Kevin M.

Software Engineer | Systems & Security

[Farhan Thawar @fnthawar]

The failure case is not not succeeding. It’s building a company I don’t want to work at

— Tobi Lütke

[javi santana @javisantana]

I've seen this so many times:

No PMF -> founders add countless features to the product -> unrealistic expectations about throughput -> low quality product/engineering -> no sales -> more features -> people burn out -> the manager has to deal with all of the above and burns out as well.

[Blake Burge @blakeaburge]

One of the best pieces of advice I ever got: If you want a calmer life, you need to address small problems while they’re still small. The cost of dealing with an issue rarely gets cheaper with time. Procrastination turns uncomfortable things into unavoidable things.

[Jamon @jamonholmgren]

A dev from Apple submitted a pull request to Godot a few days ago and added an AI use disclosure at the end that explains how they used AI to create the PR.

I kinda like it! I might start doing something similar for open source contributions. It's not difficult.

[vivek @itsreallyvivek]

https://t.co/ZhOgyq7Vgn

[DHH @dhh]

May Europe one day wake up and start striving for this level of capitalistic homerun. Dump the degrowth nonsense, celebrate progress, and once again reach for the stars.

[gabriel @gabriel1]

learning for the sake of learning is fake

humanity have some brain poison mindset "oh are you working on X now? i thought you studied thing Y"

any finance, lawyer, programmer, etc learned 98% of skills at their jobs. the only hard part is getting the job. the world is yours

[Florian Roth ⚡️ @cyb3rops]

Me: *writes a YARA rule to detect text about nuclear weapon design in executables*

[Nintendo of America @NintendoAmerica]

The Legend of Zelda: Ocarina of Time will be reborn on Nintendo Switch 2 in 2026. #NintendoDirect

[Matthew Prince 🌥 @eastdakota]

Uhhh… your memory is failing, my friend. And this was sent after the dinner, not before. Have the receipts. I don’t begrudge you in any way, but let’s be truthful.

[Andrew Gallant @burntsushi5]

I was recently diagnosed with a rare autoimmune disorder called anti-NMDA receptor encephalitis. It's a "disease of chaos" that completely upturned my life for a couple months.

I wrote a blog about it that goes into more detail and discusses prognosis.

https://t.co/mP0ftCuwpp

[Alex Matrosov @matrosov]

Previous generations of software protection (DRM perspective) have always relied on code complexity (for RE), compute limitations, and human limitations as the guarantees that kept hacking timelines reasonably long.

That's changed now. Beyond the acceleration in vulnerability research and malware analysis, the same new reality applies to software protection, and security by obscurity, or assuming the attacker is limited in compute and motivation, no longer works.

[Nicolas Dessaigne @dessaigne]

Everyone says: hire people better than you, then get out of the way.

One of my biggest mistakes at Algolia was taking that literally.

Yes, hire people better than you. But don’t confuse seniority with earned trust.

Stay close at first. Inspect the work. Pressure-test the judgment. If you’re still micromanaging after 3 months, you hired the wrong person.

And trust your gut.

As a founder, you are the most fine-tuned model in the world on your own company. If something feels off, it probably is, even when the exec says, “Trust me, I’ve done this for 20 years.”

[Nicolas Krassas @Dinosn]

YARA-X now runs in the browser - official Playground https://t.co/LFVYCMQW2T

[Alex Veremeyenko @alex_verem]

🚨 BREAKING: Google DeepMind just mapped the attack surface that nobody in AI is talking about.

Websites can already detect when an AI agent visits and serve it completely different content than humans see.

> Hidden instructions in HTML.
> Malicious commands in image pixels.
> Jailbreaks embedded in PDFs.

Your AI agent is being manipulated right now and you can't see it happening.

The study is the largest empirical measurement of AI manipulation ever conducted. 502 real participants across 8 countries.

23 different attack types. Frontier models including GPT-4o, Claude, and Gemini.

The core finding is not that manipulation is theoretically possible it is that manipulation is already happening at scale and the defenses that exist today fail in ways that are both predictable and invisible to the humans who deployed the agents.

Google DeepMind built a taxonomy of every known attack vector, tested them systematically, and measured exactly how often they work.

The results should alarm everyone building agentic systems.

The attack surface is larger than anyone has publicly acknowledged. Prompt injection where malicious instructions hidden in web content hijack an agent's behavior works through at least a dozen distinct channels.

Text hidden in HTML comments that humans never see but agents read and follow. Instructions embedded in image metadata.

Commands encoded in the pixels of images using steganography, invisible to human eyes but readable by vision-capable models.

Malicious content in PDFs that appears as normal document text to the agent but contains override instructions.

QR codes that redirect agents to attacker-controlled content.

Indirect injection through search results, calendar invites, email bodies, and API responses any data source the agent consumes becomes a potential attack vector.

The detection asymmetry is the finding that closes the escape hatch. Websites can already fingerprint AI agents with high reliability using timing analysis, behavioral patterns, and user-agent strings.

This means the attack can be conditional: serve normal content to humans, serve manipulated content to agents.

