Unsupervised Learning NO. 511: Serious Supabase and n8n Vulns, WTH Happened in December with AI?, 19 Changes I See Coming to Cybersecurity in 2026

Hey! Hope you all are doing well!

Holy crap this first couple of weeks of 2026 has been a crazy few months!

My Primary Recommendation for 2026: Get on Claude Code Right Now
Not sure if you noticed, but something remarkable happened to the world with AI in December. Basically Punctuated Equilibrium. Kind of like one or two generations of jumps in a blink. A lot of that was people just realizing it, but it was also some combination of Opus 4.5 with Claude Code. The acceleration of AI capabilities in 2026 is about to be even more ridiculous than I (or anyone) thought it was going to be.

I think Claude Code will be largely leading that, unless there’s some MASSIVE model jump from Google or someone due to a fundamental breakthrough. But even then, Anthropic is likely to be on that train as well and get it into Claude Code.

Claude Code is cool but it’s nowhere as good as if you enhance it and customize it to yourself, which is why I created the Open Source PAI Project. I moved it to 2.0 over the holiday break, and it's now at 2.1.

Anyone asking what they should do to get into AI? Easy.

Claude Code is by far the best AI system right now. And PAI makes it many times better. No joke. I’m out of hyperbole to use. Need to ask Kai to invent new ones.

—

I’m reading a bunch of books right now and loving three of them.

The first is a book on writing. Actually, they're both books on writing. In different ways. The first one is about the rhetorical figures, and it's a very old book. The second dissects what makes good books and movies, and stories in general. As you might guess. Both are A+.

—

I'm also in a mode where I am bouncing back and forth between AI research and engineering (future / cyber / neo shit) combined with reading about very old things, like biographies, and old books on rhetoric and writing, and such. I like the contrast. I feel like it’s rejuvinating or something. Maybe like cold plunge to sauna and back again. I remember someone saying something similar, where they only read extremely new things and extremely old things. Or something like that.

—

I'm going through my start of year list, which I'm putting in the Recommendations section. It's like a checklist of things that constantly get ignored but are very important, so I try to remind myself to do them in the last couple weeks of the year.

My Neovim config is actually super solid right now (made some tweaks a couple months ago), so I'm not doing that this year.

—

A few recent blogs:

—

Saddest photo I’ve seen in a long time. I could talk about this for hours. What it says about animals, but about us as well. And life in general. PHOTO

—

My favorite song in the world right now is Paper Hearts, by WHY? SONG

—

Most of all, what I want to share with you in this first episode is to have hope.

AI can wreck everything and it can make everything way better than it was before.

I’m pushing really f-ing hard for the latter. And it’s invigorating. Let me help you join that frame and fight.

n8n patches a perfect 10.0 CVSS RCE that lets authenticated users own the entire instance Security researcher Théo Lelasseux found the bug affecting both self-hosted and cloud versions—disable the Git node if you can't patch immediately. N8N SECURITY ADVISORY | THÉO LELASSEUX GITHUB | N8N BLOCKING NODES DOCS

California launches a one-stop platform to delete your data from companies California's new DROP system lets you submit deletion requests to multiple companies at once instead of doing it manually for each one. CALIFORNIA DROP PLATFORM | HN DISCUSSION

Thousands of Supabase projects are leaking data because devs don't enable RLS Most developers skip row-level security on Supabase, leaving their entire databases publicly accessible to anyone who knows the API endpoint. SKILLDELIVER ARTICLE | REDDIT DISCUSSION

Critical n8n RCE vulnerability lets attackers take over entire servers A CVE scored 9.9 out of 10 lets attackers execute arbitrary code through expression injection in workflow definitions—patch immediately. ORCA SECURITY BLOG

Two cybersecurity experts pled guilty to ransomware attacks on their own clients Former incident response specialists used their access and expertise to deploy BlackCat ransomware, demanding up to $10 million per victim—only one paid $1.27 million. BLEEPINGCOMPUTER REPORT | DOJ STATEMENT | COURT RECORDS

Palo Alto is moving workloads to Google Cloud and might've just negotiated a better deal Palo Alto's spending $6.3 billion on cloud through 2031, but they just cut their 2027 estimate by $114 million right after announcing this Google partnership. PALO ALTO PRESS RELEASE | AUGUST EARNINGS CALL | NOVEMBER EARNINGS CALL | BJ JENKINS LINKEDIN

Tailsnitch audits your Tailscale setup for misconfigurations TAILSNITCH GITHUB

Taiwan saw 2.63 million daily Chinese intrusion attempts in 2025 A Taiwan government report shows cyberattacks from China rose 6% last year, hitting energy and hospitals especially hard, with attacks coordinated around military drills and political events. TAIWAN NSB ANALYSIS | CYBERSCOOP ARTICLE | FDD ANALYSIS ON CEEW

