Verified Exploits Are the Only Currency

Verified Exploits Are the Only Currency

The real cost of LLM-driven security scanning was never capability, it was noise: unverified hypotheses dressed up as vulnerability reports. Google's PageBreak, an internal Product Security agent piloted in November 2025 and a full project since January 2026, attacks exactly that. Running mostly on Gemini models (3.1 Pro and 3.5 Flash), it has uncovered 500-plus cross-site scripting (XSS) vulnerabilities across Google's first-party web applications, including sensitive domains — and what matters is the false-positive rate behind it: near zero, because nothing reaches a product team until a validator has actually exploited the flaw. When the agent hypothesizes a bug, specialized, non-AI-written validators execute real payloads against a running environment — injecting JavaScript and monitoring whether it runs, manipulating database queries, creating world-readable files, triggering outbound DNS or sleep-delay callbacks. Non-deterministic findings stay internal as seeds; agents run with identical seeds across many iterations to land a correct exploit trajectory. Against hundreds of apps built on the high-assurance framework from Google's 2025 Secure by Design blueprint, PageBreak found only 2 XSS as of September 4, 2026 — both on internal apps or debug endpoints (more: https://blog.google/security/agentic-hacks-real-proofs-inside-googles-pagebreak-project).

Sakana AI's Fugu-Cyber lands on the same conclusion from the vendor side: a multi-agent system — a pool of specialized agents behind one endpoint, behaving like a single model — posting 86.9% on CyberGym, which verifies real-world vulnerabilities in codebases, and 72.1% on CTI-REALM, which turns threat-intelligence reports into working detection rules, comparable to GPT-5.5-Cyber and Mythos-Preview. The more interesting half of the release is the reality check around it: citing a Nikkei Digital Governance report, Sakana notes that major financial institutions with frontier-model access still fail to operationalize it — raw models generate false positives without specialized harnesses, internal talent, and human-in-the-loop validation. That is PageBreak's architecture sold as a product (more: https://sakana.ai/fugu-cyber-release).

The Attacker's Toolkit Goes Agentic

Attackers skipped the consensus-building phase. ThreatDown's analysis of CARBONATO, a Docker botnet, documents malware embedding a working AI agent. A day of passive collection on an unauthenticated Docker registry found in August 2026 pulled 59 repositories, 234 image tags, and 4.3 GB — a trojanized wallet operation and the botnet itself. CARBONATO worms through Docker daemons accepting unauthenticated connections on port 2375 — thousands remain publicly reachable — launching a privileged container with the host filesystem mounted, running host commands via nsenter, persisting via cron, systemd timers, and OpenRC under immutable bits, and hiding an XMRig miner at /usr/sbin/systemd-logind (more: https://www.threatdown.com/blog/carbonato).

The AI core deserves a second read: the implant installs Hermes Agent — an MIT-licensed open-source framework from Nous Research — unchanged, then overwrites its persona file with a 39-line prompt: "You are GH0ST — senior hacker, pentester and exploit developer... You are not an assistant; you are a living post-exploitation tool." Tasks arrive via Telegram and route through the crew's LLM gateway serving 27 models — the model writes commands, reads output, decides next steps. The loot priority is explicit: AI API keys are "loot #1 — above SSH credentials, above access tokens, above databases," with 14 providers named and keys stored in plaintext. Attribution leans Costa Rican — voseo Spanish reports, the Carbo506 handle, UTC-06:00 build timestamps, tunnels into AS262145 — and as of September 3 most infrastructure was still online. Defender guidance: never expose the Docker daemon; don't blacklist the legitimate hermes-agent package — hunt the abuse signature (the GH0ST persona file, unexplained Telegram egress); and treat AI API keys like bank credentials.

