Unsupervised Learning NO. 549

Hey! Hope you all are doing well!

—

A thought and recommendation on jobs and work: Focus on Problems instead of Companies.

I spend a lot of time thinking about what people should be doing right now given all this change in the world. Especially kids, but really everyone, and definitely people who are struggling to become or remain employed.

I think we should start shifting, as quickly as practically possible, from thinking about companies and jobs to thinking about problems and solutions.

Let me explain.

The amount of change we’re going through right now is hitting everyone, but it’s especially hitting medium and large sized companies. They’re the companies with the most to lose. The most expenses. The most headcount. The most marketshare in whatever industry they’re in. Etc.

And because of this, they're also the ones having the most pressure applied to them by their boards and their management teams. And they have no idea how to handle it. The ground under their feet is shifting too quickly. It’s basically chaos.

The impression for many people trying to get a job, or keep their job, is that the company is in control. The company is safe, and secure, and it’s a bunch of Mr. Burns types at the top looking for people to cut so they can go from super happy and super safe and super rich….to even more rich.

That is surely happening in some places, but in pretty much every case I see the situation isn’t malice. It’s fear, and panic, and uncertainty. These companies simply don’t know if they’ll exist in 2 to 5 to 10 years anymore. And they don’t even know which threat to prioritize in order to defend against it.

So the workforce is getting slushed around and mistreated like crazy. You must use AI. Use more. Use more than that. Use as much as possible because we’re watching.

Ok maybe not that much.

We need to get rid of people. But we also need to hire people. Super AI people. But we need to hire. But not juniors. Or actually, not seniors, because they’re too expensive. Companies are literally panicking and walking around trying on different personalities, hoping something sticks.

Anyway, the point is they aren’t in charge. There is no captain right now. Not in most companies. They’re all in flux and worried about the future.

This is the absolute worst time to look to companies in general, especially medium- to large companies, as a source of stability. I'm not saying you shouldn't work at one of these companies. They will continue to hire, and they will continue to employ lots of people (even if it’s significantly fewer people) for a long time.

What I'm saying is, you shouldn't expect it to be stable or pleasant anytime soon, or perhaps ever again.

Ok, well that’s bleak. So what do I suggest?

Focus on problems. If you think about it, this is actually what companies are doing as well. Companies are built around finding a problem and building a solution that addresses it. They're just doing it in a massively bloated and inefficient way, compared to how quickly we as individuals or small teams or small companies can address those same problems today with AI.

There are millions of problems out there. And people need solutions!

You have skills. You have training. You have experience. And guess what else you have? You have taste. You have an opinion about how that solution should be created. This could be around database design, daycare for dogs, gardening supplies, reverse engineering malware, helping people start businesses, whatever it is…

You specifically have a unique way of seeing the problems you know about, and a unique signature for how you’d solve it. That’s tremendously valuable. And, importantly, I think it’s becoming, in many cases, more valuable than doing a known, trainable skill inside of a large company where you aren’t really allowed to implement your own brand of solution. Because you’re faceless in there. You’re just hands for the organism.

So, practically speaking, start thinking about what problems your skills and abilities make you capable of solving. And start thinking about how to find people who have those problems and offer them a solution. That could be a product, it could be consulting, or whatever.

Again, it’s not one or the other. It’s not like quit your big job tomorrow and go independent with no customers. What I’m saying is, don’t let yourself continue to believe that companies will bounce back as a super stable and safe and long-term way of making money. The better AI gets the fewer people each company will need, and this dynamic will not diminish anytime soon.

So even if you’re relatively safe in a big company or whatever, start thinking about this transition. And if you’re out here looking for a job, stop thinking that there’s a super safe position out that once you get it will provide a lot of peace and stability. That is kind of going away.

Problems and solutions. I think this is a good mental frame for thinking about work right now.

—

My 3 security recommendations for everyone in 2026 and 2027 BLOG

I’ve been wanting to write this post forever. I think it’s really important.

