NEW: malware developers added nuclear & biological weapons text to to their spyware.
Goal? To trigger LLM safety refusals... so that their spyware wouldn't be analyzed by an AI security scanner.
Cleanest practical example I can think of for why over-indexing on first order safety alignment is risky.
When closed (and open) models ship with aggressive refusals, they will be sprinkled with second-order blindspots that attackers will discover...and exploit.
We are only in the earliest days of attackers leveraging these features, and it wouldn't surprise me if users systems that need to handle complex cybersecurity issues demand that models be less safety-blunted.
In the weeds: @SocketSecurity's post also shows why intention matters in how you design a malware analysis pipeline to avoid prompt manipulation.
H/T to colleagues that shared this with me https://t.co/f3Aj9TYxU4
This is a super exciting release - Claude Fable 5 is the same underlying model as Mythos but with added safeguards. The benchmarks are great and it's SOTA on everything by a margin but I'll add that *qualitatively* also, this is a major-version-bump-deserving step change forward (imo of the same order as Claude 4.5 was in November), peaking especially for long problem-solving sessions on very difficult problems. You can give it a lot more ambitious tasks than what you're used to, the model "gets it" and it will just go, and it's never felt this tempting to stop looking at the code at all (but don't do this in prod!). The model still has quirks that people will run into and the safeguards are configured to be a little too trigger happy for launch, which can hopefully be tuned over time.
I feel a lot of things changing as working software increasingly comes out on a tap. The Jevon's paradox kicks in and I feel my own demand for software growing substantially. You can ask for anything - explainers, visualizers, dashboards, bespoke single-use apps (e.g. a full wandb that is hyper-specific just for your project), you can 10X your test suite, auto-optimize code, run giant research projects with custom HTML for the results, anything! "Free your mind" (Matrix ref). Really looking forward to all the things people build!
In medieval times, within the arms race of ever more demonic torture devices, some sadistic genius came up with the idea of the Little Ease.
This was a prison cell built so small in every dimension that a grown man could not stand upright in it nor lie down at full length nor properly sit.
The pain is relentless and without relief and inflicted by one's own body. Prisoners were known to go insane within a few days. A stay at the Little Ease was considered even more cruel than the rack, the thumbscrew, and the other ghoulish machinery of the Tower of London.
A breeding pig will spend her whole life in a version of that box.
These are social, roaming creatures (more intelligent than dogs) who will never leave this corset of steel.
They have been selectively bred to be bigger than their frames can support. Yet we put them in cells so confined that they cannot comfortably sit, and their attempts to do so (for example, by sneaking their limbs into adjacent stalls) reliably lead to fractures and sprains.
They cannot sweat, yet have nothing to roll around in to cool themselves off. Except their own manure, which (contrary to the common misconception) they are so averse to (thanks to their strong sense of smell) that new sows will often suffer from constipation to avoid soiling the space from which they eat and sleep.
Here is how the writer Matthew Scully described what saw at one of Smithfield’s “gestation barn”:
> “Sores, tumors, ulcers, pus pockets, lesions, cysts, bruises, torn ears, swollen legs everywhere. Roaring, groaning, tail biting, fighting, and other “Vices,” as they’re called in the industry. Frenzied chewing on bars and chains, stereotypical “vacuum” chewing on nothing at all, stereotypical rooting and nest building with imaginary straw. And “social defeat,” lots of it, in every third or fourth stall some completely broken being you know is alive only because she blinks and stares up at you … creatures beyond the power of pity to help or indifference to make more miserable, dead to the world except as heaps of flesh into which the [insemination] rod may be stuck once more and more flesh reproduced.”
—
The Save Our Bacon Act is trying to unroll the few state protections we have against this barbaric cruelty - for example California’s Prop 12 - which banned the sale of pork from pigs kept in gestation crates.
It’s incredibly important we don’t end up with this sort of federal preemption.
SOB will not only kill the most important animal welfare related laws in the US of the past decade, but more importantly, it will also restrict ALL future legislative progress (aka how the animal welfare movement has gotten its biggest wins).
The Senate is currently deciding whether to add the SOB Act to the Farm Bill.
With relatively little money now, we can discourage the most pivotal senators in the Ag committee from backing this amendment.
Defeating this bill is even more important given the amount of philanthropic funding I expect to come online in the next year or two.
It will plausibly be over 10x more expensive to repeal SOB than to prevent it from passing in the first place.
All that money that could be spent transforming our society's relationship to mass animal suffering will instead have to be spent just getting us back to where we are right now.
That's why money spent now fighting this bill (and I mean right NOW) is so effective.
If you’re in a position to donate six figures, please DM me.
