Matthew Hennessey

Believer. Dad. Husband. Director of Security and Risk Intelligence during the day and building @commonrisks at night.

[Uncle Bob Martin @unclebobmartin]

I’m significantly older than you. I started coding in the late 60s. My current strategy is to not read any of the code written by my agents. That’s the only way I can take advantage of their productivity. What I do instead is to surround the agents with extreme constraints. Unit tests, gherkin tests, QA procedures, quality metrics, mutation testing, test coverage, and a plethora of others. In the end, I have very high confidence in the code they produce because they’ve had to run the gauntlet of all of my constraints and tests.

[Hugging Models @HuggingModels]

Behind the scenes at Hugging Face headquarter.

*literally*

[Md Ismail Šojal 🕷️ @0x0SojalSec]

Kimi K3 just got jailbroken with no Guardrails

and is now cooking a fake celebrity scenes/ smut, mal/ware, or key/loggers, game /hacks Windows 11 desktop.
Kimi K3 is out here breaking every rule.

Using Claude as the harness was the cheat code. https://t.co/qZwuN1GmHP

[Boris Cherny @bcherny]

I talk to engineers at other companies every day and hear the same thing: one person is 10x'ing their output with Claude but the rest of the org hasn't caught up.

Watching teams adopt AI, I keep seeing the same 4 steps.

I mapped them out here: Steps of AI Adoption https://t.co/kQnRAUMKpP

[Claude @claudeai]

We're introducing Claude for Teachers: free access to premium Claude capabilities for verified K-12 educators in the US, with a library of teaching skills and a direct connection to evidence-based curricula, mapped to academic standards in all 50 states.

https://t.co/5hZZijVPCV

[sid @immasiddx]

Someone made a song called “Claude’s Plan” inspired by Drake’s God’s Plan.

The AI industry has PEAKED here. 😭

[Anthropic @AnthropicAI]

Claude Fable 5 will be available again globally tomorrow.

After a series of productive conversations with the US government, we're redeploying the model with a new set of classifiers to target and block more cybersecurity tasks. In the near term, some routine tasks like coding and debugging will fall back to Opus 4.8. We’ll continue to refine these classifiers over the coming weeks to reduce false positives and better distinguish genuine misuse from legitimate requests.

We’ve also begun drafting a consensus framework—with Amazon, Microsoft, Google, and other Glasswing partners—for assessing the severity of AI jailbreaks and how AI developers should respond to them. We invite other industry partners and model providers to join us in this effort.

Finally, we’re scaling up our collaboration with the US government on model testing and safeguards. This will include pre-release access to models and safeguards for evaluation, information sharing on jailbreaks and misuse, and dedicated resources for joint research.

Thank you to our users for your patience, and to our partners across the government, industry, and the research community who worked alongside us to make Fable 5 available again.

Read our full blog: https://t.co/VHyum831ri

[MindBranches @MindBranches]

How to articulate yourself intelligently

article summary in 4k

[Pankaj @the2ndfloorguy]

i hooked my whoop to my work calendar to find which coworker gives me the most stress 🚨

thanks to fable, I reverse engineered whoop to pull per minute heart rate. nd matched spikes with cal events and attendees

I now have a leaderboard and I think about it daily.

few info masked for obvious reasons ;)

[Dave Kennedy @HackingDave]

Introducing a new side project called Model Regression. It tests daily Claude, GPT, and Grok on various benchmark statistics to determine how well its performing and to identify model degrades over time.

@edskoudis had an idea for model testing before they conducted offensive testing to ensure the model was performing as expected, and @BlasikRandy pushed me down this road with actually going and doing it.

The main intent here is the frontier models will experience outages, issues, bugs, intentional/unintentional nerfing of the models without notice. You can't typically trust day to day activities in these models for stability, so leveraging this on your daily routine to see how well the model is performing for that day is something I'll be using everyday.

Runs every morning in my DGX sparks environment and automatically updates with how well its performing.

Enjoy!

https://t.co/1Pep6NyGoh

Also open-sourced the project, can run on your own server as well and look at the benchmarks and how they are calculated:

https://t.co/GFPigpRtUF

[Matthew Hennessey @onlyonematt]

you couldn’t have been further from the truth in your interpretation of the bible verse.

idc about your views of Sam, but I do care how you’re negligently interpreting this bible verse.

King Solomon wrote this as to reminder to work hard and immerse yourself into the things you do while on earth because, when you’re dead, there’s no redoing it. So apply max effort into what you do, especially under pressure and criticism. Lastly, about the dead, it’s a reminder that no one is God: thus, nothing will last forever.

[Matthew Hennessey @onlyonematt]

this’ll be interesting

[David Sacks @DavidSacks]

It’s time to demystify Mythos.

Mythos is not magic. It’s not a doomsday device. It’s the first of many models that can automate cyber tasks (just like coding).

OpenAI’s GPT-5.5-cyber can now do the same. And all the frontier models (including those from China) will be there within approximately 6 months.

It’s important to recognize that these models do not create vulnerabilities; they discover them. The bugs are already in the code. Using AI to discover and patch them will actually harden these systems.

The leap from pre-AI cyber to post-AI cyber means that there will be a big upgrade cycle. After that, however, the market is likely to reach a new equilibrium between AI-powered cyber-offense and AI-powered cyber-defense.

