Traveling down OneStoryRoad taking photos & exploring the stories that come with them..currently curious about AI. Multiple projects: GeoGroove, TMR, Mozai

Nomadic
Joined August 2012
mozai retweeted
If you are wondering whether your website is affected, we have packaged a Codex skill to help check. Point your Codex at this repo to guide you through it: github.com/openai/php2shell-…
OpenAI models helped researchers—operating as part of our Patch the Planet initiative—discover critical security flaws in PHP, an open-source programming language used to run an estimated 70% of websites. Over the past two months, we led a coalition of maintainers, researchers, and security providers to prepare fixes and protections ahead of disclosure. This duration was necessary because the fix was quite intricate and required a major change to the PHP engine. Every site using PHP can now safely upgrade their version to stay secure, in addition to applying mitigations from various security vendors. Due to the severity of these flaws and PHP’s widespread use, we consider this bug to be one of the most impactful vulnerabilities in recent memory. It also marks a new phase, where AI can find security bugs with internet-scale impact. This is an example of the Defender’s Window in action: to our knowledge, frontier AI was able to find this vulnerability ahead of attackers, giving defenders time to prepare. openai.com/index/coordinated…
Readers added context they thought people might want to know
‪OpenAI may claim a role in the coordinated response and patching process. But the initial discovery and exploit development, however, occurred several months earlier by an independent researcher.‬ ‪x.com/lcfr_hax/statu…‬
311
1,136
215
8,784
1,223,588
Waves of change are coming from every direction we need to build the guard rails and ships to navigate. We’re not yet ready, but @tfh_technology is advancing the game.
"We will want to know for many, many things: are we interacting with a human or an AI?" 🤖 Alex Blania, CEO of @tfh_technology, on the internet we're walking into and the new World ID tool for banks he just announced to help answer that question. #Money2020USA #SundayNightLive
40
Bullish on this future tech solving new and old problems of trust online
In 2024, an employee at engineering firm Arup transferred $25.6 million after joining a video call where every other participant was a deepfake. Since then, AI has advanced significantly and is making impersonation increasingly convincing, causing challenges for financial institutions in particular. As autonomous agents begin handling more financial activity on behalf of people, establishing an added layer of trust and security behind a transaction or sensitive conversation is becoming an urgent need. Introducing @world_id for banking and finance, a suite of technologies that helps institutions establish trust through privacy-preserving cryptographic Proofs. World ID for Zoom lets meeting participants confirm they are the same Orb-verified human connected to their account, while World ID for agents allows AI agents to carry Proofs delegated by people. Bain Capital, OpenExchange, Outtake, Pantera Capital, and VanEck Funds are initial design partners, bringing World ID into some of finance's most consequential interactions. fortune.com/2026/10/18/zoom-…
3
95
RT @OpenAI: GPT-6 Pro in ChatGPT got an upgrade with faster responses and improved use of plugins and tools. And now, multiple agents can…
81
2
dots tip: ask your dot to proactively look for areas that will improve quality of your life/ work and check in with you every x hours works wonders
78
8
4
458
40,791
For the second time in Google Chrome’s history, Google awarded a $250,000 bounty for a full-chain exploit… to @XBOW. Here’s the full story: At an all-hands at the start of 2026 in Malta, I set the team a crazy challenge. A full-chain exploit of Chrome by the annual Black Hat cybersecurity conference in August. I believed there were few better tests of whether @XBOW could move beyond web applications to desktop software, servers and devices. Chrome is one of the most hardened pieces of software on the planet, used by more than half the world’s population. A full-chain exploit lets an attacker take total control of a machine, where they can read every email, password and bank login the user types. You don’t need to download anything or click a phishing link. Visiting the wrong site is enough. So @moyix, Andres Luksenberg, Baul Lee, and Willem Pinckaers took on the challenge along with a fifth teammate: OpenAI's GPT-5.6 Sol. They built a chain they thought would win, but Google told us they already knew one of the bugs. We were already in Las Vegas for Black Hat and DEF CON, and the team didn’t want to go home without the win. So Brendan and the agents built a new exploit in just 6 days. We submitted it to Google and waited. The news came through that we'd done what should’ve been impossible. A full-chain bounty of $250,000, the first awarded under Google’s 2026 rules. It took just 6 days and $40,000 of compute to construct an exploit that affects a billion users of Chrome on Windows. An intelligence-agency veteran told me his team used to spend 6 months on this kind of vulnerability. My takeaway: the cost of finding truly critical vulnerabilities is collapsing, for attackers and defenders alike. Restricting powerful models is not the answer; GPT-5.6 Sol is already public. But defenders have one advantage attackers never will: they can test their own code first. Assume your software is exploitable. Whoever is hunting your bugs has the same building blocks we did. This is cause for urgency but not panic. XBOW is now developing an autonomous product for testing compiled software (desktop applications, servers, embedded devices), and partnering with the world’s top organizations to design that product. If you’d like to be one of them, get in touch. P.S. Restart Chrome whenever the Update button appears!
