if this PHP vulnerability allows remote code execution, doesn't that mean we can use the vulnerability to auto-patch all vulnerable servers?

P256 passkeys just got proved secure by Claude. There is now no reason to have a seed phrase ever.

Do you get power consumption data?

Assorted things I've been mulling over regarding agents in the economy: • Companies are in some sense the original superintelligence. It's often the case that they can use their amortized cognitive surplus to advance their interests against those of certain consumers: relative to the optimization capacity of companies, consumers can be inattentive, underinformed, irrational, etc. (Think, say, of some of the classic insurance upsells at the end of a booking process, which is typically priced substantially above what a regular policy would cost.) Herbert Simon introduced the idea of bounded rationality, and firms often end up benefiting from it. Thanks to personal agents, we will probably get somewhat more rational in how we engage with companies. • How exactly will outcomes change? Well, certain kinds of price discrimination will work less well (how do coupons work if every agent hunts fastidiously for them?), and certain kinds of customer cross-subsidy will change (today, people who forget to cancel subscriptions subsidize those who don't). Taken across the economy as a whole, I'm not sure what the incidence of all of this will be. • In corporate strategy, people have long debated the relative importance of distribution and product quality. Perhaps you've made something better, but does anyone know about it? Won't people just continue to buy the ACME Corp Mousetraps? Personal agents will, I think, act as a kind of structural subsidy for product quality. How would markets look different if individuals always spent at least 10 hours researching their purchases? On the margin, focusing on making a product better is, I think, going to become a more effective strategy for companies. This is good! • It true, a corollary is that information about product quality will become more important and impactful. Today, most people have very limited ability to aggregate and integrate such data, but agents will have insatiable thirst for such signals. (It's often said that data is becoming more valuable because it helps in the training of models. That's obviously true, but I think there's a secondary way in which it's more valuable simply as a complement to cheaper intelligence.) • A big question is whether agents will increase superstar effects (rational agents all settle on the same product) or increase dispersion (because everyone has slightly different tastes and preferences, which agents are good at eliciting, finally overcoming the artificial clustering we've been subjected to). • Many internet companies have monetized demand routing, which is in turn often predicated on short attention spans. "I'll click on the first thing I see." This has led to some amount of inefficiency, as companies try to propitiate capricious ranking algorithms and incur various placement fees. It's not all deadweight loss (willingness to pay is itself a kind of signal, which is valuable to buyers), but it's not great. How will the nature and value of this routing change in a world of personal agents? I don't know the answer, but I think that the effects might be pretty big. • Much of what I'm writing hinges on the assumption that personal agents will be on the consumer's side. I suspect that that will be the winning strategy, but whether it's true, and what it means to be true, involves a lot of other questions. Taken as a whole, the market is a massively parallelized, decentralized, and highly imperfect value attribution machine, and, taking stock of all of the effects, it seems to me that the quality point may well be the biggest: that agents will change the nature of the backpropagation such that the rewards for better products increase. Maybe this is too optimistic, but I suspect (and hope) that companies that make things that they're proud of will feel that the universe is a little more partisan in their favor.

@levelsio I want to sponsor nomads.com :) We build a neobank specifically for digital nomads: @joinpeanut Pay with local QR payments across the world, a card, get paid w/ accounts in Dollar, Euros, Pesos, Pounds etc PS: I'm based in Lisbon!

wrt justin's fable (fable because claude) I think it's useful to warn people to take best measures against unknown unknowns. RN that is basically whether AI is, or will soon (months) be able to crack crypto keys. Because getting better at math than we are. So "can just do things". (I know this is simplistic, but well, not like anyone knows...) Be that as it may. It is also useful to consider human behavior. Most crypto participants are not here for a long time. Certain whales and CEX treasuries are. But the vast majority are trading or doing grey market or remittances. And would just switch to another solution even centralized if regulations changed. In the "fallout" scenario, where certain smart people 'bunker down' in the interim and survive and everyone else gets rekt. It does not seem to me anyone returns to crypto. They will not be imo, impressed or relieved to see such caution on display as something to imitate, now wizened by the carnage ("well crypto can work if you just keep ahead of the curve..."). The bunker dwellers might squint and see, well, not much to return to ('I have my ETH.... but no buyers'). This is not to layer on the doom, though. In fact the opposite. The game here says to me, we will not reasonably expect most people in crypto to secure themselves. Many are correct that the mere suggestion to migrate under the threat of 'lose it all' will now inevitably lead to phishing and mistakes that could amount to same fallout. When speaking from a position of authority, you are not simply relaying information. You are setting up epochs and pushing dominoes. In this epoch, I think we must strive to solve crypto and cyber threats at the root layer: consensus. There will undoubtedly be clever maths and so on. But my gut is that we are playing with fire against a fire bender, in terms of AI. What can humans do? They can govern. The resolution against fallout scenarios is not going to be by the preppers, but by the enclaves. Don't trust people to protect themselves if you want to help them. The DAO hardfork might not have been the biggest blemish on Ethereum. But a dress rehearsal for something that will keep us on our toes: the unknown unknown of securing our property rights and networks against alien powers. Social recovery, at network level, can be communicated in a way right now to help people not panic and see around the corner (if the machines break all the things, it won't matter). I wish I could honestly give a smarter prescription here, but any "smart" thing will just get outfoxed. So it is more going to be about legitimacy. I do not think super intelligence automatically gives something legitimacy. If for example, I am chilling in front of a chessboard and someone uninvited sits down, and absolutely mops the floor with me, and then I replace my pieces and then say "chessmate" - who won that round? Me I would say. Anyways a lot of text to say, don't panic. Let's think about what else blockchains and crypto are. The bearer instrument aspect does require strict control. But these instruments are subject to networks. We can figure this out, while not needing to be the smartest in the room.