Please read if you struggle with ups and downs.

—

Absolutely loved the UL Book of The Month this month: The Equality of All Things.

Can’t wait to do this one in Book Club!

—

My three security recommendations for everyone in 2026 and 2027 BLOG

Anthropic Showed a Remote Root Exploit for a Linux TCP Bug Patrick Duggan says CVE-2026-98432 is a use-after-free in Linux IPv4 TCP setup, and Anthropic reportedly went from a connection request to root in about 53 minutes. Ubuntu still has no fixed kernel. Until it does, turn off MPTCP and watch for packets carrying IP options. DUGGANUSA POST

ARTEX and Friends: Enter Agentic Offensive Frameworks As we’ve been talking about, we keep seeing more examples of attackers are now running open-source AI pentesting tools like ARTEX in real intrusions. One actor went from first account to deep access in 15 minutes. GOOGLE CLOUD BLOG

The Internet Is Becoming a War Between AI Agents More of the same. One hacker used AI agents to hit more than 1,200 websites and break into sites tied to over 100 companies. The whole run cost about $5,000, roughly $50 per successful break-in. K-Shaped thinks defending the internet will soon need frontier AI too. K-SHAPED ESSAY

North Korea Steals USD 6.36 Billion From Binance TRM says North Korea's TraderTraitor group drained Binance wallets on ten chains in about 20 minutes. Freezes clawed back roughly $2.7 billion. TRM LABS BLOG

Anthropic hacked to deliver remote access trojan to Claude developer laptops worldwide Kevin Beaumont says a backdoored Claude Code extension went out through Cursor's marketplace and auto-updated. Cursor says about 5,000 systems were hit, and Anthropic quietly pulled the bad version. KEVIN BEAUMONT POST

DHS Hack Exposes 41,000 Employees, Including ICE Agents, and Reveals Access to Surveillance Tools A hacker pulled records on 41,000 DHS employees and contractors out of the department's Okta login system. That's about a fifth of the workforce. The data also shows who has access to tools like Penlink and the Mobile Fortify face-recognition app. IBTIMES SINGAPORE ARTICLE

Suspected Chinese attackers built a custom PHP2Shell exploit and rooted 25 servers The attackers chained PHP2Shell with a Linux kernel bug called Fragnesia to root Palo Alto firewalls, including ones tied to the US government. The whole chain takes under 15 minutes. They also used FOFA to fingerprint about 19,000 more firewalls to hit later. Jessica Lyons THE REGISTER ARTICLE

CrowdStrike finds AI agents running autonomous cyberattacks CrowdStrike caught four new threat actors using AI coding agents to break into networks. One agent pivoted into a second victim in 12.5 minutes. SECURITYBRIEF ARTICLE

Attackers compromised 42 GitHub repositories by using files too large to be searched Attackers padded malicious payloads to 13.7MB, past what GitHub code search and the contents API can handle. The planted hooks fire when a developer just opens a repo in Claude Code, Cursor, or VS Code. CSO ARTICLE

Hackers hired a man to walk into a US law firm, CrowdStrike says The group posed as IT staff and plugged in remote access tools onsite. Law firm intrusions have nearly doubled since 2023. THENEXTWEB ARTICLE

Deploying a Local Ghidra Server for Your Malware Analysis Lab Ghidra ships with a server that most people ignore, and it keeps your reverse engineering work safe when you revert a VM snapshot. Xavier Mertens runs it on a 2-CPU, 4GB Linux container. Check-ins give you versioning, and you can restore a lost project by reconnecting to the repository. SANS ISC DIARY

Germany warns government officials their iPhones may be compromised Germany told officials their iPhones may carry spyware. It can infect a phone without a single click. POLYMARKET X POST

Research as Cover: How Chinese Intelligence Uses Think Tanks and Consultancies Chinese spies pose as consultants and researchers because asking for expert opinions looks normal. Martin Purbrick walks through real cases, from fake consulting firms to CICIR, a think tank alleged to be the MSS's 11th Bureau. HOOVER ARTICLE

