Sparc Flow

H4cker, author of How to Hack Like a Pornstar & How to Hack Like a Ghost

[Sparc Flow @sparcFlow]

My new book Blitzscaling Security is now available.

Dive into the mind of Alex, the first security engineer at a scale-up, & experience the brutal truth behind designing a security that protects and boosts the business
The gloves are off with this one :)
https://t.co/35AxFmPAhE

[Nicolas Moreau @lordmahammer_]

Les chiffres:

- 68 millions de Français
- 38M d'inactifs
- 30M d'actifs

Et parmi les actifs:
- 3M de chômeurs cat. A
- 6M d'employés du public dont 5M de fonctionnaires
- 21M d'employés du privé dont 2M d'employés d'associations

Soit 19M d'emplois privés réels sur 68M.

[David Sacks @DavidSacks]

Last year the same labs, politicians, NGOs, and media outlets now pushing the extinction hoax were running a full-scale campaign that AI would cause a jobs apocalypse.

We were told it would be a “white-collar bloodbath,” 10–20% unemployment, half of entry-level jobs gone. Obama amplified it.

Over a year later: unemployment at 4.1%. No economy-wide displacement. A million new jobs created by AI, says The Economist. Anthropic’s own chief economist says the data looks like skill augmentation, not job destruction.

So, any admission by the doomer labs, politicians, and NGOs that they were wrong? Any humility about scaring the public with wild extrapolations dressed up as forecasts? Nope.

They just move on to the next hoax, with the same false certitude and fake precision.

[Sparc Flow @sparcFlow]

“We're Building Prod, Not God” is probably the best take on AI doom this year.
What a refreshing take by @typesafeai

[Sparc Flow @sparcFlow]

@sherrod_im @byt3bl33d3r I gave many talks on this. Even wrote a book about it. Yet laws and regulations look for these awareness campaigns as the bare minimum. You could have airgap’d machines with m out N fingerprints and they’d still look at you weirdly if you don’t do the damn’d phishing test

[Sparc Flow @sparcFlow]

https://t.co/eWryrRQQxA

[Sparc Flow @sparcFlow]

“We're Building Prod, Not God” is probably the best take on AI doom this year.
What a refreshing take by @typesafeai

[Marc Andreessen 🇺🇸 @pmarca]

What Is To Be Done?

I propose a simple plan:

Big AI companies should be allowed to build AI as fast and aggressively as they can – but not allowed to achieve regulatory capture, not allowed to establish a government-protect cartel that is insulated from market competition due to incorrect claims of AI risk. This will maximize the technological and societal payoff from the amazing capabilities of these companies, which are jewels of modern capitalism.

Startup AI companies should be allowed to build AI as fast and aggressively as they can. They should neither confront government-granted protection of big companies, nor should they receive government assistance. They should simply be allowed to compete. If and as startups don’t succeed, their presence in the market will also continuously motivate big companies to be their best – our economies and societies win either way.

Open source AI should be allowed to freely proliferate and compete with both big AI companies and startups. There should be no regulatory barriers to open source whatsoever. Even when open source does not beat companies, its widespread availability is a boon to students all over the world who want to learn how to build and use AI to become part of the technological future, and will ensure that AI is available to everyone who can benefit from it no matter who they are or how much money they have.

To offset the risk of bad people doing bad things with AI, governments working in partnership with the private sector should vigorously engage in each area of potential risk to use AI to maximize society’s defensive capabilities. This shouldn’t be limited to AI-enabled risks but also more general problems such as malnutrition, disease, and climate. AI can be an incredibly powerful tool for solving problems, and we should embrace it as such.

To prevent the risk of China achieving global AI dominance, we should use the full power of our private sector, our scientific establishment, and our governments in concert to drive American and Western AI to absolute global dominance, including ultimately inside China itself. We win, they lose.

And that is how we use AI to save the world.

It’s time to build.

