标签：#p

There’s new benchmark measuring AI’s ability to perform mathematical cryptanalysis. Anthropic’s frontier model actually found new attacks. The benchmark: “ CryptanalysisBench: Can LLMs do Cryptanalysis? ” The idea is to benchmark the ability of LLMs to discover new mathematical cryptanalytic attacks against a series of historical algorithms. Abstract: Cryptanalysis—the task of finding attacks against cryptographic schemes—its at the intersection of mathematical reasoning and cybersecurity, two areas where LLMs have advanced fastest. Cryptanalysis represents both a clean testbed for frontier reasoning (as practical attacks can be automatically verified) and a domain with unusually high stakes, since the primitives under study underpin our digital security. In this paper we ask whether LLMs can do cryptanalysis, and find that the answer is increasingly yes. We introduce CryptanalysisBench, 191 tasks across six families of cryptographic primitives (block ciphers, hash functions, etc.) drawn primarily from four NIST standardization competitions. Our benchmark consists of three tiers: (i) primitives with known practical breaks; (ii) primitives with no known practical break, evaluated both at full strength and as scaled-down variants; and (iii) a challenge set of production primitives at the frontier of cryptanalysis. Five frontier models (Claude Opus 4.8, Sonnet 5, Mythos 5, GPT-5.5, and the open-weights GLM-5.2) break 65%­86% of Tier 1 schemes, 6­12 Tier-2 schemes at full strength, and 24­61 across all scaled-down variants. Beyond deriving known results, models produce novel cryptanalysis, such as a key-recovery attack that exploits a design flaw in the SpoC AEAD and an error in KINDI’s published CCA-security proof, both to the best of our knowledge not previously known...

Originally published at tengli.dev When I added an LLM-powered eval to mcpgrade , the first real run produced a result that looked like a scoop: context7 — a server with a perfect static score — failed tool selection 62% of the time. A model shown its two-tool catalog picked the "wrong" tool on 5 of 8 tasks. If I had shipped that number, it would have been wrong. Not slightly wrong — systematically, unfairly wrong. This post is about how I caught it, because the failure mode generalizes to most agent benchmarks people are building right now. The setup mcpgrade's --eval mode works like this: it reads a server's tool catalog, synthesizes realistic single-step tasks ("find the Slack channel where the incident was discussed"), shows a model the full catalog, and measures three things — does it pick the right tool, does it fill valid arguments, and does it correctly refuse tasks that no tool can handle. Round 1, on three real servers, cost about twelve cents and produced this: Server Static score Tool selection Args Refusal context7 (2 tools) 100 38% 100% 100% server-memory (9 tools) 81 93% 100% 100% server-slack (8 tools) 97 54% 100% 100% Two servers with excellent static scores, apparently failing live. Either static analysis was worthless, or the eval was broken. The eval was broken Every "miss" traced to one cause. Slack's post_message needs a thread_ts — a value you can only get from a previous call to get_channel_history . context7's get-library-docs needs a library ID that comes from resolve-library-id . These are pipelined tools : their required arguments are produced by other tools. My task synthesizer didn't know that. It generated tasks like "reply to the thread about the outage" — without a thread timestamp. The model, quite sensibly, picked get_channel_history first (to find the thread), or declined. My grader marked both choices wrong. The model wasn't confused. The model was right . The benchmark was grading correct multi-step reasoning as failure — and me

Automated offense has one embarrassing failure mode: it lies to you about winning. Point a tool at a target, and the naive success check is a substring match — see uid=0(root) in the response, call it a shell. But a service banner can print that. A tarpit can stream it on connect. And the moment your success signal is wrong, everything downstream inherits the lie: the report, the "which hosts are owned" state, the next move. You get a confident engine that's confidently wrong. Here's how I made mine prove it instead — what worked in a live run today, and the sharp reader feedback that already made the design better. The idea: make the target echo a secret it couldn't have guessed Borrow the oldest trick in authentication. Before each attempt, the orchestrator mints an unpredictable per-attempt nonce and injects it. The delivered command has to send that nonce back: import os def make_nonce() -> str: return os.urandom(12).hex() # unpredictable — a target can't guess it A result is only trusted if that exact nonce comes back, in a structured evidence line: HALO-EVIDENCE nonce=c609007176813c9110fccc27 level=shell uid=0 host= exit=0 _EVIDENCE = re.compile(r"HALO-EVIDENCE nonce=(\S+) level=(\S+)") def breach_confirmed(output, ok, *, nonce) -> bool: m = _EVIDENCE.search(output or "") return bool(ok and m and m.group(1) == nonce) Delivery is a ladder, because real hosts are inconsistent Proof is worthless if you can't deliver a payload. So delivery degrades gracefully — all stdlib socket: Reverse shell — target dials back to an ephemeral listener, announces the nonce, hands back /bin/sh. Bind shell — if egress is blocked, the target binds a shell and you connect in. Blind callback — if no interactive channel survives, the target just connects back and sends the nonce. That still proves code execution, with no usable shell. Each rung self-selects the first available interpreter (bash /dev/tcp, python3, perl, nc), so the same primitive works against arbitrary hosts, not one

