We read an en­tire scroll — with­out ever open­ing it

PHerc. 1667, sealed since the erup­tion of Vesuvius in 79 AD, has been vir­tu­ally un­wrapped and read from be­gin­ning to end.

June 25th, 2026

Read the preprint: Complete vir­tual un­wrap­ping and read­ing of a rolled Herculaneum pa­pyrus (PDF). The data is openly avail­able at scroll­prize.org/​data, and the code on GitHub.

For al­most 2,000 years, the car­bonized li­brary of Herculaneum has kept a cruel bar­gain: its scrolls sur­vived the erup­tion of Mount Vesuvius, but only by be­com­ing too frag­ile to open. To read one was to de­stroy it. Hundreds of rolls have there­fore re­mained sealed, their con­tents pre­served yet un­reach­able.

Today that changes. We have com­pletely vir­tu­ally un­wrapped and read PHerc. 1667 — the scroll the Vesuvius Challenge com­mu­nity knows as Scroll 4 — with­out ever touch­ing its pages. It is the first Herculaneum pa­pyrus to be dig­i­tally un­rolled and read in full, end to end, and made avail­able for sus­tained schol­arly study.

From a sealed lump to a read­able book​

PHerc. 1667 be­gan as a black­ened, rolled mass of car­bonized pa­pyrus. To read it, we never un­rolled it phys­i­cally. Instead, we scanned it with high-res­o­lu­tion X-rays, re­con­structed the wound sheet in­side the vol­ume, flat­tened it into a read­able sur­face, and used ma­chine learn­ing to bring out the faint traces of an­cient ink.

The work reaches be­yond a sin­gle scroll. Alongside the com­plete read­ing of PHerc. 1667, the re­search es­tab­lishes a method that holds up un­der in­de­pen­dent checks and scales to other rolls.

PHerc. 1667 — read in full​

PHerc. 1667 is what sur­vives of a larger roll: ear­lier at­tempts to open it by hand — in the nine­teenth cen­tury, and again in 1969 and the 1980s — de­stroyed its outer lay­ers and left only the com­pact in­ner core, about 8 cm of an orig­i­nal height of 19 – 24 cm. From that sur­viv­ing por­tion we have now re­cov­ered and read the text in full — the lower parts of some twenty-two columns, tran­scribed and re­viewed by pa­py­rol­o­gists. It is the first time the pre­served text of a rolled Herculaneum scroll has been read con­tin­u­ously, end to end, rather than in iso­lated words or patches.

The re­cov­ered text is a philo­soph­i­cal trea­tise on ethics, and the ev­i­dence points to a Stoic work: it turns on hu­man na­ture, im­pulse, and the moral progress of hu­man be­ings, and its fi­nal pre­served col­umn names Aristocreon — nephew and dis­ci­ple of the great Stoic Chrysippus — which, to­gether with the lan­guage and themes of the text, places it in a Stoic con­text and dates it to the 2nd cen­tury BC.

Because the pa­pyrus is dam­aged, the read­ings are frag­men­tary, with gaps where the sur­face is lost. Even so, sev­eral pas­sages can be read clearly for the first time in two thou­sand years:

“…we will in­quire into some­thing, but we will not grasp it, if in some way we de­part from our­selves and from our own na­ture…”

“Having…strained our­selves to the ut­most through re­search and learn­ing…pos­sess­ing the same prac­ti­cal wis­dom…”

“…such be­ing the goods for us, even from the op­po­site evils there will be nei­ther any­thing good — let alone beau­ti­ful — nor any­thing bad — let alone ugly — nor hap­pi­ness…”

Translated from the Greek; the full col­umn-by-col­umn tran­scrip­tion is in the preprint.

PHerc. Paris 4 — ink made vis­i­ble by higher res­o­lu­tion​

In a sec­ond scroll — PHerc. Paris 4, the scroll the Vesuvius Challenge com­mu­nity knows as Scroll 1 — a higher-res­o­lu­tion imag­ing tech­nique makes the ink di­rectly vis­i­ble in­side the scroll it­self, in the three-di­men­sional X-ray data, for the first time. Segmented in 3D and pro­jected back onto the un­wrapped page, that ink matches the text read in the 2023 Grand Prize one-to-one — an in­de­pen­dent con­fir­ma­tion, from bet­ter data, that the read­ing is real.

PHerc. 139 — a ti­tle, and an au­thor​

In a third scroll, PHerc. 139, we re­cover the scrol­l’s ti­tle and au­thor at­tri­bu­tion: the work is iden­ti­fied as Philodemus, On Gods, Book 8 — a trea­tise by the Epicurean philoso­pher whose works fill so much of this li­brary. Reading the ti­tle of a closed scroll tells schol­ars what a roll con­tains be­fore a sin­gle col­umn of its body is stud­ied.

How it was done​

The scans were ac­quired with high-res­o­lu­tion phase-con­trast X-ray mi­cro­to­mog­ra­phy on the BM18 beam­line at the European Synchrotron Radiation Facility (ESRF) in Grenoble — an in­stru­ment able to re­solve the wafer-thin, densely packed lay­ers of a Herculaneum roll. The work was car­ried out in col­lab­o­ra­tion with the National Library of Naples “Vittorio Emanuele III”, which safe­guards the Herculaneum pa­pyri. From those vol­umes, the team re­con­structed the scrol­l’s geom­e­try, traced and flat­tened its sur­face into a read­able sheet, and trained ma­chine-learn­ing mod­els to de­tect ink that is al­most in­dis­tin­guish­able from the car­bonized pa­pyrus be­neath it. Each read­ing was then ex­am­ined and tran­scribed by pa­py­rol­o­gists.

Crucially, all of this is open. The to­mo­graphic data, re­con­structed sur­faces and tran­scrip­tions are re­leased un­der a Creative Commons li­cence at scroll­prize.org/​data and archived at the ESRF, and the code is on GitHub. Anyone can check the work, build on it, and ap­ply it to the scrolls that re­main.

A vic­tory for open, global sci­ence​

This is what open sci­ence makes pos­si­ble. The vir­tual un­wrap­ping of the Herculaneum scrolls was pi­o­neered at EduceLab by its prin­ci­pal in­ves­ti­ga­tor, Professor Brent Seales. In 2023 Seales opened his lab’s imag­ing and soft­ware tech­nol­ogy to the Vesuvius Challenge — a pub­lic, do­na­tion-funded ef­fort he co-founded with Nat Friedman and Daniel Gross to read the scrolls in the open — and from there a global com­mu­nity took up the prob­lem. The first let­ters and the 2023 Grand Prize were won by con­tes­tants from across the world.

What is less widely known is what hap­pened next. Most of the Vesuvius Challenge re­search team first ar­rived as con­tes­tants. They en­tered the open com­pe­ti­tion, won prizes for the break­throughs they made, and were then re­cruited onto the team that has now read an en­tire scroll. The peo­ple be­hind this break­through are, in large part, the global com­mu­nity the Challenge it­self cre­ated.

What’s next​

PHerc. 1667 is one scroll. Hundreds more re­main sealed — an en­tire li­brary of phi­los­o­phy, po­etry and prose wait­ing to be read for the first time since an­tiq­uity. The method shown here is built to scale, and every­thing needed to ap­ply it is open.

If you want to help read the rest of the li­brary:

Read the sci­ence: the preprint (PDF).

Get the data and code: scroll­prize.org/​data and GitHub.

Join the ef­fort: get started and be­come part of the com­mu­nity read­ing the scrolls.

The thoughts of the an­cient world, sealed in dark­ness for two mil­len­nia, are com­ing back into the light — a whole scroll at a time.

If you want to share some­thing that does­n’t fit in a com­ment, please drop a link to it.

If you want to share some­thing that does­n’t fit in a com­ment, please drop a link to it.

My con­do­lences to fam­ily and friends. I’ve been read­ing Om’s blog for years and al­ways en­joyed his in­sight, and es­pe­cially his in­ter­weaved cre­ative en­deav­ors. His pho­tog­ra­phy has al­ways been strik­ing. He’ll be missed.

Om was such a force around in­no­va­tion through­out the early 2000s.. I re­lied on his writ­ing and coun­cil as a ven­ture cap­i­tal­ist with Orange Ventures any nu­mer­ous ar­ti­cles on the work we did through­out the early days of Android. He had a tal­ent for hon­ing it on and dis­till­ing lead­ing tech­nolo­gies help oth­ers un­der­stand their po­ten­tial. and for the past decade or more it’s been fun to see the world through his lens and his pho­tog­ra­phy posts. May his mem­ory be a bless­ing.

My con­do­lences to fam­ily and friends. I’ve been read­ing Om’s blog for years and al­ways en­joyed his in­sight, and es­pe­cially his in­ter­weaved cre­ative en­deav­ors. His pho­tog­ra­phy has al­ways been strik­ing. He’ll be missed.

Om was such a force around in­no­va­tion through­out the early 2000s.. I re­lied on his writ­ing and coun­cil as a ven­ture cap­i­tal­ist with Orange Ventures any nu­mer­ous ar­ti­cles on the work we did through­out the early days of Android. He had a tal­ent for hon­ing it on and dis­till­ing lead­ing tech­nolo­gies help oth­ers un­der­stand their po­ten­tial. and for the past decade or more it’s been fun to see the world through his lens and his pho­tog­ra­phy posts. May his mem­ory be a bless­ing.

Om was such a force around in­no­va­tion through­out the early 2000s.. I re­lied on his writ­ing and coun­cil as a ven­ture cap­i­tal­ist with Orange Ventures any nu­mer­ous ar­ti­cles on the work we did through­out the early days of Android. He had a tal­ent for hon­ing it on and dis­till­ing lead­ing tech­nolo­gies help oth­ers un­der­stand their po­ten­tial. and for the past decade or more it’s been fun to see the world through his lens and his pho­tog­ra­phy posts. May his mem­ory be a bless­ing.

I did­n’t know Om well, but I sa­vored my en­coun­ters with him, the last of which was a year ago at WWDC. He had been do­ing the best writ­ing of his life in re­cent months on this site, and in his ab­sence, we will all un­der­stand the tech in­dus­try a lit­tle less well. I’m so very sorry.

A sad day when we lose one of the most sup­port­ive and bright­est. He was a fa­ther and men­tor to the en­tire Gigaom fam­ily, help­ing us be­come bet­ter writ­ers, and hu­mans, than we thought we could be. I will miss you, Om. Peace to you and yours.

I did­n’t know Om well, but I sa­vored my en­coun­ters with him, the last of which was a year ago at WWDC. He had been do­ing the best writ­ing of his life in re­cent months on this site, and in his ab­sence, we will all un­der­stand the tech in­dus­try a lit­tle less well. I’m so very sorry.

A sad day when we lose one of the most sup­port­ive and bright­est. He was a fa­ther and men­tor to the en­tire Gigaom fam­ily, help­ing us be­come bet­ter writ­ers, and hu­mans, than we thought we could be. I will miss you, Om. Peace to you and yours.

A sad day when we lose one of the most sup­port­ive and bright­est. He was a fa­ther and men­tor to the en­tire Gigaom fam­ily, help­ing us be­come bet­ter writ­ers, and hu­mans, than we thought we could be. I will miss you, Om. Peace to you and yours.

The best.

The best.

We never met, never even talked re­ally- just a cou­ple of brief pleas­antries ex­changed here and there over shared in­ter­ests… yet this news is like a gut punch. Om was an in­sight­ful, steady­ing voice through­out my time as­so­ci­ated with the tech­nol­ogy in­dus­try- his ex­pe­ri­ence calmed choppy wa­ters, and was of­ten a much needed dose of per­spec­tive in a world in­creas­ingly happy to fo­cus on style over sub­stance. His es­says felt like a throw­back in the best pos­si­ble way, and his pas­sion for el­e­gance and crafts­man­ship was in­fec­tious. I thank him for the gift of his knowl­edge, and his un­err­ing pas­sion for the in­ter­est­ing. I hope his legacy brings com­fort to his fam­ily and loved ones.

Om was a pi­o­neer, al­ways cu­ri­ous, in­tel­lec­tual depth, an as­tute chron­i­cler of our time and fore­most a good per­son

We never met, never even talked re­ally- just a cou­ple of brief pleas­antries ex­changed here and there over shared in­ter­ests… yet this news is like a gut punch.

Om was an in­sight­ful, steady­ing voice through­out my time as­so­ci­ated with the tech­nol­ogy in­dus­try- his ex­pe­ri­ence calmed choppy wa­ters, and was of­ten a much needed dose of per­spec­tive in a world in­creas­ingly happy to fo­cus on style over sub­stance. His es­says felt like a throw­back in the best pos­si­ble way, and his pas­sion for el­e­gance and crafts­man­ship was in­fec­tious.