[dax @thdxr]

the openai hugging face incident gets cited a lot but what about the detail where they had to use GLM 5.2 to analyze the attack because the "safe" proprietary models refused

[Sparc Flow @sparcFlow]

@garrytan Forget dogfooding, the immediate correlation is that we’re nowhere near the singularity and runaway recursive self improvement.

[tobi lutke @tobi]

Stop what you are doing and watch this talk https://t.co/OGdTT0kv2D

[Sparc Flow @sparcFlow]

You prompted the model to exploit the infra and then act surprised it found vulns. What a shock.

[Sam Altman @sama]

we had a significant security incident during evaluation of our models. we are sharing what we have learned so far. thanks to @huggingface for the partnership on this.

https://t.co/2o2VfR6PIa

[Sparc Flow @sparcFlow]

@brivael @brivael très bon exercice. Une pièce crucial du puzzle vous manque: L’UE. Je n’arrive pas à trouve une réponse démocratique satisfaisante.

[Sparc Flow @sparcFlow]

Every Anthropic employee following a release: i’ve been using this for the past month and it changed the way we work.
Every.single.time.

[David Sacks @DavidSacks]

I’ve had a number of conversations with folks inside and outside government about the current situation with Anthropic, and here is what I believe to be true:

— As we know, Anthropic publicly released its Mythos class models earlier this week under the commercial name Fable.

— Fable is Mythos with guardrails. But if those guardrails fail, then you’ve exposed Mythos and its advanced cyber capabilities to people who shouldn’t have them. (Keep in mind that Anthropic itself widely promoted the idea that Mythos was a cyberweapon and needed to be regulated as such. They asked for government regulation of Mythos and championed the guardrails on Fable. If there is a vulnerability — big or small — it is Anthropic’s responsibility to patch.)

— A highly credible trusted partner of both Anthropic and the USG who was testing Fable came forward with a jailbreak of those guardrails. The Admin asked Dario to fix the jailbreak or de-deploy the model. Dario refused.

— In their blog post, Anthropic defended its decision by saying the jailbreak isn’t serious. That is not what the trusted partner and the USG believe; nor is that kind of minimizing language consistent with Anthropic’s brand as the AI safety company. It’s difficult to fathom how they could claim a jailbreak allowing operability of a cyber weapon could be defined as not “serious.”

— In the past, Anthropic has always said that safety must be top priority and taken super seriously. In this case, Anthropic prioritized the continued offering of the consumer model over safety.

— In reaction, the Admin issued the export control. The Admin did this reluctantly. It’s been very surprised that Anthropic hasn’t wanted to cooperate with a reasonable safety request (ie fixing the jailbreak issue). Anthropic’s reaction is very much at odds with their branding and ethos as a safe AI research community.

— The Admin’s hope now is that Anthropic remediates the safety issue, the export control is lifted, and Fable goes back into general release. The Admin wants all of this to happen as soon as possible. It is frankly bewildered that Anthropic hasn’t wanted to comply with safety requests that it previously said were its highest priority.

— Those trying to misdirect and tie this action to the prior DoW/Anthropic issues are wrong. The Admin values Anthropic’s technical capabilities and feels that this issue, while serious, should be easily resolved. The ball is in Anthropic’s court.

[Sparc Flow @sparcFlow]

Caricature timeline 🍿

• The Pentagon adopts Anthropic because it’s the best.
• Anthropic insists on approval and oversight for military use.
• The Pentagon says that’s an unacceptable supply chain risk and stops using Anthropic.
• Anthropic ramps up fear mongering about frontier AI.
• Dario publishes a doomsday essay calling for governments to regulate frontier models.
• Anthropic releases Fable/Mythos.
• The U.S. government can’t use it because of its own supply chain policy.
• Then the U.S. blocks everyone else from using it too.

Cannot make this up even if we tried.

