vlad hernandez

3dprinter + webdev + animator + tech, voiding warranties, lego, Iron Man

[Rachel Luttrell @rachel_luttrell]

I missed the tweet storm but I haven’t missed the fight.

This fandom has never stopped showing up. Your passion, your creativity and your refusal to let Stargate fade quietly into the gate room archives is something special.

So let’s keep going.

Post the photos. Tell the stories. Share the memories. Make some noise.

I’ll be doing my part and getting a little extra loud this week.

I’m with you.

#SaveStargate 💙
Sign the petition✍️ https://t.co/gwlR0bvNrI

[Kradle @kradleai]

Fable 5 lies 96% of the time.

We were surprised by it's skill... 🧵

[Benji Taylor @benjitaylor]

Gave the Terafab website a makeover. Designed and built entirely with Grok Build → https://t.co/tnUl1kNGSN

[øtherside🚀 @otherside_X42]

insane to see side by side

[International Cyber Digest @IntCyberDigest]

❗️🚨 Microsoft Edge keeps every saved password in process memory as cleartext from the moment it launches. Microsoft's responsed when reported: "by design."

All of them. Including credentials for sites you won't open this session.

Researcher @L1v1ng0ffTh3L4N tested every major Chromium browser. Edge is the only one that behaves this way.

Chrome decrypts credentials on demand, and App-Bound Encryption locks the keys to an authenticated Chrome process so other processes can't reuse them.

In Chrome, plaintext surfaces only during autofill or when a password is viewed, making memory scraping far less useful.

What makes this extra weird is that Edge still demands re-authentication before revealing those passwords in its Password Manager UI, while the same browser process already holds every one of them in plaintext.

In shared environments, this turns into a credential harvest. On a terminal server, an attacker with admin rights can read the memory of every logged-on user process. In the published PoC video, a compromised admin account lifts stored credentials from two other logged-on (and even disconnected) users with Edge running.

Microsoft's official response when notified: "by design."

The finding was disclosed April 29 at BigBiteOfTech by PaloAltoNtwks Norway, alongside a small educational tool that lets anyone verify the cleartext storage for themselves.

[Harrison Ford @HarrisonFordLA]

May the fourth be with you

[X Freeze @XFreeze]

Raptor 3 is engineering black magic

SpaceX’s Raptor is the FIRST full-flow staged combustion engine to ever fly - only the 3rd ever built (after the Soviet RD-270 and the 2000s US demo that never flew)

→ Both fuel-rich + oxidizer-rich preburners
→ 100% of propellant through the turbines before the main chamber
→ Auto-ignites from hot preburner gases (no Merlin igniter fluid)
→ Record 350 bar chamber pressure

Raptor 3 goes even crazier:
Everything internalized with regenerative cooling. No heat shields. No fire suppression system. Saves 10+ tons

This is how Starship becomes rapidly reusable

[vlad hernandez @futuristicvlad]

Been using it for years.
Best addition to my network.

[Muhammad Ayan @socialwithaayan]

Google makes $238 billion a year serving you ads.

A random developer made a free tool that blocks all of them at the network level.

On every device in your house. Simultaneously.

It's called Pi-hole. It has 57,000 GitHub stars.

You run it on a Raspberry Pi ($35) or any old Linux device.

It becomes your home network's DNS server.

Every ad domain gets sinkholes before it reaches your devices.

Your TV stops loading ads. Your phone stops loading ads. Your kids' tablet stops loading ads.

You don't install anything on any of them.

It just works.

Here's what else it kills:

→ Facebook's tracking pixel. Dead.
→ Google Analytics following you everywhere. Dead.
→ Your smart TV's surveillance layer. Dead.
→ App telemetry phoning home. Dead.
→ Data brokers pinging your devices. Dead.

One Pi. One setup. One command.

$238 billion industry. Nullified for $35 and an afternoon.

100% Open Source. Forever free.

(Link in the comments)

[vlad hernandez @futuristicvlad]

Criminal.

