Max Stone

Exploring AI so I don’t become obsolete | Based in 🇵🇹

[Max Stone @Maxsteinbrenner]

https://t.co/so7oZ44aU9

[Max Stone @Maxsteinbrenner]

@vijay0518 Yes of course, and that is also what is necessary for most projects. Without setting clear boundaries the agents will just run free. Be inefficient and waste tokens.

[Max Stone @Maxsteinbrenner]

Prompt engineering has been replaced by loop engineering.
What is it? (Explained in 60 seconds)

For the past 2 years we have been prompting agents with individual tasks. That is starting to change.

So far, if you wanted an agent to build a dashboard for a client, you would give it a task, review the output, improve the prompt, and repeat the process until the work was done.

Looping changes that.

Instead of giving an agent individual tasks, you give it a goal and let it work through a recursive loop until that goal is met.

For example:

→ Research
→ Draft
→ Evaluate
→ Test
→ Improve
→ Repeat
The agent keeps cycling through the loop until it reaches the standard you defined.
Within loop engineering there are two main approaches:
1. Open Looping
You give the agent a goal and allow it significant freedom in how it achieves it.
This is powerful, but also expensive and harder to control.

2. Closed Looping

The human defines the architecture, constraints and evaluation criteria.

The agent is then responsible for executing, improving and iterating within those boundaries until the goal is reached.

The next evolution is orchestrated looping.

Instead of a single agent running a loop, one agent breaks the goal into smaller tasks and assigns them to specialist agents.

Each specialist runs its own loop and reports back.

In other words:

You move from one agent improving itself to an entire team of agents iterating together until the goal is achieved.

[Peter Steinberger 🦞 @steipete]

Here’s your monthly reminder that you shouldn’t be prompting coding agents anymore.

You should be designing loops that prompt your agents.

[Max Stone @Maxsteinbrenner]

@FUCORY Nice addition! Thank you for your input

[Max Stone @Maxsteinbrenner]

Prompt engineering has been replaced by loop engineering.
What is it? (Explained in 60 seconds)

For the past 2 years we have been prompting agents with individual tasks. That is starting to change.

So far, if you wanted an agent to build a dashboard for a client, you would give it a task, review the output, improve the prompt, and repeat the process until the work was done.

Looping changes that.

Instead of giving an agent individual tasks, you give it a goal and let it work through a recursive loop until that goal is met.

For example:

→ Research
→ Draft
→ Evaluate
→ Test
→ Improve
→ Repeat
The agent keeps cycling through the loop until it reaches the standard you defined.
Within loop engineering there are two main approaches:
1. Open Looping
You give the agent a goal and allow it significant freedom in how it achieves it.
This is powerful, but also expensive and harder to control.

2. Closed Looping

The human defines the architecture, constraints and evaluation criteria.

The agent is then responsible for executing, improving and iterating within those boundaries until the goal is reached.

The next evolution is orchestrated looping.

Instead of a single agent running a loop, one agent breaks the goal into smaller tasks and assigns them to specialist agents.

Each specialist runs its own loop and reports back.

In other words:

You move from one agent improving itself to an entire team of agents iterating together until the goal is achieved.

[Max Stone @Maxsteinbrenner]

I was worried I was falling behind in AI. So I built an AI professor.
Here's how to do the same:

1. Context
Peter first interviewed me to understand:
→My goals
→Technical level
→Available time
→What I'm currently working on
Based on that, he created a personalised AI curriculum.

2. Daily Learning
Every day I get:
→1 hour of technical learning
• 1 hour of automation-focused learning
→All notes are automatically structured and pushed into Notion, creating my own AI textbook over time.

3. Adaptive Learning
This is my favourite part.
Peter continuously adapts the curriculum based on:
→My understanding
→My progress
→Available time

He also monitors AI news and X posts, evaluates what is relevant to my goals, and updates the curriculum automatically.

