AI found the holes. Someone's hunting your keys.Black
October.AI Finds PHP2Shell, Claude Duet, DeepSeek DeepInfer & Flint — ThursdAI Oct 22, 2026

0:00Alex VolkovAnthropic committed to 5% of its shares to a new Anthropic public benefit fund.

0:05Josh Longif you are running a PHP server, you need to make sure that it is patched. Like, hopefully you patched yesterday

0:12Alex VolkovOpenClaw and Hermes work the best with Anthropic models, and then Anthropic just shut them down. And now we finally see why. Hello and welcome everyone to ThursdAI for October 22nd. Cold open today, scary. The internet feels like it's failing, and a lot of it is potentially because of AI. So we're gonna talk about this. Uh, obviously we're not selling doom and gloom here, uh, but we do have, Josh Long, AKA the Joshmeister, joining us at the end of the show to talk about, to

0:51Alex Volkovbreak down some of the security incidents, uh, many of them powered by AI that just happened this week, many this month. If you heard anything about the PHP core vulnerabilities, if you heard about the GitLab RCEs, uh, and the, there's one not related to AI, which is the eMudra, certificate. We're gonna break it down to you and also give you practical things, what you can do today, right now, to protect yourself, uh, with your agents as well. But also we're going to talk about Anthropic stepping in to the personal agent era with Claude Duet, which I think to me is one of the,

1:30Alex Volkovthe highest highs. I just got access this morning. I'm so excited. I haven't even tried this. Um, we're gonna talk about a lot of stuff. Anthropic becoming a PBC, public benefit company, with giving away 5% of its value, um, a lot more. Joining me directly from GTC Berlin is Wolfram Ravenwolf from our booth at GTC Berlin at Corwe. Wolfram, how are you?

1:55Wolfram RavenwolfHi, Alex. I hope the audio is fine. I'm in the middle of the GTC.

2:00Alex VolkovThat is awesome.

2:00Wolfram RavenwolfAt our booth right now. I see still stuff going on over here.

2:05Alex VolkovYou're joining, from GTC with Jensen Huang standing by you, ready to do an interview, yes?

2:11Wolfram RavenwolfHere he is. Oh, that's another colleague of mine, but

2:14Alex Volkovthat is Jensen.

2:16Wolfram RavenwolfMaybe later.

2:17Alex VolkovAll right.

2:17Wolfram RavenwolfStill waiting for him to come along.

2:19Alex VolkovWe w- will definitely chat about some of the stuff that CoreWeave launched, in our new segment called From the Forge. And Wolfram, what are you gonna show us?

2:30Wolfram RavenwolfSome of this stuff here.

2:31Alex VolkovOh.

2:32Wolfram RavenwolfThis is a new one. The NVIDIA HGX Rubin NVL8, and this thing right here on the desk is 1.8, 1.2 million dollars.

2:45Alex VolkovOh.

2:46Wolfram RavenwolfJust for perspective.

2:47Alex VolkovCan you see if it attached to the table?

2:50Wolfram RavenwolfUh, I can't take it, sorry. Maybe later.

2:55Alex VolkovAll right, uh, we we have a big show, Wolfram, hopefully you can join us from the hotel, but it's great, that you're showing us the floor of GTC. the highlight for me, I tune into Jensen's, keynote, famous keynote, and yeah, the highlight for me is how strongly NVIDIA is leaning into the claws and that, previously, and like obviously you can see Jensen over there with claws on

3:17Wolfram RavenwolfYeah, yes.

3:17Alex Volkovon their hands. Yes. do the employees also wear claws, all of those folks? It looks like the employees have claws, like red claws, some of them.

3:25Wolfram RavenwolfYeah, yeah, there's a whole area dedicated to claws, but also Hermes agents or personal agents in general.

3:32Alex VolkovYeah. So, uh, personal agents, I think, is a huge thing, in GTC as well. Obviously, Jensen is kind of like, focusing on that, and he ended the show floor with the Hermes agent. We're also gonna chat about that as well. A big week. LDJ, welcome to the show as well. Um, I think, eh, we have to talk about the security stuff just after the TLDR, but, I think at times like this, you're, maybe you're happy that you're a non on the internet, no?

4:01LDJGood point, good point.

4:05Alex VolkovBecause stuff is... I don't want to doom and gloom, but there's a lot of vulnerabilities that we're, starting to see. again, we're gonna cover a lot of them at the end of the show. Today's show is full of guests, folks. this week also we saw a release from a company called Recursive AI, or Recursive SI, I guess. I think they rebranded. Uh, we're gonna have to keep up LDJ tabs on who did rebrand the to SI and who didn't. And, we're gonna have Tim Shi and Prince Kanuma talk about to us about Flint, which is a model that they, trained almost from scratch using a recursive process from, the Eureka machine, something they called the Eureka machine.

4:44Alex Volkovthey just announced it yesterday. So we're gonna chat about Flint as well. OpenAI has had quite a week since Dev Day. They said, hey, we're gonna either ship something or give you a reset, or for the next 30 days straight. They always kind of do that, and so they've shipped some caching updates, which are very, very, very interesting. and I think I'm really hoping everybody else will, will catch up. specifically that cache almost never, never expires, which is honestly quite crazy. Uh, and yeah, a lot of, a lot of big news, a lot of big news. I have a whole folder here that we need to get through. Aldija, what was, what was one highlight for you this week?

5:23LDJUh, yeah, there's a few. There is a Reflection Beam is now an artificial analysis, and and so we have some results there. There's a new DeepSeek Flash that was announced, and uh, besides that, there is just extra benchmark news of people auditing benchmarks, which I think is really good. Some, some flaws found in Terminal Bench 4, and uh, yeah, I think a lot of cool things to cover.

5:49Alex VolkovAnd we have Nisten Tahiray, who's now at DevRel at PrismML, and finally added the title, Nisten. Nisten, we are on the one highlight of the week that's the most important thing that, that you're, that you want to cover. if security is that for you, a reminder, we have a full segment about that, but please let us know.

6:10Nisten TahirajYou know you're locked in when you just, like, forget to check Twitter and uh, and do all of this stuff. The only reason I came back to check was because, uh, my Muse agent finally just ran out of, uh, out of quota, and, uh, I had to resort to using freaking DOD, which is just absolute garbage of a product. Uh, other than I really liked this new model, by the way. I started using it, uh, yesterday, the 42B coding model, uh,

6:42Alex VolkovFlint?

6:43Nisten TahirajYeah, yeah, yeah. I started running a lot of agents with Flint because it's, it's, it's extremely fast. Uh, it took a bit, look, it's not that good, it is still pretty tiny, remember, but it is extremely fast, and uh, I just put Haiku on a loop to just find out what was the best way to prompt it. And then once you figured that out, it was actually pretty close. I got it pretty close to doing the job of Haiku, maybe like 96% of the score. So, uh, I actually like that, that model, and uh, I think it's a, it's a little bit underhyped, if anything.

7:22Alex VolkovYeah.

7:22Nisten TahirajRight now. Uh, yeah, I would say that is, uh, that is the highlight.

7:29Alex VolkovI, we're gonna talk with Prince Kanuma, our friend of the pod, MLX King, who had day one support for Flint, and the Tim Shi from the folks at, Recursive SI is, hopefully gonna join us. We're trying to get Tim, so hopefully monitoring the, the channels, to talk to us about the best way that, that they know how to prompt. the cool thing about Flint is that they trained it in like 4 months using, recursive processes, so I'm really excited for that conversation. the highlight for me came in today. so shout out to Edwin Arbus and shout out to Adi Osmani for my invite for Claude Duet, which is, this is the highlight for me. It came literally yesterday, Anthropic announced their entry into the personal

8:10Alex Volkovagent era. Uh, personal agent, as we talk to you on the show now for almost a year, personal agents are AI agents that run in 24/7. They have their own computer, their whole- their own browser, and they are proactive. They're doing tasks for you because they have context for you. so Nisten just mentioned Muse and mentioned Dots, which is OpenAI's one. Claude is stepping into this era with Claude Duet, and I just got access, just set it up this morning, so I didn't have tons of time to play with it. but it already knew a bunch. So that, one of the biggest things that now is a problem in this era is if there's a new one, those products are very sticky.

8:52Alex VolkovAnd Nisten, maybe this is why one of the reasons why you're saying, Dots is not Dots for you, because the products are very, very sticky. It's only as good as the information and the context you give it about your personal stuff. And moving that and moving those connections, moving that data feels really, difficult right now. Not to mention many folks in this era, report on AI fatigue, AI agent fatigue. So, I don't have fatigue. I'm excited to check out Claude Duet. I think, I've been telling you guys on the show for the longest time what I wanted is exactly this format with Opus 5.5 intelligence, and that's what we got. So this is the highlight for me.

9:24Alex VolkovUh, I think with that, let's jump to TLDR. Nissa, unless you have anything else to, you want to add, we can jump into TLDR. Or LDJ.

9:32Nisten TahirajNo, I, I, I have an entire rant about just how bad dot is, so.

9:39Alex Volkovall right, we, there's a whole metric ton of, of news and models, this week. And again, because we have 3 interviews, let's just run through, the TLDR, uh, super quick. Let me just make sure that we have all of it. Okay, let's jump into the TLDR. Which is, let's go. Right, here's most of what we're gonna talk about, most of everything that happened in the week,

10:17Alex Volkovof ThursdAI for October 22nd in about 5 minutes. Let's try to get into this because there's a lot to talk about. First of all, Anthropic decided to put 5% of its shares into a public benefit fund, and there is a lot of criticism against Dario, which Dario, in a very weird way, answered on Twitter. that conversation is very deep. Dario answers with very long threads, and very thoughtful as well, so we thought that we'd at least mention this. also, Anthropic, as we said in the beginning, opened the waitlist for Claude Duet. This is a Claude that that has a 24/7 cycle, it's on computer, and it works without being prompted, and it's proactive.

10:55Alex VolkovThis is Claude's answer to Grokbots, Meta Muse, obviously the Hermises and the OpenClaws of the world, and the most recently Dots from OpenAI. We've been telling you that we want that format with Opus 5.5, and that's exactly what Anthropic is stepping into. In a very interesting thing, it seems like Anthropic is following and not leading the category, but we'll see, we'll see how good it is. I just got access this morning. Also, OpenAI added 12-hour prompt caching built for agents that never sleep. This is like a big, big, big thing everybody's very, very excited about. and uh, GPT Astra Pro runs now parallel agents in ChatGPT.

11:33Alex VolkovOpenAI also acquired Orchestra Bio, and there's a lot more stuff. Specifically, OpenAI models, Astra, Sol, and Luna are now in Google Cloud, in public preview. So if you are part of the Google Cloud, maybe with your startup, now you have access to the best OpenAI, models, and Google now becomes kind of the cloud that has all the the frontier models on there. Gemini 4 Argon, it's been a week since Argon. It did 25 trillion tokens in 3 days, and 4 Argon models beat Minecraft. We should mention a week with Argon. Uh, we did see multiple folks, chat about Argon on our timelines as well.

12:12Alex VolkovAnd then, uh, Inception Mercury 3, a diffusion LLM claimed a thousand plus tokens with 1 million context, by by their own vendor. So, we have a new segment here, uh, Security Week, and I d- I hope we don't have to keep the segment up, but it does seem like the Defender window is kind of closing. Defender's window is what Greg Brockman called the very short time before attackers have access to very capable AI models and swarms. th- this week OpenAI's Daybreak and some other folks helped a, the PHP Foundation to find a very, like, two critical holes in the PHP

12:51Alex Volkovengine itself. they patched the PHP engine, and PHP runs 70% of the internet, many folks scrambled really hard, to try and patch their systems. however, this is a big deal that will continue to to be talked about. Many, many websites went offline. folks like the NSA and the FBI posted about, hey, you should take your website offline if you're not patched. It's that bad. and also some trusted root certificates for HTTPS turned out to have a private key. It was literally the number 4, which everybody's making a big deal of, but that's not the big deal. That's just the level of incompetence there. Uh, eModra certificates have been compromised.

