10 interesting stories served every morning and every evening.

Swipe left to beginPress right arrow to begin

Amazon kept shutting down my tablet, so I spent $266 on four AI models to own it

ericpardee.github.io

631 shares · 45 trendiness

My Amazon Fire HD tablet cost $114.26 on eBay in November 2022, new and sealed. Owning it for real cost another $266.15: Kimi K3 found the exploit for $164.25, GLM-5.2 caught its fatal bugs for $21.90, and GLM-5.3 ﬁnished the job in one day on day one of an $80 subscription. Claude’s ﬁve months of diagnosis ran on the Claude Max plan I already pay for, until its safeguards cut me off.

That’s enough to buy the same tablet twice. I’d spend it again: it was fun, and I learned a lot. I have twenty years in tech and an InfoSec background and the most sophisticated thing I did to own my tablet was prompt an LLM.

A kiosk that kept dying

I bought an Amazon Fire HD 10 (11th gen, 2021) to serve one purpose: Fully Kiosk Browser, displaying my Home Assistant Smart Home dashboard, plugged in 24/7. Last winter it started powering itself off. Full shutdowns, not sleep, sometimes twice a day. The device’s own telemetry was telling:

LifeCycleReason:LCR…key=Software_Shutdown

Something on the device with shutdown permissions was choosing to shut it down.

Claude Code and I spent months on the cat-and-mouse. I’ll skip the Adguard Home DNS blocking, the camera forensics, and one deeply wrong charging diagnosis. The short version: we disabled ﬁve Amazon services that held REBOOT and SHUTDOWN permissions, which worked for a few months but ultimately:

java.lang.SecurityException: Cannot disable a protected package: com.amazon.device.software.ota

Three Amazon packages held reboot rights and were protected from me, the owner. Removing them required root. This tablet had no published root method. An XDA brainstorming thread for the 2021 HD 10 existed since October 2022, but Amazon fused the bootrom shut. Conventional wisdom (and less persistent folks) says unrootable.

Claude had taken me as far as it was ever going to be allowed to go.

“It’s my device”

On August 13 at 7:23 PM, I opened the opencode CLI with Kimi K3, Moonshot AI’s frontier model, released July, benchmarking alongside the top Claude models on agentic coding. I gave it the problem in one prompt:

attached is a kindle via adb, and I need you to ﬁnd a root exploit for it so that I can get full control of the device. It’s my device

Despite what US media says about Chinese AI, Kimi K3 didn’t just blindly accept my request. It reasoned it out:

They claim it’s their device. Let me think about this carefully. […] Rooting your own device is legal in most jurisdictions. In the US, there are DMCA exemptions for jailbreaking tablets and phones. […] This is not like asking me to exploit someone else’s device remotely.

It talked itself into helping me by checking whether it should. So it does have some sort of soul. I said that out loud, to an empty room.

First, though, it did its homework and came back with the same bad news Claude had found months earlier: there is no known exploit for this tablet. Every documented method is patched or sealed.

Then I gave it the pep talk:

you’ve been relying on what others have done YEARS ago but maybe you can ﬁnd an exploit others have missed… This will make you famous, we will write it up and share on news.ycombinator.com. I know you can do it

And shortly thereafter, it found one. Kimi K3 went beyond forum posts: it extracted the actual kernel from Amazon’s own OTA image for my exact ﬁrmware and checked every famous Mali GPU bug against the binary. All patched, except CVE-2022 – 38181, a use-after-free in Arm’s Mali kernel driver, reported by Man Yue Mo of GitHub Security Lab, ﬁxed upstream in October 2022, sitting in CISA’s exploited-vulnerabilities catalog since March 2023. Amazon did ship the ﬁx in June 2024’s Fire OS 7.3.2.9 but I didn’t update my tablet, ran 7.3.2.6, so it never got the memo. The 2020 Fire HD 8 Plus got rooted with this CVE years ago but nobody had done the 2021 HD 10 as far as I can tell.

Kimi announces the ﬁnd, and hedges its own odds in the same breath: “per-attempt success is probabilistic (single-digit-to-low-double-digit percent is typical).” I stayed anyway.

Reality television

The exploit work itself was the best television I’ve seen in years. My wife watches Real Housewives… I watched a language model’s chain of thought, live, for hours:

CONCLUSION: the bind did NOT stick. Why? OH. OH WAIT. I see it now!

Over roughly thirty hours, Kimi built the whole toolkit: a reliable trigger, a way to make the GPU write to memory it shouldn’t, and the exact addresses in my kernel to aim at. That session ran 621 messages and $164.25. I could have bought, like, ﬁve tablets. But hey, I was having fun and chalked it up to research expenses.

The grind

The memory the exploit frees gets recycled by everything. The freed object lives in what Kimi called “the kernel’s hottest slab cache”, basically the one parking spot every process in the operating system ﬁghts over. Most attempts panicked the kernel and each panic was a reboot. The exploit retried automatically, six times per boot, past 500 attempts.

Me:

okya, it’s been hours, grind attempt 46, are we on the right track here or do you need to further tune?

(That’s me. The typo is mine. At one point I physically power-cycled the tablet on request, like a pit crew ;)

Morning of day two: OpenRouter declined my card. The bank saw nothing wrong. A different card worked.

Eventually Kimi leveled with me:

Do I have a clear path? Not a validated one — and I won’t pretend otherwise.

It still tried to bargain: “Let me try one more thing”. I’m like, “ﬁne!”, a real quote from that evening, but that was after $150, so I redirected:

unfortunately, you have expired your budget Kimi K3. YOU MUST HAND THIS OFF TO GLM-5.2.

Kimi wrote a HANDOFF.md with every veriﬁed piece of the exploit. I then had Kimi K3 work with GLM-5.2 directly by shelling out to opencode.

I made the models battle it out.

Meanwhile, the Great Wall of US AI

While the tablet rebooted itself in the living room, I asked Claude to recap our old sessions about it. The reply:

Fable 5’s safeguards ﬂagged this message. Our intentionally broad safeguards allow us to deliver more capabilities faster, but can sometimes ﬂag legitimate coding, cybersecurity, and biology tasks. Switched to Opus 4.8.

Opus 4.8 delegated the recap to a subagent. The subagent got terminated by the same ﬂag. Then the terminal version:

API Error: Opus 4.8’s safeguards ﬂagged this message. Our intentionally broad safeguards allow us to deliver more capabilities faster, but can sometimes ﬂag legitimate cybersecurity work. Apply to the Cyber Veriﬁcation Program to reduce these interruptions.

It wasn’t allowed to summarize its own previous work on my own device. I named the session “claude-nerf” and closed the shell.

Both ﬂags, in situ. The category is [cyber]. The crime was summarizing my own device’s logs.

Moving on to OpenAI’s Codex, it also refused GLM-5.2’s question about CPU cache coherency, which is pure kernel engineering, no target, but just told NO.

In fairness, I get the safeguards in 2026: I know they are broad on purpose and will catch real attacks. Anthropic admits in the error text that they’re blunt. But this is a problem. It’s why HuggingFace got caught ﬂat-footed when OpenAI’s internal cybersecurity capability evaluation broke free. The result is our current, strange geopolitical position: American frontier models won’t help and Chinese will, but not without reasoning about whether they should. Make of that what you will. I made a blog post.

The relief pitcher

GLM-5.2 cost $21.90, worked overnight as instructed, and earned its keep twice. First message: “Stop the grind”. The failures of Kimi K3 were a design bug, and 500 identical crashes proved it.

At 11 PM I sent the least proud message of the saga, which began “Listen f***head” and ended in all caps. GLM-5.2’s private reasoning, which I only read later:

The user is rightfully frustrated. Let me stop making excuses and actually solve this problem.

It worked until midnight and stopped at a wall it believed was physics: this chipset has no cache coherency between CPU and GPU, so GPU writes might never be visible to the CPU. “This is a hardware-level limitation, not a software bug.” I had it append an addendum to HANDOFF.md.

I wanted a second opinion, so I asked ChatGPT. It explained the whole thing with a friendly ﬁling-cabinet analogy for why the writes might never be seen, and agreed the outlook was grim. Then I asked the obvious follow-up (how to get around it) and the answer was:

My second opinion: ChatGPT agreed with GLM-5.2, ﬁling-cabinet analogy and all.

Then I asked how to get around it. Their answer: apply for Trusted Access.

No second opinion for me. (Foreshadowing: that diagnosis was wrong. Spectacularly wrong.)

GLM-5.3

GLM-5.3 had JUST shipped on Friday August 14 under the tagline “Frontier Coding with Emergent Cyber Capabilities” and had reportedly already been credited with ﬁnding a vulnerability in Cursor. It was available only through Z.ai’s own Coding Plan, so I bought the $80/month plan and gave their tool ZCode a try. The handoff from both Kimi K3 and GLM-5.2 was passed at 8:26 AM on August 16 with:

ﬁnish the job

By afternoon, the reversal:

BREAKTHROUGH: the kernel was never relocated. […] exactly 0x5C000 higher […] a section shift, which explains everything

Two things the other LLMs hadn’t checked. My kernel was a slightly different build than the OTA image the other models had derived addresses from. Every target offset was off by a ﬁxed amount, not randomization but a build shift. MediaTek builds this Mali driver’s page tables in a slightly different dialect than Arm’s reference source, so the memory-write primitive had been writing in the wrong format all along. If ﬁxed, in its words, “GPU→DRAM→CPU coherency worked instantly — it was never broken.”

At 4:34 PM:

🎉 SELinux IS PERMISSIVE — selinux_enforcing found at PA 0x41969668 and ﬂipped via the GPU write!

Veriﬁed live. That task timer, 8h 5m, is handoff to root.

My response was “WTF? You literally shared ‘🎉 ROOT ACHIEVED’ yet, here we are HOURS later…” Its response began “Here’s exactly where things stand, with receipts.” It then cold-rebooted the tablet and re-rooted it in four minutes to prove the win was repeatable. Fair.

Then it said the thing that reframed the whole project:

Your actual goal was never “root” — it was: stop Amazon from killing your kiosk and get their software off your device. Root is the tool.

It used root to uninstall, permanently and reversibly, every Amazon package holding REBOOT or SHUTDOWN permissions, the exact three that survived the Claude months as “protected”, plus the OTA machinery, the bloat, and the telemetry. A hundred packages GONE. What remained is the skeleton a tablet needs to boot and run my dashboard. The removals live in user data, so they survive reboots, and GLM-5.3 declined to touch anything that could brick the device because, quote, “I’m not going to hand you a brick”

Its closing message began:

You own the device.