A follow-up to How Old Is My Data? The failure mode that gets worse when a machine is reading the data In a classic dashboard, stale data is a human problem: someone looks at a number that's six hours old and makes a slightly worse decision. Annoying, rarely catastrophic. Now hand that same data to a retrieval-augmented-generation (RAG) pipeline, or to an autonomous agent. The stakes change. The system doesn't pause to sanity-check the timestamp — it acts. And when the data it acts on is stale, three things are true at once: The answer is confidently wrong. There is no error to fire on — the query succeeded, the model responded, latency was normal. Every other signal on your dashboard is green. That's the worst combination in observability: a real failure that is completely invisible to the signals we currently emit. Where staleness hides in AI systems RAG: index vs. corpus. Your vector index was built from a corpus at some point in time. The corpus keeps changing — documents get added, edited, retracted. If the re-embedding job stalls or falls behind, the index quietly drifts out of date. The retriever still returns plausible chunks; the model still writes a fluent answer. It's just answering from a version of reality that no longer exists. The quantity you care about is the age of the index relative to its source — not the age of either one alone. Feature stores: online–offline skew. The features your model trained on and the features it serves on are supposed to match. When the online store lags the offline pipeline, predictions degrade in a way that looks like model drift but is actually data staleness wearing a costume. Agents: stale shared state. Multi-agent systems coordinate through shared memory, scratchpads, and context. An agent reasoning over state that another agent updated ten steps ago — but which never propagated — makes locally reasonable, globally wrong decisions. This isn't a new or exotic problem: it's exactly the regime that Age of Information t

cal.com, Calendly, zcal... booking SaaS isn't short on options, and most of them are genuinely decent. Free tiers cover the basics for a lot of freelancers. The catch: you're the product (nothing's really free), and your customer data lives somewhere you don't fully control and can't fully audit. A dysfunction I ran into on another SaaS tool was the trigger. Trusting a third-party service by default, just because it's widely used and billed monthly, doesn't always hold up. That episode was enough to make me reconsider every external service this site was relying on for functionality that's actually simple to self-host — and the booking widget, running on Calendly, was one of them. Nothing wrong with Calendly specifically. It worked fine. But structural friction had been building regardless: a recurring subscription for something as simple as displaying open slots and recording a choice, a hard dependency on a third party for a component with nothing exceptional about it technically, and customization capped by whatever the vendor exposes in settings — no way to go further if a need falls outside that box. On top of that, an integration constraint that mattered more than any of the above: the site runs on Astro, generating lightweight static pages by design, specifically to avoid the weight of third-party scripts and dependencies — the exact opposite of what embedding a SaaS widget implies. So: could a self-hosted alternative match the experience, without the monthly bill and without handing a core commercial function (people booking a call with me) to an external vendor? This is the write-up of that search, the codebase audit that came out of it, and the production rollout. The landscape Four self-hosted candidates stood out as genuinely comparable — not just UI skins sitting on top of someone else's API, not just internal-scheduling tools with the public-facing UX as an afterthought. CloudMeet — Svelte + TypeScript, deployed on Cloudflare Pages/Workers/D1, free-tie

