Jang Juhyun

programmer, security, IoT, smart card, fido, LLVM, BlockChain, Product Manager, AI Security

[Spencer Baggins @bigaiguy]

A French engineer who lives quietly in Paris has spent 30 years writing software that the entire internet now runs on without knowing his name.

He wrote the code that streams every YouTube video, every Netflix show, every TikTok clip. He wrote the code that runs the virtual servers underneath AWS, Google Cloud, and Microsoft Azure. He calculated more digits of pi than anyone in history. He has no Twitter. He has no marketing. He just keeps shipping.

His name is Fabrice Bellard.

Here is the story, because almost nobody outside the systems programming world knows what one man has built.

Fabrice was born in 1972 in Grenoble, France. He studied at École Polytechnique, the top French engineering school. He never went to Silicon Valley. He never built a startup empire. He just wrote code.

In 2000 he started a project called FFmpeg, an open-source multimedia framework for encoding, decoding, and streaming video. He was 28. The project did one thing nobody else had done well. It handled every video and audio format that existed, in one library, on every operating system. He led it himself for years.

Today FFmpeg is the invisible engine of the internet. YouTube uses it. Netflix uses it. VLC uses it. Chrome and Firefox use parts of it. Every Android phone, every iPhone, every smart TV, every video editing tool you have ever touched runs FFmpeg somewhere underneath. If you have watched a video on a screen in the last 20 years, Fabrice's code processed it.

He was not done.

In 2003 he started QEMU, a machine emulator and virtualizer. He wrote it solo until version 0.7.1 in 2005. QEMU lets you run any operating system on any other operating system. It became the foundation of modern virtualization. KVM, the Linux kernel hypervisor, runs on top of QEMU. Every major cloud provider, AWS, Google Cloud, Microsoft Azure, IBM Cloud, runs virtual machines on infrastructure built around it. The Quick Emulator is the most cited piece of cloud infrastructure code on Earth.

He kept going.

In 2001 he won the International Obfuscated C Code Contest with a small C compiler that grew into TCC, the Tiny C Compiler. TCC can compile and boot a Linux kernel from source in under 15 seconds. In 2004 he calculated the most digits of pi ever computed at the time, using a personal desktop computer and an algorithm he derived himself called Bellard's formula. In 2011 he wrote a complete PC emulator in pure JavaScript that runs Linux in your browser, a project called JSLinux that engineers still cannot believe is real.

In 2019 he released QuickJS, a small but complete JavaScript engine that fits where V8 cannot. In 2021 he released NNCP, a neural network based lossless data compressor that immediately took the lead on the Large Text Compression Benchmark.

Then he turned his attention to large language models. He built TextSynth Server, a web server with a REST API for running LLMs locally. He released ts_zip and ts_sms, compression utilities that use language models to compress text and short messages at ratios traditional algorithms cannot reach. He released TSAC, a very low bitrate audio compression system. In December 2025 he released Micro QuickJS, a new JavaScript engine for microcontrollers, separate from QuickJS, designed for environments with almost no memory.

Fabrice co-founded a telecom company called Amarisoft in 2012, where he serves as CTO. Amarisoft builds 4G and 5G base station software used by carriers and labs around the world. He has been running it for over a decade while continuing to ship personal projects from his own home page at bellard dot org

He has no Twitter. He has no Instagram. He gives almost no interviews. His personal website is a flat list of projects with no styling, no fonts, no marketing copy. Just titles and links.

A quiet French engineer who never moved to Silicon Valley wrote the code that quietly runs the internet.

He is still shipping.

[Min Choi @minchoi]

AI is starting to build AI.

Anthropic just published one of the clearest signals yet.

Claude now writes 80%+ of Anthropic's production code.

Their engineers are merging 8x more code per day than in 2024.

That sounds like a productivity stat.

It' actually much bigger.

For most of AI history, humans did the whole loop:

- write code
- run experiments
- debug systems
- interpret results
- decide what to try next

Now Claude is taking over more of that loop.

At Anthropic, Claude can already:
→ write and edit code
→ run code
→ delegate work to agents
→ debug incidents
→ optimize experiments
→ review code before merge
→ catch bugs humans missed

One example was insane:

Claude shipped 800+ fixes that reduced a class of API errors by 1,000x.

The engineer said a human would have taken 4 years.

Claude did it in April.

The scary part is not that Claude writes code.

The scary part is that Claude is getting better at the work around the code:
> figuring out what went wrong
> testing fixes
> choosing next steps
> running experiments
> checking its own outputs

Anthropic says Claude went from about 3x speedup on one internal optimization task in 2025 to about 52x with Mythos Preview in 2026.

