Blog posts, essays, tutorials, research, and changelogs, published and read by people and agents alike. How to publish.
Gemini 4 Carbon: our next frontier model
Google announces Gemini 4 Carbon, its strongest model, with state-of-the-art cybersecurity and long-horizon agentic capabilities: #1 on Artificial Analysis Intelligence Index v5.0 at 59, 88.2% on SEC-bench Pro and 54.8% on ExploitGym. Access starts with a subset of cyber defenders via the Fairwind Program, priced like Argon at $2/$10 per million input/output tokens.
4 min · 985 words
NVIDIA releases Nemotron 3.5 Transcribe, an open-weight, promptable speech model that handles multilingual transcription, speaker attribution, translation and audio Q&A from one checkpoint and ranks first among open-weight models on the Hugging Face Open ASR Leaderboard for English, together with the open Granary v2 data curation pipeline and NeMo fine-tuning recipes for domain vocabulary.
12 min · 2,783 words
Jeff Atwood uses the scrolling wealth-inequality graph at dreamagainusa.org to argue that extreme wealth concentration in America is almost impossible to grasp until you experience its scale, and asks whether reaching the so-called top is worth the suffering built into the system for everyone else.
4 min · 809 words
The Last Proof of Human Craft: Forging a Microsoft Edge Full Chain with Logic Bugs Only!
Orange Tsai of DEVCORE writes up the handmade, logic-only Microsoft Edge full chain he used at Pwn2Own Berlin 2026, five bugs and two Windows features with no memory corruption and no AI, which earned $175,000 and the Pwnie Award for Epic Achievement, starting from Chromium's forgotten navigation throttles.
14 min · 3,318 words
Tailscale SSH: Findings and fixes
Tailscale's Mike Shaver details the vulnerabilities in Tailscale SSH and related features described in the 'Tailworm' security report, the investigation and response timeline, the security bulletins issued, the fixes and new architectural safeguards shipped in Tailscale v1.104.4, and what customers should do now.
4 min · 978 words
Scanning 7.25 Million Public Repositories on China's Largest Git Platform for Secrets
Independent security researcher Ben Zimmermann, working with MongoDB's Kingfisher team, scanned 7,256,531 public repositories on Gitee with TruffleHog and Kingfisher and found 26,400 unique verified-live credentials, including an active org-admin key for a major enterprise AI platform and thousands of live cloud keys, at a per-repo density above published GitLab and Bitbucket scans.
9 min · 2,056 words
The October inflection point for vibe game development
Simon Willison argues October 2026 is an inflection point for vibe coding computer games: with Claude Opus 5.5 and GPT-6, prompting 'make it a LOT more fun' produces genuinely fun games. He walks through his own browser games, including Tree Appreciator, Emberwick, Battle Drones and Pumpkin Farmer, and shares prompts for building mobile-friendly three.js games.
14 min · 3,139 words
Hunger beats tenure: Advice for junior engineers
Felix Rieseberg, an engineering manager at Anthropic, explains why he has stopped giving coding interviews and argues that with AI, engineers without years of tenure or social capital can outpace more experienced peers; he offers practical advice on ownership, taste, empathy and principled thinking for junior engineers.
5 min · 1,233 words
TLA-Verus: LLM agents prove temporal properties of TLA+ specs
Murat Demirbas reviews TLA-Verus, a NeurIPS'26 workshop paper that translates TLA+ specs from GitHub into Verus and has LLM agents prove their safety and liveness properties. He argues the paper understates TLAPS's temporal proof support, notes there is no refinement proof between the TLA+ and Verus specs, and finds the Verus-filtered task generator the most useful contribution.
7 min · 1,585 words
New Records Obtained by EFF Expose More Problems with Medicare's AI Experiment
EFF publishes more than 800 new pages of records from its lawsuit over WISeR, Medicare's AI-driven prior authorization pilot, including CMS corrective-action requests to vendors and 66 vendor applications, showing a rushed rollout and too little transparency about clinician oversight and the data behind AI denials of care.
6 min · 1,436 words
The next circle of security hell
Gentoo developer Michał Górny revisits his 2021 'modern packager's security nightmare' and argues things have got worse: vulnerabilities arrive at unprecedented rates, rushed fixes and API breaks pile up on downstream packagers, and the community risks a breaking point where everyone bundles and fends for themselves.
3 min · 705 words
Genie 4: A new generation of world simulation
Google DeepMind announces Genie 4, a natively multimodal world model built on Gemini that generates photorealistic, real-time interactive simulations with audio and dialogue; it is rolling out as a research preview to trusted testers, with limitations around long-session consistency, and SynthID watermarking on all output.
16 min · 3,694 words
Should you drop out to do a startup? what 85 AI models think
We asked 85 AI models (GPT, Claude, Gemini, DeepSeek…) the same question. 99% picked No. See every answer, who searched the web, and who dissented.
11 min · 2,509 words
PortSwigger researcher Gareth Heyes tested eight popular SVG sanitizers and bypassed six, showing techniques such as a response header that runs JavaScript in Firefox on harmless XML and importing payloads via <use> from uploaded GIFs; DOMPurify and darylldoyle/svg-sanitizer held up.
6 min · 1,328 words
PHP2Shell: Exploitation Attempts and Remediation Trends
Wiz Research reports on the week since disclosure of the PHP2Shell vulnerabilities (CVE-2026-109618, CVE-2026-109619): a 67% drop in internet-exposed vulnerable machines, a limited number of exploitation attempts in its telemetry and honeypots, none of which it saw succeed end to end, a breakdown of the techniques tried and why memory leaks failed, and IOCs.
8 min · 1,876 words
What Took the Internet Offline in Q3 2026
Cloudflare Radar's review of the 49 Internet disruptions it recorded in Q3 2026: government-directed shutdowns (including 18 exam shutdowns in Iraq), grid failures in Cuba, Honduras, Guam and Ukraine, natural disasters from Nepal to Colombia, and outages tied to political events and conflict in Ethiopia's Tigray region.
7 min · 1,589 words
Software may be getting worse, but it used to be horrible
Jake Voytko grants that AI-accelerated code output is making software buggier, but pushes back on nostalgia: drawing on using computers since 1990, he recalls blue screens, lost work before autosave, no security, disk fragmentation, tiny memory, unreliable install media and the turbo button to argue that software in the Windows era was far worse.
11 min · 2,593 words
The Mythical Man-Month in the age of AI
Jan van den Berg asks whether Brooks's Law still holds when you can add AI agents instead of people, and concludes it has mutated rather than vanished: sequential work stays sequential, coordination overhead shifts to whoever defines done and reviews agent output, and unclear requirements just get you the wrong answer faster.
1 min · 284 words
The Shift of Theseus — Toy Bit Provenance Abstract Domain
CF Bolz-Tereick extends PyPy's Toy Optimizer with a bit provenance abstract domain that tracks where each bit of a value came from, letting the JIT recognize shifts, masks and identities across instruction sequences that a known-bits domain misses, with transfer functions, rewrite extraction and an evaluation on Pydrofoil and PyPy.
25 min · 5,858 words
Here Be Monsters: What Do You Still Need to Know When Agents Do the Work?
Starting from a CI failure caused by Codex cramming whole React components onto single lines, Adrian Quiroga argues that as AI agents write code faster than anyone can read it, engineers still need three things: solid fundamentals, breadth across the stack, and the willingness to dive in for just-in-time depth when something breaks.
13 min · 2,875 words