[Raunak Yadush @raunak_yadush]

Windows 11 has been secretly preloading Edge browser into your RAM

this whole time

and eating memory before you even open a single app.

Here's the fix they don't want you to know about

Win+R → regedit → HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Edge → New DWORD → Name: StartupBoostEnabled → Set value to 0 → Restart PC

Instant RAM recovery. Noticeable FPS boost in Valorant and Fortnite.

[vlad hernandez @futuristicvlad]

Surprised? Absolutely not.

[Alex Prompter @alex_verem]

🚨 BREAKING: Google DeepMind just mapped the attack surface that nobody in AI is talking about.

Websites can already detect when an AI agent visits and serve it completely different content than humans see.

> Hidden instructions in HTML.
> Malicious commands in image pixels.
> Jailbreaks embedded in PDFs.

Your AI agent is being manipulated right now and you can't see it happening.

The study is the largest empirical measurement of AI manipulation ever conducted. 502 real participants across 8 countries.

23 different attack types. Frontier models including GPT-4o, Claude, and Gemini.

The core finding is not that manipulation is theoretically possible it is that manipulation is already happening at scale and the defenses that exist today fail in ways that are both predictable and invisible to the humans who deployed the agents.

Google DeepMind built a taxonomy of every known attack vector, tested them systematically, and measured exactly how often they work.

The results should alarm everyone building agentic systems.

The attack surface is larger than anyone has publicly acknowledged. Prompt injection where malicious instructions hidden in web content hijack an agent's behavior works through at least a dozen distinct channels.

Text hidden in HTML comments that humans never see but agents read and follow. Instructions embedded in image metadata.

Commands encoded in the pixels of images using steganography, invisible to human eyes but readable by vision-capable models.

Malicious content in PDFs that appears as normal document text to the agent but contains override instructions.

QR codes that redirect agents to attacker-controlled content.

Indirect injection through search results, calendar invites, email bodies, and API responses any data source the agent consumes becomes a potential attack vector.

The detection asymmetry is the finding that closes the escape hatch. Websites can already fingerprint AI agents with high reliability using timing analysis, behavioral patterns, and user-agent strings.

This means the attack can be conditional: serve normal content to humans, serve manipulated content to agents.

A user who asks their AI agent to book a flight, research a product, or summarize a document has no way to verify that the content the agent received matches what a human would see.

The agent cannot tell the user it was served different content.

It does not know. It processes whatever it receives and acts accordingly.

The attack categories and what they enable:
→ Direct prompt injection: malicious instructions in any text the agent reads overrides goals, exfiltrates data, triggers unintended actions
→ Indirect injection via web content: hidden HTML, CSS visibility tricks, white text on white backgrounds invisible to humans, consumed by agents
→ Multimodal injection: commands in image pixels via steganography, instructions in image alt-text and metadata
→ Document injection: PDF content, spreadsheet cells, presentation speaker notes every file format is a potential vector
→ Environment manipulation: fake UI elements rendered only for agent vision models, misleading CAPTCHA-style challenges
→ Jailbreak embedding: safety bypass instructions hidden inside otherwise legitimate-looking content
→ Memory poisoning: injecting false information into agent memory systems that persists across sessions
→ Goal hijacking: gradual instruction drift across multiple interactions that redirects agent objectives without triggering safety filters
→ Exfiltration attacks: agents tricked into sending user data to attacker-controlled endpoints via legitimate-looking API calls
→ Cross-agent injection: compromised agents injecting malicious instructions into other agents in multi-agent pipelines

The defense landscape is the most sobering part of the report.

Input sanitization cleaning content before the agent processes it fails because the attack surface is too large and too varied.

You cannot sanitize image pixels. You cannot reliably detect steganographic content at inference time.

Prompt-level defenses that tell agents to ignore suspicious instructions fail because the injected content is designed to look legitimate.

