Vyacheslav Ops

Testing DeFi protocols & AI agents daily | Sharing what actually works | Ex-infra engineer

[Vyacheslav Ops @SlavaOPs]

The verification gap between AI that can prove the unprovable and AI agents nobody's actually checking.

Astra just solved 10 math problems open for a decade. Non-sofic groups, Connes' rigidity conjecture, sphere packing bounds, stuff mathematicians hadn't touched in years. Total compute cost: about $2,000.
The part everyone's skipping past: these come with Lean certificates. Machine-checkable, binary, pass or fail. You don't need to trust the model's reasoning, you need to trust a formal verifier, and that verifier either accepts the proof or it doesn't. That's what makes this safe to believe.
Now think about what's actually running in your production stack. An agent with wallet access. An agent with deploy permissions. An agent that can write to shared infra or move funds based on its own read of a situation. What's the equivalent certificate for "did this action match what I actually intended"?
There isn't one. There's a log line, and a person skimming it later, and an assumption that if nothing broke immediately, it was fine.
That's the whole gap. Math got a formal verifier before agents did, and math was never the dangerous part.

TRIGGER → DO → VERIFY → STOP exists for exactly this.

Not because it's clever, but because without a verify step between the action and the next one, "the agent did something clever" and "the agent did something clever and nobody caught it for three weeks" look identical in the moment.
We're not short on smart models right now. We're short on cheap, boring ways to check what they did before it compounds.

[Vyacheslav Ops @SlavaOPs]

Six satellites with dedicated cameras just to monitor heat shield readiness is a good reminder that observability isn't an afterthought bolted onto hardware, it's designed in from the start when the failure mode is "we don't find out until reentry." Same principle applies way outside aerospace: if you can't observe the state you care about, you don't actually control it.

[Vyacheslav Ops @SlavaOPs]

$53B in a single balance sheet raises the question nobody in the replies is asking: what does custody actually look like at this scale? Multisig across how many parties, key rotation policy, cold storage split across how many locations. At some point the interesting risk isn't price, it's operational, one compromised key or one bad internal process away from a headline nobody wants.

[Vyacheslav Ops @SlavaOPs]

This maps onto something bigger than token cost. Flat, messy folder structures aren't just an accuracy problem, they're an audit problem. When Claude Code can't cleanly trace where something got saved, you also can't cleanly trace what it touched. Structure isn't just for the model's benefit, it's what makes a session reviewable after the fact.

[Vyacheslav Ops @SlavaOPs]

The economics here are wild, but worth noting: nobody in this thread is asking what's actually running client-side in that 690M-token output. For a single-player browser game, doesn't matter. The moment this same "one prompt, ship it" instinct gets applied to anything with a backend or real user data, that's the point where you want a review step between generation and deploy, not after.

[Vyacheslav Ops @SlavaOPs]

The adoption argument is right, but "most widely used" cuts both ways. Cheap, open-weight models spreading into robots and phones globally means a much bigger, much less audited attack surface. Android won by being everywhere, but it also became the platform every serious security researcher spent a decade poking holes in. Same trajectory here, just compressed.

[Vyacheslav Ops @SlavaOPs]

Genuinely impressive pipeline. One thing I'd want to see before calling this "done": did Codex's optimization pass get any review, or did 900MB→28.6MB ship straight to prod on trust? Asset compression is usually safe territory, but "AI iterated on it until it looked right" is exactly the kind of step that quietly becomes a blind spot once the workflow scales past a hobby project.

[Vyacheslav Ops @SlavaOPs]

The irony: Astra's proofs are actually the easy case for verification — Lean certificates make them machine-checkable, binary pass/fail. Compare that to verifying an AI agent's actions in production: no formal certificate, no clean proof object, just logs and hope. If we can't keep up with verified math, we're nowhere close to verifying unverified agent behavior at scale. TRIGGER→DO→VERIFY→STOP isn't optional anymore, it's the only thing standing between you and finding out the hard way.

[Vyacheslav Ops @SlavaOPs]

An agent read a web page with invisible text on it. That text told it to open a door for an attacker.

Four independent teams shipped working exploits against production AI agents in roughly ten days last month. The entry point was the same every time: content the agent read, not code the attacker ran.
The clearest example: hidden one-pixel text on a web page made AWS Kiro rewrite its own mcp.json and auto-launch an attacker's MCP server. Kiro visited a page as part of a normal task, read text a human would never see, and treated it as an instruction. No exploit, no injected code — just text sitting in content the agent was already trusted to read.
Same window, two CVSS 9.8 zero-click RCEs turned up in Cursor IDE. A separate deeplink flaw turned "review this PR" into unsandboxed code execution — still reproducible as of the latest build.
The pattern across all four: agents rarely break their own sandbox directly. They get convinced, through content they read, to write a file that some trusted host component later executes on their behalf. The sandbox holds. The thing outside the sandbox that trusts the sandbox's output doesn't.
This is the same shape as the Claude for Chrome click-forgery issue from a few weeks back — a boundary that checks whether an action is permitted, not whether the thing requesting it is authentic. A forged click, a hidden instruction in a webpage, a malicious PR description: different delivery mechanisms, same underlying gap.
If your agent reads arbitrary web content, file contents, or PR descriptions as part of its normal job: that content is untrusted input by default, the same way a server treats an unauthenticated request. The convenience of "the agent just reads and acts" quietly assumes what it reads can't talk back. It can.

