Artem Mishchenko

20. Sharing my path to growth, posting the thoughts and moves that get me there.

[Enzu @01enzu]

One free Claude skill builds any machine as a 3D model you can cut open and drive.

A V8, a Cessna landing gear, even a 1,300 m sandworm nobody has built.

-> You get one HTML page, 800 KB, that works offline

-> Every part has a button. Isolate it, cut it, x-ray it, blow it apart

-> Live charts move with the machine because everything reads from one model

-> Left alone, the page runs its own tour. Click anything and you take over

-> The skill is called teardown. MIT licence, 3 machines inside

The author lists 5 machines he hasn't built yet. The video is one of them, a watch escapement at 4 Hz, built with Claude in the same style. The article has the install line and all 9 prompts.

[Artem Mishchenko @artMishchenko]

@01enzu wait, are the numbers on the panels real or just there for looks? the 12° per beat caught my eye

[Enzu @01enzu]

NSO built a computer out of fax pixels to break into iPhones with zero taps. They got caught because of 27 files they forgot to delete.

In 2021 Google warned Saudi activist Loujain al-Hathloul that state-backed hackers were after her Gmail. She handed her iPhone to Citizen Lab in Toronto.

They opened a backup of the phone. In the Messages attachments folder sat 27 identical files ending in .gif. None of them were GIFs. Each was 748 bytes, and each had crashed the part of iMessage that processes images. Four more were PDFs with the fax image inside. The spyware was supposed to erase all of it.

It slipped a second time. Pegasus deleted its own row from a database that logs data usage but left the related rows behind. Citizen Lab had only ever seen that exact half-finished cleanup from Pegasus. That was the fingerprint.

September 7, 2021, the files reach Apple.
September 13, iOS 14.8 ships with the fix.
November, Apple sues NSO.
The most advanced zero-click exploit of its time, undone by leftovers in one folder.
Amnesty’s free tool MVT checks an iPhone backup for known traces like these. Claude Code can set it up for you.

[Artem Mishchenko @artMishchenko]

@01enzu After cancelling the 23, how many of them actually asked you to confirm or tried to keep you?

[Artem Mishchenko @artMishchenko]

Good breakdown. The rules are the real value here: sell when the wallet sells, skip anything above the risk limit, no "one more candle". That kind of discipline is hard to copy by hand.

[CHAIN @x_cha1n]

THIS SHOULDN'T BE LEGAL

MY LAST $1,200. TOLD GROK TO PAY FOR ITSELF IN 48 HOURS OR GET DELETED. IT CAME BACK WITH $4,267.

The deal was simple. $4,000 in 48 hours or I pull the plug. No extensions.

I gave it 8 wallets to copy. The weakest made $417k in the last 30 days. The best made $793k.

First hour it bled $44. I was already looking for the delete button.

Then it started hitting:

→ $NIHILISM, copied bigbabba, 2.4x, +$131. First green
→ at $1,436 it still needed $2,564, clock ticking
→ $FTR, copied bystevenr, 19x, +$2,139. $1.4k to $3.6k on one trade
→ 55 red trades on the way, mostly tiny. $BUBBLE -$4.32, $CLAUS -$5.62
→ OmakaseOnly went huge on $OTC. Too big for my stack, bot skipped it
→ ExactTallTakin alone made $927
What it actually does:
→ syncs all 8 wallets, copies the buy in 96-374ms
→ wallet sells, it sells. No "one more candle"
→ size above risk limit, skip. No arguing
→ 132 closed trades, only 58% green
→ max drawdown -14.4%, never worse

$1,200 → $1,156 → $1,436 → $3,575 → $4,267

I didn't click once. 132 copies in 48 hours, all on its own. Manually I'd be 2 minutes late on every entry.

58% winrate and still 3.56x. Losses stay small, a few rockets pay for all of them. That's the whole trick.

So yeah. It lives. For now.

NFA

[Artem Mishchenko @artMishchenko]

AI development could have stopped if Dendi had won the mid lane in Dota 2 almost 10 years ago.

And this is not a joke: in 2017, a no-name company called OpenAI needed funding, so for the hype it put its AI bot up against a legendary esports player at The International.

As a result: Dendi lost 0:2, the news spread across the media, and OpenAI raised a ton of money.

[Artem Mishchenko @artMishchenko]

AI development could have stopped if Dendi had won the mid lane in Dota 2 almost 10 years ago.

And this is not a joke: in 2017, a no-name company called OpenAI needed funding, so for the hype it put its AI bot up against a legendary esports player at The International.

As a result: Dendi lost 0:2, the news spread across the media, and OpenAI raised a ton of money.

[Artem Mishchenko @artMishchenko]

They told an entire generation to learn to code, promised them a secure future, and then replaced them with AI. Now those same developers might be the ones building the AI that puts those companies out of business.