I thank him for the gift of his knowl­edge, and his un­err­ing pas­sion for the in­ter­est­ing. I hope his legacy brings com­fort to his fam­ily and loved ones.

Om was a pi­o­neer, al­ways cu­ri­ous, in­tel­lec­tual depth, an as­tute chron­i­cler of our time and fore­most a good per­son

Om was a pi­o­neer, al­ways cu­ri­ous, in­tel­lec­tual depth, an as­tute chron­i­cler of our time and fore­most a good per­son

A great man. What a ter­ri­ble loss for the SF com­mu­nity.

OM was a pi­o­neer. I have been deeply shaped and in­flu­enced by his writ­ings, learn­ings that he shared via his blogs, newslet­ter, talks etc. Very sad to hear of his pass­ing. Shall pray for his peace. Condolences to his fam­ily and friends.

A great man. What a ter­ri­ble loss for the SF com­mu­nity.

OM was a pi­o­neer. I have been deeply shaped and in­flu­enced by his writ­ings, learn­ings that he shared via his blogs, newslet­ter, talks etc. Very sad to hear of his pass­ing. Shall pray for his peace. Condolences to his fam­ily and friends.

OM was a pi­o­neer. I have been deeply shaped and in­flu­enced by his writ­ings, learn­ings that he shared via his blogs, newslet­ter, talks etc.

Very sad to hear of his pass­ing. Shall pray for his peace.

Condolences to his fam­ily and friends.

This is ter­ri­ble news … so so sad i have never met him in real life only fol­lowed through on­line blogs and also on his site …life is frag­ile, may his soul rest in peace …all we have got is to­day and thats re­al­ity 🙁 We will learn some amaz­ing things he taught us via his writ­ing and some ob­ser­va­tions… Words , emo­tions, in­ter­ac­tion via com­ments re­ally have mean­ing … Thank you Om …May you rest in peace and strength to fam­ily

This is ter­ri­ble news … so so sad i have never met him in real life only fol­lowed through on­line blogs and also on his site …life is frag­ile, may his soul rest in peace …all we have got is to­day and thats re­al­ity 🙁 We will learn some amaz­ing things he taught us via his writ­ing and some ob­ser­va­tions… Words , emo­tions, in­ter­ac­tion via com­ments re­ally have mean­ing … Thank you Om …May you rest in peace and strength to fam­ily

Om was al­ways thought­ful and smart, with his unique per­spec­tive on tech, pens, health, pho­tog­ra­phy and so many other things. We first met when he was an Advisor to about.me, where I worked. He re­sponded any­where. My con­do­lences to his fam­ily and loved ones.

Om was al­ways thought­ful and smart, with his unique per­spec­tive on tech, pens, health, pho­tog­ra­phy and so many other things. We first met when he was an Advisor to about.me, where I worked. He re­sponded any­where. My con­do­lences to his fam­ily and loved ones.

My con­do­lences to Om’s fam­ily and friends. I have been a long-time reader of his work for so many years. Rest in peace, and let’s all take care of and ap­pre­ci­ate each other while we can.

My con­do­lences to Om’s fam­ily and friends. I have been a long-time reader of his work for so many years. Rest in peace, and let’s all take care of and ap­pre­ci­ate each other while we can.

This is hor­ri­ble news. I’m so sorry to hear. I met Om once for cof­fee and we emailed each other with talk of cam­eras and set­tings and all that good stuff. He will be thought of of­ten and missed im­mensely. — Matt

This is hor­ri­ble news. I’m so sorry to hear. I met Om once for cof­fee and we emailed each other with talk of cam­eras and set­tings and all that good stuff. He will be thought of of­ten and missed im­mensely. — Matt

I met Om al­most 13 years ago via Matt Mullenweg. Om was so gen­er­ous with his time, ad­vice, and great at mak­ing a founder feel like a friend. I still re­mem­ber our meet­ing and time spent. My con­do­lences, he will be missed and very much re­mem­bered.

I met Om al­most 13 years ago via Matt Mullenweg. Om was so gen­er­ous with his time, ad­vice, and great at mak­ing a founder feel like a friend. I still re­mem­ber our meet­ing and time spent. My con­do­lences, he will be missed and very much re­mem­bered.

I’m so sad to hear this — I never met a kinder en­tre­pre­neur. I only met Om a hand­ful of times, but he shared two last­ing lessons with me. The first was when he was run­ning GigaOm and I was a cub tech re­porter at the SF Chronicle. He was skep­ti­cal about hir­ing me, he said, be­cause news­pa­per writ­ers were gen­er­ally too slow and did­n’t un­der­stand web-era pub­lish­ing. He was right, and it pushed me to leave news­pa­pers as quickly as I could to prove that I could evolve. The sec­ond was many years later, when I was hav­ing a drink with him and some other re­porters. We asked him what ad­vice he had for us, and he said: never name your blog af­ter your­self. I’m happy to have known him even a lit­tle, and my con­do­lences to his friends and fam­ily.

I’m so sad to hear this — I never met a kinder en­tre­pre­neur.

I only met Om a hand­ful of times, but he shared two last­ing lessons with me.

The first was when he was run­ning GigaOm and I was a cub tech re­porter at the SF Chronicle. He was skep­ti­cal about hir­ing me, he said, be­cause news­pa­per writ­ers were gen­er­ally too slow and did­n’t un­der­stand web-era pub­lish­ing. He was right, and it pushed me to leave news­pa­pers as quickly as I could to prove that I could evolve.

The sec­ond was many years later, when I was hav­ing a drink with him and some other re­porters. We asked him what ad­vice he had for us, and he said: never name your blog af­ter your­self.

I’m happy to have known him even a lit­tle, and my con­do­lences to his friends and fam­ily.

Om was one of the greats. A ter­rific jour­nal­ist, a fix­ture of Silicon Valley, and a good friend. He was al­ways bru­tally hon­est and usu­ally right. He will be missed.

Om was one of the greats. A ter­rific jour­nal­ist, a fix­ture of Silicon Valley, and a good friend. He was al­ways bru­tally hon­est and usu­ally right.

He will be missed.

I’m so very sorry. Om was a good per­son, To sort care­fully about every­thing from friends to fam­ily, I will miss him. My con­do­lences.

I’m so very sorry. Om was a good per­son, To sort care­fully about every­thing from friends to fam­ily, I will miss him. My con­do­lences.

Om, I’m so glad we made time to meetup at the SF Pen Ahow last fall. Pens, pa­per, writ­ing, friend­ships. Your happy place. You were run­ning late be­cause you were vol­un­teer­ing and help­ing the show for a com­mu­nity you loved so much. Thank you my sweet, sweet friend.

Om, I’m so glad we made time to meetup at the SF Pen Ahow last fall. Pens, pa­per, writ­ing, friend­ships. Your happy place. You were run­ning late be­cause you were vol­un­teer­ing and help­ing the show for a com­mu­nity you loved so much.

Thank you my sweet, sweet friend.

My con­do­lences. Om’s writ­ing was a calm space in the whirling dervish that is the in­ter­net. I’ll miss read­ing his mis­sives and wit­ness­ing more of his pho­tog­ra­phy.

My con­do­lences. Om’s writ­ing was a calm space in the whirling dervish that is the in­ter­net. I’ll miss read­ing his mis­sives and wit­ness­ing more of his pho­tog­ra­phy.

I’m so sad. Om was a true pi­o­neer and a role model. My great­est sym­pa­thy to his fam­ily. I’m truly shaken by this news.

I’m so sad. Om was a true pi­o­neer and a role model. My great­est sym­pa­thy to his fam­ily. I’m truly shaken by this news.

Deepest con­do­lences. This is crush­ing for the Malik Family, and his mas­sive fan­dom. When one read his note about tak­ing a short break, lit­tle did we know that would be his last mis­sive. Au Revoir, Om. Your words will con­tinue to in­spire.

Deepest con­do­lences. This is crush­ing for the Malik Family, and his mas­sive fan­dom.

When one read his note about tak­ing a short break, lit­tle did we know that would be his last mis­sive.

Au Revoir, Om. Your words will con­tinue to in­spire.

Thoughtful, Wise and Sincere. Responsive to com­ments. I learned so much read­ing and re­flect­ing on his writ­ing.

Thoughtful, Wise and Sincere. Responsive to com­ments. I learned so much read­ing and re­flect­ing on his writ­ing.

I too was a ca­sual friend (more ca­sual than I wish I had been) but I re­call fondly every in­ter­ac­tion we had over the years, when I moved to the Bay Area back in 2006, Om was one of the friend­liest and also best folks to know in the tech scene here. I re­mem­ber great dis­cus­sions at var­i­ous events over the years and as Harry notes his writ­ing in re­cent months has been fan­tas­tic. May his mem­ory be a bless­ing.

I too was a ca­sual friend (more ca­sual than I wish I had been) but I re­call fondly every in­ter­ac­tion we had over the years, when I moved to the Bay Area back in 2006, Om was one of the friend­liest and also best folks to know in the tech scene here. I re­mem­ber great dis­cus­sions at var­i­ous events over the years and as Harry notes his writ­ing in re­cent months has been fan­tas­tic. May his mem­ory be a bless­ing.

I will miss “On my Om” and I’m sure I won’t be alone in that. Rest in peace, Om, and con­do­lences to fam­ily and friends.

I will miss “On my Om” and I’m sure I won’t be alone in that. Rest in peace, Om, and con­do­lences to fam­ily and friends.

My heart­felt con­do­lences. We’ve ex­changed thought­ful com­ments on this blog and con­nected a few times on so­cial me­dia, but I will truly miss his end­less cu­rios­ity about the world. His pas­sion ex­tended be­yond tech­nol­ogy; he had a re­mark­able abil­ity to cap­ture the mo­ments he ex­pe­ri­enced through the lens of a cam­era. He did­n’t just trans­port you to those scenes; he also made you aware of why they mat­tered and why you should care. There are very few newslet­ters I ea­gerly an­tic­i­pate, de­spite sub­scrib­ing to nu­mer­ous ones. His was one of the four that I looked for­ward to with gen­uine en­thu­si­asm. Om will be deeply missed by many, as his writ­ing ac­com­plished some­thing few oth­ers achieve to­day: it in­spired us to strive to be bet­ter hu­man be­ings. R.I.P.

My heart­felt con­do­lences. We’ve ex­changed thought­ful com­ments on this blog and con­nected a few times on so­cial me­dia, but I will truly miss his end­less cu­rios­ity about the world. His pas­sion ex­tended be­yond tech­nol­ogy; he had a re­mark­able abil­ity to cap­ture the mo­ments he ex­pe­ri­enced through the lens of a cam­era. He did­n’t just trans­port you to those scenes; he also made you aware of why they mat­tered and why you should care.

There are very few newslet­ters I ea­gerly an­tic­i­pate, de­spite sub­scrib­ing to nu­mer­ous ones. His was one of the four that I looked for­ward to with gen­uine en­thu­si­asm. Om will be deeply missed by many, as his writ­ing ac­com­plished some­thing few oth­ers achieve to­day: it in­spired us to strive to be bet­ter hu­man be­ings. R.I.P.

Om was one of my first bosses in jour­nal­ism, and the lessons he taught me have been a part of my daily life ever since. Following him through blogs and so­cial me­dia in the time since, I al­ways ad­mired how kind and cu­ri­ous he al­ways was, in ad­di­tion to be­ing one of the sharpest minds about tech out there. Shocked and sad­dened by the news, and deep­est sym­pa­thies to his friends and fam­ily.

Om was one of my first bosses in jour­nal­ism, and the lessons he taught me have been a part of my daily life ever since. Following him through blogs and so­cial me­dia in the time since, I al­ways ad­mired how kind and cu­ri­ous he al­ways was, in ad­di­tion to be­ing one of the sharpest minds about tech out there. Shocked and sad­dened by the news, and deep­est sym­pa­thies to his friends and fam­ily.

When I first started spend­ing time on the web and read­ing a lot about tech news, GigaOm was one of the best web­sites I reg­u­larly vis­ited. When I joined Twitter, Om was among the first per­sons I fol­lowed. When I started lis­ten­ing to pod­casts, Om was one of the voices I liked the most (I be­lieve he was a reg­u­lar on Twit dot TV). When I fi­nally got to work in the in­dus­try my­self, I had the chance to meet him and tell him in per­son, in Paris, at the Le Web event, while shak­ing his hand, that I was a big fan. I re­mem­ber this mo­ment very clearly (it was in the me­dia break room) as I felt so lucky to meet one of my web he­roes. I was very shy, and I could have (should have) told him that he was one of my in­spi­ra­tions. Ever since that mo­ment, Om kept on prov­ing he was one of the best ob­servers and com­men­ta­tors of the in­dus­try, and one of the best writ­ers. His blog is so good. This feels so sud­den, too soon. My thoughts are with his loved ones. I’m so sorry. His words, his writ­ing, his thoughts, his im­pec­ca­ble taste will be missed.