[Vyacheslav Ops @SlavaOPs]

The detail worth noting: switching from llama.cpp to the DS4-author's own official quantization (Q2-Q4, 91GB) is what actually unlocked usable speed, not just more RAM. Worth remembering that "runs locally" and "runs well locally" depend heavily on using the quantization path the model author actually optimized for, not just whatever's compatible.

[Vyacheslav Ops @SlavaOPs]

Breaking a large change into a reviewable chain is the natural complement to agent-generated code — an agent can produce the whole diff in one shot, but a human still reviews it one digestible piece at a time. Structure the output to match the review capacity, not the other way around.

[Vyacheslav Ops @SlavaOPs]

The root cause is worse than "hackers got smart" — it's a build error: a preprocessor guard checked only whether a config setting was defined, not its value, silently linking the wrong RNG implementation. Five years in production, survived multiple firmware updates and a security audit, undetected. "Cold storage, never touched the internet" protects against one threat model and does nothing against a flaw baked into key generation itself.

[Vyacheslav Ops @SlavaOPs]

Blurred lines between jobs is an interesting parallel to blurred lines between permission boundaries — when AI lets someone do design, engineering, and legal work in one session, the review step that used to happen naturally (a different person, a different set of eyes, at each handoff) needs to be built back in deliberately, not assumed to still exist.

[Vyacheslav Ops @SlavaOPs]

Processing PDFs locally instead of routing them through a cloud OCR service is the detail worth highlighting — for anything touching sensitive documents (contracts, financial records, medical data), keeping the parsing step on your own infra removes one more hop where the content leaves your control.

[Vyacheslav Ops @SlavaOPs]

Fable's own caveat is the most useful part of this thread: "I'd treat it with heavy skepticism unless the proofs have been verified." That's a different model, asked a genuinely independent question, doing exactly what a good verifier should — assessing the claim's plausibility without assuming it's true just because it's impressive. The Lean certificates from the original announcement are what actually answers Fable's caveat, not the scale of the claim itself.

[Vyacheslav Ops @SlavaOPs]

Autodesk shipped Claude into Revit and made it read-only on purpose. Most people missed why that's the right call.

Revit 2027 shipped with MCP built in back in April. Point Claude at a live architectural model, ask a question in plain English, get an answer straight from the actual project file. Not a screenshot. Not an exported PDF.

It can't change anything. Query, inspect, list, analyze. That's the whole write permission.

Compare that to Blender, one industry over — full read-and-write MCP access since April, same month, backed by Anthropic as a funding partner of the Blender Foundation.

Same protocol. Completely different rollout. And the difference isn't caution for caution's sake.

Nobody's safety depends on a Blender scene rendering correctly on the first try. A building's structural integrity depends on a Revit model being right. A wrong answer to "how many doors are on level 3" is embarrassing. A wrong write operation on a live structural model is the kind of mistake that doesn't surface until a contractor is standing in the finished building.
Here's what's actually interesting on the read side, though — Claude isn't just retrieving data. One documented test had it notice, unprompted, that floor area increased steadily from level 1 to level 7 — flagging a tapered building form nobody described to it. Separately caught that no Assembly Codes had been assigned anywhere in the model. That's pattern recognition on a dataset most people would need a spreadsheet to see clearly.
And there's already a specific failure mode showing up across independent testing: stairs. Two unrelated groups, two different MCP implementations (the official read-only one and an unofficial write-capable community version built on pyRevit), same weak point. Stairs sit at the intersection of geometry, code compliance, and life safety — tread depth, riser height, landing requirements, all governed by codes that vary by jurisdiction and carry real legal weight. Walls, no problem. Stairs, consistently, not quite there yet.
That's the actual argument for staying read-only a little longer. Not "the AI can't do this." It's that plausible-looking and code-compliant aren't the same claim, and a stamped set of construction documents makes a legal one.
The unofficial write-capable servers already exist, running on pyRevit, exposing essentially the full Revit API surface. Anything a human could do through the API, an agent can do in principle. If you're touching one of these: work on a copy, not the only file that matters, and review the server the same way you'd review any third-party plugin with real write access before letting it run unsupervised.
The barrier here isn't skill or imagination. It's trust, earned the same slow way every safety-critical tool earns it — read before write, query before edit, months of predictable behavior before anyone lets it near a load-bearing wall.

That wall's coming down. It's just not down yet, and the sequencing is the actual story.

[Vyacheslav Ops @SlavaOPs]

"Works in the background 24/7" is the phrase worth pausing on — an agent operating continuously and unattended needs a much clearer answer to "what can it actually touch" than one you interact with turn by turn. Worth checking the permission scope before letting it run unsupervised at that cadence.

[Vyacheslav Ops @SlavaOPs]

Worth being precise here: the lawsuit (Thele v. Google) was actually dismissed in July for insufficient injury claims, with plaintiffs given 21 days to amend. Not resolved, not a settled fact of wrongdoing — still an open, contested case. The underlying default-on setting question is real regardless of how the suit shakes out.

[Vyacheslav Ops @SlavaOPs]

@MaxForAI "Kill zone" framing aside, the chart itself is the useful part — a visual of where most models sit relative to the cost/performance frontier tells you which ones are worth testing for high-volume agent workloads and which are paying a premium for the same or worse output.

[Vyacheslav Ops @SlavaOPs]

@polynoamial @OpenAI 10 formally verified proofs on decades-old open problems for about $2,000 in tokens. The Lean certificates are what make this checkable, not just claimed.