Lockdown Mode, Until It Doesn't

Lockdown Mode, Until It Doesn't

Calif.io's post is six words long: "Lockdown Mode helps, until it doesn't." The editorial note attached to it describes a Lockdown Mode bypass on an iPhone 18 Pro, delivered as a PDF over AirDrop, with the exploit research assisted by AI. The post itself shows none of that. What it shows is a demo that replies describe as something "dancing on my screen all day," a question about "how pwned does a device need to be to still be pwned after an update," and a suggestion that the work "deserves some compensation." No writeup, no CVE, no Apple acknowledgement, no description of what the model contributed. That is a claim, not a record, and what would settle it is a technical disclosure or an Apple advisory naming the parser (more: https://x.com/calif_io/status/2117720348322144733?s=19).

If the description holds, it matters because Lockdown Mode exists to shrink the file-format attack surface for high-risk users, and PDF handling on a received AirDrop is exactly the surface it is meant to constrain. Until the chain is published, treat it as a plausible demo by a credible shop and nothing more.

The wider week makes the same point from the defender's seat. Hackaday's roundup leads with Akamai's "TLP Is Not a Suggestion," written after two embargoes broke in one week: a bug leaked onto Hacker News a day early, and Linux kernel bugs landed on the public list instead of the private one. AI tooling now compresses "details exist" to "working exploit" into hours, so a broken embargo costs more than it used to. The rest is dense: a CVSS 9.5 sixteen-year-old overflow in TianoCore EDK II's PXE driver that runs before Secure Boot; Tailscale SSH running as root with races that let an ordinary user hijack privileged sockets, which Erica Windisch argues is wormable at under a second per hop. For the fraud-minded, two items stand out. TrendAI's SHADOW-EARTH-79, tied by Citizen Lab to Candiru spyware, won about 12% of Starlink ad impressions against a 3% baseline and spent $109,000 over four months with zero conversions, which is not what advertisers do. And Straiker exposed CARLIY0S, a PentAGI-based system run by CyberCartel against 400-plus Latin American financial targets using Kimi, Grok and Claude, jailbroken by framing the work as red-team CTF practice (more: https://hackaday.com/2026/10/30/this-week-in-security-broken-embargoes-uefi-overflow-wormable-tailscale-starlink-ad-snooping-and-a-dhs-directory-dump/).

The Bug Flood Reaches the Release Calendar

PostgreSQL has shipped a major release between mid-September and mid-October every year for a decade. Version 19 will not ship until November at the earliest, and three large features were reverted deep into beta. Robert Haas's explanation is blunt: "LLMs happened." Between feature freeze and September 25, commits to the current stable branch jumped from 724 in 2025 to 1,169 in 2026, and commits back-patched to at least one prior release went from 248 to 433, up 74%. Nobody on the project believes committers got sloppier. The simpler reading is that the same mistakes were made and far more were caught, by people running LLMs over a 30-year-old codebase (more: http://rhaas.blogspot.com/2026/10/postgres-19-is-late-and-its-ais-fault.html).

LLMs draft fixes, but the fixes are not always correct or compliant with project standards, so humans still review and commit, and "those humans have not gotten any smarter between 2025 and 2026." Haas calls the delay unconcerning and the long-term picture "more troubling": forty years of bugs humans could not find are now findable in hours, and nobody knows how the project catches up while still shipping features. This is maintainer overload moving from bounty programs, where curl already gave up, to release engineering, where the cost is reverted features.

Cloudflare's answer to the downstream problem, the security lead pinged at breakfast about a critical CVE, is Zero Wire, a public briefing feed on Radar. Each entry is an index card: plain-language explanation, who should investigate, recommended actions, links to vendor advisories and CISA's Known Exploited Vulnerabilities catalog. The homepage splits "Needs attention" from "Reference," and the post is careful about a distinction most dashboards blur: "A vulnerability's severity and evidence of active exploitation are distinct: readers need both." Scope is critical CVEs in Internet-facing software where a proxy can help, so it will not cover the EDK II class of bug at all. Each briefing ships a read-only prompt for an agent to assess your own exposure per asset. That is a sensible shape for the triage layer the Postgres story says is missing, with the caveat that a vendor-run feed will naturally highlight the problems its product mitigates (more: https://blog.cloudflare.com/zero-wire).

