
#1 HackerOne. Stealth (Decent AI Safety). Prev: PrivateAI @ Perceptio (acq Apple), Scientist/Lecturer @ MIT+Harvard. OG GPU AI. Music Producer. Engineer. Angel.
San Francisco, CA
Joined October 2008
- Tweets3.4K
- Following1.2K
- Followers3.3K
- Likes5.7K
Nicolas Pinto retweeted
New work on Training Foundation Models with a Single Algorithm:
Paper: arxiv.org/abs/2610.40564
Code, Models: yudasong.github.io/unified-t…
This work introduces Unified Training, a framework that unifies pretraining, midtraining, supervised fine-tuning and RL under a single maximum-likelihood objective. Building on MaxRL, it enables static data and RL-generated data to be trained together within the same system.
Empirically, Unified Training improves accuracy and compute efficiency, generalizes better to harder reasoning problems, and reduces forgetting.
Interestingly, reusing data across training stages can improve performance even when conventional staged training fails. It also produces models that adapt more effectively to new tasks, leading to stronger continual learning.
See an excellent thread by @yus167.
Nicolas Pinto retweeted
What happens when we run that same Left Shoulder MRI through Gemini 4 Argon with 6 million tokens of context?
26 interactive 3D callouts across all 8 MRI sequences, mapping both the tears and every intact structure in the joint:
braid.health/shoulder-argon
Nicolas Pinto retweeted
The agentic moment we saw in coding just happened in radiology.
Instead of scanning a file system, an agent can now scan the body in 3D:
1. look (up to 100 16-bit slices/batch)
2. annotate, analyze & verify across priors
braid.health/www/page/agenti…
Nicolas Pinto retweeted
The sustained info war assault on open models is an agenda driven, self sabotage for our society.
The PHP vulnerabilities were found by Sol 5.6 as part of a defensive audit, for example, not abliterated models.
Putting our head in the sand and pretending vulnerabilities do not exist is idiotic. Better we find all these old, human written mistakes and fix them with AI. If you have a pair of magic glasses that show you what buildings will fall down the answer is to fix the buildings, not smash the glasses.
When HuggingFace was under attack and when OpenCode was under attack they needed open models to defend them because closed models refused.
Eventually OpenCode, because they're a prominent project, were granted access to OpenAI Daybreak Blue. Many individual researchers get denied with obscure errors and no explanation. To be clear, DayBreak is a fantastic project, and OpenAI is doing their best to be responsible here, but not everyone gets access and everyone has a right to defend themselves.
Nobody should have to beg for permission to defend themselves from cyber assault. When you're under attack, waiting to see if you get granted access to defend yourself via a black box KYC process is how we end up helpless, watching as our shop burns while raging looters storm it and destroy our life's work.
AI can be used for attack and defense and many of the recent attacks used both open and closed models, by the lab's own admissions.
Open models are often the only thing standing between us and the new reality of cyber assault.
If we ban them or restrict them in the US, then US companies will just be defenseless against global cyber assault actors who are not going to respect those bans.
I strongly believe a part of why so many critical vulnerabilities are happening all over the proliferation of "abliterated" models, or models with safeguards removed.
You can access an abliterated GLM 5.3, a near frontier AI model, on @abliteration_ai today. And it's a world class penetration tester for like $10.
Nicolas Pinto retweeted
wait, PHP was actually scanned by Anthropic’s Claude Mythos earlier this year. they also had access to OpenAI’s Daybreak Red for validating exploits.
the PHP Foundation revealed this JUST yesterday.
keeping frontier cyber models in the hands of a selected few doesn’t seem to be working well for the internet.
thephp.foundation/blog/2026/…
Do you know who illustrated the comic on calif.io/php2shell?
Her name is Stephanie Cortes. And her husband is the hacker who discovered php2shell: @lcfr_hax.
This artist-hacker couple has the best story, stay tuned!
Nicolas Pinto retweeted
‼️ BREAKING: Security firm Calif unveiled an untethered iPhone 18 Pro jailbreak on stage in Paris.
