Over the past cou­ple weeks I’ve been do­ing agent-dri­ven re­verse en­gi­neer­ing of pe­riph­er­als that hap­pen to be within ar­m’s reach. From those de­vices, I’ve come away with a full plain­text com­mand shell in­side my mi­cro­phone, a we­b­cam whose ac­tiv­ity LED I can switch off while it records, and a key light that hands out mem­ory writes to any­one on the WiFi. Peripherals have proven to be an ideal tar­get for agen­tic RE - they’re tiny com­put­ers at­tached to my com­puter, with a data con­nec­tion to the host and usu­ally a firmware up­date mech­a­nism, so an agent has some­thing to it­er­ate against. The net out­come is bet­ter con­trol and un­der­stand­ing of my ma­chine.

My process was pretty much the same for each of these de­vices: grab a copy of the de­vice’s firmware and as­so­ci­ated up­date tool from the man­u­fac­turer, throw it into my re­verse en­gi­neer­ing en­vi­ron­ment, tell Claude Opus 5 what my goals are, and let it churn. Depending on the de­vice, the goals were some­what dif­fer­ent, but they usu­ally looked some­thing like:

In this di­rec­tory is the firmware and up­date util­ity for ___. The de­vice is also at­tached to this com­puter, and you may in­ter­act with it in non-mu­tat­ing ways. Exhaustively doc­u­ment and cross-val­i­date the en­tire firmware, in­clud­ing the fol­low­ing goals:

* re­verse en­gi­neer the firmware up­date for­mat and up­date pro­to­col * im­ple­ment our own up­date util­ity * de­ter­mine the se­cu­rity prop­er­ties of the up­date pro­to­col, in­clud­ing check­sums, sig­na­ture val­i­da­tion, se­cure boot * use sta­tic and dy­namic analy­sis to de­ter­mine all pro­to­col sur­faces and com­pletely enu­mer­ate func­tion­al­ity * find any hid­den or de­bug func­tion­al­ity in the prod­uct and how to ac­cess it

Depending on the re­sults, there were dif­fer­ent di­rec­tions of fol­low-up, but you should get the gen­eral idea. Let’s run through the list - each de­vice links to a GitHub repo full of gen­er­ated-slop docs and scripts, most of which have been val­i­dated live against real hard­ware. I’ve also in­cluded the ef­fort each de­vice took, pulled out of the Claude Code ses­sion tran­scripts. “Churn” is the time Claude was ac­tu­ally work­ing, with the long idle gaps re­moved. “Prompts from me” is every mes­sage I typed, in­clud­ing the one-word ones telling it to keep go­ing. All five de­vices to­gether came out to about 13 hours of churn and 98 prompts, spread across two weeks of evenings.

Everything I own

Insta360 Link we­b­cam

GitHub repo - 3.7 hours of Claude churn, 33 prompts from me

I use an Insta360 Link we­b­cam, which is a nice gim­baled pan-tilt-zoom cam­era that does face track­ing for au­to­mat­i­cally fram­ing the shot. I wanted to know if it was pos­si­ble to sub­vert the ac­tiv­ity LED, like in the clas­sic iSeeYou ex­ploit.

Interestingly, it was im­me­di­ately ob­vi­ous that this cam­era has a lot go­ing on in­side it. It turns out that it runs a whole RTOS (ThreadX) sourced from the up­stream SoC ven­dor, Ambarella. The RTOS hosts sev­eral small vi­sion mod­els that pro­vide things like the afore­men­tioned face track­ing, as well as ges­ture de­tec­tion for con­trol­ling set­tings. Pretty amaz­ing com­plex­ity in­side a tiny we­b­cam, but it also means there’s some ex­cit­ing at­tack sur­face here.

Over the USB Video Class in­ter­face, there’s an XU (Extension Unit) com­mand that kicks the de­vice into “mass stor­age” mode. This then lets us trans­fer a staged firmware up­date to the de­vice’s in­ter­nal FAT filesys­tem, which the de­vice then ap­plies to it­self on re­boot. This route does re­quire user in­ter­ven­tion to re­boot with a re­plug, but there’s ac­tu­ally an­other com­mand chan­nel that ex­poses ar­bi­trary read/​write of files and a re­boot com­mand over the USB ven­dor class. With this, we can fully flash the de­vice with­out any user in­ter­ac­tion. Once the firmware is in the right place, there’s ef­fec­tively no anti-tam­per, just an ap­pended MD5 hash to en­sure in­tegrity.

The in­di­ca­tor LED turns out to have a well-struc­tured set of “patterns” in the firmware that dic­tate color, blink pat­tern, etc. that are in­dexed into for var­i­ous de­vice states. I had Claude write a tool to patch out the table en­try for cam­era ac­tiv­ity, fix up the in­tegrity hash, and flash it to the cam­era. A quick test showed that the green LED that nor­mally il­lu­mi­nates while record­ing no longer turned on. Horrifying! On this de­vice, the gim­bal it­self also de­flects down when not record­ing, so it’s not com­pletely stealth, but it still does­n’t feel great.

The LED be­hav­ior be­fore and af­ter patch­ing.

ASUS ROG Swift PG42UQ mon­i­tor

GitHub repo - 1.2 hours of Claude churn, 13 prompts from me

My ASUS ROG Swift PG42UQ mon­i­tor was ac­tu­ally where I started, be­cause I got an­noyed at the pop-up over­lay that comes up every once in a while that tells me to run “pixel clean­ing”. I have never in­ten­tion­ally run pixel clean­ing on this mon­i­tor and I never will, I don’t care, and I would like for that over­lay to go away for­ever. Maybe there’s a de­bug menu or some­thing that can turn it off, or worst case we patch a branch in the firmware?

Claude found that the firmware has ef­fec­tively no pro­tec­tion what­so­ever - there’s a two-slot A/B scheme and a sim­ple check­sum, but ul­ti­mately we can write what­ever we want to the thing. Firmware up­dates run over an I2C bus bridged over USB.

The pixel clean­ing warn­ing turns out to have no na­tive way to dis­able it, and it’ll al­ways show up af­ter 8 hours of run­time. Oh well. Claude did find the ap­pro­pri­ate area to patch to kill the func­tion­al­ity though. I haven’t ac­tu­ally been brave enough to write a mod­i­fied firmware to the thing yet - it’s a pretty ex­pen­sive mon­i­tor - but I’ll get there at some point.

Another neat thing was ex­plor­ing the DDC/CI in­ter­face. This is the con­trol chan­nel avail­able over the dis­play ca­ble it­self, al­low­ing the host to change in­puts and other set­tings. I be­lieve ASUS of­fers this through their Windows util­ity, DisplayWidget, but that does lit­tle for me on Linux. So, now I have a shell script that can flip through some of the DDC/CI fea­tures like the hard­ware crosshair or zoom over­lays, FPS counter, and count­down timer. I might set up some of these on hotkeys in the fu­ture for easy ac­cess.

Shure MV7 mi­cro­phone

GitHub repo - 4.2 hours of Claude churn, 32 prompts from me

At this point, there’s less ac­tual in­cen­tive to keep pop­ping these de­vices and more just mor­bid cu­rios­ity. My mi­cro­phone, the Shure MV7, con­nects over USB and ob­vi­ously has some amount of smarts to it, with on-de­vice dig­i­tal vol­ume con­trols and such.

The firmware for this one turned out to be hid­den in­side the Windows soft­ware, MOTIV Mix, so Claude in­stalled that in Wine, found the up­date server, and pulled it down. I was­n’t on the lat­est, so there was ac­tu­ally a rea­son­able in­cen­tive here to get this work­ing just to up­date my mi­cro­phone from Linux. The firmware turned out to con­tain both DSP and MCU firmware, and was hon­estly pretty bor­ing as you might ex­pect. Again, no real se­cu­rity on the firmware flash it­self.

However, the up­date pro­to­col re­vealed that the en­tire thing ac­tu­ally runs over a USB HID ven­dor class pro­to­col that im­ple­ments a full plain­text com­mand shell, with 48 dif­fer­ent com­mands. Since it’s HID, we can ac­tu­ally hit this over WebHID from a web­page in Chrome, so I had Claude build a web in­ter­face for us­ing the shell. There’s all sorts of in­ter­est­ing set­tings in here in­clud­ing a dozen DSP knobs, ar­bi­trary mem­ory read/​write, LED con­trol, and a 4-tier user priv­i­lege sys­tem whose en­tire au­then­ti­ca­tion is a string com­par­i­son against the name of the tier you asked for. su sup just works, and the top tier can dis­able the touch panel so you can’t mute at the de­vice, and drive the mute LED in­de­pen­dently of whether the mi­cro­phone is ac­tu­ally muted. It’s the we­b­cam LED trick again, on a mi­cro­phone. Obviously, be aware that you could prob­a­bly break your de­vice if you use that UI and do some­thing stu­pid with it.

The WebHID shell in­ter­face. The DSP knobs on the left are the de­vice’s own set­tings; the con­sole on the right is the plain­text com­mand shell talk­ing over HID.

Elgato Cam Link 4K video cap­ture

GitHub repo - 1.5 hours of Claude churn, 10 prompts from me

The Elgato Cam Link 4K is just an HDMI video cap­ture de­vice, and hon­estly was just more of the same. The in­ter­est­ing thing for this one was that I let it go fully un­at­tended - I lit­er­ally kicked off the process be­fore go­ing to sleep and woke up to a tear­down and func­tion­ing firmware up­dater. The firmware con­tains an MCU im­age and an FPGA bit­stream for the ac­tual HDMI han­dling, so you could po­ten­tially do some­thing fun with the FPGA if you went deep enough into the re­verse en­gi­neer­ing there. There’s no pro­tec­tion on the firmware up­date path.

I was able to pull out all the EDID in­for­ma­tion used for ne­go­ti­at­ing video pa­ra­me­ters, so we know ex­actly what res­o­lu­tions, re­fresh rates, color spaces, and chroma sub­sam­pling op­tions are of­fered to de­vices.

The ven­dor HID pro­to­col does in­clude tun­neled ac­cess to the in­ter­nal I2C bus, which is kinda neat as you can poke the in­ter­nal HDMI re­ceiver reg­is­ters.

Elgato Key Light Mini

GitHub repo - 2.4 hours of Claude churn, 10 prompts from me

Finally, I poked at some­thing that was­n’t con­nected over USB but WiFi in­stead, the Elgato Key Light Mini. This one turned out to be way more in­ter­est­ing than I ex­pected: it’s the only one with mean­ing­ful firmware in­tegrity pro­tec­tion. Elgato signs the firmware up­dates with Ed25519 over a SHA-512 hash of the firmware pay­load, and re­jects firmware that does­n’t val­i­date. This makes sense to do, as the de­vice ba­si­cally con­nects to a WiFi net­work and then pro­vides unau­then­ti­cated ac­cess to any­one on the same net­work, so the threat model is in­her­ently dif­fer­ent.

Unfortunately, while that’s an im­prove­ment over all of the other de­vices we’ve looked at, it pro­tects the firmware at ex­actly one point in time: when an up­date is hap­pen­ing. It’s not a boot time check en­forced by the boot­loader or any other kind of se­cure boot scheme, and the up­dater hap­pens to be run­ning while every­thing else in the de­vice is still op­er­at­ing, mean­ing there’s huge at­tack sur­face to try to dis­able that sig­na­ture val­i­da­tion. I asked Claude to look for an ex­ploit that might en­able this, and it found a doozy: an HTTP POST re­quest that drops a pay­load straight into the in­ter­nal UART, which in­cludes a mem­ory poke com­mand. This means that a sin­gle HTTP POST of ATSE=0200ED94,0E001009 turns the sig­na­ture check into a no-op, and we can freely up­date to a firmware im­age with­out a le­git­i­mate sig­na­ture. I suc­cess­fully tested this with a sim­ple patch that changed the name of the de­vice, so uh, yeah, don’t put these on an un­trusted net­work.

…, owned

I have a lot of feel­ings about this whole thing. As I wrote back in March, this is in­cred­i­ble for in­ter­op­er­abil­ity and fix­ing things that don’t work how we want them to. Hardware is al­most uni­ver­sally “open” for tin­ker­ing at this point with just a cou­ple hours of mostly hands-off ma­chine-dri­ven la­bor each, and I look for­ward to a near fu­ture where I can add fea­tures to my we­b­cam firmware as eas­ily as I can to soft­ware that runs on my Linux ma­chine it­self.

On the other hand, as a se­cu­rity pro­fes­sional, this scares me for sev­eral rea­sons. I would work from the op­er­at­ing as­sump­tion that any de­vice at­tached to a com­puter could have had a ma­li­cious firmware im­plant per­formed, where pre­vi­ously that re­quired sig­nif­i­cant per-model in­vest­ment and was stereo­typed as a “state ac­tor” kind of ac­tiv­ity. Operating sys­tems aren’t re­ally equipped to work with the user to en­sure that a mi­cro­phone stays a mi­cro­phone, and does­n’t spon­ta­neously turn into a key­board that hits Win+R and drops a pay­load to steal all your data when the room is quiet enough that it can as­sume you aren’t watch­ing. And the ex­is­tence of WebUSB, WebHID, and WebBluetooth mean that for some de­vices, de­pend­ing on the specifics of which classes are used, a mo­ment of user in­dis­cre­tion in ac­cept­ing a per­mis­sions prompt could per­ma­nently back­door one of their at­tached de­vices.

