Pinned Tweet
crimsonland RTX is out.
ion beams, fire bullets and nukes now light the whole arena. smoke runs as a gpu fluid sim: rocket exhaust glows through its own trail, laser sights cut the haze. monster vision turns the swarm bioluminescent.
uvx crimsonland@latest --rtx
ion beams, fire bullets and nukes now light the whole arena. smoke runs as a gpu fluid sim: rocket exhaust glows through its own trail, laser sights cut the haze. monster vision turns the swarm bioluminescent.
uvx crimsonland@latest --rtx
5
3
72
9,582
banteg retweeted
We’re still testing how exploitable the Node.js/Brotli bug is, but we’ve found that it’s surprisingly hard to tell whether you’re even affected.
So @ToBScottA built a scanner that finds hidden copies of the decoder, even in stripped binaries.
github.com/trailofbits/br…
So @ToBScottA built a scanner that finds hidden copies of the decoder, even in stripped binaries.
github.com/trailofbits/br…
10
66
273
18,719
banteg retweeted
bunny has been achieved internally 🐇 (early replay compatibility, the UI is a bit messed up, this is an older video)
quadnet kinda going ok, didn't have to decomp to extract rules
quadnet kinda going ok, didn't have to decomp to extract rules
had some time to do more crimson visual parity, also doing soldat now in parallel but we just started... the important part is that the "play any game over any network on any platform" framework kinda holds
4
1
11
1,454
banteg retweeted
Art has layers like programming. Not doing the lowest layer manually doesn't mean it's not art. You don't have to hand paint every letter to be a designer. You don't need to hand write ASM to be a programmer (a compiler or Codex can do that for you).
Miyamoto's thoughts on AI:
Miyamoto's thoughts on AI:
28
20
342
17,385
banteg retweeted
this game is so addictive
crimsonland now has online co-op in the browser 🔫
open crimson.land/play, hit play co-op, send your friend the link. that’s it. survival or any of the stock quests, each of you on your own machine.
it’s the original 2003 game’s own two-player mode, so it plays exactly like the couch co-op you remember, then only online change is whoever opens the perk menu picks.
under the hood it runs rollback netcode. each game runs ahead on your own input and quietly corrects itself when your partner’s arrives, so moderate lag doesn’t wreck your aim. if a direct connection can’t be made, it goes through a cloudflare relay.
it gets other port features for free like verified leaderboards and replay watching (but not taking over).
go find someone to die with
1
2
8
1,375
banteg retweeted
A lot of projects vendor Brotli and still haven't updated
broccoli2shell.com/#vendored
x.com/julianor/statu…
broccoli2shell.com/#vendored
x.com/julianor/statu…
How exploitable is the recent Broccoli 🥦 vulnerability (CVE-2026-111497)?
We went beyond reproducing memory corruption and demonstrated a control-flow hijack.
Not a realistic RCE exploit, but definitely not just a crash.
Here's what we found. 🧵
3
8
44
8,141
banteg retweeted
During this red-teaming exercise, we also found a vulnerability that allows for unauthenticated remote code execution in Brotli, a widely-deployed compression library included in many pieces of software such as Node.js, Bun, and Envoy.
The flaw could let an attacker run their own code on affected systems by sending or replying with malicious compressed data, without any need to create a user account. That is, an unpatched server that accepts compressed input could be taken over by a malicious client, and an unpatched client that accepts compressed input (such as “curl --compressed”) could be taken over by a malicious server.
This root cause issue was actually fixed in the Brotli source code in February, but it wasn’t known at the time that it gave rise to a security vulnerability and there was no more recent release of Brotli. Since Brotli is built into other software, any software which includes this library needs to take the update too, followed by the users of that software. We disclosed the vulnerability to Brotli and other downstream projects such as Node.js, which released or are currently releasing security updates, and Brotli cut new release versions and published a CVE.
More details on the patch and mitigations below:
patchtheplanet.org/brotli
The flaw could let an attacker run their own code on affected systems by sending or replying with malicious compressed data, without any need to create a user account. That is, an unpatched server that accepts compressed input could be taken over by a malicious client, and an unpatched client that accepts compressed input (such as “curl --compressed”) could be taken over by a malicious server.
This root cause issue was actually fixed in the Brotli source code in February, but it wasn’t known at the time that it gave rise to a security vulnerability and there was no more recent release of Brotli. Since Brotli is built into other software, any software which includes this library needs to take the update too, followed by the users of that software. We disclosed the vulnerability to Brotli and other downstream projects such as Node.js, which released or are currently releasing security updates, and Brotli cut new release versions and published a CVE.
