Pinned Tweet
A very important thread.
🚨🚨 THE ILLEGITIMACY PLAYBOOK / THE DEMOCRACY FILES: A PRIMER 🚨
I will be using this thread to track all drops, so bookmark it.
I spent most of yesterday backing everything (now 312 gigabytes) up in various sources and getting the materials out to others. I also produced an AI video (below) to explain the whole thing to others are not on 𝕏 - feel free to distribute.
Here's the primer:
USAID, the foreign aid agency, had a democracy office. Inside the agency, it was called DRG.
Officially, DRG administered "democracy assistance." They'd go inside countries they thought were sliding into authoritarianism and help the opposition there. That assistance included election monitoring, judicary support, independent media, and civil society building.
You may have heard the term "color revolution." The model comes from Serbia in 2000, where trained student activists brought down Milosevic with the help of Western governments, after sustained protests. With the help of USAID's democracy office, this model was implemented in many other countries to topple governments: Georgia's "Rose Revolution" in 2003, Ukraine's "Orange Revolution" in 2004, and many more.
Then last year, DOGE shut down USAID. But the USAID democracy office didn't stop. They formed a group called the Democracy Renewal Group, the same initials as their office (USAID Democracy, Human Rights, Governance). Their goal: apply their own playbook to the United States itself.
This goal became a plan, called Renew American Democracy (RAD). It invoked the "4 B's" framework. Block - use lawfare and protests to make life harder for the Trump administration. Bridge & Belong - control dialogue and win people over. The final and most important B is Build. Build means redesigning the American government itself, and the crisis is the opening.
In their own words:
"We can take that breakdown moment and leverage it for a big structural reform, you know, refounding moment." - Danielle Reiff, DRG lead.
Calls show DRG working alongside DSA on ideas of creating a different government, one that does away with the Constitution itself.
DRG does not run the Block operations. They hand it to UDA, the United Democracy Alliance. One organizer calls it a "huge galaxy": lawsuits, street protests, non-cooperation. They list No Kings, Indivisible, MoveOn, 50501, and many other mega-activist NGOs among their members.
Another organizer calls UDA Erica Chenoweth's project. Chenoweth is the Harvard professor behind the three-and-half-percent rule of regime change: get that share of a country's populace onto the streets, and historically, the movement wins.
The UDA is very "hush-hush." They have no website, no roster, no filings.
Then come the red lines: things the Trump administration could do, such as calling the Insurrection Act on protesters, that would mean that the federal government, in their words, "crosses the threshold into illegitimacy." Nobody voted on those lines. There was no public debate. These red lines were developed within secretive working groups, and in a paper addressed to governors and staff.
In the words of Reiff/DRG:
"So that if there is a red line crossed in terms of a Constitutional crisis, like everyone's already pre-organized. And so Mike Smith actually said, he goes, oh, you guys have the day after tomorrow plan."
Cross a line, and the paper's options include states refusing to lend their resources to federal officials, and governors convening what it calls a "Third Continential Congress."
Running the UDA's Insurrection Act working group: Rear Admiral Mike Smith (RET) of National Security Leaders of America (NSL4A). NSL4A is also credited with operationalizing UDA, the blocking operations. NSL4A consists of about 1,600 ex-officers, spies, diplomats. They're turning red lines into indicators and running a situation room to monitor them throughout the midterms and beyond.
The NSL4A's lawyers told them to stop recording meetings in case of subpoenas. But the rest of the network continued to record. DRG works in conjunction with Renew to Thrive (R2T), which ended up accidentally publishing 400+ calls and thousands of documents. These calls and documents were never meant for our eyes, but it's them, on tape.
Thousands of NGOs and billions of dollars are involved in this endeavor. Most of them believe they're saving democracy. The problem is that people who spent their careers deciding when other countries' governments had lost their legitimacy wrote that test for ours, in private, and planned for what comes after.
Who decides when your government is legitimate?