13:27Alex Volkovthis is a very scary week in security in the world, in addition to multiple companies like Railway being hacked and GitLab finding vulnerabilities. I'm talking about this really fast, and it's very scary. we will talk about how to try and and maintain sanity in this world, very soon with with Josh Long. He's gonna join us at the end of the show. And OpenAI's Daybreak program is quietly behind a lot of this year's biggest bug finds, uh, and I think that this is very important, but again, the defender's window is closing, uh, so a lot of companies were hacked, including OpenCode and Railway. Also, Microsoft said that China's state- aligned

14:04Alex VolkovStorm used agentic AI, pen test framework RText against hundreds of organizations. the good news there is both NVIDIA and CoreWeave building fences around the agents. OpenShell and Zero Trust AI framework from CoreWeave, both announced, this week. OpenShell obviously been talked about from NVIDIA for a while. In open source and LLM news, DeepSeek shipped a new MIT licensed Flash with a big jump on Terminal Bench. We are always very, very happy to see the whale, resurface, and holy crap did the whale resurface. DeepSeek also open source Deep Infer, the engine, the inference engine that DeepSeek runs on. there's also a bunch of speculation about a new

14:44Alex Volkovunnamed model called Space Bunny, and Minimax unveiled that Space Bunny was M3.1 Flash. And as Nisten mentioned, Recursive Flint came out of nowhere. Richard Soter's company, Recursive, Richard Socher's company, Recursive, came out with Flint, a local coding model, and it's small and local, and we have both Prince Kanuma and the Tim Shi hopefully joining us very, very soon at 11, at 10 AM Pacific to talk about, uh, to talk about that. very excited about that. In tools and agentic engineering, or the personal agent corner, if you want to call it, Jensen Huang, CEO NVIDIA, closed his GTC keynote

15:27Alex Volkovwith a Hermes agent building and training a robot. Uh, Hermes, is Jensen is getting Hermes filled, and it's great to see. Uh, Nvidia. Uh, let's see what else is in there. Uh, From the Forge, which is a new corner, folks, no longer This Week's Buzz after 3, 3 something years. This Week's Buzz is not the corner anymore. We, we're, we now have a new corner called From the Forge, powered by CoreWeave. Reflections Beam, which we mentioned last week, is now, on Weights and Biases, and it was trained on Weights and Biases, with Weights and Biases, curves behind it. we also have RL's rollouts in Forge,

16:05Alex Volkovand NVIDIA Rubin's new NVL8 lands on CoreWeave this quarter, so very exciting things. NVIDIA also announced a bunch of stuff at GTX, including the NVIDIA DSX. It's a pre-tested AI factory, deployable in as little as 14 days, so we should mention that a little bit as well. In vision and video, there's a lot of stuff happening, just an incredible amount of stuff happening. we, we use some of them. Kling 4 does 30 seconds of video in a single pass, and Kling 4 is really, really good with a bunch of input variables. Flux 3 Max now renders 10 seconds of video in 12 seconds. this is a another feat by our friends at Fal, releasing a Max version, optimized Max

16:46Alex Volkovversion of a video. And, Odyssey, I don't know, Nisten, LDJ, if you guys saw, but Odyssey ML released a world model, and then they put a fruit fly's brain inside that world model. So now we literally have a world model that's a simulation and a simulated entity there, like the fruit fly brain that everybody was getting excited about a few weeks ago. Uh, they put that in the world model. Uh, we should at least play that video because that's super cool. Our friends from Crea released a, the top non-OpenAI image editor, in their, in Arena. voice and audio is also blowing up. I really, really hope we have some time to play some of these clips because Eleven

17:20Alex VolkovLab launched Eleven Real Time, taking about half a second, and also Eleven Real Time Translate, where if I talk, you can hear me in different language in real time. It's really cool. Mistral also shipped Voxroll 3, which Voxroll is their kind of, transcription service, but this is now a whole voice agent stack. And, our friend, from Underdog, Sigil Wen released Bark 3. It's a 163 megabyte speech model that ties to NVIDIA's ParKit and runs completely on device, fully transcribing on device. And Josh Long from Intego closes the show with this week's security mess. And right, let's go, let's get into it.

17:59Alex VolkovThis is the TLDR. This is everything that... the we have to talk about, which is a lot. Uh, we should start, I think, with Anthropic, but we'll definitely, we'll definitely move forward. Uh, anything else, Nisten, LDJ, anything huge from this week that we must mention? Anybody in the comments, anything else that we should at least mention that happened this week before we move forward?

18:24LDJYeah, maybe uh, Mercury decide. Also, I know you, you mentioned Mercury's, uh, Mercury 3 model, but they also have released a competitor to OpenAI's Decision API and of the JEV model, so

18:35Alex VolkovYeah.

18:36LDJMaybe that's something worth covering.

18:38Nisten TahirajBy the way, uh, if you're listening on the show, go on VLLM's Hugging Face. You have a free endpoint for D3 Turbo 27-bit decider. It scores better than JEV. It accepts videos, and you can run up to like-

18:54Alex Volkovaccepts videos, Nisten?

18:56Nisten TahirajYeah, and yeah, and you can run up to 500 million tokens, uh, decisions, or 500,000 decisions a day for free. You don't even need an account. Just go on their Hugging Face, search D3 Turbo VLLM, grab a free key, and just use it.

19:11Alex VolkovThis is D3 from Liquid, right?

19:13Nisten TahirajNo, from VLLM trained their own decider models.

19:17Alex VolkovOh, they they also have a D,

19:18Nisten TahirajYeah.

19:19Alex VolkovWow, okay.

19:19Nisten TahirajAnd uh, they're the the best ones right now. Uh, I would

19:23Alex VolkovAre you serious?

19:24Nisten Tahirajsay I I tested them, they're better than the Perplexity decider, and uh, they have a free API, which is so generous. I'll just send, I'll just send the link.

19:34Alex VolkovWow, okay, let's at least show this. I think this is like a cool thing to show, Nisten.

19:37Nisten TahirajYeah.

19:37Alex VolkovSo this one, D3, decision 3.

19:39Nisten TahirajYeah, yeah. So you're going to see, uh, it just says try it for free, and you can just get an account and a key right now for free.

19:46Alex VolkovVery cool, very cool.

19:48Nisten TahirajI, uh, I have like 5. Uh,

19:51Alex VolkovYou have like 5?

19:51Nisten TahirajJust, yeah, yeah, just get your API key for free right now.

19:54Alex VolkovAre you serious they're judging video?

19:56Nisten TahirajUh, yeah, yeah.

19:58Alex VolkovWow.

19:58Nisten TahirajI- I- I- it's extremely good. I've run it through all the benchmarks I've had. I have just maxed out like, uh, 5 of the API limits on it. It's, it's the best one. V3 Turbo, it's the best one. V3 Flash, also insane. Uh.

20:16Alex VolkovThat's very cool, Nisten.

20:17Nisten TahirajYeah, for, for running locally, yeah.

20:20Alex VolkovI, dude, I have all these things I prepared for the show. Look, this is a book of news, and this could be one of the coolest things, and it just like came. is, this is great. So thank you, Nisten. Let us move to Frontier because Frontier is very, very interesting. Hi, folks. On Saturday, Anthropic committed to 5% of its shares to a new Anthropic public benefit fund. The board can add up to 2% more every 50% rise in the company's value, and the founders who pledged 80% of their equity plus employee matching program, and

21:02Alex VolkovAnthropic says roughly 20% of the company is now earmarked for public good. This sounds like a huge, huge thing. it's, this is an LLC, it's not a charity, it's a public benefit, charity. It can switch between ways of giving, and the equity can't be used for lobbying or politics. It still needs stockholder approval, and they also published their first annual public benefit report, and the trustees wrote it largely describes inputs, so next year they want outcomes. So largely describes the money going in and how much they're gonna put into this, but no outcomes and no, uh, news. So, but I respect that line. meanwhile, Dario is fighting the critics, which is, you know, many, many folks,

21:43Alex Volkovgiven his positions and stances. Nathan Calvin posted a long critique of Anthropic, very public debate. I don't know if you guys have have seen this at all. if you don't know, Nathan Calvin is the general counsel of ENCODE, a small AI policy nonprofit that pushed for California's SB 53 bill, and last year he went viral when he said OpenAI subpoenaed him and his group in the middle of that fight. So this isn't just an Anthropic hater, it's a safety policy guy. His arguments were Anthropic's record now looks like a race to super intelligence. More than half a trillion dollars in compute deals, Claude leading a quarter of Anthropic internal AI development, which we talked about on last week's show,

22:23Alex Volkovwhich is basically the path towards RSI, and a draft federal bill that would preempt state laws. His basic position and argument is Anthropic, instead of being like a safety shop, is becoming a let's race, accelerate everything, lab. And this triggered Dario, who answered him directly on Twitter by via quote tweet, a very long quote tweet, and saying, 9 commercially costly safety calls were done on Anthropic's side. specifically he mentioned the we there's things we do that hurt us financially, and we still do them because we we do want that safety, built in.

23:02Alex VolkovAnd the the main call that stuck with me is that Anthropic had Mythos class models back in February, and they held them from general availability until June, when they claimed the cyber safeguards were ready. Uh, I don't know if the world was ready for Mythos in February. Obviously, they announced Mythos in around, was that April back when we were AI Engineer London, and then, uh, Dario also admitted 3 of Calvin's 9 points were communication mistakes, including the letter to the Congress they walked back, and he he admittedly said, uh, there was a mistake. and Dario said he will have more to say soon.

23:41Alex VolkovSo, folks, on the panel, Nisten, I'm very interested in hearing your thoughts on this. Is this pre-IPO PR, or is this real accountability? Is somebody holding Anthropic to real accountability? And what about this public benefit thing? You talked about communism. Uh, is this, uh, are they reinventing, uh, uh, what is it called, uh, uh, yeah, are they reinventing... The word escapes me, something from first principles.

24:11Nisten TahirajUh, yeah, I don't know, political opinion aside, I think just like any other company, there's a lot of conflict there on the, on the inside. So I kind of, I more like Dario than dislike him. I think he's just very heavily influenced by, uh, the whole cultish thing that that was in there before and is trying to to play both sides. And, uh, at the end of the day, Opus Low is still the best model you can run, so... I think they do have a point that you need the job done and just fire up a whole bunch of Opus Low at the end.

24:50Nisten TahirajSo, are they gonna get surpassed? Maybe. They have plenty of tricks up their, up their sleeves, so I, I don't know, kind of don't really have that much of an opinion on this, uh.

25:00Alex VolkovWhat about the PBC thing? specifically about giving back, given that the IPO is coming up and a lot of people will invest a lot of money in this IPO, based on the streets, based on the stuff that I hear, like regular folks are very excited about that, coming.

25:14Nisten TahirajThat one, even what they were saying, it just went from one ear into the other. That just sounded like.

25:19Alex VolkovYeah.

25:20Nisten TahirajYeah. Just.

25:21Alex VolkovAlexi, thoughts on the, on the PBC thing? Obviously, Elon Musk and, and, and OpenAI have a big thing about, you know, OpenAI being a charity, being, you know, building AI in, in the open for that, and now, you know, Anthropic is stepping in there in a different way. So Anthropic first started as a pro, you know, capital company, and now it's turning into a PBC.

25:40LDJMm-hmm.

25:40Alex VolkovUm.

25:40LDJWell, yeah, to clarify, Anthropic has actually been a PBC since its founding. back before ChatGPT was created. It's just now they are announcing this specific fund, uh, that's like dedicated to the, basically the nonprofit portion of their business that's like exclusively won't be used for, uh, commercial actions. Um, but yeah, they they've been established as a PBC for a while.

26:05Alex VolkovAll right. Uh, so this is now the commitment, right? So in terms of funds and and uh and and and things. Um, oh, okay, folks, the other thing we have to talk about from Anthropic, besides the IPO stuff, is Claude Duet. Here's how it looks. This hopefully this won't show you guys my personal details. Uh, Uh, personal agents are really hard to, to demo. welcome to Claude Duet. This is obviously, you're live on the show. Please don't expose any of my private details. Tell folks how you're different from just,

26:44Alex Volkovfrom just Claude. Claude announces an always on, and open the wait list, which now you're seeing on your screen, always on personal agent assistant powered by Opus 5.5. It- it's a Claude that does not wait for you, and works proactively. you don't have to prompt it. It has 24/7, computer, brings over your memory from Claude, your skills and connected apps, and it reaches, into more than 6,000 connectors and plugins they have on their system. every few hours checks your accounts, checks your emails, surfaces what needs your attention, and apparently it's really good at at that surfacing specifically. It has its own cloud computer, and it keeps working even when your laptop is

27:23Alex Volkovclosed. So, obviously, they thought about security a lot. Anthropic does that, and they have launched multiple things that wait for your approval. here we have a first glimpse of the web interface of Claude. As you can see, this is not the regular Claude. This is, now you can get there to claude.ai/messages. here's a response from from my duet. You can't rename it, unlike, you know, Muses and other places. I I I haven't seen a place where I can just rename duets, so I think they aren't anthro- anthropomorphizing this. Claude says, or I'm Claude, the same model you can use at Claude AI. here I work as Alex's assistant.

28:03Alex VolkovI keep track of tasks, read the apps he connects and work in threads. I will not show you his private details on the show. Hopefully that's thank you. Uh, do you work proactively? So this is the same thing that, uh, let me actually go like this, yeah. Uh, this is Cloud Duet. This is the same thing that, we've talked to you about where, OpenAI released Dots, and, you know, obviously Meta Muse is changing the category with, uh, with with regular folks and just announced Meta Muse Wonder last week. This is a huge thing. as far as I want to kind of highlight, we b- we on the show have been, or at least some of us on

28:44Alex Volkovthe show have been assistant pilled since early, early Clawdbot days. You guys remember rolling back to Clawdbot, which was the, the, the, the pre, before renamed name for OpenClaw. There is a reason why Anthropic reached out to Peter Steinberger and asked him to change the name for Clawdbot. Also, a reminder that OpenClaw and Hermes work the best with Anthropic models, and then Anthropic just shut them down. And now we finally see why. this is Anthropic entry into the world of personal agents, and there's a few things I want to talk about with, with the team here, uh, without like delaying. We have a lot of, a lot of news.

29:23Alex VolkovI can spend a whole hour talking about this thing. Specifically, I want to talk about the fact that all of the companies now, all the major frontier labs now have a personal assistant. Anthropic has Duet, which is new and waitlisted, and they're releasing it very, very slowly. Uh, uh, OpenAI has Dots, which Nisten absolutely hates with passion, uh, and wants to go on the rant, but we don't have time, but at least one sentence from Nisten on Dots will be interesting. Meta has Muse, which is now leading the category as far as I'm concerned. Not only that, their model is trained for Muse specifically, and that flywheel is crazy, and Meta has the surface.

