Unsupervised Learning NO. 493

Hey! Hope you’re doing well!

First, a new blog post that’s more negative than usual…but it’s honestly what I’ve been feeling and I think a lot of people are likely feeling the same way. I’M WORRIED IT MIGHT GET BAD

Got back from Vegas and am reflecting on being thankful. First that I was able to go, as it seemed like a lot fewer people were able to, but mostly because of friendships. Old and new. It was brilliant being able to see so many UL people! Including at our annual UL Dinner.

But also hanging out afterwards and at Blackhat / DEFCON. Plus I got to see so many security homies from over the years. And even better, I got to cross-pollinate the UL/Security groups in a few places! One such place was at Sean Sun’s always spectacular Miscreant’s Creator’s meetup. I feel refreshed having seen so many friends. 🫶🏼

—

While I was in Vegas, I got to catch up with one of the companies I'm involved with called SPLX.ai. I feel like I don't talk about them enough here, unrelated to whether or not they're doing a sponsor slot. They're just the best solution out there for automated AI pentesting. They literally only have a challenge of getting POCs because they win 100% of the POCs that they get. Not most POCs. Every single POC. If you are a red team looking to scale up your building to test AI systems, you need to check them out. Oh, and they recently wrote a really cool blog post analyzing GPT-5. It went exactly as you’re expecting. CHECK OUT SPLX.AI

—

If you’re looking for a Web Analytics alternative to Google Analytics, I use Fathom Analytics, which also gives me a cool widget in my menu bar (and Claude Code status line). They’re not a sponsor, but here’s my referral code (with $10 of free credit) if you want to check it out. CHECK THEM OUT

While in Vegas I had a really cool conversation with Jason Haddix, Caleb Sima, and Ashish Rajan on lots of AI/Security topics on the AI Security Podcast (episode coming soon).

One of the questions that was asked was:

My counter question to that is, "How do we know we aren't? Because I'm not sure there's really anything such as an AI attack. If you think about AI as just having more eyes and hands, here's a question for you:

Would you see more attacks or would you see more AI attacks? I think you would mostly just see more attacks. They would just be done much better because they could target people individually, they could take more time riding specific spearfishes and specific campaigns targeting your infrastructure and your people.

Now, of course, prompt injection is an actual new novel attack, and I think that's AI-special. But other than that, I think what we should expect to see is more scale and, as we talked about on the podcast, possibly faster coverage of attack surface for a given campaign since, once again, you just have more eyes and hands to go and do that thing. It was an important conversation in the episode, and I really recommend you subscribe to the podcast and check out the episode when it comes out. THE AI SECURITY PODCAST

A Thought on MCP Security

🔥🔥🔥 AI Cyber Challenge releases all finalist security tools as open source
The AI Cyber Challenge dropped all 7 finalist teams' Cyber Reasoning Systems as open source, plus the competition infrastructure and benchmarks, so anyone can build on their automated vulnerability-finding tech.

This is one of the biggest stories from BlackHat/DEFCON in my opinion. These are systems designed to AUTONOMOUSLY go and find problems and fix them! And they’re all public domain now! AI CYBER CHALLENGE ARCHIVE

Porn sites are stuffing SVGs with clickjacking code to farm Facebook likes
Dan Goodin reports Malwarebytes found porn sites hiding obfuscated JavaScript inside SVG images that secretly click-jack Facebook likes when you tap the picture. ARSTECHNICA STORY | MALWAREBYTES RESEARCH POST

Attackers can now hide C2 traffic inside Zoom and Teams calls
Security researcher Adam Crosser discovered a way to tunnel command-and-control traffic through legitimate Zoom and Teams infrastructure, making it nearly impossible to detect. | BLEEPING COMPUTER ARTICLE | BLACKHAT PRESENTATION | TURNT TOOL

