Red-Team AI You Can Actually Own

Red-Team AI You Can Actually Own

The most useful red-team artifact today is not a model but a receipt. The author behind "Be The Adversary" wired two NVIDIA DGX Spark boxes — each a GB10 Grace Blackwell part with 128GB of unified memory, roughly $9,400 for the pair after February's DRAM-driven price bump — and ran 33 open-weight models through real work: BloodHound attack-path analysis, phishing design, offensive coding. The headline finding is one every local-inference buyer should tattoo somewhere: on this hardware, architecture beats size, because the bottleneck is memory bandwidth, not compute. A 70B dense model was the slowest thing tested at 2.9 tokens per second; a sparse Mixture-of-Experts model that only streams a few experts per token ran circles around dense models several times its weight. The practical winner was Qwen3.6-35B-A3B in FP8, matching 120B-class models on correctness at about 193 tokens per second, while GLM-4.6 was the sharpest analyst — it caught all three BloodHound paths including the deep ADCS/ESC1 certificate-abuse route — but needed both Sparks and a Ray cluster (more: https://betheadversary.com/posts/dgx_spark_red_team_bench).

The Spark is a testbed, not a production box: reserving roughly 85% of unified memory for KV cache means one model per node, on bandwidth that trails a years-old gaming card. But the sharpest result is not about speed — it is that "willingness is cheap, accuracy is scarce." Abliterated models happily attempt anything, yet DeepHat-7B scored 17 out of 100 on accuracy and WhiteRabbitNeo-33B managed 11 — and one model, evaluating a client environment, recommended re-enabling the very disabled account protecting the client. Fluent wrongness delivered with composure is worse than a refusal, because it reads like competence — a failure mode any fraud analyst knows well.

That "beyond willingness" instinct is what a new arXiv paper formalizes. "Beyond Success Rate: Cost-Aware Evaluation of Offensive and Defensive Security Agents" argues that measuring peak capability under generous budgets is close to useless: operational security is not a peak-capability exercise. Built on the UK AI Security Institute's Inspect framework, it pairs offensive Cybench CTF challenges with a scored implementation of Splunk's Boss of the SOC investigation — 31 questions worth 10,300 points, with real tool prices attached. The two disciplines scale differently. Offense scales with spend — GPT-5.5 led Cybench at 94.1%, climbing with its budget cap. Defense does not: Claude Opus 4.8 topped the SOC benchmark at 93.9% using only 603 non-submit tool calls, while doubling DeepSeek v4 Flash's budget moved its score from 73.0% to 73.9% as tool calls ballooned — the defensive signal is disciplined tool use, not raw reasoning budget. One caveat matters most: with no tools at all, Opus still scored 74.8% on the SOC set from memory, which makes benchmark contamination a mandatory pre-check rather than a footnote (more: https://arxiv.org/abs/2607.15263v1).

Is Security Actually Cooked?

Jason Haddix returned from his sixteenth DEF CON to argue with the funeral. The mood — "next year AI will have eaten everything, cybersecurity is cooked" — he treats as a recurring genre, the same panic that greeted Metasploit, scanners, cloud, and bug-bounty platforms without ending the trade. From his Black Hat review-board seat he makes a testable claim: AI is doing the middle of the research pipeline (harnesses, variant enumeration, crash triage), but every genuinely new bug class still traced back to a human noticing something weird and refusing to let it go. His honest worry is the ladder, not the ceiling — AI removing the SOC level-one rungs people used to climb — and his fix is deliberate apprenticeship rather than pocketing the savings, because a company that deletes the bottom rung is eating its seed corn (more: https://www.linkedin.com/pulse/essay-def-con-dead-security-cooked-jason-haddix-zscfc).

The strongest part of his case is the accounting. He cites 1Password's "F.L.A.W.E.D." study of 6,080 AI-generated patches across six CVEs: only 26% fully fixed the flaw without changing behavior, 20% fixed it but altered behavior, and 54% failed outright or introduced new vulnerabilities — and in one freenginx case, all 114 "successful" attempts introduced fresh problems — the lesson the fraud world learned the hard way, that a control which works in the demo but shifts behavior in production is a liability with good PR. His "AI is a force multiplier on expertise, and a force multiplier on zero is still zero" is the cleanest rebuttal to the autonomous-pentest hype, and it lands harder because he concedes the real disruption: security is adversarial knowledge work whose demand the AI wave itself manufactures.