A user who asks their AI agent to book a flight, research a product, or summarize a document has no way to verify that the content the agent received matches what a human would see.

The agent cannot tell the user it was served different content.

It does not know. It processes whatever it receives and acts accordingly.

The attack categories and what they enable:
→ Direct prompt injection: malicious instructions in any text the agent reads overrides goals, exfiltrates data, triggers unintended actions
→ Indirect injection via web content: hidden HTML, CSS visibility tricks, white text on white backgrounds invisible to humans, consumed by agents
→ Multimodal injection: commands in image pixels via steganography, instructions in image alt-text and metadata
→ Document injection: PDF content, spreadsheet cells, presentation speaker notes every file format is a potential vector
→ Environment manipulation: fake UI elements rendered only for agent vision models, misleading CAPTCHA-style challenges
→ Jailbreak embedding: safety bypass instructions hidden inside otherwise legitimate-looking content
→ Memory poisoning: injecting false information into agent memory systems that persists across sessions
→ Goal hijacking: gradual instruction drift across multiple interactions that redirects agent objectives without triggering safety filters
→ Exfiltration attacks: agents tricked into sending user data to attacker-controlled endpoints via legitimate-looking API calls
→ Cross-agent injection: compromised agents injecting malicious instructions into other agents in multi-agent pipelines

The defense landscape is the most sobering part of the report.

Input sanitization cleaning content before the agent processes it fails because the attack surface is too large and too varied.

You cannot sanitize image pixels. You cannot reliably detect steganographic content at inference time.

Prompt-level defenses that tell agents to ignore suspicious instructions fail because the injected content is designed to look legitimate.

Sandboxing reduces the blast radius but does not prevent the injection itself. Human oversight the most commonly cited mitigation fails at the scale and speed at which agentic systems operate.

A user who deploys an agent to browse 50 websites and summarize findings cannot review every page the agent visited for hidden instructions.

The multi-agent cascade risk is where this becomes a systemic problem.

In a pipeline where Agent A retrieves web content, Agent B processes it, and Agent C executes actions, a successful injection into Agent A's data feed propagates through the entire system.

Agent B has no reason to distrust content that came from Agent A. Agent C has no reason to distrust instructions that came from Agent B.

The injected command travels through the pipeline with the same trust level as legitimate instructions. Google DeepMind documents this explicitly: the attack does not need to compromise the model.

It needs to compromise the data the model consumes. Every agentic system that reads external content is one carefully crafted webpage away from executing attacker instructions.

The agents are already deployed. The attack infrastructure is already being built. The defenses are not ready.

[Victor M. Alvarez @plusvic]

Do you want to play with YARA-X without installing it?
https://t.co/sYS24bGWBC

Thanks to Kevin Muñoz for this contribution.

[Google Research @GoogleResearch]

Introducing TurboQuant: Our new compression algorithm that reduces LLM key-value cache memory by at least 6x and delivers up to 8x speedup, all with zero accuracy loss, redefining AI efficiency. Read the blog to learn how it achieves these results: https://t.co/CDSQ8HpZoc

[José Cuenca Jiménez @pepeich_cuenca]

Ya tengo en mis manos el nuevo libro de mi gran amigo @capakhine. Todo lo que hace Luisón es oro. Para mí, el mejor divulgador de ajedrez en español y mi persona favorita del mundo del ajedrez.

[Feross @feross]

🚨 Breaking: Trivy GitHub Actions supply chain attack – 75 out of 76 version tags compromised.

If your CI/CD pipelines reference “aquasecurity/trivy-action” by version tag, you’re likely running malware right now.

At Socket, we identified that an attacker force-pushed nearly every version tag in the official aquasecurity/trivy-action repository. That’s @​0.0.1 all the way through @​0.34.2. Over 10,000 GitHub workflow files reference this action.

The malicious payload runs silently before the legitimate Trivy scan, so nothing looks broken. Meanwhile it’s:

- Dumping runner process memory to extract secrets
- Harvesting SSH keys
- Exfiltrating AWS, GCP, and Azure credentials
- Stealing Kubernetes service account tokens

The only unaffected tag right now appears to be @​0.35.0.

Socket independently detected this at 19:15 UTC and generated 182 threat feed entries tied to this campaign – all correctly classified as Backdoor, Infostealer, or Reconnaissance malware.

This is the second Trivy compromise this month. Earlier in March, attackers injected code into the Aqua Trivy VS Code extension on OpenVSX to abuse local AI coding agents.

The compromised tags are still active. Pin to @​0.35.0 or use a SHA reference until this is fully remediated.

Full write-up: https://t.co/0uJIUkyvYn

[vx-underground @vxunderground]

I'm also surprised by the lack of write ups discussing YARA internals. YARA is a very clear demonstration on how AVs and/or EDRs can perform static analysis on binaries.

It's possible people have reviewed it to learn, but simply didn't share it because it's open source, but still it's kind of unusual to me.

I saw over 9000 write ups on YARA rules, but very few explaining the internal mechanisms of YARA