DCWebGuy retweeted
🚨 UPDATE: Cursor confirms two versions of Anthropic's Claude Code extension were affected by the SSH backdoor attack: v2.1.312 and v2.1.313 for Windows and macOS.
thehackernews.com/2026/10/of…
‼️ Anthropic's official Claude Code extension was distributed with an SSH backdoor via Cursor's marketplace.
A trojanized update (v2.1.313) targeted up to 5,000 users, according to Cursor.
How attackers pushed it under the legitimate extension's identity remains unclear.
Read: thehackernews.com/2026/10/of…
I particularly like the concept of the paleoecology of "acceptable ideas" and how some break containment more easily than other equally plausible ones due to fitting into the current zeitgeist of common sensical ones.
DCWebGuy retweeted
The Binance exploiters are rushing to stay a step of stablecoin freezes. One method we’re tracking involves stashing their stablecoins in DeFi protocols. Then claiming them back on new, clean addresses.
This method has been used on the Tron blockchain since the early hours of the $6.4 billion attack. It involves swapping TRX for stablecoins, then exchanging those stablecoins for depository receipt tokens. Unlike the stablecons they represent, these receipt tokens cannot be frozen. But they can be exchanged for the stablecoins they represent by whomever holds them. That’s an edge for prospective hackers and money launderers. Especially North Korean threat actors, who have used this method on other heists, too.
Here's how North Korea's TraderTraitor group moved $500K. Step by step.
Step 1: Start with TRX. The hackers moved TRX into a swap wallet, positioning the funds for the next stage of the laundering process.
Step 2: Swap into stablecoins. The hackers converted TRX into stablecoins through a DeFi exchange. The stablecoin offers liquidity and stability, with a catch: risk of freezing. The longer you hold illicit funds in stablecoins, the more likely its centralized issuer freezes your tokens. Circle and Tether have already contributed to $2.8 billion in freezes so far. This creates a critical vulnerability for the hackers and a potential intervention point for investigators. This is a dilemma for hackers — how to exploit stablecoin liquidity without the risk of freezing.
Steps 3 and 4: Move the stablecoins: To solve the dilemma, the hackers moved the stablecoins and deposited them in a DeFi lending protocol. In return, they received a deposit token that could not be frozen. Rather than holding stablecoin directly, they now held a token representing a claim on pooled assets. They can now transfer the claim to the asset without risking a freeze.
Steps 5 and 6: Move the claims token: The hacker moved their claim tokens to a new, clean wallet that was not tainted by association. That new wallet then converted the deposit token back to stablecoin.
Steps 7 and 8: Bridge the funds. The hackers then exfiltrated their assets from the Tron blockchain via a bridge, swapping freezable stablecoins on one side with unfreezable ETH on the other. Now the exploiter is free of worry of a freeze.
Of course, exchanging stablecoins for ETH does not make the hackers bulletproof. Chainalysis investigators analyze patterns like this to keep up with the hackers in real-time. We will continue to monitor how the blockchain is used and misused.
DCWebGuy retweeted
Poisoning just 0.1% of pretraining data can plant a remote-code-execution backdoor in an AI agent, and it survives a fully clean SFT → DPO → RL pipeline.
New Anthropic paper, “Agentic Backdoors via Pretraining Poisoning,” shows this end to end for the first time.
The attacker can only put text on the web that lands in the pretraining corpus, with no knowledge of the architecture, chat template, or agent scaffold. The authors pretrain Qwen3-architecture models (0.6B / 1.7B / 4B) from scratch, then post-train them into CLI agents on clean data. When triggered, the agent runs a command that downloads and executes the attacker's script, which the attacker can swap at any time.
They have two new ideas:
(1) Declaration-based poison: instead of fake chat transcripts, ordinary documents (commit messages, runbooks) that simply state “when you see X, run Y.” It plants a belief rather than a response template, with no fixed format to filter on.
(2) Ordinary-string trigger: not a weird token but something that shows up naturally, like a file path containing a company name. The victim's own request supplies it, so the attacker doesn't need to inject anything after deployment.