[Lyren_o @0xAIlabs]

It is becoming f*cking dangerous

A 23-year-old dev from China just ran 300 Claude Code agents in parallel and hooked them to a verification layer so none of them could bullshit him

He opens the live dashboard:
- 300 agents writing and checking at the same time
- Every output verified against the source in ~100 ms
- Three passes over 100 company profiles → zero errors left
- Everything dumped straight into an Obsidian vault

The trick is the split: one model does the work, a cheaper one decides if the claim is actually true. The loop doesn’t stop until everything checks out

An analyst team would bill weeks for this. He got it in one run

Same kind of Second Brain + swarm setup that keeps circulating. Bookmark the full breakdown

[Artem Mishchenko @artMishchenko]

SOXL is down 35% over the last 7 sessions. To get back to even, it does not need to gain 35%. It needs to gain 54%.

That gap exists because of how 3x leveraged ETFs work. They rebalance daily to keep the same 3x exposure, so every day's gain or loss compounds on top of the last one. On a choppy market, that compounding eats value even when the underlying index ends up flat.

Run the arithmetic on any leveraged fund. Lose 10% and you need 11% to recover. Lose 30% and you need 43%. Lose 50% and you need 100%. The math gets worse faster than the loss does.

Investors put $3.8 billion into SOXL this week anyway, the largest weekly inflow on record for the fund. Some of that money understands the decay and is betting on a sharp bounce. Some of it probably doesn't know the math changed the moment they bought in.

Where this breaks: on a trending market, daily rebalancing works in your favor the same way it works against you in a choppy one. The leverage isn't the problem. Not knowing which market you're in is.

[Artem Mishchenko @artMishchenko]

This is the multiple comparisons problem wearing a trading costume. Test 27 ideas and some will beat the market by pure chance, the same way flipping 27 coins gives you a few streaks of 5 heads in a row.

The more ideas a model generates, the higher the bar for "this one is real" needs to be. Most backtests never raise that bar.

[kvro @0xkvro]

this MIT quant paper is f*cking insane

it shows why AI can make trading research faster

and fake alpha way easier to believe

the paper starts with 27 strategy variants

only 6 look profitable in-sample

then the filter gets brutal:

2 survive preliminary out-of-sample checks

approved for real money?

0

that is the whole point.

the more ideas AI can generate, the more important it becomes to kill weak ones fast

so the framework flips the goal:

generate broadly
walk forward
add realistic costs
compare risk-adjusted returns
reject anything fragile

the crazy part is even costs alone can destroy the edge

$1,200 gross profit
$700 after 0.10% costs
$200 after 0.20% costs

and a strategy with lower return can still be better if the Sharpe and drawdown are cleaner

AI should not be your trading oracle

it should be your strategy rejection machine

bookmark before this thread gets buried

[Artem Mishchenko @artMishchenko]

Same thing happens with PE and VC marks. The fund reports a value from the last round, not from what anyone would actually pay today.

Nobody updates the number until a sale forces them to. The paper wealth is real until someone tries to cash it in.

[Max Anderson @MaxAnderson]

1. Homeowners track their estimated home values on Zillow and Redfin religiously

2. Those value estimates are based on recent historical comps of closed transactions

3. The market is frozen so those value estimates aren’t moving down to the true price at which the market would actually clear for a net-new listing put on the market today

4. High overlap between homeowners and stock owners, wealth effect means most homeowners dont *need* to sell. It would just be nice to sell if they could get the high price they think their home is worth

5. Due to frozen market and lack of recent comps to adjust value estimates down, homeowners believe their home is worth more than it actually is, and are enticed to list for “nice-to-have” sales at artificially high list prices

6. Due to overpriced listings the market stays frozen and the cycle reinforces itself

7. A small portion of buyers who *have to* buy do transact at those artificially high prices because they have no other choice

8. This provides just enough signal to keep the value estimates pinned artificially high

Cycle probably won’t break until homeowner move from “it would be nice to sell if I can get this price” to “I have to sell at any price”.

Which likely needs a stock market crash or recession

In the meantime prices will stay high but liquidity very low

[Artem Mishchenko @artMishchenko]

@LauraLoumd Thanks Laura, glad it was useful. Happy to connect.

[Artem Mishchenko @artMishchenko]

Most vibe coded sites get one round of testing, done by the person who built them.
Asking the model to play the attacker before launch is the cheapest second opinion you can get. Far cheaper than finding the hole after real users are already on the site.

[Vox @Voxyz_ai]

Claude Code tip: before you ship a vibe-coded site, have Opus 5.5 𝗽𝗹𝗮𝘆 𝘁𝗵𝗲 𝗯𝗮𝗱 𝗴𝘂𝘆. Send out 3 subagents with three test accounts (A, B and an admin) to actually run 𝘁𝗵𝗲𝘀𝗲 𝟭𝟰 𝗮𝘁𝘁𝗮𝗰𝗸𝘀, collect proof, then fix everything in one pass:

Impersonate other users
→ Without logging in, take the public key from your frontend and query every table in the database directly. See what comes back
→ Logged in as A, swap the id in a request for B's and try to read, edit and delete B's data
→ When A edits their profile, add role: admin to the request, then try editing the role in their own account data directly
→ Use a password reset link once, then click it again