The argument that we replaced passwords with something worse
Daniel H argues that modern authentication has become a nightmare of complexity, where we've traded simple passwords for a mess of SSO providers, passkeys, and authentication apps that often fail when you need them most. I disagree, I think. I think Passkeys in particular are way better than vanilla passwords. | THE OTHER DANIEL'S BLOG POST | HACKER NEWS DISCUSSION

Sonicwall Firewalls Are Getting Hammered By Zero-day Attacks
Attackers are exploiting what looks like a zero-day in SonicWall Gen 7 firewalls' SSL VPN service, with multiple security firms tracking Akira ransomware deployments that started around July 15th. | CYBERSCOOP ARTICLE | SONICWALL ADVISORY | HUNTRESS ANALYSIS

FBI Warns About Scam QR Codes in Unexpected Mail Packages
The FBI is warning people about unexpected packages containing QR codes that lead to sites stealing personal data or installing malware. | FBI WARNING | MALWAREBYTES ARTICLE

Anthropic offers Claude to all three branches of government for $1
Anthropic one-ups OpenAI's federal deal by offering Claude to executive, legislative, and judicial branches for $1 per agency annually, with FedRAMP High certification and multi-cloud support through AWS, Google Cloud, and Palantir. TECHCRUNCH ARTICLE | ANTHROPIC ANNOUNCEMENT

Marines Release an official drone-fighting handbook
The Marine Corps just published their first official counter-drone tactics manual, covering everything from detection to jamming to kinetic kills. | MARINE CORPS ARTICLE | HN DISCUSSION

Microphones can spot radar-evading hypersonic missiles
Researchers found that hypersonic missiles create unique sound signatures detectable by acoustic sensors, potentially solving the radar-evasion problem. | ECONOMIST ARTICLE

OpenAI’s bad very bad gpt-5 launch, and the equalization of AI players
The GPT-5 launch went really poorly. It kind of seemed okay within the first few hours and maybe the first day or so. But very quickly people started reporting all sorts of issues.

The worst stuff to me was the chart crime. It's really hard to release charts that bad unless you have incompetence or chaos in the organization. It's a smart group of people, so something very strange must have happened to force them to put this out like this. What it says to me is that they were feeling a lot of pressure from competitors and felt like they really had to put out something extraordinary to regain momentum.

The irony is that Sam had been telling us for months in various interviews that it wouldn't be as big of an update as before. I guess he also did tell us that it would be as big as the update as before, but he also said many times that it would be more of a subtle and quality upgrade than a big jump. The problem is the hype expectation vs. what we actually got, and it's doing a lot of damage.

I kind of see it as the end of an era of them being the official (single) leader. I mean, everything had already kind of equalized before, but this really made it concrete. Opus 4 and 4.1 are already so good, not to mention Google's latest models. Everything is just so good now. It’s not like OpenAI is bad or anything, just that there’s no longer a single leader—and if there were to be one, it probably wouldn’t be them. But it depends on what you’re counting. To most people AI still equals ChatGPT, so they still have that.

I guess the other thing to mention is that the thing I've been talking about for a couple of years now seems to be happening, where the intelligence of the model is not the only thing anymore that makes an AI ecosystem attractive. It's more so the ecosystem itself, meaning all the different ways that the model is used within tooling and interfaces. THE POST BY CHARLIE MEYER | HACKER NEWS DISCUSSION

Claude's 1M token model beats Gemini on speed but loses on detail. EVERY ARTICLE

Voice-controlled swarms using MCP, tool APIs, and a boids twist
Jason Fantl builds a voice-to-LLM controller that runs MCP tools to split, reassign, and steer swarms. Insanely cool. VOICE-CONTROLLED SWARMS ARTICLE

Genie might be Google’s real advantage over OpenAI
Ahura Mazda argues Google’s Genie feels like the actual leap—native simulation + tool-use—while OpenAI looks stuck in chatbots. AHURA MAZDA POST | HACKER NEWS DISCUSSION

