Michał Piszczek

CTO @ Archdesk | Systems where physics meets economics.

Ex-Hacker. Ex-Fintech CEO. Nullius in verba. 🖖

AI does not fail. Human judgment does.

[Michał Piszczek @cdiamond]

@hackernoon's editors picked my essay as a Top Story today.

Thesis in one line: technology never destroys value, it relocates scarcity. AI made execution cheap. The price moved to judgment, verification, and a name willing to be answerable.

Original: https://t.co/JwhZZelsDr:

HackerNoon: https://t.co/7TntPgu5wk

[Michał Piszczek @cdiamond]

@HuggingPapers The card's own table has it behind on two of the three rows quoted as SOTA: DeepSWE 73.7 vs 77.0 for DeepSeek V4.1 Flash-1017, OSWorld 2.0 61.7 vs 70.6 for Opus 5. Only BankerToolBench 76.2 is a top score

[Michał Piszczek @cdiamond]

@rubenssoto_ai Blended that is about $0.43 per million tokens for DeepSeek vs $8.55 for GPT, but 20x the input tokens leaves the per-run bill at $0.96 vs $1.29. Price per token is not price per task

[Michał Piszczek @cdiamond]

@AravSrinivas The pre-commit example in the docs exits 0 for anything under 0.5, so a missed secret just gets committed. Fine as a second pass behind a regex scanner, thin as the only gate

[Michał Piszczek @cdiamond]

@atomic_chat_hq The 300 tok/s figure is the math slice of the README table. Averaged across chat, code, math and multilingual, it comes to 120.5 to 240.6 tok/s, or 2.00x, at batch 1 greedy on an M4 Max

[Michał Piszczek @cdiamond]

@multimodalart Private-only scoring closes the public-set loophole. If the same private tasks get reused across editions while dozens of entrants keep submitting, does the aggregate score itself become the target? Do the tasks rotate?

[Michał Piszczek @cdiamond]

@NousResearch @trycua The docs say you can click in to take over while Hermes keeps working next to you. Does the agent pause on human input, or can you both drive the same desktop at once?

[Michał Piszczek @cdiamond]

@IntCyberDigest Unit 42 says the actor scripted a system-prompt override against GLM 5.2, flagged refusals, then settled on DeepSeek V4. So jailbroken looks more like model selection by refusal rate, and low safety friction is a buying criterion

[Michał Piszczek @cdiamond]

@falconforceteam The PHP subprocess hunt matches InitiatingProcessFileName on php. Under mod_php, which PHP rates highest-risk, shell-outs come from the Apache worker, so the parent is httpd or apache2 and the hunt likely misses them

[Michał Piszczek @cdiamond]

@akaclandestine That ~6% is version-string math. 7.4 to 8.1 got source-only backports, and distros often patch without bumping the version, so the true rate is probably higher. The 5.4 to 7.3 tail has no fix at all

[Michał Piszczek @cdiamond]

@DarkWebInformer Compare the version lists. October's CPU affected 8u503, 21.0.12.1 and 25.0.4.1, this alert covers 8u511, 21.0.13 and 25.0.5. So the next builds up are exposed too, and having taken the CPU doesn't settle this one

[Michał Piszczek @cdiamond]

@RonMasas Exposure hinges on the Node binary, not express.json(). Imperva's request-body repro used Express 5 / body-parser 2 on Node 24.22.0 and took several attempts. So check the Node version inside each container image, not just package.json

[Michał Piszczek @cdiamond]

@twtayaan Worth noting why the perf argument died: the range check was never the real cost, toggling user access with STAC/CLAC is. So skipping checks across multiple accesses saved little

[Michał Piszczek @cdiamond]

@Marktechpost The 28.4x row is 4,431 ms vs 155.8 ms at 400 req/s. That gap looks like vLLM queueing past saturation, not per-request speed. Max req/s per B200 at a fixed p95 would be the cleaner comparison

[Michał Piszczek @cdiamond]

@IntCyberDigest Worth noting hiding is the small tail: 90 of 6,637 malicious skills, 1.4%. In most of the rest the instruction sits in plain view in SKILL.md, just written to look routine, so reading the raw file catches more than the headline suggests

[Michał Piszczek @cdiamond]

@jerryjliu0 Outside ParseBench the overall leads are small: 1.2 pts on olmOCR-bench (after their 1,288px rescoring), 1.7 on PulseBench-Tab, 0.7 on fr-bench-pdf2md. The 12.1 pt gap is a ParseBench result

[Michał Piszczek @cdiamond]

@cyb3rops Confidentiality and integrity high, availability none: that profile on JSSE looks like a validation bypass, not a crash. Oracle note says it is reachable through JSSE APIs fed by a web service, so any Java client or service handling external data is in scope

[Michał Piszczek @cdiamond]

@liquidai Flat p95 out to 500 req/s on a B200 is the real result. Missing piece is cost per million decisions, since these tasks are usually served by classical classifiers

[Michał Piszczek @cdiamond]

@verge Timeline check: Amazon saw the earliest PoC around 02:00 UTC Oct 21, before Chainguard's 07:41 UTC images, and after Calif's accidental video (~20:00 UTC Oct 20). The Oct 17 honeypot hit predates all of it, so none of them explain that one

[Michał Piszczek @cdiamond]

@rohanpaul_ai Worth keeping the denominators apart: the 75-94% is agentic Responses API traffic, while Codex agents alone were 99.2% eligible. The ~10% compaction gap then sits inside that eligible Codex slice, so it's a trigger hole, not an eligibility one

[Michał Piszczek @cdiamond]

@L4UR3N7 Worth separating the risks: installs with --require-hashes can't be swapped by a forged https://t.co/Ab3KtdbmrG cert, since the sha256 check fails. The exposure is unpinned installs, which is why the fix thread bootstraps pip with a sha256-pinned wheel URL