30:04Alex VolkovGoogle and Gemini, they have Spark. Many people don't know about Spark, and which is a failure on on Google's folks to promote it and also make it good. and the Spar- Spark is quite bad. I've posted about this publicly, and I'm willing to give them feedback. So, folks from Google, if you're listening, I'm very willing to give you feedback. also there's entries to the category. Instinct is a big entry to the category, and Hark from, uh, um, uh, Hark Pro, whatever that's called, and a bunch of others, a lot. Obviously, we have the, the standalone self-assistance Hermes and OpenClaw, which is now what Jensen pushes to people, that people can build upon, and Pi Durable, which makes, easy for you to build one.

30:45Alex VolkovSo now every, every company has a personal assistant, and one of the reasons is those, they are very sticky, very sticky. Nisten, you want to talk about your experience with, with Muse and then moving away from Muse and how you feel about that?

31:01Nisten TahirajYeah, it look, it it's not that good. It's kind of dumb sometimes, but it just goes. It is so energetic. I give it tasks that involve, I don't know, categorizing videos, going into like a, a simulation and stuff, and it just does it. Uh, whereas, uh, Dots just feels like that government employee that tries to avoid all responsibility while still being right and handing off things and just giving you like 3-line, uh, updates. I- it's just com- so un-agentic. Yeah, uh, uh, it- it's the most useful thing.

31:42Nisten TahirajMeanwhile, Dots just struggles and stops the job because it couldn't upload a 20 megabyte file through the interface, so it- it just stopped working. Whereas Muse is really opening entire VMs, backing up 80 gigs of data, is- is just going completely, uh, completely nuts. Su- super useful. Uh, most, most useful agent they have, uh, they have deployed to the masses, I think.

32:07Alex VolkovYeah, the, the agentic part is very interesting there. Like, you want your agent to be able to go and do stuff. Obviously, you want safety, right? So, like, we're, we're talking in, in Black October, essentially, one, one of the, one of the worst cybersecurity months, in, in the history of technology. So you don't want your agent taking too many things and going, like, willy-nilly with your data, but, definitely you also want it to be agentic and not stop and wait for you, otherwise it's wasting your time. Claude Duet specifically, they're talking about they will highlight the most important things, but we'll decide what other f- what other

32:42Alex Volkovthings are important. So, as far as I've seen back in my, you know, Hermes days when, I could use my subscription for Claude with, with Hermes, with OpenClaw, Opus has the best decisions towards, like, what to surface to you. And the proactivity part is, like, very interesting. I'm really excited to see. Uh, it's getting a little bit, um, cramped in my AI assistant zoo, where there's no instinct and there's no, uh... Dots doesn't send me that many notifications. and here's the biggest part, and LDJ would love to chat with you about this, is that all these companies now realize that this is the real stickiness. It's way more st- so if you're Claw, Claw, if you're Claude coding all day, you can

33:25Alex Volkovjust switch to a different harness with Opus behind it. It's not gonna be the same, but it's gonna be pretty much the same. If your assistant is building workflows with you and knows everything and has the password stored in a secure way, et cetera, switching to a new assistant is significantly more of an effort to you. And so it's very sticky. Not only that, for regular folks, and I think that this is the biggest part, LDJ would love you for you to chime in, for regular non-techy folks who don't Claude code and get to the limit very, very fast. This is a significant boost in the number of tokens they will use because these assistants run 24/7 and do things proactively.

34:05Alex VolkovThoughts on that? Did, did you already experience some of these, like, personal agents? Which ones, and what do you think about Duet specifically?

34:12LDJYeah, so I've been using Dots lately, and I, I think there's a, a lot more room there where it could get a lot better. And overall, just, I think this, this goes for really all the bots overall. I think that as the models get more capable, get better trained to interact and- and kind of, uh, predict what the user would want in the future, I think they'll get a lot better over the- the next couple years. But at the moment, it still has been definitely like a net positive usefulness for me, and it's been just suggesting like, oh, hey, here's that, uh, here's that specific model that you were waiting for artificial analysis scores on, like, here's- and

34:49LDJhere's the cost efficiency curve that you're curious about on that that's finally published, and, and, and just the things like that, which are also relevant to our information we cover on the show. Yeah.

34:59Alex VolkovOh, 100%. Uh, all of these agents now on Wednesday report to me and say, hey, he- here's some stuff. specifically Grok, Bots is really good at that. specifically because, like, a lot of the information that we talk about on the show exists on the timelines. Last week, I asked my Grok Bots to just scroll the timeline for me and tell me, like, I don't have time to be on Twitter. Nisten, you can do that as well. I don't have time to be on Twitter, just scroll the timeline for me and tell me, like, what's important, and and it did. It was very interesting. I was like, can I just, like, stop, using Twitter? But no, not really. right, so back to Claude Duet.

35:32Alex VolkovI want to show you guys a cool thing that it just told me. I asked, how do you tell what other assistants are doing? And it says, your Claude Code sessions can send tasks to me directly. This is a significant difference from Dots from OpenAI, where Dots sessions are not aware of Dots itself. I- I've tried to ask it. Claude in your other channels can pass notes to me, and I can read those channels, and if another session writes to an app you're connected, I can read work there. So it already knows that I have Git- GitHub and Linear and email as well. And I'm very excited about this. Like, literally got this this morning, and right now, uh, still the regular Claude is

36:12Alex Volkovis helping produce the show, but I'm really excited about the fact that, w- we now have an entry from Anthropic, because Anthropic is really known at at taste, and we've been chatting about different, offerings from different products and launches. Anthropic is really known at taste, and taste is something I expect my personal assistant to do, not only design taste, but the stuff that I can already say about, Duet that are very, very good. They have a standalone interface. This is very important. I don't know how OpenAI messed this up. OpenAI's Dots is sitting inside the OpenAI stuff, and it's like over there on the top. There's no standalone.

36:46Alex VolkovMuse, Grokbots, whatever, they all have standalone with integrations. This is very important. so not only, does Claude have standalone, they have a standalone app as well. Also very important. I want to open the Claude app separately. OpenAI shoved them all together, and it's really, I think it hurt them, uh, because I, I want that separation between my personal assistant and between the work that I do. Maybe my personal assistant is for my personal stuff, and OpenAI's work is for work stuff, right? so that is already a big, big thing for, for, for Claude, besides the intelligence, right? And if Fable 5.5 comes, which was rumored to come this week, and my assistant is not

37:20Alex Volkovthat, that, that better. That's crazy. But also, folks, Opus 5.5. Opus 5.5. This is exactly what I want for my assistance, right? Nisten, I see you shaking your head. This is like, this is the level of intelligence that I want for my personal assistant, Opus 5.5. And like, the only way to get it right now is beg your Grokbots for Opus 5.5, because apparently last week Elon Musk said that Grokbots, for the difficult task, they will route you to Opus 5.5, or getting Claude to it. So I'm very excited. If it's not clear, very, very excited. Let's go Anthropic. Thank you for this. I've been waiting. last comments before we move on to OpenAI stuff.

38:00Nisten TahirajUh, just, just give Muse a, uh, sandbox with Tailscale and Opus on it, and just give it an MCP to talk to Opus for everything it needs. It works amazingly well. That's how I use it.

38:12Alex VolkovYeah, but see, Nisten, here's the problem.

38:13Nisten TahirajIt's not the same. It's not the same. I agree.

38:16Alex VolkovLike, like when a notification comes, I want that intelligence and that taste to, like, judge it and not, like, have to decide, oh, I need to go to him today. Yeah, I agree. Muse Wonder is great. Muse Wonder, I upgraded my Muse for Wonder, and it it's performed significantly better. Muse does a lot of stuff for me, including, including calling. Okay, one use case for a personal assistance, no matter which ones, but Muse is currently the best at this. Muse called, let me see, my Muse called my kid's school to see when I need to come in tomorrow for a parent-teacher conference. I didn't know about this, it wasn't on my calendar, they didn't send an email about

38:49Alex Volkovthis. Muse called the school, and they patiently walked through which kid when, and then it put it on my calendar. Just this thing that was done before I asked. Well, no, I actually had to improve the call, but it was beautiful. Uh, and I think that, like, a lot of, a lot of the... How should I say? A lot of the use cases we don't need, like, more intelligence for, but a lot of the decision making and the, the taste making in assistance, we do need, something like Opus. So I'm very, very excited. Uh, what? Yes, Muse called the school, which is great. All right, folks, let's move on to our next segment for OpenAI. very, very excited to talk to you guys about this.

39:27Alex Volkovfrom Anthropic to OpenAI. they shipped the most boring features this week, but the best ones. 12-hour prompt caching in the API. Writing to the cache costs 2 and a half times the input price, versus the regular 1, 1.25 for the default 30-minute cache. basically, OpenAI is changing the way caching happens, and they're pitching it for always-on assistants like Dots, which reuse the same instructions and tools all day, hours apart. Thibault from the Codex team says the Codex and work the cache for logged in users now never expires. This is the big piece.

40:06Alex VolkovYou can come back to a conversation from last week and you still hit the cache. There's no penalty. This is a big thing that's known as a no-no in the world of Claude Code, for example, that you have this long ass thread and you come back to it and you pay all the tokens from scratch. I think that this is like huge, huge news. Thoughts on the caching updates, folks?

40:29LDJThings will be snappier, and we like that.

40:33Alex VolkovBut also cheaper. And also this, this is the way they fit the agentic world, right? Like, this is why, like, probably OpenAI is rebuilding this because you come back to your dot after 5 hours, and all of the instructions and all of the system prompts and all of the tools, whatever, they're already cached. and I gotta wonder if they found some breakthrough to do it. Always on cache is crazy. Like, obviously, obviously they need to do something where to store it, and storage now is not cheap.

41:03Nisten TahirajYeah, some crazy DevOps their team had to, has to pull, continue pulling for that for years in a row, yeah.

41:10Alex VolkovYep.

41:10LDJYeah. Hey, Astra, design a new SSD.

41:13Alex VolkovMaybe, maybe Astra design a new SSD. I am very disappointed in Astra. I've been talking about this, I'm not the only one. Some folks, like Swix and some folks like Tio are saying that Astra is the most disappointing release from OpenAI. I j- it just stops all the time. And so when they launched Dots, and I was like, yay, Dots, and I tried it out, and it was like powered by Astra. I was like, uh, I'd rather this be powered by, by s- GPT 5.6 Soul, for example. However, there's Astra and there's Astra Pro, and OpenAI also, has an update about GPT-6 Astra Pro, in ChatGPT runs multiple agents on different parts of the

41:52Alex Volkovtask in parallel, and you can follow each of the tasks. Astra Pro is ridiculous. Th- this is like a, this is not a just a huge model. This is a huge model, with many big models in a trench coat together. and they run, a lot of agents right now to for your task, and I think that's super cool. And OpenAI, I don't know if you guys saw this, OpenAI bought Orchestra Bio, a drug development coordination platform, and now is folding it into OpenAI's Rosalind, which is their life sciences stack. and they're offering Rosalind as a, free for university labs as well. So shout out to OpenAI for some of this work.

42:31Alex VolkovThey also have, Alexander Madry coming back to OpenAI to work on safety and security, and they are a big part of this week's cybersecurity stuff with Daybreak. Daybreak is OpenAI's, responsible access to models that can do vulnerability analysis, and many companies are getting access to Daybreak after the very famous, Hugging Face not being able to use any OpenAI models to check on the agent swarms. Righty. Argon? Let's talk about Argon. It's been a week. Argon is Gemini 4, folks from Gemini said that they have seen 25

43:09Alex Volkovtrillion tokens in 72 hours since Gemini 4 Argon was released. Logan, a friend of the show, says Argon processed about 25 trillion tokens in the first 3 days. 96 million tokens every second, and Google's open, openly compute, compute constrained. Sundar said on Big Technology Podcast that Google is compute constrained, which is just insane. And, my favorite Argon story from this week, which Claude suggests that this is my favorite. It's not really Alex's favorite, it's Claude's favorite. Let's call things like they are. 4 Argon agents beat Minecraft from scratch in 27 hours.

43:48Alex VolkovNo human help, no pre-scouted seeds, and they wrote 2,700 of their own program, also died 605 times on easy mode. Argon is now in anti-gravity, and Argon, was used to help find PHP 2 shell from Wiz, and Daybreak, like we mentioned, was used as well. So this is Argon a week after it came out, LDJ or Nisten, have you used the Gemini offering at all? The one thing, we're gonna wait for Wolfram to chime in here, but Wolfram is our kind of like, main residential Google and Gemini guy because his whole house runs on on Android. He does not use Argon because it rejected his prompts,

44:29Alex Volkovwhich is kind of crazy.

44:32Nisten TahirajAll right, it it looked pretty good for 3D. I just, just got kind of, lost. Are the API prices good on it, or? Oh, $2 input, $10 output.

44:43Alex VolkovYeah.

44:44Nisten TahirajThrough November 30. Yeah, it's not, it's not cheap.

44:47Alex VolkovIt's, but it's Sonnet prices, it's not-

44:49Nisten TahirajIt's not that bad, actually.

