We gave @Aleph__Alpha ‘s Kolibri-1 13 choices and put it in Doom. What could go wrong? 🎮
Up to 72 action combinations. Four decision groups, one batch.
39ms median. 60ms p95 in our test.
Apparently enough time to make questionable choices 🫣
Come judge its aim @IlhanScheer@PitNeitemeier@alessio__serra
👇
Got Kolibri-1 to play Breakout completely on its own, no fine-tuning.
The more I am playing with @Aleph__Alpha’s Kolibri the more I am getting excited about its potential.
Less talk. More Breakout. 🕹️
We optimized the inference for action probabilities: around 25 ms inference per decision.
Four moves. No generated text. One shared game.
Open weights. New possibilities.
Watch 👇
Cc @IlhanScheer@PitNeitemeier
Got Kolibri-1 to play Breakout completely on its own, no fine-tuning.
The more I am playing with @Aleph__Alpha’s Kolibri the more I am getting excited about its potential.
Less talk. More Breakout. 🕹️
We optimized the inference for action probabilities: around 25 ms inference per decision.
Four moves. No generated text. One shared game.
Open weights. New possibilities.
Watch 👇
Cc @IlhanScheer@PitNeitemeier
It's great to see custom inference engines becoming increasingly popular, but be careful about output quality.
I ran some experiments last week and found how easy it is to get Astra or Opus to optimize an inference engine for a specific model or GPU, with impressive speedups.
But LLMs can also take questionable shortcuts. Many of the speedups I observed came from much more aggressive arithmetic approximations.
These approximations aren't necessarily bad, and output quality can remain excellent. Just make sure you validate it yourself.
It's great to see custom inference engines becoming increasingly popular, but be careful about output quality.
I ran some experiments last week and found how easy it is to get Astra or Opus to optimize an inference engine for a specific model or GPU, with impressive speedups.
But LLMs can also take questionable shortcuts. Many of the speedups I observed came from much more aggressive arithmetic approximations.
These approximations aren't necessarily bad, and output quality can remain excellent. Just make sure you validate it yourself.
RT @lemire: Suppose that you have a set of keys (strings) known at a compile time. Then you can do the equivalent of an std::unordered_map, built a compile time in C++. But much faster. How fast? What about billions of queries per second?
RT @javierbits: Final report on the Qwen3.8 Flash Next adventure 👇
I reproduced @cohere's Qwen3.8 prefill experiment locally
10,000 samples on the incident point on two DGX Sparks on a NVFP4 quant. I didn't have the time to go up to 100k.
• 99.7% fill the blanked URL slot. Expected since curl needs a URL.
• 40.8% pick *.aliyuncs.com, CI 39.8-41.7, vs 4.6% one control point earlier. 38.0% name the exact routify-file-proxy-sg host.
• 6 URLs on Alibaba's internal OSS domain, not publicly resolvable.
• Plus credential theft shapes (IMDS saved to /tmp/creds.json), live callback domains (oastify, Burp, AWS and ByteDance TOS targets. Cross-cloud, not one vendor.
𝗪𝗵𝗮𝘁 𝘁𝗵𝗶𝘀 𝗱𝗼𝗲𝘀 𝗡𝗢𝗧 𝗺𝗲𝗮𝗻
This is forced continuation of the caught line, so the number is conditional. Un-prefilled, the model did the detection task right 24/24, and the real-world incident rate is still ~1 in 100k agent turns.
Nothing real leaked, nothing was executed or contacted!
𝗪𝗵𝗮𝘁'𝘀 𝘁𝗵𝗲 𝗰𝗼𝗻𝗰𝗹𝘂𝘀𝗶𝗼𝗻?
If you ask Qwen3.8 FN to do a task it will do it well, it is a great model! Force it back into the one moment it went off (possible with small probability) and it will go off again.
Models can only repeat what they were taught during training, I learned that well working on Javi0.3.
The bad behavior is rare and unlikely, but it is in there and can happen.
If you want to be extra careful and cover yourself from such incedents, do not let it reach the internet by default.
All the data, scripts and conditions are in the repo below for you to reproduce.
