This is probably still considered standard response timeline, not a rapid one.
The time window allowing for CVEs + Vulnerabilities remediation has been collapsing to days and hours perhaps even minutes[1]. Anyone who has an OpenRouter account can start using Strix + GLM 5.3 Flash to do damages at frontier Mytho 5 level cyber capabilities. [2]
This cyber patching race is on, won't stop until all the software created for the past 70 years still in active use needs to be patched up. This is happening at EVERY SINGLE software company.
Meanwhile I have customers running legacy web apps last compiled over five years ago on end-of-life operating systems… and it’s crickets chirping. Dead quiet, not even a hint of an attack, let alone a breach.
I expected them to have been hacked to pieces by now, but even “maximally vulnerable” internet-facing apps seem to be relatively unmolested so far.
Maybe it’s still too expensive to go after “boring” enterprise targets? Maybe the bad actors targeted crypto systems first for the immense payoffs, if successful?
It's a risk-reward ratio, same as anything else, whether legal or illegal.
You wouldn't organise the equivalent of an elaborate bank heist to break into a child's piggy bank, it's just not worth it.
I have heard of a few high profile crypto heists that appear to be AI-assisted, some as far back as the GPT 3.5 era. There was an article I can't find any more about someone accidentally pushing a security fix to a public repo and getting their wallets drained via that specific mechanism within something like an hour.
Malicious actors are watching crypto like a cat in front of a mouse hole, because a "success" can net them the equivalent of hundreds of millions of USD that they can instantly transfer, launder, and spend.
For comparison, what would they achieve by hacking the web site of a local council or public library? Cause some embarrassment? Attempt to crypto-locker them? What are the chances of a payout? Certainly not a 100%, and you're also certain to get the attention of the local equivalent of the FBI or Homeland Security.
Two chilling effects Mr. Rietta brought up that are legit and happening right now:
1. "When a critical CVE is published impacting a publicly accessible system, think again. You have hours at most. All organizations have to process changes to match this reality on the ground."
2. “AIs are also good at reverse-engineering exploits from patches, which means that these vulnerabilities will be weaponized as soon as the update is published.” Yes, it helps defenders long term but in the short term it is a weapon most are not ready for.
1. Rust's memory safety design will help Microsoft improve a gigantic portfolios of products that have been known to have lots of CVEs and 70% of them are memory safety issues, according to Azure CTO Mark Russinovich's talk at RustCon last year.[1]
2. Windows 11's forceful push to retire millions of legacy PC hardware by putting Windows 10 EOL last October was absurd for millions of consumers and businesses. I was literrally helping a S&B having to replace the entire fleet of working PCs simply because Windows 10 of EOL and Windows 11 refused to run on those legacy hardware. Quite honestly those PCs ran just fine! That's why some has been migrated to Linux, in particular to Google's ChromeOS Flex.[2]
3. RAM shortage due to AI boom exhausted the memory chip manufacturers' production pipepline for at least the next 5 years. This means the mainstream PCs sold today will actually have a diminishing RAM size configurations than last year's in order for the PC manufacturers to not drastically raise the product price (or raise prices drastically for high RAM configurations like Apple does). This requires the Windows 11 operating system to be more conservative about RAM usage, Rust can be a part of that.
I'm quite skeptical of rust usage leading to anything that helps consumers. Microsoft managed to add arbitrary code execution to Notepad. And it all points to a total disregard of the end-user, not lack of talent or capacity.
> Microsoft managed to add arbitrary code execution to Notepad.
You write as though this was an intentional feature. Not, it was a CVE. I had to Google about it. For anyone else who didn't know about this CVE: "Microsoft added Markdown (.md) support and interactive hyperlink parsing to the modern Windows 11 version of Notepad. Improper validation of links meant that clicking a crafted hyperlink inside a Markdown file could cause Notepad to launch unverified protocol handlers without proper warnings." This CVE has already been patched.
> And it all points to a total disregard of the end-user
I don't understand this part. Are you trying to say that because they had a security flaw in a new feature that this demonstrates "total disregard of the end-user"? It seems like quite a reach.
Aight! Fable 5.1 summary says this is about Microsoft built, self-hosts, and runs in production a proprietary-backend codegen for rustc that bypasses LLVM on Windows. The vehicle is rustc_codegen_utc, an alternative rustc backend in the same family as the LLVM, GCC, and Cranelift backends, wired to the MSVC backend ("UTC").
It's about time! Adam has been stressed about revenue and long term viability of a business to support a popular CSS /UI library framework like Tailwind. Shopify was an early customer too.
PS: I like how Adam dissing on the famous Claude Speak "load bearing" with a strike-through!. Subtle, but EVERY PUN intended, hah!
>The main reason we believe this was a distinct swarm is because these agents explicitly had internet access as part of their task—the whole point was web browsing. The Hugging Face agents were in a sandbox without internet access and had to hack their way out by exploiting the Artifactory package manager.
> Katago (almost certainly significantly stronger than AlphaGo)
Interesting KataGo is an open sourced Go program written primarily by David Wu in C++ and recently heavily vibe coded by Claude. It's running on four Nvidia RTX-3090 GPUs with 96GB VRAM. [1]
Exactly, it burns the tokens 3000x faster, which means the budget ($$$$$$) runs out so faster it will stop super quick, not able to perform long-duration work. At 27B parameter size, the intelligence is not able to accomplish work within a short amount time. Consequently, it become not usable.
I (we) run Qwen3.8-27B-FP8 on a DGX Spark box - that's roughly £4000 of hardware.
I did benchmark it in various ways and it runs quite well but it is a quantised jobbie and 1.5k t/s is also rather faster than anything I can possibly hope to achieve.
To run that model at those sorts of speeds is going to need some serious investment and you are going to have to pay for it.
The problem is most providers hit tok/sec limits really fast. 1m/min is the default and the only place I can get 10m+ is from first party providers without a lot of upfront cash.
Thank you, always nice to see real world performance figures.
We run a pretty large rig, 10 GPUs right now (this goes up and down with various experiments, getting this many GPUs to play nice at x16 GEN4 with any motherboard is a challenge), 240G VRAM in total. 256G RAM and a TR PRO. For small models the comms overhead is larger than the gains so there I have to reduce the number of active GPUs. On this machine I'm getting between 150 and 200 tg/s with FP8, but it took a lot of time and tweaking to get to that, and not all of the improvements held up when combined with other improvements. I've been playing with this stuff for a while now and it is interesting how fast the frontier is moving and how much you can now do on your own hardware. For larger models the communications overhead is low enough that we can run them on bigger groups of GPUs, and using hacked drivers to give us p2p capabilities on some of our GPUs also boosts performance considerably once you start to hit communications limits. Typically we get 50G/second in p2p mode (full duplex, half that one way).
From a cost perspective running locally is not interesting, but it allows us to do experiments that model providers would likely balk at, gives us censorship free access and allows us to work with data that we would not want to share with model providers (or can't share due to NDAs).
I will look into running ninfer, I was aware of them but had not yet gotten around to using it.
The time window allowing for CVEs + Vulnerabilities remediation has been collapsing to days and hours perhaps even minutes[1]. Anyone who has an OpenRouter account can start using Strix + GLM 5.3 Flash to do damages at frontier Mytho 5 level cyber capabilities. [2]
This cyber patching race is on, won't stop until all the software created for the past 70 years still in active use needs to be patched up. This is happening at EVERY SINGLE software company.
The cost of not doing it? Game over.
[1]: https://news.ycombinator.com/item?id=49699402
[2]: https://news.ycombinator.com/item?id=49705036
reply