When I first started spend­ing time on the web and read­ing a lot about tech news, GigaOm was one of the best web­sites I reg­u­larly vis­ited. When I joined Twitter, Om was among the first per­sons I fol­lowed. When I started lis­ten­ing to pod­casts, Om was one of the voices I liked the most (I be­lieve he was a reg­u­lar on Twit dot TV). When I fi­nally got to work in the in­dus­try my­self, I had the chance to meet him and tell him in per­son, in Paris, at the Le Web event, while shak­ing his hand, that I was a big fan. I re­mem­ber this mo­ment very clearly (it was in the me­dia break room) as I felt so lucky to meet one of my web he­roes. I was very shy, and I could have (should have) told him that he was one of my in­spi­ra­tions. Ever since that mo­ment, Om kept on prov­ing he was one of the best ob­servers and com­men­ta­tors of the in­dus­try, and one of the best writ­ers. His blog is so good. This feels so sud­den, too soon. My thoughts are with his loved ones. I’m so sorry. His words, his writ­ing, his thoughts, his im­pec­ca­ble taste will be missed.

Sad to hear of Om’s pass­ing. We kept in loose touch over nearly two decades. I was for­tu­nate to have a few meals with him and trea­sured our con­ver­sa­tions and his com­pany. Outstanding writer, kind hearted, warm spir­ited, and very in­sight­ful. Loved talk­ing watches with him as well. He was al­ways open to in­ter­est­ing ideas, no mat­ter where they came from. A won­der­ful hu­man, a gift to know. ❤️

Sad to hear of Om’s pass­ing. We kept in loose touch over nearly two decades. I was for­tu­nate to have a few meals with him and trea­sured our con­ver­sa­tions and his com­pany. Outstanding writer, kind hearted, warm spir­ited, and very in­sight­ful. Loved talk­ing watches with him as well. He was al­ways open to in­ter­est­ing ideas, no mat­ter where they came from. A won­der­ful hu­man, a gift to know. ❤️

I ad­mired Om as a pi­o­neer in tech jour­nal­ism, but also as a man with a kind heart and soul. At the height of his pow­ers, he was a gi­ant, but a gi­ant with a con­science. His loss leaves us all a lit­tle poorer at a time when we need a mind and a con­science like his more than ever. May his mem­ory be a bless­ing.

I ad­mired Om as a pi­o­neer in tech jour­nal­ism, but also as a man with a kind heart and soul. At the height of his pow­ers, he was a gi­ant, but a gi­ant with a con­science. His loss leaves us all a lit­tle poorer at a time when we need a mind and a con­science like his more than ever. May his mem­ory be a bless­ing.

Inna lil­lahi wa inna ilayhi ra­jioon (RIP). I am in shock. I knew Om from when he was still an ac­tive jour­nal­ist, be­fore even GigaOm, and re­mem­ber fondly our geeky con­ver­sa­tions on how to free jour­nal­ism from its Big Tech shack­les us­ing RSS. He was not much older than me, and I kept bump­ing into him at ran­dom when I still lived in San Francisco. My sin­cere con­do­lences to his fam­ily and friends.

Inna lil­lahi wa inna ilayhi ra­jioon (RIP).

I am in shock. I knew Om from when he was still an ac­tive jour­nal­ist, be­fore even GigaOm, and re­mem­ber fondly our geeky con­ver­sa­tions on how to free jour­nal­ism from its Big Tech shack­les us­ing RSS. He was not much older than me, and I kept bump­ing into him at ran­dom when I still lived in San Francisco.

My sin­cere con­do­lences to his fam­ily and friends.

I met Om a few times, talked on the phone with him a cou­ple times, but I wish I’d known him bet­ter. He was a gi­ant in our busi­ness, and even though he’s gone, his in­flu­ence con­tin­ues on.

I met Om a few times, talked on the phone with him a cou­ple times, but I wish I’d known him bet­ter. He was a gi­ant in our busi­ness, and even though he’s gone, his in­flu­ence con­tin­ues on.

I am shocked, he was a close friend, we are the same age and grew up in New Delhi, first met him in the 90’s when he in­ter­viewed me, and af­ter that we shared our love for tech­nol­ogy and pho­tog­ra­phy… I dont even know what else to say, I wanted to show him what I was work­ing on these days, and he had not re­sponded was strange… he leaves a huge gap in the world, there was only one OM

I am shocked, he was a close friend, we are the same age and grew up in New Delhi, first met him in the 90’s when he in­ter­viewed me, and af­ter that we shared our love for tech­nol­ogy and pho­tog­ra­phy… I dont even know what else to say, I wanted to show him what I was work­ing on these days, and he had not re­sponded was strange… he leaves a huge gap in the world, there was only one OM

My con­do­lences to Om’s fam­ily. He was an in­cred­i­bly kind soul to all of us en­tre­pre­neurs dur­ing the resur­gence of the web (“Web 2.0” as it came to be known). Rather than try­ing to be the clever an­a­lyst, he was al­ways re­spect­ful, al­ways kind and most im­por­tantly, al­ways ex­cited in a way that was so in­fec­tious to all of us around him. We will truly miss him but his spirit will live on in the count­less peo­ple he touched over a ca­reer of bring­ing so much pos­i­tive en­ergy into the world.

My con­do­lences to Om’s fam­ily. He was an in­cred­i­bly kind soul to all of us en­tre­pre­neurs dur­ing the resur­gence of the web (“Web 2.0” as it came to be known). Rather than try­ing to be the clever an­a­lyst, he was al­ways re­spect­ful, al­ways kind and most im­por­tantly, al­ways ex­cited in a way that was so in­fec­tious to all of us around him. We will truly miss him but his spirit will live on in the count­less peo­ple he touched over a ca­reer of bring­ing so much pos­i­tive en­ergy into the world.

When some­thing in­ter­est­ing is hap­pen­ing, es­pe­cially when it’s tech­nol­ogy re­lated, and es­pe­cially when I’ve been stew­ing on it and had a hard time so­lid­i­fy­ing my own un­der­stand­ing, some­times I think, “I won­der what Om’s take is.” There have only ever been a hand­ful of voices worth turn­ing to like that, be­cause the kind of care Om put into his thoughts and his abil­ity to turn his thoughts into words is rare. So sorry for this world to lose him. Condolences to his fam­ily, friends, and com­mu­nity.

When some­thing in­ter­est­ing is hap­pen­ing, es­pe­cially when it’s tech­nol­ogy re­lated, and es­pe­cially when I’ve been stew­ing on it and had a hard time so­lid­i­fy­ing my own un­der­stand­ing, some­times I think, “I won­der what Om’s take is.” There have only ever been a hand­ful of voices worth turn­ing to like that, be­cause the kind of care Om put into his thoughts and his abil­ity to turn his thoughts into words is rare. So sorry for this world to lose him. Condolences to his fam­ily, friends, and com­mu­nity.

Om, I un­for­tu­nately never met you in per­son but your writ­ing al­ways hit the spot. You’ll be missed. ♥️ My heart goes out to your fam­ily and friends.

Om, I un­for­tu­nately never met you in per­son but your writ­ing al­ways hit the spot. You’ll be missed. ♥️

My heart goes out to your fam­ily and friends.

Om’s uniquely in­formed per­spec­tive re­sulted in writ­ing that con­tained equal mea­sures of kind­ness and can­dor about two fields that of­ten clash, news and tech. He was as warm and thought­ful in per­son as on the page and had given me some great ca­reer ad­vice early on in mine. Deepest sym­pa­thies to those who knew and loved the man.

Om’s uniquely in­formed per­spec­tive re­sulted in writ­ing that con­tained equal mea­sures of kind­ness and can­dor about two fields that of­ten clash, news and tech. He was as warm and thought­ful in per­son as on the page and had given me some great ca­reer ad­vice early on in mine. Deepest sym­pa­thies to those who knew and loved the man.

I’m heart­bro­ken to read this! Sending my con­do­lences to Om’s fam­ily and friends– I never got to know him in per­son, but al­ways cher­ished our few on­line in­ter­ac­tions and have long ad­mired both his writ­ing and pho­tog­ra­phy. He’ll be long re­mem­bered and missed by so many!

I’m heart­bro­ken to read this! Sending my con­do­lences to Om’s fam­ily and friends– I never got to know him in per­son, but al­ways cher­ished our few on­line in­ter­ac­tions and have long ad­mired both his writ­ing and pho­tog­ra­phy. He’ll be long re­mem­bered and missed by so many!

I’ll re­mem­ber him, not only from his writ­ing, but also from his ex­pres­sion of his sen­si­bil­i­ties through his pho­tog­ra­phy. RIP

I’ll re­mem­ber him, not only from his writ­ing, but also from his ex­pres­sion of his sen­si­bil­i­ties through his pho­tog­ra­phy. RIP

I never met Om, but greatly ap­pre­ci­ated his pro­found in­sights on the com­plex­i­ties & im­pli­ca­tions of tech­nol­ogy as well as his pho­to­graphic artistry & love of foun­tain pens & inks. I al­ways in­tended to send him a note, which I re­gret I never did. My con­do­lences to his fam­ily & friends.

I never met Om, but greatly ap­pre­ci­ated his pro­found in­sights on the com­plex­i­ties & im­pli­ca­tions of tech­nol­ogy as well as his pho­to­graphic artistry & love of foun­tain pens & inks. I al­ways in­tended to send him a note, which I re­gret I never did. My con­do­lences to his fam­ily & friends.

Imagine your fa­vorite team just scored an in­cred­i­ble, last-sec­ond goal at the World Cup. So you log on­line to cel­e­brate with other fans. But, us­ing data it’s al­ready col­lected on you, the so­cial me­dia plat­form you like to post on wrongly guesses that you’re un­der 16 so it forces you to go to a third-party ver­i­fi­ca­tion app and pro­vide im­ages of your face or your gov­ern­ment-is­sued ID. You don’t re­ally know much about the ver­i­fi­ca­tion app, what coun­try it’s based out of, what hap­pens with your in­for­ma­tion, and whether you’re pro­tected from hack­ers or data breaches. You’re not happy about it, but you hand over a photo of your pass­port and hope it does­n’t come back to haunt you.

Now imag­ine that in­stead of post­ing about sports, you’re crit­i­ciz­ing a pow­er­ful politi­cian, or talk­ing about your ex­pe­ri­ences with abuse or ad­dic­tion, or dis­cussing em­bar­rass­ing med­ical is­sues you’re fac­ing. Suddenly this “papers, please” ap­proach to the in­ter­net sounds even more in­va­sive, right? Unfortunately, that’s the di­rec­tion we’re all headed — even here in the United States — and we have good rea­son to be wary of the global rush to sac­ri­fice user pri­vacy on the al­tar of age ver­i­fi­ca­tion.

Australia’s so­cial me­dia ban for un­der-16s went into ef­fect in December 2025 and set a land­mark stan­dard many other na­tions now look to when craft­ing their own such reg­u­la­tions. As a pre­lim­i­nary mat­ter: This law is not work­ing as in­tended. The gov­ern­men­t’s own re­search found that months af­ter the in­sti­tu­tion of the ban, roughly seven out of 10 kids still were us­ing so­cial me­dia. And a study just re­leased in the British Medical Journal found “little ev­i­dence was found of im­me­di­ate sub­stan­tive re­duc­tions in re­ported so­cial me­dia use by ado­les­cents un­der 16 years.” Secondly, phones are al­ready banned in Australian schools, so this ban is in­tended to ad­dress what kids do on the in­ter­net in their own free time, not dur­ing class time.

So, what ex­actly does this law — one that is ren­dered ir­rel­e­vant dur­ing the school day, and is­n’t even work­ing prop­erly out­side it any­way — ac­tu­ally man­date? Well, pretty much what was in the hy­po­thet­i­cal de­scribed ear­lier in this piece, ex­cept it’s not at all a hy­po­thet­i­cal any­more.

Essays

Cassius Marcellus Clay brought can­nons to a free press fight

·

Jun 25

In June 1845, Cassius Marcellus Clay launched an anti-slav­ery news­pa­per in Lexington, Kentucky, one block from one of the largest slave mar­kets in the United States. He called it The True American. Published by William L. Neale and edited by Clay, the pa­per openly chal­lenged Kentucky’s slave­hold­ing es­tab­lish­ment. Its ed­i­tor was a son o…

Australia’s law man­dates that so­cial me­dia com­pa­nies, at risk of mas­sive fines, col­lect ei­ther bio­met­ric info, gov­ern­ment-is­sued IDs, or other data from users be­cause they now have a duty to take suf­fi­cient steps to en­sure users un­der 16 are kept logged out. In some cases, plat­forms can use ex­ist­ing data they have on users to ver­ify age, like if an ac­count has been open for a suf­fi­cient num­ber of years, but will in many sce­nar­ios need to ver­ify in­de­pen­dently by gath­er­ing more user data. This is where third-party ver­i­fi­ca­tion tools come in.

