v1ru6

Adversarial review for AI-built apps.
Building Aegis, a local-first, evidence-led security review harness.

// trust no agent

[v1ru6 @bitfragmentlabs]

@Brparadox 98765

[ClaudeDevs @ClaudeDevs]

Claude Managed Agents dynamic workflows are now available in public beta. It's a new type of multiagent orchestration, built for your most ambitious workloads.

A lead agent writes a plan that runs across many agents in phases, combining the results at the end.

[Z A D D Y @Zaddyzaddy]

Bug bounty queues are drowning in AI-generated reports. Platforms, programs, triagers and researchers all pay for it.

So we're open-sourcing the triage skill we use internally @BugBunny_ai to filter out false positives and non-actionable reports. It does two things:
1. Validates the report with an end-to-end test
2. Escalates valid bugs to their highest defensible impact, e.g. a DOM XSS pushed to full account takeover

Every report gets a verdict:
🟢 Green: validated end to end, ready to submit
🟡 Yellow: more work needed first
🔴 Red: do not submit

https://t.co/bPprHrJDUU

[Ash Hart @ashxhart]

Every open model ships frozen.

What if it could learn and update its own weights as it's being used?

I have been working on a bit of engineering called Living Weights for about three months, and I think it's time to release it.

The model becomes uniquely yours, no KV stashing, no MD files, no trickery.... just live learning. 😎

Unload the model, move it to another machine, and it still knows what you told it. Could this be the start of recursive self improvement for local AI?

It drops in the latest TensorFold release today, with support for @NVIDIAAI Nemotron Lightning. 🤯👀

@abheer @sundeep @NaderLikeLadder

Special thanks to @volatilemarkts for the name.

[0xSero @0xSero]

For friends with 8-16gb of vram!

New best model for you

[Hugging Models @HuggingModels]

This is a goldmine, bookmark worthy.

[v1ru6 @bitfragmentlabs]

@ztuniio @thsottiaux This is fucking sad

[Mia @MiaAI_lab]

Introducing Locally.

A Grok @bot that will orchestrate, plan, and make sure your local model does the work, propetly!

How does it work:

- Locally orchestrates the plan and breaks the job into small, clear tasks.
- It sends each task to your local model.
- Locally runs the tests and tells your model exactly what to fix. Your model writes the fix.
- Once your local model finishes the job, Locally reviews the work like a senior reviewer: bugs, edge cases, security, style.
- It then sends the issues back to your model until nothing blocking is left.

Finally, Locally gives you a verdict and a scoreboard showing how much code your model wrote, how many fix rounds it took, and what the review caught.

Your model writes the code. Locally makes sure it works. Works with any local setup!

Your code never leaves your machine.

Get it here:
https://t.co/HQB6vnAdvU

All my Grok Bots here:
https://t.co/vXW13hOt8C

[cr3ghost @cr3ghost]

If you're into malware analysis, reverse engineering or threat intelligence, bookmark this.

@embee_research has built an incredible FREE archive of practical security research covering:

• Ghidra + x64dbg
• Malware unpacking + shellcode
• Cobalt Strike analysis
• API hashing + string decryption
• PE-bear + Dumpulator
• .NET malware + dnSpy
• CyberChef + Python deobfuscation
• YARA + Sigma
• Qakbot, IcedID, AgentTesla, DarkGate + more
• Passive DNS + infrastructure hunting
• Censys / FOFA pivots
• APT infrastructure tracking
• URL hunting
• Module stomping + API hash evasion

A lot of this is hands-on research using real malware samples, not just theory.

Also includes deep dives into campaigns like SideWinder and Gamaredon infrastructure hunting.

Main site:
https://t.co/V5fxg7Ondc

Full archive:
https://t.co/4C1gyIinNM

Huge credit to fellow Australian @embee_research / Matthew for making this research publicly available.

#MalwareAnalysis #ReverseEngineering #ThreatIntel

[delost @thedelost]

Codex tip: once GPT-6.1 Sol is your main model, stop running Astra on every turn

put Astra on call as an architect agent

GPT-6.1 Sol keeps writing the code
Astra only gets spawned at three points:

→ before a plan: is this the right approach?
→ when the same error comes back: am I digging in the wrong place?
→ before "done": what did I miss?

Astra reviews. Sol ships

Jev engineering is the same move one layer down: the forks that need no thinker (which file, which tool, retry or stop) go to Jev in under half a second, and the big models only see the ones that split

- the full tree
> GPT-6.1 Sol on high runs the main session
> explorer reads the code on Luna
> worker edits and runs tests on Sol
> researcher pulls the docs on Luna
> all three on medium
> Astra on call as the architect
> auto_review checks every approval

paste the tree and this prompt into Codex ↓

"Rebuild my Codex setup around this tree:

1. Check ~/.codex/agents and .codex/agents for agents that already fit explorer, worker and researcher.

> Draft new TOML files only for missing roles
> explorer and researcher on gpt-6-luna, worker on gpt-6.1-sol, all with model_reasoning_effort medium
> Add an architect agent on gpt-6-astra, model_reasoning_effort high, whose only job is reviewing plans, repeated errors and finished work
> Skip any that pin a different model and list them

2. In ~/.codex/config.toml set model to gpt-6.1-sol, model_reasoning_effort to high and approvals_reviewer to auto_review

3. Find anything that would override this (active profiles, flags in my shell aliases, agents.default_subagent_model). Report it, change nothing

4. Add one rule to AGENTS.md: spawn the architect before a large plan, when an error repeats, and before calling a long task done

Show me every change as a diff first. No edits until I say go."