Socratic AI tutors beat generic chatbots for real thinking in college
A new paper tests a Socratic AI tutor with 65 German pre-service teachers and show it boosts critical, independent thinking over a vanilla chatbot—and outline orchestrated multi-agent systems as the next step. This is exactly how I'm thinking about it as well. If you don't put the effort in and you just want to be lazy, AI will definitely make you stupid and show you a lot of porn or whatever you want to see to be entertained. But if you care about learning and constantly challenging yourself and growing, then AI can do that for you as well. People are going to get from AI exactly what they ask of it. ARXIV PAPER

Google says AI search is providing higher quality clicks to websites
Google claims their AI Overviews and AI Mode are actually increasing search volume and sending more valuable traffic to websites, but I don't get how that can be possible if it's answering the question without having to click through. GOOGLE BLOG POST

The new instagram map is freaking people out
Morning Brew says users are accusing Instagram of exposing live locations despite opt-in claims, while some blame the confusion on geotagged posts. MORNING BREW STORY

Cursed knowledge makes tech safer but also more fragile
Alex Tran argues the more we automate guardrails, the more we rot our intuition—so when they fail, we fail hard. CURSED KNOWLEDGE ARTICLE | HACKER NEWS DISCUSSION

surtoget.no is a tiny, spicy Gleam-powered protest site
John Mikael Lindbakk built a snarky, no-database site in Gleam to dunk on a chronically late Norwegian train line, with clever pre-rendering, image caching, and Erlang FFI hacks. INTRO POST BY JOHN LINDBAKK | SURTOGET.NO SITE

How i ended up writing gleam for a living
Louis Pilfold tells the origin story of betting his career on Gleam and why the language’s ergonomics plus BEAM reliability hit a sweet spot for real software. YOUTUBE: LOUIS PILFOLD ON GLEAM | LOBSTERS DISCUSSION

Developers Feel Dotfiles Are Too Personal To Share
Juhis Hamatti wrote about how he loves dotfiles and sharing knowledge but feels his configuration files are too intimate to publish, even though he regularly reads others' dotfiles for inspiration. I feel exactly the same way, and it’s why I haven’t updated my stuff recently. As a security person I also worry about something sensitive ending up in there as well. | THE ESSAY | JUHIS'S BLOG | JUHIS'S DIGITAL GARDEN | JUHIS ON GITHUB

No one is really working
Human Invariant talks through three elite early-career archetypes barely doing deep work and then breaks down the reasons they’re still paid so much. This is part of the reason why lots of companies can’t wait to fire people. NO ONE IS REALLY WORKING

Entry-level jobs have dropped 73% as companies replace new grads with AI
Final Round AI reports that entry-level job postings have dropped 73% across major fields, with tech companies cutting new graduate hiring by over 50% since 2019. FINAL ROUND AI ANALYSIS | NEW YORK FED DATA

Job growth just fell off; here’s what might be breaking
Claudia Sahm digs into why U.S. hiring suddenly cooled—cyclical slowdown, data quirks, or something structural, with some good data to back her up. JOB GROWTH HAS SLOWED SHARPLY | HACKER NEWS DISCUSSION

Insurers warn key regions are becoming uninsurable. CNBC ARTICLE

Trump order could push crypto and private equity into 401(k)s
Morning Brew says Trump’s move nudges the Labor Department to greenlight riskier 401(k) options, which CNBC’s Ryan Ermey notes could open the $12.2T pool to crypto and private markets. Not an expert, but seems like it could be great until it isn’t? HR BREW ON $12.2T 401(K) ASSETS

UK government tells citizens to delete emails to save water during drought
The UK government advised people to delete old emails and photos to conserve water because "data centres require vast amounts of water to cool their systems". See this for why the UK/Europe will lose in AI. TOM'S HARDWARE ARTICLE | UK GOVERNMENT ANNOUNCEMENT

Study shows lifestyle changes can slow cognitive decline by 55%
A two-year randomized trial found that combining exercise, social activities, and brain training reduced cognitive decline by 55% in older adults at risk for dementia. We know the medicine, we just have to take it. SMITHSONIAN ARTICLE | HACKER NEWS DISCUSSION