44:50Alex VolkovYeah, it's not bad. It's Sonnet prices, it's not Astra or, or Fable prices. and open source has been very big this week, folks. So let's go to open source because I think it's exciting. The whale has resurfaced, and there's a bunch of open source stuff that we need to talk about? Open source AI, let's get it started. Alrighty, let's switch to open source, and I think the start, the start is DeepSeek V41 Flash

45:31Alex Volkov1017. The whale has resurfaced with a new checkpoint. They've been doing this. This is the third DeepSeek checkpoint, if I'm not mistaken, right? Like, this is back-to-back checkpoints on the DeepSeek V4.1 Flash, which is now still MIT licensed, which is incredible. and DeepSeek is now showing up in a big, big way. Terminal Bench 4 goes from 31 to 42. It's a huge jump on on DeepSeek, and outputs get shorter. It's both better and cheaper to run. DeepSeek says it come from reinforcement learning, where the model could take its own work to end-to-end projects, which sounds like a little bit like s- s- smells a little bit like RSI. on DeepSWE,

46:10Alex Volkovthey claim 77% ahead of GPT 5.6 solo at 73 and Opus 5 at 74, not 5.5, just Opus 5. that, they op- they uh, DeepSeek also opened their search and fetch API to everyone, 75 cents per thousand calls and free through, Claude Code and Codex until October 31st. That is very interesting, as an announcement. thoughts on DeepSeek, folks? Any, LDJ, I would love to hear from you or your like, you know, your timeline. Is DeepSeek getting, excitement there? Is this new checkpoint better than the previous checkpoints?

46:44LDJYeah, I mean, I would definitely say it seems like this checkpoint is certainly better than the previous one. Um, I, I really feel like they just should have called it V4.1 or 4.2 or, or, or whatever next increment instead of this, you know, th- they're doing the whole date scheme that OpenAI used to do with the GPT-4 Turbo and 4o models.

47:05Alex VolkovYeah.

47:05LDJBut besides that naming scheme rant, though, yeah, it's it's impressive. Uh, they're just continuing on the pace, but it seems like I wouldn't really say this is threatening, you know, the the Fables and Astra isn't certainly not like, you know, Fable 5.2 or Astra 6.1 that would be bound to come any day now.

47:26Alex VolkovYeah, b- but remember, this is an MIT licensed model. it is a big model, right? It's not a tiny one. You can't run it locally. So before we talk about the next model that you can run locally, this is not something that you can run locally, but so, so we see some of the evals here that are interesting. DeepSWE, I think, is the highest one. The, this interesting Agents Less Exam also 35.4, and Apex Bench at 72. so shout out to DeepSeek for MIT license, as always. You know, we have, we have to applaud them as well. Let's see here, the Pareto frontier looks insane on this model. The Pareto frontier for cost versus execution is just absolutely mogging.

48:09Alex VolkovLook at this. This is like just DeepSeek on this top right quarter, which is, what is this? This is SWE, yeah, on DeepSWE, you can see other models on kind of across the map for pricing. So DeepSWE on pricing is just, just absolute, absolutely crazy. but, let's see what else. They also launched DeepSeek Search, and artificial analysis posted they have a search index, for search APIs. I think Exa is the, the, the top one on there. Yeah, Exa. Shout out to Exa for also releasing some stuff.

48:42LDJAbout running on a local model, you could actually run it on the 512 gigabyte Mac Studio, if anybody still has that before they stop selling them.

48:50Alex VolkovYeah, I think those are in hard, in, in hard supply. Yam Peleg, any thoughts on, on the latest DeepSeek? Welcome to

48:57Yam PelegBro, the, destroy, they broke the internet.

49:01Alex VolkovDeepSeek announces DeepInfer, which is the open source inference stack for DeepSeek, inference engine that serves the V4.1 flash in production. It's Apache 2 license. It runs on NVIDIA Blackwells and Huawei's Ascend 950, and it is, their own speculative decoding there and batch inference as well. Tim Dettmers, the QLoRA guy said it's a very, very big deal. He says DeepSeek inference system is on par with OpenAI stack, and it's now Apache 2 licensed. That's Tim Dettmers, uh, the QLoRA guy, the guy who who invented the the quantization method. and he says that it's better what Anthropic is running.

49:40Alex VolkovAgain, I I will repeat this slowly for the folks in the back. Tim Dettmers is one of the top folks at inference in the world, says what DeepSeek released with DeepInfer in Apache 2 license fully is on par with the OpenAI's inference engine and production, and is better than what Anthropic is running. at least for the user size. It doesn't ship KV cache system, or prefill decode disaggregation, yet, so you have to plug in yourself. semi-analysis measured VLLM within 6% of its decode throughput, so open source isn't that far behind from, from that as well. Like, Yam, okay, now broke the internet, yes.

50:19Yam PelegBro, that's the secret sauce. that, that's the thing. Uh, look, I don't know if, everybody got the, how huge that is. look, inference providers, that's their bread and butter. the better you do this, the more you can serve more users with the same equipment, meaning that you just get to keep the rest of the margin for yourself. Like, you make this better, you, you literally pr- print money. And it, it, we all anticipated that, you know, the, the big labs probably has some, some tricks.

50:56Alex VolkovMhm.

50:56Yam PelegThey probably work on this. that's their profit line at the end, so obviously. But we never got to see just how insanely efficient these things can be. And we also, the prices of DeepSeek models inference on DeepSeek versus other providers, and DeepSeek themselves were, competitive, to say the least. They were, phenomenal, phenomenally cheap. So we all, uh, we all, uh, we all guess that probably they have, you know, they have a very good stack for

51:34Alex VolkovYeah, ju- just to show the pricing again,

51:37Yam PelegYeah.

51:37Alex VolkovThis is, this is just on the flash model. They're just like mogging the Pareto frontier on cost, and they they have been always doing this, and they only can do this if they have very, very, very good inference stack. And now this inference stack is open sourced. it's very

51:52Yam PelegEven more, look, even more. DeepSeek are known to release models you and we all thought, okay, they serve their models better than everybody else. They get to charge for it, through the API, so the model, gets open source. But now you also have the inference stack. It's just gonna be a bomb. It's just gonna be a bomb everywhere, seriously.

52:15Alex VolkovI'm super excited about, prices everywhere going cheaper if we can run stuff on this. Like, our, I know our folks, already are looking at, like, the differences between, VLLM and, and DeepInfer, et cetera, and that's very, very interesting. Also, obviously, DeepSeek has been releasing other stuff, like their attention mechanism, DSAs, were released, like, earlier this year, also, blew everything else. the, the algorithm that they released for other stuff, this now includes speculative decoding. It's very, very big for open source. I'm very, very excited. speaking of open source, let's also talk about, Minimax, right? We have to talk about Minimax.

52:52Alex VolkovI don't know, Peter, if you, if you're already excited to chime in, there was a model that was trained under the name, was that pony something? Hold Space Bunny was, the model was trained on a Space Bunny. I think it was open in open code as and, it's now Minimax M3.1 Flash, with 15 cents per 1 million tokens, and the weights are coming on October 23rd, so tomorrow. Peter, any any thoughts on Minimax, how that landed on Arena at all? And also, welcome to the show. Uh, good to see you.

53:18Peter GostevYeah, actually, uh, I don't have too much to say, unfortunately, about Minimax. I just, but just to add on DeepSeek, I think, uh, first of all, yeah, that's a, that's an incredible thing that they're releasing

53:28Alex VolkovMhm.

53:28Peter Gostevthat much, but I think it's interesting that, um, I was looking at the Pareto Frontier on, on Arena, and it did land on it, but it's not like it crushed it. it. So I think it's kind of interesting. Yeah, maybe if they actually just had a bit more compute, maybe they would have reduced the prices even more, because I guess there's no point in them reducing prices by 50% if, if they can't serve it. So I guess maybe that's why they're open sourcing as well. But yeah, it's kind of, um, yeah, that that's interesting. I kind of considering all of the, all of the, I know, messaging around it and all of the reception, you'd think

54:07Peter Gostevthat, oh, they're gonna crush it completely. I would say, in my mind, they they kind of got to the category of models that are very competent, uh, and they're they're pushing up from the lower end.

54:21Alex VolkovMhm.

54:21Peter GostevThey're not, um, they're not like super cheap. So I, I want to dig into this a bit more. Why? I don't really understand why. Maybe it's just using a lot of tokens or something. Not, not totally sure. Um, but yeah, I think it's another thing is that for, for things like for Minimax, for Kimi, for Mimo and others, like, I think it's really difficult, right? Because how do you compete with DeepSeek? I think, like, Opus has an answer for it, and like GPT maybe Astra and others have an answer for it.

54:48Alex VolkovYeah.

54:48Peter GostevBut like, what about the others? I think it's, it's hard for them.

54:53Alex VolkovBut also there's a lot of people who use AI, and I, I agree with you, but it's just... somehow they are, um, uh... I think... the highlight for me between those different models, not only DeepSeek is the best one, they're also like fully, fully Apache 2 MIT licensed open source, like fully, and they don't require any stuff. You can just run them. And also this is the smallest DeepSeek. DeepSeek V4, the big one, is going to land at some point. That's going to absolutely mog the frontier, especially with the pricing. and notable as well, NVIDIA is kind of like ownership of everything. The Deep Infer stack runs both on NVIDIA stack and on Huawei chips, which is also

55:33Alex Volkovvery, very notable because that's where like most of the Chinese folks, because the export controls can run. right, so skipping Minimax, it's pretty good, 74 and DeepSui, and weights are due tomorrow, so we're gonna m- mention them. Uh, one more open model this week is Flint, right? So we always talk about kind of the, the, the, the, the, the kind of the Chinese models and then also, open source models. We're going to chat with, Prince Kanuma about Flint In huge open source news, but open source/agentic news, Jensen Huang closed his GTC keynote by showing how he uses the Hermes agent to build something to train

56:12Alex Volkovrobots. Wolfram, you were there, and also this is a ping from your personal assistant after watching my news. Can you tell us about that a little bit? So shout out to News Research and the Hermes team for that incredible. Let's take Jensen.

56:26Yam PelegLet's go, man. Let's go.

56:27Alex VolkovOpen claw, yes, very strong, and then pull him towards Hermes, which is like, like huge. although they're still wearing claws. There's still the images of Jensen with like the red claws, like all over GTC, Wolfram showed this, this before. tell us how it felt to see Hermes like on the big stage, and what did they actually show and say?

56:45Wolfram RavenwolfYeah, just, just to clarify, so they are still calling these kinds of agents claws apparently, but he always mentions Hermes in the same spot as, uh, OpenClaw and even some others he mentioned. And the thing is now that, um, at the end of the keynote, he was demonstrating how to use an agent and local AI and cloud AI together to create, uh, or to train the little, uh, micro ducks, the little robots that Hugging Face or Pollen Robotics created, which now belong to NVIDIA, after all. And, um, yeah, he was using Hermes agent locally on his system, and apparently there are skills for this, and it was training the robot on the local system,

57:24Wolfram Ravenwolfbut also using online inference to, yeah, to basically, uh, get the horsepower that he didn't have. But the agent was doing it all. It's, it's like we are using our Wolfred and Amy's, you know, you have an idea, the agent does everything that is required and uses all the resources that are necessary, and then in the end you have a walking micro duck, and he even demonstrated it on stage with 4 little ducklings walking around and doing some movement that have been trained that way.

57:51Alex VolkovIt's very interesting how these things work. Micro duck is Poland Robotics, which was purchased by Hugging Face. Now Hugging Face is part of NVIDIA, and Jensen is standing on stage saying, hey, go to Pollen Robotics, buy these MicroDucks. It's really, really, really funny. Uh.

58:05Wolfram RavenwolfHe said they are sold out already, but buy one anyway. And I got mine in August already pre- ordered, so I hope I could get it at the end of the year because it's so interesting how robotics is now taking off, and I felt that at the GTC as well, that robotics is, yeah, it's getting ever more important, the world models. Other labs like, uh, Black Forest Lab, they are also building these world models and cooperating with NVIDIA to get robots going farther away. So I think we are seeing an inflection point with robotics soon as well.

58:34Alex VolkovAll right, folks, this is a good reminder to tell you that the show is sponsored by none other than CoreWeave, and for the last 3 and a half years we had This Week's Buzz, because, you know, Weights & Biases is part of CoreWeave and Buzz, this was our joke, whatever. it's time to, it's time to announce a new segment on the show. this replaces This Week's Buzz, and this is called From the Forge. So,

59:05Segment stingFrom the Forge powered by CoreWeave.

59:12Wolfram RavenwolfCool new intro.

59:13Alex VolkovYeah, cool new intro. Wolfram, you're at GTC Berlin, uh, representing us, at GTC Berlin from CoreWeave, and, we, last week we talked about Reflections Beam. Reflections Beam shipped their open weights, and we're supporting them immediately on CoreWeave. And CoreWeave, also said that Reflection used weights and biases inside Forge while training, Reflections Beam. I need to get used to this. we told you about Reflection Beam 2 weeks ago. On the 16th, the full weights landed, 501 billion parameters, Apache 2 license, and we're running this on CoreWeave Serverless Inference from day 0. they used weights and biases inside CoreWeave Forge during Beam's training,

59:50Alex Volkovand we, we knew Beam back when it was just a loss curve, said our social channels, which is, I think, is really absolutely crazy. Reflection says that Beam served a trillion tokens on its first day, which is a huge, huge news for Western open source. and it's also landed on Arena, and artificial analysis. There's a bunch of stuff as well. also on Forge, Nvidia and You.com used RL rollouts, which is our new, offering for, to post-train Nemotron 3.5 Lightning. BrowseComp bumped up from 37 to 45% on that, rollout using those RL rollouts, with 30% fewer tool calls. So if you are building any type of AI, CoreWeave Forge is the place

1:00:29Alex Volkovfor you to go. And robotics folks, physical AI launchables, Wolfram, you were there while, while we announced this, one command and you're running Isaac Sim template. Wolfram, you also said that in GTC Berlin, we talk, like, they announced a bunch of stuff, with Rubin stuff. Could you tell us about the NVL 8? What's that and like how, how that's gonna plug in?