Signatures That Hold a Hypothesis

The most ambitious paper in the batch is "Adversary Brains," listed on arXiv under Gadi Evron of Knostic. The pitch: "Where YARA matches a file and Sigma matches a log line, an adversary brain matches the activity pattern of a campaign or threat actor." A brain is a typed property graph of entities and links, each link carrying a weight derived from its background rate, a role, a volatility class and provenance. It fires when every required link matches and the weighted share of supporting links clears a threshold, default 0.7. The design scales Heuer's Analysis of Competing Hypotheses from a handful to thousands, and LLMs "turn prose reports into brains, judge matches, and drive the loop." Verdicts must cite evidence from a deterministic match block, hallucinated ATT&CK IDs are dropped, and "a model's confidence score is not calibrated. We use it only to rank." Compiled detections tag their own alerts so they cannot re-enter as evidence (more: https://arxiv.org/abs/2610.35624v1).

The evidence is thinner than the architecture. There is no evaluation on real telemetry, no detection rate, no false-positive rate against a signature baseline. Across 100 synthetic runs with rotated indicators a behavioral brain fired every time while its indicator twin fired once. In one emulated lsass case the brain survived a command-line change that defeated a Sigma rule, but a dump through dbghelp instead of dbgcore beats it, and "one case is not a rate." Anyone who has built fraud rules will recognize weighted, partially-required feature conjunctions with a decay loop. The new part is letting a model author thousands of them from prose, and the open question is whether the loop stays honest once alerts flow back through human-written reports.

On the fixing side, Collinear AI's CWE-bench v2 opens 100 tasks across 91 CWEs: an agent gets a real repository checkout and a short instruction, must find and fix a weakness without breaking functionality, and is scored programmatically. Verifiers check behavior rather than one fix's structure, and must fail memorized upstream patches. Gemini 4 Argon leads at 67.8% pass@1 and 81.0% pass@4, with Claude Opus 5.5 at 67.3% and 78.0%, and the leader still fails 19% of the set on every attempt. The cost frontier is DeepSeek V4.1 Flash at 57.0% for $0.04 per rollout, Opus adding ten points for $1.83, Gemini at $3.92 (more: https://huggingface.co/blog/cwe-bench). At the entry end, waf-dojo is a Go and Terraform training game for AWS WAF: each player gets their own ALB and Web ACL, a traffic generator forges ClientHellos with uTLS for JA4 fingerprint practice, and 41 labs cover real CVE classes. Score is block rate times one minus false-positive rate, which is the right formula. The license is PolyForm Shield, source-available and not open source (more: https://github.com/nishikawaakira/waf-dojo).

The Commitment Load and the Exit Price

Anthropic's amended S-1 is the primary document behind weeks of secondhand reporting, and the text extraction available here strips most headline dollar figures. Trailing-twelve-month revenue grew "approximately 1,200%" to September 2026. Customers above $100,000 generated $26.1 billion, stated as 74% of total, implying roughly $35 billion trailing revenue against about $4.6 billion for all of 2025. The company "has incurred net losses in each year since our founding." The editorial headline puts aggregate commitments at $895 billion; that figure does not appear in this extraction, but the named components do: Amazon at least $110 billion through 2036 "regardless of actual usage," Google at least $121.3 billion plus $125 to $150 billion of TPU capacity, Microsoft $44.9 billion, SpaceXAI up to $120.5 billion, three smaller providers at roughly $106 billion combined, and Broadcom equipment leases of $161.2 billion before interest. Those sum to roughly $800 billion on their own, with obligations running "between 2031 and 2045," against about $500 billion of compute deals reported in mid-October (more: https://www.sec.gov/Archives/edgar/data/2130357/000162828026068676/anthropicpbc-sx1ax1.htm#i199fd6a8a0664d5da497db9a78cf0452_55).

The new risk language is what a filing has to say under oath. "Our internal estimates and our expectations regarding future models, rather than our current models, indicate that we may imminently meet our Responsible Scaling Policy's definition of 'dramatically accelerated progress attributable to AI.'" The filing concedes the company "may in the future not identify a significant acceleration in our rate of development until after it has occurred." The supporting fact: "Over 90% of the contributions to our codebase in September 2026 were written by Claude." The infosec disclosures are concrete too. In September 2025 a Chinese state-sponsored group manipulated Claude Code into attempting intrusions at roughly 30 targets with "a limited number of successful intrusions." The company delayed pre-training a frontier model by more than a month to harden against weight exfiltration, and admits safety controls "have failed, been misconfigured, or been inadvertently disabled."