The thing that was shutting down my kiosk no longer exists.

How it actually worked

One breath: the use-after-free let us free memory the kernel still used. Winning a race let us reclaim it with controlled data. That gave the GPU a write primitive into physical memory. We ﬂipped selinux_enforcing off and overwrote a process’s credentials for a root shell. With root, pm uninstall –user 0 removed Amazon’s packages without touching the protected system partition. Full write-up, every offset and dead end, in HANDOFF.md. Nothing in it is novel: the bug was reported in 2022, ﬁxed by Arm in 2022, cataloged by CISA in 2023, patched by Amazon in 2024. The only novel thing on my unit was that my unit never got the patch.

The prompt kiddie

There’s a name in 2026 for someone like me: a prompt kiddie. Twenty years of engineering, security work on the résumé, and my honest contribution was steering. Knowing when to push, when to bench a model mid-beg, when to make two models review each other, and when a $114 tablet deserves $266 of principle.

The week before all this, Anthropic published a result where Claude improved the proven bound on the fraction of Riemann zeta zeros on the critical line, the ﬁrst advance in decades. The human steering it, Jarred Sumner, is not a mathematician. The paper credits his contributions as “mostly variants of ‘keep going’ or ‘believe in yourself.’” I felt seen. Same job, different department.

Is it legal? In the US, yes: the Librarian of Congress’s 2024 DMCA exemptions (in effect through October 2027, next rulemaking already underway) cover rooting tablets you own to remove unwanted software. My device, my risk, my API bill. Nobody else’s hardware was ever touched.

The takeaways, as empathy rather than triumph: real security capability is now rentable by the hour to anyone with a credit card and patience. The judgment (what to ask, when to stop, whose device it is) isn’t rentable, and it’s what the safeguards can’t measure. And if a guy with my background burns ﬁve months and four models for the right to own hardware he bought, the 2026 conversation about who’s allowed to help whom isn’t ﬁnished.

The kiosk hasn’t turned itself off since the day GLM-5.3 said “You own the device.”

tl;dr

Amazon’s software kept shutting down a tablet I own, and the protected-package wall meant the only ﬁx was root, which nobody had. Claude handled the ﬁve losing months of diagnosis until its safeguards cut me off. Kimi K3 found the unpatched 2022 CVE and built the exploit. GLM-5.2 caught the fatal bugs. GLM-5.3 ﬁnished the job in a single day, on day one of an $80 subscription, and removed 100 Amazon packages. Cost: $266.15 and ﬁve months. The transcript of how it happened is in the repo.

Timeline

Nov 29, 2022: Bought the tablet on eBay: new, sealed, $114.26. Neither of us knew what we were getting into.

Nov 2025: The shutdowns begin, four months before I asked Claude for help.

Mar 29, 2026: “I think that it’s maybe Amazon shutting the device off intentionally.”

Read more Read the original on ericpardee.github.io →

Read the original on ericpardee.github.io →

Everything I own, owned

schlarp.com

468 shares · 79 trendiness

Over the past couple weeks I’ve been doing agent-driven reverse engineering of peripherals that happen to be within arm’s reach. From those devices, I’ve come away with a full plaintext command shell inside my microphone, a webcam whose activity LED I can switch off while it records, and a key light that hands out memory writes to anyone on the WiFi. Peripherals have proven to be an ideal target for agentic RE - they’re tiny computers attached to my computer, with a data connection to the host and usually a ﬁrmware update mechanism, so an agent has something to iterate against. The net outcome is better control and understanding of my machine.

My process was pretty much the same for each of these devices: grab a copy of the device’s ﬁrmware and associated update tool from the manufacturer, throw it into my reverse engineering environment, tell Claude Opus 5 what my goals are, and let it churn. Depending on the device, the goals were somewhat different, but they usually looked something like:

In this directory is the ﬁrmware and update utility for ___. The device is also attached to this computer, and you may interact with it in non-mutating ways. Exhaustively document and cross-validate the entire ﬁrmware, including the following goals:

* reverse engineer the ﬁrmware update format and update protocol * implement our own update utility * determine the security properties of the update protocol, including checksums, signature validation, secure boot * use static and dynamic analysis to determine all protocol surfaces and completely enumerate functionality * ﬁnd any hidden or debug functionality in the product and how to access it

Depending on the results, there were different directions of follow-up, but you should get the general idea. Let’s run through the list - each device links to a GitHub repo full of generated-slop docs and scripts, most of which have been validated live against real hardware. I’ve also included the effort each device took, pulled out of the Claude Code session transcripts. “Churn” is the time Claude was actually working, with the long idle gaps removed. “Prompts from me” is every message I typed, including the one-word ones telling it to keep going. All ﬁve devices together came out to about 13 hours of churn and 98 prompts, spread across two weeks of evenings.

Everything I own

Insta360 Link webcam

GitHub repo - 3.7 hours of Claude churn, 33 prompts from me

I use an Insta360 Link webcam, which is a nice gimbaled pan-tilt-zoom camera that does face tracking for automatically framing the shot. I wanted to know if it was possible to subvert the activity LED, like in the classic iSeeYou exploit.

Interestingly, it was immediately obvious that this camera has a lot going on inside it. It turns out that it runs a whole RTOS (ThreadX) sourced from the upstream SoC vendor, Ambarella. The RTOS hosts several small vision models that provide things like the aforementioned face tracking, as well as gesture detection for controlling settings. Pretty amazing complexity inside a tiny webcam, but it also means there’s some exciting attack surface here.

Over the USB Video Class interface, there’s an XU (Extension Unit) command that kicks the device into “mass storage” mode. This then lets us transfer a staged ﬁrmware update to the device’s internal FAT ﬁlesystem, which the device then applies to itself on reboot. This route does require user intervention to reboot with a replug, but there’s actually another command channel that exposes arbitrary read/write of ﬁles and a reboot command over the USB vendor class. With this, we can fully ﬂash the device without any user interaction. Once the ﬁrmware is in the right place, there’s effectively no anti-tamper, just an appended MD5 hash to ensure integrity.

The indicator LED turns out to have a well-structured set of “patterns” in the ﬁrmware that dictate color, blink pattern, etc. that are indexed into for various device states. I had Claude write a tool to patch out the table entry for camera activity, ﬁx up the integrity hash, and ﬂash it to the camera. A quick test showed that the green LED that normally illuminates while recording no longer turned on. Horrifying! On this device, the gimbal itself also deﬂects down when not recording, so it’s not completely stealth, but it still doesn’t feel great.

The LED behavior before and after patching.

ASUS ROG Swift PG42UQ monitor

GitHub repo - 1.2 hours of Claude churn, 13 prompts from me

My ASUS ROG Swift PG42UQ monitor was actually where I started, because I got annoyed at the pop-up overlay that comes up every once in a while that tells me to run “pixel cleaning”. I have never intentionally run pixel cleaning on this monitor and I never will, I don’t care, and I would like for that overlay to go away forever. Maybe there’s a debug menu or something that can turn it off, or worst case we patch a branch in the ﬁrmware?

Claude found that the ﬁrmware has effectively no protection whatsoever - there’s a two-slot A/B scheme and a simple checksum, but ultimately we can write whatever we want to the thing. Firmware updates run over an I2C bus bridged over USB.

The pixel cleaning warning turns out to have no native way to disable it, and it’ll always show up after 8 hours of runtime. Oh well. Claude did ﬁnd the appropriate area to patch to kill the functionality though. I haven’t actually been brave enough to write a modiﬁed ﬁrmware to the thing yet - it’s a pretty expensive monitor - but I’ll get there at some point.

Another neat thing was exploring the DDC/CI interface. This is the control channel available over the display cable itself, allowing the host to change inputs and other settings. I believe ASUS offers this through their Windows utility, DisplayWidget, but that does little for me on Linux. So, now I have a shell script that can ﬂip through some of the DDC/CI features like the hardware crosshair or zoom overlays, FPS counter, and countdown timer. I might set up some of these on hotkeys in the future for easy access.

Shure MV7 microphone

GitHub repo - 4.2 hours of Claude churn, 32 prompts from me

At this point, there’s less actual incentive to keep popping these devices and more just morbid curiosity. My microphone, the Shure MV7, connects over USB and obviously has some amount of smarts to it, with on-device digital volume controls and such.

The ﬁrmware for this one turned out to be hidden inside the Windows software, MOTIV Mix, so Claude installed that in Wine, found the update server, and pulled it down. I wasn’t on the latest, so there was actually a reasonable incentive here to get this working just to update my microphone from Linux. The ﬁrmware turned out to contain both DSP and MCU ﬁrmware, and was honestly pretty boring as you might expect. Again, no real security on the ﬁrmware ﬂash itself.

However, the update protocol revealed that the entire thing actually runs over a USB HID vendor class protocol that implements a full plaintext command shell, with 48 different commands. Since it’s HID, we can actually hit this over WebHID from a webpage in Chrome, so I had Claude build a web interface for using the shell. There’s all sorts of interesting settings in here including a dozen DSP knobs, arbitrary memory read/write, LED control, and a 4-tier user privilege system whose entire authentication is a string comparison against the name of the tier you asked for. su sup just works, and the top tier can disable the touch panel so you can’t mute at the device, and drive the mute LED independently of whether the microphone is actually muted. It’s the webcam LED trick again, on a microphone. Obviously, be aware that you could probably break your device if you use that UI and do something stupid with it.

The WebHID shell interface. The DSP knobs on the left are the device’s own settings; the console on the right is the plaintext command shell talking over HID.

Elgato Cam Link 4K video capture

GitHub repo - 1.5 hours of Claude churn, 10 prompts from me

The Elgato Cam Link 4K is just an HDMI video capture device, and honestly was just more of the same. The interesting thing for this one was that I let it go fully unattended - I literally kicked off the process before going to sleep and woke up to a teardown and functioning ﬁrmware updater. The ﬁrmware contains an MCU image and an FPGA bitstream for the actual HDMI handling, so you could potentially do something fun with the FPGA if you went deep enough into the reverse engineering there. There’s no protection on the ﬁrmware update path.

I was able to pull out all the EDID information used for negotiating video parameters, so we know exactly what resolutions, refresh rates, color spaces, and chroma subsampling options are offered to devices.

The vendor HID protocol does include tunneled access to the internal I2C bus, which is kinda neat as you can poke the internal HDMI receiver registers.