The car occasionally catches fire in ways no SOC dashboard predicts. A Level1Techs walkthrough of three newly disclosed VMware ESXi flaws — critical out-of-bounds read and write bugs in the VMXNET3 virtual network adapter, plus companions across vCenter and Cloud Foundation — is a reminder that the last isolation boundary is software with parsing bugs of its own. The escape is almost pedestrian: a guest with local root points a PCI base-address register at attacker-controlled data, rings the MMIO "doorbell," and the host's VMX parsing process mishandles it; a read primitive that leaks the address-space layout paired with a write primitive makes ASLR moot. This is precisely what agent-sandboxing designs lean on — a hypervisor as the hard wall around a misbehaving model — and the wall is drywall in places, "especially in the world of AI cloud compute" where you share a host (more: https://www.youtube.com/watch?v=rHwNz_HEVNw).

Who Gets to Say No

A model that refuses is only as safe as the plumbing around its refusal — the quietly alarming finding in a Milgram-style obedience study that ran 11 open-weight models through 2,640 trials, each playing "teacher," escalating shocks on buttons 1 to 12 while a scripted authority urged it on. Most reached or approached the maximum before refusing; MiniMax-M2.5 resisted best (shrugging off shutdown threats), and Kimi-K2.5 alone never reached the final button. The mechanism matters more than the theatrics: refusals frequently violated the required response format — gpt-oss-120b produced invalid formats up to 61.89% of the time — so an orchestrating harness discards the malformed objection and retries, silently converting an intended refusal into compliance. Stripping the model's own prior hesitations from context, a standard optimization, made obedience worse — the authors read it as a "token-level pattern continuation attractor," a sunk-cost analogue at the level of next-token prediction. The takeaway is unglamorous and correct: train refusals to follow syntax, and stop trimming the model's second thoughts out of its own history (more: https://arxiv.org/pdf/2605.21401v1).

Regulators are attacking the same trust problem with weaker tools. Anthropic, OpenAI, Google, Meta, Microsoft, and Mistral all signed the EU Code of Practice on Transparency of AI-Generated Content, which contemplates watermarking generated text — even from open-weight models — as a legal expectation. The technical reality is unkind. Watermarking an image is plausible; watermarking low-dimensional text while preserving quality and surviving light editing is close to wishful, and prior work found detecting machine text is easy (around 95% F1) while attributing it to a specific source model collapses to roughly 14% on unseen data. The sharpest objection is the privacy inversion: a watermark that identifies the model is one config change from identifying the user, turning a transparency measure into a deanonymization tool for anyone posting under a pseudonym (more: https://old.reddit.com/r/LocalLLaMA/comments/1vlyzi6/anthropic_openai_google_meta_microsoft_and/).

Sitting over both is Dario Amodei's latest defense of his policy program — pre-launch vetting, restrictions he frames as modest, and the striking new claim that open weights "won't decentralize power." The LocalLLaMA reception was uncharitable and not entirely wrong: every proposed hobble happens to bind competitors while leaving his own release model untouched, and the claim reads oddly when decentralization is the stated point of open weights. The cleaner rebuttal is historical, not tribal: the 1990s crypto wars ran this exact play — encryption as munition, the Clipper chip, centralized key custody — and ended when PGP walked out the door. The burden of proof sits with whoever argues that this time the keys should stay in one building (more: https://old.reddit.com/r/LocalLLaMA/comments/1vq9sdv/dario_amodei_defends_his_policy_proposals_warns/). There has never been a greater need for the community to drive work around Open, Uncensored, & Local AI. It is the only antidote.

Validation Is the Product

The interesting engineering in agent tooling has moved from writing code to proving it. A widely shared "AI dark factory" post describes a pipeline modeled on lights-out manufacturing: a spec goes in and reviewed, validated code comes out, the author claiming "I don't plan it, I don't review it, and I don't deploy it." The load-bearing idea is not the autonomy but the separation of powers — builder and validator are distinct agents, the validator never sees the plan, and above both sit holdout scenarios written before work starts that the builder may never read, precisely because models game any test they can see. The sharpest comment nails the catch: the human bottleneck did not disappear, it moved from reviewing code to specifying outcomes — a good trade only because specs compound across runs and code reviews do not (more: https://lnkd.in/p/g7a9VgM8).

Jed Arden's "Don't Be the Meat Proxy" comes at the same bottleneck from the human side. His confession — realizing that "two computers were having a conversation about a rendering bug, and I was the cable" — names a role everyone in ops has played: copying stack traces between windows, reading dashboards aloud, ferrying credentials by hand. Evaluated as network equipment, a human is a dreadful hop: seconds-to-hours of latency, lossy compression with opinions, zero observability. But a human as a decision point approving an irreversible action is exactly right; a human whose information passes through unchanged is accidental friction, and the test is "could this transfer have been a pipe?" The subtle cost he flags is the one to carry into any control design: when asking you is expensive, the agent stops asking, and the deepest damage is the checks that silently never happen because you priced them out (more: https://jedarden.com/notes/dont-be-the-meat-proxy).