A forgotten password, a security plugin that blocked your own IP by mistake, a plugin bug that turns the admin screen white — the causes vary, but the result is the same: you can’t log in to wp-admin. Note: WP-CLI is a command-line tool for managing WordPress, invoked as wp . It operates directly on the server, without going through a browser. This is exactly the situation where WP-CLI is useful. It works here because it never touches wp-login.php — it reads and writes the WordPress database and filesystem directly, so a broken login screen doesn’t affect it at all. Why WP-CLI keeps working when wp-admin doesn't A normal login follows the path: browser → wp-login.php → authentication → wp-admin. If anything along that path is broken — a plugin throwing a fatal error during authentication, a security plugin blocking your IP, a fatal error in the admin theme — the login itself can’t complete. WP-CLI connects over SSH and reads/writes the wp_users and wp_options tables (and the filesystem) directly. The code in wp-login.php is never executed, so problems on that path don’t matter. This does require that SSH access itself still works — on most hosting providers, SSH is a separate access path from the admin dashboard, so it usually still works even when wp-admin doesn’t. Scenario 1: Forgotten password # List administrator accounts wp user list --role = administrator --fields = ID,user_login,user_email # Overwrite the password directly wp user update 1 --user_pass = 'a-strong-new-password' wp user update writes the new password directly to the database row — no password-reset email, no token, no waiting on a delivery that might land in spam or not arrive at all. Scenario 2: A security plugin blocked your own IP Login-attempt-limiting plugins occasionally misclassify legitimate activity as an attack and add the working IP to a block list. # Deactivate the plugin responsible for the block wp plugin deactivate <plugin-causing-the-lockout> # Re-enable it later, after reviewin

In a new disclosure, OpenAI says its agent used exposed logins to gain access to at least four “publicly available services” in its unhinged quest to solve a test.

Are you a data nerd who loves fitness? If you wear an Oura Ring or an Apple Watch , you’re sitting on a goldmine of biometric data. Specifically, Heart Rate Variability (HRV) —the secret sauce for understanding your nervous system's recovery status. But how do you know if a low HRV score is just a fluke or a serious sign of overtraining? In this tutorial, we are going to build a personalized HRV Anomaly Detector . Using Machine Learning , specifically the Isolation Forest algorithm from Scikit-learn , we will transform raw time-series data from the Oura Cloud API into an early-warning system for stress and burnout. This type of anomaly detection is essential for anyone looking to optimize their performance without hitting a wall. The Architecture 🏗️ Before we dive into the code, let's visualize how the data flows from your finger to our machine learning model. graph TD A[Oura Ring / Apple Watch] -->|Syncs| B(Cloud API / HealthKit) B -->|Fetch JSON| C[Python Script] C -->|Pandas Clean| D{Feature Engineering} D -->|HRV & Sleep Duration| E[Isolation Forest Model] E -->|Predict| F[Anomaly Flag: Overtrained?] F -->|Plot| G[Matplotlib Visualization] G -->|Insight| H[Rest or Push?] Prerequisites 🛠️ To follow along, you'll need the following stack: Python 3.9+ Scikit-learn : For our machine learning heavy lifting. Matplotlib : To visualize our "danger zones." Pandas : For time-series manipulation. Oura Cloud API : You'll need a personal access token (available at the Oura Cloud portal ). Step 1: Fetching Your HRV Data 🛰️ First, let's grab our data. If you don't have an Oura ring, you can export your Apple Watch data as a CSV, but the Oura API is much more convenient for automation. import requests import pandas as pd # Replace with your actual Personal Access Token TOKEN = ' YOUR_OURA_TOKEN ' url = ' https://api.ouraring.com/v2/usercollection/daily_readiness ' headers = { ' Authorization ' : f ' Bearer { TOKEN } ' } params = { ' start_date ' : ' 2023-01-01 ' , ' end_date '

"Log in with Google" — without Google ever seeing the other site's password. OAuth lets one app act on your behalf at another service without ever handling your password. Instead of credentials, apps get a scoped, revocable token. The authorization-code flow Redirect. The app sends you to the provider with the scopes it wants. Consent. You authenticate with the provider and approve (or deny) those scopes. Code. The provider redirects back to the app with a short-lived authorization code. Token exchange. The app's server swaps the code (plus its secret) for an access token. Use & refresh. The app calls APIs with the token, refreshing it as needed. Why it's safer than sharing a password Scoped. A token grants only the permissions you approved, not full account access. Revocable. You can revoke one app without changing your password. PKCE. Public clients add a proof step so an intercepted code alone is useless. The one-line mental model Hand out a narrow, revocable token — never the password itself. This is part of LearningTechBasics — one tech idea a day, each with an animated diagram and a 60-second narrated video. 📊 Animated version with the live diagram Follow @amtocbot · #LearningTechBasics

Stratagems #20: Alex Felt the AI Collector Slow Down. He Knew Someone Else Had Made a...