A love letter to a future employer that still feels fresh
Charlotte Brandhorst-Satzkornat writes a candid, funny “hire me” note that nails culture fit without the cringe. It’s basically a template for showing taste, values, and momentum in one page. A LOVE LETTER TO MY FUTURE EMPLOYER | CAT ZWANGER HOMEPAGE | HACKER NEWS DISCUSSION

Pay phones come back as free community lifelines
Engineer Patrick Schlott revives pay phones in rural Vermont—free VoIP calls, daily use, and suddenly crucial with schools banning smartphones. NPR STORY

How Black Sabbath's First Four Albums Used Obscure Phototype Alphabets
Nick Sherman traces how Black Sabbath's iconic album covers from 1970-72 all used rare typefaces from the phototype era that have been mysteries for decades. | FONTS IN USE ARTICLE | NICK SHERMAN

Everything local for AI work without the internet
Manish shows how he runs a full AI stack fully offline—models, vector search, and evals—so nothing ever leaves the box. MANISH’S OFFLINE AI WORKSPACE | HACKER NEWS DISCUSSION

Getting Good Results From Claude Code
Chris Dzombak shares practical tips for making Claude actually useful for coding, like being specific about languages and tools you're using. | DZOMBAK ARTICLE | HACKER NEWS DISCUSSION

AI bubble concerns grow as spending vastly outpaces revenue.
I’m not in this camp, but I'm including for diversity of thought reasons. NEW YORKER ARTICLE

Omnara AI built a mobile app that turns your AI agents into communicative teammates—you get push notifications when Claude needs help, see what it's doing in real-time, and can guide it from anywhere. OMNARA GITHUB REPO

Turn any website into an API
Parse.bot basically lets you point at any page and get a clean API back without building scrapers. HACKER NEWS DISCUSSION

Aura Lets Websites Declare Their AI Capabilities Like Robots.txt
Osman Kitay created a protocol that gives websites a standard way to tell AI agents what actions they can perform, moving beyond brittle screen scraping to explicit API declarations. | AURA GITHUB | NPM PACKAGE

Write your own dead-simple bash/zsh tab completions
Li Haoyi shows how to add tiny, custom tab completions to bash and zsh without generators or frameworks—just a few lines that make your CLI feel bespoke. MILL BLOG POST | HACKER NEWS DISCUSSION

Apple’s Embedding Atlas (super sick visualizations of embeddings) GITHUB

My bud YTCracker just released a 17-track album mixing technical hacking references with personal stories about making it in cybersecurity. I've been listening since the early 2000s, and this album is particularly strong. I INVENTED THE COMPUTER ALBUM

Doctor sees 12 AI-triggered psychotic breaks. KEITH'S TWITTER THREAD

Uv now lets you run GitHub gists directly
Charlie Marsh just added the ability to run GitHub gists directly with uv, so you can execute remote Python scripts without downloading them first. Cool/scary. UV PULL REQUEST

UAI emerges as the third essential interface type. JOSH'S UAI ARTICLE

Google Launches Gemini CLI and GitHub Actions for AI-Powered Coding
Google released Gemini CLI and GitHub Actions integration, letting developers use Gemini AI directly from terminals and CI/CD pipelines. | GOOGLE BLOG POST | HACKER NEWS DISCUSSION

Photographer captures same NYC commuters twice over 9 years
Peter Funch spent 9 years photographing the same commuters twice at 42nd and Vanderbilt, creating haunting diptychs that reveal our unchanging daily rituals. MODERN MET ARTICLE | PETER FUNCH WEBSITE

I may be wrong about my latest essay about worrying about how bad things could get.

But on the off chance that I’m right, do me a favor and be extra appreciative of what we have today, and what we’ve had for decades. Just try to squeeze as much enjoyment out of life as you can. The invisible, common things. Your partner. Your hobbies. Your friends. Your family.

If I’m wrong, and everything is fine in a few months / years…well, so what? We wanted to appreciate those things more anyway.