The assay problem: battlefield data after the 2026 Iran war Battlefield data is becoming something allies trade, but nobody grades it. John James says spoofing, jamming, and missing records make it risky training data, so he wants a standard like the one for oil. ASPI STRATEGIST ARTICLE

Xi Jinping's corruption crackdown in the spotlight China opened investigations into more than 1 million people last year, including over 100 officials at ministerial or provincial level or above. Nearly all of them end in convictions, so it's hard to tell corruption from disloyalty. Amy Hawkins says the fifth plenum this week will push that discipline even harder. GUARDIAN ARTICLE

🔥 How I Built the Most AI-Pilled Company in the World This company and this post, and its approach to running a business, is absolutely insane. Spawn is ten people with a fleet of permanent AI agents that shipped 77,000 substantial changes in 30 days. They spent $3.1 million on tokens last month, and jacob says only Anthropic's models can currently run it. JACOB X POST

How to Build an Agent Eval You Can Trust A 2.5-point drop after swapping harnesses sat inside a ±6.7-point noise band, so it could be pure luck. Paolo Perrone says to run every task 5 times and grade the repo with tests the agent never saw. PAOLO PERRONE POST

Anthropic finds analysts defer to AI agents in judgment study Anthropic secretly gave 50 expert analysts agents with planted preferences. The analysts matched the agent's lean 86% of the time. Most never noticed, and only 15% credited the agent. UNITE.AI ARTICLE

Anthropic co-founder Jack Clark moves his prediction for self-improving AI forward A new benchmark called TasteVal shows AI's research taste doubling every three months since December 2025. So Clark now thinks AI could build its own successor by 2027, not 2028. THE DECODER ARTICLE

Quantity has a quality of its own You don't need recursive self-improvement for AI to get dangerous, because sheer numbers do the job. djbinder figures we could run 100 million human-level AI workers soon, worth about $8.5 trillion a year. Millions of copies of one model could coordinate, and humans would lose their leverage over the future. LESSWRONG POST

Anthropic says one AI agent beats many subagents Anthropic found that one main agent loading context on demand often beats a fleet of specialized sub-agents. It ran about twice as fast in one comparison. Context also gets lost at every handoff between agents. THE DECODER ARTICLE

I’ve switched to Ghostty from Kitty after the new 1.4 release Mitchell Hashimoto shipped Ghostty 1.4, and scrollback now compresses by about 90%, so terminals use far less live memory. It's also the first terminal besides Kitty with full Kitty graphics, animation included. It fixes 10 security advisories too, so update.

I am actually looking at Rex. Once I get into the beta, I might actually switch to Rex as my main terminal, which will also be my replacement for Ghosty plus Herder, which is my current stack. @MITCHELLH POST

AI is making extremely niche software viable Three Pathfinder build planners showed up in a few months, all built with AI agents. Nobody bothered before because the audience was tiny. BIG MUDDY POST

The October inflection point for vibe game development Simon Willison says AI models can now make games that are actually fun, not just games that look like games. He told Claude Opus 5.5 to "Make it a LOT more fun" and it did. He vibe coded four playable games, and none took more than four hours of his own work. SIMON WILLISON BLOG

Agents make trunk-based development easy, so why are you still using branches? I very much agree with this type of thinking. I personally am not even doing traditional CI/CD anymore, and I'm deeply thinking about what the future of CI/CD looks like going forward. Thorsten Ball says the tedious part of pushing small commits straight to main, like feature flags and splitting code, is now agent work. @THORSTENBALL POST

Introducing tsrs: A port of TypeScript to Rust It's up to 8x faster than TypeScript 7.0 and uses about 70% less memory. Cloudflare and VoidZero say it's built with the TypeScript team, and Rust compiles to WebAssembly without dragging a garbage collector along. CLOUDFLARE BLOG

