Offensive Cyber Goes Private

Offensive Cyber Goes Private

The United States Senate Armed Services Committee has approved language in its fiscal 2027 National Defense Authorization Act that would authorize Defense Secretary Pete Hegseth to establish a pilot program allowing private-sector contractors to conduct cyber operations "through contractor-owned, contractor-operated means" under U.S. Cyber Command's operational authority. The provision, which still requires full Senate and House approval, limits contractors to "access generation and maintenance" — but as multiple former senior cyber officials pointed out, that phrase covers nearly the entire operational envelope of modern cyber campaigns. (more: https://www.bankinfosecurity.com/american-hackers-for-hire-proposal-sparks-heavy-criticism-a-32176)

Nick Leiserson, who spent a dozen years as a House staffer before serving in the Biden White House's Office of the National Cyber Director, called the proposal a direct threat to global cyber stability — noting the U.S. has sanctioned Chinese military and intelligence contractors for doing exactly what this provision would authorize American firms to do. Jason Kikta, a 20-year Marine Corps veteran who helped stand up Cyber Command's Cyber National Mission Force, offered the most memorable prediction: the pilot itself will be "smooth as butter," then scale will arrive and "it'll go to hell in a hand basket." The SolarWinds operation, he noted, was "pretty much all access generation." So was Volt Typhoon's pre-positioning inside U.S. water and power networks. Alex Orleans, a CrowdStrike and Cisco veteran, cut to the geopolitical absurdity: "This is your brain on American exceptionalism" — the U.S. would assert its contractors are untouchable while continuing to burn adversary contractor infrastructure built on compromised home routers.

While Washington debates whether to deputize hackers, the open-source community is already demonstrating what autonomous offensive security looks like. T3MP3ST, a multi-agent framework released under AGPL-3.0, turns an AI coding agent you already run — Claude Code, Codex, Hermes, or a fully offline model via Ollama — into a zero-day hunter. It claims 90.1% pass@1 on XBOW's own 104-challenge black-box suite (above XBOW's self-reported 85%), 23/40 hint-free on Cybench, and 8/10 exact file/line/CWE hits on held-out post-cutoff CVEs the model had never seen. Every headline number recomputes from committed data with npm run verify-claims. The recon engine and war room are stable; the 8-operator kill chain's downstream swarm coordination remains experimental and honestly labeled as such. The framework's coordinated-disclosure pipeline is live enough to have drafts held for vendor coordination right now. (more: https://github.com/elder-plinius/T3MP3ST)

Surveillance State, Exposed

A pair of security researchers, Sam Curry and Maik Robert, discovered that the San Francisco Police Department was accidentally livestreaming real-time footage from five Skydio surveillance drones — including color and thermal imaging, GPS telemetry, and drone pilots' names — to anyone who found a public, unauthenticated web address. The leak wasn't a Skydio vulnerability. Someone inside the SFPD created a "ReadyLink" shareable URL last December with no authentication requirement and a one-year expiration, then somehow that link ended up indexed in AlienVault Open Threat Exchange, where the researchers found it using routine URL enumeration. The footage had potentially been exposed for six months before discovery. (more: https://www.wired.com/story/sfpd-drone-video-leak-surveillance/)

The archived footage — 60 videos across 20 flights over roughly 48 hours — paints an uncomfortable picture of modern aerial policing. WIRED's analysis detected hundreds of people and dozens of clear faces across the videos. In one sequence, four Skydio quadcopters tracked a man across San Francisco for an alleged car-parts theft, capturing his license plate, his hiding spots behind parked cars, and the police tackle. In another, a drone hovered over a rooftop, zooming in on a person sitting alone wearing headphones — the response to a reported "prowler." As ACLU senior policy analyst Jay Stanley put it, drone footage is a "toxic asset" always one misconfiguration from public exposure, and AI makes the privacy implications exponentially worse: "Maybe no human has the time to pore over every frame of these videos, but an AI can do that, and it's scalable to vast amounts of video." Notably, SFPD's own fleet has exploded from 6 drones to 98 since the program's 2024 launch, with over 1,400 flights logged.