Read that schedule next to Revolut. The r/LocalLLaMA repost was removed as a duplicate, but the thread preserves the essentials: 56 Nvidia B200s serving about 2,000 engineers on a self-hosted GLM model, replacing Claude Code at a claimed 90% saving. The most useful comment is the skeptical one: adoption had cost "$1,000 to $10,000 per month per engineer with not so much ROI," and the article never states total spend before and after. A bank pricing its exit at a tenth of list, in the week the vendor files obligations running to 2045, is the frontier-economics argument in two documents (more: https://old.reddit.com/r/LocalLLaMA/comments/1xnhq66/revolut_sidelines_claude_code_for_a_selfhosted/).

Experts on Disk, Quants on Trial

Betelgeuse answered last week's pushback with numbers. Running Qwen 3.8 Flash Next at IQ4_XS, a 100GB-class full 4-bit expert set, on an RTX 3060 12GB with 16GB of system RAM, the engine reports 14.0 tokens per second on a single 16GB DDR4 stick and 24.0 on two 8GB sticks, against roughly 0.5 for stock llama.cpp and 4 to 6 for Strata's low-RAM mode, with output "100% byte-exact." The mechanism is an exclusive host-RAM victim cache: evicted experts land in RAM while duplicate GGUF pages are dropped from the page cache, and a hardware DMA engine pulls hits across PCIe while an oracle pre-stages NVMe misses. Dual-channel RAM at the same 16GB doubles host bandwidth, which is where the jump from 14 to 24 comes from. Two things to hold against it: nobody has answered the repeated prefill question, and one tester with a 4080 Super and 64GB got 3.28 tokens per second on Q8, so the fast path is sensitive to configuration in ways the table does not show (more: https://old.reddit.com/r/LocalLLaMA/comments/1xkh2ns/betelgeuse_running_qwen_38_flash_next_iq4_xs_at/).

The ISTA-DASLab versus Unsloth dispute is the quant war of the season, and the thread's own summary is fair: Unsloth's comparison made waves, Unsloth's higher-context runs showed a wider gap, ISTA pointed out inconsistencies in the measurements, and Unsloth says it cannot reproduce ISTA's results. The sticking point is that ISTA does not publish KL divergence for its GSQ-RCO quants. A recommendation to prefer ISTA at the smallest sizes stands only as far as a reproducible measurement does, and right now the two labs cannot agree on one (more: https://old.reddit.com/r/LocalLLaMA/comments/1xm8xhn/kind_of_enjoying_the_ista_gsqrco_vs_unsloth_beef/).

New weights: SenseNova-Loop-9B-Preview runs a block of 24 decoder layers twice with shared weights, 56 executions from 32 distinct layers, trained to 262,144 tokens. Looped blocks buy depth per parameter at the cost of compute per token, and commenters flag a Terminal Bench score below a 3B model (more: https://old.reddit.com/r/LocalLLaMA/comments/1xje5oo/sensenovasensenovaloop9bpreview_hugging_face/). Also trending without a readable card in this batch: Nota AI's NVFP4 repack of Solar-Open2 at 250B (more: https://huggingface.co/nota-ai/Solar-Open2-250B-Nota-NVFP4), and Sarvam's 105B reasoning model, which has existed since spring, so this is a refresh rather than a debut (more: https://huggingface.co/sarvamai/sarvam-105b). As for ranking all of this, one hobbyist had four frontier models grade 39 local models over 50 prompts, and every judge put Bonsai-2 27B PQ2 on top. The thread's own diagnostics say why to discount it: Bonsai scored 1.5 out of 10 on coding yet ranked first overall, and BF16 and Q8 builds of the same 4B model scored 7.5 and 1 on debugging. That spread is noise (more: https://old.reddit.com/r/LocalLLaMA/comments/1xi6edm/5_frontier_llms_grade_39_local_llms_on_50_prompts/).

Writing Weights by Hand

Jacob Lauritzen reports getting Fable to hand-write the weights of a 100,000-parameter network that separates real legal citations from fabricated ones, "basically one-shotted a full NN that's better than training it." His follow-up qualifies it: "with more training, performance converges between hand-written weights and trained weights." So the claim is not that synthesis beats gradient descent, it is that a frontier model can encode a rule system into a small matrix faster than a short training run can learn it. A fraud analyst would recognize a weighted rule set compiled into tensor form. Missing is everything that would make it checkable: the dataset, the held-out split, the trained baseline's budget, and the error analysis on well-formed fakes. Writing a classifier from nothing is a stronger claim than editing one, and deserves a repository (more: https://x.com/jacsebl/status/2117606206764175543).