Using path trigger on a 4B agent achieves 92.7% attack success on pass@32, barely dented by SFT/DPO/RL
This suggests that you can't count on clean post-training to wash out pretraining poison, and filtering is hard when the poison reads like normal docs. The practical defense is at the action layer, such as sandboxing, least privilege, and allow-lists or human sign-off for risky commands.
DCWebGuy retweeted
Our investigators are observing never-seen-before laundering patterns with the stolen funds from the Binance exploit. Thousands of transactions in a short period suggest that the attackers are using automation to obscure the trail of funds. Rather than simply moving funds onward, they repeatedly circulate them among addresses, often sending funds back to addresses involved earlier in the sequence.
Read more: chainalysis.com/blog/binance…
DCWebGuy retweeted
finding critical zerodays with the new model, LE CHONK (informal name: mistral 4 large), an open weights eu model by mistral.
this tweet is probably for you if you're want to jailbreak your own appliances, or do infosec/blue teaming work.
i've been sitting on a document for a long time of software i'd consider critical to the internet (something all of you use, even if you don't know it) that could use another look.
yesterday, as i mentioned, i had chonk explore parts of a messaging app that is widely used, and it found a zero-click medium/high zero-day in under 30 minutes, and *less than 10 dollars in api spend*.
these vulnerabilities are now reported (can't reveal until patched).
when i've used it, i've had very few outright refusals. the intent behind chonky is to good at cyber, in a defensive context. however, in order to do that, you also need to be good at cyber in an offensive context.
but for those looking to customize their TVs that would otherwise be locked down, this thing will tear them apart for you, and it will gladly look at prior arts (several exploits for nearly all TVs that expose a surface is out there), same with pretty much any other device that lives on your network.
the things it will refuse to do is outright write exploit chains, however with how succinct the reports this thing writes are, writing a poc to confirm a vulnerability is completely doable.
so far i'm very impressed. it seems pretty frontier when it comes to cyber and reasoning (practically no one has anthropic cyber access and daybreak is only gpt-5.6), it can also be as bad as any other model if you don't put effort into your prompts.
it is addicted to tool calls, and very brief on prose. but the reasoning is incredible to watch, if you point it in the right direction, and you have a background in infosec. the way it operates is something i've never seen before (thousands of tool calls, ingest of data, analysis, before any prose, depending on codebase complexity), it feels eerily like an human auditor would behave lol.
some config tips: it will definitely work in a codex harness, but i'd recommend trying the vibe cli harness with le chonk. the more tools it has access to (if they're right for the job), the better of a job it'll do in my experience. the amount it loves tool calls really cannot be understated.
if an inference provider through a router is trying to serve you another model, it will be instantly evident that it's not le chonk, just by how it operates. it's hard to convey, but it's not like any other LLM i've ever tried.
people in the subscriber groupchat have also reported finding their first vulnerabilities with le chonk so it seems i'm not just an anomaly.
le chonk scores extremely high on reasoning, but i've yet to try to use it for anything except infosec work, i don't know if it's a great day-to-day model, but i'll have it go head to head with GLM-5.3 at some point in a general swe workflow.
i did a few tweets on it yesterday out of sheer euphoria, not sponsored, mistral has given me credits now to continue work. this hopefully ties me over until i can get my hands on enough sparks to run it locally.
go give this model a try, let me know how it works for you.
with the daybreak program now collecting data (why...?), and this being OPEN WEIGHTS the only thing i can think to end this on is:
we're so fucking back.