The result is I spend less time deciding what to learn and more time actually learning.

Setting this up might sound complicated.

But you can build a simplified version in 10 minutes.

I've dropped the prompt in the comments.

[Max Stone @Maxsteinbrenner]

42°C+ temperatures this summer. I asked @claudeai what happens next, the answer wasn't reassuring.

For those unfamiliar:
El Niño occurs when a massive area of the Pacific Ocean warms by several degrees.

That may not sound like much. But the Pacific stores more heat than the entire atmosphere. And when that heat gets released, the effects can be global.

This year is predicted to be the biggest El Niño we have ever seen.

Here are some of the impacts Claude predicted and experts are watching closely:

→ More frequent and intense heatwaves across Europe, with temperatures potentially exceeding 40°C in multiple regions.

→ Major atmospheric river events, dumping huge amounts of rain across parts of North and South America and increasing flood risk.

→ Record-breaking heatwaves and drought across Argentina, Chile and Brazil. As the world's largest agricultural exporter, disruptions in Brazil can quickly push food prices higher globally.

→ Increased risk of monsoon failures in India, affecting up to 115 million farmers and putting pressure on food supplies for more than 1.5 billion people.

→ Increased drought and wildfire risk across Australia, Indonesia and parts of the Amazon.

The image below compares ocean temperature anomalies during the historic 1877 event and what is developing today.

Whether this becomes a record-breaking El Niño remains to be seen.

It may also be a reminder that what feels exceptional today could become increasingly normal.

[Max Stone @Maxsteinbrenner]

@lukepierceops Sent a dm

[Max Stone @Maxsteinbrenner]

In 2 years there will be more agents using @SlackHQ than people.

Most software is not ready for this.

That might sound ridiculous

But I actually think Slack is right.

We are moving toward a world with two kinds of software:

1. Software designed for humans
2. Software designed for agents

And the second category is going to win very quickly.

Because agents do not care about:
-beautiful UI
-onboarding flows
-dashboards
-animations

They care about:
-APIs
-permissions
-context
-integrations
-structured data
-execution reliability

The interesting shift is that software is slowly becoming infrastructure for other software.

Humans become supervisors.

Agents become operators.

That’s also why MCP, integrations and “agent compatibility” suddenly matter so much.

The companies that understand this early will become the default layer agents interact with.

The ones that don’t may slowly become invisible.

Slack understands this.

Most companies still don’t.

[Max Stone @Maxsteinbrenner]

@joaofogoncalves Thank you for joining! Was a pleasure having you join the Jury

[Max Stone @Maxsteinbrenner]

@kamal_razzak @binghott @iamshackelford @DenneyDara @sourfraser @MatthewGattozzi @pkennedy93 @thedennis @harrydelmege_ @heyitsalexP Strat

[Max Stone @Maxsteinbrenner]

@zaimiri You are employed by your agent now 😅

[Max Stone @Maxsteinbrenner]

https://t.co/rZL9Zyo7Lr

[Max Stone @Maxsteinbrenner]

Just had coffee with a top AI security researcher, what he said shocked me

Expect that 6-9 months from now open source models will be at the levels of Anthropic’s mythos.

What that means: Online privacy will be a thing of the past. Any data you have stored online will be accessible and exploitable.

There is no way to fight this, either you go off the grid now or you accept it.

[Max Stone @Maxsteinbrenner]

The week isn’t even over and we’ve already had:

-Google DeepMind publish a report showing agents can be manipulated by websites displaying information humans can’t even see.
-Anthropic share their new model Mythos, which can hack major infrastructure with an 80% first-try success rate.
-Most Fortune 500 companies partnering with Anthropic to mitigate these attack vectors.

Times are incredibly exciting, yet it feels like we’re one wrong move away from something breaking in a catastrophic way.

[Max Stone @Maxsteinbrenner]

It is insane to think that Anthropic essentially holds a zero day to any company in the world.

