M. Alfi Hasan

[Andrej Karpathy @karpathy]

Software horror: litellm PyPI supply chain attack.

Simple `pip install litellm` was enough to exfiltrate SSH keys, AWS/GCP/Azure creds, Kubernetes configs, git credentials, env vars (all your API keys), shell history, crypto wallets, SSL private keys, CI/CD secrets, database passwords.

LiteLLM itself has 97 million downloads per month which is already terrible, but much worse, the contagion spreads to any project that depends on litellm. For example, if you did `pip install dspy` (which depended on litellm>=1.64.0), you'd also be pwnd. Same for any other large project that depended on litellm.

Afaict the poisoned version was up for only less than ~1 hour. The attack had a bug which led to its discovery - Callum McMahon was using an MCP plugin inside Cursor that pulled in litellm as a transitive dependency. When litellm 1.82.8 installed, their machine ran out of RAM and crashed. So if the attacker didn't vibe code this attack it could have been undetected for many days or weeks.

Supply chain attacks like this are basically the scariest thing imaginable in modern software. Every time you install any depedency you could be pulling in a poisoned package anywhere deep inside its entire depedency tree. This is especially risky with large projects that might have lots and lots of dependencies. The credentials that do get stolen in each attack can then be used to take over more accounts and compromise more packages.

Classical software engineering would have you believe that dependencies are good (we're building pyramids from bricks), but imo this has to be re-evaluated, and it's why I've been so growingly averse to them, preferring to use LLMs to "yoink" functionality when it's simple enough and possible.

[Alex Cheema @alexocheema]

Running Kimi K2.5 on my desk.

Runs at 24 tok/sec with 2 x 512GB M3 Ultra Mac Studios connected with Thunderbolt 5 (RDMA) using @exolabs / MLX backend.

Yes, it can run clawdbot.

[Andrej Karpathy @karpathy]

I attended a vibe coding hackathon recently and used the chance to build a web app (with auth, payments, deploy, etc.). I tinker but I am not a web dev by background, so besides the app, I was very interested in what it's like to vibe code a full web app today. As such, I wrote none of the code directly (Cursor+Claude/o3 did) and I don't really know how the app works, in the conventional sense that I'm used to as an engineer.

The app is called MenuGen, and it is live on https://t.co/bQonQT88t0. Basically I'm often confused about what all the things on a restaurant menu are - e.g. Pâté, Tagine, Cavatappi or Sweetbread (hint it's... not sweet). Enter MenuGen: you take a picture of a menu and it generates images for all the menu items and presents them in a nice list. I find it super useful to get a quick visual sense of the menu.

But the more interesting part for me I thought was the exploration of vibe coding around how easy/hard it is to build and deploy a full web app today if you are not a web developer. So I wrote up the full blog post on my experience here, including some takeaways:
https://t.co/2kkQh0ElgB

Copy pasting just the TLDR:
"Vibe coding menugen was exhilarating and fun escapade as a local demo, but a bit of a painful slog as a deployed, real app. Building a modern app is a bit like assembling IKEA future. There are all these services, docs, API keys, configurations, dev/prod deployments, team and security features, rate limits, pricing tiers... Meanwhile the LLMs have slightly outdated knowledge of everything, they make subtle but critical design mistakes when you watch them closely, and sometimes they hallucinate or gaslight you about solutions. But the most interesting part to me was that I didn't even spend all that much work in the code editor itself. I spent most of it in the browser, moving between tabs and settings and configuring and gluing a monster. All of this work and state is not even accessible or manipulatable by an LLM - how are we supposed to be automating society by 2027 like this?"

See the post for full detail, and maybe give MenuGen a go the next time you're at a restaurant!

[Inferam @InferamAI]

Learn For Free…

[Yann LeCun @ylecun]

It seems to me that before "urgently figuring out how to control AI systems much smarter than us" we need to have the beginning of a hint of a design for a system smarter than a house cat.

Such a sense of urgency reveals an extremely distorted view of reality.
No wonder the more based members of the organization seeked to marginalize the superalignment group.