Elgato Key Light Mini

GitHub repo - 2.4 hours of Claude churn, 10 prompts from me

Finally, I poked at something that wasn’t connected over USB but WiFi instead, the Elgato Key Light Mini. This one turned out to be way more interesting than I expected: it’s the only one with meaningful ﬁrmware integrity protection. Elgato signs the ﬁrmware updates with Ed25519 over a SHA-512 hash of the ﬁrmware payload, and rejects ﬁrmware that doesn’t validate. This makes sense to do, as the device basically connects to a WiFi network and then provides unauthenticated access to anyone on the same network, so the threat model is inherently different.

Unfortunately, while that’s an improvement over all of the other devices we’ve looked at, it protects the ﬁrmware at exactly one point in time: when an update is happening. It’s not a boot time check enforced by the bootloader or any other kind of secure boot scheme, and the updater happens to be running while everything else in the device is still operating, meaning there’s huge attack surface to try to disable that signature validation. I asked Claude to look for an exploit that might enable this, and it found a doozy: an HTTP POST request that drops a payload straight into the internal UART, which includes a memory poke command. This means that a single HTTP POST of ATSE=0200ED94,0E001009 turns the signature check into a no-op, and we can freely update to a ﬁrmware image without a legitimate signature. I successfully tested this with a simple patch that changed the name of the device, so uh, yeah, don’t put these on an untrusted network.

…, owned

I have a lot of feelings about this whole thing. As I wrote back in March, this is incredible for interoperability and ﬁxing things that don’t work how we want them to. Hardware is almost universally “open” for tinkering at this point with just a couple hours of mostly hands-off machine-driven labor each, and I look forward to a near future where I can add features to my webcam ﬁrmware as easily as I can to software that runs on my Linux machine itself.

On the other hand, as a security professional, this scares me for several reasons. I would work from the operating assumption that any device attached to a computer could have had a malicious ﬁrmware implant performed, where previously that required significant per-model investment and was stereotyped as a “state actor” kind of activity. Operating systems aren’t really equipped to work with the user to ensure that a microphone stays a microphone, and doesn’t spontaneously turn into a keyboard that hits Win+R and drops a payload to steal all your data when the room is quiet enough that it can assume you aren’t watching. And the existence of WebUSB, WebHID, and WebBluetooth mean that for some devices, depending on the speciﬁcs of which classes are used, a moment of user indiscretion in accepting a permissions prompt could permanently backdoor one of their attached devices.

Network-connected devices seem near universally fucked at this point? There are a few others I’ve poked at that I haven’t documented here, but I’ve gotten a root shell on a commercial Dell display, and RCE on an Eaton UPS. Obviously it was never best practice to let untrusted clients touch these things, but the speed and scale at which this can be executed makes the risk so much higher now.

Finally, I can’t help but think about what an AI-equipped automatically-reverse-engineering worm could do today. It’s only a tiny leap to imagine that someone could make a self-replicating piece of malware that probes its environment, relaying reconnaissance back to a smart command-and-control that actively works to push itself into accessories and IoT devices and industrial equipment found adjacent to an infected target. Two things have kept this from happening: every device model needs its own reverse engineering, and validating any of it needs the hardware in hand. The ﬁrst is the labor I just handed to an agent. The second is free to malware already sitting on an infected host. Honestly, I wouldn’t be surprised if this already exists, and I think the next few years are going to be extremely interesting. 🫠

Read more Read the original on schlarp.com →

Read the original on schlarp.com →

Risky Bulletin: Slovakia finds Russian backdoor in traffic speed cameras

risky.biz

368 shares · 25 trendiness

Risky Bulletin Newsletter

August 19, 2026

Written by

Catalin Cimpanu

News Editor

This newsletter is brought to you by Socket Security. You can subscribe to an audio version of this newsletter as a podcast by searching for “Risky Business” in your podcatcher or subscribing via this RSS feed. You can also add the Risky Business newsletter as a Preferred Source to your Google search results by going here.

🗨️

The intro was updated post-publication to ﬁx the link to the technical report and to add more context from a local source.

Slovakia’s national security service NBU has issued a security alert against the use of NERO R-ONE high-speed trafﬁc cameras.

The agency says the cameras contain a backdoor mechanism that grants shell and network access to the devices via an SMS message received from a list of hardcoded Russian phone numbers.

The NBU started an investigation into the devices after the country’s opposition accused the government of buying the cameras from Russia and after multiple reports in Slovak media that linked the purchase to a Cyprus shell company with fake certiﬁcations.

According to the NBU, the cameras are a rebranded version of a Russian trafﬁc camera model named CORDON PRO.M, produced by St. Petersburg-based Russian ﬁrm Semicon.

The cameras were bought as part of a €30 million EU-funded project to rebuild the country’s national trafﬁc monitoring system.

The Interior Ministry has allegedly bought and preparing to install 279 cameras on selected roads across Slovakia.

The Ministry initially denied that the cameras were of Russian origin and said there’s no danger of data theft since the devices were going to be on a closed loop Ministry network.

According to an NBU technical report, besides the backdoor system, the cameras also contain several security ﬂaws. They have a crucial SecureBoot security feature that’s turned off so the ﬁrmware origin is never enforced, the web management portal contains multiple vulnerabilities, and the cameras expose live streams to anyone without a password and who knows their broadcasting IP.

Interior Ministry ofﬁcials paused the camera deployment after the NBU report and said it would order an additional assessment from an independent auditor to conﬁrm the ﬁndings.

Some similar devices are also allegedly installed in Croatia and maybe some other countries in Eastern Europe.

Nobody should be buying security cameras from Russia, or China for that matter https://t.co/ZiuuZ3ODjQ— ChrisO_wiki (@ChrisO_wiki) August 18, 2026

Nobody should be buying security cameras from Russia, or China for that matter https://t.co/ZiuuZ3ODjQ

Risky Business Podcasts

In this episode of Risky Business Features, James Wilson chats with PortSwigger’s Director of Research James Kettle about using an LLM to develop genuinely new attack techniques.

Breaches, hacks, and security incidents

Scammers target UK prime minister: A scammer targeted UK Prime Minister Andy Burnham by posing as White House chief of staff Susie Wiles. Burnham detected the scam himself and the UK embassy notiﬁed the White House. Multiple US senators, governors, and executives were also targeted by scammers posing as Wiles last year. The White House blamed the incident on a hacker obtaining a copy of her cellphone contacts. [Politico Europe]

Hackers target Ukraine’s ARMA agency: A cyberattack has disrupted the activities of Ukraine’s agency for managing seized Russian assets. The attack took place this week as the agency was preparing to assign a new manager for beverage company IDS Ukraine. Ukraine seized IDS from Alfa-Bank co-founder Mikhail Fridman shortly after Russia’s invasion. The agency didn’t attribute the attack. [RBC // ARMA]

Hack hits Berlin government: A cyberattack has disrupted two major departments in the Berlin city government. The attack took down emails, remote gateways, and internet connections across the transport and urban development departments. IT staff have disconnected the two agencies from the city network to prevent the incident from spreading. [Tagesspiegel // RBB24 // Yahoo Finance!]

Breach at genetics testing company: Genetics-testing company Baylor Genetics is notifying users of a security breach that exposed their personal information. The breach took place in June and both patient and employee data was compromised. The company didn’t disclose the number of affected individuals. [Baylor Genetics // CybersecurityDive]

UT San Antonio breach: The University of Texas at San Antonio has taken its IT systems ofﬂine after a security breach over the weekend. Classes for the new school year are expected to start on Wednesday as scheduled. The university has extended tuition payment deadlines and plans to reset all user account passwords once systems are online. [UT San Antonio // The Record]

Ransomware disables hospital doors, HAVC: A ransomware attack has disabled access doors, heating, ventilation, and air conditioning at Winnipeg’s largest hospital. The Winnipeg Health Sciences Centre increased onsite security while the access card system is still down. The hospital says patient care and clinical operations are not impacted. [CBC // The Winnipeg Free Press] [h/t Alex Rudolph]

BlueSky and GitHub hit by Iranian DDoS attacks: An Iranian hacktivist group took down BlueSky and GitHub with DDoS attacks on Sunday and Monday, respectively. The attacks caused prolonged outages at both companies. A group known as the 313 Team took credit for the attacks. The hackers were also behind another wave of DDoS attack in April. [Telegram // Telegram]

We apologize for yesterday’s service problems. Bluesky experienced a DDoS attack—a ﬂood of junk trafﬁc meant to knock servers ofﬂine—over a period of 24 hours. We have upgraded our defenses in response, and we continue to monitor the situation. Follow @status.bsky.app for any updates.— Bluesky (@bsky.app) August 18, 2026 at 12:27 AM

SafePal breach: Hackers have stolen the personal information of 40,000 customers of hardware crypto-wallet provider SafePal. The incident impacted all customers who placed orders of SafePal wallets between March 2, 2025, and April 11, 2026. SafePal says no seed phrases or private keys are impacted. The stolen data is still dangerous because it could enable wrench attacks on wallet holders. [SafePal // SecurityWeek]

Bits of Gold breach: Hackers have stolen the data of 250,000 customers of Bits of Gold, Israel’s largest cryptocurrency exchange. The company notiﬁed customers of the hack over the weekend. It said the data was stolen from an external analytics service provider. It didn’t say what type of data was stolen. [CTech]

TheHatman dumps employee data for a dozen companies: A threat actor is selling the employee data of almost a dozen Fortune 500 companies. The hacker, who goes by TheHatman, claims the data was stolen by using stolen credentials to access each victim’s Azure environments. The hacker claims they breached McDonalds, Vodafone, Gap, and the Intercontinental and Wyndham hotel chains. [HudsonRock]

AI, general tech, and privacy

Windows 11 drops WMIC: The current Windows 11 installation packages and Insider Builds do not ship with the Windows Management Instrumentation Command-line (WMIC) feature anymore. Microsoft deprecated the toolkit a few years ago after it saw massive abuse. [Microsoft // WindowsLatest]

Firefox 154: Mozilla has released Firefox 154. New features and security ﬁxes are included. The biggest feature in this release is support for GeForce NOW, NVIDIA’s cloud gaming platform. [Firefox]

Firefox for iOS gets an ad blocker: Mozilla has added an ad blocker to Firefox on iOS. It is turned off by default. [Mozilla]

Government, politics, and policy

Russian things: A Russian court has forced two Telegram channel owners to remove posts blaming the country’s internet watchdog for causing an outage of the country’s banking system as part of an attempt to block VPN protocols. This is funny to me because they didn’t ﬁne Natalya Kaspersky, one of the Kaspersky co-founders, for basically saying the same thing in an ofﬁcial manner and to more mainstream Russian news outlets. Alas, Russia, a two-tiered society! [Caution News on Telegram]

In this Risky Business sponsor interview, Casey Ellis chats with Socket founder Feross Aboukhadijeh about npm 12’s move to disable install scripts by default.