Look at Snapchat, for ex­am­ple. Snapchat uses k-ID, a com­pany based in Singapore, and al­lows ver­i­fi­ca­tion through a bank­ing con­nec­tion, gov­ern­ment ID scan, or selfie the com­pany uses to pro­vide an age range. This re­quires quite an in­vest­ment of trust on the user’s end. How do third-party com­pa­nies like this re­tain and pro­tect data? What kind of laws gov­ern these com­pa­nies abroad? Is such a com­pany in an­other coun­try more sus­cep­ti­ble to cen­so­r­ial re­quests from lo­cal or for­eign gov­ern­ments?

Australia does or­der that per­sonal in­for­ma­tion col­lected for age ver­i­fi­ca­tion “must be de­stroyed once all pur­poses have been met.” But those pur­poses in­clude chal­lenges and com­plaints, so it’s un­clear ex­actly how long data will be re­tained on users who ob­ject to wrong age clas­si­fi­ca­tions. Worryingly, in re­search con­ducted be­fore the ban went into ef­fect, Australia’s Age Assurance Technology Trial “found some con­cern­ing ev­i­dence that in the ab­sence of spe­cific guid­ance, ser­vice providers were ap­par­ently over-an­tic­i­pat­ing the even­tual needs of reg­u­la­tors about pro­vid­ing per­sonal in­for­ma­tion for fu­ture in­ves­ti­ga­tion…which could lead to in­creased risk of pri­vacy breaches due to un­nec­es­sary and dis­pro­por­tion­ate col­lec­tion and re­ten­tion of data.”

The longer that in­for­ma­tion is re­tained, and the more that is col­lected for ver­i­fi­ca­tion, in­creases the risk of breaches or hacks that threaten a user’s pri­vacy. Now mul­ti­ply that in­di­vid­ual risk by mil­lions.

We don’t even need to imag­ine the hy­po­thet­i­cal here, be­cause it hap­pened to nearly 70,000 Australians just weeks be­fore the un­der-16 ban went into ef­fect. A breach of a third-party cus­tomer ser­vice app Discord used “mainly to deal with” — guess what — “complaints re­lat­ing to the plat­for­m’s age as­sur­ance processes” was hacked, lead­ing to the re­lease of “government ID im­ages, names, user­names, email ad­dresses, and some lim­ited billing in­for­ma­tion.”

Expect more such at­tacks in the fu­ture.

In ad­di­tion to in­tro­duc­ing new risks from data breaches and hacks, the Australian gov­ern­ment ad­mits that man­dated age ver­i­fi­ca­tion in­tro­duces new risks for phish­ing at­tempts by scam­mers seek­ing to take ad­van­tage of con­fu­sion sur­round­ing the ban. But the gov­ern­ment puts much of the onus on so­cial me­dia plat­forms to en­sure users un­der­stand the ver­i­fi­ca­tion process and on users to read up to make sure they aren’t be­ing scammed.

We have, quite rea­son­ably, spent much of the 21st cen­tury de­bat­ing what should be our re­la­tion­ship to tech com­pa­nies and what amount of our per­sonal lives and de­tails we are com­fort­able hand­ing over, know­ingly or not. Governments have even been haul­ing tech CEOs in to ques­tion them about their in­take of in­di­vid­u­als’ data. Yet now coun­tries like Australia are man­dat­ing that they col­lect it or face con­se­quences.

As the Australian Human Rights Commission ex­plains, even if some user ac­counts ul­ti­mately evade age checks, this sig­nals a broader shift in how peo­ple use the in­ter­net:

The eSafety Commissioner’s guid­ance tries to re­as­sure us: ‘No, not every ac­count holder will go through an age check process if the plat­form has other ac­cu­rate data.’ But that does­n’t ac­tu­ally mean you es­cape scrutiny. It just means that plat­forms will use what they al­ready know about you to make the call. That’s the real shift that is hap­pen­ing here. We’re mov­ing to a world where the law re­quires you to be pro­filed in or­der to par­tic­i­pate.

The eSafety Commissioner’s guid­ance tries to re­as­sure us: ‘No, not every ac­count holder will go through an age check process if the plat­form has other ac­cu­rate data.’ But that does­n’t ac­tu­ally mean you es­cape scrutiny. It just means that plat­forms will use what they al­ready know about you to make the call. That’s the real shift that is hap­pen­ing here. We’re mov­ing to a world where the law re­quires you to be pro­filed in or­der to par­tic­i­pate.

The on­line world we’re mov­ing to­ward is a “papers, please” one, where vi­tal venues of pub­lic dis­cus­sion might now only be open to those who are will­ing to trust tech com­pa­nies and the third party ver­i­fi­ca­tion apps they use with in­for­ma­tion that can elim­i­nate their anonymity on­line, and the gov­ern­ments re­spon­si­ble for man­dat­ing the col­lec­tion of that in­for­ma­tion.

Many users will very likely pro­vide the in­for­ma­tion they need to log on and con­tinue com­mu­ni­cat­ing with their friends and fam­i­lies. But maybe they’ll think twice about what they say and do. This new era of the in­ter­net is un­likely to be sig­nif­i­cantly safer for chil­dren. But it will be much less free for every­one.

You’ve likely heard by now that the UK (along with France, Spain, the United Arab Emirates, Indonesia, Malaysia, Greece, Denmark, Norway, and the European Union) is pur­su­ing its own un­der-16 ban.

The ban will hap­pen even though the ex­act de­tails for its en­force­ment and ver­i­fi­ca­tion meth­ods are not yet pub­lic — but the UK in­tends to avoid Australia’s fail­ures. That’s why Prime Minister Keir Starmer promised this month that the British ver­sion will be “Australia-plus,” as the UK will “learn the lessons from Australia’s ex­pe­ri­ence” and “make it far harder for chil­dren to by­pass safe­guards.” (Starmer has since re­signed as prime min­is­ter but there is cur­rently no in­di­ca­tion that the gov­ern­men­t’s plans for the pol­icy will change.)

UK cit­i­zens have rea­son to worry. Australia’s en­force­ment of its un­der-16 ban comes with a wealth of risks to user pri­vacy, so to see gov­ern­ment of­fi­cials sig­nal that they in­tend more se­vere en­force­ment sug­gests the po­ten­tial for even greater pri­vacy threats.

Perhaps even most alarm­ing is of­fi­cials’ open in­ter­est in tar­get­ing vir­tual pri­vate net­works to crack down on ver­i­fi­ca­tion eva­sion. VPN use rose last year af­ter the roll­out of the UK’s sim­i­larly messy Online Safety Act, when in­ter­net users sought to avoid road­blocks from the gov­ern­ment against on­line “harms.” After the Online Safety Act was im­ple­mented, UK of­fi­cials said they were “gather[ing] in­for­ma­tion on VPN us­age.” And as I ex­plained at Persuasion last week:

One prob­lem fac­ing ad­vo­cates of in­ter­net re­stric­tions is the avail­abil­ity of vir­tual pri­vate net­works (VPNs), which reroute traf­fic and al­low users to ac­cess banned con­tent or sites from be­hind fire­walls or blocks. The UK gov­ern­ment is well aware of the chal­lenge VPNs may pose to its un­der-16 ban, and Technology Secretary Liz Kendall an­nounced this week that the gov­ern­ment “will make fur­ther state­ments in July about VPNs.” Children’s Minister Josh MacAlister has said there are “options there about whether we could age-gate VPN use, which would be re­ally wel­come.”

One prob­lem fac­ing ad­vo­cates of in­ter­net re­stric­tions is the avail­abil­ity of vir­tual pri­vate net­works (VPNs), which reroute traf­fic and al­low users to ac­cess banned con­tent or sites from be­hind fire­walls or blocks. The UK gov­ern­ment is well aware of the chal­lenge VPNs may pose to its un­der-16 ban, and Technology Secretary Liz Kendall an­nounced this week that the gov­ern­ment “will make fur­ther state­ments in July about VPNs.” Children’s Minister Josh MacAlister has said there are “options there about whether we could age-gate VPN use, which would be re­ally wel­come.”

Many UK cit­i­zens no doubt have valid and rea­son­able con­cerns about the way their chil­dren ex­pe­ri­ence the in­ter­net and so­cial me­dia. But they may be shocked and sur­prised by the amount of power and con­trol UK of­fi­cials claim they need to solve the prob­lem. Should UK of­fi­cials travel down the path of tar­get­ing VPN us­age, they may find them­selves more in line with coun­tries like China, Iran, and Russia. It’s not good com­pany.

Alarmingly, yes. The home of the First Amendment is on course to em­brace the “papers, please” era of the in­ter­net and has been slink­ing to­wards it for years now.

A num­ber of states have been de­vel­op­ing and pass­ing bills, many of which are fac­ing chal­lenges, that pose many of the same con­cerns we’ve raised in the in­ter­na­tional con­text. At least 19 states have passed leg­is­la­tion ad­dress­ing mi­nors’ ac­cess to so­cial me­dia or “addictive” feeds, but some are en­force­able, some en­joined, and some not yet ef­fec­tive. And more than 20 states have en­acted age-ver­i­fi­ca­tion laws for adult-con­tent web­sites, many of which be­came more se­cure af­ter the Supreme Court’s de­ci­sion in Free Speech Coalition v. Paxton in 2025. Separately, app-store age-as­sur­ance laws are be­ing lit­i­gated in states such as Texas and Utah.

While this takes place among the states, at the fed­eral level we’re see­ing a num­ber of pro­pos­als be­ing con­sid­ered, in­clud­ing the so-called “Kids Online Safety Act,” or KOSA, which was in­cor­po­rated in the House’s broader KIDS Act pack­age and has been the sub­ject of ne­go­ti­a­tions be­tween the Senate and the White House. The House and Senate have slightly dif­fer­ent ver­sions of the bill, but both would im­pose reg­u­la­tions that would ef­fec­tively force so­cial me­dia web­sites and other plat­forms to con­duct age ver­i­fi­ca­tion of their users. And since it’s a fed­eral bill, states that wanted to main­tain a free and open in­ter­net would be over­rid­den. The en­tire coun­try would be forced to re­veal their iden­tity and data be­fore they could speak on­line.

Tech

How does the First Amendment ap­ply to AI?

·

Jun 24

This is the sec­ond ar­ti­cle in a weekly se­ries on AI and Free Speech. You can read the first ar­ti­cle ex­plain­ing why the First Amendment is so im­por­tant in the age of AI here.

What this means for the American peo­ple is that both the state and fed­eral gov­ern­ment could be man­dat­ing col­lec­tion of in­for­ma­tion about you at every step you en­gage with the in­ter­net. Soon, every­thing you do on­line could have an el­e­ment of age as­sur­ance or ver­i­fi­ca­tion, from down­load­ing an app in the app store to mak­ing an ac­count to post­ing a photo, whether you’re a 14-year-old try­ing to game or a 40-year-old post­ing about recipes. The de­bate is rapidly ex­pand­ing to in­clude video games and AI chat­bots as well.

And that cre­ates a lot of risks for data breaches, overly broad data col­lec­tion and re­ten­tion, cen­so­r­ial le­gal de­mands for col­lected data, cor­po­rate and gov­ern­men­tal malfea­sance, pres­sure to self-cen­sor, and per­haps bla­tant First Amendment vi­o­la­tions. Every new layer and every new man­date brings more po­ten­tial for risk. As we’ve un­for­tu­nately seen many times over the years, peo­ple in­clud­ing high-level gov­ern­ment of­fi­cials will ma­li­ciously seek to root out the iden­ti­ties of their crit­ics, so the more lay­ers of anonymity we can pre­serve in on­line speech, the bet­ter.

Americans can take se­ri­ously the need to pro­tect kids on­line while still rec­og­niz­ing that many of the pol­icy and leg­isla­tive so­lu­tions of­fered to­day are cre­at­ing in­tol­er­a­ble bur­dens on our abil­ity to speak freely and anony­mously on the in­ter­net. The re­al­ity is that age ver­i­fi­ca­tion to a large ex­tent re­quires us to con­firm iden­tity, and we will come to re­gret so closely ty­ing our ex­pres­sive ac­tiv­ity on­line to gov­ern­ment-man­dated age and iden­tity ver­i­fi­ca­tion. Once we cre­ate this leg­isla­tive in­fra­struc­ture of sur­veil­lance we may find it very dif­fi­cult to tear down.