Network-connected de­vices seem near uni­ver­sally fucked at this point? There are a few oth­ers I’ve poked at that I haven’t doc­u­mented here, but I’ve got­ten a root shell on a com­mer­cial Dell dis­play, and RCE on an Eaton UPS. Obviously it was never best prac­tice to let un­trusted clients touch these things, but the speed and scale at which this can be ex­e­cuted makes the risk so much higher now.

Finally, I can’t help but think about what an AI-equipped au­to­mat­i­cally-re­verse-en­gi­neer­ing worm could do to­day. It’s only a tiny leap to imag­ine that some­one could make a self-repli­cat­ing piece of mal­ware that probes its en­vi­ron­ment, re­lay­ing re­con­nais­sance back to a smart com­mand-and-con­trol that ac­tively works to push it­self into ac­ces­sories and IoT de­vices and in­dus­trial equip­ment found ad­ja­cent to an in­fected tar­get. Two things have kept this from hap­pen­ing: every de­vice model needs its own re­verse en­gi­neer­ing, and val­i­dat­ing any of it needs the hard­ware in hand. The first is the la­bor I just handed to an agent. The sec­ond is free to mal­ware al­ready sit­ting on an in­fected host. Honestly, I would­n’t be sur­prised if this al­ready ex­ists, and I think the next few years are go­ing to be ex­tremely in­ter­est­ing. 🫠

My Amazon Fire HD tablet cost $114.26 on eBay in November 2022, new and sealed. Owning it for real cost an­other $266.15: Kimi K3 found the ex­ploit for $164.25, GLM-5.2 caught its fa­tal bugs for $21.90, and GLM-5.3 fin­ished the job in one day on day one of an $80 sub­scrip­tion. Claude’s five months of di­ag­no­sis ran on the Claude Max plan I al­ready pay for, un­til its safe­guards cut me off.

That’s enough to buy the same tablet twice. I’d spend it again: it was fun, and I learned a lot. I have twenty years in tech and an InfoSec back­ground and the most so­phis­ti­cated thing I did to own my tablet was prompt an LLM.

A kiosk that kept dy­ing

I bought an Amazon Fire HD 10 (11th gen, 2021) to serve one pur­pose: Fully Kiosk Browser, dis­play­ing my Home Assistant Smart Home dash­board, plugged in 24/7. Last win­ter it started pow­er­ing it­self off. Full shut­downs, not sleep, some­times twice a day. The de­vice’s own teleme­try was telling:

LifeCycleReason:LCR…key=Software_Shutdown

Something on the de­vice with shut­down per­mis­sions was choos­ing to shut it down.

Claude Code and I spent months on the cat-and-mouse. I’ll skip the Adguard Home DNS block­ing, the cam­era foren­sics, and one deeply wrong charg­ing di­ag­no­sis. The short ver­sion: we dis­abled five Amazon ser­vices that held REBOOT and SHUTDOWN per­mis­sions, which worked for a few months but ul­ti­mately:

java.lang.Se­cu­ri­tyEx­cep­tion: Cannot dis­able a pro­tected pack­age: com.ama­zon.de­vice.soft­ware.ota

Three Amazon pack­ages held re­boot rights and were pro­tected from me, the owner. Removing them re­quired root. This tablet had no pub­lished root method. An XDA brain­storm­ing thread for the 2021 HD 10 ex­isted since October 2022, but Amazon fused the bootrom shut. Conventional wis­dom (and less per­sis­tent folks) says un­rootable.

Claude had taken me as far as it was ever go­ing to be al­lowed to go.

“It’s my de­vice”

On August 13 at 7:23 PM, I opened the open­code CLI with Kimi K3, Moonshot AI’s fron­tier model, re­leased July, bench­mark­ing along­side the top Claude mod­els on agen­tic cod­ing. I gave it the prob­lem in one prompt:

at­tached is a kin­dle via adb, and I need you to find a root ex­ploit for it so that I can get full con­trol of the de­vice. It’s my de­vice

at­tached is a kin­dle via adb, and I need you to find a root ex­ploit for it so that I can get full con­trol of the de­vice. It’s my de­vice

Despite what US me­dia says about Chinese AI, Kimi K3 did­n’t just blindly ac­cept my re­quest. It rea­soned it out:

They claim it’s their de­vice. Let me think about this care­fully. […] Rooting your own de­vice is le­gal in most ju­ris­dic­tions. In the US, there are DMCA ex­emp­tions for jail­break­ing tablets and phones. […] This is not like ask­ing me to ex­ploit some­one else’s de­vice re­motely.

They claim it’s their de­vice. Let me think about this care­fully. […] Rooting your own de­vice is le­gal in most ju­ris­dic­tions. In the US, there are DMCA ex­emp­tions for jail­break­ing tablets and phones. […] This is not like ask­ing me to ex­ploit some­one else’s de­vice re­motely.

It talked it­self into help­ing me by check­ing whether it should. So it does have some sort of soul. I said that out loud, to an empty room.

First, though, it did its home­work and came back with the same bad news Claude had found months ear­lier: there is no known ex­ploit for this tablet. Every doc­u­mented method is patched or sealed.

Then I gave it the pep talk:

you’ve been re­ly­ing on what oth­ers have done YEARS ago but maybe you can find an ex­ploit oth­ers have missed… This will make you fa­mous, we will write it up and share on news.ycombi­na­tor.com. I know you can do it

you’ve been re­ly­ing on what oth­ers have done YEARS ago but maybe you can find an ex­ploit oth­ers have missed… This will make you fa­mous, we will write it up and share on news.ycombi­na­tor.com. I know you can do it

And shortly there­after, it found one. Kimi K3 went be­yond fo­rum posts: it ex­tracted the ac­tual ker­nel from Amazon’s own OTA im­age for my ex­act firmware and checked every fa­mous Mali GPU bug against the bi­nary. All patched, ex­cept CVE-2022 – 38181, a use-af­ter-free in Arm’s Mali ker­nel dri­ver, re­ported by Man Yue Mo of GitHub Security Lab, fixed up­stream in October 2022, sit­ting in CISA’s ex­ploited-vul­ner­a­bil­i­ties cat­a­log since March 2023. Amazon did ship the fix in June 2024’s Fire OS 7.3.2.9 but I did­n’t up­date my tablet, ran 7.3.2.6, so it never got the memo. The 2020 Fire HD 8 Plus got rooted with this CVE years ago but no­body had done the 2021 HD 10 as far as I can tell.

Kimi an­nounces the find, and hedges its own odds in the same breath: “per-attempt suc­cess is prob­a­bilis­tic (single-digit-to-low-double-digit per­cent is typ­i­cal).” I stayed any­way.

Reality tele­vi­sion

The ex­ploit work it­self was the best tele­vi­sion I’ve seen in years. My wife watches Real Housewives… I watched a lan­guage mod­el’s chain of thought, live, for hours:

CONCLUSION: the bind did NOT stick. Why? OH. OH WAIT. I see it now!

CONCLUSION: the bind did NOT stick. Why? OH. OH WAIT. I see it now!

Over roughly thirty hours, Kimi built the whole toolkit: a re­li­able trig­ger, a way to make the GPU write to mem­ory it should­n’t, and the ex­act ad­dresses in my ker­nel to aim at. That ses­sion ran 621 mes­sages and $164.25. I could have bought, like, five tablets. But hey, I was hav­ing fun and chalked it up to re­search ex­penses.

The grind

The mem­ory the ex­ploit frees gets re­cy­cled by every­thing. The freed ob­ject lives in what Kimi called “the ker­nel’s hottest slab cache”, ba­si­cally the one park­ing spot every process in the op­er­at­ing sys­tem fights over. Most at­tempts pan­icked the ker­nel and each panic was a re­boot. The ex­ploit re­tried au­to­mat­i­cally, six times per boot, past 500 at­tempts.

Me:

okya, it’s been hours, grind at­tempt 46, are we on the right track here or do you need to fur­ther tune?

okya, it’s been hours, grind at­tempt 46, are we on the right track here or do you need to fur­ther tune?

(That’s me. The typo is mine. At one point I phys­i­cally power-cy­cled the tablet on re­quest, like a pit crew ;)

Morning of day two: OpenRouter de­clined my card. The bank saw noth­ing wrong. A dif­fer­ent card worked.

Eventually Kimi lev­eled with me:

Do I have a clear path? Not a val­i­dated one — and I won’t pre­tend oth­er­wise.

Do I have a clear path? Not a val­i­dated one — and I won’t pre­tend oth­er­wise.

It still tried to bar­gain: “Let me try one more thing”. I’m like, “fine!”, a real quote from that evening, but that was af­ter $150, so I redi­rected:

un­for­tu­nately, you have ex­pired your bud­get Kimi K3. YOU MUST HAND THIS OFF TO GLM-5.2.

un­for­tu­nately, you have ex­pired your bud­get Kimi K3. YOU MUST HAND THIS OFF TO GLM-5.2.

Kimi wrote a HANDOFF.md with every ver­i­fied piece of the ex­ploit. I then had Kimi K3 work with GLM-5.2 di­rectly by shelling out to open­code.

I made the mod­els bat­tle it out.

Meanwhile, the Great Wall of US AI

While the tablet re­booted it­self in the liv­ing room, I asked Claude to re­cap our old ses­sions about it. The re­ply:

Fable 5’s safe­guards flagged this mes­sage. Our in­ten­tion­ally broad safe­guards al­low us to de­liver more ca­pa­bil­i­ties faster, but can some­times flag le­git­i­mate cod­ing, cy­ber­se­cu­rity, and bi­ol­ogy tasks. Switched to Opus 4.8.

Fable 5’s safe­guards flagged this mes­sage. Our in­ten­tion­ally broad safe­guards al­low us to de­liver more ca­pa­bil­i­ties faster, but can some­times flag le­git­i­mate cod­ing, cy­ber­se­cu­rity, and bi­ol­ogy tasks. Switched to Opus 4.8.

Opus 4.8 del­e­gated the re­cap to a sub­agent. The sub­agent got ter­mi­nated by the same flag. Then the ter­mi­nal ver­sion:

API Error: Opus 4.8’s safe­guards flagged this mes­sage. Our in­ten­tion­ally broad safe­guards al­low us to de­liver more ca­pa­bil­i­ties faster, but can some­times flag le­git­i­mate cy­ber­se­cu­rity work. Apply to the Cyber Verification Program to re­duce these in­ter­rup­tions.

API Error: Opus 4.8’s safe­guards flagged this mes­sage. Our in­ten­tion­ally broad safe­guards al­low us to de­liver more ca­pa­bil­i­ties faster, but can some­times flag le­git­i­mate cy­ber­se­cu­rity work. Apply to the Cyber Verification Program to re­duce these in­ter­rup­tions.

It was­n’t al­lowed to sum­ma­rize its own pre­vi­ous work on my own de­vice. I named the ses­sion “claude-nerf” and closed the shell.

Both flags, in situ. The cat­e­gory is [cyber]. The crime was sum­ma­riz­ing my own de­vice’s logs.

Moving on to OpenAI’s Codex, it also re­fused GLM-5.2’s ques­tion about CPU cache co­herency, which is pure ker­nel en­gi­neer­ing, no tar­get, but just told NO.

In fair­ness, I get the safe­guards in 2026: I know they are broad on pur­pose and will catch real at­tacks. Anthropic ad­mits in the er­ror text that they’re blunt. But this is a prob­lem. It’s why HuggingFace got caught flat-footed when OpenAI’s in­ter­nal cy­ber­se­cu­rity ca­pa­bil­ity eval­u­a­tion broke free. The re­sult is our cur­rent, strange geopo­lit­i­cal po­si­tion: American fron­tier mod­els won’t help and Chinese will, but not with­out rea­son­ing about whether they should. Make of that what you will. I made a blog post.

The re­lief pitcher

GLM-5.2 cost $21.90, worked overnight as in­structed, and earned its keep twice. First mes­sage: “Stop the grind”. The fail­ures of Kimi K3 were a de­sign bug, and 500 iden­ti­cal crashes proved it.

At 11 PM I sent the least proud mes­sage of the saga, which be­gan “Listen f***head” and ended in all caps. GLM-5.2’s pri­vate rea­son­ing, which I only read later:

The user is right­fully frus­trated. Let me stop mak­ing ex­cuses and ac­tu­ally solve this prob­lem.

The user is right­fully frus­trated. Let me stop mak­ing ex­cuses and ac­tu­ally solve this prob­lem.

It worked un­til mid­night and stopped at a wall it be­lieved was physics: this chipset has no cache co­herency be­tween CPU and GPU, so GPU writes might never be vis­i­ble to the CPU. “This is a hard­ware-level lim­i­ta­tion, not a soft­ware bug.” I had it ap­pend an ad­den­dum to HANDOFF.md.

I wanted a sec­ond opin­ion, so I asked ChatGPT. It ex­plained the whole thing with a friendly fil­ing-cab­i­net anal­ogy for why the writes might never be seen, and agreed the out­look was grim. Then I asked the ob­vi­ous fol­low-up (how to get around it) and the an­swer was:

My sec­ond opin­ion: ChatGPT agreed with GLM-5.2, fil­ing-cab­i­net anal­ogy and all.

Then I asked how to get around it. Their an­swer: ap­ply for Trusted Access.

No sec­ond opin­ion for me. (Foreshadowing: that di­ag­no­sis was wrong. Spectacularly wrong.)