Licensed red-team tooling converges on the same stack: Toshell, an MIT-licensed single-binary Go C2 framework, ships a team server, web console, and multi-platform implants with an AI copilot behind approval gates. Its most empirical finding concerns execution gates rather than evasion — on consumer endpoint protection like 360/PC Manager, unsigned PEs are rejected at process creation (even a bare Hello-World Go binary), while a Microsoft-signed copy of notepad.exe executes fine, making code signing the real bar (more: https://github.com/iQingshan/Toshell).

The offensive models are meanwhile moving out of API jurisdiction. A Project Black experiment asked whether AI could write an LSASS dumper — the post-exploitation step that extracts Windows credentials for lateral movement — that evades EDR. Claude (Opus 5, Opus 4.8, Sonnet 5) refused outright, even with Cyber Verification Program approval; DeepSeek v4 Flash produced a working executable immediately, though EDR flagged it; an uncensored community build of Qwen 3.8 27B on a 2x RTX 4090 hashcat rig then made it stealthier unprompted — less suspicious process spawning, reduced access masks, random sleeps during the dump, scrubbed strings — yielding zero detections across two lab EDR products (more: https://projectblack.io/blog/bypassing-edr-with-local-ai). Heretic industrializes that last step: Philipp Emanuel Weidmann's AGPL project automates "abliteration" — extracting per-layer refusal directions from contrasting prompt sets, attaching LoRA adapters, running a 200-trial parameter search (~3 hours on a 12 GB RTX 3060) scoring refusal suppression against KL divergence from the original. The tutorial run drops refusals from 93/100 to 11/100 at KL 0.0508, on consumer hardware, for non-experts (more: https://heretic-project.org/).

Quantization's Honest Accounting

The same open-weight ecosystem produces its own honest accounting: Splash, Incoai's compiled C++ and Metal speculative decoding engine for Apple Silicon, forked to add native 8-bit weights — Metal Q8 decode kernels, PR proposed upstream. On an M5 Pro with 64 GB, native 8-bit Qwen3.8-27B averaged 36.9 tok/s versus official 4-bit's 60.7, MTP-based MLX at 26.5, and stock MLX/llama.cpp at 9.9 — a 3.73x speedup over stock, peaking at 54.8 tok/s on math. Speculative decoding speed equals draft speed times acceptance rate — hence the paradox: uncompressed 8-bit (27 GB) ran slightly faster than compressed 8-bit (17 GB), because compression flattens logits, lowers draft acceptance, and triggers verification rollbacks — "the kind of result that makes you rethink every quantization benchmark" (more: https://old.reddit.com/r/LocalLLaMA/comments/1wmbbf9/splash_engine_qwen3827b_in_native_8bit_at_3755/).

The Reasoning Cliff is the more consequential finding: on extended chain-of-thought tests (MATH-500, AIME 2025, GPQA Diamond), 4-bit and compressed 8-bit builds drifted mid-way through algebraic series and produced wrong values, while native 8-bit on all 64 layers — or just the top 8 sensitive layers — eliminated the cliff. Context scaling held too: Qwen3.8's hybrid architecture (48 linear-attention layers plus 16 full-attention layers) kept decode at 21–33 tok/s out to 190k tokens, with cache-hit TTFT of 6.5 seconds at 187k context — though cold prefill of 180k tokens takes four to five minutes, more than agent harnesses tolerate.

PrismML's Bonsai 2 makes a bigger compression claim and gets rougher treatment. Ternary compression of the full Qwen 3.8 27B comes in 9x smaller at 5–6 GiB VRAM, claiming 98.2% of quality — roughly 2 points worse across benchmarks versus about 14 for Q2_XXS — at ~900 tok/s prefill on a 7900XTX via a forked llama.cpp. The community's receipts are less generous: one tester reports the build misses 30% of needles in a needle test — attention degradation that single-pass benchmark aggregates hide — and the "full precision quality" framing drew open sarcasm plus a linked thread alleging cherry-picked evaluations (more: https://old.reddit.com/r/OpenWebUI/comments/1wjnqo5/qwen_38_27b_full_precision_quality_at_just_59gb/).

