Pinned post
Latest posts 5
The nursing problem, infra agents, and their slow crystallization
cryptologie.net/posts/the-nurs…
cryptologie.net/posts/the-nurs…
cryptologie.net The nursing problem, infra agents, and their slow crystallization As a small team, we always have a million things to focus on. In my mind, I sometimes think that we could expand our team in order to be able to brainstorm all these issues… is there a term for people who still live pre-AI and still don't understand?
What’s interesting is that trust in software so far has been based on human networks of trust.
Do I trust this guy? Do I trust this project? Do I trust this company? Do I trust this public key?
It’s all social based.
It’s not going away because we still use services all over the place, but more and more can be audited/verified thanks to agents now.
We already see people auditing all their dependencies (and we are doing it in zkao.io for our users now), or people even inlining their dependencies.
I guess there is a trade off that people are getting at: should I trust agents rewriting and auditing this code for me, or should I trust other humans to maintain this part of the code for me.
Hopefully we can help with that part soon as well.
zkao.io zkao - Deep Research, But for Finding Bugs AI agents that audit your cryptography code with the methodology our auditors use. Deep audits and continuous testing, built by zkSecurity. Do I trust this guy? Do I trust this project? Do I trust this company? Do I trust this public key?
It’s all social based.
It’s not going away because we still use services all over the place, but more and more can be audited/verified thanks to agents now.
We already see people auditing all their dependencies (and we are doing it in zkao.io for our users now), or people even inlining their dependencies.
I guess there is a trade off that people are getting at: should I trust agents rewriting and auditing this code for me, or should I trust other humans to maintain this part of the code for me.
Hopefully we can help with that part soon as well.
Frontier cyber agents are getting better at two things at once: finding vulnerabilities and staying inside the rules researchers set. The harder part is no longer just model capability; it’s where the system still fails once the model is good enough to act.
1) OpenAI says GPT-6 Cyber scores 48.5% on ExploitGym, up from 32.1% for GPT-5.6 Cyber, and 40.3% recall on a new offensive web vuln-discovery eval vs 32.0% for GPT-6 Astra. They also report 99.93% out-of-scope avoidance without the deployment prompt, and 100% with it. The release also claims it helped develop 948 Linux privilege-escalation exploits and identify 81 previously unknown high-severity Firefox vulns. These are vendor-reported numbers, so the takeaway is capability is rising, but the claims still need independent validation.
2) Signed but Not Safe shows what happens at the handoff layer in multi-agent systems. In a preregistered study, signed requirement manifests cut unsafe commits under attack from 69.4% to 9.0% with Qwen3-8B, and the verifier beat an LLM checker on the same trajectories. But signing only protects requirements in transit: when the orchestrator extracted the wrong requirement before signing, the signature faithfully preserved the mistake. The residual risk is extraction.
3) SPILLWAY makes a similar point for tool-using agents. It separates target admission from sanitization, using deterministic checks on typed tool returns plus a sanitizer that strips injected instructions before the model reads them. Across the tested backbones and suites, in-scope attack success went to zero. Its limitation is explicit: it covers identity targets, depends on declared tool roles, and still leaves some cases to a judge and delegation rules.
Taken together, these are not proofs of a universal shift, but they do show where the practical trust boundary is moving in evaluated agent systems: provenance, extraction, typed tool outputs, and deterministic enforcement around the loop.
openai.com/index/introduc…
arxiv.org/abs/2611.07483
arxiv.org/abs/2611.07222View quoted post on X
California Just Voted Against Taxing 200 People
youtube.com/watch?v=xZXryV…
youtube.com/watch?v=xZXryV…
www.youtube.com California Just Voted Against Taxing 200 People On November 3, 2026, California voted on Prop 40: a one-time 5% tax...