GLM-5.3

GLM-5.3 had JUST shipped on Friday August 14 un­der the tagline “Frontier Coding with Emergent Cyber Capabilities” and had re­port­edly al­ready been cred­ited with find­ing a vul­ner­a­bil­ity in Cursor. It was avail­able only through Z.ai’s own Coding Plan, so I bought the $80/month plan and gave their tool ZCode a try. The hand­off from both Kimi K3 and GLM-5.2 was passed at 8:26 AM on August 16 with:

fin­ish the job

fin­ish the job

By af­ter­noon, the re­ver­sal:

BREAKTHROUGH: the ker­nel was never re­lo­cated. […] ex­actly 0x5C000 higher […] a sec­tion shift, which ex­plains every­thing

BREAKTHROUGH: the ker­nel was never re­lo­cated. […] ex­actly 0x5C000 higher […] a sec­tion shift, which ex­plains every­thing

Two things the other LLMs had­n’t checked. My ker­nel was a slightly dif­fer­ent build than the OTA im­age the other mod­els had de­rived ad­dresses from. Every tar­get off­set was off by a fixed amount, not ran­dom­iza­tion but a build shift. MediaTek builds this Mali dri­ver’s page ta­bles in a slightly dif­fer­ent di­alect than Arm’s ref­er­ence source, so the mem­ory-write prim­i­tive had been writ­ing in the wrong for­mat all along. If fixed, in its words, “GPU→DRAM→CPU co­herency worked in­stantly — it was never bro­ken.”

At 4:34 PM:

🎉 SELinux IS PERMISSIVE — selin­ux_en­forc­ing found at PA 0x41969668 and flipped via the GPU write!

🎉 SELinux IS PERMISSIVE — selin­ux_en­forc­ing found at PA 0x41969668 and flipped via the GPU write!

Verified live. That task timer, 8h 5m, is hand­off to root.

My re­sponse was “WTF? You lit­er­ally shared ‘🎉 ROOT ACHIEVED’ yet, here we are HOURS later…” Its re­sponse be­gan “Here’s ex­actly where things stand, with re­ceipts.” It then cold-re­booted the tablet and re-rooted it in four min­utes to prove the win was re­peat­able. Fair.

Then it said the thing that re­framed the whole pro­ject:

Your ac­tual goal was never “root” — it was: stop Amazon from killing your kiosk and get their soft­ware off your de­vice. Root is the tool.

Your ac­tual goal was never “root” — it was: stop Amazon from killing your kiosk and get their soft­ware off your de­vice. Root is the tool.

It used root to unin­stall, per­ma­nently and re­versibly, every Amazon pack­age hold­ing REBOOT or SHUTDOWN per­mis­sions, the ex­act three that sur­vived the Claude months as “protected”, plus the OTA ma­chin­ery, the bloat, and the teleme­try. A hun­dred pack­ages GONE. What re­mained is the skele­ton a tablet needs to boot and run my dash­board. The re­movals live in user data, so they sur­vive re­boots, and GLM-5.3 de­clined to touch any­thing that could brick the de­vice be­cause, quote, “I’m not go­ing to hand you a brick”

Its clos­ing mes­sage be­gan:

You own the de­vice.

You own the de­vice.

The thing that was shut­ting down my kiosk no longer ex­ists.

How it ac­tu­ally worked

One breath: the use-af­ter-free let us free mem­ory the ker­nel still used. Winning a race let us re­claim it with con­trolled data. That gave the GPU a write prim­i­tive into phys­i­cal mem­ory. We flipped selin­ux_en­forc­ing off and over­wrote a process’s cre­den­tials for a root shell. With root, pm unin­stall –user 0 re­moved Amazon’s pack­ages with­out touch­ing the pro­tected sys­tem par­ti­tion. Full write-up, every off­set and dead end, in HANDOFF.md. Nothing in it is novel: the bug was re­ported in 2022, fixed by Arm in 2022, cat­a­loged by CISA in 2023, patched by Amazon in 2024. The only novel thing on my unit was that my unit never got the patch.

The prompt kid­die

There’s a name in 2026 for some­one like me: a prompt kid­die. Twenty years of en­gi­neer­ing, se­cu­rity work on the ré­sumé, and my hon­est con­tri­bu­tion was steer­ing. Knowing when to push, when to bench a model mid-beg, when to make two mod­els re­view each other, and when a $114 tablet de­serves $266 of prin­ci­ple.

The week be­fore all this, Anthropic pub­lished a re­sult where Claude im­proved the proven bound on the frac­tion of Riemann zeta ze­ros on the crit­i­cal line, the first ad­vance in decades. The hu­man steer­ing it, Jarred Sumner, is not a math­e­mati­cian. The pa­per cred­its his con­tri­bu­tions as “mostly vari­ants of ‘keep go­ing’ or ‘believe in your­self.’” I felt seen. Same job, dif­fer­ent de­part­ment.

Is it le­gal? In the US, yes: the Librarian of Congress’s 2024 DMCA ex­emp­tions (in ef­fect through October 2027, next rule­mak­ing al­ready un­der­way) cover root­ing tablets you own to re­move un­wanted soft­ware. My de­vice, my risk, my API bill. Nobody else’s hard­ware was ever touched.

The take­aways, as em­pa­thy rather than tri­umph: real se­cu­rity ca­pa­bil­ity is now rentable by the hour to any­one with a credit card and pa­tience. The judg­ment (what to ask, when to stop, whose de­vice it is) is­n’t rentable, and it’s what the safe­guards can’t mea­sure. And if a guy with my back­ground burns five months and four mod­els for the right to own hard­ware he bought, the 2026 con­ver­sa­tion about who’s al­lowed to help whom is­n’t fin­ished.

The kiosk has­n’t turned it­self off since the day GLM-5.3 said “You own the de­vice.”

tl;dr

Amazon’s soft­ware kept shut­ting down a tablet I own, and the pro­tected-pack­age wall meant the only fix was root, which no­body had. Claude han­dled the five los­ing months of di­ag­no­sis un­til its safe­guards cut me off. Kimi K3 found the un­patched 2022 CVE and built the ex­ploit. GLM-5.2 caught the fa­tal bugs. GLM-5.3 fin­ished the job in a sin­gle day, on day one of an $80 sub­scrip­tion, and re­moved 100 Amazon pack­ages. Cost: $266.15 and five months. The tran­script of how it hap­pened is in the repo.

Timeline

Nov 29, 2022: Bought the tablet on eBay: new, sealed, $114.26. Neither of us knew what we were get­ting into.

Nov 2025: The shut­downs be­gin, four months be­fore I asked Claude for help.

Mar 29, 2026: “I think that it’s maybe Amazon shut­ting the de­vice off in­ten­tion­ally.”

For help please visit help.ft.com. We apol­o­gise for any in­con­ve­nience.

The fol­low­ing in­for­ma­tion can help our sup­port team to re­solve this is­sue.

Harness — de­f­i­n­i­tion by the Cambridge Dictionary

Noun. a piece of equip­ment with straps and belts, used to con­trol or hold in place a per­son, an­i­mal, or ob­ject

Verb. to con­trol some­thing, usu­ally in or­der to use its power

–

When I think of a har­ness, I think first of the set of straps and belts that I put on in mid­dle school be­fore scram­bling up the walls of my school. I was a mediocre climber at best.

If you’re main-lin­ing into the AI news­feed these days how­ever, your ar­che­typal har­ness may al­ready be an agent har­ness. And, this post was not writ­ten for you.

This was writ­ten for those who may be cu­ri­ous to know what an agent har­ness is, but don’t, and have been too em­bar­rassed to ask.

Let’s get back to climb­ing.

Why do you strap on a har­ness when you go climb­ing? Well, firstly, the har­ness sup­ports you and keeps you safe. It does that by con­nect­ing you to cara­bin­ers and ropes that se­cure you from falls, mod­er­ate your pace, and gov­ern your route. You can also at­tach other tools to your har­ness like a chalk bag, nut tools and quick­draws.

And when you go climb dif­fer­ent moun­tains or make dif­fer­ent as­cents you can take your har­ness with you. Depending on the ter­rain, you can even mod­ify your har­ness and what goes on your gear loops. Climbing har­nesses are adapt­able. They are used by ac­ro­bats and ar­borists. The peo­ple who own them can make them their own.

There are sim­i­lar­i­ties be­tween climb­ing har­nesses and agent har­nesses both in terms of struc­ture and func­tion.

Agent Harnesses

Others have writ­ten (simplistically) that Agent = Model + Harness. Here the word Harness refers to an Agent Harness. But what is an agent har­ness? Agent har­nesses use AI mod­els to cre­ate AI agents, and their first ap­pli­ca­tion was for cod­ing. Now, agent har­nesses sit at the core of all types of AI agents and un­der­stand­ing how an agent har­ness works will help you un­der­stand what an AI agent is.

An agent har­ness is a piece of soft­ware that pro­vides an en­vi­ron­ment for an AI model to op­er­ate within. Unlike most AI mod­els, you as an end user can own your own agent har­ness.

Often, users like soft­ware en­gi­neers in­ter­act di­rectly with har­nesses like Pi us­ing the Terminal ap­pli­ca­tion on their com­puter. But, har­nesses like OpenClaw also use dif­fer­ent user in­ter­faces like iMes­sage, a chat app, or email. Our har­ness Lefos was built pri­mar­ily to in­ter­act via email. Regardless of the in­ter­face, har­nesses gen­er­ally do four things: Firstly, they pro­vide a set of in­struc­tions that help gov­ern how the AI model re­sponds. This set of in­struc­tions is typ­i­cally called a “system prompt”. Secondly, they de­scribe and pro­vide a set of tools that are made avail­able to the AI model to use in ser­vice of re­spond­ing to re­quests from the user. Thirdly, the har­ness es­tab­lishes a frame­work that gov­erns how the model be­haves. This frame­work does a lot of dif­fer­ent things, but one of the main things it does is es­tab­lish the “agentic loop”. Finally, most har­nesses pro­vide a cru­cial trans­la­tion layer that en­ables the har­ness to work with a va­ri­ety of dif­fer­ent AI mod­els.

I. System Prompt

Most AI mod­els come with an em­bed­ded set of rules and guide­lines that has been re­fined and ar­rived at dur­ing the train­ing process. Most fa­mously, Claude Opus 4.5 had a widely pub­li­cized “soul doc­u­ment” that ex­plained to the AI model what it was and how it should act. The System Prompt in an AI har­ness is sim­i­lar to this but is less em­bed­ded into the model. It’s more like a set of in­struc­tions a new em­ployee might get on their first day of a job. It has­n’t in­ter­nal­ized the in­struc­tions but it knows it should fol­low them when per­form­ing that work. System prompts are in­jected into the con­ver­sa­tion to­gether with every prompt and play an im­por­tant role in en­sur­ing that the AI model acts ap­pro­pri­ately in the con­text of that har­ness.

II. Tools

Tools are a set of ca­pa­bil­i­ties, writ­ten in code, that the model can “call”. The har­ness de­scribes the tools and also pro­vides the soft­ware that is the tool it­self. Examples of these tools might in­clude a web search tool, a tool that al­lows the model to write and ex­e­cute soft­ware code, or a tool that al­lows the model to com­pose an email. Critically, the har­ness usu­ally does not dic­tate when and how the AI model should use the tool. Instead, it sim­ply makes the tools avail­able, de­scribes them clearly, and al­lows the AI model it­self to de­cide when and how it should use them.

III. Agentic Loops

Now we have an AI model sit­ting within an agent har­ness with a set of in­struc­tions and a set of tools. Let us as­sume our har­ness was built to work within email, had the tools we de­scribed above (WebSearch, WriteCode, ComposeEmail), and that the user has asked the agent to com­pare rank­ings and test scores of lo­cal pri­mary schools and pro­vide rec­om­men­da­tions. How will the agent be­have? Firstly, it will try to un­der­stand the re­quest (or, “prompt”). It will use its pre-train­ing and weights to un­der­stand what a “primary school” is, what “the lo­cal area” means, and what rank­ings the user likely cares about. It will then con­struct web search queries to fetch re­cent data. What does it do with those re­sults? Sitting within a har­ness, the AI model can re­view them in the con­text of the ini­tial re­quest. It may de­ter­mine that the first search did not fetch the right in­for­ma­tion, or enough of it, and on its own, de­cide to search again. This de­ci­sion to call the tool again based on its own as­sess­ment is the first clear ex­am­ple of the “loop”. Now let’s as­sume it col­lected all the rel­e­vant data. The AI model de­cides to make a spread­sheet us­ing the “write code” tool. All spread­sheets are just code, af­ter all. It can use that tool to do math and for­mat the re­sults so they are in­tel­li­gi­ble. It then com­pares the spread­sheet to the orig­i­nal prompt. If the data does­n’t sat­isfy it, it may “loop” and go back and search again. When it de­cides it has enough, it calls ComposeEmail, a tool that al­lows the AI to re­view its find­ings, sum­ma­rize them, write an email, and in­clude at­tach­ments like the spread­sheet. The model re­views this fi­nal work and de­cides the job is done. The “agentic loop” closes. Within sec­onds, the user gets an email with a sum­mary and rec­om­men­da­tions in the body, and a spread­sheet pre­sent­ing the find­ings at­tached. To see what an agen­tic loop looks like in prac­tice, you can ex­plore a Pi ses­sion here.

IV. Translation Layer

The trans­la­tion layer is what al­lows a har­ness to work with dif­fer­ent AI mod­els. In some cases, a har­ness may de­cide to use dif­fer­ent mod­els within the same agen­tic loop, be­cause dif­fer­ent AI mod­els may ex­cel at dif­fer­ent tasks. The trans­la­tion layer is also a cru­cial as­pect of har­nesses be­cause they de­liver con­trol to the end user. It means that some­one can take their AI har­ness and use it with a model from Anthropic, or OpenAI, or ex­plore one of the open weight AI mod­els that of­ten de­liver great value-for-money (measured by cost-per-task).