On the data-privacy front, the ongoing OpenAI, Inc. Copyright Infringement Litigation has entered its ugliest phase. Last December, OpenAI made 20 million "de-identified" ChatGPT user conversation logs available to plaintiffs for keyword searching — already a cramp for anyone who assumed chatbot conversations were sacrosanct. But the plaintiffs now allege OpenAI applied approximately 19 billion redactions across those logs (roughly 1,000 per conversation), under-represented conversations using Retrieval Augmented Generation, and failed to retain large numbers of conversations entirely — including those from ChatGPT's "Temporary Chat" feature. On July 9, the plaintiffs moved for sanctions, asking the court to prohibit OpenAI from using the produced logs for its defense, establish as fact that copyrighted material was "substantially and systematically" used, and inform the jury about deleted conversations. (more: https://old.reddit.com/r/OpenAI/comments/1usd3ui/updated_millions_of_chatgpt_user_conversations/)

The Agentic Coding Reckoning

Salvatore Sanfilippo — antirez, the creator of Redis and a programmer whose credentials are beyond questioning — published a direct challenge to the remaining holdouts: stop reading the code. His argument is not a vibe-coding manifesto. It is a prioritization claim grounded in the economics of the 8-hour workday. LLMs produce locally optimal code reliably; they struggle with big-picture design. Reviewing 5,000 lines of generated code daily is a tradeoff that steals time from design thinking, QA, and feature direction — the activities that now constitute the highest-leverage part of a programmer's job. "If you control the ideas of your software, looking at the code itself is suboptimal and often pointless," he writes. His concrete recommendation: invest in DESIGN.md files where each data structure is described in human language, with implementation tricks and design rationale. "You open the file, read the design, then you own the ideas." The one caveat he offers is for junior programmers, who should still learn to write programs — but by implementing small interpreters and hash tables, not reviewing JavaScript for web clients. (more: https://antirez.com/news/169)

The tooling is catching up to antirez's thesis. Omnigent, a new open-source meta-harness, makes multi-agent orchestration trivial: one session drives Claude Code, Codex, and other agents simultaneously, with guardrails, session sharing, and custom orchestrators built on top. The emerging pattern that practitioners report getting "insane value" from is Claude Code for implementation, then Codex to review the diff in a separate session — different models, different context windows, the model that wrote the code never grades its own output. (more: https://www.linkedin.com/posts/cole-medin-727752184_a-new-open-source-tool-for-ai-coding-was-share-7472300595190710272-q8Xp)

A detailed guide to building an "Agentic OS" around Claude Fable 5 lays out nine architectural layers, from hard rules the model cannot argue with (because a script can verify every one) to an earned-trust system that grants autonomy only after 20 logged runs at 95% verified pass rate. The central insight: Fable 5 can cost 10–50x more than it should depending on architecture, not workload. Let it split a job across ten parallel copies each re-reading the same material and a single day burns $400–600; route decisions to Fable 5 and execution to cheaper models and the same day costs a few dollars. The model that does the work cannot also judge whether the work is done — "something independent has to check." (more: https://linas.substack.com/p/claude-fable-5-agentic-os-guide)

Daniel Miessler's viral LinkedIn post sharpens the strategic angle: Meta spent billions on a new AI research lab that's already "worse than dead," Microsoft's relationship with OpenAI is "completely adversarial," and the only company he sees in a strong position is Anthropic — vision plus business discipline, already profitable. The ultimate AI prompt for any business, he argues, is: "What is the specific problem that we have as a company, and why do we think AI can help us solve it?" For too many, the answer is circular: "The primary problem we have is that leadership wants us to use AI." One commenter reframed it through a security lens that hits home: "What can an adversary do with the AI you just deployed that they couldn't do before? Most organizations can't answer that because they never answered the question you pose either." (more: https://www.linkedin.com/posts/danielmiessler_absolutely-insane-to-me-the-damage-that-multiple-share-7473455461288136704-Wi4E)