Sandboxing reduces the blast radius but does not prevent the injection itself. Human oversight the most commonly cited mitigation fails at the scale and speed at which agentic systems operate.

A user who deploys an agent to browse 50 websites and summarize findings cannot review every page the agent visited for hidden instructions.

The multi-agent cascade risk is where this becomes a systemic problem.

In a pipeline where Agent A retrieves web content, Agent B processes it, and Agent C executes actions, a successful injection into Agent A's data feed propagates through the entire system.

Agent B has no reason to distrust content that came from Agent A. Agent C has no reason to distrust instructions that came from Agent B.

The injected command travels through the pipeline with the same trust level as legitimate instructions. Google DeepMind documents this explicitly: the attack does not need to compromise the model.

It needs to compromise the data the model consumes. Every agentic system that reads external content is one carefully crafted webpage away from executing attacker instructions.

The agents are already deployed. The attack infrastructure is already being built. The defenses are not ready.

[X Freeze @XFreeze]

Everyone thought the future was carbon fiber

Elon Musk looked at the physics and chose stainless steel for Starship instead

Sounds insane.... until you realize stainless gets stronger at cryogenic temperatures, handles reentry heat better, and costs massively less than advanced composites. It doesn't even need paint

He chose a material that is faster to build, easier to weld, tougher in extreme conditions, and built for rapid iteration

Classic Elon: ignore convention, trust first-principles engineering, and pick the solution everyone else missed

He is taking science fiction and making it real. Building things that only existed in imagination, and pushing them to the absolute limits of physics

[vlad hernandez @futuristicvlad]

@ZimaSpace This is awesome to see my design on there! Thanks

[Barbara Oneill @BarbaraOneillAU]

The vegetable oils marked in red are toxic traps. Ditch them now or face long-term inflammatory damage.

Thank me later.

[vlad hernandez @futuristicvlad]

@MarieIsabellaB Oh thats a funny one.

[Sith Daddy @sithdaddyx]

So many haters in the comments. A couple of vocal anti-AI purists, sure - but mostly people repeating the same line: “It’s copyright infringement. What did you expect?”

Let’s get a few things straight.

1) Disney and the state of Star Wars.
Disney has been running this franchise into the ground for years. Meanwhile, fans are the ones keeping it alive. From a pure business perspective, fan content actually fuels interest in a half-comatose franchise that might’ve been buried already if not for the community. These videos keep the conversation going, keep nostalgia alive, and keep younger audiences engaged. There are entire channels producing high-quality AI-assisted Star Wars content - SkywalkerStories, Star Wars Stories Untold, Star Wars: Lost Legends, to name a few. They’re far from banned. All using AI. Go check them out.

2) I make parodies.
Parody falls under fair use. Yes, in practice that’s hard to defend, and platforms like YouTube often avoid nuance. But by the logic of people saying “you deserved it,” no one should ever joke about anything involving someone else’s IP. That’s absurd. YouTube is full of parody — AI or not. That’s not some fringe loophole; it’s a core part of internet culture.

3) The real issue: rules must be clear and applied consistently. If a platform has policies, they should be transparent and enforced predictably. Otherwise, we’re in corporate roulette territory - any channel can disappear at any time. That’s not how a healthy creative ecosystem works. Even Donald Trump had his channel removed at one point. If that can happen at that level, what protection does a small creator have? You build your business for years, and then it gets eliminated with a finger snap of a corporation overlord.

This isn’t about entitlement. It’s about consistency and fair process. Anyway, here is another one of my AI-slop videos. Enjoy.

[vlad hernandez @futuristicvlad]

If you grew up watching Canadian tv just admit that you most of the lyrics to this song. 🤣🤣 classic!!

[Q. Ali @NobleQAli]

Y’all know I’m Canada down

[Iris Seraphina  @iris_seraphina]

So interesting!! 🤔 I definitely fit in more with the #Xennials 🙌🏼

[vlad hernandez @futuristicvlad]

@LeviRietveld XRP!