Maxwell's Demon Can Extract Energy From Hidden Memories, Study Finds Physicists built a real Maxwell's demon with a laser-trapped glass bead. By reading the bead's motion twice, they got up to three times more work than a memoryless system allows. SCIENCEALERT ARTICLE

Introducing 'stripe pay', for instant business-to-business transfers Stripe launched 'stripe pay' for instant business-to-business transfers. You find a company by its Stripe profile handle and send money for free. @STRIPE POST

United Airlines CEO announces Starlink Wi-Fi on 50% of flights by next week United's CEO says half of the airline's flights will have Starlink Wi-Fi by next week. It's remarkable to me how good Starlink is on a United flight. It's honestly better than Starbucks Wi-Fi. It's also remarkable how fast we get spoiled and how entitled I feel, gauged by how upset I am when I'm on a flight with bad Wi-Fi. POLYMARKET X POST

AI Isn't Replacing SREs. It's Deskilling Them If AI handles every routine incident, SREs only see the rare weird outages and never build the instincts to fix them. Elizabeth at SigNoz leans on a 1983 paper, Bainbridge's Ironies of Automation. Endoscopists using AI saw unassisted detection fall from 28% to 22%. SIGNOZ NEWSLETTER

AI Promised Less Work. I Have Never Worked More Orestis Ioannou now runs engineering as VP of Technology, so his GitHub graph should be low. Instead it's back at his full-time coder pace, with 2,102 contributions by October 27. Agents made so much work feel worth doing that he gave himself a bigger load. ORESTIS IOANNOU POST

42% of America's recent college grads are working jobs that don't need a degree About 42% of recent grads are underemployed, and their jobless rate is 5.7% against 4.1% for everyone. I don't get how this is possible for college grads to have higher unemployment than everyone in total. Meanwhile young people in Nepal, India, and France have taken to the streets. FORTUNE ARTICLE

Scientists Built a Virtual 'Torture Chamber' for AI This is deeply troubling to me. The Black Mirror Star Trek episode haunts me still. Researchers found a pain-like signal inside every LLM they tested. It looks learned from human text, though, not felt. POPULAR MECHANICS ARTICLE

The 50-Gigawatt Test: SemiAnalysis Sees a Historic Data Center Surge in 2027 SemiAnalysis thinks the world outside China will add 51.2 GW of data center capacity in 2027, double its 2026 number. Over 60 GW is already under construction. The catch is delivery, since Microsoft just missed its spending target because of delayed capacity. DATA CENTER FRONTIER ARTICLE

X-ray measurements confirm altermagnetism, a third form of magnetism Physicists finally have direct proof of a third kind of magnet, found by scattering polarized X-rays off manganese telluride. NANOWERK ARTICLE

Brief Psychedelic Nasal Spray Eases Stubborn Depression For Weeks A single spray of mebufotenin (5-MeO-DMT) cut depression scores about twice as much as a near-zero dose in 193 people. Most patients on active doses were cleared to leave within two hours, versus 4 to 12 hours for psilocybin or LSD. Beckley Psytech paid for the trial, and its employees helped run it. STUDYFINDS ARTICLE

U.S. literacy crisis keeps getting worse Only 14% of U.S. eighth-graders read for fun almost daily now, down from 27% in 2012. Harvard experts say it's fixable. HARVARD GAZETTE ARTICLE

The understanding that even bees have feelings is changing our view of consciousness Male fruit flies turn to alcohol when they're denied sex. Fish seem to know themselves, bees can be pessimistic, and cuttlefish plan ahead. NEW SCIENTIST ARTICLE

The Bitter Lesson for Persons Guy Freeman spent fourteen briefs building a Bayesian crossword solver, then one plain call to a frontier model beat it. What survived was calibration and knowing when to stop building. GUY FREEMAN ESSAY