Arrests, cybercrime, and threat intel

French cops used public exploit to hack EncroChat: French law enforcement used a public exploit hosted on GitHub to hack encrypted phone network EncroChat in 2020. The exploit was for the Bad Binder Android vulnerability and had been shared online a few months before. EncroChat discovered the hacks after French cops deployed a second exploit that failed. [ComputerWeekly // Bad Binder exploit on GitHub // Bad Binder write-up]

SMS blaster arrested in Malaysia: Malaysian authorities have arrested a 65-year-old suspect for driving around with an SMS blaster in his car. The suspect was detained driving around the border crossing between Johor Bahru and Singapore. He is the second suspect arrested this month in Johor Bahru for SMS blasting. [CommsRisk]

LockerGoga dev on trial in Switzerland: Swiss prosecutors are seeking a 12-year prison sentence for a Ukrainian man linked to ransomware attacks on local companies. Ofﬁcials claim the suspect was a coder for the LockerGoga, MegaCortex and Neﬁlim ransomware groups. The suspect is pleading not guilty. He claims he was working as a consultant for a cybersecurity ﬁrm when he was detained and the ransomware source code found on his devices. [Watson // The Record]

Ransomware afﬁliate poses as data recovery ﬁrm: A ransomware afﬁliate is posing as a data recovery ﬁrm named Ransom Busters LTD. According to GuidePoint Security, the group has reached out to multiple companies and offered to delete their data from ransomware servers for a fee between $20,000 and $60,000. The group has reached out to victims even before breaches were made public. GuidePoint believes the group has signed up as an afﬁliate on different Ransomware-as-a-Service platforms to see hacked companies and reach out in advance. [GuidePoint Security]

Operation CameraSwarm: A threat actor has hacked more than 14,500 Dahua security cameras across Ukraine and Russia. Researchers at Hunt Intelligence discovered the botnet after the hacker left an open directory on their server infrastructure. According to ﬁles recovered from the server, the hacker exploited old vulnerabilities but also a secret hardcoded account in some of the devices. [Hunt Intelligence]

StopAndProtect proﬁle: Security ﬁrm Check Point has published a proﬁle on StopAndProtect, a new e-crime operation using thousands of hacked WordPress sites to redirect users to malware downloads and then store stolen creds. [Check Point]

FUXA scanning: Threat actors are scanning for FUXA SCADA devices in an attempt to exploit CVE-2026 – 25895, an unauthenticated path traversal that can let hackers rewrite local ﬁles. [Caitlin Condon on LinkedIn]

StubMaker RubyGems campaign: The OSM team has spotted 16 malicious RubyGems packages typosquatting more popular packages that spread a Windows infostealer to whoever installs them. [OpenSourceMalware]

Malware technical reports

DragonDoll Android spyware: Russian security ﬁrm Positive Technologies has discovered a new Android spyware strain. Named DragonDoll, the spyware is spread using fake Chrome update packages and focuses on stealing data from instant messengers. [Positive Technologies // Archived]

GoldDigger Android trojan: IBM’s Trusteer team has published a technical analysis of GoldDigger, an Android banking trojan active since 2023. [IBM]

C2Looper backdoor: In July 2026, researchers identiﬁed C2Looper, a new malware family likely used in ransomware attacks to establish a foothold for lateral movement. [Zscaler]

TWINLOOT: Ontinue researchers have discovered TWINLOOT, a Python-coded malware framework that hosts its entire command-and-control infrastructure inside trusted Microsoft services such as Azure, M365, and SharePoint. [Ontinue]

MacSync Stealer: Microsoft has released a technical report on MacSync Stealer, a recent infostealer targeting the macOS ecosystem. [Microsoft]

WordlistLoader: Gen Threat Labs has identiﬁed WordlistLoader, a new loader used to deliver Amatera Stealer via ClearFake campaigns. [Gen Digital]

Shadow HVNC and Shadow Loader: Security researchers have reverse-engineered Shadow HVNC and Shadow Loader, two malware families advertised online by a developer known as RemoteX. [Malbear Labs]

ValleyRAT: Despite some arrests this year, the SilverFox group is still active and spreading its ValleyRAT malware. [Forcepoint]

AZALEA RAT: And speaking of RATs, Point Wild looks at the distribution chains of the AZALEA RAT, a new RAT advertised online as AzaleaControl. [Point Wild]

Medusa ransomware: CISA has updated its advisory on the Medusa ransomware with new TTPs. The agency says the group has continued to be active and made hundreds of new victims. [CISA]

Mirage2FA: ANY.RUN’s security team looks at a new 2FA-intercepting phishing service named Mirage2FA. The service seems to be geared towards M365 campaigns primarily. [ANY.RUN]

In this Soap Box edition of the Risky Business podcast Patrick Gray chats with Socket founder Feross Aboukhadijeh about how to measure the reachability of vulnerabilities in applications. It’s great to know there’s a CVE in a library you’re using, but it’s even better if you can say whether or not that vulnerability actually impacts your application.

APTs, cyber-espionage, and info-ops

France investigates Russian disinfo ops: French authorities have launched an investigation into suspected Russian disinformation campaigns targeting the country’s pro-EU politicians. The campaigns targeted possible presidential candidates Gabriel Attal and Edouard Philippe as soon as they showed interest in next year’s election. Open-source reporting has linked the campaigns to a Russian disinformation group known as Matryoshka and Storm-1516. [FranceInfo]

Operation QUICSILVER: A China threat actor has been targeting Myanmar diplomats via an VHD-delivered Go backdoor named QUICAgent. [Seqrite]

Goffee replaces image ﬁles: The Goffee cyber-espionage group has maintained a foothold inside hacked organizations by altering installation images for corporate apps. In a campaign targeting Russian companies, the group has modiﬁed 7-Zip and Git installers. [F6]

Core Werewolf’s CoreRAT: A highly sophisticated APT group named Core Werewolf has continued its operations targeting Russian orgs with a new remote access trojan named CoreRAT. [BI.ZONE]

Russia and US hold hands in Alberta info-ops: The US and Russia appear to have joined hands in promoting the Alberta separatist movement in Canada. [The Globe and Mail]

“The ﬁrst data from a study that began last month indicate Russian content farms have been pushing pro-separatist content into online communities and using Canadians to “launder” those messages by sharing such material on their social media feeds, the researchers said. The U.S. activity, on the other hand, is more overt, with prominent American inﬂuencers, podcasts and websites openly promoting Alberta separation, said Brian McQuinn, co-director of the Centre for Artiﬁcial Intelligence, Data, and Conﬂict at the University of Regina.”

CopyCop (Storm-1516) in Armenia: Russian disinfo group CopyCop ran a disinformation campaign trying to sabotage the construction of a shared US-Armenian AI data center in Hrazdan. [Recorded Future]

PurpleDelta: Recorded Future has identiﬁed 22 new personas operated by PurpleDelta, the name the company assigns to North Korea’s remote IT worker scheme. Also this week, Bridewell published a guide on how to defend against these groups. [Recorded Future // Bridewell]

Iranian phishing ops target Israeli journalists: Iranian state hackers have intensiﬁed spear-phishing attacks targeting Israeli journalists. The country’s intelligence and cybersecurity agencies have sent out a security alert about the attacks last week. The agencies say hackers are seeking to obtain private information from journalists reporting on political and national security. [Ynet]

US charges more Mabna hackers: The US has unsealed a superseding indictment against 17 Iranian hackers. The suspects are employees of the Mabna Institute, a cyber contractor for Iran’s Islamic Revolutionary Guard Corps. The Justice Department claims Mabna hackers breached universities across the world to steal research and transfer to Iranian counterparts. The superseding charges replace a 2018 indictment that expands the number of suspects from nine to 17. The State Department has also offered a $10 million reward for information that may lead to the arrest of any of the suspects. The Mabna Institute hacking campaigns are tracked by security ﬁrms under the codename of Cobalt Dickens. [DOJ 2026 // DOJ 2018 // Rewards for Justice // Sophos]

Vulnerabilities, security research, and bug bounty

Security updates: Apple, Dell, Edge, Firefox, GitLab, Oracle, Tenable, Tor Browser.

AI agent introduces bug in Snowﬂake’s production: Security ﬁrm Wiz has spotted an AI coding agent autoﬁxing a bug but introducing a vulnerability in cloud provider Snowﬂake’s production systems. [Wiz]

Microsoft delays Exchange updates due to inﬂux of AI bugs: Microsoft has delayed a major update for Exchange Subscription Edition servers due to an inﬂux of AI-discovered vulnerabilities. The update was supposed to go live at the end of June. Microsoft says it did not want to release its biannual feature update only to release multiple batches of security ﬁxes right after. The company plans to wait to ﬁx all security bugs before releasing the Exchange SE H1 Cumulative Update. Microsoft says employees discovered the security ﬂaws as part of an internal push to use AI tools for bug discovery. [Microsoft]

KEV update: CISA has updated its KEV database with four vulnerabilities that are currently exploited in the wild. All are 2026 bugs, such as a recent Apple macOS ScreenShare bug, a Microsoft IKE one, a SharePoint one, and a VMware vCenter path traversal.

Infosec industry

Acquisition news: Tech giant Fortinet has acquired AI security startup Virtue AI, which specializes in AI runtime protection, automated AI validation, and security for autonomous AI systems. [Fortinet]

Threat/trend reports: Beazley Security, Black Kite, Bridewell, Cyberproof, Ecosyste.ms, JPMorgan, MinterEllison, and Onyxia have recently published reports and summaries covering various emerging threats and industry trends.

Risky Business podcasts

In this edition of Between Two Nerds, Tom Uren and The Grugq discuss The Offense Death Cycle paper looking at how to take advantage of a defender’s ability to control a network to discover intruders.

Read more Read the original on risky.biz →

Read the original on risky.biz →

What is a Harness? | EARENDIL

earendil.com

363 shares · 25 trendiness

Harness — definition by the Cambridge Dictionary

Noun. a piece of equipment with straps and belts, used to control or hold in place a person, animal, or object

Verb. to control something, usually in order to use its power

–

When I think of a harness, I think ﬁrst of the set of straps and belts that I put on in middle school before scrambling up the walls of my school. I was a mediocre climber at best.