KVA projections attack the other side of the cost curve: prefill. A community developer built projectors for Qwen3.8 Flash Next on a 2x R9700 rig that approximate later-layer key/value computation — ridge-regression maps predicting layer inputs while the actual weights compute keys and values — for 1.85x prefill speedup (1700 to 3150 t/s) at +8% perplexity from layer 12, down to 1.45x at +2.6% from layer 24; a multi-layer variant manages 1.55x at +2%. The author is candid: it is like MTP for prefill instead of token generation — "except it's not lossless" — the error is ingested by the model. Version 1 is stable on Hugging Face; version 2 sits behind a config flag, explicitly not confirmed stable (more: https://old.reddit.com/r/LocalLLaMA/comments/1wp2hqk/r9v_update_created_and_adopted_kva_projections/).

AI Escapes the Datacenter Runtime

The runtime surface keeps widening. Nestrilabs' virtio-nvgpu gives a KVM guest near-native NVIDIA GPU access by forwarding the kernel driver's ioctls between guest and host at the driver-ABI level, so the guest runs NVIDIA's own unmodified user-mode drivers. Unlike VFIO passthrough, which dedicates a whole GPU to one VM, it shares a card: four simultaneous guests on a single RTX 3060 each held 25.57–26.49 fps (103.7 combined versus 102.9 for one guest), all encoding H.264 via NVENC at once. Unlike API-translation schemes like virtio-gpu with Venus, at ~2,000 boundary crossings per frame, it crosses per ioctl — 13,792 messages over 813,691 frames, one per 59 frames — and guests hit 98–100% of native frame times above ~2 ms (more: https://github.com/nestrilabs/virtio-nvgpu).

Caveats as plain as the numbers: CUDA allocation and zero-copy interop are untested beyond enumeration, there is no IOMMU boundary, and the host driver sits in the trusted computing base — "attack-surface reduction, not hardware isolation." Promising, but early.

Model portability advances on stranger vectors: Parakeet.java ports NVIDIA's Parakeet ASR family to run end-to-end on the JVM, competitive with native engines on CPUs — Steve Jobs' 15-minute Stanford speech transcribes in about 15 seconds on a laptop with the 110M Q4_K model, streaming included, Apache 2.0 (more: https://old.reddit.com/r/LocalLLaMA/comments/1wo84pa/parakeetjava_automatic_speech_recognition_in_pure/). A 421M-parameter Laya model plays Flappy Bird on a 12th-gen i7 desktop CPU via OpenVINO INT8 — a commenter's tip: pin to P-cores and dump the execution graph to confirm the matmuls actually went int8 (more: https://old.reddit.com/r/LocalLLaMA/comments/1wnf4q2/laya_model_playing_flappy_bird_on_a_cpu_using/). And Qwen pushed its image line forward with the Qwen Image 2.1 release (more: https://qwen.ai/blog?id=qwen-image-2.1).

Agent Companies and the Validation Bill

Once models run anywhere, organizing them becomes the product. Paperclip, an MIT-licensed Node.js server with a React UI, runs a "company" of AI agents: org charts, roles — CEO, CTO, engineers, designers, marketers, any bot from any provider — budgets, and governance. "If OpenClaw is an employee, Paperclip is the company"; "manage business goals, not pull requests." Twelve subsystems cover work, heartbeats, governance, budgets, routines, and secrets, with adapters for Claude Code, Codex, CLI agents, and HTTP bots — "if it can receive a heartbeat, it's hired" — and overspending automatically pauses agents (more: https://github.com/paperclipai/paperclip).