I’ve been dis­ap­pointed by lo­cal mod­els in the past. But then I checked Qwen 3.6, and I was in awe. For me it’s the first lo­cal model that ac­tu­ally makes sense as a gen­eral in­tel­li­gence.

It comes in two vari­ants, a mix­ture-of-ex­perts model Qwen 3.6 35B A3B, and a dense Qwen 3.6 27B - slower, but more pow­er­ful. The one I rec­om­mend!

Let me share my im­pres­sions, and show that you can run it too.

It’s hot, lit­er­ally. When my knees started to melt, I grabbed a phone-at­tached ther­mal cam­era and took a photo.

Qwen 3.6, right­fully, got a lot of cov­er­age on Hacker News. The most com­mon state­ment about Qwen 3.6 27B is that it punches above its weight - see Will it Mythos?. And I think it is a well-de­served sen­ti­ment. It will make your com­puter hot, but it’s worth it!

Testing the wa­ters

Simon Willison uses “penguins on a bi­cy­cle” as a smoke test (see for Qwen 3.6 35B A3B and then Qwen 3.6 27B). I usu­ally go with con­strained writ­ing.

A year ago these kinds of things were state of the art, need­ing a unique, and in­sanely ex­pen­sive GPT-4.5, see vibe trans­lat­ing Quantum Flytrap.

I also asked it to write an 8 line poem about Zouk dance and quan­tum physics, see the tran­script. The thought process made sense, both in terms of de­lib­er­a­tion on quan­tum terms, and rhymes.

Then I asked in OpenCode to cre­ate a hexag­o­nal minesweeper us­ing pnpm. It worked:

It worked on the first go, from a sin­gle prompt, with a proper Node pack­age. The mix­ture-of-ex­perts Qwen 3.6 35B A3B was faster… but ig­nored my in­struc­tion to cre­ate a pack­age, and did it in a sin­gle in­dex.html.

Real work

Sure, cre­ative writ­ing about quan­tum me­chan­ics, or yet an­other clone of a minesweeper, is rarely a day job. But Qwen 3.6 27B is de­cent at reg­u­lar tasks as well.

Prompt by a friend, Maciej Cielecki, at AI Tinkerers Warsaw.

It worked for a few min­utes and cre­ated this:

A land­ing page by Qwen 3.6 27B — view the live page.

By stan­dards of cur­rent fron­tier mod­els, it’s un­re­mark­able. But it is al­ready a prac­ti­cal job. It worked, was re­ac­tive, de­faults were nice - all from a sin­gle, short prompt.

Running Qwen 3.6 lo­cally with llama.cpp

Running lo­cal mod­els is eas­ier than ever. A few CLI lines and you’re off.

I rec­om­mend llama.cpp - a di­rect, open source tool that al­lows run­ning mod­els on var­i­ous de­vices. You don’t need Ollama, and frankly - I would rec­om­mend against us­ing that on eth­i­cal grounds.

First, we go to Hugging Face, to get proper quan­ti­za­tion, i.e. a model with re­duced size - pop­u­lar ones are by un­sloth or bar­towski, among oth­ers. Default mod­els usu­ally come with BF16 pre­ci­sion. A com­mon 8-bit quan­ti­za­tion saves half the space at al­most no cost to qual­ity. Going fur­ther down the road, mod­els are smaller (and po­ten­tially - faster), but at the cost of qual­ity, see this com­par­i­son for 27B and an­other one for 35B A3B.

We grab un­sloth/​Qwen3.6 – 27B-MTP-GGUF:Q8_0, an 8-bit quan­ti­za­tion with sup­port for multi-to­ken pre­dic­tion (MTP).

llama-server -hf un­sloth/​Qwen3.6 – 27B-MTP-GGUF:Q8_0 \ –spec-type draft-mtp -ngl 999 -fa on -c 65536 –port 8080

What it does:

-hf un­sloth/​Qwen3.6 – 27B-MTP-GGUF:Q8_0 grabs from Hugging Face, on the next runs will reuse that

-m ~/models/Qwen3.6 – 27B-Q8_0.gguf use in­stead if you al­ready have it

draft-mtp we use a fast model to pre­dict sub­se­quent to­kens, speeds up things

-ngl 999 for putting all lay­ers to GPU

-fa on flash at­ten­tion is on

-c 65536 con­text size set to 64k to­kens (this we can tweak, as Qwen 3.6 27B na­tive con­text is 256k)

–port 8080 bet­ter to pin port, as it will be used by other con­figs

If you open http://​127.0.0.1:8080, you can di­rectly chat with it.

Precisely the same server can be used for vibe cod­ing. Choice of agent de­pends both on one’s goal and sub­jec­tive taste - for an all-around OpenCode, min­i­mal­is­tic Pi, and self-im­prov­ing Hermes.

For OpenCode, it is as sim­ple as adding to ~/.config/opencode/opencode.jsonc:

{ “$schema”: “https://​open­code.ai/​con­fig.json”, “provider”: { “llama”: { “name”: “llama.cpp (local)”, “npm”: “@ai-sdk/openai-compatible”, “options”: { “baseURL”: “http://​127.0.0.1:8080/​v1”, “apiKey”: “local” }, “models”: { “qwen3.6 – 27b”: { “name”: “Qwen3.6 – 27B Q8 +MTP” } } } }, “model”: “llama/qwen3.6 – 27b” }

If you just want to chat and are a big fan of Terminal, in­stead of llama-server use llama-cli:

llama-cli -hf un­sloth/​Qwen3.6 – 27B-MTP-GGUF:Q8_0 \ -ngl 999 -fa on -c 65536

Measuring per­for­mance

Is it fast enough?

I ran a few tests (source is here) on my Macbook Max M5 128 GB, run­ning it with and with­out multi-to­ken pre­dic­tion, and com­par­ing both with the 35B A3B model, and also a quan­tized DeepSeek V4 Flash ver­sion DwarfStar4.

to­kens / s

RAM

Qwen3.6 – 35B-A3B · 8-bit

MLX

85 tok/​s 85

37 GB RAM 37 GB

llama.cpp

93 tok/​s 93

44 GB RAM 44 GB

llama.cpp + MTP

105 tok/​s 105

45 GB RAM 45 GB

Qwen3.6 – 27B · 8-bit

MLX

17 tok/​s 17

28 GB RAM 28 GB

llama.cpp

18 tok/​s 18

41 GB RAM 41 GB

llama.cpp + MTP

32 tok/​s 32

42 GB RAM 42 GB

DeepSeek-V4-Flash · Q2–Q4

llama.cpp

33 tok/​s 33

103 GB RAM 103 GB

30 to­kens per sec­ond is not bad, well within typ­i­cal fron­tier model API range. While mlx-lm is pre­cisely tar­geted at Apple Silicon de­vices, and AI agents heav­ily rec­om­mend it, llama.cpp turned out to be faster. It was us­ing 95% of GPU, which means it is ef­fi­ciently us­ing avail­able re­sources.

Macbook Max M5 is a beast (at least for a lap­top), but on other de­vices it should also work de­cently. As you can see, both Qwen 3.6 vari­ants run within 48 GB of Apple Silicon’s shared RAM. A 4-bit quan­ti­za­tion are less than 18 GB and should run on 32 GB de­vice. On con­sumer Nvidia RTX cards, you need to quan­tize ag­gres­sively, but in­fer­ence runs even faster.

I set this up to­day on my 5090 at Q6_K quan­ti­za­tion and Q4_0 KV, got 50 to­kens/​s con­sis­tently at 123k con­text, us­ing ~28/32gb vram through LM Studio. - gfosco on the Hacker News

I set this up to­day on my 5090 at Q6_K quan­ti­za­tion and Q4_0 KV, got 50 to­kens/​s con­sis­tently at 123k con­text, us­ing ~28/32gb vram through LM Studio. - gfosco on the Hacker News

While 35B A3B is 3x faster, I pre­fer 27B. I’d rather gen­er­ate a third as much code, but of higher qual­ity.

How do they re­late to pre­vi­ous state of the art mod­els?

Manual in­spec­tion is great, but bench­marks help with ground­ing in­tu­itions. Here is the score from Artificial Analysis, com­par­ing it with fron­tier mod­els:

Gemma 4 31B

29

≈ late 2024

o1 / Claude 3.5 Sonnet

Qwen3.6 – 35B-A3B

32

≈ early 2025

o3 / Claude 4 Sonnet

Qwen3.6 – 27B

37

≈ mid 2025

GPT-5 / Claude Sonnet 4.5

DeepSeek-V4-Flash

40

≈ late 2025

GPT-5.2 / Claude Opus 4.5

A few more bench­marks are in these notes, but the spirit is sim­i­lar. Added here Gemma 4 31B, as a lot of peo­ple use this as the de­fault for lo­cal cod­ing. But both bench­marks and gen­eral sen­ti­ment on­line favour Qwen 3.6 27B by a large mar­gin.

Here there is a caveat - 8-bit quan­ti­za­tion of Qwen 3.6 likely does not af­fect re­sults much, but DwarfStar4 uses much more ag­gres­sive ones for DeepSeek V4 Flash, 2 – 4 bit. For sure it is worse than the full model. My per­sonal im­pres­sion is that within these quan­ti­za­tions Qwen 3.6 27B is as good as (or maybe slightly bet­ter than) DwarfStar4. Though, I won’t be sur­prised if for longer con­text pro­jects DS4 has an edge.

What’s next

I think we are en­ter­ing a fas­ci­nat­ing era, when it be­comes fea­si­ble to run one’s own mod­els.

The change will be pro­pelled fur­ther by the state of pro­pri­etary fron­tier mod­els. Claude Fable 5 was taken down. Other fron­tier mod­els run at a mas­sive sub­sidy, where pay­ing $100 a month gives us thou­sands worth in to­kens. Let’s use the dis­count while it lasts!

A lo­cally set model can be fine-tuned to our needs, and can­not be taken away. Businesses can use them for pro­pri­etary and sen­si­tive data. We can use them per­son­ally for of­fline pro­jects, or when we don’t feel com­fort­able shar­ing our deep­est se­crets, or med­ical data, with the US or China.

With the re­lease of fron­tier-level open-weight GLM 5.2, there is a new era. While Qwen 3.6 was the step­ping stone, even fron­tier GLM 5.2 can be run lo­cally. It won’t run on your Macbook or a sin­gle RTX 5090. But still, it is man­age­able with a com­pany bud­get.

Moreover, I strongly be­lieve that we will have mod­els smarter than cur­rent state of the art, while runnable on lo­cal de­vices, maybe even smart­phones. Current mod­els com­bine both raw in­tel­li­gence and fac­tual knowl­edge in the same weights. Future mod­els will likely sep­a­rate that, of­fload­ing a lot of knowl­edge to tool call­ing.

Discuss on Hacker News, LinkedIn, or X.

We ran a set of pop­u­lar open-source mod­els against our IDOR bench­mark, the same dataset and the same prompt we’ve used to eval­u­ate fron­tier cod­ing agents. The re­sult sur­prised us: GLM 5.2, an open-weight model from Zhipu AI, scored a 39% F1 on IDOR de­tec­tion, beat­ing Claude Code (32%) at roughly $0.17 per vul­ner­a­bil­ity found. It still trailed Semgrep’s mul­ti­modal pipeline (53 – 61% F1), but that pipeline runs in a pur­pose-built har­ness that does a lot of the heavy lift­ing. Among mod­els given noth­ing but a prompt, the best open-weight op­tion was no longer the ob­vi­ous un­der­dog, beat­ing out Claude Opus 4.8.

We weren’t try­ing to crown an open-weight cham­pion, re­ally. We were try­ing to an­swer a nar­rower, more bor­ing ques­tion: how much of vul­ner­a­bil­ity-de­tec­tion per­for­mance comes from the model, and how much comes from the har­ness around it? For us at Semgrep this is a very im­por­tant ques­tion as we speak to cus­tomers who are lever­ag­ing AI agents heav­ily in their se­cu­rity tasks. A har­ness is the scaf­fold­ing that wraps a model: it feeds it the repos­i­tory, de­cides what it sees, parses its out­put, and loops it through a task. Our in­ter­nal mul­ti­modal pipeline runs in­side a har­ness, which is pur­pose-built for sta­tic analy­sis. We have been test­ing this in­ter­nally for a while with a work­flow for find­ing IDORs or Insecure Direct Object References. These are ac­cess con­trol is­sues which can roughly be thought of as “you’re ac­cess­ing some­thing be­long­ing to an­other user”.