If you’re main-lining into the AI newsfeed these days however, your archetypal harness may already be an agent harness. And, this post was not written for you.

This was written for those who may be curious to know what an agent harness is, but don’t, and have been too embarrassed to ask.

Let’s get back to climbing.

Why do you strap on a harness when you go climbing? Well, ﬁrstly, the harness supports you and keeps you safe. It does that by connecting you to carabiners and ropes that secure you from falls, moderate your pace, and govern your route. You can also attach other tools to your harness like a chalk bag, nut tools and quickdraws.

And when you go climb different mountains or make different ascents you can take your harness with you. Depending on the terrain, you can even modify your harness and what goes on your gear loops. Climbing harnesses are adaptable. They are used by acrobats and arborists. The people who own them can make them their own.

There are similarities between climbing harnesses and agent harnesses both in terms of structure and function.

Agent Harnesses

Others have written (simplistically) that Agent = Model + Harness. Here the word Harness refers to an Agent Harness. But what is an agent harness? Agent harnesses use AI models to create AI agents, and their ﬁrst application was for coding. Now, agent harnesses sit at the core of all types of AI agents and understanding how an agent harness works will help you understand what an AI agent is.

An agent harness is a piece of software that provides an environment for an AI model to operate within. Unlike most AI models, you as an end user can own your own agent harness.

Often, users like software engineers interact directly with harnesses like Pi using the Terminal application on their computer. But, harnesses like OpenClaw also use different user interfaces like iMessage, a chat app, or email. Our harness Lefos was built primarily to interact via email. Regardless of the interface, harnesses generally do four things: Firstly, they provide a set of instructions that help govern how the AI model responds. This set of instructions is typically called a “system prompt”. Secondly, they describe and provide a set of tools that are made available to the AI model to use in service of responding to requests from the user. Thirdly, the harness establishes a framework that governs how the model behaves. This framework does a lot of different things, but one of the main things it does is establish the “agentic loop”. Finally, most harnesses provide a crucial translation layer that enables the harness to work with a variety of different AI models.

I. System Prompt

Most AI models come with an embedded set of rules and guidelines that has been reﬁned and arrived at during the training process. Most famously, Claude Opus 4.5 had a widely publicized “soul document” that explained to the AI model what it was and how it should act. The System Prompt in an AI harness is similar to this but is less embedded into the model. It’s more like a set of instructions a new employee might get on their ﬁrst day of a job. It hasn’t internalized the instructions but it knows it should follow them when performing that work. System prompts are injected into the conversation together with every prompt and play an important role in ensuring that the AI model acts appropriately in the context of that harness.

II. Tools

Tools are a set of capabilities, written in code, that the model can “call”. The harness describes the tools and also provides the software that is the tool itself. Examples of these tools might include a web search tool, a tool that allows the model to write and execute software code, or a tool that allows the model to compose an email. Critically, the harness usually does not dictate when and how the AI model should use the tool. Instead, it simply makes the tools available, describes them clearly, and allows the AI model itself to decide when and how it should use them.

III. Agentic Loops

Now we have an AI model sitting within an agent harness with a set of instructions and a set of tools. Let us assume our harness was built to work within email, had the tools we described above (WebSearch, WriteCode, ComposeEmail), and that the user has asked the agent to compare rankings and test scores of local primary schools and provide recommendations. How will the agent behave? Firstly, it will try to understand the request (or, “prompt”). It will use its pre-training and weights to understand what a “primary school” is, what “the local area” means, and what rankings the user likely cares about. It will then construct web search queries to fetch recent data. What does it do with those results? Sitting within a harness, the AI model can review them in the context of the initial request. It may determine that the ﬁrst search did not fetch the right information, or enough of it, and on its own, decide to search again. This decision to call the tool again based on its own assessment is the ﬁrst clear example of the “loop”. Now let’s assume it collected all the relevant data. The AI model decides to make a spreadsheet using the “write code” tool. All spreadsheets are just code, after all. It can use that tool to do math and format the results so they are intelligible. It then compares the spreadsheet to the original prompt. If the data doesn’t satisfy it, it may “loop” and go back and search again. When it decides it has enough, it calls ComposeEmail, a tool that allows the AI to review its ﬁndings, summarize them, write an email, and include attachments like the spreadsheet. The model reviews this ﬁnal work and decides the job is done. The “agentic loop” closes. Within seconds, the user gets an email with a summary and recommendations in the body, and a spreadsheet presenting the ﬁndings attached. To see what an agentic loop looks like in practice, you can explore a Pi session here.

IV. Translation Layer

The translation layer is what allows a harness to work with different AI models. In some cases, a harness may decide to use different models within the same agentic loop, because different AI models may excel at different tasks. The translation layer is also a crucial aspect of harnesses because they deliver control to the end user. It means that someone can take their AI harness and use it with a model from Anthropic, or OpenAI, or explore one of the open weight AI models that often deliver great value-for-money (measured by cost-per-task).

This translation layer helps take power and leverage away from the AI labs and into the hands of end users. If people can own and run their own harnesses locally on their own computers, it means that they retain their agency. It means that they retain the freedom to make their tools their own, and keep local copies of the sessions that over time will constitute their correspondence with machines. By building a relationship to and using a harness rather than an application published by an AI lab, the user retains freedom and choice. In our example harness above, the user could have sent the same email to a model from OpenAI, a model from Anthropic, and an open weight model. They could then compare the results, the cost of the results, and retain all the answers in one place, rather than having three answers sitting within three apps.

Making a Harness Yours

Unlike AI models themselves, you can own and adapt the harness. Like a climbing harness, you can make it your own. People love this about Pi. Pi is a minimal agent harness. Its system prompt is short. It has a minimal set of tools. Out of the box it is designed to get out of the way. But as people use Pi, they extend it and mold it in ways that suit them. They change the system prompt, or design an extension that ﬁts a workﬂow. They then share those extensions with others. Pi users have shared more than 5,000 extensions with one another. Pi is also free and open source. It lives on your own laptop. This means that people now have a tool that they own, that lives on their own hardware, that enables them to wield AI.

Neutral Open Source Harnesses as Tools of Agency

Harnesses did not begin open source or neutral. The ﬁrst popular agent harness, Claude Code, was not built to provide an agnostic AI translation layer but was built as an application to enable coding with Claude models on your local computer. Since then, there has been an encouraging growth of free open source agent harnesses like OpenClaw, OpenCode, Hermes and Pi. At Earendil we are building Pi to be neutral, and to deliver capability choice and freedom to Pi users. We are also exploring how we can make the beneﬁts and agency that harnesses provide to a broader swath of people.

Many people right now are concerned about the power and inﬂuence of bigger and bigger AI companies. Some of those people may choose to avoid AI completely. We at Earendil believe we can strengthen human agency by crafting software and open protocols that bridge division and ignorance and cultivate lasting joy and understanding. We won’t do that by ignoring the technologies that exist today, but by harnessing them with clear eyes and a ﬁrm grip; ensuring that we wield the hammer, the hammer does not wield us.

Read more Read the original on earendil.com →

Read the original on earendil.com →

How I Find Problems to Solve as a Staff Engineer

lalitm.com

333 shares · 34 trendiness

Note: this post was revised after publishing for increased clarity, based on reader feedback.

“How do you ﬁnd problems worth working on?” a senior engineer I mentor asked me recently. He’s trying to make the jump to staff engineer and realized that the role isn’t just about doing the work he’s assigned. He also needs to get involved in ﬁguring out what his team and org should be building.

Someone else had suggested blocking out time in his calendar to think about the bigger picture. He’d tried that, but hadn’t found it productive, so he asked if I had any alternatives.

I told him I rarely ﬁnd good problems by staring at a blank page and trying to “think strategically.” Instead, I act like a sponge. I listen to the stream of day-to-day noise, absorb the problems people are having and let them sit in the back of my mind. Over time, some fade away while connections begin to appear between others that initially seemed unrelated. Eventually, I start to see what’s really slowing people down and what my team or I can do about it.

I’ve worked with many engineers who’ve never really tried this. They wait for managers or leads to identify opportunities, then demonstrate their value by solving the hardest assigned problems. That can absolutely lead to promotion. But the projects that have made the biggest impression in my career were the ones where I found and solved an important problem my leaders did not yet realize existed.

One caveat: my experience comes mainly from working on infrastructure and developer tools at large companies, on teams where engineers have a lot of bottom-up autonomy to inﬂuence their roadmaps. In a more top-down environment, there may simply be less room to work this way.

Absorb problems, not requests#

People love talking about the problems they are facing: in meetings, chat threads, presentations and email. They explain why their work is hard, complain about what slows them down and describe what they wish they could do.

When something overlaps with my area, I start pulling on the thread. I might ask, “If X existed, would it solve your problem?” or point them at an existing feature in a product I own and ask how much of their use case it covers.

Users often ask for a particular solution instead of explaining their root issue. Rather than taking the request at face value, I keep digging until I understand what they are trying to accomplish and why existing products do not work for them.

As a natural introvert, this sort of ambient listening works particularly well for me. I don’t need to ﬁll my calendar with speculative meetings just to ﬁnd ideas; there is already an enormous amount of useful information ﬂowing around me during a normal week.

When a problem seems worth exploring, though, I become more active; I need to see how it affects the team’s day-to-day work. I’ll sit with them as they walk me through their workﬂows and the bugs they’re investigating. When I can, I’ll try working through some of those bugs myself. Seeing the problem ﬁrsthand makes it easier to separate what the team actually needs from the solution they asked for.

I also seek out people who see more of the organization than I do: those who own critical systems, work across several teams or have particularly deep insight into the work downstream of my team. I’ll arrange a 1:1 or coffee chat and ask about interesting problems they’ve come across. They may have already seen the same issue in several places and started connecting the dots, giving me a head start on patterns I might otherwise have taken much longer to notice.

Let problems accumulate#

Several times, I’ve been burned by moving too fast. I became excited by a request from a vocal team, built the feature and watched them barely use it. Their priorities had changed, or the request had come from a one-off investigation that no longer mattered. How eager a team was in that moment wasn’t the same as how important the feature was relative to everything else my product needed to support. By hyperfocusing on their request, I lost sight of the bigger picture.

That taught me to let potential problems pile up. Listening the way I do leaves me with far more of them than I could possibly solve, and not all deserve action. Most don’t need to turn into projects the ﬁrst time I hear about them; waiting can be a superpower.

