ddxv

>> Fixing the existing backlog only solves half the problem; the other half is cutting the rate at which new vulnerabilities enter the codebase. For that, we recommend scanning at PR time. We built security guidance directly into our development process through a Claude Code plugin, which we’ve released publicly.

This both makes sense and is likely very juicy for their token volume.

What would a honeypot mean in this scenario? Like they are hoping you'll accidentally send keys? Or that you'll divulge private company information? It seems about the same as any other AI model from OpenAI/OpenRouter etc right?

If you accidentally send private keys to someone logging that data, you need to rotate keys.

But please let me know if you were thinking about something else, I'm interested.

What do you mean by zero-alignment? Do you consider abliterated models to have zero-alignment?

The truncated English is interesting. I noticed something similar from the OpenAI blackhat talk a couple months ago. Is this pretty standard at this point?

> At an internal staff meeting in September, AWS CFO John Felton had a joke for Prasad Kalyanaraman, the executive overseeing much of Amazon's AI infrastructure expansion.

> "You've taken us free cash flow negative as a company, so congratulations," Felton said, according to a recording of the meeting obtained by Business Insider.

> The remark was lighthearted. But it captured a stunning reversal.

> Just two years ago, Wall Street was debating what Amazon would do with its growing cash hoard. Now, free cash flow has evaporated as Amazon embarks on its biggest bet ever, spending $220 billion this year alone to build the physical backbone for AI.

Huge $220 billion this year to build data centers. One good thing about them for AWS would be that a push to self host / manage your own AI infrastructure could likely still be a boon for AWS.

Dams create large bodies of water that change ecosystems and provide focal points for human communities. They certainly do more than just hydroelectric.

An example would be Lake Pillsbury in Northern California which the dam has not done hydroelectric for decades but the fight to prevent demolishing the dam has had plenty of local support.

Title changed, previously was the same as the article:

"AI agents aren’t ‘going rogue.’ Frontier labs are skipping security basics."

Not a fan of the change. Feels like the article title was changed for being too critical of OpenAI and Anthropic

I've been using OpenRouter, absolutely loving how cheap it is too.

I agree. I hope developers put their token budgets into open weight models rather than funding the banning of open weight models.

Is that any different than any worms developed in the past decades? If you want to call them worms/virus/replicate (ie using real world names for their digital behavior) I'm not trying to police that. I just don't see the difference between a worm/virus created today with an LLM vs one 'yesterday' without an LLM.

I don't think they are actually evil, I think they're doing what they're doing out of mostly pure intentions. That being said, people need to start advocating internally to get their companies off of using Anthropic's models and start using privacy focused local or open weight models.

It's one thing that Anthropic is pushing for so much open weight regulation, it's another that they have such a high valuation pumped by all of our collective subscriptions and token budgets.

Yes. I would argue it's who's managing the harness and agent is responsible. If you mean you're running an agent locally then it is 100% your responsibility. If you're using some trading platform and all you did was prompt, whoever was running the harness that accepted the model's outputs to hack a third party is responsible for the hack, in my opinion.