Cybersecurity Engineer | AI is reshaping finance & security at the same time | The 3 industries eating everything else | Daily insights on what's happening
A $97 tool just embarrassed a $2,000,000,000,000 company.
64 minutes. 63 automated checks. 2 CRITICAL vulnerabilities . We scanned one of the most visited websites on earth.
Remote code execution. Email impersonation. Both sitting wide open.
We reported it first. Now we're talking about it
@T_Zahil Itโs not why you should move question ! Itโs do you really need to question ! From what i noticed the reasoning layer is the most important you have to look at it from an architectural perspective and find the best design model for your specific project orientation
@demishassabis Apache 2.0 + runs on a 16GB card is the real headline here. A local multimodal with zero token cost and nothing leaving your machine actually this is the direction serious agent builders are already moving to !
i run two AI models on my project. one builds, one reviews. and i made one rule that changed everything:
the reviewer is never allowed to trust the builder's report
when the builder finishes a task it writes a summary "done, everything works, tests pass." most people read that and move on
my reviewer model ignores the summary completely. it reads the actual source code line by line. it re-runs the tests itself. it independently verifies every claim before approving anything
because here's what i learned building with AI: the model that writes the code is the worst possible judge of whether that code is correct. it's confident. it's convincing. and it's wrong just often enough to hurt you
trust is not a security model. verification is.
the build report means nothing. only the source code tells the truth
@NielsRogge The move to local is inevitable . Cloud agents hitting rate limits and latency issues while local runs 24/7 with no weekly resets. The benchmark gap is closing fast too
@bridgemindai This is why i stopped relying on cloud limits for anything serious honestly local deployment has zero weekly resets and the only limit is your GPU actually !
I spent the last few months building a security scanner and testing it on some of the biggest platforms on the internet.
One of them had a vulnerability where any website could make requests on behalf of a logged-in user without them knowing just silently in the background on a platform with over a billion active users.
Another one was a privacy-focused organization. Their entire brand is built on anonymity and protecting user data. They were running Google Analytics on their own website. Every visitor tracked by the exact company they were trying to protect people from.
Another had their SSL certificate , the thing that encrypts everything between you and the app expiring in 7 days. On a platform used by 2 billion people. Well most of the time it is auto renew btw ..
Anyway these aren't small startups. These are platforms with hundreds of engineers and security teams.
So what i learned: security at scale isn't about having the best team. It's about having systems that catch what humans miss because we always miss something.
That's literally why i'm building what i'm building.
@godofprompt What about creating a memory md file and you update it before compacting aka losing context he will never fail you can even class it a strict rule yeah it will cost you some tokens but it will save you !
@VictorTaelin Ngl this is the most honest AI productivity take i've seen in a while the dopamine of fast generation vs the grind of trusting what was actually built. Two very different timelines
@bindureddy Solid list actually but sleeping on local open source models for agent workflows . Honestly once you self-host one ! You get zero token cost, full privacy, and a model you can fine-tune on your own data. Hard to beat that for specific use cases