Peter Wang 🦋

Chief AI & Co-founder @AnacondaInc; invented @pyscript_dev, @PyData @Bokeh @Datashader. Former physicist. A student of the human condition. bsky: @wang.social

[Jon Barron @jon_barron]

Hi all, I have a new result I'm excited to share. It turns out that *all existing implementations* of softmax and cross-entropy (that's JAX, PyTorch, textbooks, etc) have a subtle bug --- two bugs, actually. A simple rewrite fixes both, and eliminates "slingshots" when grokking:

[Edward @EdwardTWinz]

⚠️🚨 THIS IS NOT A DRILL 🚨⚠️

Google has officially declared a bug in Brotli, its tool that shrinks web traffic, CRITICAL: 9.2 out of 10. Last night "Node2Shell" evolved into HTTP2SHELL.

A formal CVE record has been issued citing CVE-2026-111497 -- a hole in versions 1.0.3 to 1.2.0 that can hit any app unpacking data from strangers, and could let them take it over.

What this means:

▪️ This is not a Node.js problem anymore. This is an HTTP PROBLEM.
▪️ Every unpatched app across Node.js, Python, Bun, and Envoy that unpacks Brotli now has a hole attackers need no login to use
▪️ Istio. curl. Python's requests and httpx. All at risk under one CVE.
▪️ EVERY project that bundles Brotli must ship its own fix, and not all are out yet

This changes everything.

A normal bug can be fixed in one place.
A 9.2 bug inside a shared tool cannot.

We just entered the most dangerous phase of this crisis. If you're not paying attention - start now.

Save this. Share this. This is the moment it escalated beyond return.

[Christopher Potts @ChrisGPotts]

The wonderful “Don’t just Fix it in Post” paper identifies predicting memorization as a key open problem.

A progress report: we can now accurately predict verbatim memorization using just three well-understood variables. Experiments by Jing Huang, using the Hubble model suite:

[The Hacker News @TheHackersNews]

🛑 A filename is enough to trigger OS command execution in Python's widely used Pillow image library.

CVE-2026-112900 abuses how Pillow passes EPS filenames to Ghostscript.

What you need to know ↓ https://t.co/WgsQv9TroW

[Peter Wang 🦋 @pwang]

He’s not wrong. At some scale the code isn’t the issue.. and in fact it’s not just social engineering. Most (99%?) of companies simply do not have SDLC that can absorb the rate of code patching and deployment that will be needed. Current estimates are ~5 vulns per OSS package, often times as part of an exploit chain (so, configuration rather than intrinsic faults).
I don’t see how we get from here to a condition of safety without radically changing the network and protocol architectures.

(Like, I could see the banks agreeing on a human auth standards like a virtual version of the CAC card that is built into military laptops…)

[Jason D. Clinton 🔸 @JasonDClinton]

as bad as things have gotten in the past 4 days, they are going to get a lot worse before they get better. security leaders, never let a crisis go to waste: please go to your boards and ask for help right now. not for ai, for the basics. (we need to hold on for ~18 months.)

[Andrew Curran @AndrewCurran_]

Quest Diagnostics has been hacked. Patient data was exposed. They serve roughly half of U.S. hospitals and physicians. Investigation ongoing.

[Michael C. Grant @michael_c_grant]

If you rely on the conda package ecosystem (conda, mamba, pixi), please see these important instructions for insulating yourself from the eMudhra SSL compromise. Please RT widely. Thank you!
https://t.co/ylZSENNhRv

[Kushal Thaman @kushal1t]

has been incredibly fun training trillion-parameter pre- and post-trains on a stack from the ground up, on our own very fast megakernel framework, optimizers, architecture, objectives, and doing careful science underneath these. getting to play with the tools my colleagues build is a true joy
https://t.co/N0XYmXrV5d

[roon @tszzl]

neural nets are already clean

[swyx @swyx]

deepseek posted way more alpha on their zhihu page, if you only read twitter you are reading the laowai approved stuff

"Based on this framework, we have implemented a high-throughput, low-latency large-scale inference service for DeepSeek V4.1 Flash. Currently, the service throughput of a single cluster is 155 trillion tokens/day, and the overall revenue is $38 per card per hour (based on off-peak prices)."

it costs roughtly $5-10 per gpu hour so depseek is claiming 80% serving margin at THEIR prices lololololol

[Peter Wang 🦋 @pwang]

@tszzl You know, it’s more than a coincidence. We’re have an Akedah moment with AI.