How much could a single underscore in a username really matter? Just ask Brandon Klayme, who served 18 months in prison before realizing how authorities arrested, charged, and convicted the wrong man.

The US government is targeting China with a new import ban on "advanced robotic devices" and power inverters made in foreign countries, as reported earlier by Reuters. In an announcement on Tuesday, the Federal Communications Commission says the ban will include "mobile" robots, such as humanoid and quadruped models - but it is not limited […]

Claude & Cursor usage in your macOS menu bar Discussion | Link

A new lawsuit accuses Tesla of overextending the safety operators overseeing its robotaxis.

"Preliminary investigation shows that two of Link's three reaction wheels currently are not operable."

Run coding agents through the full development process Discussion | Link

Spur Intelligence has raised a $200 million round from Insight Partners for its tech that can identify legit human traffic from bots.

Working with databases is a big part of backend development, and choosing the right ORM can save you hours of work. Here are five of the most popular Node.js ORMs, along with their strengths and weaknesses, to help you pick the right one for your next project. 1. Prisma A modern, type-safe ORM built for TypeScript with an excellent developer experience. Pros • Great TypeScript support • Easy migrations • Excellent DX • Large community Cons • Less flexible for advanced SQL • Requires client generation Drizzle ORM A lightweight, SQL-first ORM focused on performance and simplicity. Pros • Very fast • Full TypeScript support • SQL-first approach • Lightweight Cons • Smaller ecosystem • Better if you know SQL 3. TypeORM A mature ORM with broad database support, widely used in enterprise and legacy projects. Pros • Rich feature set • Supports many databases • Strong relationship support Cons • More complex API • Slower development than newer ORMs 4. MikroORM A powerful TypeScript ORM designed for large and complex applications. Pros • Excellent relationship handling • High flexibility • Strong TypeScript integration Cons • Steeper learning curve • Smaller community 5. Sequelize One of the oldest and most established ORMs in the Node.js ecosystem. Pros • Battle-tested • Supports many databases • Large legacy adoption Cons • TypeScript support is weaker • Feels outdated compared to modern ORMs Which ORM do you use the most? 👇

Process mismatch In tools built for Scrum, a task is an input: something you file, size, and work on. In Shape Up, a task is an output — something discovered while building work that was already shaped and bet on. That's the core mismatch, and it plays out differently depending on the tool. Jira Jira does exactly what it was built to do. Its shape is Scrum's shape: a backlog, estimates, sprints. Teams bring Shape Up in anyway and try to make it fit the tool's shape. A scope becomes an epic. A task becomes a ticket. The pitch — Shape Up's document for a problem, its appetite, and a proposed solution — has no equivalent object in Jira, so it ends up living in a Confluence doc, disconnected from the work it's supposed to govern. The substitutions are each small and reasonable on their own: An estimate field is there, so it gets filled in — and the velocity report looks broken without it. Losing bets need somewhere to go, so they land in the backlog. They aren't dead, they're waiting — and now someone has to groom them. Appetite ("how much is this worth") quietly reverts to estimate ("how long will this take"). Before long, the team is running Scrum, with a backlog-refinement meeting back on the calendar. The tool's requirements pull the ceremonies back in. Linear Linear is fast and well made. It even has cycles. The mismatch here isn't a quality problem — it's an inheritance problem. Linear carries the same assumptions as Scrum, just executed better. When a cycle ends with work unfinished, Linear rolls it forward automatically into the next one. It's meant as a convenience feature. It's also the inverse of Shape Up's circuit breaker. Shape Up's bet is that the deadline is real. The whole mechanism depends on a hard stop forcing a decision — cut the scope and ship what's done, while there's still time to make that call. A tool that quietly carries unfinished work forward removes the one moment the method needs. Every six weeks, it says: the deadline was just a suggestio

eBay and three former executives will pay $55.7 million as part of a settlement with a Massachusetts couple targeted with a bizarre harassment and cyberstalking campaign in 2019, as reported earlier by CNBC. The settlement will resolve a lengthy legal saga that revealed how eBay's former executives sent live insects, a bloody pig mask, a […]