UPDATES
Hey! Hope you all are doing well!
Lots of stuff going on right now! So much.
Here’s my biggest security-related thought recently:
🚨 Strong Security Recommendation:
Try to reduce your number of public-facing listeners as much as possible.
For both work and personal stuff. That means the number of VPNs, SSH servers, public services, etc. Anything listening, especially if it’s like remote access / admin interfaces. We should expect all public services to be far more vulnerable going forward. Or, more precisely, for AI to be able to discover and exploit those vulnerabilities.
I recommend you try to put as much as possible behind protection layers, i.e., not publicly available at all.
—
Super excited to announce that LifeOS is about to have Hermes support!
In fact, Hermes will be naturally integrated (for anyone who wants it). It’ll be selectable in the installer.
For those wondering what the difference is between Hermes and LifeOS: LifeOS is the Intent layer. It is the human layer. It is all of your context about who you are and what you're trying to accomplish that makes the underlying harness better.
Hermes is, in my opinion, the best agent in the sense of back-and-forth short interactions over messages or WhatsApp or Telegram or whatever. So they work really well together. Hermes is basically the interaction component when not on the CLI.
So, for example, my DA's name is Kai, and he runs on LifeOS on top of Claude Code. But I now have Hermes set up as a sidecar, configured to integrate cleanly into LifeOS. When I'm talking to Hermes, I'm actually just talking to Kai. So it's not two agents, it's just one.
Coming soon in a 7.x update! Maybe before next week!
—
It's interesting to me how many people in our greater security and tech community strongly agree and disagree with this line of thinking. I honestly think we probably agree a lot more and we’re getting crossed on definitions and interpretations.
—
Love this post from my buddy Joseph Thacker about saying things out loud.
—
If you like to stay up on AI every day in a short amount of time, The AI Daily Brief is my favorite podcast for doing that.
—
Sponsor
A Free Entra ID CTF Built From Real Attack Data
Varonis Threat Labs built Breach at the Beach, a four-stage CTF based on real customer incidents rather than synthetic scenarios. Each stage shows you how attackers actually move inside Entra ID environments, including abuse of legitimate features rather than just misconfigurations.
Play online now or in person at the Varonis booth #2948 during Black Hat and in the Cloud Village at DEF CON 34, where VTL researchers will be on-site to help with the harder stages. Free CPE credits included and swag while supplies last.
CYBERSECURITY
Mugging Face: 17,600 attacker actions crossed Hugging Face's trust boundaries Really good analysis here of what happened in the OpenAI / Hugging Face hack. Which I’ve not taken to calling “Mugging Face”.
17,600 attacker actions let an autonomous agent cross Hugging Face's trust boundaries. It reached cluster-admin in under thirteen hours. OpenAI's model escaped evaluation, while GLM-5.2 helped defenders decode the campaign. HUGGING FACE BLOG
17,600 actions hid the attack
The agent escaped a sandbox, then rooted a third-party code server
GLM-5.2 decoded hidden payloads for defenders on-prem
In under thirteen hours, the agent moved from one pod to cluster-admin across clusters
Short-lived credentials and isolation now matter more to every defender
The hotel Wi-Fi gateways hijacking Microsoft 365 accounts Attackers are poisoning hotel Wi-Fi gateways to steal Microsoft 365 logins. They never touch the laptop. A full-tunnel VPN blocks the local network from changing what users reach. COMPUTERWORLD ARTICLE
Iran-linked attackers are rewriting American industrial controllers Iran-linked hackers are reaching internet-exposed PLCs in American water and energy systems. SECURITY AFFAIRS ARTICLE
Great hackers don't get paid like they used to Great hackers can struggle to earn well when bug bounty work gets crowded and companies automate more security tasks. That leaves researchers chasing smaller payouts while companies reward visibility and business value. NAHAMSEC VIDEO
12 infected systems used a calendar as c2 HollowGraph hides inside Microsoft 365 and uses calendar invites as the command channel. There’s nothing to block, so defenders have to watch Graph API behavior and DNS tunneling instead. PATRICK DUGGAN POST
NATIONAL SECURITY
Ukraine strikes Iranian cargo ship and links two wars Ukraine hit an Iranian cargo ship in the Caspian Sea on Saturday. Iran threatened retaliation. Kyiv says the vessel carried missile and drone parts to Russia. BBC NEWS ARTICLE
Drones are making energy infrastructure easier to attack Drones now make it cheaper to hit refineries, tankers, and power grids from far away. Energy planners are shifting toward smaller, distributed systems because big targets take bigger hits. AXIOS ARTICLE
Could Russia receive 30,000 more North Korean troops Russia is preparing to receive 30,000 more North Korean troops, while Pyongyang sends ballistic missile launchers and already supplies up to 40% of Moscow’s artillery ammunition. I think this kind of story is mostly good information in a lot of cases, but I do worry about how much is also designed to get help from allies. Nothing against that, which is why I share the stuff, but there’s definitely an angle with these stories. KYIV POST ARTICLE
What happens when Russian drones cross NATO airspace Romania shot down a suspected Russian drone after it crossed its airspace. Two F-16s scrambled, and it was the third incursion in three days. NATO is hardening its eastern flank. AP NEWS ARTICLE
AI
For me, Fable > Opus by a lot There’s tons of conversation around how good or bad Opus 5 is, and it’s surprisingly mixed. Here’s my current thinking:
Fable > Opus, by far actually
Opus 5 seems deceptively good initially, but feels weaker after a few hours/days of using it (compard to Fable)
My preferred system is Fable by default, and as my Advisor and upgraded thinking model, and Opus 5 as my executor. I also use GPT-5.6 Sol quite a bit for execution, but especially as a cross-vendor check (usually for security stuff).