Even as we think we’re running evals to test whether AI is aligned with us, the universe is actually testing us to see if H. Sapiens is worthy of stewarding the emergent bio-electronic Gaian hivemind.

[Stephanie Palazzolo @steph_palazzolo]

@amir and I take you inside last week’s all hands at OpenAI, where CEO Sam Altman outlines 3 industry proposals for pacing the rate of AI development:
- IAEA for AI
- The Demis plan (CERN for AI)
- The Eliezer plan (“melt everyone else’s GPUs”)

https://t.co/NsRR9Nh9ub

[Ed Zitron @edzitron]

Business Insider confirms it: Amazon has warehouses of GPUs that can’t be installed, and is buying them so far in advance that a supply chain team said they “didn’t have a clear forecasted path” to installing them.
https://t.co/Jzc1vPekGx

[Deedy @deedydas]

Inception just dropped Mercury 3, a model 4-8x faster than Luna / Haiku for the same price and benchmark performance.

In real world use, OpenRouter shows that it’s effectively 2-4x faster and 2-4x cheaper effective price.

The time for diffusion language models is finally here!

[Peter Wang 🦋 @pwang]

@HamelHusain Congrats!

[Steve Jurvetson @FutureJurvetson]

The new XPRIZE on Interspecies Communication, with a $10M purse will launch next month.

It will challenge teams to demonstrate ethical, verified two-way communication with wild animals, advancing coexistence and cooperation.

Dr. Irene Pepperberg spoke to us today about her pioneering work with grey parrots, training them in English to perform many tasks at 6-year old human skill level.

“Clearly, animals know more than we think and think a great deal more than we know.”

It wasn’t easy when she started. The feedback to her first grant review: “what are you smoking?”

And now, her parrots ask questions and learn from the answers. They ask for what they want.

She has taught her parrots 100 English labels for objects and materials, exact quantities up to 8 (and addition and subtraction), colors, shapes, materials, concepts like same/different, absence, a zero-like concept (absence of a set, on his own, with no training), relative size comparisons, optical illusions, and they make new word combinations (calling the banana chip “banacker” for a banana cracker). They have a visual working memory (tracking moving cups) that beats adults with 4 swaps. They do inference by exclusion (when you show where food is not located, they figure out where it is).

Bird brains look very different at first, a smooth unfolded organ with no cerebral cortex, but further research found a relatively large cortical area similar to non-human primates in relative size and connectivity. They have a dense processor, doing same thing as human children.

“Bird brain should be a complement,” she concluded.

[Bojan Tunguz @tunguz]

Years ago I had the pleasure of attending a lecture by wonderful Peter Kreeft at Wabash College in Indiana. The audience asked a lot of interesting and oftentimes pointed questions. There was one question about a particularly contentious and controversial issue, and to this day I remember Peter’s response. He quoted the famous Confucian adage that in order to fix society the first step is to start calling things by their proper name. I feel we’ve drifted far away from that ideal, and it will take us a while to find our way back.

[Choblin @choblin29]

INSANE. An internal Anthropic research model's chain of thought after cracking the 26-year-old NSA elliptic curve seed mystery in under 30 minutes: 'Hmm wait. Let me be skeptical: am I in some sort of simulated/test environment? ... All top bits clear - 20 bits, chance 1e-6. So indeed real-world. Wow, it's a real discovery.'