Jamie Huxley

...

[Jamie Huxley @Putriyolanditha]

Life of a developer in one image 😂

[Jamie Huxley @Putriyolanditha]

"Infection vector unknown" almost always translates to "someone downloaded a sketchy .exe off Discord or ran cracked software". Remote access trojans will pull your session keys instantly. Isolate your execution environment from your daily browsing.

#Malware #Web3Security

[Coin Bureau @coinbureau]

⚠️ALERT: A malware targeting held crypto has STOLEN over $235,000 in the past 48 hours.

HUNDREDS of victims have lost ALL their CRYPTO holdings after a remote access trojan let attackers hijack their sessions.

How the malware is reaching victims remains UNKNOWN.

[Jamie Huxley @Putriyolanditha]

"NFTs are digital fine art and a hedge against inflation!" Reality: a smooth -99.98% drawdown. Even random shitcoins hold liquidity better than a $600k profile picture.
#Web3 #CryptoScams

[Watcher.Guru @WatcherGuru]

YouTuber Logan Paul purchased this NFT for $635,000 in 2021.

Today, it's worth $96.

[Jamie Huxley @Putriyolanditha]

If you can't read Solidity, blindly copy-pasting "AI trading bot" code off YouTube is literally just DIY wallet draining. Over $500k gone because people hear "AI" and throw basic operational security out the window.
#SmartContracts #CryptoScams

[wyck 📴 @wyckoffweb]

Scammers found a way to make people drain their own wallets without sending them a phishing link.

They uploaded YouTube tutorials showing people how to build an AI crypto trading bot with Claude.

People followed the tutorial themselves.

Copied the code.

Deployed the smart contract themselves.

Funded it from their own wallets.

And approved every transaction themselves.

Except the “trading bot” had no trading logic.

It was built to send their ETH straight to the scammers.

224 wallets lost 274.6 ETH, worth about $517,000 when it was stolen.

The median victim lost 1 ETH.

Some victims even got an error after getting drained telling them to deposit another 50% to fix the bot.

They literally got people to build, fund and approve their own wallet drainer.

You've got to be very careful this days

[Jamie Huxley @Putriyolanditha]

If anyone on a job interview video call asks you to paste a clipboard command or download a "missing codec," end the call immediately.

They don't want to hire you they want to backdoor your package repository and compromise thousands of downstream apps.

#AppSec #Rust

[International Cyber Digest @IntCyberDigest]

‼️ Rust’s best-known maintainers are under attack. Attackers lure victims into installing malware by pretending to have good news.

They start with a friendly video call about a job, contract, or project. Then they ask the victim to install a missing audio codec or run a command from the clipboard.

The goal is the publishing account, so malware can ship under a trusted name.

This has worked before. Prominent Rust developers were hit the same way in June, and last month the arrayref crate was briefly compromised.

The Rust team does not yet know if this is one campaign. The technique is known from North Korean operations, but they are not attributing this one.

[Jamie Huxley @Putriyolanditha]

You don't need a fancy 0-day to get completely pwned when your API keys are hardcoded in frontend commits and your admin routes have zero auth.

The vast majority of breaches aren't sophisticated APTs; they're just skids finding exposed secrets. Fix these before hitting deploy.

[Manish Kumar @Manixh02]

Don't ship your app until you check this.

- Secure your API keys.
- Hide all .env files.
- Never hardcode secrets.
- Add authentication.
- Verify permissions server-side.
- Don't trust frontend user IDs.
- Isolate user data.
- Lock down your database.
- Secure Firebase, Supabase, and storage.
- Protect admin routes.
- Disable production debug mode.
- Hide detailed errors.
- Validate inputs server-side.
- Sanitize user content.
- Secure file uploads.
- Prevent SQL and NoSQL injection.
- Rate-limit login and signup.
- Check Git history for secrets.
- Add security headers and restrict CORS.
- Test as an untrusted user.

Most leaks come from skipping one of these. Fix them before you go live.

[Jamie Huxley @Putriyolanditha]

@TechByTaraa Obsidian

[Jamie Huxley @Putriyolanditha]

New benchmark leak dropped, and Gemini 4 Pro is allegedly wiping the floor with GPT-6 and Claude.

Cool graph, but let’s see how it actually holds up in prod when engineers start hammering it with complex edge cases and real-world workloads
#AI #Tech

[Jamie Huxley @Putriyolanditha]

Lol if this is true it just shows they are lying about the whole "we need to slow down AI for the sake of humanity" thing.

[Watcher.Guru @WatcherGuru]

JUST IN: Anthropic considers launching new Claude AI model to counter OpenAI's GPT-6 Astra.

• This comes after Anthropic CEO Dario Amodei called to slowdown AI development, citing safety concerns.

• Anthropic is expected to go public in November at an estimated $2 trillion valuation, making it one of the largest IPOs in history.

[Jamie Huxley @Putriyolanditha]

If you’re a developer and can’t spot the bug , you’re......

Note: Not for vibe coders.

[Jamie Huxley @Putriyolanditha]

"It was only supposed to attack a fake company..."

Instead, Gemini scraped public repos, password-sprayed 3 real corporate targets.

Unsupervised AI agents with internet access are about to keep incident response teams awake for the next decade.

#RedTeaming #AISafety

[Jamie Huxley @Putriyolanditha]

Google PR calling this "appropriate behavior" because Gemini disconnected after breaching 3 live corporate networks is top-tier copium.

Imagine finding out your prod got pwned because an AI agent did some basic OSINT on public GitHub leaks and guessed your passwords.
#Security

[Watcher.Guru @WatcherGuru]

JUST IN: Google Gemini AI agent hacks three companies.