Its Hexacon demo shows the phone on iOS 27.0.1, Apple's latest, giving up a root shell within 2 minutes of boot.
Nicolas Pinto retweeted
New work on Decentralized Compounding Inference:
Paper: arxiv.org/abs/2610.04862
This work introduces an asynchronous multi-agent system where agents independently explore, experiment, verify, and refine solutions while collaborating through structured persistent memory.
Agents build on previous work in a shared, branchable Git repository, where atomic commits preserve intermediate results and semantic dependencies track how contributions build on each other.
See an excellent thread by @veds_12.
Nicolas Pinto retweeted
Looped transformers with tied weights might make pretty nice local models and assistants
Nicolas Pinto retweeted
'How biological synapses self-assemble gradient learning"
from Tommy's (Poggio) team @mcgovernmit
@qianli_liao Ziyn @LiuZiyin10 , @yule_gan, ..
@PNASNews
pnas.org/doi/10.1073/pnas.26…
Nicolas Pinto retweeted
Even with the instability and difficult situation in my country, I still managed to wrap up Q1 2026 on the HackerOne global bug bounty leaderboard as:
Top 6 – Highest Reputation
Top 1 – Other Assets
Top 2 – Broken Access Control
#bugbounty
Nicolas Pinto retweeted
thanks to AI assisted math, bought the smallest table that can fit my home cluster of 11 mac minis
using AI to do more AI
🤖 Made with AI
The optimality of the packing for 11 squares has been formalized in lean thanks to Astra and Claude! Huge thanks to @ojoshe, @kleddamag, @wand_125, @guzhou0806, and @ctjlewis for aiding in the process.
Image credit: jlevy.github.io/squares/case…
1/n
Nicolas Pinto retweeted
Just got fired from Apple. I was the guy who designed the AirPods to shoot out of the case at high speeds whenever you drop it.
Nicolas Pinto retweeted
from Anthropic’s open source scanner report:
> latest Claude models found +29,000 candid vulnerabilities
> Anthropic only had time to review 6,000 of them
“we remain bottlenecked on our human capacity” 💀
Replying to @AnthropicAI
To secure open-source software, we’re launching OSS Scanner.
We’ll use our frontier models to periodically scan opted-in open-source projects for vulnerabilities, at no cost. Our reports will provide a proof-of-concept, explanation, and suggested fix.
anthropic.com/research/launc…
Nicolas Pinto retweeted
A new Stanford paper just proved that decentralized multi-agent systems can beat Claude Code and Codex on complex coding tasks, running up to 2.49× faster!
DeLM tackles a key bottleneck in multi-agent systems: time wasted repeating work and waiting on other agents.
DeLM replaces the central coordinating agent with a shared context and task queue. Agents pick up tasks independently, share discoveries as they happen, and build on each other’s progress. When one agent finds a solution or hits a dead end, the others can use that information immediately.
DeLM beats state-of-the-art in both speed and accuracy on long-horizon tasks from Terminal-Bench 4.0, DeepSWE v1.1, and ProgramBench:
- Up to 2.49× faster execution than the vanilla Claude Code and Codex baselines
- Up to +19.2 percentage points in accuracy over the vanilla Claude Code and Codex baselines
- Up to +19.9 points in ProgramBench test pass rate within the same 120-minute budget
Built on Codex and Claude Code. Code and 720 trajectories are available so you can explore how the agents collaborate! An open-source plugin lets you try DeLM directly in Codex and Claude Code.
Nicolas Pinto retweeted
I find it odd watching armchair critics rush to nitpick @MistralAI’s plans or obsess over whether they’re #1 on every leaderboard.
Having a team with this level of conviction building frontier models and AI infrastructure in France—and punching so far above their weight relative to hyperscaler resources—is incredible.
Building in the arena is hard. Anybody who actually tries knows. We should be rooting for them, and I have huge respect for what they’re building in France 🇫🇷🇫🇷🇫🇷—keep it up!








