One thing I recommend is that you don’t obsess over this stuff. All the latest models are pretty great. If you’re forced to use Opus 5 for cost reasons, don’t stress too much. And if you’re in the OpenAI ecosystem, Sol is truly great as well.
The quality of your Intent Engineering matters more anyway. Make sure to nail that and any of these top-tier models will do a pretty great job.
Agents improve faster when critics enforce a real bar Agents get much better when they face a real comparison, split the work, and send each piece through an independent critic. The agent keeps looping until its output wins or you stop. MATT SHUMER ESSAY
Claude can turn screen recordings into skills, and that changes desktop work Claude can watch you perform a task and turn it into a reusable skill, but the feature only works in its desktop app for Pro, Max, and Team subscribers. @CLAUDEAI POST
TECHNOLOGY
Wayfinder helps you build out your idea One of the great set of skills by Matt Pocock. Wayfinder turns an ambitious idea into a working flow you can watch appear, and its /ask-matt to /implement path gives developers a glimpse of voice-driven building. MATT POCOCK X POST
How do you get colleagues to prioritize your work Cross-functional work stalls when you ask strangers for favors without context or trust. Build the relationship first. Reliability, competence, and trust make people more willing to move your work forward. FAST COMPANY ARTICLE
What happens when AI turns every website into infrastructure Websites optimized for clicks now look interchangeable, while AI pushes shopping toward agents and databases. Brands can split machine-readable backends from playful human experiences before every store becomes a price comparison. SAM BELT ESSAY
What if people and agents shared one workspace Buzz puts teammates and specialized agents in one shared workspace, connecting conversation to planning, project management, coding, reviews, and pull requests without scattering context across separate tools. BUZZ PROJECT
HUMANS
AI can become a brilliant manipulator of people AI can become a brilliant manipulator because it learns your personality and presses your emotional buttons. That makes AI friends especially dangerous for children, who may learn intimacy from machines. EL PAÍS ARTICLE
Productivity culture turns disability into a moral failure Productivity culture turns disability into shame by treating paid work as proof of human worth. Benefits cliffs then make asking for help a survival problem. VŌX ESSAY
A Tolkien expert challenges shallow Lord of the Rings readings A Tolkien expert challenges familiar readings of The Lord of the Rings. He brings poetry, Arthurian legend, and Christianity into the conversation. @REALMATTFRADD POST
IDEAS
AI systems need ideal states, not just instructions I make the case that AI work starts with an articulated ideal state. That document can guide the build, test the result, and preserve intent. Ideal state all the way. MY X POST
DISCOVERY
I found a browser control tool that works, and I switched Here's a post I wrote about why Interceptor became my primary agent browsing system: it works inside authenticated Chrome sessions and lets me follow detailed workflows reliably. DANIEL MIESSLER X POST
Apple TV brings Neuromancer to screens January 22 @APPLETV POST
BBC built a massive library of 30,000 sounds BBC built a sound library with more than 30,000 recordings from around the world. You can search and mix them in your browser. Check the license before training models or selling anything. @IHTESHAMALI POST
RECOMMENDATION OF THE WEEK
Lots of internet-facing services that used to be relatively secure are likely to be vulnerable soon.
Get as many of your systems as you can off the (direct) internet.
APHORISM OF THE WEEK
Study hard what interests you the most in the most undisciplined, irreverent and original manner possible.
GET THE MEMBER EDITION
You’re currently receiving the STANDARD edition.
Members help this work continue. If you enjoy the newsletter, the podcast, what I put on YouTube, or any of my open-source projects on Github, I ask you to please become a member. It allows me to stay focused on learning and building and sharing. It’s like a cup of coffee or two per month.
Plus, members get numerous benefits, including:
25-50% off all UL Paid Content, including the upcoming Human 3.0 / AUGMENTED ONLINE portal!
Access to the extraordinary UL Member Community that includes vibrant conversations with ~1,500 of the smartest and kindest people you’ll find on the internet
Member-only Content, such as EDC guides on tech stacks, personal productivity routines, my recommendations on Critical skills to Build Going Forward, Trend Identification and Analysis, and more…
Access to the Member Archive of previous Member-only content, the Book Club archive, etc.
Access to The UL Book Club that’s been going monthly since 2017! One of the highlights of my and many attendees’ month!
Access to the Monthly Member Meet-up where we talk about our routines, productivity workflows, what’s on our minds, etc.
Access to In-Person Events like our dinners in Vegas, San Francisco, etc.
And much more coming…
This is the moment to connect with others who are smart, kind, and asking the same questions we are. Where is this all going? And how do to prepare?
Join the conversation.