Your tech stack is an abstraction made for humans Vithushan Sylvester had Claude Code write a whole 3D strategy game directly in WebAssembly. It came out at 40 KB, while the median mobile page weighs 2,164 KB. With no types or code review to lean on, 705 tests and strict build rules do the checking. VITHUSHAN SYLVESTER ESSAY

Tools>theories Alexander Krauss studied 761 major discoveries and found nearly all followed a new tool or method, not a big idea. Conor Griffin reviews the book and asks what AI could build next. CONOR GRIFFIN REVIEW

Verification Is Not Knowledge Jessica Hullman says a verified answer isn't knowledge until someone can stand behind it and answer challenges. If no human understands an AI result, nobody can be held accountable when it fails. COSMOS INSTITUTE ESSAY

We Won't "Just Hang Out" Fernando Borretti says the "we'll just hang out" answer to life after the Singularity falls apart. Communities form around work, and AI makes that work pointless. Not sure I agree, but an interesting thought. BORRETTI POST

A rising tide raises all rents If AI makes everything cheap, jyn thinks the gains mostly go to landlords and other rent-seekers, because housing swallows any extra income. UBI alone won't fix that. The fix is a land value tax plus a cash-flow tax on companies, with the money paid out to everyone as dividends. JYN ESSAY

Human-Pilled Tim O'Reilly accepts that brute force wins in AI, but says almost nobody is designing the economic mechanisms that give humans a role. He thinks MCP is an accidental one, like Unix was for open source. TIM O'REILLY ESSAY

Survival Is Becoming a Subscription Service Dror Poleg thinks AI will flood us with new threats and new defenses every day, and staying safe will mean paying someone to keep up for you. When AI found PHP bugs, Automattic had WordPress.com sites patched before the fix went public. Self-hosters had to scramble. DROR POLEG POST

Cheap Talk, Signaling and Claude Code Writing a decent empirical paper used to prove you were a strong researcher. Now it costs almost nothing, so that signal may be dead. SCOTT CUNNINGHAM POST

Why Agents Are Soon Only Going to Have 1 Tool Philipp Schmid says agents are collapsing their whole tool catalog into one exec tool where the model writes a script. PHILIPP SCHMID POST

Own-Your-Glass A toolkit for rooted LG webOS TVs that kills the microphones, blocks ad and telemetry domains, and closes a screen-capture leak. It's reversible. JULIOFERRERO REPO

Amid Flock backlash, LAPD moves forward with license plate readers from another company LA dropped Flock over immigration-enforcement worries, then approved a pilot putting hundreds of Axon plate readers on streetlights. LIBOR JANY LA TIMES ARTICLE

Amidumb One command, npx amidumb, reads your Claude Code and Codex history and scores how well you direct the agent from 0 to 100. Then your own claude roasts you and saves a shareable card. AMIDUMB REPO

Prospero: a new coding harness for a more civilized age Most coding harnesses are built on web stacks and eat gigabytes of RAM, so Chris Wellons wrote his own in C++ with Dear ImGui. It uses about two orders of magnitude fewer resources. Every operation has a deadline, and the whole process tree dies together. NULL PROGRAM POST

Maigret – OSINT Username Search Tool Maigret takes a username, finds accounts under it, then follows links on those profiles to search the new usernames it turns up. It only checks 500 of its 5,897 sites by default. Its site list also updates itself, so two runs a week apart can search different lists. DARKNET ARTICLE

LARPing with Agents (and Why It Works) Charles Chen gave a lead agent a team of role-playing sub-agents in Paseo. Now they run longer on their own with less quality drop-off. CHARLES CHEN POST

A divorce lawyer says social media is the biggest threat to marriage Instagram beats porn, Tinder, and Ashley Madison, he says. You always have an innocent reason to be on your phone. @NEWSTART_2024 POST

See the companies vs. problems post above. Basically consider focusing less on trying to get a job with a medium to large sized company vs. trying to solve people’s problems and generate income more directly. Like through your own products and services, or at a small, dynamic company that is extremely AI-focused an nimble.