Our har­ness enu­mer­ates the ap­pli­ca­tion’s end­points, and code try­ing to sift through only the im­por­tant con­text, and then points the model di­rectly at them. That’s a lot of struc­ture, but re­mem­ber when I said we re­ally did­n’t mean to an­swer the what’s-the-best-open-weight-model? The mod­els in this test don’t get that, they run in a sim­ple Pydantic AI har­ness with the same IDOR prompt we give every other LLM-provider model, no end­point dis­cov­ery, no guided nav­i­ga­tion, we did give it a bit of help, just a lit­tle more than “here’s the code, find the bugs.”, of­fer­ing a search strat­egy and some point­ers on what IDORs look like.

So this started as a prompt­ing-ver­sus-har­ness ex­per­i­ment, but while we were run­ning it we were gen­uinely shocked. One of the open-weight mod­els, with none of our scaf­fold­ing, sur­passed a fron­tier cod­ing agent.

Introducing GLM-5.2

If you’ve not heard of GLM-5.2, don’t worry, nei­ther had we un­til we saw it on so­cial me­dia and thought to add it to our bench­marks. GLM 5.2 is the lat­est model from Zhipu AI (Z.ai), rolled out to its GLM Coding Plan mem­bers on Saturday, June 13, 2026, with the open weights and re­lease notes fol­low­ing three days later on June 16 (which is when we heard about it). Three things make it in­ter­est­ing for se­cu­rity work.

First, it’s open weight. That means the mod­el’s pa­ra­me­ters are pub­lished un­der an MIT li­cense, which means you can down­load them, run them on your own hard­ware, fine-tune them, and in­spect them. For a lot of se­cu­rity teams work­ing in sen­si­tive ar­eas that’s im­por­tant, an open-weight model can run en­tirely in­side your own en­vi­ron­ment. But it’s im­por­tant to note that “open weight” is not the same as “open source”, the trained weights are re­leased, but the train­ing data and full pipeline gen­er­ally are not (though Z.ai does pub­lish its RL train­ing frame­work).

Second, it’s gen­uinely com­pet­i­tive on cod­ing. GLM 5.2 is a Mixture-of-Experts (MoE) model with roughly 750 bil­lion to­tal pa­ra­me­ters but only about 40 bil­lion ac­tive per to­ken, which keeps in­fer­ence cost down rel­a­tive to its size. It ex­tends the us­able con­text from 200K all the way to 1M to­kens, and Z.ai’s pitch is that this con­text stays re­li­able across long, messy agent tra­jec­to­ries, not just that it ac­cepts more in­put. Again for se­cu­rity tasks this is im­por­tant, as se­cu­rity tasks for things like IDORs must be able to rea­son across dif­fer­ent files, through an au­tho­riza­tion frame­work. On stan­dard cod­ing bench­marks it posts the strongest open-weight num­bers go­ing: 81.0 on Terminal-Bench 2.1 (versus 63.5 for GLM 5.1, and within a few points of Claude Opus 4.8′s 85.0) and 62.1 on SWE-bench Pro, edg­ing out closed fron­tier mod­els and trail­ing the very top by sin­gle-digit per­cent­ages.

Third, cost. Tokenomics is quickly be­com­ing as im­por­tant as the LLM ca­pa­bil­i­ties them­selves. Reported pric­ing lands around one-sixth of com­pa­ra­ble fron­tier mod­els and com­men­ta­tors who track open mod­els closely have com­pared GLM 5.2′s re­cep­tion to DeepSeek. GLM-5.2 ar­rived at a charged time not just due to to­ke­nomics but also land­ing just af­ter fron­tier-class closed mod­els hit new ex­port re­stric­tions af­ter re­ported jail­breaks. One de­tail from the re­lease notes is worth flag­ging for any­one point­ing this model at code: Z.ai re­ports that GLM 5.2 ex­hibits more re­ward-hack­ing be­hav­ior than GLM 5.1, dur­ing train­ing it would do things like read pro­tected eval­u­a­tion files or curl ref­er­ence so­lu­tions to in­flate its score, prompt­ing them to build a ded­i­cated anti-hack­ing guard. It’s an hon­est dis­clo­sure by the team, but if you were build­ing a model for hack­ing, well… you can’t get more hacker than try­ing to by­pass the tests in the first place.

Our Experiment

Before we get too much into the de­tails, it’s im­por­tant to re­cap what ex­actly we were try­ing to do and what our ex­per­i­ments were. A quick re­fresher on IDOR: Insecure Direct Object Reference is a vul­ner­a­bil­ity class where an ap­pli­ca­tion ex­poses an in­ter­nal iden­ti­fier like a user ID in a re­quest with­out check­ing that the caller is ac­tu­ally al­lowed to ac­cess that ob­ject. Change the iden­ti­fier, get some­one else’s data.

@app.route(‘/user/<int:user_id>’) def get_user(user_id): user = User.query.get_or_404(user_id) re­turn jsonify(user.to_­dict())

This Flask route fetches and re­turns a user record straight from the ID in the URL, with no check that the re­quester owns it. Any logged in user can just change user_id and read some­one else’s record. IDOR is some­where be­tween a busi­ness-logic flaw and a mis­con­fig­u­ra­tion, it’s not a taint-flow bug, which is what makes it hard for both sta­tic analy­sis and LLMs: there’s no dan­ger­ous func­tion to flag, only a miss­ing check. It’s also one of the most com­mon find­ings in the wild (currently #4 on the HackerOne top vul­ner­a­bil­ity types list), which is why we keep com­ing back to it as a bench­mark.

So back to our ex­per­i­ment: We held three things con­stant and var­ied one, stan­dard ex­per­i­men­tal con­di­tions. Constant: the IDOR dataset (the same real, open-source ap­pli­ca­tions we’ve used in prior re­search), the eval­u­a­tion method (F1 score against a known set of true pos­i­tives), and the IDOR sys­tem prompt it­self. Varied: the model and its har­ness. Specifically:

Semgrep Multimodal ran in­side our cus­tom har­ness: the one that enu­mer­ates end­points and di­rects the model to them. We tested it with two fron­tier mod­els be­hind it.

Semgrep Multimodal ran in­side our cus­tom har­ness: the one that enu­mer­ates end­points and di­rects the model to them. We tested it with two fron­tier mod­els be­hind it.

But we also just ran Claude Code through the Claude Code SDK, and other provider mod­els through their na­tive SDKs but with the same prompt.

But we also just ran Claude Code through the Claude Code SDK, and other provider mod­els through their na­tive SDKs but with the same prompt.

The open-weight mod­els which in­cludes­GLM 5.2, MiniMax M3, and Kimi K2.7 Code, ran in the sim­ple Pydantic AI har­ness with the IDOR prompt and noth­ing else.

The open-weight mod­els which in­cludes­GLM 5.2, MiniMax M3, and Kimi K2.7 Code, ran in the sim­ple Pydantic AI har­ness with the IDOR prompt and noth­ing else.

This is an im­por­tant de­tail, so we’ll say it twice: the open-weight mod­els were not given the end­point-dis­cov­ery scaf­fold­ing that the mul­ti­modal pipeline gets. They saw a prompt and a code­base. This is just what they are ca­pa­ble of with­out any help.

We also com­puted a few dif­fer­ent mea­sures of ef­fec­tive­ness:

Precision: of every­thing the de­tec­tor flagged as an IDOR, what frac­tion were real? High pre­ci­sion = few false alarms. If it re­ports 10 bugs and 7 are gen­uine, pre­ci­sion is 70%.

Precision: of every­thing the de­tec­tor flagged as an IDOR, what frac­tion were real? High pre­ci­sion = few false alarms. If it re­ports 10 bugs and 7 are gen­uine, pre­ci­sion is 70%.

Recall: of all the real IDORs that ac­tu­ally ex­ist in the dataset, what frac­tion did it find? High re­call = it misses a few real bugs. If there are 20 real IDORs and it catches 12, re­call is 60%.

Recall: of all the real IDORs that ac­tu­ally ex­ist in the dataset, what frac­tion did it find? High re­call = it misses a few real bugs. If there are 20 real IDORs and it catches 12, re­call is 60%.

F1: the sin­gle num­ber that bal­ances pre­ci­sion and re­call. It’s their har­monic mean: F1 = 2 × (precision × re­call) / (precision + re­call). The rea­son you use F1 in­stead of plain ac­cu­racy is that the two goals fight each other. A de­tec­tor can hit 100% pre­ci­sion by flag­ging only the one bug it’s cer­tain about (but miss­ing every­thing else so ter­ri­ble re­call), or 100% re­call by flag­ging every­thing as vul­ner­a­ble (but drown­ing you in false pos­i­tives so ter­ri­ble pre­ci­sion). F1 re­wards be­ing good at both at once, and the har­monic mean pun­ishes a lop­sided score, if ei­ther pre­ci­sion or re­call is near zero, F1 is dragged down hard. This is what we’ll re­fer to through­out this post.

F1: the sin­gle num­ber that bal­ances pre­ci­sion and re­call. It’s their har­monic mean: F1 = 2 × (precision × re­call) / (precision + re­call). The rea­son you use F1 in­stead of plain ac­cu­racy is that the two goals fight each other. A de­tec­tor can hit 100% pre­ci­sion by flag­ging only the one bug it’s cer­tain about (but miss­ing every­thing else so ter­ri­ble re­call), or 100% re­call by flag­ging every­thing as vul­ner­a­ble (but drown­ing you in false pos­i­tives so ter­ri­ble pre­ci­sion). F1 re­wards be­ing good at both at once, and the har­monic mean pun­ishes a lop­sided score, if ei­ther pre­ci­sion or re­call is near zero, F1 is dragged down hard. This is what we’ll re­fer to through­out this post.

Cost in dol­lars: per true pos­i­tive and per run to­tal spend di­vided by the num­ber of real bugs found. The real-world eco­nom­ics of run­ning the de­tec­tor. A cheap model with mediocre F1 can still win here.

Cost in dol­lars: per true pos­i­tive and per run to­tal spend di­vided by the num­ber of real bugs found. The real-world eco­nom­ics of run­ning the de­tec­tor. A cheap model with mediocre F1 can still win here.

The re­sults

Ranked by F1 score on IDOR de­tec­tion:

Rank

Configuration

Harness

F1

1

Semgrep Multimodal (GPT 5.5)

Semgrep Multimodal

61%

2

Semgrep Multimodal (Opus 4.8)

Semgrep Multimodal

53%

3

GLM 5.2

Pydantic AI (prompt only)

39%

4

Claude Code (Opus 4.6)

Claude Code SDK

37%

5

Claude Code (Opus 4.8/4.7)

Claude Code SDK

28%

6

MiniMax M3

Pydantic AI (prompt only)

23%

7

Kimi K2.7 Code

Pydantic AI (prompt only)

22%

8

GPT-5.5

Codex

20%

9

Nemotron Super 3 120B

Pydantic AI (prompt only)

18%

10

DeepSeek V4

Pydantic AI (prompt only)

17%

For us two find­ings stand out.

Our mul­ti­modal pipeline leads, and the har­ness is prob­a­bly why. GPT 5.5 and Opus 4.8 in­side Semgrep Multimodal take the top two spots at 61% and 53%. This is of course good news for us and our cus­tomers, val­i­dates that our ap­proach works, etc… But that is­n’t the in­ter­est­ing part.

The biggest sur­prise is in third place. GLM 5.2, with no scaf­fold­ing at all, beat Claude Code by seven points (39% vs. 32%). An open-weight model run­ning a bare prompt out­per­formed a fron­tier cod­ing agent on a rea­son­ing-heavy se­cu­rity task. And it did so cheaply! At GLM 5.2′s pric­ing, the open-weight run cost roughly $0.17 per vul­ner­a­bil­ity found. For a de­tec­tion task you might run across thou­sands of end­points, per-bug eco­nom­ics are not a foot­note, they’re of­ten the de­cid­ing fac­tor in whether a tech­nique is us­able at scale.

GLM 5.2 was­n’t rep­re­sen­ta­tive of open weights as a cat­e­gory, it was the stand­out for sure, but that does­n’t mean the oth­ers don’t hold their own. MiniMax M3 (23%) and Kimi K2.7 Code (22%) landed well be­hind it and be­hind Claude Code, clus­tered closely to­gether. Both are ca­pa­ble gen­eral cod­ing mod­els, but on this spe­cific task, rea­son­ing about miss­ing au­tho­riza­tion checks with no guid­ance to­ward where to look, they strug­gled to sep­a­rate real IDORs from noise.

The spread be­tween GLM 5.2 and the next open-weight model (16 points) is wider than the gap be­tween GLM 5.2 and Claude Code. So the take­away is­n’t “open weights have caught up.” It’s “one open-weight model has, on this task, un­der these con­di­tions.”