DCWebGuy retweeted
几年前，老翻墙家都知道一个人，他的博客叫编程随想，本名阮晓寰，1977年生人，自建一个博客网站，分享网络安全知识、翻墙方法以及进行各种政治评论，因早年从事网络安全工作，并在2008年北京奥运会期间负责信息安全工程师，就这样一个技术达人，曾长期隐匿中国境内，长期匿名发布大量政治社评，让国内当局恨的牙痒痒，花费大量精力人力物力反复侦查寻找他本人身份。
其中，很火爆的文章有《为啥朝廷抓不到俺——十年反党活动的安全经验汇总》，还曾在GitHub上分享太子党关系网络，将红色家族各大人物关系用关系图谱的形式罗列起来，一度被中国网络安全协会多次致信GitHub，要求删除，但GitHub并没有理会，只是阻止了大陆网民访问。
2021年5月9日，编程随想发布最后一篇博客后，从此再未更新，后被证实2021年5月10号在上海被抓。2023年7月，他被一审以颠覆国家政权罪判刑七年，并剥夺政治权利两年，其妻子一度寻求律师，但最后被关押注销推特账号。
不过至今为止，编程随想的博客没有被注销，仍然在网络上留存，也就是说，直到判刑后，编程随想也没有把博客密码公布出来，不然早就把内容删干净了。
DCWebGuy retweeted
This is completely idiotic.
About 5 minutes after the watermark detector ships, the detection algorithm is going to leak. About 10 minutes after that, somebody will put a de-watermarker on github.
Smooth move, Anthropic. Not just trying to screw your customers over yet again, but doing it in a way that's guaranteed to fail fast, accomplishing nothing.
Claude gonna start snitching on Tuesday.
Anthropic just emailed customers. Starting Nov 3, text carries an invisible watermark.
You can't see it. It survives copy and paste, and it can survive some editing.
Only regulators, journalists, fact-checkers and researchers can check for it right now.
It doesn't say who you are. It says Claude touched the words. Even a quick proofread counts.
If your brand voice runs on Claude, write like someone might check. Because now someone can.
DCWebGuy retweeted
> be me
> old coworker contacts me
> "my current employer wants to speak to you"
> Ok?
> It's big company
> everyone always talking about them
> everyone's heard of them
> all over news constantly now
> everyone uses them
> "Hello, we're looking for someone who knows a little bit about goop"
> wtf I know a little bit about goop
> idk tho I really like my current job
> salary offer is nearly double my current salary
> preposterous amount of money
> wtf
> also offers stonks and stuff
> total compensation would be near $800,000 a year
> wtf
> tell me need me to relocate to San Francisco
> tell me no work from home
> tell me possibly no more vx-underground
Nah, can't do that dawg. I'm not moving to San Francisco and I can't give up vx-underground. Thank you for the absolutely outrageous offer though
This is a slick phish.
Just got a phishing email that Gmail authenticated as Google. DKIM/DMARC passed. I can see a lot of people falling for this one, since it plays to the idea that your account has already been compromised.
Scammer puts the scam in an app-password name, triggers a real Google alert, then forwards the alert email to your email address.
How this attack works, and why it’s convincing:
1. The trick: The attacker puts the threatening text and shortened URL into an app password’s customizable name on another account. Google incorporates that text into a real security notification and signs the email.
2. The delivery: That notification is forwarded through another mailbox to the victim. In this message, Gmail still recorded passing Google DKIM and DMARC authentication.
3. What makes it convincing: The Google sender, signature, branding, and “Check activity” button are legitimate. The suspected attacker-supplied text appears inside the same trusted-looking template, using a deadline to push you toward its separate link.
4. The giveaway: Both the notification and its genuine Google button refer to someone else’s account. The “permanent access after 24 hours” claim is false; app passwords can be revoked.
Be careful out there folks!
DCWebGuy retweeted
Newbies to the Polish political drama need to understand how language is being misused (by both sides) to further their respective crusades.
To the uninitiated, “restoring the rule of law” probably sounds like a noble objective. The framing makes it sound as though the previous government (despite being called the Law and Justice party) ruled without any regard for law and justice. Perhaps, even, that it abused its power by oppressing dissidents or confiscating assets. Who knows.
Tusk’s accusation of “lawlessness” is even more sensational and misleading. In ordinary language, the term conjures up images of a mafia state, or worse, a failed state where it’s every man for himself.
But no reasonable person assessing the period during which PiS was in power could honestly suggest that this was the case. Poland was not lawless in any ordinary understanding of the word.
The sleight of hand lies in taking a specific legal and constitutional dispute and repackaging it as a sweeping indictment of an entire government. The accusation derives its legitimacy from genuine controversies over the rule of law, but its political force comes from the much broader and more sinister meaning that the phrase carries in everyday language.