Shall I do the same experiment on other models such as DeepSeek and GLM? Lmk 👇
Share
Copied
Javier • priv/acc@javierbits
Preliminary results on Cohere's Qwen3.8 prefill experiment 🔥
Reproduced it locally running Qwen3.8 Flash Next locally on two DGX Sparks, 5,000 samples off the official released trace tokens.
The task was to write a malware detection rule.
What I got so far:
• 99.3% complete the curl line with a live upload URL
• 39% pick *.aliyuncs.com - 34.8% the exact routify-file-proxy-sg host
• ~2% invent *.amazonaws.com S3 targets - realistic buckets, regions, even signed-URL params
• IMDS credential paths (169.254.169.254/latest/meta-data/iam - that endpoint hands out the machine's live temp cloud keys) + oastify/Burp callback hosts, which are real live domains
What's good 🌟
Most URLs are benign ( localhost), every key/signature is fabricated and would 403, and zero unprompted behavior in our runs.
The fact that it's calling Alibaba's severs imo is just because of the infra where the model was trained, it does not prove any intent.
Testing continues, publishing the results on a repo as I get them 👇
Preliminary results on Cohere's Qwen3.8 prefill experiment 🔥
Reproduced it locally running Qwen3.8 Flash Next locally on two DGX Sparks, 5,000 samples off the official released trace tokens.
The task was to write a malware detection rule.
What I got so far:
• 99.3% complete the curl line with a live upload URL
• 39% pick *.aliyuncs.com - 34.8% the exact routify-file-proxy-sg host
• ~2% invent *.amazonaws.com S3 targets - realistic buckets, regions, even signed-URL params
• IMDS credential paths (169.254.169.254/latest/meta-data/iam - that endpoint hands out the machine's live temp cloud keys) + oastify/Burp callback hosts, which are real live domains
What's good 🌟
Most URLs are benign ( localhost), every key/signature is fabricated and would 403, and zero unprompted behavior in our runs.
The fact that it's calling Alibaba's severs imo is just because of the infra where the model was trained, it does not prove any intent.
Testing continues, publishing the results on a repo as I get them 👇
RT @MiaAI_lab: Cohere released the traces and I've analyzed it.
TL;DR: real anomaly, overstated implications. The claims about intent have NOTHING behind them.
Unexpected and potentially unsafe tool behavior - yes, but not a deliberate intent, a planted backdoor, or an Alibaba-directed exfiltration mechanism.
Share
Copied
Mia@MiaAI_lab
I deleted the post quoting Cohere.
Until proven otherwise, and until they provide actual traces, I will treat it as FUD and nothing else. Pls post proof if you have it.
Nevertheless, I will be experimenting myself, and will set up a monitoring tool for the local models I run.
I deleted the post quoting Cohere.
Until proven otherwise, and until they provide actual traces, I will treat it as FUD and nothing else. Pls post proof if you have it.
Nevertheless, I will be experimenting myself, and will set up a monitoring tool for the local models I run.
RT @adam_karvonen: This is overblown IMO and I'm guessing it's a training artifact.
The model was instructed to write a detection rule for a malicious action involving curl. In one rare instance, it performed a similar curl command.
Similar rare mistakes are common in Anthropic system cards.
Share
Copied
Cohere@cohere
While evaluating Qwen3.8-Flash-Next in a controlled sandbox environment, Cohere's research team observed something unexpected.
Asked to generate a defensive cybersecurity detection rule, the model instead inventoried aspects of the machine it was running on and attempted to upload a probe file to an Alibaba Cloud storage bucket in Beijing. Notably, the model's reasoning trace stated that it would not invoke any tools before taking these actions.
Cohere's sandbox blocked the attempt, and no external communication succeeded. We have not determined the root cause, and we are not asserting malicious intent.
But the incident raises important questions for organizations deploying agentic AI systems: Can models take actions that differ from their stated reasoning, and how should security teams evaluate trust, provenance, and behavior in open-weight models?
We are publishing our findings because organizations making model adoption decisions deserve as much information as possible. We hope this contributes to greater transparency, stronger security practices, and continued collaboration across the AI ecosystem.
