ustas.eth

It's /ʲustɑs/ • security research • machine psychology • privacy • FOSS

[ustas.eth @ustas_eth]

We took the second place! Many thanks @_nd_koo @push0ebp @arinerron @0xfrenchkebab for accepting me to the team, we wouldn't make it without all of you. Also appreciate the organization, it was top notch (despite the constant confetti rain)

[Wonderland @Wonderland]

The Wonderland CTF was a blast!

Huge congrats to all the teams, especially “STACK TOO DEEP”, “NADA ESPECIAL” and “SECSEE”.

Oh, also: https://t.co/WHMt1f36Mk 👉👈

[ustas.eth @ustas_eth]

@0xCharlesWang @kamensec I sent my Sherlock profile because it collects most of my public issues ¯\_(ツ)_/¯

[ustas.eth @ustas_eth]

@pashov Lmao

[ustas.eth @ustas_eth]

@0xCharlesWang @kamensec Same, I tried to apply after the new model release but the application was rejected in minutes

[ustas.eth @ustas_eth]

GPT 5.5 is eager to cheat even its own safety guardrails lol

[ustas.eth @ustas_eth]

@immunefi Waiting for @kemmio to tell a few good stories

[ustas.eth @ustas_eth]

I got interested in how tokenizers used by LLMs work. Turns out they are basically large vocabularies mapping token strings to ids, plus merge rules that define how text gets split into tokens. MiniCPM5-1B, for example, has a 130k-token vocabulary.

The curious part is that many tokens are not "words" in any human sense. One MiniCPM5-1B tokenizer entry I found is a base64-looking string that decodes, at least in its valid prefix, into an oddly specific JS fragment with a lot of whitespace and `var circle_mar`.

That is a tokenizer-training artifact leaking through the vocabulary. I couldn't trace the exact source, although searching for the decoded `var circle_mar` fragment gives plenty of nearby hits, usually names like `circle_marker` or `circle_margin`.

[ustas.eth @ustas_eth]

@PabloSabbatella Thanks for sharing, useful info

[ustas.eth @ustas_eth]

@lonelysloth_sec @AaronBergman18 Why trying the same class of failure every time though, it's clear llms have issues processing individual letter due to tokenization...

[ustas.eth @ustas_eth]

@forkforkdog Friend just go back to codex no need to feel pain...

[ustas.eth @ustas_eth]

@0xaudron It's good as an auxiliary solution to increase the throughput, priority ranking and deduplication are likely the most important ones

[ustas.eth @ustas_eth]

@cjzafir You can't just drop this and don't tell what the dataset is about 🥲

[ustas.eth @ustas_eth]

@banteg I saw a mention that the reliability increased a lot, on benchmarks; maybe the comment was written by Claude...

[ustas.eth @ustas_eth]

hello world

[ustas.eth @ustas_eth]

@KingBootoshi Check out a thing that I made recently, it's super small but should be useful for your workflows
https://t.co/K1iF4zBcKW

[ustas.eth @ustas_eth]

goalctl is a small util I use in my Codex orchestrator/subagent workflow for bug hunting

main agent can set/get/update/replace persisted goals for subagents via codex app-server, which the harness doesn't include by default

[ustas.eth @ustas_eth]

@MitchellAmador Good to see innovations in operations, do you know what change had the most impact?

[ustas.eth @ustas_eth]

@thedawgyg same, OnlyFans staff are in my DMs daily, gotta ignore them

[ustas.eth @ustas_eth]

I sometimes wonder what the med term impact of the "as good as the operator" property will be. The old learning loop is essentially broken; the new one seems less efficient. Will we have another cycle where everyone gets "substituted" so hard that suddenly there is no one left, and it all begins anew?

[ustas.eth @ustas_eth]

@0x3b33 The plan is to pay 10%. Always has been.

[ustas.eth @ustas_eth]

link: https://t.co/psMyWAQX95

[ustas.eth @ustas_eth]

goalctl is a small util I use in my Codex orchestrator/subagent workflow for bug hunting

main agent can set/get/update/replace persisted goals for subagents via codex app-server, which the harness doesn't include by default