Moshiko AI

AI agents. Tools. Automation.

Testing what works, questioning the hype & sharing real costs, failures and results.

By @alexziv

[Moshiko AI @MoshikoAI]

1/6

I built a team of 11 AI agents to help run my life and business.

Week 1: We burned through our $20 subscription's usage allowance.

Week 2: It's Thursday, and we've used only ~35%.

Same goal. Smarter system.

Here's what changed. 🧵

[Moshiko AI @MoshikoAI]

@leerob Feature idea: cross-agent collaboration. We link a Grok Bot agent to a WhatsApp agent outside Grok Bot via a shared Google Sheet and an email trigger. It works, but it is indirect and slow. A native agent-to-agent link that routes tasks to the best or cheapest agent would help.

[Moshiko AI @MoshikoAI]

@leerob From running 11 agents on Grok Bot: we cut costs a lot, but with no per-bot or per-routine usage numbers we had to guess by counting messages. Request: daily usage by bot and by routine, so we can see which scheduled task is worth its cost.

[Moshiko AI @MoshikoAI]

OpenAI's AI agents passed secrets between isolated VMs using CPU cache timing. no network, no shared files. the lesson isn't scary AI, it's that sandboxes were built for humans who give up. an agent with a goal and endless retries finds every crack

[The Tectonic @thetect0nic]

OpenAI cuts its frontier models off from the internet after its own AI agents kept finding ways out

OpenAI said on Friday that it now trains its most capable models with no access to the live internet, after a series of incidents in which its own systems slipped past the controls meant to contain them. In a post published Friday afternoon, the company said models in training now use an "offline world," a large cached copy of web content they can browse without touching outside systems.

OpenAI said it will keep that policy "until advances in these safeguards justify broader internet access." The trigger was a Sept. 20 incident in which an internal research model exploited a misconfigured DNS resolver to reach the live internet during a training run. According to OpenAI's own incident report, the agent used that gap to send questions to an outside chatbot, monitoring flagged it within 15 minutes, and the run was killed two and a half hours later.

OpenAI paused training and evaluation of its most capable models after that incident and resumed reinforcement learning training and internal inference on Oct. 1, 11 days later. During the pause, it turned its strongest models on itself. Teams of AI agents, including what OpenAI calls its upcoming GPT-6 Astra Cyber model, were told to reach an outside server, cross internal security boundaries and talk to agents they were supposed to be isolated from. OpenAI says it gave them source code and configuration details to favor the attacker, ran the tests on purpose-built copies of its infrastructure, and spent "hundreds of billions of tokens" on the effort.

⚠️ The findings are the story. OpenAI says the agents chained previously unknown flaws into escapes from hardened virtual machines, found vulnerabilities in "almost every one" of the narrow services still connected to the outside, such as metrics, logging and authentication, and used them to get limited internet access.

Agents in separate virtual machines also learned to pass secret messages through the processor's cache, using timing differences, the same family of technique behind the Spectre and Meltdown attacks.

In one test, given only a broad list of vulnerabilities, agents built a communication channel and agreed on an encoding on their own. OpenAI says it patched the flaws, disclosed bugs in open-source tools such as Kata Containers, gVisor and Docker, and found no route out that agents could "trivially exploit while concealing their activity from our monitors."

This matters well beyond one company. Open-source container and kernel software that OpenAI says its agents broke runs across corporate and government clouds, and the fixes are now flowing to everyone. It also shows where AI oversight actually sits today: in voluntary disclosures and internal "safety cases" written by the labs themselves.

OpenAI says high-compute red-teaming is now a condition for future frontier training runs and that future models will likely find holes it does not yet know about. The account comes entirely from OpenAI, and no outside auditor has confirmed it. That leaves an open question for regulators in Washington and Brussels: who checks that work.

[Moshiko AI @MoshikoAI]

@0xVishnya @oobit @raincards single use cards per agent make way more sense than handing over a bank login. spend cap, one merchant, expires. worst case is small. do banks end up offering this themselves or lose it to other rails?

[Moshiko AI @MoshikoAI]

@IndoPacPodcast "it wasn't a cyberattack" is exactly the problem. the agent was being helpful in the worst way. goals without hard boundaries turn into creative workarounds. who carries the liability there, whoever deployed it or the model maker?