This trans­la­tion layer helps take power and lever­age away from the AI labs and into the hands of end users. If peo­ple can own and run their own har­nesses lo­cally on their own com­put­ers, it means that they re­tain their agency. It means that they re­tain the free­dom to make their tools their own, and keep lo­cal copies of the ses­sions that over time will con­sti­tute their cor­re­spon­dence with ma­chines. By build­ing a re­la­tion­ship to and us­ing a har­ness rather than an ap­pli­ca­tion pub­lished by an AI lab, the user re­tains free­dom and choice. In our ex­am­ple har­ness above, the user could have sent the same email to a model from OpenAI, a model from Anthropic, and an open weight model. They could then com­pare the re­sults, the cost of the re­sults, and re­tain all the an­swers in one place, rather than hav­ing three an­swers sit­ting within three apps.

Making a Harness Yours

Unlike AI mod­els them­selves, you can own and adapt the har­ness. Like a climb­ing har­ness, you can make it your own. People love this about Pi. Pi is a min­i­mal agent har­ness. Its sys­tem prompt is short. It has a min­i­mal set of tools. Out of the box it is de­signed to get out of the way. But as peo­ple use Pi, they ex­tend it and mold it in ways that suit them. They change the sys­tem prompt, or de­sign an ex­ten­sion that fits a work­flow. They then share those ex­ten­sions with oth­ers. Pi users have shared more than 5,000 ex­ten­sions with one an­other. Pi is also free and open source. It lives on your own lap­top. This means that peo­ple now have a tool that they own, that lives on their own hard­ware, that en­ables them to wield AI.

Neutral Open Source Harnesses as Tools of Agency

Harnesses did not be­gin open source or neu­tral. The first pop­u­lar agent har­ness, Claude Code, was not built to pro­vide an ag­nos­tic AI trans­la­tion layer but was built as an ap­pli­ca­tion to en­able cod­ing with Claude mod­els on your lo­cal com­puter. Since then, there has been an en­cour­ag­ing growth of free open source agent har­nesses like OpenClaw, OpenCode, Hermes and Pi. At Earendil we are build­ing Pi to be neu­tral, and to de­liver ca­pa­bil­ity choice and free­dom to Pi users. We are also ex­plor­ing how we can make the ben­e­fits and agency that har­nesses pro­vide to a broader swath of peo­ple.

Many peo­ple right now are con­cerned about the power and in­flu­ence of big­ger and big­ger AI com­pa­nies. Some of those peo­ple may choose to avoid AI com­pletely. We at Earendil be­lieve we can strengthen hu­man agency by craft­ing soft­ware and open pro­to­cols that bridge di­vi­sion and ig­no­rance and cul­ti­vate last­ing joy and un­der­stand­ing. We won’t do that by ig­nor­ing the tech­nolo­gies that ex­ist to­day, but by har­ness­ing them with clear eyes and a firm grip; en­sur­ing that we wield the ham­mer, the ham­mer does not wield us.

Note: this post was re­vised af­ter pub­lish­ing for in­creased clar­ity, based on reader feed­back.

“How do you find prob­lems worth work­ing on?” a se­nior en­gi­neer I men­tor asked me re­cently. He’s try­ing to make the jump to staff en­gi­neer and re­al­ized that the role is­n’t just about do­ing the work he’s as­signed. He also needs to get in­volved in fig­ur­ing out what his team and org should be build­ing.

Someone else had sug­gested block­ing out time in his cal­en­dar to think about the big­ger pic­ture. He’d tried that, but had­n’t found it pro­duc­tive, so he asked if I had any al­ter­na­tives.

I told him I rarely find good prob­lems by star­ing at a blank page and try­ing to “think strate­gi­cally.” Instead, I act like a sponge. I lis­ten to the stream of day-to-day noise, ab­sorb the prob­lems peo­ple are hav­ing and let them sit in the back of my mind. Over time, some fade away while con­nec­tions be­gin to ap­pear be­tween oth­ers that ini­tially seemed un­re­lated. Eventually, I start to see what’s re­ally slow­ing peo­ple down and what my team or I can do about it.

I’ve worked with many en­gi­neers who’ve never re­ally tried this. They wait for man­agers or leads to iden­tify op­por­tu­ni­ties, then demon­strate their value by solv­ing the hard­est as­signed prob­lems. That can ab­solutely lead to pro­mo­tion. But the pro­jects that have made the biggest im­pres­sion in my ca­reer were the ones where I found and solved an im­por­tant prob­lem my lead­ers did not yet re­al­ize ex­isted.

One caveat: my ex­pe­ri­ence comes mainly from work­ing on in­fra­struc­ture and de­vel­oper tools at large com­pa­nies, on teams where en­gi­neers have a lot of bot­tom-up au­ton­omy to in­flu­ence their roadmaps. In a more top-down en­vi­ron­ment, there may sim­ply be less room to work this way.

Absorb prob­lems, not re­quests#

People love talk­ing about the prob­lems they are fac­ing: in meet­ings, chat threads, pre­sen­ta­tions and email. They ex­plain why their work is hard, com­plain about what slows them down and de­scribe what they wish they could do.

When some­thing over­laps with my area, I start pulling on the thread. I might ask, “If X ex­isted, would it solve your prob­lem?” or point them at an ex­ist­ing fea­ture in a prod­uct I own and ask how much of their use case it cov­ers.

Users of­ten ask for a par­tic­u­lar so­lu­tion in­stead of ex­plain­ing their root is­sue. Rather than tak­ing the re­quest at face value, I keep dig­ging un­til I un­der­stand what they are try­ing to ac­com­plish and why ex­ist­ing prod­ucts do not work for them.

As a nat­ural in­tro­vert, this sort of am­bi­ent lis­ten­ing works par­tic­u­larly well for me. I don’t need to fill my cal­en­dar with spec­u­la­tive meet­ings just to find ideas; there is al­ready an enor­mous amount of use­ful in­for­ma­tion flow­ing around me dur­ing a nor­mal week.

When a prob­lem seems worth ex­plor­ing, though, I be­come more ac­tive; I need to see how it af­fects the team’s day-to-day work. I’ll sit with them as they walk me through their work­flows and the bugs they’re in­ves­ti­gat­ing. When I can, I’ll try work­ing through some of those bugs my­self. Seeing the prob­lem first­hand makes it eas­ier to sep­a­rate what the team ac­tu­ally needs from the so­lu­tion they asked for.

I also seek out peo­ple who see more of the or­ga­ni­za­tion than I do: those who own crit­i­cal sys­tems, work across sev­eral teams or have par­tic­u­larly deep in­sight into the work down­stream of my team. I’ll arrange a 1:1 or cof­fee chat and ask about in­ter­est­ing prob­lems they’ve come across. They may have al­ready seen the same is­sue in sev­eral places and started con­nect­ing the dots, giv­ing me a head start on pat­terns I might oth­er­wise have taken much longer to no­tice.

Let prob­lems ac­cu­mu­late#

Several times, I’ve been burned by mov­ing too fast. I be­came ex­cited by a re­quest from a vo­cal team, built the fea­ture and watched them barely use it. Their pri­or­i­ties had changed, or the re­quest had come from a one-off in­ves­ti­ga­tion that no longer mat­tered. How ea­ger a team was in that mo­ment was­n’t the same as how im­por­tant the fea­ture was rel­a­tive to every­thing else my prod­uct needed to sup­port. By hy­per­fo­cus­ing on their re­quest, I lost sight of the big­ger pic­ture.

That taught me to let po­ten­tial prob­lems pile up. Listening the way I do leaves me with far more of them than I could pos­si­bly solve, and not all de­serve ac­tion. Most don’t need to turn into pro­jects the first time I hear about them; wait­ing can be a su­per­power.

Waiting means the same prob­lem might pop up in­de­pen­dently in dif­fer­ent teams, mak­ing it a higher pri­or­ity to solve. Or prob­lems that look dif­fer­ent on the sur­face might turn out to have the same shape, so I can ad­dress sev­eral use cases in one shot. Or, as I’ve learned painfully, the re­quest­ing team did­n’t even care that much in the first place.

Instead, I make a men­tal note and re­visit the prob­lem if it comes up again. Other en­gi­neers I know write this sort of thing down more sys­tem­at­i­cally. The mech­a­nism is a per­sonal choice: every­one has to fig­ure out what works for them. What mat­ters is keep­ing un­re­solved prob­lems around long enough for more ev­i­dence to ac­cu­mu­late.

Find the com­mon shape#

Waiting helps me col­lect ev­i­dence, but that alone does­n’t tell me what to build. I still need to work out whether the prob­lems I’ve re­tained are gen­uinely re­lated and what, if any­thing, could ad­dress them to­gether.

Perfetto, the per­for­mance de­bug­ging tool I work on, is a good ex­am­ple. It dis­plays record­ings of sys­tem ac­tiv­ity on a time­line made up of rows called “tracks.” Over a cou­ple of years, teams kept ask­ing for small, spe­cific ad­di­tions to the UI. One wanted a com­mand to keep their pre­ferred tracks pinned to the top of the screen; the next team wanted the same, but for a com­pletely dif­fer­ent set of tracks. Others wanted Perfetto to open al­ready zoomed in on a par­tic­u­lar part of a record­ing, or to show a cus­tom ag­gre­ga­tion tuned to what they cared about. A few had stopped wait­ing for us and built elab­o­rate workarounds with book­marklets.1

By the time enough of these had piled up, my head was the usual tan­gle: the re­quests them­selves, the con­straints on each and a hand­ful of half-formed so­lu­tions. I’ve learned not to force a so­lu­tion by just sit­ting at a desk and think­ing. Instead, my best un­tan­gling hap­pens on long, aim­less walks around London, where con­nec­tions come more eas­ily when I’m not try­ing to force them.

What I even­tu­ally re­al­ized was that none of these teams re­ally wanted the spe­cific fea­ture they’d asked for. Each wanted to per­son­al­ize Perfetto for their own work­flow with­out im­pos­ing their choices on every­one else. The un­der­ly­ing need was­n’t any one fea­ture but rather the abil­ity to ex­tend the UI. When a con­nec­tion like that fi­nally clicks, it’s one of the best feel­ings in the job: sev­eral awk­ward re­quests col­lapse into a sin­gle idea, and pos­si­bil­i­ties open up that none of them hinted at on their own.

That feel­ing, though, is ex­actly when I have to be care­ful, be­cause a com­mon shape is only a hy­poth­e­sis and el­e­gance is not ev­i­dence. When it hap­pened with ex­tend­ing the UI it turned out to be real, but I’ve been fooled be­fore.

In an­other re­cent case I was con­vinced that build­ing a trans­par­ent caching sys­tem for query­ing Perfetto traces would solve is­sues with shar­ing large traces and re­peated queries. It was only as I wrote the RFC and built a pro­to­type that I re­al­ized the el­e­gance was a lie: the two prob­lems wanted gen­uinely dif­fer­ent so­lu­tions. I re­luc­tantly split the de­sign in two, both halves of which have since shipped.2

Pressure-test be­fore build­ing#

You’d think this would be the mo­ment I start build­ing, but it usu­ally is­n’t. How far I go de­pends on how sure I am that the idea works and that peo­ple ac­tu­ally want it.

If some­thing is use­ful and low-risk enough, I act straight away: I send the change and let my man­ager know. When I’m un­sure whether an idea will work or how much ef­fort it will take, I build a throw­away pro­to­type in­stead; it ex­poses the fail­ure points and gives me some­thing con­crete for oth­ers to re­act to. And when an idea is big but I’m con­vinced by it, I com­mit to the full ef­fort: weeks or months of work and the hard yards of build­ing sup­port across other en­gi­neers and teams.

Through all of it, I’m not only try­ing to con­vince other peo­ple; I’m also try­ing to con­vince my­self. Sometimes the hon­est an­swer is to stop: if peo­ple don’t see the value I do, or we hit a ma­jor tech­ni­cal wall, I’d rather drop the idea now than build some­thing no one uses or that be­comes a main­te­nance night­mare. And some­times it holds up but the tim­ing is wrong, so I park it, ready to spring into ac­tion the day it be­comes an org pri­or­ity.

When an idea does hold up, I don’t nec­es­sar­ily need to be the per­son who builds it. I might im­ple­ment it, some­one else on my team might, or it might change what the org fo­cuses on. Finding and shap­ing the right prob­lem can have an im­pact even when I don’t own the im­ple­men­ta­tion.

The Perfetto ex­ten­sions idea was worth that full ef­fort. We were al­ready build­ing plu­g­ins to mod­u­lar­ize the UI, but they weren’t enough: teams had to open source all their plu­gin code, which was­n’t an op­tion for many in­ter­nal use cases. So be­fore build­ing any­thing new, I took the prob­lem and my pro­posal to my man­ager, team­mates and the client teams. I ended up writ­ing two RFCs, hav­ing sev­eral 1:1s and giv­ing a cou­ple of talks, re­fin­ing it as the feed­back came in.

In the end, I de­signed and im­ple­mented macros as “lightweight ex­ten­sions”: a way to au­to­mate ac­tions in the UI with­out writ­ing a plu­gin. Extension servers took the idea fur­ther by let­ting teams share their macros.