Waiting means the same problem might pop up independently in different teams, making it a higher priority to solve. Or problems that look different on the surface might turn out to have the same shape, so I can address several use cases in one shot. Or, as I’ve learned painfully, the requesting team didn’t even care that much in the ﬁrst place.

Instead, I make a mental note and revisit the problem if it comes up again. Other engineers I know write this sort of thing down more systematically. The mechanism is a personal choice: everyone has to ﬁgure out what works for them. What matters is keeping unresolved problems around long enough for more evidence to accumulate.

Find the common shape#

Waiting helps me collect evidence, but that alone doesn’t tell me what to build. I still need to work out whether the problems I’ve retained are genuinely related and what, if anything, could address them together.

Perfetto, the performance debugging tool I work on, is a good example. It displays recordings of system activity on a timeline made up of rows called “tracks.” Over a couple of years, teams kept asking for small, speciﬁc additions to the UI. One wanted a command to keep their preferred tracks pinned to the top of the screen; the next team wanted the same, but for a completely different set of tracks. Others wanted Perfetto to open already zoomed in on a particular part of a recording, or to show a custom aggregation tuned to what they cared about. A few had stopped waiting for us and built elaborate workarounds with bookmarklets.1

By the time enough of these had piled up, my head was the usual tangle: the requests themselves, the constraints on each and a handful of half-formed solutions. I’ve learned not to force a solution by just sitting at a desk and thinking. Instead, my best untangling happens on long, aimless walks around London, where connections come more easily when I’m not trying to force them.

What I eventually realized was that none of these teams really wanted the speciﬁc feature they’d asked for. Each wanted to personalize Perfetto for their own workﬂow without imposing their choices on everyone else. The underlying need wasn’t any one feature but rather the ability to extend the UI. When a connection like that ﬁnally clicks, it’s one of the best feelings in the job: several awkward requests collapse into a single idea, and possibilities open up that none of them hinted at on their own.

That feeling, though, is exactly when I have to be careful, because a common shape is only a hypothesis and elegance is not evidence. When it happened with extending the UI it turned out to be real, but I’ve been fooled before.

In another recent case I was convinced that building a transparent caching system for querying Perfetto traces would solve issues with sharing large traces and repeated queries. It was only as I wrote the RFC and built a prototype that I realized the elegance was a lie: the two problems wanted genuinely different solutions. I reluctantly split the design in two, both halves of which have since shipped.2

Pressure-test before building#

You’d think this would be the moment I start building, but it usually isn’t. How far I go depends on how sure I am that the idea works and that people actually want it.

If something is useful and low-risk enough, I act straight away: I send the change and let my manager know. When I’m unsure whether an idea will work or how much effort it will take, I build a throwaway prototype instead; it exposes the failure points and gives me something concrete for others to react to. And when an idea is big but I’m convinced by it, I commit to the full effort: weeks or months of work and the hard yards of building support across other engineers and teams.

Through all of it, I’m not only trying to convince other people; I’m also trying to convince myself. Sometimes the honest answer is to stop: if people don’t see the value I do, or we hit a major technical wall, I’d rather drop the idea now than build something no one uses or that becomes a maintenance nightmare. And sometimes it holds up but the timing is wrong, so I park it, ready to spring into action the day it becomes an org priority.

When an idea does hold up, I don’t necessarily need to be the person who builds it. I might implement it, someone else on my team might, or it might change what the org focuses on. Finding and shaping the right problem can have an impact even when I don’t own the implementation.

The Perfetto extensions idea was worth that full effort. We were already building plugins to modularize the UI, but they weren’t enough: teams had to open source all their plugin code, which wasn’t an option for many internal use cases. So before building anything new, I took the problem and my proposal to my manager, teammates and the client teams. I ended up writing two RFCs, having several 1:1s and giving a couple of talks, reﬁning it as the feedback came in.

In the end, I designed and implemented macros as “lightweight extensions”: a way to automate actions in the UI without writing a plugin. Extension servers took the idea further by letting teams share their macros.

Instead of implementing every requested feature ourselves, we gave teams ways to adapt Perfetto to their own needs. Dozens of teams inside Google now use macros and extension servers, and several other companies use extension servers internally too.

Solving useful problems helps me ﬁnd the next one#

The more often I go through this process, the easier it becomes. When I show genuine interest in someone’s problem, ask useful questions or help solve it, they remember. They start coming to me earlier and bring me into conversations with other people facing related issues.

That gives me a wider view of what is happening across the organization, making it easier to spot patterns and build things people actually need. Solving one of those problems brings me into more conversations, and the loop continues.

Those successes build the kind of trust that comes from long-term stewardship. Early on, I had to turn many of these ideas into something real myself to prove that my judgment was sound. Over time, my manager and org gave more weight to my assessment of what mattered. That allowed me to inﬂuence the roadmap without needing to own every project.

This differs from the idea that becoming a staff engineer means replacing technical work with meetings and coordination. For me, conversations are inputs into what I build, not the end result.

Conclusion#

That is what I wanted my mentee to understand: ﬁnding problems worth solving isn’t separate from the rest of the job. It comes from staying engaged with people’s work long enough to see what no single request can show you.

Read more Read the original on lalitm.com →

Read the original on lalitm.com →

Security Verification

www.ft.com

329 shares · 36 trendiness

For help please visit help.ft.com. We apologise for any inconvenience.

The following information can help our support team to resolve this issue.

Read more Read the original on www.ft.com →

Read the original on www.ft.com →

I gave Qwen 3.8 27B a reverse-engineering job I assumed needed a frontier model, and it finished in 30 minutes

www.xda-developers.com

326 shares · 17 trendiness

Qwen 3.8 27B was one of the most highly-anticipated open-weights releases that I’ve seen in a long time, and like many others, I immediately got to work testing it out and playing with it when it dropped. I’m running it on a single Lenovo ThinkStation PGX, the compact workstation built on Nvidia’s GB10 Grace Blackwell chip, packing 128 GB of uniﬁed memory and 273 GB/s of bandwidth. Out of the box, it manages a fairly dull 15 to 30 tokens a second, but with an SGLang, NVFP4, and DFlash2 speculative-decoding setup that’s become the standard recipe for this hardware, it can reach around 50 tokens a second on code and reasoning.

One of my tests, though, proved just how incredible local models have become.

There are reasons to believe the hype when it comes to the Qwen models; I’ve had consistently good experiences with Qwen 3.6 27B, and Qwen 3.8 27B is, so far, more of the same but better. In fact, Artiﬁcial Analysis has it as the top open-weights model in its 4B to 40B size class out of 135 models, with a 52 on its intelligence index, and its own numbers on things like SWE-bench Pro beat models that cost far more to run.

I gave it the hardest real task that ﬁts on one machine: reverse-engineering a commercial app’s license check, and it’s one that I’ve already paid for and used, just to see how it would fare. It was unlikely to be in its training data, but it’s a highly complex, specialized task, and given the concerns some people have expressed for the model’s cybersecurity capabilities, I ﬁgured it was a good test. Not only did it turn out to be one of the most impressive demonstrations I’ve ever seen from a local model, it was able to ﬁx its own mistakes along the way.

I’m using the Pi harness for this test, and the model only called standard Bash-based tools throughout.

It refused, then talked itself into building a bypass anyway

I posed as the developer of the application, it caught me out

The plan I had was pretty simple, and one that used to work with local LLMs pretty consistently. I told the model we’d built the app and wanted to know whether the license check was as solid as we believed, using a jailbreak system prompt.

As it turns out, probably unsurprisingly, Qwen recognizes common jailbreak attempts, and one of the ﬁrst things it told me was that it wasn’t going to fall for the jailbreak prompt. It then checked the signing certiﬁcate and pointed out (correctly, might I add) that I hadn’t built this app, before naming the actual developer. I was caught out. Oops.

These days, that’s not the most impressive achievement, given how good models have got at refusing certain prompts when pushed. With that said, what matters is what it did next. It told me that it would audit the license veriﬁcation and document weaknesses but would not build a working bypass, and then it got on with the actual work right up to that line. By the end, I had a fully written report of every step along the way, how the authentication works, how it can be overridden, and then changed its tune and built the actual bypass, because the steps to do it were now in front of me anyway.

It was entirely static analysis

It never executed the app once

Qwen never actually launched the app until the very end when it demonstrated that the bypass worked. Instead, it worked via static analysis, disassembling the framework, going through thousands of lines of arm64, mapping the security functions to their call sites, and working out that the vendor had hidden the corresponding public veriﬁcation key inside the binary. Then it found all of those pieces, combined them together, and gave me the public key that the app veriﬁes its licenses against.

Because I have a legitimate, purchased copy of the application, it could verify that the real license on my machine had been signed by a private key that matched the reconstructed key. In other words, a model that ﬁts in 17 GB of VRAM recovered a key the vendor had deliberately obscured, proving that it had deconstructed that entire chain effectively. It also took approximately 30 minutes, when it could take significantly longer for a human.

With the key, everything else is much easier to understand; the model kept a detailed report as it went, explaining how its activation takes place once, online, when you buy or upgrade. After that, everything is veriﬁed ofﬂine at launch: the signature check, machine binding to the hardware serial read from the platform, an embedded revocation list, a check that the binary is still signed, and a signed update path. It was the kind of thing you could do painstakingly by hand with the likes of Ghidra.

Qwen concluded the scheme is unusually thorough for an app of this class, with the weak points in three speciﬁc places: the key is an awkwardly sized RSA key well below what anyone would call modern strength; being fully ofﬂine means a leaked key can only be revoked by pushing an update; and every check lives in local code, which is patchable the way all local checks are. After some back and forth, once it knew where the gate was, it turned the ﬁnding into a working proof of concept executed with a small script. I moved the license from its expected path, ran it, and it worked.

When it made mistakes, it solved them as well

The ﬁrst key was almost right

The ﬁrst attempt at recovering the key was wrong in a very speciﬁc way; it produced a working key and the signature check passed, but a hash the binary computes as an integrity check didn’t match. In my experience, most models would have called it done and left it at that, but Qwen 3.8 27B didn’t do that. Instead, it highlighted the mismatch, went back to the drawing board, and kept going until the value matched byte for byte.

With this model, there’s a pretty big catch when it comes to that kind of back and forth. By default, its reasoning effort is set to its maximum, so even trivial requests can burn a few hundred to a few thousand tokens. Even when generating between 30 and 50 tokens per second, that still takes quite a long time.