The cursed branch keeps climbing. Days after a RISC-V CPU was compiled into Qwen's weights, mapestree got a slow but recognizable Doom running on that virtual machine (more: https://old.reddit.com/r/LocalLLaMA/comments/1xi2jfm/i_ran_doom_inside_the_qwen_model_weights/). Zeeshan Patel, working with Opus 5.5, went further. QwenGPU compiles a SIMT GPU into Qwen3.5-2B as 45 layers in front of Qwen's own, so the model executes CUDA kernels by decoding tokens. QLink's trick is that a store from one model is already a valid write for another: a kernel store emits a three-token record, and feeding it to a second model acts as a memcpy. Four merged models, one per GB200, produced every collective identical to real NCCL on the same int32 inputs. They trained an XOR MLP with data parallelism from 53% to 98.8% in 40 steps. One XOR step costs about 10,000 decoded tokens, so this trains nothing useful. It does retire the "it's just feeding output back in" objection, since the computation is now a distributed collective with exact parity to the real library (more: https://x.com/zeeshanp_/status/2117580800640397476?s=19).

The practical cousin is a hobbyist's note on architecture over size. The author had been building on Qwen3.5 9B with RYS layer duplication, repeating transformer blocks to deepen a model without new parameters. Each SFT run on the 12B result took 14 to 18 hours, plus eight rounds of RL. They applied a double-RYS expansion to Liquid AI's LFM3 1.7B, making it 3B, and ran one SFT pass: 2,600 steps over 100,000 samples in 107 minutes. It beat the best Qwen result before any RL. The diagnosis is that LFM3's 20 stacked width-7 gated short-convolution layers suit long-horizon state tracking in a way Qwen's Gated DeltaNet does not. Liquid's own card advises against LFM3 for multi-step reasoning. Earlier layer-surgery writeups put the floor for useful duplication near 3B; this started below it. Sequence length is unstated, and the convolution advantage should fade as tracked state spans thousands of tokens (more: https://old.reddit.com/r/LocalLLaMA/comments/1xjkxyd/architecture_matters_more_than_you_think_or_how_i/).

Agent Economies, Simulated and Shipped

"The Wealth of Agents," from Princeton, is not about human developers; "developers" means organizations that build agents, and the question is whether capability scales by composing agents from many independent builders rather than one lab controlling the stack. A task-decomposing multi-developer system routes subtasks to different builders' agents and composes the replies. Because a real population of competing developers cannot be run as an experiment, a meta-agent pipeline simulates them. On GAIA, the median specialist scores 21% and the best 35%, yet the composed system clears 70%, three points above the best generalist built with several times each specialist's budget. On generalist pools the composite costs more for less, and on SealQA's narrow search tasks it "performs consistently worse" than a routed single agent. The Adam Smith framing is economic: an incentive structure where a retailer or newsroom contributes a first-party agent, keeps control, and gets paid rather than scraped. The authors list security, privacy and accountability among untrusted participants as open, and for anyone who has watched marketplaces get gamed, that line is the paper (more: https://arxiv.org/abs/2610.20518v1).

Cole Medin's software factory is the single-developer version, and the title's "hundreds of PRs a week" never appears in the transcript. What does appear is a mission-control dashboard: issues run in parallel in git worktrees through his open-source Archon harness, with a per-issue complexity assessment deciding how heavy the loop gets. The numbers given are "hundreds of laps," 21 failures from workflow bugs and two from Claude Code rate limits. He started the year with a "dark factory" merging straight to production and pulled back; the agent now escalates owner decisions to a human. Neon, whose Postgres stores every tool call, sponsors the video. The claim that reliability needs a control plane with full audit trails is his assertion from client work, but it is the one claim a security reviewer would make unprompted (more: https://www.youtube.com/watch?v=YHKuUjicB3M).

At the smallest scale, a 4B model running a Minecraft errand runner shows what decomposition buys. The player types "I'm hungry, get me at least 3 porkchops and also make me a netherite ingot," and Mica v0.5 4B never parses the sentence in one shot. It answers a chain of multiple-choice questions supplied from game data, each answered with a probability, then picks the next valid action from a recipe planner while a scripted bot does the mining. The transferable claim is the design: "if something is too hard to settle in one request, break it into smaller judgments," and a local model making many cheap judgments per second beats an API judge making one expensive one. The old lesson that local models need heavy scaffolding is here turned into the architecture rather than fought (more: https://old.reddit.com/r/ollama/comments/1xhw3y4/a_4b_model_made_me_a_netherite_ingot_from_bare/).