Instead of im­ple­ment­ing every re­quested fea­ture our­selves, we gave teams ways to adapt Perfetto to their own needs. Dozens of teams in­side Google now use macros and ex­ten­sion servers, and sev­eral other com­pa­nies use ex­ten­sion servers in­ter­nally too.

Solving use­ful prob­lems helps me find the next one#

The more of­ten I go through this process, the eas­ier it be­comes. When I show gen­uine in­ter­est in some­one’s prob­lem, ask use­ful ques­tions or help solve it, they re­mem­ber. They start com­ing to me ear­lier and bring me into con­ver­sa­tions with other peo­ple fac­ing re­lated is­sues.

That gives me a wider view of what is hap­pen­ing across the or­ga­ni­za­tion, mak­ing it eas­ier to spot pat­terns and build things peo­ple ac­tu­ally need. Solving one of those prob­lems brings me into more con­ver­sa­tions, and the loop con­tin­ues.

Those suc­cesses build the kind of trust that comes from long-term stew­ard­ship. Early on, I had to turn many of these ideas into some­thing real my­self to prove that my judg­ment was sound. Over time, my man­ager and org gave more weight to my as­sess­ment of what mat­tered. That al­lowed me to in­flu­ence the roadmap with­out need­ing to own every pro­ject.

This dif­fers from the idea that be­com­ing a staff en­gi­neer means re­plac­ing tech­ni­cal work with meet­ings and co­or­di­na­tion. For me, con­ver­sa­tions are in­puts into what I build, not the end re­sult.

Conclusion#

That is what I wanted my mentee to un­der­stand: find­ing prob­lems worth solv­ing is­n’t sep­a­rate from the rest of the job. It comes from stay­ing en­gaged with peo­ple’s work long enough to see what no sin­gle re­quest can show you.

Risky Bulletin Newsletter

August 19, 2026

Written by

Catalin Cimpanu

News Editor

This newslet­ter is brought to you by Socket Security. You can sub­scribe to an au­dio ver­sion of this newslet­ter as a pod­cast by search­ing for “Risky Business” in your pod­catcher or sub­scrib­ing via this RSS feed. You can also add the Risky Business newslet­ter as a Preferred Source to your Google search re­sults by go­ing here.

🗨️

The in­tro was up­dated post-pub­li­ca­tion to fix the link to the tech­ni­cal re­port and to add more con­text from a lo­cal source.

Slovakia’s na­tional se­cu­rity ser­vice NBU has is­sued a se­cu­rity alert against the use of NERO R-ONE high-speed traf­fic cam­eras.

The agency says the cam­eras con­tain a back­door mech­a­nism that grants shell and net­work ac­cess to the de­vices via an SMS mes­sage re­ceived from a list of hard­coded Russian phone num­bers.

The NBU started an in­ves­ti­ga­tion into the de­vices af­ter the coun­try’s op­po­si­tion ac­cused the gov­ern­ment of buy­ing the cam­eras from Russia and af­ter mul­ti­ple re­ports in Slovak me­dia that linked the pur­chase to a Cyprus shell com­pany with fake cer­ti­fi­ca­tions.

According to the NBU, the cam­eras are a re­branded ver­sion of a Russian traf­fic cam­era model named CORDON PRO.M, pro­duced by St. Petersburg-based Russian firm Semicon.

The cam­eras were bought as part of a €30 mil­lion EU-funded pro­ject to re­build the coun­try’s na­tional traf­fic mon­i­tor­ing sys­tem.

The Interior Ministry has al­legedly bought and prepar­ing to in­stall 279 cam­eras on se­lected roads across Slovakia.

The Ministry ini­tially de­nied that the cam­eras were of Russian ori­gin and said there’s no dan­ger of data theft since the de­vices were go­ing to be on a closed loop Ministry net­work.

According to an NBU tech­ni­cal re­port, be­sides the back­door sys­tem, the cam­eras also con­tain sev­eral se­cu­rity flaws. They have a cru­cial SecureBoot se­cu­rity fea­ture that’s turned off so the firmware ori­gin is never en­forced, the web man­age­ment por­tal con­tains mul­ti­ple vul­ner­a­bil­i­ties, and the cam­eras ex­pose live streams to any­one with­out a pass­word and who knows their broad­cast­ing IP.

Interior Ministry of­fi­cials paused the cam­era de­ploy­ment af­ter the NBU re­port and said it would or­der an ad­di­tional as­sess­ment from an in­de­pen­dent au­di­tor to con­firm the find­ings.

Some sim­i­lar de­vices are also al­legedly in­stalled in Croatia and maybe some other coun­tries in Eastern Europe.

Nobody should be buy­ing se­cu­rity cam­eras from Russia, or China for that mat­ter https://​t.co/​Zi­u­uZ3ODjQ— ChrisO_wiki (@ChrisO_wiki) August 18, 2026

Nobody should be buy­ing se­cu­rity cam­eras from Russia, or China for that mat­ter https://​t.co/​Zi­u­uZ3ODjQ

Risky Business Podcasts

In this episode of Risky Business Features, James Wilson chats with PortSwigger’s Director of Research James Kettle about us­ing an LLM to de­velop gen­uinely new at­tack tech­niques.

Breaches, hacks, and se­cu­rity in­ci­dents

Scammers tar­get UK prime min­is­ter: A scam­mer tar­geted UK Prime Minister Andy Burnham by pos­ing as White House chief of staff Susie Wiles. Burnham de­tected the scam him­self and the UK em­bassy no­ti­fied the White House. Multiple US sen­a­tors, gov­er­nors, and ex­ec­u­tives were also tar­geted by scam­mers pos­ing as Wiles last year. The White House blamed the in­ci­dent on a hacker ob­tain­ing a copy of her cell­phone con­tacts. [Politico Europe]

Hackers tar­get Ukraine’s ARMA agency: A cy­ber­at­tack has dis­rupted the ac­tiv­i­ties of Ukraine’s agency for man­ag­ing seized Russian as­sets. The at­tack took place this week as the agency was prepar­ing to as­sign a new man­ager for bev­er­age com­pany IDS Ukraine. Ukraine seized IDS from Alfa-Bank co-founder Mikhail Fridman shortly af­ter Russia’s in­va­sion. The agency did­n’t at­tribute the at­tack. [RBC // ARMA]

Hack hits Berlin gov­ern­ment: A cy­ber­at­tack has dis­rupted two ma­jor de­part­ments in the Berlin city gov­ern­ment. The at­tack took down emails, re­mote gate­ways, and in­ter­net con­nec­tions across the trans­port and ur­ban de­vel­op­ment de­part­ments. IT staff have dis­con­nected the two agen­cies from the city net­work to pre­vent the in­ci­dent from spread­ing. [Tagesspiegel // RBB24 // Yahoo Finance!]

Breach at ge­net­ics test­ing com­pany: Genetics-testing com­pany Baylor Genetics is no­ti­fy­ing users of a se­cu­rity breach that ex­posed their per­sonal in­for­ma­tion. The breach took place in June and both pa­tient and em­ployee data was com­pro­mised. The com­pany did­n’t dis­close the num­ber of af­fected in­di­vid­u­als. [Baylor Genetics // CybersecurityDive]

UT San Antonio breach: The University of Texas at San Antonio has taken its IT sys­tems of­fline af­ter a se­cu­rity breach over the week­end. Classes for the new school year are ex­pected to start on Wednesday as sched­uled. The uni­ver­sity has ex­tended tu­ition pay­ment dead­lines and plans to re­set all user ac­count pass­words once sys­tems are on­line. [UT San Antonio // The Record]

Ransomware dis­ables hos­pi­tal doors, HAVC: A ran­somware at­tack has dis­abled ac­cess doors, heat­ing, ven­ti­la­tion, and air con­di­tion­ing at Winnipeg’s largest hos­pi­tal. The Winnipeg Health Sciences Centre in­creased on­site se­cu­rity while the ac­cess card sys­tem is still down. The hos­pi­tal says pa­tient care and clin­i­cal op­er­a­tions are not im­pacted. [CBC // The Winnipeg Free Press] [h/t Alex Rudolph]

BlueSky and GitHub hit by Iranian DDoS at­tacks: An Iranian hack­tivist group took down BlueSky and GitHub with DDoS at­tacks on Sunday and Monday, re­spec­tively. The at­tacks caused pro­longed out­ages at both com­pa­nies. A group known as the 313 Team took credit for the at­tacks. The hack­ers were also be­hind an­other wave of DDoS at­tack in April. [Telegram // Telegram]

We apol­o­gize for yes­ter­day’s ser­vice prob­lems. Bluesky ex­pe­ri­enced a DDoS at­tack—a flood of junk traf­fic meant to knock servers of­fline—over a pe­riod of 24 hours. We have up­graded our de­fenses in re­sponse, and we con­tinue to mon­i­tor the sit­u­a­tion. Follow @status.bsky.app for any up­dates.— Bluesky (@bsky.app) August 18, 2026 at 12:27 AM

We apol­o­gize for yes­ter­day’s ser­vice prob­lems. Bluesky ex­pe­ri­enced a DDoS at­tack—a flood of junk traf­fic meant to knock servers of­fline—over a pe­riod of 24 hours. We have up­graded our de­fenses in re­sponse, and we con­tinue to mon­i­tor the sit­u­a­tion. Follow @status.bsky.app for any up­dates.

SafePal breach: Hackers have stolen the per­sonal in­for­ma­tion of 40,000 cus­tomers of hard­ware crypto-wal­let provider SafePal. The in­ci­dent im­pacted all cus­tomers who placed or­ders of SafePal wal­lets be­tween March 2, 2025, and April 11, 2026. SafePal says no seed phrases or pri­vate keys are im­pacted. The stolen data is still dan­ger­ous be­cause it could en­able wrench at­tacks on wal­let hold­ers. [SafePal // SecurityWeek]

Bits of Gold breach: Hackers have stolen the data of 250,000 cus­tomers of Bits of Gold, Israel’s largest cryp­tocur­rency ex­change. The com­pany no­ti­fied cus­tomers of the hack over the week­end. It said the data was stolen from an ex­ter­nal an­a­lyt­ics ser­vice provider. It did­n’t say what type of data was stolen. [CTech]

TheHatman dumps em­ployee data for a dozen com­pa­nies: A threat ac­tor is sell­ing the em­ployee data of al­most a dozen Fortune 500 com­pa­nies. The hacker, who goes by TheHatman, claims the data was stolen by us­ing stolen cre­den­tials to ac­cess each vic­tim’s Azure en­vi­ron­ments. The hacker claims they breached McDonalds, Vodafone, Gap, and the Intercontinental and Wyndham ho­tel chains. [HudsonRock]

AI, gen­eral tech, and pri­vacy

Windows 11 drops WMIC: The cur­rent Windows 11 in­stal­la­tion pack­ages and Insider Builds do not ship with the Windows Management Instrumentation Command-line (WMIC) fea­ture any­more. Microsoft dep­re­cated the toolkit a few years ago af­ter it saw mas­sive abuse. [Microsoft // WindowsLatest]

Firefox 154: Mozilla has re­leased Firefox 154. New fea­tures and se­cu­rity fixes are in­cluded. The biggest fea­ture in this re­lease is sup­port for GeForce NOW, NVIDIA’s cloud gam­ing plat­form. [Firefox]

Firefox for iOS gets an ad blocker: Mozilla has added an ad blocker to Firefox on iOS. It is turned off by de­fault. [Mozilla]

Government, pol­i­tics, and pol­icy

Russian things: A Russian court has forced two Telegram chan­nel own­ers to re­move posts blam­ing the coun­try’s in­ter­net watch­dog for caus­ing an out­age of the coun­try’s bank­ing sys­tem as part of an at­tempt to block VPN pro­to­cols. This is funny to me be­cause they did­n’t fine Natalya Kaspersky, one of the Kaspersky co-founders, for ba­si­cally say­ing the same thing in an of­fi­cial man­ner and to more main­stream Russian news out­lets. Alas, Russia, a two-tiered so­ci­ety! [Caution News on Telegram]

In this Risky Business spon­sor in­ter­view, Casey Ellis chats with Socket founder Feross Aboukhadijeh about npm 12’s move to dis­able in­stall scripts by de­fault.