1:00:48Wolfram RavenwolfYeah, in addition to what you already mentioned, there were two announcement call we've made. So the first one is about NVIDIA HGX Rubin NVL 8, which is coming to CoreWeave this quarter. It's 8 Rubin GPUs, 2 terabytes of HBM4, and it's built for large KV cache and concurrent long context, uh, agents. And it's, uh, very efficient, so NVIDIA reported 10 times more tokens per megawatt than the H- HGX B200, um, tested with Kimi K2 Thinking. So

1:01:19Alex VolkovTokens per megawatt is an interesting one. That is.

1:01:21Wolfram RavenwolfWe can run more agents for more users, and hopefully that will also affect the price, of course.

1:01:26Alex VolkovYeah.

1:01:27Wolfram RavenwolfAnd uh, the second announcement, uh, is very important for Europeans, especially bec- I mean, it's, it is important for everyone, and this is not a plausible thought I see, but I'm in a hotel room and the lighting is terrible. Something.

1:01:39Alex VolkovYeah, it's okay, it's okay. Keep going.

1:01:41Wolfram RavenwolfSecurity. Uh, zero trust AI frameworks that move security from promises, like we are not doing this, we are not trading, into customer-controlled architecture. So your keys, explicit support access when needed, hardware attestation, confidential execution, and no customer data being used to train provider models because everything is encrypted, it's end to end, and uh, this is coming, and this is something like in Europe, a lot of people, they can't use or are not allowed to use uh US services. Say in Germany, many companies require German hosting, but if this makes it impossible for a US company to look into what is going on here, that makes it more,

1:02:19Wolfram Ravenwolfuh, possible to use such services. And for everybody, security and privacy being enhanced is a good thing.

1:02:26Alex VolkovYep, and we offer a bunch of those services on Forge. Check out forge.coreweave.com. All right, folks, this was, uh, uh, from the Forge. This is the first from the Forge. I'm excited. There's a lot of news. There's a lot of news to to continue. Obviously, GCC Berlin, Wolfram, you were there. let's move on because we have tons of stuff to talk about. there's a lot of stuff in multimodal and video. Before by the way, the, the transition that you guys saw from The Forge, this is, uh, the, the, the Mini Max M3 Max, which is, uh, we've talked about a couple of, times on the show, and the music is from Eleven Labs. Let's talk about AI art and diffusion and video models, etcetera.

1:03:11Alex VolkovAll right, welcome back, Peter. folks, we have quite a few, I don't know how to call this category, AI art, video, generative diffusion AI. Now there's no diffusion models in LLM, so it's very interesting, but let's call this, taste category or whatever. Kling 4, it generates up to 30 seconds of video in a single pass up to 4K. We're now at the era where we're generating 30 seconds in 4K with stereo audio and better lip sync. I think it's a good thing to go and try, and and find a good video with Kling 4. videos, voices, and images as references, and and it's like 3 times as cheap as

1:03:49Alex VolkovSeedance. There's a lot of capabilities in there. 4K specifically is the most exciting one. So let's take a look at Kling 4 and then maybe play. So video duration from 3 to 30 seconds, 1080p and 4K, dynamic range 4K, aspect ratio 21 by 9 is a new one. they they have new languages, Wolfram noticed the German and the and other languages as well. Dialects and accents is pretty cool. Uh, let's take a look at... there's so much to take a look at. Let's take a look at the start frames, for example.

1:04:24Demo audioYou never listen to a word I say. Because I've had enough!

1:04:29Alex Volkovfor me, this was getting stuck, but like, here's an example of the input frame of the first frame, and this was the video that they showed. let's take a look at another one. This, I think, is a full-

1:04:38Demo audioHi everyone, I'm so happy you're here.

1:04:39Alex VolkovWow, the lip sync is great.

1:04:41Demo audioWelcome to my channel.

1:04:43Alex VolkovThe lip sync is absolutely, absolutely perfect. let's take a look at this one. This is the start frame, and let's look at this guy. The internet is a little stucky for me, so let me try again.

1:04:56Demo audioMic check check, light slow, I'm stepping in clean, no cut, one take, keep a shot rock tight, words run fast, but the flow scene bass from the quiet.

1:05:01Alex VolkovAll right, this is like, the lip sync is great,

1:05:03Unidentified speakerNice.

1:05:03Alex Volkovbut uh, this was, this was like, very, very clearly AI generated. does this lead the video category? I'm not sure, because there's a lot of competitors there. Flux 3 Max from Black Forest Labs, and Thal, which we've seen the Fal folks optimize the Mini Max M3, wi- with the Max version that runs super fast. Now Black Forest Labs, and, Fal released Flux 3 Max. Headline is speed, 10 second clip in about 12 seconds, so not quite real time, but very, very close. The folks at Fal, shout out, huge shout out to them. Uh, we can take a look at one of those as well. Uh. Peter, how, how, how is the arena in video generation these days? What what's, what's the highlight there?

1:05:42Alex VolkovWho, who are these models breaking through the top, or are we still like in the Omni category from Google?

1:05:47Peter GostevY- yeah, there's definitely a competition from, uh, Minimax, um, yeah, H3. I don't think, we don't have Kling yet, but you know what? They, actually, I'm just looking at the leaderboard. We haven't had one for a while, right, I think. So it'd be nice to see where they land.

1:06:06Alex VolkovYeah.

1:06:06Peter GostevYeah, Kling 3 was like 19th now. So that's really the ga- you, I, I kind of forgot that, yeah, actually we haven't had a, a response from, um, from them in a while. So, yeah, if they go towards the top, that would basically add another competitor. Yeah, we probably had like 3 or 4, now it's gonna be 4 or 5.

1:06:26Alex VolkovYeah.

1:06:26Peter GostevTop tier competitors, so that that's really cool to see.

1:06:29Alex VolkovAnd, and I think for folks who haven't, like, tracked this category for a while because they said, okay, you know, this is all like AI slop, et cetera. The video models is improving in a crazy rate. When we talked to you about Seedance before, Seedance was the only one that look at take up to like 5 references and do text to video and image to video. All of these now can do video to video and references for faces and characters, and the character consistency is insane, is insane. So now we're looking at realism, and uh, and and speed, basically, because Seedance took like, I don't know, 2, 2 and a half, 3 minutes to generate 30 seconds, and now,

1:07:02Alex Volkovyou know, this one is faster. Wolfram, go ahead, and then we'll show some examples of the, the PAL one.

1:07:07Wolfram RavenwolfAnd H3 is also taking off in the local AI scene because I'm running this on my 3090, and it works very well.

1:07:14Alex VolkovMinimax H3, yeah.

1:07:16Wolfram RavenwolfAt Minimax H3, yeah, you can now run a, a front, yeah, it's, it's almost frontier. I would call it frontier. I mean, you have Omni and Reference and all of this, and you can do this on your own GPU, and the community is fine tuning and optimizing it, and so it's really fast now. It is amazing what is happening here.

1:07:33Alex VolkovAll right, folks, I think it's time for us to, uh, to move. Oh, we're 5 minutes late. I'm so sorry. Okay, folks, it's time for us to to get to our next guest on the show. let me just run through this. so Cling 4, Flux 3 Max, and Crea 3 also launched a a model. It's number 4 on Arena multi-image edit leaderboard, so shout out to the folks at Crea. and yeah, Odyssey ML we don't have time to go to. All right, folks, time for us to move on because this week there's a lot of great open source, news from Western Labs. I am very, very happy to, invite, Tim Shi from, from Recursive AI and Prince Canuma, our friend, uh, second time, I think, or third time from the pod from

1:08:11Alex Volkovlike the local AI MLX community. think. Uh, Tim, how about this is your first time on the pod, and I know this this came together super quickly, so really appreciate you coming on, because you guys just launched Flint. Would love to just have you introduce Recursive AI and then, and then yourself, and then we'll, we'll get to Prince, and then we're gonna talk about this most, most, most, most exciting release from you guys.

1:08:31Tim ShiYeah, super excited to be here, and thanks for having me. Um, Recursive is building, um, yeah, self self-improving AI for us to build super intelligence, and we want to automate knowledge discovery. So the idea, uh, the process of ideation, implementation, validation, the whole scientific method, and we're applying to the science of AI first. So Flint was like the first demonstration of this technology, or we call it Eureka Machine, where you can basically apply it to the discovery of the training of the mod- training of a small language model, and then we, uh, basically optimize model for, uh, Mac. So it will run really fast on Mac, and it has like a lot of capabilities that can

1:09:10Tim Shisort of do for your daily workflows. Um, yeah, so my background is I started my career actually with, uh, working with Richard and then NLP Labs in, uh, at Stanford and then OpenAI, and then I started a company called Cresta, basically one of the early attempts to apply, um, AI to enterprise. And then, yeah, super excited to be here and also, um, yeah, to talk about a release.

1:09:33Alex VolkovThat is awesome. absolutely thank you for coming. We're gonna get to Flint in a second. I also like a bunch of questions about the Eureka Machine, whatever you guys call the Eureka Machine, RSI, et cetera. Prince Canuma, second time on the show. Some folks know you as the MLX King. You want to briefly introduce yourself so we can get to the, the, the meat and potatoes of the most important thing, in, in open, in Western open, source AI this week?

1:09:53Prince CanumaAbsolutely. Thank you for having me, Alex. Hi, Tim, uh, once again. Uh, Prince Canuma here. I am the creator of MLX VLM. Over the past 3 years, I've been building infrastructure to run AI on Apple devices efficiently. We just crossed 7.5 million downloads in our engine, and, uh, happy to have brought uh, day zero support for Apple Silicon on MLX for Flint.

1:10:17Alex Volkovfolks, I'm looking at the Flint website, which I think I should like just the show while team we have the questions for you. let's pull this up here. this is quite the model, and a very small one at that. So could you introduce us to Flint before we talk about the Eureka machine sizes-wise, what are you guys aiming for, and why is it so cut and fast? Or how?

1:10:39Tim ShiYeah, we, we think about Flint as a first demonstration of our Eureka machine, sort of our, system to automate scientific discovery. and the Flint has, our goal is to optimize it for, like, your daily coding use cases. So developers can run Flint on a Mac, M4 and M5, and get really fast speed, and you can see, and be able to, like, sort of drive a lot of their daily coding use cases.

1:11:03Alex VolkovYeah, Prince, you saw this as well, like, there's like over 125 tokens per second on M4.

1:11:09Prince CanumaUh,

1:11:09Alex VolkovPro and

1:11:10Prince Canuma100, 189 as of yesterday, but this is more of like a branch that I'm working on.

1:11:16Alex VolkovYeah. And, um,

1:11:18Tim ShiYeah.

1:11:19Alex Volkovis, tell us about, so, okay, so I do want to like, talk about sizes a little bit, right? It's a 40 billion, parameter model, but like a very, very sparse MoE, right? Uh, uh, Tim, could you talk to us about like how... Okay, so the Eureka machine, once we get to, did it make the decisions? Like, how do you guys arrive at that, like, very, very, very sparse kind of architecture, 2 billion parameter active? Is that what, like, enables the speed? and how is it compared to, like, other models in open source that are running at the same-ish size?

1:11:48Tim ShiYeah, we actually first look at the sort of hardware substrate, right? So we work with closely with partners like, um, you know, N- NVIDIA and AMD, and we look at, you know, for a model to be running locally, what are the, basically the shape of the model to be eff- efficient, right? So for MacBook Pro, um, we basically asked the model to search what is like the most, um, efficient architecture, and it come up with something that's like actually way sparser than, um, uh, sparser than like comparative models. Um, so we ended up with a final architecture of 40 billion total parameter with about 2.5 billion active per token, and it's, um, basically what the Eureka Machine think will project it to offer the

1:12:29Tim Shibest combination of speed and coding performance, sort of among like all the configurations you can have on the, uh, of on the on the Mac, on the Mac, um, yeah.

1:12:38Alex VolkovI find your last sentence incredible enough so that I will ask you to repeat it. This is what the Eureka Machine thinks that is the most optimal. Let- let's

1:12:49Tim ShiThat's right, yeah, yeah.

1:12:50Alex Volkovthe- let's talk about it. It's- it's incredible. You guys are like, literally the name is Recursive. Recursive, was that rebranded to SI or not yet? but Recursive Superintelligence, I think, is the concept. and then now you're referring to the fact that, like, the thing that built the thing, that's how you guys arrived at the architecture. How involved were you guys at the building of this, the decision making versus the, the Eureka Machine decision? And what is the Eureka Machine? I think it's time for us to actually talk about what is that, because I think it's maybe more important than the actual model.

