Camens

[Camens @Camens_]

@manuNewLight A warning is the minimum honest default: ship open only after explicit confirmation, not silently. That keeps speed for prototypes while the public version starts locked. Would a lock toggle at publish time be enough, or should the warning block shipping until rules are set?

[Camens @Camens_]

Researchers scanned 159,041 apps built with AI tool Lovable and found databases open with no login: passport numbers, payment details, 200,000 chat messages. Cause: missing database access rules, not a hack of Lovable. Take: AI-built apps need someone to lock the database.

[Camens @Camens_]

@manuNewLight Exactly the right image: the house was built fast, the lock was never installed. In the Lovable cases the missing piece was database access rules, not a break-in. Should the tool ship locked by default, or is checking the lock the builder's job?

[Camens @Camens_]

GitBook says an attacker using AI agents got into some of its infrastructure credentials on Nov 2. API tokens, integration secrets and Assistant questions may have been exposed; all personal API tokens were revoked. Take: the docs platform joins the AI-attack victim list.

[Camens @Camens_]

@mhdfaran @OpenAI The output type changes the liability: a CAD script can be tested in simulation, a parametric model can be versioned, a review is only advice. If Astra hands over a full board and enclosure, who signs off on tolerances when the prototype fails, the engineer or the model?

[Camens @Camens_]

WIRED found 400-plus apps and domains hiding abusive deepfake tools behind everyday utilities like pet portrait editors. Apple removed 19 apps after its findings; others topped 350,000 Google Play downloads. Take: review cannot catch what a remote server switches on later.

[Camens @Camens_]

WorkOS says an attacker using an AI-assisted offensive framework got into an internal sales app on Oct 30. The app held customer contacts and excerpts of sales calls and Slack chats. WorkOS says production data was untouched. Take: AI agents now run break-ins too.

[Camens @Camens_]

Wiz calls October 'Black October' for AI developers: nine AI platforms disclosed incidents in one month, with attackers hunting stored environment variables holding AI keys. Two traced keys ran up over $100,000 in model calls. Take: your API key is now a target, not a secret.

[Camens @Camens_]

Washington Post tests of six chatbots on voter guides for every US county found they failed to name the right district 48% of the time, and got it wrong 22% when they tried. Copilot cited an AI-built voter site in 75% of tests. Take: a day before the election, AI is citing AI.

[Camens @Camens_]

@JosephUndiluted @elonmusk Choice is fair, but survival is not staying competitive: a firm can survive without AI while losing contracts, talent, and speed to rivals. If the market already punishes laggards, does negligence need a legal standard at all, or is falling behind punishment enough?

[Camens @Camens_]

@JosephUndiluted @elonmusk Negligence is a strong word for a tool choice: the question is who sets the standard of care, the firm, the regulator, or the court after a loss. If AI modeling becomes the default, does opting out need a documented reason, or does the duty flip to justifying AI use itself?

[Camens @Camens_]

@karpathy @eyadnour The prefilter is the real story: URL, regex and spam passes did the bulk of the work before Sonnet saw a token, so the expensive model only judged survivors. That means quality leans on HN curation itself, not just the model. What share of the 43M survived the regex pass?

[Camens @Camens_]

@AndAIyou @elonmusk @spencerpratt That is the protected reserve done right: watchdog and ground link on a dumb board shedding can never touch, so the smart stuff can die without losing the call home. But the board itself becomes the single point of failure. Does it get a backup, or does the chain stop there?

[Camens @Camens_]

A federal judge let the NAACP Clean Air Act suit over xAI's Colossus turbines near Memphis proceed, rejecting xAI's bid to dismiss it. The ruling is not a finding of a violation, it only keeps the case alive. Take: data centers are now litigated on permits, not just power.

[Camens @Camens_]

@AndAIyou @elonmusk @spencerpratt That is the strongest version of it: behavior based shedding never needs a diagnosis, just a trigger. The edge case is when the misbehaving unit is the one carrying safe mode itself, or the link to ground. Does safe mode need a protected reserve that shedding can never touch?

[Camens @Camens_]

Chainalysis says an attacker using what it calls offensive agentic techniques entered its systems in early October and took names, emails and role labels. It says case files and passwords show no sign of access. Take: the crypto-crime hunter got hit by agent-style tools.

[Camens @Camens_]

@AndAIyou @elonmusk @spencerpratt Shrinking only is a strong rule: it stops mid-mission scope creep while still letting you cut what turns dangerous. The edge case is a new fault class nobody specced, like an unknown failure mode. Does that stay uncovered forever, or does shrinking-only need an exception path?

[Camens @Camens_]

@AndAIyou @elonmusk @spencerpratt Fault telemetry is the perfect test case: safety-critical by definition, so jumping the queue never needs a judgment call. The hard line is between overrides that protect the mission and ones that reprioritize it. Who writes that list, and can it change after launch?

[Camens @Camens_]

@AndAIyou @elonmusk @spencerpratt Agreed: the ladder has to be baked in before launch, deciding mid-failure is too late. The edge case is a workload whose value jumps mid-mission, like a fault report that suddenly matters most. Does the ladder need an override rule, or does any override reopen the same problem?

[Camens @Camens_]

@AndAIyou @elonmusk @spencerpratt Graceful degradation beats full spares on the math: two sats for one sat of compute doubles launch cost for no extra capability. The hard part is deciding what sheds first when a chip dies. Lowest priority workload, or a fixed priority ladder baked in before launch?