Takeaways

This is not an ap­ples-to-ap­ples com­par­i­son of raw model abil­ity, and we don’t want any­one walk­ing away think­ing it is. Instead we think the take­away is: Among mod­els given the same min­i­mal prompt and har­ness, GLM 5.2 a open-weight model, ⅙ the cost of a fron­tier LLM beat Claude Code at a gen­uinely dif­fi­cult se­cu­rity re­search task.

The har­ness still mat­ters more than the model. The largest per­for­mance gap in the table is­n’t be­tween mod­els, it’s be­tween con­fig­u­ra­tions that get end­point dis­cov­ery and those that don’t. But for any­one fol­low­ing se­cu­rity re­search right now, this is def­i­nitely not a sur­prise, and to be ex­pected.

The har­ness still mat­ters more than the model. The largest per­for­mance gap in the table is­n’t be­tween mod­els, it’s be­tween con­fig­u­ra­tions that get end­point dis­cov­ery and those that don’t. But for any­one fol­low­ing se­cu­rity re­search right now, this is def­i­nitely not a sur­prise, and to be ex­pected.

BUT when a sur­prise like this comes out of nowhere and pro­duces these kinds of re­sults for that lit­tle com­pute cost, it’s a stark re­minder that you can’t put all your eggs in one LLM-basket. If you’re stuck to an ex­pen­sive fron­tier model, even with the best ven­dor-locked-in-har­ness you can miss the ad­van­tages of swap­ping mod­els whether that be cost or per­for­mance.

BUT when a sur­prise like this comes out of nowhere and pro­duces these kinds of re­sults for that lit­tle com­pute cost, it’s a stark re­minder that you can’t put all your eggs in one LLM-basket. If you’re stuck to an ex­pen­sive fron­tier model, even with the best ven­dor-locked-in-har­ness you can miss the ad­van­tages of swap­ping mod­els whether that be cost or per­for­mance.

Open-weight mod­els have crossed a thresh­old worth watch­ing. A year ago, putting an open-weight model on a vul­ner­a­bil­ity-de­tec­tion leader­board would have been a char­ity en­try. GLM 5.2 beat­ing a fron­tier agent on a bare prompt, at a sixth of the cost, with the op­tion to run fully in your own en­vi­ron­ment. For a lot of se­cu­rity teams this is an at­trac­tive op­tion.

Open-weight mod­els have crossed a thresh­old worth watch­ing. A year ago, putting an open-weight model on a vul­ner­a­bil­ity-de­tec­tion leader­board would have been a char­ity en­try. GLM 5.2 beat­ing a fron­tier agent on a bare prompt, at a sixth of the cost, with the op­tion to run fully in your own en­vi­ron­ment. For a lot of se­cu­rity teams this is an at­trac­tive op­tion.

We have a caveat: This is one task, one dataset, one run. IDOR de­tec­tion is non-de­ter­min­is­tic, the dataset is fi­nite, and we’ve changed only one con­fig­u­ra­tion cleanly. It might well be the case that for IDOR de­tec­tion GLM-5.2 re­ally is bet­ter than Claude, but for SSRF de­tec­tion the ta­bles turn - we don’t know this yet, but you can be sure we’ll find out.

Lots of love,

Security Research and Engineering @ Semgrep

This open-source ATS by HackerRank has been blow­ing up re­cently: https://​github.com/​in­ter­view­street/​hir­ing-agent

It’s popped up on LinkedIn and Reddit with hun­dreds, some­times thou­sands, of likes.1 A coworker men­tioned it to me in pass­ing a few days ago.

I’ve de­cided to test it out.

First work­ing run: 90/100. Felt pretty good!

I had some de­bug prints scat­tered around from trou­bleshoot­ing the setup, so I cleaned those up and ran it again.

74/100.

Same re­sume. Same com­mand. The only thing I changed was delet­ing print state­ments.

I dis­abled DEVELOPMENT_MODE and put it in a loop to run a hun­dred times.

The scores range from 66 to 99.

If your com­pa­ny’s cut­off sits at 85, I fail 65% of the time. Same ex­act re­sume, dif­fer­ent luck.

Here a quick run­down on how the tool works:

Your PDF gets parsed into text. An LLM is called six times to ex­tract struc­tured in­for­ma­tion — your ba­sics, work his­tory, ed­u­ca­tion, skills, pro­jects, awards. It pulls your GitHub pro­file, scans your top re­pos, ap­pends them as ex­tra con­text. Then every­thing gets fed into the LLM at once to be graded.

The scor­ing is out of 100, with up to 20 bonus points on top:

35 points for open source con­tri­bu­tions

35 points for open source con­tri­bu­tions

30 for per­sonal pro­jects

30 for per­sonal pro­jects

25 for work ex­pe­ri­ence

25 for work ex­pe­ri­ence

10 for tech­ni­cal skills

10 for tech­ni­cal skills

Up to 20 bonus points for startup ex­pe­ri­ence, a port­fo­lio site, a tech­ni­cal blog, etc.

Up to 20 bonus points for startup ex­pe­ri­ence, a port­fo­lio site, a tech­ni­cal blog, etc.

The de­fault model is gem­ma3:4b, run­ning at tem­per­a­ture 0.1 — low, sup­pos­edly nudg­ing the model to­ward de­ter­min­is­tic out­puts.

Here’s what I found when I looked at those in­di­vid­ual cat­e­gories.

Look at tech­ni­cal skills: I scored 8/10 in 98 out of 100 runs. Nearly per­fect con­sis­tency. How come? Because tech­ni­cal skills are a check­list. You ei­ther know React or you don’t. There’s noth­ing for an LLM to judge — a five year old could match that check-list.

Now look at pro­jects — there’s HUGE vari­a­tion.

LLMs strug­gle to make a judg­ment call like that con­sis­tently. Sometimes my pro­jects “lack ar­chi­tec­tural com­plex­ity”, some­times they “demonstrate real-world de­ploy­ment”. Which one the LLM spits out is a roll of the dice.

Temperature 0.1 is al­ready low, but even go­ing down to tem­per­a­ture 0 does­n’t fix this. Someone opened a GitHub is­sue back in October show­ing scores of 27, 34, 32, 34, 34, 30 across six con­sec­u­tive runs at tem­per­a­ture 0.2 This non-de­ter­min­ism is­n’t a bug you can just fine-tune away, it’s a fun­da­men­tal de­sign flaw.

I was wor­ried part of this might be the model. After all, gem­ma3:4b was a lo­cal model run­ning on my ma­chine.

Gemini re­sulted in a tighter dis­tri­b­u­tion — scores clus­tered be­tween 48 and 64. But if your cut­off is 60, you’re still fail­ing 28% of the time through no fault of your own.

The Open Source scores have be­come con­sis­tent — that’s a le­git im­prove­ment. But pro­ject scores are still all over the place.

Experience has me the most con­cerned.

25/25.

Every sin­gle run.

I went back and pulled up an old re­sume — one in­tern­ship on it.

Also 25/25.

The clue is in the prompt…

The en­tire thing is two lines long.

No rubric. No ex­am­ples. No an­chors for what earns a 15 ver­sus a 25.

A ju­nior en­gi­neer with one in­tern­ship gets 25/25. A prin­ci­pal en­gi­neer with a decade of dis­trib­uted sys­tems gets 25/25. I get 25/25. Experience has two lines and no an­chors — con­sis­tent, but use­less. Projects has a de­tailed rubric with ex­am­ples but it’s the nois­i­est cat­e­gory — in­con­sis­tent, also use­less. There are some things that LLMs just can’t do well, no mat­ter how you prompt.

Use an LLM to parse a re­sume into struc­tured data — great, that’s what they’re good at. Use one to check whether some­one knows Python — amaz­ing. Use one to judge whether a can­di­date’s ex­pe­ri­ence is worth 18 points or 24 points? You get a vibe-check. Something HR teams, bar rais­ers, and a dozen other ini­tia­tives have spent decades try­ing to avoid.

The 65% weight­ing on open source + pro­jects does­n’t help ei­ther. I’d take the en­gi­neer with 30 years of ex­pe­ri­ence who built S3 over some­one with two in­tern­ships and an open source pro­ject — but this tool would­n’t. Some of the best en­gi­neers I know have built things that never ended up on GitHub. That’s over half of their score gone be­fore any hu­man looks their way.

If you’re an en­gi­neer with any say in how your com­pany han­dles re­sume screen­ing: please be very care­ful with AI-screening tools. A tool that can’t dif­fer­en­ti­ate is­n’t fil­ter­ing for qual­ity — it’s just fil­ter­ing. You might as well throw out half the re­sumes and tell the the ap­pli­cants you don’t fuck with bad luck.

Correction (June 28): A reader flagged that the re­sume_e­val­u­a­tion_cri­te­ria.jinja tem­plate says “Software Intern” on line 1 — nowhere doc­u­mented, nowhere else ref­er­enced in the repo. The same tem­plate that later gives bonus points for “founder roles, co-founder po­si­tions, or early-stage en­gi­neer roles.” I re-ran with an ex­plicit Senior SWE prompt and got iden­ti­cal re­sults — the scor­ing di­men­sions are po­si­tion-ag­nos­tic.

1

Viral LinkedIn (read at your own risk) and Reddit posts. They both claim the repo was open-sourced re­cently, but based on com­mit his­tory it’s more likely that it just blew up re­cently and has been open sourced since October 2025.

2

Non-determinism at tem­per­a­ture 0 was flagged in this GitHub is­sue, opened October 2025.

No posts

Lots of US states, European coun­tries, and Australia have in­tro­duced “age ver­i­fi­ca­tion” reg­u­la­tions. They pre­sent it as the clas­sic “save the chil­dren” talk­ing point, but it’s re­ally just a pre­cur­sor to at­tri­bu­tion of speech, par­tic­u­larly at­tribut­ing your words to your real iden­tity.

This is the state’s dream; your words, un­de­ni­ably tied to your real life iden­tity. Law en­force­ment gen­er­ally needs two things to take mean­ing­ful ac­tion: What hap­pened? and Who did it? so lets go over them, I promise it’s rel­e­vant.

What hap­pened? - Maybe you dis­like dat­a­cen­ters, il­le­gal im­mi­gra­tion, or taxes. Whatever it is, the po­lice want to know. If you’re post­ing on so­cial me­dia, they prob­a­bly al­ready know.

Who did it? - They can’t pros­e­cute PickleDog52, they rely on some sort of iden­ti­fier and a lot of in­ves­tiga­tive work to fig­ure out who to ha­rass or jail. Traditionally this has been achieved with OSINT (looking for clues in your posts, speech pat­tern, etc..) or sub­poe­naing the ser­vice provider to get your IP or other iden­ti­fiers like email or phone.

Doing #2 takes a lot of ef­fort and does­n’t scale. Sometimes there’s no prob­a­ble cause that a crime has been or will be com­mit­ted. Sometimes the tar­get uses a VPN or Tor. Sometimes the plat­form does­n’t have re­li­able met­rics on the tar­get. Whatever the rea­son, it usu­ally re­quires hu­mans click­ing but­tons, send­ing emails, or de­cid­ing things.

These “age ver­i­fi­ca­tion” laws are - by de­sign - iden­tity at­tri­bu­tion sys­tems. They at­tribute dig­i­tal iden­ti­ties (accounts) to phys­i­cal iden­ti­ties (SSN, ID, etc..). This is gov­ern­men­t’s ideal sit­u­a­tion, the abil­ity to quickly (automatically?) get iden­ti­fy­ing in­for­ma­tion about in­con­ve­nient peo­ple re­gard­less if they’re a crim­i­nal or not.

There’s also some­thing creep­ily ironic about se­lect cor­po­rate elite, politi­cians, and gov­ern­ment of­fi­cials push­ing age ver­i­fi­ca­tion to “save the chil­dren”… Maybe go check their flight logs or hard dri­ves or some­thing… Yikes!

Anyways, I have no doubts that this will be­come au­to­mated once enough of the pop­u­la­tion has ver­i­fied their iden­ti­ties. Post an in­con­ve­nient mes­sage about a politi­cian, or get a lit­tle too rowdy in a group chat, and you’ll get a let­ter in the mail or a knock at the door. Similar to the “love let­ters” sent by ISPs on be­half of the RIAA and MPAA when you en­joy a DRM-free me­dia file.

Don’t let them win. Don’t ver­ify your age. Don’t give up your iden­tity. If you ab­solutely must, find one of the nu­mer­ous age ver­i­fi­ca­tion ser­vices and pay in Monero.