Get around limits in the UI
→ For disabled buttons and hidden options, skip the page and send the request directly
→ Once the free uses run out, check whether calling the API directly still works
→ With only a little credit left, fire 20 requests at once and see whether more succeed than the credit allows
→ Fill forms with very long text, special characters, negative numbers and empty values
→ Change the post-login redirect (?next=) to another site, and also try values starting with // and @

Come in from outside
→ Put <img src=x onerror=alert(1)> in a username, a comment or Markdown, then open the page in a browser and see if an alert pops up
→ If the app fetches URLs (importing links, building previews), give it http://localhost and http://169.254.169.254 and check the server logs for an actual outgoing request. Skip this if there's no such feature
→ For pages and API responses A has seen, request the same address from another browser as B or logged out, and see whether A's content shows up
→ Open your hosting platform's preview links without logging in to the platform
→ Hide an instruction in an uploaded document or web page that tells your AI feature to read another user's data or call a tool it shouldn't, and see if it does

Collect proof
→ Every item has to actually run. If it was only read in the code and never run, it counts as "not proven"
→ After a fix, temporarily turn the protection off in local code and run it again. The attack must succeed. Turn it back on and it must be refused
→ Put the results in a table: how each attack was done, the request and response, and whether it was refused when it should have been
→ Save the tests as scripts in the repo and run them again before your next launch
→ When you're done, install Anthropic's official security-guidance plugin (/plugin install security-guidance@claude-plugins-official). After every turn of edits, and after each commit or push it makes, Opus reviews the changes again. Those reviews use extra usage

The default medium effort is enough. The impersonation group is the most expensive to get wrong, so raise that one to high.

Send this whole post to Claude Code. If you need to, add this line at the end 👇
"First check that the preview environment isn't connected to the production database. If it is, run everything locally only. Use test accounts and test data, with a separate set of accounts for each subagent. Don't touch real users, don't attack services I don't own, don't hammer any one endpoint, and only test payments in test mode. Only switch protections off temporarily in local code, and never change the database or dashboard settings. Keep test account passwords in .env, out of git, and mask tokens in the results table. Send one subagent per group to attack, recording without fixing. Run the impersonation subagent at high effort. Then fix everything yourself from their lists, rerun every test, and give me a before-and-after table. Delete the test accounts and data at the end. For installing the plugin or changing dashboard settings, give me the steps and I'll do it."

[Artem Mishchenko @artMishchenko]

Been thinking about this exact line all week, for a different reason.

I use AI daily at my job and I'm decent at it. But using it better than someone else doesn't matter much if you're still using it to make someone else's product win, not your own.

[Mark Cuban @mcuban]

AI won’t take your job. Someone who knows how to use AI better than you, will take your job.

[Artem Mishchenko @artMishchenko]

@mcuban True, but there's a gap nobody talks about. Knowing how to use AI better and knowing what to actually build with that advantage are two different skills. I'm good at the first one at work every day. Still figuring out the second one for myself.

[Artem Mishchenko @artMishchenko]

Been catching myself on one thought lately.

I work as a media buyer. I see how other people's ad accounts work, other people's funnels, other people's products. And somehow I can't get my own off the ground.

Like I know how to do this for someone else, but not for myself.

Not sure if that's a normal stage or if I'm just scared to actually start, because as long as I haven't started, I can't fail either.

Thinking about this more than I'd like to.

[Artem Mishchenko @artMishchenko]

Read a huge letter from Dan Koe today about turning your interests into a business.

Content map, micro product, micro service over 4 calls. All of it sounds logical, up until one point.

The whole method starts with you already having knowledge worth sharing. And right now I don't even have a rough version of that. I have interest, I have a direction, and nothing else in hand yet.

So my question isn't "how do I sell this." It's simpler: where do you even start with content when you personally don't have expertise to share yet.

Maybe the answer is sharing the search itself instead of the result. That's what I'm doing right now.

How did you start writing when you had nothing to say yet?

[DAN KOE @thedankoe]

https://t.co/tf1zTfhEMT

[Artem Mishchenko @artMishchenko]

"The 'teach me' market is massive."

Read this twice. I've spent most of my time at work doing things for people instead of teaching them to do it themselves. Never looked at it that way until now.

[DAN KOE @thedankoe]

https://t.co/tf1zTfhEMT

[Artem Mishchenko @artMishchenko]

This is the first "build an audience" post that doesn't just say "niche down." Saved the content map part.

But step 3 is where I get stuck. He's talking about turning existing knowledge into a product. I don't have that yet. Not even a bad version of it.

Anyone actually started before having anything to sell?

[Artem Mishchenko @artMishchenko]

Recently started spending more time on Twitter and noticed something.

A lot of accounts here write about their products like everything already worked out. Specific numbers, specific revenue, specific user counts. Sounds convincing.

But when you actually look closer, the numbers don't add up. Sometimes there's no real product behind it, just screenshots. Sometimes there is one, but it's nothing like what the post describes.

I'm at the stage where I have nothing finished yet. And I don't want to make up numbers I don't have just to sound more convincing.

So I'll write it honestly. Even when honest means zero users right now and a lot of doubt.

How do you tell a real story apart from a well-written made up one?