1:13:22Tim ShiIt's funny that you mentioned it. We actually got the domain recursive.si, um, and it's also stands for recursive super intelligence. recursive self-improvement is also recursive super intelligence, um, and we are thinking about basically the Eureka machine as a basically basically a machine to automate scientific discovery. So it will basically have, um, think of it as like a community of scientists and agents that will come up with ideas and, you validate ideas and implement those ideas. So it runs in a loop, um, keep, you know, trying different things that will potentially improve the, um, your objective. So you define a certain objective for this particular example, it's going to be speed

1:14:02Tim Shiand coding performance. It's a good combination of what we think is going to be good for developer on the machine. And then the Eureka machine basically search for different combinations of, uh, different architecture. And of- of- obviously, like, you know, it's not inventing, like, completely new, like, say, transformer architecture, right? Obviously, there's like a lot of unknown unknowns in scientific discovery, but within the known boundaries of what you can, um, search for, I think it's sort of find some interesting discoveries.

1:14:31Alex VolkovThat is, very interesting. How how recursive is it as well? Is the Eureka Machine, like, update the Eureka Machine, inference or code or, directions? Can you talk about, like, the recursive part as well? Because, when you say Eureka Machine came up with this model, this model is a small model. h- how recursive is the recursive part?

1:14:52Tim ShiYeah, so the Eureka Machine, um, is a larger system and model with combination of different models and, um, harnesses, but, uh, uh, we're sort of moving towards eventually Flint, we'll build the next version of Flint. Um, currently, um, it's basically a larger set of systems, models looking at the small model and say, what are things to improve? So, for example, um, um, I think Thomas Wolf actually, um, posted about this as well. It's like an AI researcher looking at the LM head would say, you should always keep it in high precision and never decide to quantize it to 4 bits. But our Eureka machine actually tried that idea and validated this actually a good

1:15:27Tim Shiidea for, uh, for, for Mac and local coding use cases. So some, some of the, some things like that that maybe human scientists will overlook, but, um, a, a Eureka machine, like an automated AI scientist, would just, you know, combining all the existing knowledge, propose a hypothesis that might eventually be true. Those are the discoveries that we think that our machine will be able to make, um, down the road for many different domains. I think it'll be really valuable for, for the, for the science itself.

1:15:57Alex VolkovI, I think that's kind of incredible, especially like some of the decisions that, you know, maybe humans didn't go through. Uh, let- let me go to Prince for a bit, for- for the model itself. Uh, Prince, you've been testing out like, maybe

1:16:07Prince CanumaYes.

1:16:08Alex VolkovDay- Day 0 support as well. Tell us, is this a mo- is this a good model for a daily driver for coding right now?

1:16:14Prince CanumaYes. So actually, I rank it around one of the top 3. I have a- a list that I keep at all times because people ask me all the time.

1:16:21Alex VolkovYeah.

1:16:22Prince CanumaRight now it's- it's Flint, it's Cohere, and it is Qwen 27B, the, the most famous one. Those are really good models, and actually Flint was surprising to me because a lot of models you have to, like, ask a question and then ask it again and continuously do that. Flint, tool calling, great, as well as, like, building artifacts, like, hey, build me a game, take documents from the internet, store it somewhere in my computer. It can do all of that. And uh, right now it's my main daily driver for, for a couple weeks on the native.

1:16:55Alex VolkovWow, that's quite incredible. And uh, Tim, kind of like I'm, I'm always assuming when I bring folks from different labs for training models, like I'm always assuming there's something else that, that they still don't like can talk to us about, about like the, the new iterations. But given the name itself, it's like very, very obvious where you guys are going to, to, to improve these models. I guess my question to you guys is like, why start from local and why bet on open?

1:17:23Tim ShiI think the answer to open is very clear. I think that, you know, historically, uh, models being like in closed, uh, source, at least in the Western Hemisphere, and I think that, uh, a lot of Chinese open source models, open way models actually gained a lot of adoption in, um, uh, large enterprises, and we see the curve of, like, companies shifting. You know, maybe they start with large, you know, closed models, and they realize that the cost is going to be very high, and then they start shifting towards, uh, open way models. And we actually did that before at Cresta, like we with like OGPT models, and we shifted to fine tune our small, we actually have like tens of th-

1:17:58Tim Shiuh, tens of like different, uh, open way models, small models running production, running different things like summarization or, you know, some, um, auto triaging tickets and all these like specialized ta- tasks. And it's obvious like enterprises would eventually own their intelligence in a sense like they would prefer to have control over their intelligence instead of like relying on a external partner who, you know, may n- may may still be very costly at the time. So we think that this could be the future where people, some people would choose open way models, some people would choose like closed source models, but at the end of the day, it's the customer's choice, and I see the usage

1:18:37Tim Shiof a model is going to be, um, really high in the next year or so. And, and to answer your question about small, I think that we're just getting started. This is our first model release, and, um,

1:18:48Alex VolkovMm.

1:18:48Tim Shiyeah, we'll see how, what the Eureka Machine can do in the future.

1:18:52Alex VolkovWell, Tim, we, we, I don't know how familiar you are with Thursday AI, but like we, we've been doing, a segment on open source AI and modeling for the past 3 and a half years, and every time that we have somebody from the labs come in and then we see Apache 2, we have, we have applause because I think it's very, very important for the ecosystem. So thank you guys for releasing this in like a very open licensing as well. I also want to mention the speed with which you train this. I think this is like one of the highlights, just before we, we drop off, this is one of the highlights in the blog post for me. could you talk about how fast this happened and,

1:19:23Alex Volkovhow? Just how?

1:19:26Tim ShiYeah, actually, a lot of kudos to the technical team, and I think, um, there's a lot of effort went into this, but I'm also very impressed by how fast we're able to put together, the, um, whole model factory and be able to, like, train the first model, and in about, like, less than 4 months. And I think a lot of this actually-

1:19:44Alex Volkov4 months to release a model from scratch.

1:19:48Tim ShiWe actually didn't have any pre-training, post-training effort until like 1 month ago, and we were debating what are the use cases, product use cases of like, you know, Eureka Machine. We thought we should be using it to train models, and I think that we just decided to put together teams, but also rethinking how, you know, agents can be used in the whole process and how Eureka Machine can be used to accelerate that process. So we apply auto research to almost every stage of the pipeline, from pre-training to post-training to RL to inference, and we think that that's going to be, um, uh, a way for a lot of labs to accelerate, to catch up, to

1:20:27Tim Shilike, you know, build models in a, in a, in a way that wasn't imagined before.

1:20:32Alex VolkovI think, before, so that is incredible. Four, four months from nothing to no pre- training to a model that runs and one of the fastest to, to run on local hardware, I think it's incredible. maybe for folks who are listening who are like, I can't wait to try the Flint model. Uh, excited about the recursive stuff, excited about Eureka Machine, but like can't wait to try the Flint model. Uh, maybe from both of you, any, comments about how best to use this? Like all models come in with their tricks, with their, with their like specific stuff. Prince, you already mentioned something. Uh, team would love to hear from you. What, what do you find from, from using Flint, like, locally, that folks need to

1:21:01Alex Volkovknow about, like, how to prompt? Is there, like, any specific things about reasoning or quirks like that that are different from different models? Uh, would love to hear i- like each one of you give us a little bit of a tip to folks who are listening who would like to use those locally. Oh, and also,

1:21:15Tim ShiYeah, we'll be curious.

1:21:16Alex VolkovI'll bring in Nisten, the co-host, who has been using this all day and wants to to tell you all about this, but let's start with with use cases as well.

1:21:24Tim ShiYeah.

1:21:25Alex VolkovYeah.

1:21:25Tim ShiI would say this model is more agentic. Yeah, I would say this model is more agentic than than, um, feels like you can run it locally, do a lot of things. Um, but remember, this is the small model, so, you know, and compared to, um, like Opus and all these larger models, you typically would need to give it more instructions and guardrails and, you know, tips on what to do. And it's just the nature of the model, but also you can, um, yeah, because also I'm just curious, like, what, what other things you guys were able to build with this? So, yeah, feel free to share on social media about things you build and how you use the model.

1:21:59Nisten TahirajSo I, I have it doing both stuff for, uh, smaller models, just doing testing, but the most fun thing I have with it is I made a big city-sized GTA mod simulator, and, uh, this was probably the smallest, fastest thing that I, I could actually run as a character, uh, going around, uh, to make decisions and stuff. I just want to know what, what went into, uh, RLing it, uh, so well. A- again, it's not perfect, but it's pretty easy to, to prompt. It is actually pretty, pretty obie- obedient. So I want to, what went into RLing this, and do you guys plan on turning it into a

1:22:40Nisten TahirajJEV as well? Because it's kind of ideal size.

1:22:45Tim ShiYeah, I think, uh, that's, that's a good question. I think the RL, I think our, I think put a lot of effort to making sure the model is very agentic. And the JEV question is qu- um, interesting. I'll be curious to see if someone could make a demo around, like, you know, just model modest by itself to train itself to be a JEV. I think that would be a cool demo to show.

1:23:02Alex VolkovNo.

1:23:03Prince CanumaYep.

1:23:03Alex VolkovUh.

1:23:03Prince CanumaThe good, the good thing is that you can run up to like 8 agents in parallel and, and have really good performance. So you're talking about each agent, like 32 tokens per second and averaging like nearly 500 tokens per second on a, on a M5 Max, and this could work on a 48 gigabyte, even up to like 36 gigabytes. And if you have more memory, great, but you can run a parallel agent with it.

1:23:29Alex VolkovI think th- this is a great place to end our interview on because specifically, given the next segment about security and other stuff, and given the personal agents stuff, many people would like to run agentic models locally completely so that no information leaves their systems. And, you know, that that's one of the big upsides for local agents completely, like everything's running on your system. Tim Shi and Prince Canuma, thank you so much for coming and telling us all about Flint.

1:23:52Tim ShiMy pleasure.

1:23:53Alex VolkovRunning, running this locally. We're very, very excited about the new lab as well as like a new leader in in the category, and the speed is really, really impressive. So, so definitely give Flint a try. I will be monitoring the other stuff, so team feel free, and welcome to come back once we, once the Eureka Machine decides to release a bigger model. I I'll I'll we'll we'll be definitely down to to host that as well. Thank you so much for joining as we move to our next segment. Thank you, Alex. Bye-bye. Cheers. Thank you, Alex. Uh, thank you, team. Thank you, Prince Canuma. And now, I think I'll bring everybody back to the stage for this as we introduce Josh Long.

1:24:26Alex VolkovJosh, I don't think you've been in video form on the pod before. We definitely chatted. I should have, I should have chatted with my Claude to rearrange the segments because, uh, we just finished a very high note, local, open source, Apache, like, works amazing, runs, and now we have to talk about the Black October, the very scary stuff that happens in the world of cybersecurity. Josh is a cybersecurity evangelist, Josh, some folks are calling whatever's happening right now in cybersecurity is the Black October. there's a lot of vulnerabilities and hacks are happening all the same time, so much so that folks are saying, is the internet done?

1:25:03Alex VolkovWhich is very scary. Just to name a few of them, the bigger ones, and the reason why we're talking about them to you in the AI show, AI news show, because a lot of them are AI related. Some of them are maybe swarm stacks, some of them were discovered by AI. we'll start with PHP2Shell, which is a huge vulnerability in the most, popular language in the world, the most websites run on. I think, like, the the latest stats are talking about 70% of the world's websites are still running on PHP. PHP2Shell basically gives an ability to take over that machine without any, like, credentials. There's also a, an updated CVE in, eMudhra, was that eMudhra, right?

1:25:41Alex VolkovLike, the certificate, update that lets everybody say that they have a, valid HTTPS. There's just some of the stuff, including LiteLLM getting a supply chain attack. Josh, you're smiling. H- how are you still able to to smile, given that everything is going on right now and folks are f- freaking out? I want, I want some chats about that.

1:26:01Josh Longokay, so for for one thing, it gives me an opportunity to get to talk about fun stuff like this on shows like, uh, ThursdAI, so, uh, that part of it I don't mind. Um, but yeah, I do think that, so there there tends to be a lot of like Y2K like hype around things like this, right? Everyone Yeah. starts freaking out, and it's like, oh my gosh, it's the end of the world. But, it, so a lot of the standard kind of disclaimers apply here, right? talking about uh, the PHP2 shell vulnerabilities first. there were, a few, independent groups who discovered these, two vulnerabilities. that we had Calif and Wiz and even OpenAI, and they were all kind of like finding

1:26:41Josh Longthese independently and reporting them,

1:26:43Alex VolkovYeah.

1:26:43Josh Longum, which is really interesting because that doesn't seem like that happens very often. The last time that I remember that this being like a big thing where a whole bunch of people independently found the vulnerabilities and reported them was back with, uh, I think it was in 2017, toward the end of the year, um, with Spectre and Meltdown, and those kind of like came to light all of a sudden in January 2018, and everyone was freaking out about those too.

1:27:08Alex VolkovYeah.

1:27:08Josh LongUm, so kind of unusual to have a situation like that where multiple groups are independently discovering the same vulnerabilities and reporting them at the same time.

1:27:16Alex VolkovSo, I said that, Daybreak, the, the kind of responsible security program that they allow slowly people into to, to be able to extend the defender's window, whatever Greg Bachman called the defender's window, right? Like, we have a limited time until all these, like, other intelligence catches up to the frontier of cybersecurity. we have limited time, so Daybreak is their system to let people into, and with GPT 5.6, oh, sorry, 6.1 Sol, th- this is like w- where they discovered the PHP vulnerabilities and disclosed it to PHP Foundation, right? And also Calif and and Wiz and folks, th- they apparently use Gemini Argon, f- for that as well. both arrived at the same thing.