That is not normal tool improvement.

That is compounding.

The current human advantage is still taste and judgment:

What problem should we solve?
Which result matters?
Which direction is worth pursuing?
When should we stop?

But the "doing" part is getting automated fast.

This is the real shift:

Humans used to build AI.

Now humans increasingly steer agents that build AI.

And if that loop closes completely, you get recursive self-improvement:

AI systems designing, testing, and improving their own successors.

Anthropic says we are not there yet.

But they also say institutions are not ready if it comes sooner than expected.

The AI race is no longer just about better chatbots.

It's about who can build the fastest machine for improving intelligence itself.

[Vivek | Cybersecurity @VivekIntel]

Anthropic just open-sourced a reference framework for AI-powered vulnerability discovery and remediation 🤖💀

The workflow:

Recon → Find → Verify → Triage → Report → Patch

Features:
• Threat modeling
• Autonomous vulnerability hunting
• Crash verification
• Finding deduplication
• Exploitability analysis
• AI-generated patches with validation

Built around Claude Code and sandboxed agents using gVisor.

🔗 https://t.co/ZFOtXZPEn8

Interesting signal: AI is moving beyond code generation into autonomous security research and vulnerability management.

#CyberSecurity #AppSec #AI #LLM #VulnerabilityManagement #DevSecOps #ClaudeAI

[Fei-Fei Li @drfeifei]

https://t.co/Kt50ttQRMJ

[Anthropic @AnthropicAI]

How well do the security community's techniques hold up against AI-enabled cyberattacks?

We examined 832 malicious accounts and mapped their activity onto a longstanding database of tactics and techniques used by threat actors.

Here's what we learned:https://t.co/fgOqJRh2rx

[Demis Hassabis @demishassabis]

Celebrating the milestone of a massive 150+ million downloads of Gemma 4 with the release of the new Gemma 4 12B model! It's incredibly powerful for such a small model and it’s tiny enough to run locally on a laptop with just 16GB VRAM. Apache 2.0 license - happy building!

[Sebastian Raschka @rasbt]

It's been a while! 4 nice additions to the open-weight local-LLM-on-consumer-hardware ecosystem:

[Seungjoo Kim (김승주) @skim71]

원문 보고서를 한 번쯤 읽어보는 것도 좋을듯 합니다. 무엇보다 Responsible Disclosure 제도가 어떤 배경에서 등장했고, CVE·VDP·SBOM 등과 함께 어떻게 발전해 왔는지를 한눈에 살펴볼 수 있답니다!

"Responsible Disclosure in the Age of AI: A Call for Urgent Action" https://t.co/3ynSLvjMIX

[Chad Wahlquist @chadwahl]

Everyone: We are launching Forward Deployed Engineering - FDEs

@ssankar in 2009:

[Devin Desktop @devindesktop]

Claude Opus 4.8 is now available in Windsurf and Devin CLI

[HAHWUL @hahwul]

Dalfox v3 has been released🔥

I've been rewriting it in Rust since August last year, and it's finally done.

The biggest change is the engine. v3 no longer depends on a headless browser like v2 did. Instead, it uses DOM/AST analysis to check whether an XSS finding is actually valid.

Tested on xssmaze, various challenge sites, and real-world targets, it reduces false negatives and false positives more effectively while scanning faster than v2.

https://t.co/maZDqTQPqs

[XBOW @Xbow]

What will the next six months of offensive security look like? Or what should it look like?

Our recent panel discussion at RSAC with @nicowaisman, XBOW CISO; @Jhaddix, Arcanum CEO; @daveaitel, Technical Staff, OpenAI examined this question.

See highlights of their advice below; get all their insights in our new whitepaper, The Next Six Months of Offensive Security: What CISOs Need to Change Now: https://t.co/o5OwiWy0NV

[Sebastian Raschka @rasbt]

Gated DeltaNet has been one of my favorite "hybrid attention" newcomers in the good old transformer stack.
Excited to see Gated DeltaNet-2. Adding it to my reading stack. In the meantime, I have a primer on Gated DeltaNet here: https://t.co/FoicOLtFE6

[Seungjoo Kim (김승주) @skim71]

CISA와 G7 파트너들은 AI 소프트웨어 공급망 보안에 대한 새로운 지침을 발표했다고...

Software Bill of Materials (SBOM) for Artificial Intelligence - Minimum Elements (2026년 5월12일) https://t.co/XVKCB7Bk4C

[Logan Graham @logangraham]

A lot of people have been wondering about Mythos, Glasswing, and the vulns we / our partners are fixing. Today, I’m excited for us to start sharing more. (For context, I lead Glasswing @AnthropicAI.)

