GitLab discovers widespread NPM supply chain attack(about.gitlab.com)

330 points by OuterVale 11 months ago | 181 comments

GitLab blog post describing a widespread npm supply chain malware attack that includes a "dead man's switch" capable of harming user data.

Open source projects could sell SBOM fragments(thomas-huehn.com)

99 points by Tomte 1 year ago | 56 comments

How Dactyl Works(dactyl.dev)

60 points by anorak27 1 month ago | 12 comments

OpenTelemetry Tracing in < 200 lines of code(jeremymorrell.dev)

213 points by masterj 2 years ago | 28 comments

Agent orchestration for the timid(substack.com)

104 points by markferree 9 months ago | 27 comments

Now it's PostgreSQL's turn to have a bogus CVE(opensourcewatch.beehiiv.com)

151 points by elorant 3 years ago | 80 comments

What Security Teams Need to Know About Agents Using Abliterated Models(eve.security)

5 points by mooreds 17 hours ago | 0 comments

Eve Security blog post explaining abliterated open-weight models and how security teams can detect, govern, and block AI agents that use them.

Small models also found the vulnerabilities that Mythos found(aisle.com)

1206 points by dominicq 6 months ago | 321 comments

AISLE blog post arguing that small open-weights models reproduced much of Anthropic Mythos's showcase vulnerability analysis, framing AI cybersecurity capability as jagged.

Recent AI model progress feels mostly like bullshit(lesswrong.com)

474 points by paulpauper 1 year ago | 375 comments

LessWrong linkpost essay arguing recent AI model improvements feel overstated, based on experience building an AI codebase security-scanning startup.

A new model for open source: closed to pull requests, open to remix(ghuntley.com)

9 points by ghuntley 11 days ago | 5 comments

Geoffrey Huntley blog post proposing an open source model where projects reject pull requests but invite others to fork and remix the code.

LLMs aren't world models(yosefk.com)

330 points by ingve 1 year ago | 189 comments

Blog post by Yossi Kreinin arguing that large language models are not world models, illustrated with examples like LLMs losing track of chess board state.

AWS Bedrock to require sharing data with Anthropic for Mythos and future models

369 points by TomAnthony 4 months ago | 216 comments

Hacker News discussion of Anthropic requiring 30-day data retention for Mythos-class Claude models on AWS Bedrock, moving data outside AWS's security boundary.