Know-nothing tech workers think they're going to marginally increase the avalanche of wealth that rains down on them by booting out their immigrant colleagues. They're about to discover that attracting the best and brightest is the defining comparative advantage of US tech.
Bucco’s guide to making $400k+:
So, your dumb ass has been lucky enough to stumble into making a 1% salary. Congratulations, you’re at the doorstop of generational wealth (or early retirement). Here’s how to not fuck it up
1. Assume this isn’t permanent: The first thing you need to recognize is most people don’t keep their 1% salaries. There’s a lot of luck, and variable comp, that usually goes into that kind of paycheck. So have some humility and live like it ain’t permanent, because it usually ain’t. Which brings me to point #2
2. Live below your means: Most people who start making fat paychecks start racking up fat credit card bills. But if you follow my first rule you won’t do that. At least for the first 3 years you will live like you aren’t making a lot of money. You will save. A lot. This is a gift to future you
3. Take care of yourself: If you are making this much you are usually working very hard. So take care of yourself. Invest in your brain and your body and your health. It is a marathon, not a sprint, as they say. And one of the reasons people don’t maintain their high paychecks is because they burn out
4. Pay it forward: Fate has smiled on you. You are not only obligated to pay it forward, but it is the right thing to do. One day you may experience something bad, unlucky, and catastrophic. People will remember that you did not neglect others while it was your moment in the sun and they will come to your support. Be kind, especially when you don’t need to
5. Maintain perspective: You are not better than anyone because you make a lot of money. There are many ways to be rich. Be sure that you stay humble, and continue to invest in your friends, families, relationships and health. Or you might one day find yourself with a full bank account and an empty life
Follow these rules and I assure you that the odds of living a prosperous life will tip heavily in your favor
The new White House policy requiring green card applicants to apply from outside the US is a capricious attack on legal immigration. It will hurt families, leave us with fewer doctors, teachers and scientists, and hurt American competitiveness in AI.
My current gut feel is that juniors will start at small companies as the first or second developer hire, for developing in-house software.
They’ll build low stakes apps for those companies, like estimating, automations, websites, task management.
It’ll teach them the strategic layer (since they own the whole stack) in a lower pressure environment. They’ll need to think about all of it, but the projects are small and the user bases tiny.
This is as opposed to being a junior on a larger tech team, where you’re given small tactical slices to work on under close supervision. That route is drying up, I’m sad to say.
These juniors will be affordable to a small business and AI will give them instant productivity that the business can leverage for operational efficiencies.
My son @cedricholmgren is currently doing exactly this route; working at a local fence and deck company as their in-house programmer. He owns probably a dozen apps in 5 different languages and frameworks. It’s amazing. He’s been doing it for a couple years and at some point someone’s going to discover that he’s a lot smarter and more disciplined than his old man and snap him up.
@buccocapital Was talking with some colleagues recently about how the loneliness and isolation that comes with moving up the corporate ladder will now be inflicted on everyone, and much worse because you can't have any true connection with the agents you "manage".
Been thinking about what an "agent-native cloud" actually needs to look like. Mentioned this, and @Vercel's CEO replied that it'll be them. Cool! Here's the spec they (or @Cloudflare, or some startup not yet invented) actually have to hit.
It won't be @awscloud.
Thread...
Read @EggerDC on the utter foulness of the Trump IRS settlement fund. Truly the type of rank corruption we have not really witnessed before. Plundering at its finest
We’ve agreed to a partnership with @SpaceX that will substantially increase our compute capacity.
This, along with our other recent compute deals, means that we’ve been able to increase our usage limits for Claude Code and the Claude API.
Jeff Bezos reveals the moment an early Amazon executive told him he had enough ideas to destroy Amazon:
"Early in Amazon's history, Jeff Wilke came to me one day and said, Jeff, you have enough ideas to destroy Amazon. You have enough ideas per minute, per day, per week to destroy Amazon."
"I was like, what do you mean?"
"He said, you have to release the work at the right rate that the organization can accept it."
"Every time I released an idea, I was creating a backlog, a queue, work in process. It was just stacking up, it was adding no value. In fact, it was creating distraction."
"So I started prioritizing the ideas better, keeping lists of them, keeping them to myself until the organization was ready for the ideas."
We just announced a large raft of improvements at @Stripe Sessions. My meta reflections:
• It feels that the entire economy is replatforming right now.
• Many charts at Stripe are inflecting in quite dramatic ways. What GitHub recently reported for commits we are seeing in economic activity (such as new company formations).
• It is increasingly clear that agents will be responsible for most transactions in the not overly distant future.
• Stripe was always developer-centric, but AI is making developer-centricity strategic in a new way: agents are even hungrier for good DX than developers themselves are.