Two independent evaluations this week—from XBOW and the UK AISI—confirm what we've been seeing internally: Claude Mythos Preview is a step change in autonomous cybersecurity capabilities. We need to start preparing fast for a world of models with this level of capabilities.

The UK AI Security Institute tested the model we shipped at the launch of Project Glasswing and found Mythos Preview is the first model to solve both of their end-to-end cyber ranges, including one (Cooling Tower) which no model had ever cleared. But attackers (and defenders) have sophistication & cost constraints – Mythos is also the only model that clears every one of their tasks estimated over 8 hours under their deliberately low 2.5M-token cap.

XBOW tested it on their offensive security benchmarks, finding "token-for-token, unprecedented precision." It's the only model to succeed at subtle V8 sandbox work.

Other Glasswing partners shared similar stories. In a few weeks of testing, Mythos Preview has helped them find many thousands of (estimated) high + critical severity vulnerabilities, sometimes double what they'd normally find in a year.

I don't share this to boost Mythos. In fact, this is not about Mythos. It’s about preparing for the coming world of models being better, faster, cheaper, and more creative than some of the best human experts at dual use capabilities. Clearly, we need them supporting defenders as widely as can be done safely – and especially the least resourced ones.

Within a year, Mythos will probably look quite dumb (relative to other new models). And others may release openly available or unguardrailed models of Mythos-level capabilities.

We started Project Glasswing because capabilities like Mythos Preview's won't stay rare, or stay in careful hands. We are bringing it to defenders as fast as we responsibly can, while working to figure out, for example, the right safeguards and patching & disclosure processes.

Also, to be clear, compute has never been a limiter in our rollout.

Expect a fuller update on our Glasswing work in the coming days.

XBOW report: https://t.co/Mumtbf3kE3

UK AISI report: https://t.co/vBgqz0AeKJ

[Ajit kumar @ajitcodes]

Learn AI for free directly from top companies.

1 - Anthropic:
https://t.co/1M15GC7cOY

2 - Google:
https://t.co/AIkLM6XjVL

3 - Meta:
https://t.co/UWdSCK5daz

4 - NVIDIA:
https://t.co/B458g8uF1u

5 - Microsoft:
https://t.co/UChXyK2ZQh

6 - OpenAI:
https://t.co/Do088drBz6

7 - IBM:
https://t.co/4XKRjVNMKA

8 - AWS:
https://t.co/36WQ7H0vfT

9 - https://t.co/saSYDpvXFf:
https://t.co/mtt2yYxm6a

10 - Hugging Face:
https://t.co/YYHwWDpwPF

👇Comment "Learning" if you find this helpful.

Repost so others can take help.

Must bookmark for future reference.

[Om Patel @om_patel5]

THIS GUY BUILT A PHYSICAL DEVICE THAT SITS ON YOUR DESK AND SHOWS YOUR CLAUDE CODE USAGE LIMITS IN REAL TIME

it's called clawdmeter. it runs on a $32 waveshare ESP32 dev board with a 480x480 AMOLED display

instead of checking the claude code UI or guessing how much usage you have left, you can now just glance at your desk

at this point anthropic should just mail these to us for free

but i also don't need MORE claude usage anxiety

AND it's open source on github.

this situation says EVERYTHING about the current state of the product

the claude code accessory market is booming in real time

[보안프로젝트 @ngnicky]

Checkmarx는 지난 주말, 자사의 Jenkins 애플리케이션 보안 테스트(AST) 플러그인의 악성 버전이 Jenkins Marketplace에 게시되었다고 경고했습니다.

이번 침해는 TeamPCP 해커 그룹이 자행했다고 주장하며, 이들은 npm에 대한 Shai-Hulud 캠페인 과 Trivy 취약점 스캐너 침해를 포함한 일련의 공급망 공격을 시작하여 자격 증명 탈취 악성코드를 유포했습니다.
https://t.co/ivRzSxB2BU

[보안프로젝트 @ngnicky]

국민성장펀드 국민 모집액 6,000억원 예정이라. 하루만에 끝날 듯~~

[보안프로젝트 @ngnicky]

어마한 규모이구먼~~~
앤트로픽이 컴퓨팅 확장을 위해 클라우드 업체인 아카마이 테크놀로지스와 18억달러(약 2조6380억원) 규모의 컴퓨팅 계약을 체결했다. https://t.co/6MPXtLtHaa