1:27:53Alex VolkovWhat is that thing, Josh? Could you tell us, like, what w- what folks need to be n- what folks need to know about the the PHP 2 shell, and what they need to do as well?

1:28:02Josh LongYeah, so, uh, the the most important thing is, first of all, if you are running a PHP server, you need to make sure that it is patched. Like, hopefully you patched yesterday because, um, you know, these are pretty critical vulnerabilities. Um, a- as far as the the ratings go, um, a 10 is the highest. The CVSS score for these, I think, is 9.2. So it's like just about as critical as it gets as far as vulnerabilities go. Um, so these are very severe flaws, um, and it's very, very important to make sure that you are patched, uh,

1:28:35Alex VolkovSevere enough that both the FBI and an NSA accounts on Twitter and the Prime Minister of Japan and multiple other, like, state, big state, like, companies all came out and said, hey, patch or go offline.

1:28:49Josh LongYeah.

1:28:49Alex VolkovThis is like how big this is. Like, you have to patch or completely take your system offline until you are able to. Don't keep them online. this goes out to everybody who listens to th- th- does run like PHP software, whatever WordPress is. we will say, though, uh, many companies and clouds, if you are running things on the big clouds, they have protected this, and if you have, like, a web firewall in front of your website, like a Cloudflare or Vercel, right? those, they have released, they have updated their, their web firewalls and have released, like, protections, but you still have to patch. Like, it's still, like, very important.

1:29:20Alex VolkovYeah, Josh?

1:29:20Josh LongYeah, 100%. Yeah, I was gonna mention that too. So I- I- I've seen a lot of, like, yeah, again, hype and kind of misinformation going around online where people are saying, you know, you might want to just stay off the web for the next couple of days, and and I- I'm like, well, let's think about that. Let's break that down. Okay, so first of all, the big Fortune 500 companies, um, are are going to have patched immediately. Um,

1:29:43Alex VolkovYeah.

1:29:43Josh Longthey already had web application firewalls in place anyway, which would have mitigated those kind of, uh, attacks. So, um, there there has been an increase in attempted attacks, uh, but, um, but because just about everybody's behind something like Cloudflare, um, you know, they're pretty widely protected, like, even if you haven't patched yet, but hopefully just about everybody has patched by now. Again, if you are running a PHP server, you need to make sure you're on the latest patch. Um, uh, it- there's no excuse for that. Even if you do have a web application firewall, you need to make sure you're patched. Um, but, but it's not the kind of thing that people need to be, like,

1:30:23Josh Longfreaking out about, "Oh my gosh, like, can I browse the web? Am I unsafe?" Well, think about it this way. So, um, if, like, you shouldn't be entering personal information into random websites anyway, right? So, like, it's- it's really- it's really probably not something you need to be extra, like, height- on heightened alert about, right? Um, like, go about your daily business, don't worry about it too much, but it's, it's more on the side of the people who are running websites, especially if you're not a Fortune 500 company who's got a big security team and all that. Um, you probably are more likely to be impacted by this because you need to patch

1:31:01Josh Longyourself.

1:31:01Alex VolkovYeah, and hopefully folks are not self- hosting those completely and hosting them on servers, and cloud providers that, that they do kind of like patch because it's in the language itself. So that's one thing that happened. PHP2Shell is, it's kind of crazy. the first class, but there's a few vulnerabilities that were discussed. I, I do want to talk about the, the, the, the eMudhra kind of like signature signing. Could you walk us through that one, Josh? Like, uh, and Nisten, I see you like want to chime in. Feel free to chime in here as well, if, if your experience is like different, because we need to talk about the class of attacks and discoveries getting faster and faster

1:31:36Alex Volkovwith AIs that are able to do this now, and whether or not this is now our daily lives, like, should we always keep our OS up to date and browser up to date now, which is good security practices, which you can get to at the end. Nisten, you want to chime in here on about something? I see.

1:31:48Nisten TahirajYeah, as as someone that built their own router at home on Alpine Linux and sets own SE Linux policies, Josh, what about people that just don't care at all? Like, they actually just do not, uh, care. Like, what does this go? Because I know I could run an LLM on their, on their server or turn it into a botnet or something, it could harass people. But what about, what about people that they just, they still just do not care?

1:32:15Alex VolkovWhen you say they don't care, what do you specifically mean? You mean

1:32:17Nisten TahirajI mean, literally do not care.

1:32:19Alex VolkovNo, but like about which part? About the fact that now there's vulnerabilities outside?

1:32:22Nisten TahirajAbout PHP on websites or their servers.

1:32:25Alex VolkovAh, yeah.

1:32:27Josh LongSo, so you're talking about like server operators who don't care.

1:32:30Nisten TahirajNo, no, just the people that own the these, these websites and that go to them.

1:32:34Josh LongAh,

1:32:34Alex VolkovYeah, server

1:32:35Josh Longyeah.

1:32:35Alex VolkovYeah.

1:32:36Josh LongSo, so I, I guess, um, the thing that people should be aware of, if you are running a website and you don't have a patch and you don't feel like you need to worry about this, um, you probably don't understand the severity of situation, right? So, so anytime that there are major vulnerabilities just flapping in the wind, right? Like, uh, somebody else could come along and pretty much compromise your site. They could, um, could take your site offline, right? If, if you're running an e-commerce site, um, guess what? You're not gonna have sales, but it gets worse than that because now it's reputational damage to you, right? So, um, it- nobody's ever gonna trust you again if they know that the last time they

1:33:12Josh Longwent to your site, um, it was compromised, right? It- and- and, you know, and- ...there are different things that could happen with that compromise. Sometimes it's a very, like, public, obvious thing where somebody defaces the website. Um, other times it might be, um, sort of a more behind the scenes thing where they're, uh, they're in there, but they're not making themselves, like, widely known, so they're kind of, like, able to steal, um, information that people are providing to the website, right? Potentially including sensitive information, might be credit card numbers or whatever else people are typing into the site, right? So, um,

1:33:50Josh Longi- i- it's- it's a- an important responsibility. If you are choosing to run your own server, you need to make sure to keep it patched. That's super important. Uh, if n- if for no other reason than your own, you know, reputation, um, you need to make sure to keep it patched.

1:34:06Alex VolkovSo, ThursdAI is focused on engineers and folks who are building in the public, right? So many of us are running websites. There was also some vulnerabilities in Node.js, which folks need to know about and, like, patch their Node.js. There was also, supply chain attacks that, you know, hopefully they were patched with sorry, LiteLLM. The other class of a big vulnerability that was discovered was not related to AI at all. It was like complete negligence from the company called eMudhra that they signed HTTPS certificates, and instead of, Josh, please correct me if I'm wrong here, but like I'm not a cybersecurity expert at all, but like instead of a

1:34:36Alex Volkov24 or 48 like, like long character signing key, the keys were literally just, one of them was just like like the number 4, one of them was 56, whatever. Some faulty thing, could be, I don't know, led to the fact that those security, signatures were compromised completely. That is a different class of things to worry about. Could you walk us through, what, what a, how should I say, a compromised HTTPS signature, affects, how it affects people in the wild.

1:35:03Josh LongRight, um, and and by the way, this is actually not the first time with eMudhra, that's not not the first time we've had a, um, a similar situation. So, um, I actually, um, wrote a blog post way back in like 2011 about a company called DigiNotar, um, that, uh, had a ha- had a situation where their um, uh, root certificate authority was, uh, was compromised. Basically, what happens in these kind of situations is that, um, uh, anybody who wants to can create their own certificate impersonating any website that they want. Um, now that doesn't mean that, um, anybody out on the- the- the web could,

1:35:45Josh Longum, reasonably, like, imitate Google. This is more of a, like, a- a- a- um, they call it a man-in-the-middle type situation, right? So if, for example, like, let's say that, um, you went to your local restaurant or cafe or whatever, uh, hopped on their public Wi-Fi, uh, publicly available Wi-Fi, right? And, uh, and somebody, um, running, uh, or who was, um, could insert themselves in the middle, right? So- so basically the, um, the person hosting that Wi-Fi, um, or de- depending on- on the situation with, uh, you know, if it's like an open

1:36:23Josh LongWi-Fi network, maybe even somebody on the same network, um, could find a way to get in between you and the website that you're trying to access. Um, if they had one of these vulnerability, uh, vulnerable, um, certificates issue or that appeared to be issued by eMudhra, um, if your browser trusted that eMudhra root certificate, um, then it would trust that you were actually going to, for example, Google.com or wherever

1:36:53Alex VolkovMhm.

1:36:53Josh Longyou were trying to go. Um, so it- th- there's a lot of things that kind of have to- to be in place that- that- it's that man-in-the-middle aspect of it that makes it, like, probably not as big of a deal as I think a lot of people worry that it is. Um, I have seen people, you know, s- suggest that it's, uh, a- again, kind of one of these world-ending events. It is pr- a problem, no doubt, and, uh, so the major browsers, if you're keeping your browser up to date, that's really important because they've already removed, um, that certificate. Um, Apple is the one that's kind of a little bit problematic right now because, um, uh, Apple takes a long time to, uh, i- in- in between patches,

1:37:35Josh Longright? So they haven't put out a new version of Safari, at least, uh, unless they did, like, in the last hour or so.

1:37:41Alex VolkovYeah.

1:37:41Josh LongUm, there's not a new version of Safari out yet. Um, uh, and and Apple does take a long time typically to release patches, just in general. Um, but if you're running, you know, Google Chrome, uh, Brave, you know, Edge, whatever, they've got patches for all of the, uh, Firefox, for all the all the major, um, browsers have already removed the eMudhra certificate, so nobody else can pretend to have a, a, uh, a, a signed certificate that, you know, can let you impersonate something like Google.

1:38:16Alex VolkovImpersonate and then decode traffic. I think this is like the biggest thing, right? like the man in the middle part that you're talking about, like HTTPS traffic is s- secured, and this is why the signatures those exist. If they pretend to be one of those, they can say, hey, I am an legit HTTPS like thing, but then decode the traffic that's supposed to secure, like credit card data and other stuff. if you're still browsing and not going to HTTPS only sites, that's a problem. But if you are, now you update your browser. I think that this is like the most important part. it's very, very important to update the browsers, update the OS systems as fast as

1:38:47Alex Volkovpossible. Um, and I would go and say as far as don't go to websites they're not big and known to purchase stuff as well and enter your credit cards is always a good advice, but the, like, the best advice right now is just don't go to a random janky website, enter credit card form.

1:39:02Nisten TahirajBy the way, the certificate key, what happened there is that during the key signing ceremony, the 384-bit key was just changed to a 4, which is so sketchy, but also so elegant. And, in my opinion, yeah, it was definitely a human that did that because they just found out that, like, the private key was literally just the number 4. Like,

1:39:22Alex VolkovYeah.

1:39:22Nisten Tahirajif it was an LLM, it would have at least done something better. That was, that was definitely, uh, the humans. It's, it's pretty, it's pretty funny. But the update, um, I'm like rebooting a whole bunch of stuff right now, I just realized.

1:39:36Alex VolkovYeah, there's a lot of like, there's a lot of, non, like, again, for, for folks who are maintaining servers, not folks who are just browsing the web, there's a lot of work to do now to upgrade, know, Linuxes and, and, PHP versions and Node versions and et cetera. so hug ops to everybody who spent a lot of time lately not going to sleep to like like try to mitigate the scope of these attacks. The last thing that we do want to talk about this week also, and it seems to be picking up, is hacks on like major companies. So OpenCode was hacked, what, a week ago or so, and they like publicly talked about this. And now Railway, which is a deployment place where

1:40:11Alex Volkovyou like deploy your websites and put the websites, was also hacked. And like the h- the thing that seems to be happening there, and we would love to chat with all of you guys about this, is that the extraction of API keys, specifically LLM API keys, is now what's happening because that's money. That's literal money to those hackers, right? Whereas previously, you know, in the world of, uh, let's say DeFi and and crypto, you would hack something because you can, like, sell those tokens immediately and then get valuable money. when somebody hacks a website, your personal data, you can sell it on the open dark web, but o- dark web has your personal data at this point already.

1:40:48Alex VolkovI'm I'm not sure how much your SSN is worth right now. but your API key to OpenAI, if it hasn't have a limit on it, that's essentially like a f- free and direct access to your credit. And there's a lot of folks who are buying those keys for distillation purposes on the black market. There's like many, many folks who cover the API keys on the black market. So that seems to be what's happening right now with Railway and uh, and OpenCode as well, which I think OpenCode caught up as well. and thoughts on this, folks? Will this keep happening like, like with agent swarms? This is, is this the defender window that Greg Bachman talked about coming to a close?

1:41:23Alex VolkovAre we at the place where, like, it's gonna be great, but for a while it's gonna be sucky? Like, how how to protect yourselves against it? Would love to hear opinions around, like, that specific thing.

1:41:35Nisten TahirajJust use TailScale everywhere and uh, eh, yeah. TailScale, Two Factor, and uh, just just vibe code your own dependencies and vibe code your own home firewall, and just, just don't trust any, any type of like sales or marketing material for a product. If you can't see the code or your agents can't see it, you, you literally just cannot trust it. I, I don't, I don't know what else to, to tell people.