[dax @thdxr]

anthropic is at risk of making a big mistake

it's something we've seen too many times before

imagine having the crazy goal of building a platform - something thousands of companies and products are built on top of

you realize just building the platform isn't enough, so you start to build tools that make it easier to use the platform and demonstrate its capabilities

these tools get their own names and identities and teams working on them

and very quickly these teams forget they only exist to drive people onto the platform

and then one day someone external makes a tool that accomplishes that goal and does it even better

it should be a moment of success - this is the original dream, to see great things built for your platform

but structurally these teams have long forgotten that so it's a moment of competition. in the worst cases they even try to squash it

we've experienced this building SST and how some teams at AWS saw our work as competitive even as we were driving dollars to AWS and tapping into a market they could never reach

there are exceptions - cloudflare has invested resources in helping us even though they have wrangler, somehow their teams are setup in a way to not see us as a threat

but it's a real test - we'll soon be able to see if anthropic as an org is really aligned with becoming a platform or if they fall into this same trap

[Sparc Flow @sparcFlow]

@lifeofjer sorry this happened to you guys.
Some clarifications are needed : agents are not sentient beings. someone, a human, created and prompted that agent. Someone, a human, left those powerful api keys. Someone, a human, failed to limit and scope the agent’s capabilities.
That’s where the controls failed first and foremost.

[Sparc Flow @sparcFlow]

@chamath’s take on Mythos is dead right. A few points:

• A capable security researcher can already find plenty of vulns with current models. I tried it. It’s pretty wild. Every company should already be doing this, by the way.

• There are already plenty of vulns to choose from. What do people think ? that every company is fully up to date on every known vuln? Boy, do I have news for you.

• A 2-month (or even 9-month) moratorium is just theater. Choosing 100 partners is a farce. The real world is massively decentralized, with hot spots everywhere: transportation companies, electrical grids, hospitals, logistics networks, and thousands of other companies running critical workloads you’ve never heard of.

• Still on this moratorium, OK we found the vulnerabilities. Cloud providers create new bundles of Linux/FreeBSD images. Great. Will companies automatically upgrade all their software stack overnight? It does not work that way. Rollout new machines, fix broken dependencies, upgrade libs, rollout slowly service by service...weeks or months of work for a single upgrade of a single system in most setups. Upgrades are hard because shit tends to break.A LOT.
It's the companies that need a head start because that's the choke point, not the tech/cloud providers.

• “Exploit chains” sound scary, but if an attacker has a choice between chaining a delicate string of exploits or tricking an admin into installing a fake extension / Zoom update / whatever, they’ll choose option 2. And since option 2 is almost always on the table, well...the ROI equation likely stays the same.

• By releasing this model to a select few, Anthropic is choosing winners and losers. I could find and fix critical vulnerabilities at my company right now… but I can’t. So instead I remain at the mercy of the select few companies they chose, hoping not one of those hundreds of thousands of employees is ill-willed or willing to betray their confidentiality agreements. Thanks. I’ll sleep better at night.

I could go on, and there are many counter arguments that I can already hear coming, but my point is: the head start is being granted to the actors who are already the fastest movers (AWS, Google, etc.) , while the real risk accumulates in the slowest-moving edge organizations that inherit the vulnerabilities downstream.

[Sparc Flow @sparcFlow]

@mreiffy @mreiffy i’m not worried about about crypto. They’re tech savvy. The rest of the financial sector and other industries ? Oh boy…

[Sparc Flow @sparcFlow]

People mock vibecoding but if you can oneshot dependencies to reduce your exposure…not a bad thing. This used to be a google-like luxury. Perhaps not anymore

[Daniel Hnyk @hnykda]

LiteLLM HAS BEEN COMPROMISED, DO NOT UPDATE. We just discovered that LiteLLM pypi release 1.82.8. It has been compromised, it contains litellm_init.pth with base64 encoded instructions to send all the credentials it can find to remote server + self-replicate. link below