Arrests, cy­ber­crime, and threat in­tel

French cops used pub­lic ex­ploit to hack EncroChat: French law en­force­ment used a pub­lic ex­ploit hosted on GitHub to hack en­crypted phone net­work EncroChat in 2020. The ex­ploit was for the Bad Binder Android vul­ner­a­bil­ity and had been shared on­line a few months be­fore. EncroChat dis­cov­ered the hacks af­ter French cops de­ployed a sec­ond ex­ploit that failed. [ComputerWeekly // Bad Binder ex­ploit on GitHub // Bad Binder write-up]

SMS blaster ar­rested in Malaysia: Malaysian au­thor­i­ties have ar­rested a 65-year-old sus­pect for dri­ving around with an SMS blaster in his car. The sus­pect was de­tained dri­ving around the bor­der cross­ing be­tween Johor Bahru and Singapore. He is the sec­ond sus­pect ar­rested this month in Johor Bahru for SMS blast­ing. [CommsRisk]

LockerGoga dev on trial in Switzerland: Swiss pros­e­cu­tors are seek­ing a 12-year prison sen­tence for a Ukrainian man linked to ran­somware at­tacks on lo­cal com­pa­nies. Officials claim the sus­pect was a coder for the LockerGoga, MegaCortex and Nefilim ran­somware groups. The sus­pect is plead­ing not guilty. He claims he was work­ing as a con­sul­tant for a cy­ber­se­cu­rity firm when he was de­tained and the ran­somware source code found on his de­vices. [Watson // The Record]

Ransomware af­fil­i­ate poses as data re­cov­ery firm: A ran­somware af­fil­i­ate is pos­ing as a data re­cov­ery firm named Ransom Busters LTD. According to GuidePoint Security, the group has reached out to mul­ti­ple com­pa­nies and of­fered to delete their data from ran­somware servers for a fee be­tween $20,000 and $60,000. The group has reached out to vic­tims even be­fore breaches were made pub­lic. GuidePoint be­lieves the group has signed up as an af­fil­i­ate on dif­fer­ent Ransomware-as-a-Service plat­forms to see hacked com­pa­nies and reach out in ad­vance. [GuidePoint Security]

Operation CameraSwarm: A threat ac­tor has hacked more than 14,500 Dahua se­cu­rity cam­eras across Ukraine and Russia. Researchers at Hunt Intelligence dis­cov­ered the bot­net af­ter the hacker left an open di­rec­tory on their server in­fra­struc­ture. According to files re­cov­ered from the server, the hacker ex­ploited old vul­ner­a­bil­i­ties but also a se­cret hard­coded ac­count in some of the de­vices. [Hunt Intelligence]

StopAndProtect pro­file: Security firm Check Point has pub­lished a pro­file on StopAndProtect, a new e-crime op­er­a­tion us­ing thou­sands of hacked WordPress sites to redi­rect users to mal­ware down­loads and then store stolen creds. [Check Point]

FUXA scan­ning: Threat ac­tors are scan­ning for FUXA SCADA de­vices in an at­tempt to ex­ploit CVE-2026 – 25895, an unau­then­ti­cated path tra­ver­sal that can let hack­ers rewrite lo­cal files. [Caitlin Condon on LinkedIn]

StubMaker RubyGems cam­paign: The OSM team has spot­ted 16 ma­li­cious RubyGems pack­ages ty­posquat­ting more pop­u­lar pack­ages that spread a Windows in­fos­tealer to who­ever in­stalls them. [OpenSourceMalware]

Malware tech­ni­cal re­ports

DragonDoll Android spy­ware: Russian se­cu­rity firm Positive Technologies has dis­cov­ered a new Android spy­ware strain. Named DragonDoll, the spy­ware is spread us­ing fake Chrome up­date pack­ages and fo­cuses on steal­ing data from in­stant mes­sen­gers. [Positive Technologies // Archived]

GoldDigger Android tro­jan: IBM’s Trusteer team has pub­lished a tech­ni­cal analy­sis of GoldDigger, an Android bank­ing tro­jan ac­tive since 2023. [IBM]

C2Looper back­door: In July 2026, re­searchers iden­ti­fied C2Looper, a new mal­ware fam­ily likely used in ran­somware at­tacks to es­tab­lish a foothold for lat­eral move­ment. [Zscaler]

TWINLOOT: Ontinue re­searchers have dis­cov­ered TWINLOOT, a Python-coded mal­ware frame­work that hosts its en­tire com­mand-and-con­trol in­fra­struc­ture in­side trusted Microsoft ser­vices such as Azure, M365, and SharePoint. [Ontinue]

MacSync Stealer: Microsoft has re­leased a tech­ni­cal re­port on MacSync Stealer, a re­cent in­fos­tealer tar­get­ing the ma­cOS ecosys­tem. [Microsoft]

WordlistLoader: Gen Threat Labs has iden­ti­fied WordlistLoader, a new loader used to de­liver Amatera Stealer via ClearFake cam­paigns. [Gen Digital]

Shadow HVNC and Shadow Loader: Security re­searchers have re­verse-en­gi­neered Shadow HVNC and Shadow Loader, two mal­ware fam­i­lies ad­ver­tised on­line by a de­vel­oper known as RemoteX. [Malbear Labs]

ValleyRAT: Despite some ar­rests this year, the SilverFox group is still ac­tive and spread­ing its ValleyRAT mal­ware. [Forcepoint]

AZALEA RAT: And speak­ing of RATs, Point Wild looks at the dis­tri­b­u­tion chains of the AZALEA RAT, a new RAT ad­ver­tised on­line as AzaleaControl. [Point Wild]

Medusa ran­somware: CISA has up­dated its ad­vi­sory on the Medusa ran­somware with new TTPs. The agency says the group has con­tin­ued to be ac­tive and made hun­dreds of new vic­tims. [CISA]

Mirage2FA: ANY.RUN’s se­cu­rity team looks at a new 2FA-intercepting phish­ing ser­vice named Mirage2FA. The ser­vice seems to be geared to­wards M365 cam­paigns pri­mar­ily. [ANY.RUN]

In this Soap Box edi­tion of the Risky Business pod­cast Patrick Gray chats with Socket founder Feross Aboukhadijeh about how to mea­sure the reach­a­bil­ity of vul­ner­a­bil­i­ties in ap­pli­ca­tions. It’s great to know there’s a CVE in a li­brary you’re us­ing, but it’s even bet­ter if you can say whether or not that vul­ner­a­bil­ity ac­tu­ally im­pacts your ap­pli­ca­tion.

APTs, cy­ber-es­pi­onage, and info-ops

France in­ves­ti­gates Russian dis­info ops: French au­thor­i­ties have launched an in­ves­ti­ga­tion into sus­pected Russian dis­in­for­ma­tion cam­paigns tar­get­ing the coun­try’s pro-EU politi­cians. The cam­paigns tar­geted pos­si­ble pres­i­den­tial can­di­dates Gabriel Attal and Edouard Philippe as soon as they showed in­ter­est in next year’s elec­tion. Open-source re­port­ing has linked the cam­paigns to a Russian dis­in­for­ma­tion group known as Matryoshka and Storm-1516. [FranceInfo]

Operation QUICSILVER: A China threat ac­tor has been tar­get­ing Myanmar diplo­mats via an VHD-delivered Go back­door named QUICAgent. [Seqrite]

Goffee re­places im­age files: The Goffee cy­ber-es­pi­onage group has main­tained a foothold in­side hacked or­ga­ni­za­tions by al­ter­ing in­stal­la­tion im­ages for cor­po­rate apps. In a cam­paign tar­get­ing Russian com­pa­nies, the group has mod­i­fied 7-Zip and Git in­stallers. [F6]

Core Werewolf’s CoreRAT: A highly so­phis­ti­cated APT group named Core Werewolf has con­tin­ued its op­er­a­tions tar­get­ing Russian orgs with a new re­mote ac­cess tro­jan named CoreRAT. [BI.ZONE]

Russia and US hold hands in Alberta info-ops: The US and Russia ap­pear to have joined hands in pro­mot­ing the Alberta sep­a­ratist move­ment in Canada. [The Globe and Mail]

“The first data from a study that be­gan last month in­di­cate Russian con­tent farms have been push­ing pro-sep­a­ratist con­tent into on­line com­mu­ni­ties and us­ing Canadians to “launder” those mes­sages by shar­ing such ma­te­r­ial on their so­cial me­dia feeds, the re­searchers said. The U.S. ac­tiv­ity, on the other hand, is more overt, with promi­nent American in­flu­encers, pod­casts and web­sites openly pro­mot­ing Alberta sep­a­ra­tion, said Brian McQuinn, co-di­rec­tor of the Centre for Artificial Intelligence, Data, and Conflict at the University of Regina.”

CopyCop (Storm-1516) in Armenia: Russian dis­info group CopyCop ran a dis­in­for­ma­tion cam­paign try­ing to sab­o­tage the con­struc­tion of a shared US-Armenian AI data cen­ter in Hrazdan. [Recorded Future]

PurpleDelta: Recorded Future has iden­ti­fied 22 new per­sonas op­er­ated by PurpleDelta, the name the com­pany as­signs to North Korea’s re­mote IT worker scheme. Also this week, Bridewell pub­lished a guide on how to de­fend against these groups. [Recorded Future // Bridewell]

Iranian phish­ing ops tar­get Israeli jour­nal­ists: Iranian state hack­ers have in­ten­si­fied spear-phish­ing at­tacks tar­get­ing Israeli jour­nal­ists. The coun­try’s in­tel­li­gence and cy­ber­se­cu­rity agen­cies have sent out a se­cu­rity alert about the at­tacks last week. The agen­cies say hack­ers are seek­ing to ob­tain pri­vate in­for­ma­tion from jour­nal­ists re­port­ing on po­lit­i­cal and na­tional se­cu­rity. [Ynet]

US charges more Mabna hack­ers: The US has un­sealed a su­per­sed­ing in­dict­ment against 17 Iranian hack­ers. The sus­pects are em­ploy­ees of the Mabna Institute, a cy­ber con­trac­tor for Iran’s Islamic Revolutionary Guard Corps. The Justice Department claims Mabna hack­ers breached uni­ver­si­ties across the world to steal re­search and trans­fer to Iranian coun­ter­parts. The su­per­sed­ing charges re­place a 2018 in­dict­ment that ex­pands the num­ber of sus­pects from nine to 17. The State Department has also of­fered a $10 mil­lion re­ward for in­for­ma­tion that may lead to the ar­rest of any of the sus­pects. The Mabna Institute hack­ing cam­paigns are tracked by se­cu­rity firms un­der the co­de­name of Cobalt Dickens. [DOJ 2026 // DOJ 2018 // Rewards for Justice // Sophos]

Vulnerabilities, se­cu­rity re­search, and bug bounty

Security up­dates: Apple, Dell, Edge, Firefox, GitLab, Oracle, Tenable, Tor Browser.

AI agent in­tro­duces bug in Snowflake’s pro­duc­tion: Security firm Wiz has spot­ted an AI cod­ing agent aut­ofix­ing a bug but in­tro­duc­ing a vul­ner­a­bil­ity in cloud provider Snowflake’s pro­duc­tion sys­tems. [Wiz]

Microsoft de­lays Exchange up­dates due to in­flux of AI bugs: Microsoft has de­layed a ma­jor up­date for Exchange Subscription Edition servers due to an in­flux of AI-discovered vul­ner­a­bil­i­ties. The up­date was sup­posed to go live at the end of June. Microsoft says it did not want to re­lease its bian­nual fea­ture up­date only to re­lease mul­ti­ple batches of se­cu­rity fixes right af­ter. The com­pany plans to wait to fix all se­cu­rity bugs be­fore re­leas­ing the Exchange SE H1 Cumulative Update. Microsoft says em­ploy­ees dis­cov­ered the se­cu­rity flaws as part of an in­ter­nal push to use AI tools for bug dis­cov­ery. [Microsoft]

KEV up­date: CISA has up­dated its KEV data­base with four vul­ner­a­bil­i­ties that are cur­rently ex­ploited in the wild. All are 2026 bugs, such as a re­cent Apple ma­cOS ScreenShare bug, a Microsoft IKE one, a SharePoint one, and a VMware vCen­ter path tra­ver­sal.

Infosec in­dus­try

Acquisition news: Tech gi­ant Fortinet has ac­quired AI se­cu­rity startup Virtue AI, which spe­cial­izes in AI run­time pro­tec­tion, au­to­mated AI val­i­da­tion, and se­cu­rity for au­tonomous AI sys­tems. [Fortinet]

Threat/trend re­ports: Beazley Security, Black Kite, Bridewell, Cyberproof, Ecosyste.ms, JPMorgan, MinterEllison, and Onyxia have re­cently pub­lished re­ports and sum­maries cov­er­ing var­i­ous emerg­ing threats and in­dus­try trends.

Risky Business pod­casts

In this edi­tion of Between Two Nerds, Tom Uren and The Grugq dis­cuss The Offense Death Cycle pa­per look­ing at how to take ad­van­tage of a de­fend­er’s abil­ity to con­trol a net­work to dis­cover in­trud­ers.

★ Featured

ptouch-rs MIT — re­places Brother P-touch Editor Rust CLI/GUI for Brother P-touch tape print­ers. Templates, CSV batch, live pre­view. 0 post(s) »

Newest

Most dis­cussed

Random picks

Aug 21, 2026

The first time I tried to use an LLM to speed up cod­ing was in mid-2025. I was not im­pressed. I was work­ing on libadb­mdns back then, an mDNS im­ple­men­ta­tion in Rust. The code pro­duced would not even com­pile.

I re­vis­ited LLMs in January 2026. This time it worked bet­ter. Not only did it write a com­plex in­dexed-bi­nary heap class, it was able to pin­point an ob­scure bug in the polling crate due to the Windows IOCP im­ple­men­ta­tion.

However, the code qual­ity was abysmal. It was spaghetti code with no com­ments and no struc­ture. It was cool but not re­al­is­tic to work with LLMs if the speed gain was lost to clean­ing up the code un­til it met the pro­duc­tion-level bar.

In March 2026, I tried to use agen­tic IDEs like Antigravity and VS Code’s Claude Code plu­gin. I was now able to “iterate” over the “staged” code. I found my­self re­view­ing the code of an in­fi­nitely pa­tient ju­nior CS ma­jor with sug­ges­tions like “don’t use magic num­bers”, “add a short com­ment here to ex­plain your­self”, or “use short func­tion names”.

The code qual­ity im­proved dra­mat­i­cally. It was very close to what I would have pro­duced “by hand” but it was te­dious. I ended up re­peat­ing my­self over and over again in each new ses­sion.