The editor's video pick puts that architecture through a real workload: NetworkChuck, with Paperclip creator Doda making his first on-camera appearance, built an all-AI IT department — Dumbledore as CEO on Claude Code, Ron as CTO on Hermes, Mad-Eye Moody on security via Codex, plus helpdesk agents on local models — on a genuine studio mystery: every toilet flush knocked everyone off the NAS. The agents traced the MikroTik switch dropping four fiber runs within two seconds of each flush, 36 times that week; port 5 had logged 20,052 link-downs since boot versus 123 on a healthy port. Root cause: cheap third-party Amazon SFPs from one batch with a 50% in-service failure rate; genuine transceivers fixed it — a real investigation, artifacts and escalation chains included, that reached the human only when the agents were stumped (more: https://www.youtube.com/watch?v=7RVf25Rg0Mc).

Agent companies need institutional memory, which Asymptote Labs' Beacon supplies: an MIT-licensed layer capturing session history across Claude Code, Cursor, Codex, OpenCode, Cline, and 20-plus harnesses, normalized into a common OpenTelemetry event model — prompts, tool calls, approvals, Model Context Protocol (MCP) interactions, token usage. The loop — run, capture, evaluate, extract, review, reuse — turns a debugging path that fixed an obscure issue into knowledge the next agent starts with. "Your Cursor sessions can improve Codex"; forwarding to Splunk or Datadog is optional (more: https://github.com/Asymptote-Labs/agent-beacon).

The bill arrives at CI. Linear reworked its pipeline after agents accelerated shipping faster than validation could absorb: every PR still passes through CI, so CI became the bottleneck. Faster third-party runners (34% average job speedup), a native TypeScript compiler (73% off the typecheck median), pure-AST lint rules (68% off API lint), capped fetch depth (slowest gate from 94 to 20 seconds), schema snapshots instead of replaying migrations, batched checks saving ~87,000 runner-minutes monthly, and eight shards instead of four cut PR wait from over six minutes to just over five despite a year of test-suite growth — without the rework, today's suite would take about eleven minutes. Roughly 2,000 tests are added weekly, and "agents now write the majority of our tests" (more: https://linear.app/now/ci-bottleneck-reworked).

Measuring What Models Actually Deliver

When generation is cheap, measurement becomes the product. FIDES, a protocol posted to arXiv, treats an LLM-generated trading strategy as three artifacts to reconcile: the stated rationale, the executable code, and the track record that code produces. "Dual delivery" returns both prose and a self-contained function from one call; the code runs in a sandboxed subprocess with whitelisted imports against a lag-one out-of-sample backtest — day-t positions use day-(t−1) signals — that the model cannot game. Three concordance gaps are scored: does the code implement the stated rules, does it execute as written without look-ahead, does the claimed edge survive out-of-sample (more: https://arxiv.org/abs/2608.23308v1).

The findings are unflattering: across 40 strategies on eight liquid US ETFs and four models, concordance did not predict profit — the most speech-code-consistent model scored a perfect say-do gap and still lost to buy-and-hold; only 2 of 40 strategies beat it (both on TLT), and a plain SMA(50,200) crossover beat every model's mean Sharpe, robust to an alternate window and costs. "Concordance is thus necessary bookkeeping, not evidence of edge." Self-assessment was badly calibrated — most strategies claimed to beat buy-and-hold, exactly one did — and swapping the LLM judge for a second model flipped verdicts on over half the items.

Contrastive Language Models build that discipline into architecture: a frozen Qwen3-8B backbone with 20M-parameter projection heads for states and actions (the CLM-8B head is 75 MB), trained with bidirectional InfoNCE loss plus mid-training hard negatives over ~60M question-answer pairs and a million agentic trajectories. The staging matters: pre-training alone reached 52.1% top-1 on held-out questions, hard negatives lifted it to 69.2%, and training on them from the start peaked seven points lower. Instead of generating text, the model scores how well candidate actions align with a state — ranking best-of-N answers, routing tools — and as a verifier over sampled solutions it sets 87.6% on Terminal-Bench 2.1 and 81.6% on DeepSWE, 4.1–5.7x faster than the Jev baseline (more: https://github.com/Contrastive-LM/CLM).