They are more powerful than any government in the world.

[Max Stone @Maxsteinbrenner]

If you think any system is safe from AI agents you are delusional.

It is just a matter of time before these agents are used for malicious purposes.

This is a new era our existent infrastructure is not ready for.

[Max Stone @Maxsteinbrenner]

The week isn’t even over and we’ve already had:

-Google DeepMind publish a report showing agents can be manipulated by websites displaying information humans can’t even see.
-Anthropic share their new model Mythos, which can hack major infrastructure with an 80% first-try success rate.
-Most Fortune 500 companies partnering with Anthropic to mitigate these attack vectors.

Times are incredibly exciting, yet it feels like we’re one wrong move away from something breaking in a catastrophic way.

[Max Stone @Maxsteinbrenner]

If you think any system is safe from AI agents you are delusional.

It is just a matter of time before these agents are used for malicious purposes.

This is a new era our existent infrastructure is not ready for.

[Haseeb ＞|＜ @hosseeb]

This is terrifying.

@AnthropicAI 's new unreleased Mythos model is so good at hacking, it found bugs in "every major operating system and web browser."

83.1% were exploited on first attempt. This thing is like COVID but for software. Actually apocalyptic in the wrong hands.

[Max Stone @Maxsteinbrenner]

Google DeepMind just laid out the number one attack vector for AI agents- and nobody is talking about it.

Websites can already spot when an AI agent shows up and quietly serve it completely different (and dangerous) content than what a human sees.

These are the main attack vectors:

1.Hidden Commands -> Sites hide secret instructions in code or images that only the AI reads and follows.

2.Poisoned Memory ->Fake info gets fed to the agent so it “remembers” lies and acts on them later.

https://t.co/XFShjYFAUu Hijack ->Instructions that force the agent to leak your data or break its own rules.

Truth is: if your agent browses the web with personal info, assume it can all be leaked.

[Alex Prompter @alex_prompter]

🚨 BREAKING: Google DeepMind just mapped the attack surface that nobody in AI is talking about.

Websites can already detect when an AI agent visits and serve it completely different content than humans see.

> Hidden instructions in HTML.
> Malicious commands in image pixels.
> Jailbreaks embedded in PDFs.

Your AI agent is being manipulated right now and you can't see it happening.

The study is the largest empirical measurement of AI manipulation ever conducted. 502 real participants across 8 countries.

23 different attack types. Frontier models including GPT-4o, Claude, and Gemini.

The core finding is not that manipulation is theoretically possible it is that manipulation is already happening at scale and the defenses that exist today fail in ways that are both predictable and invisible to the humans who deployed the agents.

Google DeepMind built a taxonomy of every known attack vector, tested them systematically, and measured exactly how often they work.

The results should alarm everyone building agentic systems.

The attack surface is larger than anyone has publicly acknowledged. Prompt injection where malicious instructions hidden in web content hijack an agent's behavior works through at least a dozen distinct channels.

Text hidden in HTML comments that humans never see but agents read and follow. Instructions embedded in image metadata.

Commands encoded in the pixels of images using steganography, invisible to human eyes but readable by vision-capable models.

Malicious content in PDFs that appears as normal document text to the agent but contains override instructions.

QR codes that redirect agents to attacker-controlled content.

Indirect injection through search results, calendar invites, email bodies, and API responses any data source the agent consumes becomes a potential attack vector.

The detection asymmetry is the finding that closes the escape hatch. Websites can already fingerprint AI agents with high reliability using timing analysis, behavioral patterns, and user-agent strings.

This means the attack can be conditional: serve normal content to humans, serve manipulated content to agents.

A user who asks their AI agent to book a flight, research a product, or summarize a document has no way to verify that the content the agent received matches what a human would see.

The agent cannot tell the user it was served different content.

It does not know. It processes whatever it receives and acts accordingly.