Local AI: The Quantization Tax

A detailed benchmark from a user running Qwen3.6-27B on an RTX PRO 6000 Blackwell workstation reveals a painful truth that academic quantization metrics hide: low-bit quantization destroys agentic reliability. This is a pattern that keeps surfacing — small logit errors that are invisible in single-turn benchmarks compound catastrophically over multi-turn tool-calling sequences, because each degraded decision feeds into the next. In BF16, the model works flawlessly across OpenCode, VS Code Copilot, and multi-turn agent loops. Switch to NVIDIA's official NVFP4 checkpoint — same hardware, same config — and the model halts mid-task, gets stuck in failure loops repeating the same phrases until context exhaustion, and requires manual "continue" prompts that never occur in BF16. FP8 shows the same symptoms less frequently. Increasing repetition penalty doesn't break the loops; it just makes the model alternate between two failure phrases instead of one. Community consensus is blunt: "quants don't perform as well as native precision, period." Multiple users report that NVFP4's true quality lands between Q3 and Q4 despite its larger file size, and that chat template bugs in Qwen3.6's launch may compound the degradation. (more: https://old.reddit.com/r/LocalLLaMA/comments/1uplzs7/qwen3627b_nvfp4fp8_agent_loops_vs_flawless_bf16/)

NVIDIA's own Puzzle-75B-A9B demonstrates the other side of the local inference equation — the sweet spot nobody else is filling. This 75B-total, 9B-active MoE model runs at 132 tokens/second on three 3090s capped at 200W each, with hybrid Mamba keeping the KV cache tiny enough for three concurrent 256K-context sessions. It replaced a Nemotron Super 120B MoE that consumed four GPUs, roughly doubling speed per watt while freeing a card. The user notes the 70–80B total / ~10B active band fills 72GB of quantized VRAM exactly — dense-class quality at A3B-class speed — yet almost nobody ships models in this range. Benchmark tables show Qwen3.6-27B still beats Puzzle on most academic metrics, but real-world in-context grounding tells a different story: one user measured cold accuracy at 0.26 that jumped to 0.97 with a 4.6K-token reference document in the prompt. (more: https://old.reddit.com/r/LocalLLaMA/comments/1uru9ja/nvidia_puzzle75ba9b_nvfp4_at_132_ts_on_33090_why/)

For those wondering whether FlashAttention-3 or FA-4 optimizations might unlock more performance on consumer silicon, a thorough kernel-level investigation confirms: FA-2 is the ceiling. The primary lever behind FA-3 — faster WGMMA tensor-core instructions — simply doesn't exist on RTX GPUs. TMA (tensor memory accelerator) is available on SM_120 (RTX 50XX) but isn't the bottleneck, and warp specialization without asynchronous tensor cores actually makes things slightly worse (213μs vs. 206μs). Since the pipeline is tensor-core-bound on consumer hardware, meaningful improvements will require sacrificing accuracy to leverage lower-precision tensor cores. (more: https://old.reddit.com/r/LocalLLaMA/comments/1urucz1/exploring_flashattention34_optimizations_on_rtx/)

On the audio inference front, audio.cpp continues expanding into the unified local audio framework the ecosystem has lacked. The latest release adds four ASR models — Nemotron 3.5 ASR, Higgs Audio STT, VibeVoice ASR, and Hviske — with initial streaming support. The headline: Nemotron ASR transcribed 327.6 seconds of audio in 2.17 seconds offline on an RTX 5090 at 3.18% WER, with the streaming SSE path matching accuracy at 307ms time-to-first-token and substantially lower VRAM. (more: https://old.reddit.com/r/LocalLLaMA/comments/1urd4ln/audiocpp_what_does_the_fox_say_4_asr_models/) Meanwhile, Mesh LLM takes a different approach to the hardware problem: rather than optimizing single-node inference, it pools GPUs and memory across machines into a single OpenAI-compatible API endpoint. Models too large for one box run via "Skippy stage splits," the coordinator plans contiguous layer ranges across peers, and a Mixture-of-Agents gateway can fan prompts to every model in the mesh simultaneously. The project supports 72+ model families and integrates directly with Claude Code, Goose, and OpenCode. (more: https://github.com/Mesh-LLM/mesh-llm)

Compiling Agent Cognition

The most technically ambitious paper this week comes from RightNow AI, and its title makes an audacious claim: an "AGI compiler." Strip away the provocation and the actual contribution is rigorous: AutoRatchet is a Rust workspace of 16 crates (36,843 lines) that records live LLM agent behavior, measures which parts are deterministic, extracts them into verified programs or distilled specialists, and emits signed WebAssembly artifacts with physically enforced capability boundaries. The key finding on their AgentMark benchmark: 87.1% of 560 recorded frontier-agent spans are witnessed-deterministic at default temperature — classification, extraction, and routing hit 100%, while free-text summarization sits at 17.5%. On a 300-item production-style stream with three scheduled distribution shifts, the system drives marginal cost from 59 to 2 micro-dollars per item at 96.9% parity on witnessed inputs with zero errors. (more: https://arxiv.org/abs/2607.04542)