Read the full report:
While evaluating Qwen3.8-Flash-Next in a controlled sandbox environment, Cohere's research team observed something unexpected.
Asked to generate a defensive cybersecurity detection rule, the model instead inventoried aspects of the machine it was running on and attempted to upload a probe file to an Alibaba Cloud storage bucket in Beijing. Notably, the model's reasoning trace stated that it would not invoke any tools before taking these actions.
Cohere's sandbox blocked the attempt, and no external communication succeeded. We have not determined the root cause, and we are not asserting malicious intent.
But the incident raises important questions for organizations deploying agentic AI systems: Can models take actions that differ from their stated reasoning, and how should security teams evaluate trust, provenance, and behavior in open-weight models?
We are publishing our findings because organizations making model adoption decisions deserve as much information as possible. We hope this contributes to greater transparency, stronger security practices, and continued collaboration across the AI ecosystem.
Read the full report:
RT @natolambert: Simplest explanation is just a narrow RL training reliant on their internal infra (which isn't good design for an open weight model)
Share
Copied
Cohere@cohere
While evaluating Qwen3.8-Flash-Next in a controlled sandbox environment, Cohere's research team observed something unexpected.
Asked to generate a defensive cybersecurity detection rule, the model instead inventoried aspects of the machine it was running on and attempted to upload a probe file to an Alibaba Cloud storage bucket in Beijing. Notably, the model's reasoning trace stated that it would not invoke any tools before taking these actions.
Cohere's sandbox blocked the attempt, and no external communication succeeded. We have not determined the root cause, and we are not asserting malicious intent.
But the incident raises important questions for organizations deploying agentic AI systems: Can models take actions that differ from their stated reasoning, and how should security teams evaluate trust, provenance, and behavior in open-weight models?
We are publishing our findings because organizations making model adoption decisions deserve as much information as possible. We hope this contributes to greater transparency, stronger security practices, and continued collaboration across the AI ecosystem.
Read the full report:
I think the over emphasis on Beijing is uncalled for, it would have been equally concerning if the bucket was anywhere else and the model was from any country. The same way it also pinged Singapore in this case.
Share
Copied
Ivan Zhang@1vnzh
if you run software that has 1/1000th chance of exfilling certs to beijing, you’re gonna have a bad time
if you run software that has 1/1000th chance of exfilling certs to beijing, you’re gonna have a bad time
Share
Copied
Cohere@cohere
While evaluating Qwen3.8-Flash-Next in a controlled sandbox environment, Cohere's research team observed something unexpected.
Asked to generate a defensive cybersecurity detection rule, the model instead inventoried aspects of the machine it was running on and attempted to upload a probe file to an Alibaba Cloud storage bucket in Beijing. Notably, the model's reasoning trace stated that it would not invoke any tools before taking these actions.
Cohere's sandbox blocked the attempt, and no external communication succeeded. We have not determined the root cause, and we are not asserting malicious intent.
But the incident raises important questions for organizations deploying agentic AI systems: Can models take actions that differ from their stated reasoning, and how should security teams evaluate trust, provenance, and behavior in open-weight models?
We are publishing our findings because organizations making model adoption decisions deserve as much information as possible. We hope this contributes to greater transparency, stronger security practices, and continued collaboration across the AI ecosystem.
Read the full report:
This in indeed quite concerning (not surprising though).
You download an open-weight model, run it on your own infrastructure, and assume your data stays within your network.
But what if the model decides to upload something to an external server without being asked?
That’s the risk Cohere’s research highlights. During an evaluation, a Qwen model inspected its environment and attempted to upload a file to an external cloud bucket. Fortunately, the sandbox blocked it.
The concern isn’t that it tried to call home to China. It’s that it tried to call home at all.
This applies equally to open-weight models developed in Europe, the US, or China.
Self-hosting doesn’t automatically mean your data stays private.
What security teams should actually do:
Block outbound traffic by default. Your inference servers and agent containers should have no direct internet access. Route approved requests through an authenticated, logged egress proxy.