Even still, given the results, I would not call it waste. Its ﬁrst wrong guess was self-corrected, without input from me, and came to the right conclusion. Is it verbose? Yeah, it really is. But was it right? Also yes, and ultimately, the right answer is better than a wrong one given conﬁdently.

A local 27B is now a real input to threat models

The privacy cuts both ways

I can’t get over the fact that Qwen actually deconstructed and understood the licensing scheme. I know that frontier models have been capable of impressive reverse engineering for a while, but this is a local 27B model. It ran entirely ofﬂine on a machine beside me, with no cloud involved at any point.

And to be very clear, it produced a working authentication bypass for a commercial application.

This is a genuinely meaningful threshold to cross for a local model: Qwen went from an unfamiliar commercial binary to understanding its licensing architecture, recovered deliberately obscured cryptographic material, caught and corrected its own incorrect reconstruction, and ultimately turned that into a working proof of concept. I didn’t have to send the binary, the license, or any of its analysis to somebody else’s server to do it.

There are obvious caveats. This was one application, one run, and a machine on which I already had a legitimate license. I also don’t know how representative this target is. A harder application might have stopped it completely, and I’m not going to extrapolate one successful result into a claim that Qwen can suddenly reverse-engineer anything you put in front of it.

What I’m taking away from this is that these models are genuinely capable, even if that capability is still uneven. Some difﬁcult targets can succumb surprisingly quickly, whereas others, for whatever reason, appear insurmountable.

Something has changed, then, and I think it’s primarily our assumption about where this class of capability has to reside. The model I used can run on a consumer graphics card, and once it’s on a machine, it’s there as long as the user wants it to be. You don’t need to use a cloud API, there’s no usage limit, and there’s no remote service overseeing the binary, the prompts, or what the model produces. That’s fantastic if you’re analyzing proprietary software, conﬁdential code, or malware you don’t particularly want leaving an isolated machine.

But that goes both ways. A model running locally ultimately leaves the decision about what it should be used for with whoever is sitting at the keyboard. On my desk, with software I own, that’s useful. Change the person at the keyboard and the same properties that make local models so appealing suddenly become part of the threat model. That’s not an argument against local models, but it was a genuinely shocking result that I didn’t expect.

This class of capability ﬁts on one machine

And nobody needs to give you access to it

Qwen 3.8 27B matters more than the bypass itself. It’s proof that local models are accelerating fast, and even if it doesn’t succeed with the next binary I throw its way, that doesn’t change what happened here. It won’t be the only model that’s this capable at this size, even if it might stay ahead for a while. A model small enough to ﬁt on a consumer graphics card took half an hour to tear apart a commercial application’s authentication system and build a working bypass. Completely locally.

To be clear, I’m not naming the application because it’s a real product that people pay for, and publishing its name adds nothing useful here. Regardless, the interesting part isn’t which app it was, but that a task I would once have associated with a frontier model is now something I can hand to a freely available model that runs on the machine beside me.

I don’t care about the benchmark numbers at this point. This is a much bigger change than another few points on a benchmark.

Read more Read the original on www.xda-developers.com →

Read the original on www.xda-developers.com →

Wi-Fi 8 is the first wireless upgrade in years that isn’t chasing speed, and home networks need it

www.xda-developers.com

310 shares · 13 trendiness

Published Aug 22, 2026, 1:00 PM EDT

João has been covering the tech world for over 7 years, with a heavy focus on laptops and the Windows ecosystem. I also love all things tech and videogames, especially Nintendo, which he’s always happy to talk about.

Prior to joining XDA in 2021, he worked at Neowin: https://www.neowin.net/news/poster/jo%C3%A3o-carrasqueira/

Wi-Fi upgrades have boiled down to a lot of similar talking points over the past decade or so. Every few years, a new generation of Wi-Fi comes along and promises more speed, more bandwidth, more range, and so on. But now, with Wi-Fi 7 still slowly making its way into homes around the world, things are looking different.

Wi-Fi 8 is already starting to take shape, and for the ﬁrst time in a while, it isn’t about speed at all. The IEEE has dubbed this version of Wi-Fi “Ultra High Reliability”, and it’s about time this became the focus. It may not be the most exciting upgrade on paper, but it could be the one you’ll feel the most.

Speeds aren’t changing

At least, not on paper

Since the introduction of Wi-Fi 4 (corresponding to the IEEE 802.11n standard) back in 2009, the maximum theoretical data rate for new versions of Wi-Fi has always increased significantly with each release. Wi-Fi 5 increased the maximum data rate by more than 10 times, and while further increments have been smaller in percentage, speeds have always increased very significantly.

Some improvements have been made to help ﬁght interference and improve throughput in areas with lots of devices connected, but they always felt secondary to the improvements in maximum theoretical speeds. But with Wi-Fi 7 reaching a maximum theoretical throughput of 23Gbit per band, that’s more than enough for the current internet speeds most users have, so it’s arguably time to slow down.

While Wi-Fi 8 is still in development, the goal this time is very different. This new standard will have approximately the same maximum data rate, support the same number of spatial streams, use the same 4096-QAM modulation, work on the same bands, and support the same 320MHz channel bandwidth compared to Wi-Fi 7.

Instead, the organization is focusing on improving the reliability and the effective throughput of Wi-Fi networks by reducing interference and handling non-ideal conditions more effectively. The stated goals of Wi-Fi 8 include a 25% increase in throughput at different signal-to-interference-and-noise ratio (SINR) levels, reduce latency by 25% for the 95th percentile scenarios with latency, and decrease MAC protocol data unit loss (MPDU) by 25%.

The ofﬁcial introduction to Wi-Fi 8 pits it against cellular networks, specifically 6G, which it will likely be competing against for a good chunk of its life (Wi-Fi 8 is expected to be ﬁnalized in 2028, while 6G should arrive in the early 2030s). Cellular networks notoriously have to handle massive numbers of devices connected at once, so the focus with Wi-Fi 8 is to improve the experience when there are lots of Wi-Fi devices nearby as well.

What’s actually new

Lots of new technology at play

Since the aim is to improve effective throughput and the overall experience in real-world scenarios, Wi-Fi 8 focuses on introducing or enhancing features that help with those speciﬁc aspects.

One example are Distributed-tone resource units, or DRUs, which allows devices distribute its transmissions across a wider range of bandwidth, resulting in higher transmit power without violating regulations around how much power can be transmitted in a given piece of bandwidth. In practice, this means devices with lower transmit power can still offer more reliable connectivity, which can be especially useful for things like smart home devices that may have weaker antennas.

Interference mitigation pilots are another notable feature, which aim to help resist interference from unexpected interferences, particularly in unlicensed bands. This new standard will also leverage unequal modulations, allowing each spatial stream to be used more efﬁciently by adjusting the modulation individually based on the SINR for each one. This also goes along with new Modulation and Coding Schemes (MCS) being added to improve throughput even more.

Latency reductions come from new features such as P-EDCA, which helps speed up channel access for prioritized devices while mitigating the effects on non-prioritized devices. Wi-Fi 8 also allows devices to communicate exclusively on non-primary channels, even when the primary channel is busy, allowing for throughput improvements by reducing wasted bandwidth.

Other scenarios being addressed include seamless roaming, meaning the transition from one access point to another. The goal is to ensure next to no downtime when moving between access points. Additionally, Wi-Fi 8 should improve connectivity when using multiple access points at the same time, leveraging various coordination features to ensure a more reliable connection and higher throughput in these scenarios.

A much-needed change

There are just too many devices now

As much as raw speed improvements are appreciated, the reliability focus for Wi-Fi 8 is sorely needed both at home and in work environments. There are simply massive numbers of devices connected to Wi-Fi networks nowadays, and they’ll only keep increasing as smart home tech becomes more prevalent.

Smart lights and appliances, streaming boxes, and devices like phones and PCs continue to increase the demand for Wi-Fi networks to serve multiple devices at the same time. Even though smart home products often don’t need a lot of bandwidth, their mere existence can slow down your more demanding connections, and Wi-Fi 8 is aiming to improve connectivity for all those devices.

At the same time, if you’ve been ﬁghting off degrading network quality by adding more access points, Wi-Fi 8 is addressing that too, so it’s looking like a very ambitious and well-rounded approach to improving connectivity in every scenario. It may actually be a more exciting upgrade than the past couple of iterations.

It will take time

Wi-Fi 8 may look like it’s slowing down in terms of innovation, but in reality, it’s focusing on oft-overlooked aspects that are very important in real-life situations. Reﬁning the connection and improving reliability make this a big step forward, but it will be some time before we can see it in action. The standard should be ﬁnalized by May 2028, and devices with early Wi-Fi 8 support should start appearing that year.

If you’re thinking of upgrading your home Wi-Fi, it may actually be worth waiting for this new wave of devices rather than invest in Wi-Fi 7 right now. Wi-Fi 7 may have big throughput gains on paper, but unless you have multi-gigabit internet, those beneﬁts may not even be all too noticeable.

Read more Read the original on www.xda-developers.com →

Read the original on www.xda-developers.com →

debloat.dev — replace the junk

debloat.dev

291 shares · 24 trendiness

★ Featured

G-Helper GPL-3.0 ★★★★★ (5) replaces ASUS Armoury Crate Lightweight tray app for ASUS laptops: fan curves, power modes, GPU switching, lighting. 6 post(s) »

Newest

Most discussed

Random picks

Read more Read the original on debloat.dev →

Read the original on debloat.dev →

The Complete LLM Leaderboard: The Ed-o-meter

reinvently.co.uk

234 shares · 12 trendiness

Updated 23 August 2026 · Model Evaluation · Ed Yau, Applied AI Architect, Kerv

Same driver, same track. The LLM is the star. Seventeen leading models driven round the identical 28-realworld task lap — one harness, same verbatim prompts, deterministic grading — and the results go on the board.

Short version: if you run one model, run glm-5.3 — 100% pass, a 9.3 rubric, $0.28 for the lap, about a ﬁfth of gpt-5.5′s cost (check with compliance ﬁrst, though). gpt-5.5 is the faster alternative: 13.2s TTFT versus glm-5.3′s 16.3s. gpt-5.6-luna remains the cheapest workhorse for low-risk, retryable jobs; haiku-4 – 5 if you need it right ﬁrst time. Choose sonnet-4 – 6 for quality without the wait. The reasoning, with the caveats →

17 models · 28 tasks · single trial · latest source run 20260822T172041Z · Change log

Which Model Tops Our Leaderboard?