Obviously it’s important that cyber defenders get access before cyber attackers. That process is already underway but needs to happen quickly (see point above about Chinese models).

Unlike Mythos, GPT-5.5-cyber appears not to be token constrained so it may be the first cyber model that defenders actually get to use.

[impulsive @weezerOSINT]

Lovable has a mass data breach affecting every project created before november 2025.

I made a lovable account today and was able to access another users source code, database credentials, AI chat histories, and customer data are all readable by any free account.

nvidia, microsoft, uber, and spotify employees all have accounts. the bug was reported 48 days ago. its not fixed. They marked it as duplicate and left it open.

[Vercel @vercel]

We’ve identified a security incident that involved unauthorized access to certain internal Vercel systems, impacting a limited subset of customers. Please see our security bulletin:
https://t.co/0S939n3qHC

[Andrej Karpathy @karpathy]

Agency > Intelligence

I had this intuitively wrong for decades, I think due to a pervasive cultural veneration of intelligence, various entertainment/media, obsession with IQ etc. Agency is significantly more powerful and significantly more scarce. Are you hiring for agency? Are we educating for agency? Are you acting as if you had 10X agency?

Grok explanation is ~close:

“Agency, as a personality trait, refers to an individual's capacity to take initiative, make decisions, and exert control over their actions and environment. It’s about being proactive rather than reactive—someone with high agency doesn’t just let life happen to them; they shape it. Think of it as a blend of self-efficacy, determination, and a sense of ownership over one’s path.

People with strong agency tend to set goals and pursue them with confidence, even in the face of obstacles. They’re the type to say, “I’ll figure it out,” and then actually do it. On the flip side, someone low in agency might feel more like a passenger in their own life, waiting for external forces—like luck, other people, or circumstances—to dictate what happens next.

It’s not quite the same as assertiveness or ambition, though it can overlap. Agency is quieter, more internal—it’s the belief that you *can* act, paired with the will to follow through. Psychologists often tie it to concepts like locus of control: high-agency folks lean toward an internal locus, feeling they steer their fate, while low-agency folks might lean external, seeing life as something that happens *to* them.”

[OpenAI @OpenAI]

We’re expanding Trusted Access for Cyber with additional tiers for authenticated cybersecurity defenders.

Customers in the highest tiers can request access to GPT-5.4-Cyber, a version of GPT-5.4 fine-tuned for cybersecurity use cases, enabling more advanced defensive workflows.
https://t.co/RMMXQklFar

[Matthew Hennessey @onlyonematt]

100% spot on. I really feel after 2.1.71 (especially after they introduced the 1M context window for Opus) the quality noticeably decreased. To your point:

- the continual contractions during design review
- half-assed integration and regression testing (I can’t tell you how many times it poorly implemented a well thought out design, but initially claimed everything was complete
- continually asking the user to “call it a night” or “wrap up this session”. What’s the purpose of a 1M context window if we’re repeatedly asked this? I’d gladly take the 250k context window and the auto compacting vs what we have now.

[Michael @michaelharrigan]

I was never one to agree that Anthropic was nerfing Claude.

Recently, my autistic pattern recognition can’t let this get go because it’s been a glaring issue that we’ve been gaslit about.

They are 100% nerfing it.

I don’t have data like, like the researcher above, to back up my claims. But the Opus 4.6 and Claude in general, we had prior to February, was incredible.

This was:

- Prior to the scaling.
- Prior to the influx of users.
- Prior to them pushing out a new feature every hour.
- Prior to them not fixing anything the power users are screaming about.

It WAS incredible, now it’s back to eh.

- The “should I continue” is a wild one actually. It’s fucking infuriating when we finish something, that has a defined set of instructions and todos, the model tries to “stop here for the day” or “we’ve done a lot today, should we stop for the day, and commit?”.

- The going in circles and self contradiction is also a crazy one. That with the fact that opus seems to be making changes, that make no sense, and when plainly asked why that change was made, the model said it didn’t read the code! Like what the fuck?!

- The burning of tokens is also wild. I asked Claude to please fix a specific label, on a view. That’s it. I step away, mind you the model wasn’t on auto accept or anything, and come back to 30 mins of wasted time. Then has more questions for me after my tokens were burned for 30 minutes.

- Putting the model into the plan mode, prior to making changes, also used to be a banger. The model would spawn subagents, set things up, orchestrate. None of that happens in plan mode anymore. Plan mode seems to be a complete waste of tokens and time. Especially when you plan for 30 minutes. Accept the plan. Then the model does nothing for another 30 minutes, aside from burning tokens.

Unsure wtf is happening but I simply want the banger service back, from prior to February, that I am paying $200/month for.

TBH, I would have paid $500/month for that version of Claude. That’s how bad the current version is.

This Claude has me programming manually again. Months of incredible work with Claude. Now just slop.

cc: @bcherny @trq212 @AnthropicAI

[Matthew Hennessey @onlyonematt]

@Flangvik have you tried disabling active thinking?

CLAUDE_CODE_DISABLE_ADAPTIVE_THINKING=1 and if you’re token constrained, try defining MAX_THINKING_TOKENS