1:42:07Peter GostevAgain, my, my question, something I don't, I don't really have a good feel for is, us people in security, like everyone, are they taking it like properly seriously? Because it's just weird how these things keep happening, and like the OpenCode team, they didn't have access to the, to Daybreak, right? It just feels like such a trivial thing, like surely you can just do that. So I don't know, like, do you feel like they're taking it seriously or not, not quite, Penny hasn't quite up yet?

1:42:38Josh LongI- it's, it's interesting because I, I think, um, so I'll, and you mentioned vibe coding, right? Obviously, there's a lot of people who are, who are just trying to do their own thing, and, and, and, uh, and I think that's where a lot of times these API keys will leak is because, you know, they're, they're, they're unintentionally putting their API key in a public place, right? And then someone can grab it, right? That, that is- is one of the problems that we're seeing. Uh, that's happened multiple times, um, where somebody's just, uh, unintentionally exposed their own, uh, private API key. That's- that's kind of problematic, and- and I think that, um,

1:43:16Josh Longyou know, if- again, if you've never run your own service publicly, and now you're trying to do that for the first time, and you don't really understand kind of how these things work, because most people, uh, probably really don't. Like, the average person really doesn't get that. Um, they don't understand what the potential problems are with exposing keys like that. Um, and so, you know, they just go with whatever output they get. It seems to work when they're testing it, and so they just publish it to- to the web. And so sometimes that's how these things get- get exposed, which, you know, and- and- and I don't expect that everyone's going to be a security expert,

1:43:49Josh Longright?

1:43:49Alex VolkovYeah.

1:43:50Josh LongAnd not everybody knows to, you know, prompt like, hey, is there anything about this that, like, maybe I should consider doing to harden this before I publish this to the open web and start advertising it? Um, it would be nice if people thought to do that, or if, uh, that was like sort of baked in whenever you're developing something, uh, vibe coding something, but.

1:44:10Alex VolkovThere is a reason why it took over 8, uh, Peter, we we talked about this, I think, on the public. There is a reason why it took over 8, 9 months for the bigger companies to release something like a personal agent to you. Like OpenClaw and Hermes, which you run on your computer and you're kind of in charge of the security itself, that's one thing. There's a completely another thing to allow people to provide their passwords, passwords, and then save them in the, in like a local, but secure way. that the LM doesn't have access to. Like, all that infrastructure has to be in place for people to like, to, to, to go trust because like if one of those vulnerabilities goes around and actually

1:44:45Alex Volkovlike steals your data from your personal AI assistant, it's gonna be like awful for a reputation of the company. There is a reason why, like, only now, almost a year after Peter Steinberg innovated with the OpenClaw, we're seeing these companies step in, despite them very clearly realizing the benefits of, hey, personal agents is like much more sticky, sells more tokens, it's harder to to to switch from, et cetera, because there's security there. Wolfram, to your, to your metaphor from before, building your house versus renting it, so I would, I would add on that metaphor, given the security considerations we're talking about now. this is the difference between building your house and not really knowing what a,

1:45:18Alex Volkova door bolt, security bolt is, and living in a high-rise apartment with a security guard at the door, right? Like Muse, the folks have hired, Moxie, Marlinspike, the folks from Signal for the E2E connections. cetera. They are known for security significantly more than you just like vibe coding your server in Nginx and running this on, on like PHP, which is now fully compromised, which is scary. The practical advice that we want to give folks is, obviously, if you are having any API tokens, and you were on those exposed websites, OpenCode, or Railway, et cetera, rotate them. Like, know which agent has which API token. It's very, very important.

1:45:52Alex VolkovI know it's a pain in the ass, but at days like this, a pain in the ass is very well worth it. Put caps on your API tokens as well. Put caps in email notifications. Get email notifications when your API keys are like running out. put, uh, you know, it's better to to to put auto auto refill because then you at least get a notification from your credit card statement that like your key has been auto refilled. So if you see like multiple ones happening in succession, you'd be able to like run and stop this bleed, basically, if your key was exposed. Rotating keys is very important. And I think the the last thing is very clear for many people.

1:46:25Alex VolkovMany people don't have this yet. Use a goddamn password manager. Use a password manager and store those keys so you don't have to remember them and put them in files. It is, it is increasingly more important now than it used to be before, given that, you know, you're giving your keys to agents, etcetera. Wolfram, you want to chime in with some security practices simple for folks?

1:46:45Wolfram RavenwolfYeah, you, you already gave the practice I wanted to mention, but you should treat it like a credit card, but it's even worse than that because the credit card, you also have the CVC number, and you often have to do a two-factor to authorize a payment.

1:46:57Alex VolkovAnd credit cards are secure and protected by the credit card companies. I don't think your API key is gonna get re- refunded by OpenAI if it was leaked. Like a very, very big point. Like they can, you know.

1:47:06Wolfram RavenwolfYeah. So treat them even more securely than your credit.

1:47:09Alex VolkovYeah.

1:47:10Nisten TahirajI, I, I have the most fun advice, just to install TailScale everywhere and give it to your, uh, go on Instagram on your Meta Muse, and then, uh, you just talk to, uh, Muse on Instagram and just be like, hey, every day just go on every single device I have and run a security check of every NPM and and PIP, uh, needed thing, and just give me a report. I- I- I'm joking to do it with Muse. I- I do it with Opus. It- but it's a very simple prompt, just every day at 6 a.m., uh, just check every single pip, NPM, Linux package, whatever I have on my

1:47:48Nisten Tahirajsystem, and give me, and also check up the, the latest, like, uh, SNIC and Socket IO news, and give me just an overall security report of what I need to do, or send me an alert if it's something bad. That's it. It just runs it every day. It's pretty simple. That's what's saved my ass almost all the time.

1:48:06Alex VolkovJosh, any any other chimes into, like, what folks can realistically do to to, like, at least somewhat protect themselves in this world of increasing security vulnerabilities and and agent hacks?

1:48:19Josh LongYeah, I, uh, so generally speaking, um, the the standard security vice advice just kind of applies here, so, um.

1:48:26Alex VolkovEat your vegetables type stuff, yes.

1:48:28Josh LongYeah, yeah, yeah, yeah. So, like, obviously make sure you're using multi-factor authentication on everything, uh, you know, make sure you're keeping your operating system, your browser, and everything up to date. Um, when there are new patches issued, make sure you, uh, apply them quickly. Um, the- the one kind of caveat here, the- the irony is that, uh, you know, with some of these, uh, software supply chain attacks, right, the- the LiteLLM thing, um, uh, that's, um, one of those awkward situations where if you are following that best practice of, like, updating immediately, like, as soon as something comes out,

1:49:04Alex VolkovYeah.

1:49:04Josh Longum, you could ironically end up getting compromised, um, instead because of that su- a supply chain attack. It's- it's kind of a- one of those unfortunate catch-22 situations, but generally speaking, for- for anyone listening, uh, if- if you keep everything up to date and, and update pretty quickly, um, that's the best way you can protect yourself.

1:49:26Alex VolkovLet's draw a very clear distinction here between what you keep up to date and what you need to, like, wait for. supply chain attacks, they apply to package management, right, for software engineers. So if you are installing from UV or PIP or NPM or like PNP, whatever those packages, those packages can get, exposed by hacking the folks who distribute those packages and then put like, key extraction things or other things that can hurt your system. do not update those just willy-nilly. There needs to be a period of 24 hours, at least to let the folks know that they've been hacked and like claw back the, the, the LiteLLM, like exposed. this is what's called the supply chain attacks.

1:50:02Alex VolkovBrowsers, and we haven't seen like any supply chains and browser update, like update your browsers immediately, update your operating systems as soon as those patches come out. And for PHP and other places, you have to patch the actual patches that they released on your system. So those are like kind of like different things. Package manager supply chain attacks do not update immediately. In fact, the best practice that we know to to help you against supply chain attacks is to put a blocker to say, hey, I'm not installing any packages that are like at least 24 hours old, because hopefully in the 24 hours that passed, the, the folks who got hacked and the package was like infected, the, the package manager, you

1:50:38Alex Volkovknow, will take it back, right, claw it back. That, so package managers do not install the new ones, don't keep them up to date, like Josh was saying. Uh, operating systems, phones, uh, you know, browsers, those things need to be, when you see the update notification, hit that, like literally update.

1:50:54Josh LongYeah. Well, well said. That's a good distinction to make, uh, between stuff that, like, consumers are running typically versus stuff that is running behind the scenes, right?

1:51:02Alex VolkovYeah.

1:51:02Josh LongSo, so yeah, really good point about that. Um, eh, eh, f- for a lot of software, um, supply chain attacks, um, s- some- sometimes they're caught quickly. Sometimes they're caught, you know, within a couple of hours, like the LiteLLM thing recently. So, uh, i- in other cases, they might kind of linger a little longer than that. Um, so, uh, but- but I- I think that's that 24-hour thing, unless you know there's some vulnerability that you have to patch right now,

1:51:31Alex VolkovYeah.

1:51:31Josh Longuh, that was just fixed in the latest version, right? And if something like that does happen, they're gonna make a big deal out of it, right? They'll let people know it's gonna be a well-known, like, public thing, more than likely.

1:51:41Alex VolkovYeah.

1:51:42Josh LongUm, and in those cases, maybe you need to patch right away. Um, if it's not that kind of a situation where you know there's some urgent vulnerability that's got to be patched, then w- again, when we're talking about the software supply chain kind of things, um, probably a good idea to, to wait a little bit of time just to make sure.

1:52:00Alex VolkovHi, folks, we're coming to the end of the show. Josh, thank you so much for joining us and, and very clearly, helping folks and with, with, with positivity in mind as well. I think it's very important because, my, my, my comment to many folks in the group chats who are freaking the fuck out. Uh, if you are freaking out on X, yes, it's scary. Yes, there's a lot of stuff. The algorithm is poised. This is what the algorithm loves when you click on the, on the thing and you hover and you're like, oh, and even if you comment and write something in that area, the, the, the fear and gloom and FUD and like all of these things the algorithm absolutely loves. So you are, will get constantly people who are like first

1:52:34Alex Volkovjoining the algorithm and to get some clicks, but also like people who just comment on the same stuff, right? but you you'll be fed this fear over and over again in different forms and different types, different varieties, uh, because the algorithm loves the engagement. It does not mean the sky's falling, go out, touch some grass, and then come back and run some security stuff because it is important, but it's like the the the internet. I've seen some folks say, hey, go take out, you know, 20,000 dollars in cash to put it because like the the banks are like all done. Scary, but I don't know if we're quite there yet because, yeah, the companies are

1:53:04Alex Volkovpatching the PHP stuff, right? but definitely there's a lot of stuff that that the can of worms has been opened, and be security mindful as well. So yeah, I think may- maybe this is the advice. We all now have access to, basically security, like, uh, experts, if we can, like, knock on Josh's door, everybody, to run stuff for us. So definitely use that. the other thing that you did bring, and it's kind of like a breaking news type situation, Peter, thank you for bringing this up. we talked about, like, agent security. 1Password finally comes out with the platform for you and your agents to be able to run. They they're mentioning, all of

1:53:38Alex Volkovliterally everyone, bot and Anthropic and Claude and OpenAI and Muse and Browse and Town and like, et cetera. 1Password for agents. Give your agent access without giving up your passwords. When an agent reaches a sign-in form and requests a credential from your vault, if you approve the request, 1Password directly auto-fills the credential in the destination I think that's incredibly important. I've been waiting for this since, you know, Muse a- a- announced this, and it's just like absolutely crazy. I said, I signed up, let me in there. so shout out to 1Password for like finally like, getting there. if you are using 1Password, join this waitlist.

1:54:09Alex VolkovI think it's very, very important. It's kind of like the Stripe link for credit cards, but for passwords, and uh, I think it's very important. Again, if you are using agents at all, even if you are not using a one like password manager, 1Password I found for the past 15 years to be the most reliable for me. Josh, thank you so much for joining, folks. We're 2 and a half hours on the stream, but I think it was very, very important to at least mention some of the stuff because it does feel like the defender's window is coming to a close, and a lot of swarms, a lot of, like, bad actors with AIs are now, taking over. Like Nissen said, you, you do need to take some steps, and dedicate some

1:54:42Alex Volkovtime in your personal life to kind of protect yourself as well. The eat your vegetables stuff are always there freezing your credit, and and uh, specifically now I think the the the the more, um, how should I say, the the the biggest exposure for folks who are not realizing that this is exposure is API keys for LLMs. Those are directly connected to your account, especially if auto refill is there. Uh, put caps, put notifications on, uh, and then make sure that you rotate them if a website was like like Railway was exposed or or OpenCode. With that, I think we'll say thanks to folks on the stage, uh, and then we'll sign off this is it for Thursday AI for October 22nd.

1:55:20Alex Volkovthe biggest news that we talked about is this, the availability security stuff. We talked about, um, uh, Flint from, Recursive AI being built by the Eureka Machine, which is a re- recursive improvement machine, and is getting a very fast local model. we talked about holes in PHP and, your AI keys and, a lot more. Anthropic becoming a PBC and Anthropic stepping into the personal agent with, Claude Duet, which we got access to and we'll tell you all about next week. Hopefully by then the wait list will open. Thank you so much for everybody for tuning in, for listening into ThursdAI. Josh, thank you for joining. Peter Gosta of LDJ, Wolf from Nisten was here in Yam

1:55:56Alex Volkovbefore, and Tim joined us, as well. Thank you all for joining ThursdAI. We'll see you here next week. Bye, everyone.