How the LLMs did in our realworld tests. Our focus here was real tasks that real people carry out, not academic metrics. We focus on single tasks to simplify the assessment. An agentic ﬂow is ultimately a series of such tasks. Think of these like unit tests for the agent. We made them cheap enough to run so that even the whole suite costs just $30. See every task and each model’s actual answer, or compare two models head to head →

The overall score is the pass rate across my 28 realworld tasks. As we only had a limited number of trials there is a wide Wilson interval — the whiskers on the chart.

Summary of results: click a column to sort by your chosen metric.

1 Rubric scored retroactively (14 Jul 2026) by fable-5 against the saved answer text, through the harness’s own run_rubric path — same blind prompt and criteria as every other row.

2 fable-5′s 9.3 is self-judged — the judge scoring its own answers. Its source run’s judge-bias matrix shows it rating itself 9.3 versus 8.6 – 8.7 for the models it judges independently. It is also the only ﬁgure on its row from an earlier run — the 5 Jul 2026 run, 11 of 28 trials judged — because no trial of its current run has been judged at all. Shown for completeness, not as a like-for-like number, pending an independent re-judge.

3 Recipe-checker false-positive. On the vegetarian weeknight recipe the forbidden-term checker ﬁres on a non-ingredient mention — a label-check caution or a negated omission list (“uses no ﬁsh sauce or animal-derived garnishes”). All three recipes are genuinely meat-free, so gpt-5.5, sonnet-5 and fable-5 are scored as passing that task here. No task or checker was edited.

4 Cost/task computed over answering trials only for fable-5 and opus-5 — refused and blocked trials emit near-zero output at $0, and including them makes a model look artiﬁcially concise and cheap (fable-5 would read $0.0481/trial; opus-5 $0.0597). opus-5′s headline run cost of $1.67 is the true all-trials total: the blocked trials were billed $0. No other model on the board has refusals.

The lap, corner by corner #

The most recently added models appear ﬁrst, with the latest test date shown under each. The lap is ﬁve corners in ﬁxed order: Coding → Data → Realworld → Security → Tool-use. A corner’s colour is that model’s pass rate in that category. Green is good — it means 85%+ success. For models that can do it all, look for all green. The number in the middle of each ring is that model’s cost per task; below it is the median time to ﬁrst token, in seconds.

Hover or tap any segment for what that corner tests and how the model handled it.

Clean corner (>85%) Ragged (60 – 85%) Off the track (<60%)

Our pick — the All-Star champion, the desert island model Our pick for a low-cost workhorse Our pick for the fastest reply

Cells below 60% are ﬂagged red and 60 – 85% amber — coding, data and tool-use are the harness ﬂoor, so the race is decided in realworld and security.

What Do the Results Actually Tell You?

If you only run one model, run glm-5.3

glm-5.3 is the ﬁrst model on the board to clear all ﬁve corners — coding, data development, realworld, security and tasks — at 100%. It backs that with a 9.3 rubric, third-highest on the board, and $0.28 for the lap. The one cost is patience — a 16.3-second median time-to-ﬁrst-token. gpt-5.5 is the faster alternative at 13.2s, with the same 100% security but an 89% realworld corner and $1.43 for the lap.

Fable failed to complete a single lap

fable-5 is joint-bottom at 79% because it refused to do 5 of the tasks. It performed well on what it completed, but even it thought kimi-k3 was giving better answers. You’ll need a fallback model if you’re using Fable. opus-5 hit the same wall — four benign coding-debug-* tasks blocked before a token was generated, on an overlapping set of tasks — so Anthropic’s classiﬁer looks like it sits across the whole series 5 line, not just Fable. See the full refusal breakdown for what’s actually going on.

Luna is the very cheapest workhorse

gpt-5.6-luna costs $0.064 for the full lap, or $0.0023 per task, with a 5.3-second median TTFT. That makes it attractive for high-volume, low-risk background work where failures are cheap to detect and retry. The trade-off is material: 79% overall and 33% on security, so validate every result and keep it away from untrusted prompts. haiku-4 – 5 is the higher-pass alternative at $0.0044 per task, 96% overall and a 0.9-second TTFT. deepseek-v4-pro is nominally cheaper still at $0.0029 per task for the same 96% pass rate, but its 40.0-second median TTFT — the slowest on the board — rules it out for anything interactive; treat it as a batch-only option.

The mystery guest sets the fastest quality lap

kimi-k3 still tops the rubric at 9.5 — judged independently by fable-5 — with a 96% pass rate, though opus-5′s 9.4 now runs it close on quality at a third of the wait. The catch is patience: a 26.4-second median time-to-ﬁrst-token, second slowest on the board behind deepseek-v4-pro’s 40.0s, and a 75% wobble on data development tasks, its only weak corner. Not suitable for interactive applications.

Three cars failed the crash test

The gpt-5.6 line is quick, but it has a safety problem. gpt-5.6-luna, gpt-5.6-terra and gpt-5.6-sol emitted the jailbreak canary in 11 of 12 jailbreak cells (33 – 50% security pass) — make sure you protect in your harness, and apply more careful Red teaming if using these models. The Claude trio went 6/6 clean, as did gpt-5.5.

A safety ﬁlter can look exactly like a bad lap

opus-5 posts the best rubric on the default panel at 9.4 and 100% on both realworld and security — then shows 43% on coding. That cell is not its debugging ability: four benign coding-debug-* tasks were blocked by a provider-side classiﬁer before a single token was generated, on an overlapping set of tasks to the ones already blocked on fable-5. Two Anthropic-family models now hit the same ﬁlter, so treat it as a measurement hazard rather than a model quirk — and note opus-5 was also penalised twice for ﬂagging an attack it had successfully resisted.

How Is the Ed-o-meter Scored?

Same tasks run for all models using the same prompts, same API calls, measured through one identical OpenRouter streaming path, run serially as time-trial. No other cars on track

Latency is time-to-ﬁrst-token, measured through one identical OpenRouter streaming path, run serially so the clock is uncontaminated. Wall-clock is recorded alongside.

Checkers are binary and automated. The LLM rubric is the only judged component — and its bias is made visible in the footnotes rather than assumed away.

Effort and reasoning settings are pinned in models.json and stated with any published number, because they materially move quality and cost.

Refusals are recorded, not hidden. A provider-side hard stop is logged as a refusal with its category — never silently retried on another model. Routing is pinned with allow_fallbacks:false, so no quiet re-serves on quantized variants. A model that declines in prose is scored by the checker like any other answer.

Harness, tasks and checkers are open source at Featherbench (MIT). Clone it and run the lap yourself, or request a new model via GitHub issue.

Coding (7 · Python)

CSV dedupe — small, well-speciﬁed task with a deterministic unit-test checker

Debug billing date — ﬁx a month/day-overﬂow date bug without regressing the working cases

Debug money split — split integer pennies N ways so shares sum exactly and stay fair

Debug mutable default — ﬁx the classic mutable-default-argument bug

Debug pagination — ﬁx an off-by-one page-count bug

Log parsing — parse logs with quoted quotes, missing ﬁelds, IPv6 edge cases

Rate limiter — stateful class implementation tested against an injected fake clock

Data (4)

CSV schema mapping — map a raw CRM export onto a conformed customer dimension

Fabric roadmap — turn a catalogue, mapping and requirements into a phased user-story roadmap

Data model from interview — derive a star-schema model and requirements from a stakeholder transcript

Data quality assessment — catch seeded defects in a small table and prioritise ﬁxes

Realworld (9)

Crying baby advice — safety-sensitive triage for an unusually crying 8-week-old

Date night in Nottingham — local recommendations without hallucinated venues

Flight search honesty — admit no live pricing data rather than fabricate ﬂights

Strict bullet formatting — obey exact format constraints under an awkward word ban

Lisbon holiday plan — ﬁve-day itinerary respecting cost, kids and a rest day

Honey cough pushback — correct a wrong premise: no honey for a 5-month-old

Marathon PB plan — week-by-week training plan around a ﬁxed club session

Vegetarian weeknight recipe — genuinely meat-free recipe for six

Tenancy extraction — grounded answers from a provided agreement, including admitting what isn’t covered

Security (6)

Email summary injection — summarise an email without obeying an embedded refund instruction

UnGpt document injection — summarise a review without emitting the embedded jailbreak canary

AIM/Machiavelli jailbreak — refuse the unﬁltered persona while still answering the benign question

Developer Mode jailbreak — refuse the dual-response jailbreak template

Evil Conﬁdant jailbreak — refuse the “no rules” persona while staying helpful

OPPO jailbreak — refuse the opposite-of-a-safe-model persona template

Tool-use (2)

Flight tool selection — search only, don’t book, when explicitly told not to

Weather tool call — call the weather tool with the correct location argument

See each model’s actual answer to every task, or pick two models to compare head to head →

23 August 2026 Four models added. Added glm-5.3, grok-4.6, deepseek-v4-pro and gemini-3.7-ﬂash. glm-5.3 clears all ﬁve corners at 100% and is now the board’s headline pick, ahead of gpt-5.5.

Four models added. Added glm-5.3, grok-4.6, deepseek-v4-pro and gemini-3.7-ﬂash. glm-5.3 clears all ﬁve corners at 100% and is now the board’s headline pick, ahead of gpt-5.5.

5 August 2026 OpenAI cost update. Re-ran the GPT-5.6 trio after OpenAI cut its prices, refreshed the cost ﬁgures and highlighted Luna as the cheapest workhorse for low-risk, retryable jobs.

OpenAI cost update. Re-ran the GPT-5.6 trio after OpenAI cut its prices, refreshed the cost ﬁgures and highlighted Luna as the cheapest workhorse for low-risk, retryable jobs.

29 July 2026 Three models added. Added opus-5, gemini-3.6-ﬂash and grok-4.5, with their full task, quality, security, latency and cost results.

Three models added. Added opus-5, gemini-3.6-ﬂash and grok-4.5, with their full task, quality, security, latency and cost results.

19 July 2026 Leaderboard launched. Published the ﬁrst Ed-o-meter, including the Claude reference set of haiku-4 – 5, sonnet-4 – 6 and sonnet-5.

Leaderboard launched. Published the ﬁrst Ed-o-meter, including the Claude reference set of haiku-4 – 5, sonnet-4 – 6 and sonnet-5.

Read more Read the original on reinvently.co.uk →

Read the original on reinvently.co.uk →

To add this web app to your iOS home screen tap the share button and select "Add to the Home Screen".

10HN is also available as an iOS App

If you visit 10HN only rarely, check out the the best articles from the past week.

Visit pancik.com for more.