87
263
97
2,615
815,951
Shouldn’t be this difficult but I wanted scheduled iMessage reviews, thoughtful reply drafts, and a notification from my personal Openai Dot assistant. Here’s the wiring that took: Local Luna Max checks Messages every 30 minutes → flags something needing attention → Astra High reviews the supplied message and context and drafts a reply → returns it to Luna → a cloud relay notifies moz → I review it → the original local thread sends only after approval. In my tests, the local thread had Messages access, while the cloud relay provided the working notification route. The test delivered the message, context, and draft successfully. Model names reflect requested settings; runtime identities weren’t exposed. It works, but a simple message-review workflow shouldn’t require this much wiring. Just wanted to have my Dot Moz have more context about my world.
4
282
28 days of shipping might have been a bit ambitious of @OpenAIDevs I’d prefer 28 days of debugging at this point.
4
406
Dusting off this tweet from April because this gap in shared understanding of LLM capability is *widening*. It's now less "two groups of people speaking past each other" and more a sharp funnel. - Napkin math somewhere around 6B people (~75% of the population) have barely come in contact with LLMs at all. - Around 1-2B (~20%) are casual and infrequent users of free-tier ChatGPT-like products. This group sees derpy chatbots and treats them a bit like a better Google search, a writing aid, or etc. Maybe an agent tries to book you a flight. I have non-tech friends who (reasonably, imo) say they have not much use for it at all. Even many professionals outside of math&code are in this tier. For example, execs and many other functions spend a lot of their time talking to other people, so while they understand what is happening intellectually, it is still second-hand and a bit abstract. - Now we get to professional use of frontier-grade LLMs in math&code. Somewhere around 20M people (0.2%) see first-hand that large, complex projects that used to take them weeks/months can now be completed by agents with a prompt. Building apps, copying apps, translating apps, decompiling apps from binaries... This has all happened very quickly and recently - less than 1 year ago, I was writing code manually by hand, typing memorized computer code commands into a code editor character by character, occasionally pressing Tab to autocomplete a little chunk of code. - And finally we get to the ~5,000 people (~0.00006%) with access to frontier-grade systems internally. The external world has seen the preview. It looks like swarms of thousands of agents collaborating over weeks on software mega projects: minting zero days, running cyber attacks and defenses at machine speeds, discovering new science, advancing the frontier of mathematics. Things that would have taken top professionals in the industry years of work. Meanwhile, human review and comprehension are starting to fall behind. For example, people are still involved in the "archeology" of the OpenAI-HF incident from many months ago. Mathematicians may be poring over the 722 manuscripts on frontier mathematics for a while. The funnel is driven by a combination of factors: 1. The impact scales with ambition, problem size, and horizon. A question with a paragraph answer barely stresses the system. You need a reservoir of big, difficult problems that you really care about. This aspect drives the consumer / professional dimension of the funnel. 2. The jaggedness of the system (which I have written about a lot separately). Capability peaks in domains that are digital, verifiable and economically valuable. This is because LLM capability emerges from reinforcement learning on verifiable rewards on a curated environment mixture driven by revenue potential. This aspect primarily drives the area (e.g. math&code) dimension of the funnel. 3. Access. Free-tier, paid-tier, internal. So this is the weirdness of the moment. The general public has mostly not interacted with these systems. When they have, it looks like a derpy chatbot. The majority of professionals still see only a modest uplift. And a small sliver of professionals are experiencing the vertigo of the curve going vertical. And it is all happening at the same time.