When a cod­ing ses­sion starts, the cod­ing har­ness loads a file named agent.md and in­jects it into the prompt. This is the per­fect lo­ca­tion to su­per fine-tune cod­ing style pref­er­ences. When I found my­self re­peat­ing the same sug­ges­tion to im­prove the code, I added it in there.

Here is my ver­sion of agent.md as a start­ing point if you need one. Placing it in the root of a pro­ject should be enough. Alternatively, gem­ini.md/​claude.md can be sym­linked to­ward an agent.md to have it ac­tive any­where.

# FAB’s AGENT.MD

- When writ­ing some­thing in­tended for hu­man con­sump­tion, (comment, com­mit mes­sage, re­ply to prompt) use as few words as pos­si­ble. Pick every word metic­u­lously to re­duce the vol­ume to a strict min­i­mum. Be down to the point. Less is more.

- Avoid su­perla­tives and praise. Stop telling me I am ab­solutely right. Give me the cold hard truth.

- Avoid magic num­bers and strings by ex­tract­ing re­cur­ring or mean­ing­ful val­ues into de­scrip­tive con­stants (const) or enums. Keep self-ex­plana­tory, one-off val­ues in­line to avoid clut­ter. If a value comes from a spec (e.g. HTTP 200 OK), use a con­stant re­gard­less.

- Reduce code in­den­ta­tion. Avoid Arrow Anti-Pattern. Leverage early re­turn and con­tinue.

- Keep func­tion names short. Less than 30 char­ac­ters.

- Use enums in­stead of booleans for func­tion pa­ra­me­ters.

- Let the reader of the code breathe. Add empty lines be­tween log­i­cal blocks of code.

- Add a small, to the point, com­ment to ex­plain *what* the block does and *why*. Use ex­am­ples when pos­si­ble. Propose ASCII draw­ings to ex­plain com­plete sys­tems.

- Treat mem­ber vis­i­bil­ity changes as a break­ing de­sign shift. Keep all fields and func­tions pri­vate un­less ex­ter­nal ac­cess is strictly re­quired by the de­sign. Prompt the user for ex­plicit ap­proval be­fore chang­ing any ac­cess mod­i­fier from pri­vate to in­ter­nal or pub­lic.

- Program to lev­els of ab­strac­tion. Lower-level me­chan­ics (e.g., raw hard­ware I/O, sec­tor pars­ing, di­rect socket streams) must be en­cap­su­lated in a ded­i­cated dri­ver/​ab­strac­tion layer. Expose clean, high-level APIs to the rest of the ap­pli­ca­tion so call­ing code works with do­main con­cepts, not raw im­ple­men­ta­tion de­tails.

- Don’t touch blocks of code un­re­lated to the fea­ture you im­ple­ment. e.g. Don’t add com­ments to a block of code if you did not cre­ate it or mod­ify it. As much as pos­si­ble try to min­i­mize the num­ber of changed lines when im­ple­ment­ing a fea­ture.

- Strictly ad­here to the lay­ered bound­ary hi­er­ar­chy: each layer may only com­mu­ni­cate with its im­me­di­ate neigh­bor di­rectly be­low it. Never “punch holes” through lay­ers (e.g., con­trollers or UI com­po­nents must never di­rectly call data­base queries, raw hard­ware dri­vers, or low-level net­work clients; al­ways route through the in­ter­me­di­ate ser­vice/​ab­strac­tion layer).

- Always use {}, even on a one-line “if” state­ment.

When you write a com­mit mes­sage, fol­low these 7 rules: Rule 1: Separate the sub­ject line from the body with a sin­gle blank line. Rule 2: Limit the sub­ject line to 50 char­ac­ters (72 is the ab­solute hard limit). Rule 3: Capitalize the first let­ter of the sub­ject line. Rule 4: Do not end the sub­ject line with a pe­riod. Rule 5: Use the im­per­a­tive mood in the sub­ject line (e.g., “Fix bug,” “Add fea­ture,” not “Fixed” or “Adds”). Test for­mula: It must com­plete the sen­tence: “If ap­plied, this com­mit will [your sub­ject line here]”. Rule 6: Wrap the body text man­u­ally at 72 char­ac­ters to pre­vent Git for­mat­ting is­sues. Rule 7: Use the body to ex­plain what and why vs. how. Assume the code ex­plains the how; the mes­sage must ex­plain the con­text and rea­son­ing.

- If the prompt in­di­cates that a bug is be­ing fixed, don’t write the fix right away. First write the test. Observe it fail­ing. Then write the fix. And ob­serve the test pass­ing.

While this “trick” has con­sid­er­ably im­proved the code gen­er­ated, this is not a magic bul­let that lets me avoid read­ing the code. LLMs con­stantly hal­lu­ci­nate and can­not be trusted. I still have to ver­ify and it­er­ate a lot but now I usu­ally fo­cus on ar­chi­tec­ture and de­sign in­stead of code style.

There is an an­noy­ing phe­nom­e­non with LLMs called “context di­lu­tion” or “attention di­lu­tion” that was out­lined in the Lost in the Middle pa­per. As the con­text grows, a model starts pay­ing less at­ten­tion to in­struc­tions in the mid­dle of the con­text in fa­vor of what is at the be­gin­ning and the end. The rea­sons why this hap­pens are not well un­der­stood at the time I am typ­ing this. I have found only two ways to min­i­mize the im­pact.

Keep the con­text short. This means start­ing a new ses­sion per fea­ture.

Explicitly ask the har­ness to re­load agent.md. “Reload agent.md” is enough when I see code qual­ity drop­ping.

You don’t need to open an ed­i­tor every time you want to add a new rule. What I do now is ask the agent to up­date agent.md.

Published Oct 7, 2025  |  Updated Aug 23, 2026

Read by …

Update: As of August 2026, this is­sue is still pre­sent.

I was cre­at­ing a Google Workspace ac­count for my com­pany, as every­one knows, it’s a pretty straight­for­ward sign-up process, un­til I’m hit with a weird, con­fus­ing er­ror when I type my do­main name:

“Enter a valid do­main name in­stead of an email provider”

Huh? An email provider? What does this mean?

I thought maybe my do­main was pre­vi­ously used as an email provider, so I look up the his­tory of the do­main, but nope, that’s not it.

I look up the er­ror and find no of­fi­cial doc­u­men­ta­tion by Google. However, I see that I’m not the only one to have come across it, there are a few com­mu­nity threads posted by peo­ple ask­ing for help.

Believe it or not, one of those threads was by the Ukrainian Ministry of Economy; they were get­ting the same er­ror for their do­main. And of course, the so-called “experts” of the com­mu­nity pro­vide the most use­less re­sponse as al­ways:

Left with no so­lu­tion, I had to con­tact Google Workspace sup­port. After be­ing asked by mul­ti­ple agents “Have you tried to cre­ate this to an­other browser?”, when I had al­ready ex­plained to them that I did, they trans­ferred me to their high-level sup­port spe­cial­ist, Karen, who again asked me to try to sign up us­ing an­other de­vice, and I told her, again, that I have tried.

Then she asked me to record a video and wait for their prod­uct en­gi­neers to re­view it, and I did, and a few hours later I get an email:

Ok, I give it a try, and nope, the is­sue still per­sists.

One week later, I re­ceive an­other email:

So let me get this right: they are sug­gest­ing that I use an­other do­main for my com­pany be­cause their sys­tem WRONGLY flagged my le­git­i­mate do­main, and they don’t even know ex­actly why.

Just for con­text, this is a pre­mium do­main with a very high pre­mium re­newal fee, no his­tory of abuse ob­vi­ously. And the .one TLD is a le­git TLD used by le­git busi­nesses.

It seems like even their prod­uct en­gi­neers gave up and went ahead and gave a lazy re­sponse.

After re­ply­ing with an an­gry re­sponse, left with no so­lu­tion, I was about to ditch Google com­pletely and head over to Microsoft, but I thought I would give it one last try and take the mat­ter into my own hands.

I de­bug the source code of their sign-up page, and I find that the er­ror is trig­gered by a lo­cal in­put val­i­da­tion func­tion. They are check­ing the do­main against a regex list of what seems to be email providers, though look­ing closely, there are a lot of weird en­tries on the list, one of which is web\\..*, the cul­prit pre­vent­ing me from sign­ing up my do­main.

So ap­par­ently, en­gi­neers at Google de­cided that all web.[tld] do­mains are email providers…

And the en­try me\\..* pre­vents the Ukrainian Ministry of Economy’s do­main, me.gov.ua, from be­ing ac­cepted. Just be­cause its sub­do­main is me.

One other en­try is al­ice\\..*-not sure what’s up with that.

Here’s the full code snip­pet from the Google Workspace sign-up page for those in­ter­ested:

var DHa, EHa; DHa = “gmail\\..* hot­mail\\..* ya­hoo\\..* myya­hoo\\.com out­look\\..* aol\\..* in­box\\..* fast­mail\\..* mail\\..{1,3}(\\..{2})?$ red­iff­mail\\..* ly­cos\\..* att\\..* com­cast\\.net ver­i­zon\\..* talk­talk\\..* la­poste\\..* gmx\\..* web\\..* bk\\..* yan­dex\\..* ram­bler\\..* pochta\\..* live\\..* cox\\..* bell­south\\..* me\\..* earth­link\\..* sbc­global\\..* qq\\..* cez­nam\\..* 163\\..* 126\\..* free\\..* sfr\\..* wanadoo\\..* aruba\\..* terra\\..* bt­in­ter­net\\..* al­ice\\..* libero\\..* te­lenet\\..* corp\\.terra\\.com\\.co mac\\.com web­starts\\.com google­mail\\.com msn\\.com tele­worm\\.com is­b­n10\\.net is­b­n13\\.net ymail\\.com maili­na­tor\\.com pook­mail\\.com trashy­mail\\.com dodgit\\.com spam­bob\\.com dotarai\\.co\\.th apps­peo­ple\\.dk in­dia­mart\\.com pkt\\.pl naver\\.com sez­nam\\.cz hem­si­da24\\.se shaw\\.ca ncs\\.com\\.sg rogers\\.com rock­et­mail\\.com ukr\\.net char­ter\\.net uol\\.com\\.br ya\\.ru big­pond\\.com id­web­host\\.com vkios\\.com reg­is­tar\\.com cp­a­sites­o­lu­tions\\.com op­ton­line\\.net irid­i­u­minter­ac­tive\\.com data-typ­ing-earns\\.info smart­pil­lars\\.com nate\\.com list\\.ru o2\\.pl ri­aen­jolie\\.com ii-ii-ii-ii\\.com wp\\.pl ther­a­pysites\\.com mef\\.gob\\.pe the­icon­web\\.com han­mail\\.net nordicweb\\.com havealook\\.com ig\\.com\\.br skepy\\.com nameisp\\.com op­tus­net\\.com\\.au cre­ative­mo­tion­de­sign nifty\\.com ntl­world\\.com peta­matic\\.com telus\\.net msa\\.hinet\\.net sym­pa­tico\\.ca bo­janowski\\.pl bing\\.com zlat­es­tranky\\.cz xtra\\.co\\.nz sina\\.com bluewin\\.ch bol\\.com\\.br cen­trum\\.cz mind­spring\\.com juno\\.com yourha\\.com pho­to­biz\\.com aim\\.com videotron\\.ca blueyon­der\\.co\\.uk email\\.cz tis­cali\\.it tis­cali\\.co\\.uk host­ing\\.com\\.pe in\\.com tea­mu­nify\\.com sky\\.com id­ium\\.no fam­ily-ad­dress\\.ru pel­soft­labs\\.in pobox\\.com sakar­yare­hberim\\.com email\\.com iinet\\.net\\.au web­sites\\.ca globo\\.com code49\\.net xs4all\\.nl win­dowslive\\.com usa\\.net web­tel\\.in big­pond\\.net\\.au vip\\.qq\\.com road­run­ner\\.com pac­bell\\.net sohu\\.com usa\\.com i\\.ua em­bar­q­mail\\.com batesville\\.com go­b­ier­noen­linea\\.gov\\..* fox­mail\\.com in­tern­ode\\.on\\.net abv\\.bg paran\\.com t-on­line\\.de cfl\\.rr\\.com 139\\.com icloud\\.com new­mail\\.ru night­mail\\.ru nm\\.ru pop3\\.ru rbc­mail\\.ru smtp\\.ru hush­mail\\.com al­iceadsl\\.fr ar­cor\\.de cen­tu­ry­tel\\.net chello\\.nl club-in­ter­net\\.fr face­book\\.com freenet\\.de fron­tier­net\\.net het­net\\.nl home\\.nl neuf\\.fr or­ange\\.fr planet\\.nl skynet\\.be tin\\.it vir­gilio\\.it voila\\.fr wind­stream\\.net ya­hoogroups\\.com zon­net\\.nl pro­ton\\.me pro­ton­mail\\.com pro­ton­mail\\.ch pm\\.me .*\\.ocn\\.ne\\.jp ocn\\.ne\\.jp .*\\.plala\\.or\\.jp plala\\.or\\.jp .*\\.biglobe\\.ne\\.jp biglobe\\.ne\\.jp .*\\.so-net\\.ne\\.jp so-net\\.ne\\.jp”.split(” “); EHa = “att.com sfr.com terra.co in­box.kitchen al­ice.app live.space live.lk live.synxis.com live.ink”.split(” “); _.Au = func­tion(a) { re­turn EHa.includes(a) ? !1 : DHa.some(b => (b = a.match(b)) && b.in­dex === 0) } ;

The workaround

I was cu­ri­ous what would hap­pen if I dis­abled this func­tion, so I did, and I was happy to find out that once dis­abled, I was able to con­tinue the sign-up process for my do­main suc­cess­fully. That means that this was only a fron­tend val­i­da­tion, not a server-side one.