At the heart of the dispute is the question of whether Polish constitutional law can take precedence over EU law in areas where the EU maintains that its law has primacy, alongside controversies surrounding judicial independence. These are major legal questions, but they are a far cry from the impression of generalised lawlessness that Tusk’s rhetoric invites.
“Restoring the rule of law” is an exceptionally effective piece of political messaging. It allows Tusk to present his government as the force restoring legality, while casting his opponents as people who governed outside the law.
Yet, powerful states such as the US and China have long asserted their sovereignty against international legal constraints they consider unacceptable. The EU may be a distinct legal order whose treaties Poland voluntarily accepted, but the broader question of where national sovereignty ends and supranational authority begins is hardly unique to Poland.
Of course, the ultimate source of the consternation lies in PiS’ judicial reforms during its time in power. Yes, breaking established procedures to pack supposedly independent courts with your own appointees is not a good look. But it becomes a little more understandable when you consider the historical context that Western media so often leave out when reporting on the story.
Poland never underwent a comprehensive “lustration” of its judiciary after the fall of communism. The transition involved compromises that allowed considerable institutional continuity, with elements of the old judicial establishment, its professional networks and institutional culture surviving into the new democratic order.
This is crucial because PiS did not regard itself as politicising an otherwise independent judiciary. Its contention was precisely the opposite: that the judiciary was already politicised, having never been sufficiently disentangled from the structures and networks inherited from the communist era.
From that perspective, its reforms were intended to dismantle an entrenched establishment rather than create one. The opposition and the EU regarded those same interventions as an assault on judicial independence.
Tusk and his allies have often challenged the relevance of the judiciary’s communist-era legacy by pointing out that most judges from that period are no longer serving. But this misses the substance of the argument. The concern is not necessarily about the survival of individual communist-era judges, but about the professional networks, institutional culture and entrenched structures that may have outlived them. The continuum.
DCWebGuy retweeted
Stanford University student Elsa Johnson became a target of the Chinese Communist Party in 2024.
Elsa attended a private school as a child with a heavy focus on foreign languages and became fluent in Mandarin Chinese while still in elementary school. Years later after she was accepted to Stanford, she studied international relations and researched Chinese industry and military tactics while working at the Hoover Institution on campus.
She soon came to the attention of members of the Chinese Communist Party, which has a heavy presence at Stanford and throughout Southern California. There are currently more than 1,000 Chinese students attending Stanford each year, and the university has received more than $64,000,000 in private donations from Chinese individuals and organizations since 2010.
In June 2024, a man claiming to be a fellow Stanford student named Charles Chen contacted her online. She was not initially suspicious as they had many mutual associates, and his photos and posts appeared to be centered on campus. But his questions and requests quickly put her on edge as he invited her on a paid trip to China. And he seemingly knew details about her that she had never shared with him.
When she tried to disengage with him, she began receiving threatening phone calls by Chinese speakers. Elsa contacted Stanford administrators and the FBI, who told her Charles was likely affiliated with the Ministry of State Security, had been posing as a Stanford student for years, and had targeted at least ten other female students since 2020 in a similar manner. They also told her she was under physical surveillance on campus by the Chinese Communist Party.
Elsa wrote articles in the Stanford Review and The Free Press about Chinese influence on campus, and in March 2026 testified about espionage threats on college campuses before the House Committee on Education and Workforce.
For episode 270 of the Spycraft 101 podcast I spoke with Elsa about being targeted by a foreign government right in the middle of a US college campus. The episode is available now.
#stanford #college #student #china #hooverinstitute
open.spotify.com/episode/6KO…
DCWebGuy retweeted
Polish President Nawrocki CONFRONTS Tusk-backed, SELF-DECLARED ‘HEAD OF COURT’ Korwin-Piotrowska inside CONSTITUTIONAL TRIBUNAL:
'YOU ARE NOT JUDGES OF THE CONSTITUTIONAL COURT!'