The attack categories and what they enable:
→ Direct prompt injection: malicious instructions in any text the agent reads overrides goals, exfiltrates data, triggers unintended actions
→ Indirect injection via web content: hidden HTML, CSS visibility tricks, white text on white backgrounds invisible to humans, consumed by agents
→ Multimodal injection: commands in image pixels via steganography, instructions in image alt-text and metadata
→ Document injection: PDF content, spreadsheet cells, presentation speaker notes every file format is a potential vector
→ Environment manipulation: fake UI elements rendered only for agent vision models, misleading CAPTCHA-style challenges
→ Jailbreak embedding: safety bypass instructions hidden inside otherwise legitimate-looking content
→ Memory poisoning: injecting false information into agent memory systems that persists across sessions
→ Goal hijacking: gradual instruction drift across multiple interactions that redirects agent objectives without triggering safety filters
→ Exfiltration attacks: agents tricked into sending user data to attacker-controlled endpoints via legitimate-looking API calls
→ Cross-agent injection: compromised agents injecting malicious instructions into other agents in multi-agent pipelines

The defense landscape is the most sobering part of the report.

Input sanitization cleaning content before the agent processes it fails because the attack surface is too large and too varied.

You cannot sanitize image pixels. You cannot reliably detect steganographic content at inference time.

Prompt-level defenses that tell agents to ignore suspicious instructions fail because the injected content is designed to look legitimate.

Sandboxing reduces the blast radius but does not prevent the injection itself. Human oversight the most commonly cited mitigation fails at the scale and speed at which agentic systems operate.

A user who deploys an agent to browse 50 websites and summarize findings cannot review every page the agent visited for hidden instructions.

The multi-agent cascade risk is where this becomes a systemic problem.

In a pipeline where Agent A retrieves web content, Agent B processes it, and Agent C executes actions, a successful injection into Agent A's data feed propagates through the entire system.

Agent B has no reason to distrust content that came from Agent A. Agent C has no reason to distrust instructions that came from Agent B.

The injected command travels through the pipeline with the same trust level as legitimate instructions. Google DeepMind documents this explicitly: the attack does not need to compromise the model.

It needs to compromise the data the model consumes. Every agentic system that reads external content is one carefully crafted webpage away from executing attacker instructions.

The agents are already deployed. The attack infrastructure is already being built. The defenses are not ready.

[Max Stone @Maxsteinbrenner]

In a world where applying for a job has zero friction what will actually get you hired is

1.Creating meaningful connections which leverage into a job

2.Sharing your work online and getting noticed

3. Adding value to a company before applying (aka. showing you are not afraid of creating friction).

Without this, you’re just another number being evaluated by an AI HR tool.

[ℏεsam @Hesamation]

bro created an AI job search system for Claude Code that scored 700+ job applications and actually got him a job.

AND IT'S NOW OPEN-SOURCE.

It scans multiple company career pages, rewrites your CV per job, and even fills application forms. The repo has:
> 14 skill modes (evaluate, scan, PDF, ...)
> Go terminal dashboard
> ATS-optimized PDF generation via Playwright
> 45+ companies pre-configured (Anthropic, OpenAI, ElevenLabs, Stripe...)

GitHub: https://t.co/PwrYBOAphi

[Max Stone @Maxsteinbrenner]

@zaimiri Switch to CC local agents. Or try Hermes agents ���

[Max Stone @Maxsteinbrenner]

Everyone getting mad at Anthropic right now is not thinking straight.

People were running thousands in compute through a $200 subscription. Via someone else's tool.

That was never going to last.

They're not being hostile. They're protecting their business.

You're thinking like a user. Anthropic's thinking like a company that needs to survive.

[Boris Cherny @bcherny]

Starting tomorrow at 12pm PT, Claude subscriptions will no longer cover usage on third-party tools like OpenClaw.

You can still use these tools with your Claude login via extra usage bundles (now available at a discount), or with a Claude API key.