Japan approves record $782 billion defense budget targeting China threats Japan's doubling defense spending to 2% GDP two years early, betting hard on drones and Turkish imports because they can't fill uniforms fast enough. JAPAN CABINET RECORD DEFENSE BUDGET | JAPAN PHILIPPINES PACT COUNTERING CHINA | JAPAN'S GROWING TAIWAN ENGAGEMENT | JAPAN DECRIES CHINA THREAT

US Army mounts 20kW drone-zapping lasers on tactical vehicles TOM'S HARDWARE ARTICLE

More dictatorships than democracies exist now for first time since 2002 ASAHI SHIMBUN ARTICLE

Finland detains ship and crew after undersea cable gets damaged Finnish authorities are holding an Eagle S vessel after a critical undersea cable between Finland and Estonia was severed, likely by the ship's anchor. CNN ARTICLE | HN DISCUSSION

China loaded over 100 ICBMs in new silo fields. OODALOOP ARTICLE

Google engineer says Claude Code built in one hour what took her team a year Jaana Dogan from Google gave Claude a three-paragraph prompt and got a distributed agent orchestration system that matches a year of internal work. This is what I was talking about in the intro. Things are different now. Generationally. JAANA DOGAN'S POST | BORIS CHERNY ON CLAUDE WORKFLOW | THE DECODER ARTICLE

Practical guides and code examples for building with Claude CLAUDE COOKBOOK

Attention Is Bayesian Inference A new paper by Vishal Misra argues transformers are actually doing Bayesian inference, which could explain why attention works so well. ATTENTION IS BAYESIAN INFERENCE | LOBSTERS DISCUSSION

Running Claude Code agents entirely from a phone CLAUDE CODE ON-THE-GO

America's economy looks set to accelerate The Economist reports GDP growth is expected to pick up in 2025, defying predictions of slowdown that dominated last year. I see it as a giant race between adding productivity and eliminating job which allow people to buy stuff. And then the third piece is the UBI play for after that happens. These all have to converge somehow. ECONOMIST ARTICLE | HN DISCUSSION

Plaud launches AI pin with physical button and desktop meeting app I might be getting this one to replace my Limitless. PLAUD NOTEPIN S ANNOUNCEMENT

Web development is fun again It's so crazy about half the posts I read are from developers who are like, "I'm having so much fun." And then the other half are from developers saying, "My life is meaningless now." MATTIAS GENIAR'S POST

Meta buys Manus for $2 billion to get millions of actual paying AI users Meta just bought the viral AI startup Manus for $2 billion, basically paying for a product that already has millions of paying subscribers and $100M in ARR. TECHCRUNCH ARTICLE | MANUS BLOG POST

Your key survival skill for 2026 is critical ignoring The WSJ argues we need to fight our instinct to absorb everything and practice deliberately ignoring low-quality information instead. WSJ ARTICLE

Anti-aging injection regrows knee cartilage and prevents arthritis in mice. SCITECHDAILY ARTICLE

Heavy AI use is making people talk like they're prompting LLMs PROMPTING PEOPLE POST

US job openings drop to lowest level in over a year BLOOMBERG ARTICLE

Trump will ban Wall Street from buying single-family homes This one surprised me. REUTERS ARTICLE

Bankruptcies are exploding across every part of the US economy Business filings are way up across small businesses, households, and corporations—turns out high rates and inflation actually hurt people. Exploding is a loaded word. I did more analysis on this and it’s more like returning to other highs after falling. But I imagine analysis varies. BUSINESS INSIDER ARTICLE | HN DISCUSSION

AI employees don't pay taxes and that's a civilization-level problem Alec argues that replacing workers with AI doesn't just eliminate jobs—it eliminates the tax base that funds roads, schools, and healthcare, breaking the math of society.

I don’t think this is that bad actually, since those companies that do well will be paying everyone’s UBI. That’s the only system that I see working anyway. I’ve yet to hear an alternative. ALEC'S POST

The Best Line Length THE BEST LINE LENGTH

The Gentle Seduction imagines comfortable tech-driven transhumanism THE GENTLE SEDUCTION

Text files are the most durable format for sharing knowledge across generations Jakash3 argues plain text beats fancy formats because it opens instantly, works on any system forever, and doesn't need bloated software that ruins formatting. WHY PREFER TEXTFILES | TEXTFILES DIRECTORY

Ken Thompson explains how a disk scheduling algorithm accidentally became Unix In a video interview, Ken Thompson talks about how optimizing disk head movement ended up shaping the entire operating system. KEN THOMPSON INTERVIEW

The suck is why we're here NIK SHARMA ESSAY

Going half speed gets you 96 percent of the results DEREK SIVERS ESSAY

Hourly life tracking showed most days were actually okay. REDDIT POST