kgeist

>This misses the point: AIs will get better and better, and containment will be harder and harder.

Containment is hard when you give an AI agent access to a whole VM with a huge attack surface.

And it's pretty trivial when you give it only a small whitelist of manually curated/reviewed/tested primitives.

I remember our infosec person instructing us to verify we don't use log4j in our system written in PHP. Well, we didn't :)

I ran 2 PoCs from GitHub today: one indeed expected Local File Inclusion (LFI) to already be present (so it's just LFI with extra steps), and the other one didn't work at all out of the box without some modifications (although I used the same Docker images and all). The second PoC did trigger a real stale write bug in the end, but it didn't demonstrate actual RCE; it just triggered a stale write. And then I wondered, is this the first time ever that the PHP runtime has had a memory corruption bug? I doubt it (I remember a few years ago we had random crashes in production under high load due to an opcache bug). And if it's not the first memory corruption bug in the PHP runtime, why is it being proclaimed the worst vulnerability in years?

It says 46 tok/sec for Qwen3.6-27b 4 bit on RTX5090, but I get 60-70 tok/sec on a small context like that (5 bit weights with 8 bit KV cache), although it does slow down to 40 tok/sec on large contexts. If I add ngram speculation, then it can increase to 100+ tok/sec on code.

There are many knobs to tweak to make it faster, which the site ignores.

>they'd be gambling that NATO doesn't launch things into Russia

The official discourse in Russia is that NATO is already helping Ukraine launch things into Russia. So there's no gamble; for them, it's already a fact. Except, currently, it's just a proxy war where Ukraine has to jump through hoops to get military aid and targets approved, and it can only fire from Ukraine's territory. With a direct confrontation, there's no doubt that far more would be launched into Russia.

How would a direct war with NATO on several fronts help Russia win in Ukraine? Russia isn't ready for it in the slightest. As I said, if they wanted to go all in (full mobilization instead of partial, martial law, converting all industry to military production, etc.), it would be more logical to focus first on that 1 country they want to defeat, rather than immediately triggering Article 5 and fighting 32 countries at once. It just doesn't make any sense, and judging by the Kremlin's decisions over the last 4 years, I don't think they're that stupid.

Attacking a NATO country would mean total war for Russia. Currently there are no signs that Russia is ready for total war, or willing to have one. Russia has been fighting a war of attrition in Ukraine for 4 years, without a moving frontline, exactly because it wants to win by slow attrition.

Total war (all money going to the war, millions of mobilized workers, etc.) would result in an economic collapse, which Russia is trying to avoid. Aside from "inconveniences" like Yandex AI not working after a data center hit, Russia's everyday life is largely unaffected by the war (at least compared to Ukraine's) - exactly because it is avoiding total war.

If Russia were desperate enough to finally go all in and have full mobilization (millions of conscripts, all industry working around the clock building nothing but drones and missiles, etc.), why would it start by attacking random EU countries instead of Ukraine itself? So I think it's very unlikely that anything is going to happen to Europe other than sabotage here and there. Remember that Putin is a KGB agent, and they're more about targeted tactical operations than strategic chess play.

The whole "special military operation" thing was itself just a way to quickly coerce Zelensky into signing an agreement by threatening force, without total war, but it fell apart, so they had to go this war-of-attrition route

A very naive take from someone who clearly lives in a place where people have real choices, economic freedom, freedom of movement, and a government that protects them. "Just shut it down, bro" risks destroying your livelihood and leaving your family financially stranded, and yourself incarcerated or sent to the war zone. And it's not like Yandex develops weapons of mass destruction, you probably assume it's a collaboration even if Yandex simply hosts the Defense Ministry's websites. No sane parent will put their family at risk for this kind of stuff. "I'm going against the government for abstract ethical reasons" is something very few people/countries can afford.

And you can't shut it down anyway. The government will just nationalize it and keep it running. As long as you're the one in charge, you can at least throw a few hidden obstacles in the way, like dragging out legal processes.

AI models can multitask/use parallel subagents just fine; the issue is with harnesses that don't make it a priority via the default system prompt.

I run an LLM server with Qwen 3.6 in the office, and OpenCode, which the OP mentioned, usually defaults to sequential TODO lists, and it works fine with our little LLM server with 3-4 parallel users. But I noticed that once in a while the LLM got overloaded with requests in the queue, and you couldn't do anything for 20-30 minutes. My investigation led me to an employee who used QwenCode. I tried it myself then, and indeed, it immediately launched something like 6 parallel subagents, where OpenCode would have sequential TODOs with the same model by default.

So in the end, I had to detect QwenCode on the server side and serialize all its parallel requests into a single request queue, because it made life miserable for other OpenCode users :)

Their management decisions are strange, right. They had a nice tool called Upsource, we used it for code reviews. Then they sunset it and told us to use JetBrains Space instead. After we migrated to JetBrains Space, they said, oh wait, we sunset it too. So we had to migrate to GitLab. And now, with AI-assisted coding, I don't even need their IDE anymore, because I mostly look at diffs. And that kinda brings us back to Upsource. That thing could have been grown to support AI-assisted development, like, get rid of all the heavy IDE stuff, and just have a place for code reviewing agents' output and merging things. Somewhat like GitLab Lite but fully agentic-oriented. I think it would have covered 99% of our use cases.

I heard rumors JetBrains started going downhill around 2022-2023 because they severed ties with employees in Russia's St. Petersburg, which housed their R&D and all (although many employees were relocated but who knows).

I do look at the code and have to correct Claude most of the time, but I've noticed that with AI-assisted coding, I mostly look at the diffs when i'm inside IntelliJ. I don't need a pricey full-fledged IDE to just look at files and their diffs.

Wikipedia says: "in the United States, infections occasionally occur in rural areas, where the bacteria are believed to circulate among rodents." A few years ago a boy in Russia contracted the plague after interacting with a wild marmot, he was treated successfully without any problems. I think this news is overblown, because everyone immediately pictures 14th century Europe

It's not clear if she even died from plague. The Russian-language version of the article lists various "versions" of what happened, and her breaking a test tube is only listed as one of the versions. Sounds like random rumors but at the same time, you can't trust the government either (which says no one has tested for plague positively). What's clear is that an employee at an "anti-plague' institute suddenly died from pneumonia-like symptoms, which certainly sounds suspicious but interpreting it as evidence of a plague infection may also be an overreaction

Well, I have experience writing and deploying LLM inference engines, and seeing how the whole thing easily collapses when something goes slightly wrong doesn't instill confidence either that you can just hook it up to arbitrary tools and then expect it not to do random silly stuff ("emergent behavior," heh).

It's not only about some ML theory about RL or AI safety; just silly numerical bugs, caching bugs, etc. in the inference layer can already make it do unexpected "unaligned" things, and the whole thing is just hacks upon hacks to make a silly text autocomplete look somewhat semi-intelligent. Most "post-trained" models are pretty much as useless as base models without harnesses that do the heavy lifting. Have an extra space in the chat template and intelligence goes to zero - here's your "AI" :)

Of course, they learn to generate "tool calls" to achieve "goals" instead of random prose, but at the end of the day, it's still a text autocomplete engine masquerading as an AI. In the happy path, on a known task, the text generator generates a sequence of "tool calls" you expect it to generate, but move off the happy path slightly and all bets are off, there's a non-zero chance it will do something totally random you never expect, because at that point it just throws random stuff at the wall until it succeeds, thanks to brute force with pre-learned heuristics masquerading as intelligence (which is especially the case with "agent swarms," as in the HuggingFace incident).