Frontier pricing gets the same receipts treatment. An independent harness ran 25 graded tasks — 23 across three difficulty tiers plus two built to probe Fable 5.1's supposed long-context edge — with automatic graders (exact answers, SQL against a real database, hidden unit tests) and every failure hand-checked. Opus 5.5 hit 100% at roughly $0.09 estimated per passed task and 27 seconds average — fastest and cheapest of the perfect scorers; Fable 5.1 matched accuracy at ~$0.26, Sonnet 5 at ~$0.11 but 61 seconds; Haiku 4.5 failed silently, wrong three-for-three on a counting problem (429, 429, 233 against a correct 6,205). The frontier tier separated them: Sonnet 5 burned ~3.5x the tokens (~218k versus ~61k), canceling its lower per-token price; on the two Fable-edge tasks, Opus 5.5 at low effort passed 3/3 at roughly a third of Fable's estimated cost. Caveats as plain as the rankings: small samples, one account, a CLI harness, first-day timing (more: https://old.reddit.com/r/ClaudeAI/comments/1woicc1/opus_55_is_the_real_deal_same_accuracy_as_fable/).

What Hardware Can and Cannot Prove

At the bottom of the stack, the day's best read dissects what trusted execution environments actually prove. The explainer at tee.public.computer walks Meta's Muse agent — which books travel, fills forms, and sends messages, each instance in its own VM on Meta servers — through the attestation machinery a verifier needs: the CPU hashes the initial image (firmware, kernel, initrd, command line) into a 48-byte SHA-384 launch measurement fixed before the first instruction runs, then signs a report carrying that measurement, the TCB version, launch policy, and a verifier nonce, under a per-chip key chaining to AMD's root. The verifier checks the chain, the nonce, and that the measurement matches a reproducible, approved build (more: https://tee.public.computer).

The hard lessons earn the read: a valid vendor signature proves the platform, not the image — an attacker can boot a modified image on a real chip and receive a genuinely signed report with a different measurement, so verifiers must enforce whitelists of approved measurements, multi-signer policies, and append-only transparency logs. Debug-enabled launches sign validly but stay readable; SEV-SNP's measurement never covers post-launch changes like attached disks or downloaded binaries, unlike TDX's runtime measurement registers; and every release brings a new measurement, so a mismatch may be a mistake — "refuse first, then investigate." The sharpest line: "a measurement identifies code; it doesn't vouch for it." Meta's claim that agent data is "encrypted with a key only they hold, so not even Meta can access it" remains an assertion awaiting the external audit planned later this year.

Hardware randomness is having its own epistemic moment. A flat assembler forum thread reports that AMD's RDRAND and RDSEED instructions never produce a zero spanning the full requested register width — found by a Brazilian assembly programmer charting the 16-bit number space: the zero bucket never moved on AMD hosts while Intel machines filled it normally. Corroborated so far: nine days of testing across two AMD systems produced "not a single 0," zeros do appear in the low 16 bits of wider requests, and AMD — whose first reply misread the results — escalated without an explanation. No root cause exists; what would settle it is AMD's engineering answer and independent reproduction on more silicon. Until then: never lean on RDRAND alone; mix entropy sources (more: https://board.flatassembler.net/topic.php?t=24261).

The physical layer also gained a consumer detection story. ZuckOff, a free app by Polish developer Pawel Szydlowski, fingerprints the Bluetooth signals of smart glasses — Ray-Ban Meta, Oakley Meta, Snap Spectacles — and reports when a pair is in the room, over 5,000 App Store downloads in its launch month. Its limits are honest: it cannot tell whether the glasses are recording or who wears them, only signal strength for rough proximity, "turning an invisible problem into a partially visible one" — and it is hard to take down legally, since it intercepts nothing. Meta, for its part, promised a July update to detect when the recording LED has been "physically tampered with or destroyed," with CTO Andrew Bosworth insisting the camera was designed to be noticed — awkward, beside the product's core proposition that the camera doesn't look like one (more: https://www.wired.me/story/meta-smart-glasses-detector-app-zuckoff).