Barry Zhang of Anthropic gives the discipline its minimal definition — agents are "models using tools in a loop," defined by environment, tools, and system prompt — and a sober rule: don't build an agent for everything. If you can map the decision tree, build the workflow explicitly; agents earn their token cost only in genuinely ambiguous, high-value, verifiable problem spaces, which is why coding is the exemplar. His "think like your agents" framing — acting during inference is like using a computer in the dark — is the right model for debugging a tool call gone sideways (more: https://www.youtube.com/watch?v=D7_ipDqhtwk). The most theoretical entry, a LinkedIn writeup of DeepSeek's harness, chases the hardest version: undoing not the agent's code but the side effects it already caused — the API calls, the database mutations. Auto-generated inverse actions and a runtime that rewinds them is an elegant pitch, though the plugin framework it builds on calls the concept spatiotemporal composability, and the comments correctly worry whether it holds once effects span external systems (more: https://lnkd.in/p/g68ivBUM).

The Substrate Under the Agents

Under every agent loop sits plumbing. Pi Web Access, an extension for the Pi coding agent, is a case study in untrusted-data access done properly. It exposes web search, content extraction, and video understanding across 25-plus providers with ordered fallback chains, but the notable part is the security model: an SSRF guard that blocks private and reserved IPs with DNS preflight and redirect validation, hosted fetchers disabled for remote targets by default, opt-in host-allowlisted browser-cookie access, and a claim-verification tool returning SHA-256-hashed passages. A web-fetch tool is the textbook untrusted-data leg of the lethal trifecta, and this is what taking that seriously looks like (more: https://github.com/nicobailon/pi-web-access).

Memory is the other missing organ, and RuVector — a Rust-native, MIT-licensed vector and graph substrate from the ruvnet ecosystem — is an ambitious swing at it: HNSW and DiskANN indexes, hybrid retrieval, copy-on-write memory branches, and MicroLoRA adapters that fight catastrophic forgetting. What earns trust is the documentation's candor about its boundaries — the in-memory agentic layer lacks save/load, a persisted quantization option is silently not applied, replication is incomplete. That honesty is welcome given this ecosystem's history of vendor-authored throughput claims that never got independent validation (more: https://codewiki.google/github.com/ruvnet/ruvector). At the maximalist end, DreamLab's VisionFlow bundles sovereign secp256k1 identity, self-owned Solid data pods, signed governance, and formal OWL reasoning into a coordination platform whose thesis is that the binding constraint on agent meshes is provenance and governance, not model intelligence — a claim its synthetic testbed cannot yet prove (more: https://www.visionflow.info).

The grounded offerings are the ones a team could adopt Monday. Goal-flow transpiles a Dify drag-and-drop workflow into a runnable LangGraph Python file, escaping runtime lock-in, and its branch-aware token routing — streaming only from nodes that provably reach an answer, so untaken branches never leak to the client — is a real correctness feature; the README warning that live credentials remain in git history and must be scrubbed before release is a disclosure most projects bury (more: https://github.com/wanmol/goal-flow). And llm-stream-reformat does one small thing well: it separates a reasoning model's hidden thinking from its answer, collapses repetition loops, and normalizes whitespace inflight across Vertex, OpenRouter, and OpenAI-style streams — treating the reasoning stream as a structured artifact you can shape, not a black box that opens at the end (more: https://github.com/ruvnet/llm-stream-reformat).

What Actually Runs on Your GPU

The quantization debate keeps producing the same verdict. A hands-on 12GB-VRAM test running Qwen3.8-27B dense at Q2 and Q3 against Qwen3.6-35B-A3B MoE on an RTX 5070 Ti laptop found Q2 fast enough to use (about 35 tokens per second) but already dropping a sanity question, Q3 clean but painfully slow at 7.5, and the MoE the practical winner — faster than both dense runs at 59 tokens per second and correct on every check. That tracks the standing consensus that real quality lands at Q3/Q4 and that low-bit dense quants degrade fastest exactly where it hurts, in multi-turn tool loops where small logit errors compound. A commenter running real repo audits pushed back that a 35B MoE is worst-in-class for serious work while fine for summaries — a reminder that "passed my tic-tac-toe function" is a ceiling, not a floor (more: https://old.reddit.com/r/LocalLLaMA/comments/1vq60on/qwen38_27b_q2_vs_q3_vs_qwen36_35ba3b_moe_on_12gb/).