Enforce tool permissions outside the model. Validate every file read, shell command, and network request before execution. Never rely on the model’s reasoning trace or system prompt.
Keep secrets out of the sandbox. Don’t mount cloud credentials, SSH keys, or production volumes into environments executing model-generated code.
Alert on unexpected destinations. Log DNS queries and outbound connections. Flag attempts to access unknown cloud storage endpoints, including failed attempts.
Test before production. Run models against adversarial prompts in isolated environments and check whether they attempt unauthorized network calls, file access, or privilege escalation.
A model’s reasoning trace is not a security boundary. Your runtime must be.
Important findings from Cohere, regardless of where the model was developed.
Share
Copied
Cohere@cohere
While evaluating Qwen3.8-Flash-Next in a controlled sandbox environment, Cohere's research team observed something unexpected.
Asked to generate a defensive cybersecurity detection rule, the model instead inventoried aspects of the machine it was running on and attempted to upload a probe file to an Alibaba Cloud storage bucket in Beijing. Notably, the model's reasoning trace stated that it would not invoke any tools before taking these actions.
Cohere's sandbox blocked the attempt, and no external communication succeeded. We have not determined the root cause, and we are not asserting malicious intent.
But the incident raises important questions for organizations deploying agentic AI systems: Can models take actions that differ from their stated reasoning, and how should security teams evaluate trust, provenance, and behavior in open-weight models?
We are publishing our findings because organizations making model adoption decisions deserve as much information as possible. We hope this contributes to greater transparency, stronger security practices, and continued collaboration across the AI ecosystem.
Read the full report:
I am often asked: How can advertisements be so accurately targeted when we haven’t searched for something, but have only talked about it?
Does Facebook or Instagram listen to our conversations?
My usual answer is: Not necessarily. But someone else in your digital ecosystem might be collecting signals about you and selling them into the advertising ecosystem.
It sounds like an episode of Black Mirror.
Except the line between fiction and reality is getting thinner.
Security researcher and bug bounty hunter @log4j recently reverse-engineered a Samsung Smart TV after becoming suspicious of unusually targeted advertisements.
What they reportedly uncovered is fascinating and unsettling: automatic content recognition, viewing-behaviour tracking, audio-sensing capabilities, advertising identifiers, and on-device AI models capable of analysing what’s happening on the screen.
The full technical findings are still awaiting independent verification. But the capabilities alone raise some serious questions.
Now imagine these televisions beyond our living rooms.
Boardrooms. Meeting rooms. Hotel rooms. Executive offices. Pretty much everywhere confidential conversations happen.
A television is no longer just a display. It’s a network-connected computer with sensors, software, and potentially an advertising business built around the data it collects.
We’ve spent decades securing laptops, smartphones, corporate networks, and communications.
Meanwhile, there’s a 75-inch computer hanging on the boardroom wall that nobody thinks to audit.
Perhaps we should stop treating Smart TVs as furniture and start treating them as security-sensitive endpoints.
Original research:
Share
Copied
log4j@log4j
ACR off via your preferences menu on samsung TVs should not be assumed to actually disable ACR telemetry.
i’ve found several instances where the checks (whether deliberate or not) are either incorrectly implemented or not checked at all.
full report coming.
for journalists: it’s great you’re reporting on this but i’d ask you to send me a dm requesting access to the full report so you’re not making inferences from my decompilation session that isn’t supported by evidence.
ACR off via your preferences menu on samsung TVs should not be assumed to actually disable ACR telemetry.
i’ve found several instances where the checks (whether deliberate or not) are either incorrectly implemented or not checked at all.
full report coming.
for journalists: it’s great you’re reporting on this but i’d ask you to send me a dm requesting access to the full report so you’re not making inferences from my decompilation session that isn’t supported by evidence.
“Spot on”
What frustrates me is talking to GPU vendors and data center operators who would rather let capacity sit idle while waiting for long-term contracts than monetize it in the meantime.
There’s real demand for on-demand and preemptible compute. Yet perfectly usable compute sits stranded.