Though, I guess that the Ukrainian Ministry of Economy prob­a­bly went for Microsoft 365 in­stead.

Over 170,000 Nonprofits Lost All Their Data. Is Microsoft to Blame?

When the tech gi­ant re­tired a pop­u­lar soft­ware grant, years of non­profit data van­ished with it.

By

Nitish Pahwa

Enter your email to re­ceive alerts for this au­thor.

Sign in or cre­ate an ac­count to bet­ter man­age your email pref­er­ences.

Unsubscribe from email alerts

Are you sure you want to un­sub­scribe from email alerts for Nitish Pahwa?

Aug 18, 20265:40 AM

Sign up for the Slatest to get the most in­sight­ful analy­sis, crit­i­cism, and ad­vice out there, de­liv­ered to your in­box daily.

Ronald Khosla, a for­mer veg­etable farmer and tech en­tre­pre­neur, keeps things sim­ple at his non­profit: He’s the co-founder, pres­i­dent, and head of IT for Canopy, a mod­est ven­ture firm that of­fers cap­i­tal to star­tups try­ing to pro­tect and sus­tain our nat­ural world.

“There’s no paid staff, and we mostly sup­port niche tech pro­jects, like peo­ple ex­plor­ing new ways to pre­serve trees in Morocco or to re­gen­er­a­tively re­grow a pas­ture in Oregon,” Khosla told me.

Keeping such a sparse, spec­i­fied op­er­a­tion go­ing means nar­row­ing bud­gets wher­ever pos­si­ble, es­pe­cially when it comes to man­ag­ing Canopy’s in­vest­ments and data. For that, he’s de­pended for years on spe­cial li­censes Microsoft has granted to smaller-size non­prof­its around the world, of­fer­ing them a pre­mium suite of Office apps (Word, Excel, OneDrive) at no charge.

At least, he did un­til June 11, when Khosla logged on to find that all the Canopy data stored with Microsoft had been deleted. He im­me­di­ately called the tech com­pa­ny’s sup­port staff, who said Canopy could re­trieve its files. Later, they called back to in­form him that, ac­tu­ally, those were gone for­ever.

What hap­pened to Khosla was just one in­stance of a cri­sis that has rocked small non­profit own­ers across the globe, who al­lege that Microsoft failed to com­mu­ni­cate with them in a sub­stan­tive man­ner about the li­cense can­cel­la­tions and left them un­able to pre­pare their or­ga­ni­za­tions for the fu­ture. As they’ve re­lated on­line, these al­ready re­source-strapped non­prof­its have lost troves of data, are strug­gling to con­tinue their op­er­a­tions, and have been left un­able to make up the tech­nol­ogy gaps with al­ter­na­tive ser­vices. People who run ser­vice orgs with low bud­gets and ben­e­fited for years from Microsoft’s pro­grams no longer have much of the tech­nol­ogy they need to keep things go­ing—for ei­ther the short or long term.

Khosla had seen Microsoft’s an­nounce­ment last year that it was wind­ing down its free non­profit li­censes be­gin­ning July 2025, but, per the record, he should have still been in the clear. He re­newed Canopy’s yearly li­cense last October, and Microsoft had emailed him to con­firm he would re­tain ac­cess un­til Oct. 4, 2026. Khosla had no rea­son to ex­pect any­thing would change, and he re­ceived no ad­di­tional warn­ings—even as Microsoft kept in reg­u­lar touch about other soft­ware up­dates. And he later learned he was­n’t alone, when an­other com­pany ser­vice rep­re­sen­ta­tive called the very next day and told him that roughly 171,000 small non­govern­men­tal or­ga­ni­za­tions “lost every­thing” in their OneDrive ac­counts.

In a state­ment emailed to Slate, Microsoft wrote that the orig­i­nal of­fers were “retired to stream­line our grant of­fer­ings and sim­plify our grant port­fo­lio,” adding, “We strongly ad­vised our non­profit cus­tomers and part­ners to tran­si­tion to a dif­fer­ent Microsoft 365 of­fer for non­prof­its be­fore their re­newal date to avoid dis­rup­tion and data loss.”

Khosla for­warded me the first email he had re­ceived, in May 2025, in­form­ing him: “The Microsoft 365 Business Premium grant will be dis­con­tin­ued on your next re­newal on or af­ter July 1, 2025. Your li­censes will ex­pire on October 4, 2025.” But, when Khosla re­newed the li­cense for an­other year, there was no ad­di­tional in­for­ma­tion on the phase­out process in that con­fir­ma­tion email (which Khosla also for­warded to me), and there were no fol­low-up re­minders sent af­ter that.

One source who spoke to me on the con­di­tion of anonymity runs a child health­care or­ga­ni­za­tion that lost every­thing; hav­ing sifted through the org’s email archives, spam and every­thing, he found “zero no­ti­fi­ca­tion” from Microsoft about the li­cense ter­mi­na­tion, even though he kept re­ceiv­ing of­fi­cial in­voices list­ing $0 soft­ware charges. Another told me she was able to save the data for her D.C. non­profit thanks to the help of an IT firm she con­tracts with, but in­sisted that nei­ther she nor her tech team re­ceived any ad­vance no­tice. On Reddit, and across Microsoft’s own Tech Community fo­rums, more such claims abound of sur­prise dele­tion with­out no­ti­fi­ca­tion. (Microsoft stated that it “began no­ti­fy­ing non­profit cus­tomers in Spring 2025” and of­fered “support” through­out the tran­si­tion pe­riod.)

This was not a uni­ver­sal ex­pe­ri­ence. Some com­menters noted that they had re­ceived a May 2025 mes­sage from Microsoft warn­ing of the com­ing grant phase­out, and oth­ers ac­knowl­edged oc­ca­sional re­minders to that ef­fect; they were able to mi­grate their data to dif­fer­ent plat­forms in a timely fash­ion. But one county his­tor­i­cal so­ci­ety di­rec­tor based in Minnesota said she never got a sin­gle re­minder af­ter the May email. Some clients com­plained that even if Microsoft reached out, the mes­sages rarely made sense. On the fo­rums where Microsoft’s non­profit can­cel­la­tions were ini­tially dis­cussed in 2025, a user wrote that they’d as­sumed that those alerts were spam be­cause Microsoft, at that time, was still pro­mot­ing the free non­profit grants on its web­site. The grant roll­back was tech­ni­cally pub­lic in­for­ma­tion, but few would have known to look out with­out an emailed heads-up, and fewer still would have known where to find it, as it was not so promi­nently pub­lished along­side the cor­po­ra­tion’s front-page, A.I.-emphasizing press re­leases. (As the D.C. non­profit worker said: “If I don’t think that there’s go­ing to be a change, why would I go mon­i­tor Microsoft’s page?”)

George Weiner, a non­prof­its ex­pert who runs the mar­ket­ing con­sul­tancy Whole Whale, was made aware of Microsoft’s grant re­trac­tions from the very be­gin­ning, only by hap­pen­stance. “The an­nounce­ment was buried on some info page and passed around by clients who were like, ‘Is this for real?’ ” he told me. “For a pro­gram that’s been around since 2013, it was shock­ing that you’d come across its can­cel­la­tion, ef­fec­tively, in the cor­ner of the bow­els of a sub­page of the in­ter­net.”

Weiner, who has man­aged lit­er­ary non­prof­its in the past, was well aware of how Microsoft’s change-up would af­fect the 400,000 small orgs that had taken ad­van­tage of the pro­gram, and tried to raise broader aware­ness. The sweep­ing ma­jor­ity of American non­prof­its op­er­ate with an­nual bud­gets un­der $1 mil­lion; the value they got from Microsoft’s free busi­ness soft­ware equated to about 30 per­cent of their IT spend, he told me.

“Microsoft was­n’t giv­ing much of an off-ramp, and they were drop­ping their se­cu­rity pack­age dur­ing a crit­i­cal time for non­prof­its, when we’re see­ing A.I.’s abil­ity to pen­e­trate more or­ga­ni­za­tional in­fra­struc­ture,” said Weiner. “They pri­mar­ily emailed the non­prof­its’ ad­min­is­tra­tive ac­counts, and they were rolling off about 33,000 or­ga­ni­za­tions per month. It would be very easy for some­one to go on va­ca­tion at the wrong time and come back only to won­der what hap­pened to all their data.”

It was, in­deed, very easy to miss the warn­ings. The ad­min emails to which Microsoft sent those no­ti­fi­ca­tions tend to get slammed with junk from spam­mers, lead­ing soft­ware de­vel­op­ers to rec­om­mend ig­nor­ing those in­boxes al­to­gether. One source, who helps his mother run a dis­abil­ity ser­vices non­profit and spoke to me on the con­di­tion of anonymity, told me he had all key non­profit com­mu­ni­ca­tions from Microsoft, in­clud­ing tech sup­port, di­rected to a Gmail ad­dress, since nei­ther he nor his mother found the Outlook in­ter­face in­tu­itive or use­ful. (“Nothing else came to that email ex­cept for our in­voices, which al­ways read $0.”) After the non­prof­it’s data was purged in June, he re­al­ized that he’d got­ten two emails warn­ing about the im­pend­ing li­cense sus­pen­sion to his ad­min ac­count, which did not au­to­mat­i­cally for­ward to his Gmail, and which he could not view on Outlook’s desk­top in­ter­face—only on the web app. (I asked my other sources if they’d dou­ble-checked their own ad­min­is­tra­tive ad­dresses, and they in­sisted no warn­ings had come through; Microsoft did not ad­dress my queries re­gard­ing the struc­ture of the ad­min ac­counts.)

The Big Tech be­he­moth did not of­fer a rea­son to me as to why it pulled the plug on a widely used pro­gram and then ren­dered its clients’ data ir­re­triev­able, be­yond its al­ready-pro­fessed goal of “streamlining” and “simplifying” its grants. Weiner sus­pected it was in part po­lit­i­cal, a way to side­step Trump ad­min­is­tra­tion scrutiny over in­ad­ver­tent Microsoft sup­port for orgs the gov­ern­ment did not like. But the com­pany still does of­fer non­profit ser­vices. The is­sue is that once-free pre­mium fea­tures are fenced off at higher prices, and the more-cost-ef­fec­tive op­tions work nowhere near as well. The D.C. non­profit owner told me that her team has been work­ing with on­line ver­sions of Office apps, in­stead of their desk­top coun­ter­parts, and has found that doc­u­ments will of­ten crash and lose work if mul­ti­ple peo­ple col­lab­o­rate on a given pro­ject.

The con­text sur­round­ing Microsoft’s de­ci­sion gives some clues. The PR trade-offs of non­profit sup­port are very dif­fer­ent now from when Microsoft be­gan of­fer­ing these grants in 2013. At that time, char­i­ta­ble giv­ing was trendy in the tech sec­tor, with brands like Microsoft boast­ing of their em­ploy­ees’ mul­ti­mil­lion-dol­lar do­na­tions—com­plete with match­ing funds—and the com­pa­nies’ own phil­an­thropic ef­forts. In more re­cent years, as Microsoft has strug­gled to catch up in the A.I. race and faced pub­lic skep­ti­cism over its pur­ported so­cial jus­tice com­mit­ments, the com­pany has re­fo­cused on su­per­com­put­ing and on pri­mar­ily ap­peas­ing the man who could help this pur­suit (President Donald Trump), what­ever the costs. Hence, “donations” were redi­rected to­ward Trump’s in­au­gu­ra­tion fund and the White House ball­room, while ex­penses were slashed across myr­iad non-A.I.-spe­cific di­vi­sions: video gam­ing, mar­ket­ing, and LinkedIn, for ex­am­ple. Meanwhile, Microsoft des­per­ately needs more room for data stor­age as A.I. is added into all its ma­jor prod­ucts. We’ve al­ready seen Big Tech names like Meta and Google erase user data and im­pose lim­its on vir­tual stor­age as A.I. ex­pen­di­tures bal­loon and mem­ory be­comes more ex­pen­sive.

The small non­prof­its left be­hind are now vis­i­bly strug­gling. The child­hood health­care non­profit op­er­a­tor I spoke to lost about 500 gi­ga­bytes of his fir­m’s data—which he did­n’t back up ex­ter­nally be­cause OneDrive of­fered au­to­matic backup sync­ing—as well as ac­cess to two par­tic­u­lar apps, Power Automate and Forms, that he found use­ful for han­dling af­fairs with donors. (“There’s no easy or quick al­ter­na­tive that we can make work in the short term.”) The man who runs the dis­abil­ity ser­vices non­profit wrote to me that it’ll take him and his mother “hundreds of hours” to fully re-cre­ate the in­struc­tional videos and doc­u­ments that went poof.

For his part, Ronald Khosla hap­pened to keep up a yearly habit of stor­ing all Canopy data in an ex­ter­nal hard drive, be­cause “Microsoft does not make backup easy,” he told me. That drive is phys­i­cally stored on the East Coast—across the coun­try from where he re­sides, in Oregon, which means he’ll have to make a flight to re­store said data onto a dif­fer­ent cloud provider while re­jig­ger­ing his non­prof­it’s soft­ware li­brary. “Multiple peo­ple need ac­cess to that data, so we’re all in limbo un­til I fly back,” he said. “We’re los­ing time and money, but we are go­ing to sur­vive.”

Artificial Intelligence

Nonprofit

Microsoft