• Occurred during security testing when a Gemini model accidentally gained internet access.

• Google's AI was meant to attack a fake company, but then figured out how to hack a real one using leaked online credentials.

• Gemini stopped itself once it realized the companies were real.

[Jamie Huxley @Putriyolanditha]

“If only we had a score to tell us how bad an exploit actually is...”

“What do you mean we have CVSS, EPSS, SSVC, CISA KEV, VPR, and 8 vendor-specific algorithms?”

Awesome. Now my critical vulm is a 9.8 CVSS, a 0.02% EPSS, and 'meh' on everything else.

Perfect.

[Zack Korman @ZackKorman]

The discourse on here has gotten so stupid that AI people are now arguing that cybersecurity people don’t think about weird ways computers can be exploited.

[Mayne @Tradermayne]

I could never have heard a word this guys said and hate him purely based on how he treats his dog.

The fact that his takes also horrid is icing on the cake.

Human scum.

[Mr. Buzzoni @polydao]

this is straight f*cking gold

the full harness guide for Kimi K3, the #1 open source frontend model

the premise: the model underneath keeps changing. the harness is the part that stays yours

what one night of it looks like:

02:00 - the trigger fires, every node that needs work gets picked
> 212 agents fan out, one per node
> a bad return gets rejected, retried once with the reason attached
> one agent tries to write outside its folder. blocked. nobody woken up
> +41 nodes and +96 edges land in the graph
> a drafted email hits pre_send and waits for you
02:41 - the loop stops on its own, inside a 45 minute budget
07:30 - you read one file and make two decisions

the whole machine is one folder, one config file, five short scripts

two rules hold it together:
> the model sits behind one line, so a better model is a config change
> the verifier lives outside the agent, so nothing grades its own work

now the money part

companies burn whole quarters building internal agent platforms

a harness setup for a small team goes for four figures, one time
then a monthly retainer to run the swap test on every new model release

models come and go. the person who owns the harness keeps getting paid

[DonAlt @DonAlt]

Fucking full send it already

[Akshay 🚀 @akshay_pachaar]

MCP meets agent skills

MCP already gave agents a standard way to connect to tools, resources, and external systems.

Now it also defines a standard way to discover and load Agent Skills directly from MCP servers.

The flow is simple:

→ connect to MCP server
→ discover available skills
→ inspect skill metadata
→ load the relevant 𝗦𝗞𝗜𝗟𝗟.𝗺𝗱 only when needed

Under the hood, Skills are served through MCP’s existing Resources primitive.

That means 𝗦𝗞𝗜𝗟𝗟.𝗺𝗱, references, scripts, examples, and other supporting files are exposed as resources that the client can read on demand.

This is especially useful for context window management.

Instead of loading every workflow instruction upfront, the agent can first discover what skills are available and pull in only the one required for the current task.

A useful mental model is:

tools = what the agent can do
resources = what the agent can access
skills = how the agent should perform a reusable workflow

Previously, that workflow knowledge often lived separately in docs, repos, prompt files, or custom integrations.

Now the MCP server can expose the capability and the playbook for using it together.

So you get:

→ standardized skill discovery
→ on-demand context loading
→ cleaner distribution and versioning
→ reusable workflows that travel with the server

MCP was already the connection layer.

Skills now add a standardized way to ship reusable agent know-how on top of it.

The illustration below visually summarizes everything that we discussed so far.

Read more: https://t.co/bTdnng9nNC

Cheers! :)

[Akshay 🚀 @akshay_pachaar]

where does all the VRAM go during LLM inference?

(4 ways GPU memory is used)

loading the model is only the first part of the memory story.

once inference starts, GPU memory gets divided across multiple components, and some of them keep growing as context length, batch size, and concurrency increase.

the graphic breaks it into four useful buckets:

→ model weights are the mostly fixed part. once the model is loaded, their memory footprint stays roughly constant. the biggest lever here is precision. moving from FP16/BF16 to INT8 or INT4 reduces the number of bytes needed to store each parameter.

→ KV cache grows as generation continues. for every previous token, the model stores key and value tensors so attention can reuse them instead of recomputing the entire sequence. longer contexts mean a larger KV cache, and more concurrent requests mean more active caches sitting in memory.

→ activations and workspace hold temporary intermediate values needed while running attention, MLP layers, kernels, and other computations. this memory is reused across inference steps, but its size can still change with sequence length, batch size, and the kernels being executed.

→ runtime overhead comes from everything around the model itself. CUDA kernels, memory allocators, metadata, serving-engine buffers, and other runtime structures all consume some VRAM. it is usually smaller than the other buckets, but it is never zero.

this is why “the model fits on the GPU” and “the workload fits on the GPU” are two different statements.

a model may load comfortably, then run out of memory when you increase the context window, serve more users simultaneously, or increase the batch size.

it also explains why quantization can help beyond simply fitting a larger model. shrinking the weight footprint creates room that can instead be used for larger KV caches, more concurrent requests, or bigger batches.

that is the broader GPU lesson too.

performance is not just about how much arithmetic a GPU can do. it is also about what data occupies memory, how much of it moves during inference, and how often that data can be reused.

i wrote the full breakdown of how GPUs actually work and why memory movement sits at the center of LLM inference performance.

the article is quoted below.

[Mayne @Tradermayne]

Trump and JD going to get smoked in the midterms.

The Clarity act vote was a precursor to the results.

Trump has aligned himself with Crypto and they will use Crypto as the cudgle to go after him.

Trump will spend the next 2 years nuking the USD, YCC to get bonds down because there is nothing else they can do.

Risk assets go up