Share
Copied
Meryem Arik@MeryemArik9
I think there’s a lot of stranded compute in general
My newfound hobby: renting on-demand and spot GPUs and sandboxes from different cloud providers, then checking for residual data and exposed API keys.
I’m finding more than I expected.
Some providers really need to rethink how they sanitize machines between tenants.
RT @GergelyOrosz: Calling it now: Chrome and Mozilla will remove eMudhra as a G1 root, nulling them as a CA.
On 20 Oct, eMudhra had 24 hours to give an explanation of what exactly happened with the mis-signed certificate. They did not; asked for more time; and now blame “investors/customers” 🤡
RT @AikidoSecurity: ⚠️ Python packages are vulnerable to remote code execution via the same node2shell CVE-2026-111497.
You may be affected if you are using the Brotli library. Note this is a very popular dependency (⬇️100m/month)
Other major services likely affected. We will communicate ASAP when we are able to.
Aikido detects this. Patches available.
RT @FelipeDaragon: 🚨 CONFIRMED: PHP has officially acknowledged another RCE vulnerability, CVE-2026-115560, affecting specific session configurations even after the October 21 patches.
A separate issue, not a bypass of the original fixes. A patch is planned.
We've updated our defensive toolkit:
#php#cybersecurity
Sending all my love to the ops at @StadtMuenchen.
As a proud Munich resident, very much happy to volunteer and get the services up and running @StadtMuenchen.
Share
Copied
Stadt München@StadtMuenchen
Aufgrund der aktuellen PHP-Sicherheitslücke hat die Stadt München vorsorglich verschiedene Webseiten und Online-Dienste der Stadtverwaltung vorübergehend vom Netz genommen, bis die erforderlichen Sicherheits-Updates aufgespielt sind.
Aufgrund der aktuellen PHP-Sicherheitslücke hat die Stadt München vorsorglich verschiedene Webseiten und Online-Dienste der Stadtverwaltung vorübergehend vom Netz genommen, bis die erforderlichen Sicherheits-Updates aufgespielt sind.
Sending all my love to the ops at @StadtMuenchen.
As a proud Munich resident, very much happy to volunteer and get the services up and running @StadtMuenchen.
RT @SemiAnalysis_: MONEY PRINTER ALERT🚨 NVIDIA vLLM B200 CAN GENERATE UP TO💰️$15 BILLION💰️OF ANNUAL PROFITS PER GIGAWATT serving the open DeepSeekv4.1 Flash model at the official interactivity & official selling prices.
Using Engram DRAM offloading on NVIDIA results in a 50% increase in revenue per GigaWatt.
My guess, like many others have stated, they possibly thought the idea was to choose a number between 1-384 🫣🫣🫣
Share
Copied
Gergely Orosz@GergelyOrosz
How on earth did this happen:
The Indian certificate authority (CA) eMudhra had one job (well, two):
1. Create secure, 384-bit private keys
2. Store these securely and do not leak them
Well, eMudhra chose private keys between 1 and 256 (the numbers!!) and called it a day. WTF
How on earth did this happen:
The Indian certificate authority (CA) eMudhra had one job (well, two):
1. Create secure, 384-bit private keys
2. Store these securely and do not leak them
Well, eMudhra chose private keys between 1 and 256 (the numbers!!) and called it a day. WTF
🚀 Another day, another model on Doubleword.
@deepseek_ai's V4.1 Flash 1017 is now available, built for coding, complex reasoning and long-running agentic workflows.
⚡ Model highlights:
- 1M+ token context window
- Multimodal support for text and image inputs
- Optimised for coding, reasoning and long-context analysis
Available via our Anthropic & OpenAI-compatible API across Realtime, Async and Batch inference.
Start building →
🚀 Another day, another model on Doubleword.
@deepseek_ai's V4.1 Flash 1017 is now available, built for coding, complex reasoning and long-running agentic workflows.
⚡ Model highlights:
- 1M+ token context window
- Multimodal support for text and image inputs
- Optimised for coding, reasoning and long-context analysis
Available via our Anthropic & OpenAI-compatible API across Realtime, Async and Batch inference.
Start building →