Today I call upon the blockchain industry to calmly begin planning for "bunker mode". My personal recommendation is to set in motion a controlled mass migration of assets to fresh addresses, i.e. addresses whose pubkeys remain hidden behind a hash. Holders, starting with large and sophisticated ones, should consider moving the bulk of their funds to addresses that have never signed a transaction. And when they do sign one, they should also move remaining funds to a new address (possibly generated from the same seed phrase). Don't rush. While I believe there is cause for action a rushed migration would do more harm than good. Don't panic either. Moving assets to protected addresses is a simple, preventative step which does not require new cryptography or new wallets. IMO it is now reasonable to brace for the possibility that ECDSA breaks before qday, in the worst case in months not years. By "break" I mean fast private key recovery (e.g. in one week) on available hardware (e.g. a large GPU cluster). Recent days have been humbling for human mathematical intuition. Long-held, unquestioned hypotheses have fallen. This includes the n log(n) bound for integer multiplication and the 3SUM conjecture. In hindsight, May's unexpected disproof of the Erdős unit distance conjecture was our warning shot. Yesterday's OpenAI drop made it clear that mathematical superintelligence is upon us. They say there are weeks where decades happen. We are about to live through weeks where centuries of mathematical progress happen. Could our magic 64-byte ECDSA signatures be too good to be true? Was it just security through obscurity all this time? Elliptic curves feel especially vulnerable to superintelligence. Curves carry rich structure, with room for fancy tricks like Schoof, Frobenius, pairings. (By contrast, hashes are designed to minimise algebraic structure.) Separately, as Ewin Tang can attest, an efficient quantum algorithm sometimes foreshadows an efficient classical one. We should be open to the possibility of a classical counterpart to Shor that breaks elliptic curves and RSA at once. Also noteworthy is the striking under-representation of cryptographic breakthroughs among the 722 mathematical results OpenAI published. I've witnessed first-hand the US government censoring academic quantum cryptanalysis results. Backroom interventionism is my base case. I urge large, sophisticated actors to lead by example. Project11's "risq list" (bitcoin-risq-list.projecteleven[.]com) is a great tracker of exposed BTC pubkeys. Binance, Bitbank, Robinhood, Bitfinex, and Tether have an opportunity to harden their cold storage. Next month I'll address institutions in London in a live Q&A (forum.ethereuminstitutional[.]org/london-2026). Again, please do not rush. Wallets holding under 50 BTC enjoy partial cover from "Satoshi's shield", i.e. his 20K exposed addresses that hold 50 BTC each. Load-bearing signers like oracles and L2 security councils should consider rotating ECDSA pubkeys with every signed message and/or multi-signing with a hash-based schemes like SPHINCS. Exiting bunker mode safely will require post-AI cryptography. My inclination is to go all-in on hash-based cryptography and avoid structured mathematical assumptions entirely, whether from curves, lattices, or isogenies. A single battle-tested hash (e.g. from the SHA or BLAKE families) yields plausible post-AI security. The Ethereum roadmap on strawmap[.]org fully embraces hash-based cryptography with end-to-end formal verification as a response to the quantum threat. Those timelines must now be revisited and accelerated in light of mathematical superintelligence. I'll be pushing for maximum defensive acceleration.

Live now: exploring how Peanut makes payments simple while staying self-custodial, from payment links to bank and local payment rails With @jchaskin22 and @uwwgo, co-founder of @joinpeanut xitter.cf/i/broadcasts/1dxYlaQqy…