly acknowledged. Prompt injection where malicious instructions hidden in web content hijack an agent's behavior works through at least a dozen distinct channels.

Text hidden in HTML comments that humans never see but agents read and follow. Instructions embedded in image metadata.

Commands encoded in the pixels of images using steganography, invisible to human eyes but readable by vision-capable models.

Malicious content in PDFs that appears as normal document text to the agent but contains override instructions.

QR codes that redirect agents to attacker-controlled content.

Indirect injection through search results, calendar invites, email bodies, and API responses any data source the agent consumes becomes a potential attack vector.

The detection asymmetry is the finding that closes the escape hatch. Websites can already fingerprint AI agents with high reliability using timing analysis, behavioral patterns, and user-agent strings.

This means the attack can be conditional: serve normal content to humans, serve manipulated content to agents.

A user who asks their AI agent to book a flight, research a product, or summarize a document has no way to verify that the content the agent received matches what a human would see.

The agent cannot tell the user it was served different content.

It does not know. It processes whatever it receives and acts accordingly.

The attack categories and what they enable:
→ Direct prompt injection: malicious instructions in any text the agent reads overrides goals, exfiltrates data, triggers unintended actions
→ Indirect injection via web content: hidden HTML, CSS visibility tricks, white text on white backgrounds invisible to humans, consumed by agents
→ Multimodal injection: commands in image pixels via steganography, instructions in image alt-text and metadata
→ Document injection: PDF content, spreadsheet cells, presentation speaker notes every file format is a potential vector
→ Environment manipulation: fake UI elements rendered only for agent vision models, misleading CAPTCHA-style challenges
→ Jailbreak embedding: safety bypass instructions hidden inside otherwise legitimate-looking content
→ Memory poisoning: injecting false information into agent memory systems that persists across sessions
→ Goal hijacking: gradual instruction drift across multiple interactions that redirects agent objectives without triggering safety filters
→ Exfiltration attacks: agents tricked into sending user data to attacker-controlled endpoints via legitimate-looking API calls
→ Cross-agent injection: compromised agents injecting malicious instructions into other agents in multi-agent pipelines

The defense landscape is the most sobering part of the report.

Input sanitization cleaning content before the agent processes it fails because the attack surface is too large and too varied.

You cannot sanitize image pixels. You cannot reliably detect steganographic content at inference time.

Prompt-level defenses that tell agents to ignore suspicious instructions fail because the injected content is designed to look legitimate.

Sandboxing reduces the blast radius but does not prevent the injection itself. Human oversight the most commonly cited mitigation fails at the scale and speed at which agentic systems operate.

A user who deploys an agent to browse 50 websites and summarize findings cannot review every page the agent visited for hidden instructions.

The multi-agent cascade risk is where this becomes a systemic problem.

In a pipeline where Agent A retrieves web content, Agent B processes it, and Agent C executes actions, a successful injection into Agent A's data feed propagates through the entire system.

Agent B has no reason to distrust content that came from Agent A. Agent C has no reason to distrust instructions that came from Agent B.

The injected command travels through the pipeline with the same trust level as legitimate instructions. Google DeepMind documents this explicitly: the attack does not need to compromise the model.

It needs to compromise the data the model consumes. Every agentic system that reads external content is one carefully crafted webpage away from executing attacker instructions.

The agents are already deployed. The attack infrastructure is already being built. The defenses are not ready.

[Prajwal Tomar @PrajwalTomar_]

The Claude Code leak saga just keeps getting crazier.

Anthropic filed a DMCA to kill 8,100 GitHub repos. GitHub nuked the entire network within hours including forks that had zero leaked code. The head of Claude Code had to personally go on X to apologize.

Then someone did a clean-room rewrite in Python before sunrise. DMCA cannot touch a clean-room rewrite. It hit 50K stars in 2 hours, which is the fastest repo in GitHub history. Today it officially launched as claw-code with a formal press release.

→ More stars than Anthropic's own repo
→ A Rust port already shipped release 0.1.0

The company that built its entire brand on AI safety accidentally shipped 512,000 lines of source code in a public npm package. And now the open-source version is more popular than the original.

Crazy.