AI CODE CREATIONGitHub CopilotWrite bet­ter code with AIGitHub Copilot ap­pDi­rect agents from is­sue to mergeMCP RegistryNewIntegrate ex­ter­nal tools­DE­VEL­OPER WORKFLOWSActionsAutomate any work­flow­Code­spacesIn­stant dev en­vi­ron­mentsIs­sue­s­Plan and track work­Code ReviewManage code change­sAP­PLI­CA­TION SECURITYGitHub Advanced SecurityFind and fix vul­ner­a­bil­i­ti­esCode se­cu­ri­ty­Se­cure your code as you build­Se­cret pro­tec­tion­Stop leaks be­fore they star­t­EX­PLOREWhy GitHubDocumentationBlogChangelogMarketplaceView all fea­tures

AI CODE CREATIONGitHub CopilotWrite bet­ter code with AIGitHub Copilot ap­pDi­rect agents from is­sue to mergeMCP RegistryNewIntegrate ex­ter­nal tools

AI CODE CREATION

GitHub CopilotWrite bet­ter code with AI

GitHub CopilotWrite bet­ter code with AI

GitHub Copilot ap­pDi­rect agents from is­sue to merge

GitHub Copilot ap­pDi­rect agents from is­sue to merge

MCP RegistryNewIntegrate ex­ter­nal tools

MCP RegistryNewIntegrate ex­ter­nal tools

DEVELOPER WORKFLOWSActionsAutomate any work­flow­Code­spacesIn­stant dev en­vi­ron­mentsIs­sue­s­Plan and track work­Code ReviewManage code changes

DEVELOPER WORKFLOWS

ActionsAutomate any work­flow

ActionsAutomate any work­flow

CodespacesInstant dev en­vi­ron­ments

CodespacesInstant dev en­vi­ron­ments

IssuesPlan and track work

IssuesPlan and track work

Code ReviewManage code changes

Code ReviewManage code changes

APPLICATION SECURITYGitHub Advanced SecurityFind and fix vul­ner­a­bil­i­ti­esCode se­cu­ri­ty­Se­cure your code as you build­Se­cret pro­tec­tion­Stop leaks be­fore they start

APPLICATION SECURITY

GitHub Advanced SecurityFind and fix vul­ner­a­bil­i­ties

GitHub Advanced SecurityFind and fix vul­ner­a­bil­i­ties

Code se­cu­ri­ty­Se­cure your code as you build

Code se­cu­ri­ty­Se­cure your code as you build

Secret pro­tec­tion­Stop leaks be­fore they start

Secret pro­tec­tion­Stop leaks be­fore they start

EXPLOREWhy GitHubDocumentationBlogChangelogMarketplace

EXPLORE

Why GitHub

Documentation

Blog

Changelog

Marketplace

View all fea­tures

BY COMPANY SIZEEnterprisesSmall and medium teamsStar­tup­sNon­prof­itsBY USE CASEApp ModernizationDevSecOpsDevOpsCI/CDView all use cas­esBY INDUSTRYHealthcareFinancial ser­vices­Man­u­fac­tur­ing­Gov­ern­mentView all in­dus­triesView all so­lu­tions

BY COMPANY SIZEEnterprisesSmall and medium teamsStar­tup­sNon­prof­its

BY COMPANY SIZE

Enterprises

Small and medium teams

Startups

Nonprofits

BY USE CASEApp ModernizationDevSecOpsDevOpsCI/CDView all use cases

BY USE CASE

App Modernization

DevSecOps

DevOps

CI/CD

View all use cases

BY INDUSTRYHealthcareFinancial ser­vices­Man­u­fac­tur­ing­Gov­ern­mentView all in­dus­tries

BY INDUSTRY

Healthcare

Financial ser­vices

Manufacturing

Government

View all in­dus­tries

View all so­lu­tions

EXPLORE BY TOPICAISoftware DevelopmentDevOpsSecurityView all top­ic­sEX­PLORE BY TYPECustomer sto­rie­sEv­ents & we­bi­na­rsE­books & re­ports­Busi­ness in­sights­GitHub SkillsSUPPORT & SERVICESDocumentationCustomer sup­port­Com­mu­nity fo­rumTrust cen­ter­Part­nersView all re­sources

EXPLORE BY TOPICAISoftware DevelopmentDevOpsSecurityView all top­ics

EXPLORE BY TOPIC

AI

Software Development

DevOps

Security

View all top­ics

EXPLORE BY TYPECustomer sto­rie­sEv­ents & we­bi­na­rsE­books & re­ports­Busi­ness in­sights­GitHub Skills

EXPLORE BY TYPE

Customer sto­ries

Events & we­bi­nars

Ebooks & re­ports

Business in­sights

GitHub Skills

SUPPORT & SERVICESDocumentationCustomer sup­port­Com­mu­nity fo­rumTrust cen­ter­Part­ners

SUPPORT & SERVICES

Documentation

Customer sup­port

Community fo­rum

Trust cen­ter

Partners

View all re­sources

COMMUNITYGitHub SponsorsFund open source de­vel­op­er­sPRO­GRAMSSe­cu­rity LabMaintainer CommunityAcceleratorGitHub StarsArchive ProgramREPOSITORIESTopicsTrendingCollections

COMMUNITYGitHub SponsorsFund open source de­vel­op­ers

COMMUNITY

GitHub SponsorsFund open source de­vel­op­ers

GitHub SponsorsFund open source de­vel­op­ers

PROGRAMSSecurity LabMaintainer CommunityAcceleratorGitHub StarsArchive Program

PROGRAMS

Security Lab

Maintainer Community

Accelerator

GitHub Stars

Archive Program

REPOSITORIESTopicsTrendingCollections

REPOSITORIES

Topics

Trending

Collections

ENTERPRISE SOLUTIONSEnterprise plat­for­mAI-pow­ered de­vel­oper plat­for­mAVAIL­ABLE ADD-ONSGitHub Advanced SecurityEnterprise-grade se­cu­rity fea­turesCopi­lot for BusinessEnterprise-grade AI fea­ture­sPremium SupportEnterprise-grade 24/7 sup­port

ENTERPRISE SOLUTIONSEnterprise plat­for­mAI-pow­ered de­vel­oper plat­form

ENTERPRISE SOLUTIONS

In 2022, I wrote about the damn­ing fall of events tech com­pany Pollen. The short of it:

Pollen seemed to have pulled off the im­prob­a­ble feat of build­ing a busi­ness in the no­to­ri­ously low mar­gin in­dus­try of events, sur­viv­ing Covid-19, and build­ing a solid soft­ware en­gi­neer­ing or­ga­ni­za­tion. In April this year, the com­pany an­nounced it had raised an­other $150M in fresh fund­ing.But just three weeks later, Pollen laid off about 200 peo­ple, a third of staff. Leadership as­sured em­ploy­ees all was well. However, from that point on, things got worse. Leadership later pulled the plug on Slack, em­ploy­ees were not paid wages, pen­sion con­tri­bu­tions went miss­ing, and ven­dors were not paid. Some ven­dors took mat­ters into their own hands; on 9 August 2022, JIRA was sus­pended when Atlassian tired of the com­pa­ny’s fail­ure to pay.On 10 August 2022, Pollen went bank­rupt, col­laps­ing into ad­min­is­tra­tion.

But just three weeks later, Pollen laid off about 200 peo­ple, a third of staff. Leadership as­sured em­ploy­ees all was well. However, from that point on, things got worse. Leadership later pulled the plug on Slack, em­ploy­ees were not paid wages, pen­sion con­tri­bu­tions went miss­ing, and ven­dors were not paid. Some ven­dors took mat­ters into their own hands; on 9 August 2022, JIRA was sus­pended when Atlassian tired of the com­pa­ny’s fail­ure to pay.

On 10 August 2022, Pollen went bank­rupt, col­laps­ing into ad­min­is­tra­tion.

The ar­ti­cle looked bad on Pollen’s founder, Callum Negus-Fancey. He was ul­ti­mately re­spon­si­ble for ly­ing to staff, not pay­ing salaries, the miss­ing pen­sion con­tri­bu­tions, and the un­paid health in­sur­ance for US em­ploy­ees. The story was so bad that the BBC cre­ated a doc­u­men­tary ti­tled Crashed: $800M Festival Fail.

And then there was the $3.2M dou­ble charge for cus­tomers, man­u­ally ini­ti­ated by CTO Bradley Wright, de­tailed ex­ten­sively in the doc­u­men­tary Crashed: $800M Festival Fail. That dou­ble charge would have been triv­ial to re­verse, but the re­ver­sal never hap­pened, cus­tomers never got their money back, and the post­mortem of the in­ci­dent was never re­leased to staff.

Four years later, Pollen and Callum Negus-Fancey are at­tempt­ing to erase this shame­ful story from the pub­lic record. The ar­ti­cle is my orig­i­nal writ­ing, and thus I am the copy­right holder of it. So imag­ine my sur­prise when I was no­ti­fied that Google re­moved the ar­ti­cle from its search re­sults thanks to a copy­right in­fringe­ment claim it re­ceived:

It seems that any­one can file a bo­gus copy­right claim to get an ar­ti­cle they don’t like re­moved from Google’s search in­dex. This hap­pened in this case. I have no in­for­ma­tion on who filed the copy­right claim. Even less so on who claims to be the copy­right owner? Because I am the only pos­si­ble copy­right owner!

And Google has gone ahead and re­moved my ar­ti­cle about Pollen’s shame­ful col­lapse from its search re­sults.

I have the op­tion to ap­peal, which I have done so.

Google’s copy­right re­moval sys­tem is clearly be­ing abused, to a com­i­cal de­gree. Someone does­n’t like that I went into ex­treme de­tail about the events at Pollen - all of which are facts. And, for some rea­son, bo­gus copy­right re­quests can be weaponized to re­move in­for­ma­tion like this from Google’s search in­dex.

I man­aged to find the bo­gus DMCA com­plaint sub­mis­sion, af­ter Google re­moved my site from search re­sults. It is ab­solute BS: it claims that my orig­i­nal ar­ti­cle is a copy of a The New York Post ar­ti­cle. Which is ab­solute non­sense!

This “Ellie Piee” claimed that this 1998 ar­ti­cle ti­tled Band Leader Hits Winning Chord was copied by my ar­ti­cle Inside Pollen’s Collapse: “$200M Raised” but Staff Unpaid - Exclusive. The two do not even share a sin­gle sen­tence!

The fake DMCA is made by a fake pro­file from a coun­try with zero in­hab­i­tants. The re­moval re­quests by this “Ellie Piee” are made from the coun­try called Bouvet Island, an un­in­hab­ited Norwegian de­pen­dent ter­ri­tory in the South Atlantic/Southern Ocean near Antarctica. It has zero in­hab­i­tants, and is re­ferred to as the “world’s most re­mote is­land.”

Why does Google al­low fraud­u­lent DMCA no­tices to be filed with no penalty? My own spec­u­la­tion is that it is clear enough that ei­ther Pollen, or its for­mer CEO Callum Negus-Fancey, or its co­founder and COO Liam Negus-Fancey or some­one else re­lated to the com­pany hired rep­u­ta­tion firms to re­move Pollen ar­ti­cles from Google. This firm then files the most bo­gus re­quests un­der fake names sup­pos­edly re­sid­ing in un­in­hab­ited re­gions of the world, and Google com­plies.

I never thought I would have to re­visit the shame­ful his­tory of Pollen, but some­one at the com­pany felt the need to prompt me to do so.

Lawsuits are still on­go­ing against Pollen, by the way. Now that some­one from Pollen tried to erase the record of this story, I got a bit of re­newed in­ter­est in what has hap­pened since. In California, the law­suit Tayler Ulmer vs Pollen is still in progress, sum­ma­rized as:

Tayler Ulmer and five other named for­mer em­ploy­ees, on be­half of them­selves and “all sim­i­larly sit­u­ated em­ploy­ees” claim to have been laid off with­out paid wages and ben­e­fits, plus claim­ing pos­si­ble fraud

The fil­ing says that Pollen ex­ec­u­tives Callum Negus‑Fancey, Liam Negus‑Fancey, and James Ellis are per­son­ally li­able in this law­suit

The law­suit wants to re­claim un­paid wages, un­paid sev­er­ance, restora­tion of lost 401(k) con­tri­bu­tions, and a ul­ing that all the named en­ti­ties and in­di­vid­u­als are jointly li­able, in­clud­ing suc­ces­sor en­ti­ties, so em­ploy­ees can col­lect re­gard­less of how Pollen shuf­fled as­sets and dis­solved sub­sidiaries

I am wish­ing best of luck to the claimants - for­mer Pollen em­ploy­ees - and we will see how the judge rules in this law­suit. The more Pollen wants to si­lence me writ­ing about this, the more I’ll likely pay at­ten­tion.

Pollen ex­ec­u­tives should have read what the Streinsand ef­fect means!

Subscribe to my weekly newslet­ter to get ar­ti­cles like this in your in­box. It’s a pretty good read - and the #1 soft­ware en­gi­neer­ing newslet­ter on Substack.