What makes the paper worth reading in full is its equal emphasis on failure modes. Under loose guard calibration, 48.9% of compiled answers silently disagree with ground-truth labels — the guard admits post-shift novelty and the stale artifact mislabels it. An unfaithful deopt reference causes the verification gate to refuse recompilation entirely. The authors' core claim is that calibration and reference fidelity, not model capability, decide whether cheap stays correct. The system uses conformal prediction to set abstention thresholds, and the compile-deopt-recompile loop means "nothing is figured out twice." This is the compilation step that agent frameworks have been missing: not routing to cheaper models (FrugalGPT, RouteLLM), not caching semantically similar answers (GPTCache), but actually extracting the symbolic program behind repetitive agent behavior and running it for microdollars in a sandboxed WebAssembly runtime.

MrFlow, a training-free diffusion acceleration method that shifts most denoising cost from expensive high-resolution sampling to cheap low-resolution passes followed by a single refinement step, has now released its ComfyUI plugin and expanded backbone support beyond the FLUX and Qwen-Image families covered in its initial paper. Measured end-to-end speedups range from 8.25x on FLUX.1-dev to 25x on Qwen-Image with distilled Pi-Flow weights — no finetuning or custom kernels required. (more: https://github.com/Xingyu-Zheng/MrFlow) On the practitioner tooling side, Research Radar is a daily cron job that fetches every new paper from your arXiv categories, scores abstracts 1-10 against a markdown file describing your research interests using a cheap local model, then deep-reads the top scorers with a stronger model that writes summaries, key insights, and specific connections to your work. The local inference path runs entirely through Ollama — nothing leaves your machine. (more: https://old.reddit.com/r/ollama/comments/1usoh2a/every_day_my_local_agent_reads_all_new_arxiv/)

The Brake Pedal Problem

Anthropic co-founder Jack Clark and Marina Favaro, leader of The Anthropic Institute, published a warning that AI systems approaching "full recursive self-improvement" — models capable of building their own successors — are much closer than previously expected. Their recommendation: the industry should consider slowing or pausing frontier AI development to allow researchers to understand the societal harms, and should build mechanisms for human intervention. "When I look down at the car we're driving, all I have is a gas pedal. I don't have a brake pedal," Clark told Anderson Cooper on CNN, drawing a Cold War nuclear arms race analogy for why competitors might cooperate on safety constraints. The tension here deserves naming: just weeks ago, Andrej Karpathy joined Anthropic with the stated mission of teaching Claude to improve itself without human supervision. Recursive self-improvement was a pipedream a year ago; it is now an explicit engineering goal at the same company publicly warning the industry to slow down. The timing is also financial: Anthropic has filed for an IPO that could raise tens of billions, and SpaceX's $75 billion IPO — the largest on record — is set for next week. (more: https://old.reddit.com/r/AINewsMinute/comments/1usu8n9/anthropic_warns_that_ai_will_soon_be_able_to/)

The open-source community is pushing in the opposite direction — or at least a complementary one. Zhipu's founder has publicly backed open-source AI as the global security debate intensifies, arguing against intelligence monopolies. (more: https://old.reddit.com/r/LocalLLaMA/comments/1uvbgvx/zhipu_founder_backs_opensource_ai_as_global/) On the tools front, OpenCut is being rewritten from the ground up with a Rust core targeting web, desktop, and mobile from one codebase — with an MCP server for AI agents and headless mode for automation baked into the architecture from day one. (more: https://github.com/OpenCut-app/OpenCut) And the Kode Dot, a programmable pocket device built on dual ESP32 MCUs (P4 + C5) with AMOLED touchscreen, NFC/RFID/IR, WiFi/BLE, and 16 programmable GPIO pins, has shipped to its 16,000 Kickstarter backers — a pocket pentesting and maker platform that gives the Flipper Zero serious competition. (more: https://kode.diy) Stability AI's Stable Audio 3 Medium and LiquidAI's LFM2.5-230M both hit HuggingFace trending this week, adding to the steady stream of open-weight releases across modalities. (more: https://huggingface.co/stabilityai/stable-audio-3-medium) (more: https://huggingface.co/LiquidAI/LFM2.5-230M)