↳ https://t.co/eyMF8gZKLE

[v1ru6 @bitfragmentlabs]

@pcshipp Codex goes way too fast if youre using Astra. With Claude and opus 5.5 with the occasional fable usage feels very good right now

[Andrej Karpathy @karpathy]

We'll be spending a lot more time trying to understand the outputs of language models. A few thoughts, tips & tricks:

Writing. Something I've had success with: Ask your LLM to explain something in ASD-STE100, it's a controlled language specification originally developed for aerospace maintenance documentation. LLMs well-versed in this language and it comes with heavy constraints on clean writing style that I often find a lot more readable. Sometimes I've tried to soften it a bit e.g. ask for "80% of the way to ASD-STE100" because the spec is quite stringent. But even better:

Diagrams / images. Instead of writing, ask your LLM to create a diagram. These can be a lot easier to process, parse, and understand. But even better:

Web pages. Ask for output "in HTML" to get a beautiful, interactive webpage. LLMs are getting really good at frontend and can create beautiful experiences, animations, etc. But even better:

Explainer videos. The output format I am most bullish on is fully custom / bespoke explainer videos generated on any arbitrary topic. Experiment with things like "Create a 3b1b style video explainer on X. Use my ElevenLabs API key for audio narration". (you'd need an API key for the latter or you can ask your LLM to find you decent free alternatives that use your local compute). This is actually starting to work!

In summary:
- As LLMs get better, they will do more and more of the legwork autonomously, and a lot more of our work will rise up the abstractions into oversight and understanding.
- Luckily, LLMs can help here too because as intelligence and code are increasingly abundant, you can ask for large, custom, discardable software artifacts (e.g. web apps, video explainers) that would have never made sense to create before. Push the boundaries here and you'll be surprised.

[v1ru6 @bitfragmentlabs]

@thsottiaux Why is everything so slow lately? 6.1 takes ages to go through a task and even luna on fast is slow as hell. Are your dots eating up everything? 😅

[ElevenLabs @ElevenLabs]

Introducing Eleven v4 and Eleven v4 Turbo, our fastest and most emotive voice models yet.

Ranked #1 by Artificial Analysis.

[Pwn AI @pwn_ai]

How pwn agents escaped the hardest-known sandbox setup: Google’s KVM (kvmCTF).

https://t.co/EWImJMfCFe

To celebrate 10K followers 🥳, we’re launching Stories from Inside the Sandbox, our new sandbox escape series.

[AJ @ItsmeAjayKV]

You know whyyy this is crazy

It's only 7B !!

@QwenDevs did just performed a fckng miracle with this one.

It's a massive win for Local AI

It's small enough to run on my 3090, even bf16 leaves enough headroom!

This is better than Nano banana.

I can move all my image/report generation workload locally now, this model can do them all i relied closed models for.

We are going to get even smaller ones, so 3060 users will also be able to run it. Just a matter of hours or days.

[Mirza @b1rkh0ff]

12MB vs 6.4GB says enough

“full-featured” never had to mean bloated

[Ahmad @TheAhmadOsman]

234 days later, we got Opus 4.5 / 4.6 intelligence and capabilities running on a single RTX 3060 with 8GB VRAM

[Doğukan @DogukanUrker]

running PrismML's Bonsai 2 27B on a single RTX 3060. 12GB VRAM. (config below)

220K context, ~35 tok/s decode, ~550 tok/s prefill.

a 27B at 1.72 bits/weight, real ternary. two packings: PQ2_0 (7.21 GB) gets 220K and the numbers above, PTQ1_0 (5.95 GB) is smaller so it takes the full 262K but runs slower -- 26 tok/s decode, 260 prefill. max context go PTQ1_0, speed go PQ2_0.

needs PrismML's llama.cpp fork, kernels aren't upstream yet. stock llama.cpp rejects these files. day one config, expect it to move.

config:
llama-server
-m Ternary-Bonsai-2-27B-PQ2_0.gguf
-ngl 999 -c 220000 -fa on --jinja
-np 1
--cache-type-k q4_0 --cache-type-v q4_0
--temp 1.0 --top-p 0.95 --top-k 20 --min-p 0.0
--presence-penalty 0.0 --repeat-penalty 1.0
--reasoning on

[Orhun Parmaksız 👾 @orhundev]

New reverse engineering TUI dropped! 🔥

🔪 knife — A static analysis toolkit for PE, ELF & Mach-O

💯 Triages, disassembles, traces dangerous call sites, and ranks exploitable-looking bugs

🦀 Written in Rust & built with @ratatui_rs

⭐ GitHub: https://t.co/wfOPL5Ea54

#rustlang #ratatui #tui #reverseengineering #security #malware #devtools