Judging by my tl there is a growing gap in understanding of AI capability. The first issue I think is around recency and tier of use. I think a lot of people tried the free tier of ChatGPT somewhere last year and allowed it to inform their views on AI a little too much. This is a group of reactions laughing at various quirks of the models, hallucinations, etc. Yes I also saw the viral videos of OpenAI's Advanced Voice mode fumbling simple queries like "should I drive or walk to the carwash". The thing is that these free and old/deprecated models don't reflect the capability in the latest round of state of the art agentic models of this year, especially OpenAI Codex and Claude Code. But that brings me to the second issue. Even if people paid $200/month to use the state of the art models, a lot of the capabilities are relatively "peaky" in highly technical areas. Typical queries around search, writing, advice, etc. are *not* the domain that has made the most noticeable and dramatic strides in capability. Partly, this is due to the technical details of reinforcement learning and its use of verifiable rewards. But partly, it's also because these use cases are not sufficiently prioritized by the companies in their hillclimbing because they don't lead to as much $$$ value. The goldmines are elsewhere, and the focus comes along. So that brings me to the second group of people, who *both* 1) pay for and use the state of the art frontier agentic models (OpenAI Codex / Claude Code) and 2) do so professionally in technical domains like programming, math and research. This group of people is subject to the highest amount of "AI Psychosis" because the recent improvements in these domains as of this year have been nothing short of staggering. When you hand a computer terminal to one of these models, you can now watch them melt programming problems that you'd normally expect to take days/weeks of work. It's this second group of people that assigns a much greater gravity to the capabilities, their slope, and various cyber-related repercussions. TLDR the people in these two groups are speaking past each other. It really is simultaneously the case that OpenAI's free and I think slightly orphaned (?) "Advanced Voice Mode" will fumble the dumbest questions in your Instagram's reels and *at the same time*, OpenAI's highest-tier and paid Codex model will go off for 1 hour to coherently restructure an entire code base, or find and exploit vulnerabilities in computer systems. This part really works and has made dramatic strides because 2 properties: 1) these domains offer explicit reward functions that are verifiable meaning they are easily amenable to reinforcement learning training (e.g. unit tests passed yes or no, in contrast to writing, which is much harder to explicitly judge), but also 2) they are a lot more valuable in b2b settings, meaning that the biggest fraction of the team is focused on improving them. So here we are.
2,120
5,841
2,236
43,580
6,694,358
The new AI wall I’m worried about: productivity going vertical while pay keeps inching up.
91
After yesterdays Dots drop its starting to come together. It now knows the big picture and was 10x more productive today on TMR MVP wrap up than previous methods! Soon… It’s getting easier everyday but still took some fine tuning.
1
81
Pocket-sized supercomputer. Telecommunications device. Instant access to nearly all human knowledge. Anything else 2026 has to offer?
565
446
56
6,896
124,070
Codex Dot tip: have your threads ping your dot when they reach a checkpoint or hit a blocker. Your dot can then read the thread, assess the result, and suggest what to do next. This worked in my setup and finding it useful. Try this prompt, just give it to Dot Set up checkpoint notifications for these existing threads: [thread names or links]. Whenever one reaches a checkpoint or gets blocked, have it notify you through a supported route. Read the actual thread, assess its progress, and tell me the best next step and any decision you need from me. Find and test a working route end to end before saying it’s enabled. If a direct authorization from me is needed, give me the exact text to paste. Keep existing work permissions unchanged, and use checkpoint notifications rather than repeated polling. Tell me if my setup doesn’t support this.”
2
3
286
Ever since Dots came out the biggest drawback was it couldn’t see the project or threads actively being work on that were existing. Today that all changes. What an unlock, now it can actually help me with what I’m working on. The Dots are free! Thx @thsottiaux
1
1
73
Welcome to region 5 dot! Thx @OpenAIDevs
51
Existing threads!!!!
Replying to @ChatGPT
Delegate work in Codex to your dot. Your dot can now start work in Codex and follow up on existing threads, drawing on your ChatGPT conversations, Codex threads, and automations. It’s also better at deciding when to keep a thread going or start fresh. Your dot can also review and edit Scheduled Tasks in ChatGPT Work, too. Ask what’s scheduled or update a recurring task as plans change.
1
141
what people often miss in the discussion around jobs is that most people hate their jobs, or they’re suicidal, or they’re starving to death — or all of the above. you live inside a vast bubble. let’s accelerate and help people.
53
34
5
641
19,643