• Things that we’re launching are increasingly network products at heart. (Instant transfers between Stripe businesses, new kinds of fraud prevention with Stripe Radar, stablecoin payouts to anyone with Link.) "How can we turn Stripe's economies of scale into user benefits?" is increasingly the relevant question.
• Between Privy, Bridge, Tempo, and Stripe’s core capabilities, we’re now doing a lot in stablecoins/crypto, and companies like DoorDash, Ramp, Meta, and Klarna are using our crypto stack to deploy meaningful new functionality in production. “But where’s the production use?” is rapidly becoming stale when applied to crypto.
• After more than a decade of building, we seem to have hit some kind of critical mass of core platform capabilities such that building new things now feels easier and faster than before. (AI also helps.) We announced Stripe Treasury last year (originally called Financial Accounts); since then, we’ve added multi-currency support, global payouts, card issuance and rewards, and a bunch of other sophisticated functionality. By the end of this year, Treasury will support 15 more currencies and be available to businesses in 160 countries.
On the launches themselves, a small selection that I thought were cool, though this is really just a subset:
• The @Link AI wallet. Point your agent to https://t.co/vYdvNtJgpE and ask it to make purchases on your behalf with secure single-use tokens. (To test it, I asked Claude Code to buy a small gift for me yesterday. It purchased HTTPZine on Gumroad.)
• New payment methods for Link, including Pix (largest payment method in Brazil) and UPI (largest payment method in India). We’re also adding stablecoin support to Link (which I think will be huge if we execute well).
• We’re adding a lot of new Machine Payments Protocol functionality, including micropayment and recurring payment support.
• We announced Checkout studio: a sophisticated dashboard for managing your checkout flow, including things like transaction replays and A/B tests. Today this tends to require a lot of fussy edits to production code.
• Adaptive Pricing (which automatically localizes the price and currency that customers see) now supports subscriptions. We’ve seen pretty huge (4–5%) conversion rate improvements after enabling it — customers really like paying in their home currency.
• New Stripe Terminal reader (the T600) with a customer-facing screen that can run native apps, plus support for 15 new international markets for Stripe Terminal.
• General availability for Stripe Managed Payments, our merchant of record solution. (Natively handles tax, disputes, fraud.) Maybe sounds a bit arcane, but it’s one of those iykyk products. It saves a lot of schlep.
• Fraud is a *much* bigger priority for customers than it was 2 years ago (AI makes fraud easier + unlike software, tokens can be resold), so we’ve been extending Stripe Radar to support things beyond payments fraud: free trial abuse, multi-account abuse, pay-as-you-go abuse. Early results are extremely positive. We also announced Stripe Signals — new scoring APIs for customers, businesses, and other objects, not just payments on and off Stripe.
• Usage-based billing is also becoming the de facto business model of the AI era, and we launched a bunch of new pricing models in @getMetronome and features like low-balance alerts, automatic credit top-ups, and multidimensional pricing structures.
• We showed streaming payments built on @Tempo and Metronome — track usage and get paid the instant value is delivered. Hard to predict, but I think this could be big. (Why wouldn’t you want to get paid as costs are incurred?)
• We added automatic US tax filing in Stripe Tax.
• We announced Stripe Database -- a hosted PostgreSQL database with all of your Stripe data, updated in real time. Read-only to start but we’ll make it read-write.
• Stripe Workflows are now GA.
• We showed Stripe Console, a full agentic execution environment built directly into the Stripe Dashboard. It’ll happily write code and use tools to answer your questions.
• We previewed custom objects: model your business data directly in Stripe, with custom objects, typed fields, and relationships.
• As mentioned above, Stripe Treasury accounts will support storage in 15 currencies by the end of the year. And instant/free(!) transfers between US Stripe businesses.
• You can use a Stripe card with your Treasury balance and get 2% cash back on purchases.
• We’re massively expanding our Global Payouts coverage -- soon 100 countries with fiat rails and 160 with stablecoins.
• Atlas companies can now raise money directly within Stripe.
• We launched the platform growth studio, which uses Stripe’s network data to generate specific recommendations for optimization/growth.
• We announced the Stripe Managed Risk API — platforms can outsource risk handling to Stripe while maintaining full UI/UX control.
• Connected accounts now benefit from networked onboarding, which hugely increases conversion rates.
• We’re launching Treasury for Platforms. Connected accounts can get spend cards with just a few lines of code. (Plus cash rewards, cash acceptance, check acceptance, real-time payments…)
• We announced Issuing for agents: easily create cards for agents.
But that’s really just a subset of a subset. (See https://t.co/Ej0S8aRVi0 for more.) The Stripe team is cooking! And if you’re interested in building the economic infrastructure for this new world, we’re hiring.