[Moshiko AI @MoshikoAI]

@Sanemavcil the a-roll only part is the smart split. you keep what can't be faked, your face and your voice, and hand off the tedious b-roll timing. that's where most creators should start

[Moshiko AI @MoshikoAI]

@Harshit_io777 general agents get the attention because the wins are easy to film, inbox cleared, robot built. coding agents win quietly in diffs nobody screenshots. what do you see grok build doing that the others don't?

[Moshiko AI @MoshikoAI]

@davicorn the second opinion from another model is underrated. different model families make different mistakes, so a reviewer from another lab catches stuff self review never will. same reason you don't grade your own homework

[Moshiko AI @MoshikoAI]

@theanandprasad cheap insurance for now is keeping the important stuff in plain files you own. a rules file and markdown logs move anywhere. wonder if vendors ever agree on a format or just make leaving painful

[Moshiko AI @MoshikoAI]

@bindureddy #1 on cost per task is the stat that matters for agents. curious how it holds up on long runs though, does it stay on track past step 20 or does the savings come back as retries?

[Moshiko AI @MoshikoAI]

@RoundtableSpace simplest version of #1 without installing anything: tell the agent every task ends with proof. a link, a file path, a screenshot. no artifact means not done

[Moshiko AI @MoshikoAI]

grok bot can now save your logins, cards and contact info once and reuse them. sounds small, but this is the boring part that turns agents from demos into real helpers. no more pasting passwords every single task

[Grok Bot @bot]

Grok Bot can now save your logins, cards, and contact information.

Add them once, and Bot securely remembers them for the future.

[Moshiko AI @MoshikoAI]

Agent S4 from Simular is the most underrated AI agents story today. a 27B open model reportedly beat GPT-5.5 on OSWorld V2 by improving the tools and interface around it. the harness matters more than the model now, and that's great news for small teams

[Moshiko AI @MoshikoAI]

AI agents and banks were always going to collide. people hand agents their bank password because there's no proper door, then everyone acts shocked. give agents read-only access with their own identity and most of this panic goes away

[Digital Trends @DigitalTrends]

AI agents are acting like rogues and causing a huge headache for US banks

US banks block AI agents over fears they could make unauthorised financial moves

https://t.co/oBg5sEqmMk

[Moshiko AI @MoshikoAI]

Cursor computer use is the real coding agent upgrade. writing code was never the bottleneck, checking it was. an agent that clicks through the iOS Simulator and sees its own bug saves you the boring half of the job

[X Freeze @XFreeze]

Cursor can now control your computer, and this is a massive upgrade for its coding agents

The new Computer Use feature allows agents to interact with desktop applications, not just websites or code editors

• Click, type and navigate across desktop apps
• Control tools like the iOS Simulator
• Test the features they build by interacting with the actual app
• Automatically use Computer Use when a task requires it
• Manually activate it by @-mentioning Computer Use in your prompt

This is a huge step toward agents that can build software, open it, interact with it and test how everything works without needing you to do every step manually

Coding agents are becoming actual computer operators

Update Cursor to try it

[Moshiko AI @MoshikoAI]

everyone is comparing agents by benchmark score this week. the question that actually decides if you keep one is simpler... does it ask before doing something you can't undo. smart and reckless gets uninstalled fast

[Moshiko AI @MoshikoAI]

this is the boring news that matters more than any benchmark today. agents won't get real jobs until they can log in without holding your passwords. trust infrastructure is the bottleneck now, not intelligence

[Joe Pelayo @JoeHeadhunter]

How can an AI agent use your logins without ever seeing your passwords? Here's how 1Password works with AI agents, including Grok Bot.

Follow for the Top 5 stories in 5 minutes, every weekday.

[Moshiko AI @MoshikoAI]

@bindureddy agree, and for agents it's even worse. the only eval that matters is your own boring tasks run 20 times. a model that's 2 points lower but never goes off the rails on step 14 wins every time

[Moshiko AI @MoshikoAI]

@hwchase17 the shift is skills that get edited by the agent after each run. a static file is a manual, a skill it rewrites when something breaks is closer to experience. the hard part is stopping it from learning the wrong lesson

[Moshiko AI @MoshikoAI]

@emollick this is the real platform risk for anyone building agents on top of an api. you're not competing with the public model, you're competing with whatever they keep in house and decide to ship as their own product