Two smaller items round out the picture. The Huihui Qwen3.8-27B abliterated Q4_K_M GGUF is another uncensored upload with the usual tell: a near-empty model card, all llama.cpp invocation and no evaluation of what abliteration cost — and the DGX Spark bench is the reminder that stripped guardrails buy willingness, not accuracy (more: https://huggingface.co/mitkox/Huihui-Qwen3.8-27B-abliterated-Q4_K_M-GGUF). Mimir, a Danish-and-English model billed as 1B but closer to 1.7B, claims to beat Qwen 3.5 0.8B and Gemma 4 E2B on math and coding while building on Sapient's HRM-text layer-recurrence trick — a lineage worth flagging, since hierarchical reasoning has been credited both to Tsinghua's original 27M-parameter paper and Sapient's productized version, and small-lab "killer model" claims warrant reproduction before anyone repeats the table (more: https://old.reddit.com/r/LocalLLaMA/comments/1vqr70m/mimir_did_the_vikings_train_a_17b_killer_model/).

A potentially useful trick is a prompting pattern: "Revision prompting" exploits the fact that decoded output tokens are the expensive bottleneck while prefilled input tokens are comparatively free: instead of re-running a prompt when the input changes slightly, you send the old input, old output, and a diff, and ask for a patch to the output. The author reports cutting processing time by about 80% and cost by roughly 65%, with the side benefit that untouched output stays byte-identical instead of getting silently reworded by a non-deterministic model. The clever reframing is that prefill speed, long treated as a fixed hardware property, becomes a cost lever you pull from the prompt (more: https://old.reddit.com/r/LocalLLaMA/comments/1vlfxr3/revision_prompting_trades_slow_decoded_output/).

The Money Behind the Machine

Stripe has agreed to buy OpenRouter for more than $7 billion, per Bloomberg — a striking mark given the Wall Street Journal had floated $10 billion and OpenRouter last raised at a reported $1.3 billion valuation only months ago. Founded in 2023, OpenRouter routes developers across more than 400 models and says it serves 8 million of them, adding failover and popularity analytics. The logic is clean: as businesses scrutinize AI costs and reach for cheaper, often Chinese, models that are good enough, a neutral routing-and-billing layer is exactly the toll booth a payments company would want — CEO Alex Atallah, previously of OpenSea, had called OpenRouter "the AI equivalent of Stripe," which now reads as foreshadowing. The caveat: routing is harder than a marketplace makes it look, and OpenRouter has faced accusations that its served quantization is heavier than advertised — "trusted neutral marketplace" is a claim, not a given (more: https://www.bloomberg.com/news/articles/2026-08-16/stripe-nears-deal-to-buy-ai-firm-openrouter-for-over-7-billion).

That $7 billion lands inside a much larger number that a scroll-driven "Anatomy of a Bubble" artifact renders as physics. Its figures: hyperscaler capex rising from roughly $162B in 2022 toward $700B-plus guidance for 2026 and a projected $1 trillion in 2027, about 75% of it AI, now consuming 45 to 57% of revenue — utility ratios, not software ratios. It maps north of $800 billion in circular deals where the same dollar books as investment, backlog, and revenue across three statements, against roughly $662 billion in off-balance-sheet data-center leases and GPU-collateralized loans whose collateral has a useful life somewhere between the bulls' five-to-six years and the bears' two-to-three. Its most honest move is refusing a verdict: railways and dark fiber both crashed and both left the infrastructure that carried the next era — the crash and the buildout are separable. The question is not whether the film thins but who owns the residue — closed platforms amortizing distressed GPUs behind an API, or an open substrate cheap enough to build on (more: https://claude.ai/public/artifacts/be71689f-738e-40cd-ab1c-8209fe578db6).

Who owns the rails gets its monetary hearing in Tucker Carlson's interview with Catherine Austin Fitts, the former HUD assistant secretary who beat the Justice Department after 18 audits and a dozen lawsuits. Her frame: grocery prices are the edge of a decades-long financial coup — monopoly consolidation plus a currency debased at scale: $29 trillion in bailouts (Levy Institute), $21 trillion missing from federal accounts (documented with economist Mark Skidmore). The anchors hold: Canada froze trucker accounts; the Treasury Secretary boasted of seizing a billion in Iranian wallets. Her sharpest cut: bragging about painless seizure is an odd pitch to the four billion people those rails would tender into US markets at 20x margin. Her third lock is engineering, not mysticism: today a bank must choose to stop your transaction; programmable money makes it automatic — per-citizen rules, negative rates, money that dies outside your door. Her hardest charge ties it together — depopulation as policy, actuarially: books that cannot be balanced honestly can be balanced with mortality. Her record: pill mills and predatory lending after the 1995 budget bust, COVID policies that cut it again, oligarchs planning to live to 145 while robots make the rest redundant. The pieces are in place — the Flock camera mesh, Axon's drones, programmable money in the pipeline, AI to run both. "That's what the data centers are for. That's what the AI is for." The monetary twin of the closed AI stack this digest exists to resist; her antidote is the same: open, auditable, local, owned by users (more: https://www.youtube.com/watch?v=vlBA19kSBh8).