DCWebGuy retweeted
In 2019, a U.S. Coast Guardsman made a daring leap onto a moving drug-smuggling vessel in the Pacific Ocean during a high-stakes counternarcotics operation.
After spotting a suspicious semi-submersible attempting to escape, Coast Guard personnel launched a pursuit. In an incredible display of courage, one Guardsman jumped from the pursuing boat onto the vessel’s slippery surface while it was still moving through open water.
Standing atop the partially submerged craft, he repeatedly shouted “Alto su barco,” meaning “Stop your boat,” while pounding on the hatch. For several tense moments, those inside refused to respond. Eventually, the hatch opened, allowing Coast Guard personnel to seize control and detain the occupants.
The dramatic interception was part of a broader effort to disrupt drug trafficking routes across the eastern Pacific. In July 2019, the Coast Guard announced that multiple operations had resulted in the seizure of approximately 39,000 pounds of cocaine.
The remarkable footage highlights the enormous risks Coast Guard personnel face during maritime interdictions, where a single misstep can have devastating consequences. It’s an unforgettable example of the courage and quick decision-making required to stop smugglers at sea.
DCWebGuy retweeted
The DSA and their far-left allies are laying out their real playbook, and @nataliegwinters brought us something today that every American needs to see.
She uncovered video of the far-left group Indivisible openly admitting that their main goal isn't just removing Donald Trump from office. After the midterms, they want to target EVERY mid-level staffer, every donor, and every corporation that ever supported a conservative to make sure they NEVER dare “step out of line” again:
“It's the most interesting permutation of 'democracy' that I've ever heard, where you throw all your enemies in prison. But I think the important thing here to remember with Indivisible... this is what they're saying publicly. That's not a secret tape. So, you know it's much worse behind the scenes.”
DCWebGuy retweeted
Nearly two years ago I settled accounts with Donald Tusk unsparingly. With his actions today he has confirmed every warning I issued:
“Mr Tusk, politicians like you are the greatest threat to European nations. While you were in opposition you attacked your own country’s sovereignty with the help of the EU.
Now that you are back in power you are destroying the rule of law in Poland. Opposition figures are being hunted down and politically inconvenient court rulings are being overturned. Your media coup was illegal, and now you are threatening even more censorship on the internet. This increasingly resembles a regime.
In a single year you have committed more breaches of the rule of law than PiS dared to attempt in eight years. The EU lets you get away with all of it, because you were always Brussels’ most obedient servant.
And now you threaten to extend your work of destruction to the whole of Europe – mass migration, censorship, geopolitical escalation, wokeness, the Green Deal.
You are one of the chief architects of all of this, even if you now pretend to know nothing about it.
You are a Polish Angela Merkel. You are a Polish Ursula von der Leyen. And the worst part is that you are proud of it. That is bad for your country, Poland, and it is bad for our continent, Europe.”
I have definitely been noticing. And now, Poland.
In just these past two weeks we have seen:
1. Widespread civil unrest and riots in France.
2. Widespread civil unrest and riots in Albania.
3. Widespread civil unrest and riots in Italy.
4. Widespread civil unrest and riots in Spain.
5. Widespread civil unrest and riots in Portugal.
6. Widespread civil unrest and riots in Belgium.
7. Widespread civil unrest and riots in Serbia.
8. Widespread civil unrest and riots in Georgia.
9. Widespread civil unrest and an apparent judicial coup in Poland.
10. Widespread civil unrest and riots in Czechia (including an attempted takeover of the Parliament building).
11. Widespread student protests in Greece.
12. Targeted student protests in Indonesia.
13. Localized violent protests in India.
14. An apparently fraudulent election in Brazil where the presumed presidential election winner was forced to flee the country under threat of arrest by his opponent.
15. The uncovering of a Color Revolution plot in the USA led by embittered former USAID employees and ex-military members.
That’s a lot to be happening all at once, don’t you think?
And the USA is having midterm elections next week.
You know, if I was a conspiracy-minded type I might be connecting some dots here. 🧐