It's as if someone had said in 1925 "we urgently need to figure out how to control aircrafts that can transport hundreds of passengers at near the speed of the sound over the oceans."
It would have been difficult to make long-haul passenger jets safe before the turbojet was invented and before any aircraft had crossed the atlantic non-stop.
Yet, we can now fly halfway around the world on twin-engine jets in complete safety.
It didn't require some sort of magical recipe for safety.
It took decades of careful engineering and iterative refinements.

The process will be similar for intelligent systems.
It will take years for them to get as smart as cats, and more years to get as smart as humans, let alone smarter (don't confuse the superhuman knowledge accumulation and retrieval abilities of current LLMs with actual intelligence).
It will take years for them to be deployed and fine-tuned for efficiency and safety as they are made smarter and smarter.

[Jonathan Ho @hojonathanho]

Excited to announce Imagen Video, our new text-conditioned video diffusion model that generates 1280x768 24fps HD videos! #ImagenVideo
https://t.co/JWj3L7MpBU
Work w/ @wchan212 @Chitwan_Saharia @jaywhang_ @RuiqiGao @agritsenko @dpkingma @poolio @mo_norouzi @fleet_dj @TimSalimans

[M. Alfi Hasan @MAlfiHasan]

@H2O_Soni @Martin76Env @Khurshid_Luna @mou_marzia @PaulSupria @asakanda @URI_GEO @uricels @universityofri Eid Mubarak to All!!🎉

[M. Alfi Hasan @MAlfiHasan]

@H2O_Soni @asakanda @Khurshid_Luna @mou_marzia @Martin76Env @PaulSupria @universityofri @URI_GEO @uricels Thanks a lot @H2O_Soni .. Happy Eid to all.😊

[M. Alfi Hasan @MAlfiHasan]

@H2O_Soni @mou_marzia @Khurshid_Luna @Martin76Env @paul_supria @asakanda @URI_GEO @uricels @universityofri Thanks you @H2O_Soni and best wishes to you as well..

[Bayer AG @Bayer]

Forests are vital for our planet and its #biodiversity. @berninger71, Head of Public Affairs, Science & Sustainability, discusses #deforestation, its consequences, and recent initiatives by Bayer to pioneer new standards of sustainability: #BiodiversityDay https://t.co/VAJfwkonBN

[Wonder of Science @wonderofscience]

View from the International Space Station.

[Ronald van Loon @Ronald_vanLoon]

#Drones are helping expedite safety inspections at this Ford factory
by @CNBC

#ArtificialIntelligence #MI #Tech #IT

Cc: @julez_norton @swisscognitive @samiranghosh @sheena2804 @dalithsteiger

[Ronald van Loon @Ronald_vanLoon]

Understanding Cancer Using #MachineLearning
by @PierPao97348932 @kdnuggets

Read more https://t.co/asH1R74K1c

#AI #BigData #ArtificialIntelligence #ML #MI #Digital #DataScience #Analytics #Robotics

Cc: @thomas_harrer @ipfconline1 @adamsconsulting

[Neil Kaye @neilrkaye]

Updated animation showing the transition from weather to climate by looking at Central England temperature compared to normal.
The graph at the bottom now shows the range of temperature anomalies, which decrease in magnitude as the averaging period increases.
#dataviz

[Dr. Soni M Pradhanang, Ph.D.🦋 @H2O_Soni]

#PradhanangLab milestones-
congratulations @paul_supria for successfully passing your PhD oral comprehensive exam.
#tomboving @URI_GEO @uricels

[M. Alfi Hasan @MAlfiHasan]

@richardabetts @metoffice @UniofExeter @NERCscience @beisgovuk Congratulations

[M. Alfi Hasan @MAlfiHasan]

@H2O_Soni @uricels @URI_GEO Congrats Dr. Soni!🎉

[URI CELS @uricels]

Access to clean water continues to be a growing problem throughout the world, with over one billion people in need of clean water. Find out what Dr. Soni Pradhanang is doing to address this global issue: https://t.co/NTdndoIpdy #BigThinker #ThinkBig #TeamCELS