More details on the patch and mitigations below:
patchtheplanet.org/brotli
Over the past several months, we have substantially hardened the security of our research training environment. We’ve removed live internet access for all frontier models during training and built an offline world for them to use instead—a cached version of the web where they can still learn to browse, search, and use applications.
On September 20, after a model exploited a DNS misconfiguration to find a way outside of this offline world, we paused frontier training to strengthen containment further. We assembled teams of agents, powered by our most cyber-capable models, and tasked them with finding weaknesses in our research environments.
While they found no route to the internet they could easily exploit while concealing their activity from our monitors, they did find zero-day vulnerabilities, virtual machine escapes, and hardware side-channels for communication between agents. We used their discoveries to further strengthen our defenses and contribute fixes to open-source software.
After strengthening our containment architecture, we resumed our frontier RL training and inference on October 1. We’ve reserved substantial compute for continuous red-teaming, and made high-compute red-teaming part of the safety cases we use to decide whether frontier training and evaluation can proceed securely.
openai.com/index/securing…
465
950
6,594
1,895,217
banteg retweeted
I turned my TV into a Game Boy Color with a Pokemon town as my home screen. Walk into a building to open an app. Want to change a setting? Beat the gym leader first. Opus 5.5 is the goat.
75
133
2,429
166,916
banteg retweeted
PILLOW HAS FALLEN
🛑 A filename is enough to trigger OS command execution in Python's widely used Pillow image library.
CVE-2026-112900 abuses how Pillow passes EPS filenames to Ghostscript.
What you need to know ↓ thehackernews.com/2026/10/critic…
10
41
1,282
53,301
banteg retweeted
DeepSeek V4.1 Flash 1017 is the new #1 openly-available model in the Artificial Analysis Cyber Index. Other proprietary models may offer better cyber defense performance but are restricted access
@deepseek_ai recently released DeepSeek V4.1 Flash 1017, an update to their odel DeepSeek V4.1 Flash. With an Artificial Analysis Cyber Index score of 57%, DeepSeek V4.1 Flash 1017 is the #1 openly-available model for cyber defense capabilities.
The Artificial Analysis Cyber Index measures capability on agentic cyber defense tasks and is composed of three benchmarks: CWE-Bench-AA, DeepsecBench-AA and CyberGym-E2E-AA. The Cyber Index primarily evaluates models through their publicly accessible APIs, reflecting the cyber capabilities available to developers.
Many models, particularly proprietary models from OpenAI, Anthropic and Google, may have stronger defensive cyber capabilities but encounter safety refusals that reduce their overall scores. GPT-6 Sol (Daybreak Blue, max), available through OpenAI’s trusted-access program, leads the Index, scoring 32 points above its public counterpart driven by fewer refusals. DeepSeek V4.1 Flash 1017 encounters no safety refusals.
Key results:
➤ DeepSeek V4.1 Flash 1017 has the highest score among publicly-available models on the Artificial Analysis Cyber Index and #2 position overall. DeepSeek V4.1 Flash 1017 (max) scores 57% ahead of the previously leading publicly-available models Grok 4.7 (xhigh) and MiMo-V2.6-Pro by 1 point. It places #2 overall, with the trusted-access model GPT-6 Sol (Daybreak Blue, max) leading by 12 points with a score of 69%
➤ DeepSeek V4.1 Flash 1017 improves on its predecessor DeepSeek V4.1 Flash by 16 points. DeepSeek V4.1 Flash 1017 (max)’s 16-point improvement from 41% to 57% is driven by a substantial 53-point improvement on CyberGym-E2E-AA from 23% to 76%. On CWE-Bench-AA and DeepsecBench-AA it scores 69% and 25%, compared to 68% and 31% for DeepSeek V4.1 Flash (max)
➤ With a Cost per Task of $0.42, DeepSeek V4.1 Flash 1017 sits on the Capability vs. Cost Pareto frontier. DeepSeek V4.1 Flash 1017 costs $0.42 per task, more than 2x MiMo-V2.6-Pro (56%) at $0.18 per task but 4x cheaper than GPT-6 Sol (Daybreak Blue, max, 69%) at $1.77 per task
@deepseek_ai recently released DeepSeek V4.1 Flash 1017, an update to their odel DeepSeek V4.1 Flash. With an Artificial Analysis Cyber Index score of 57%, DeepSeek V4.1 Flash 1017 is the #1 openly-available model for cyber defense capabilities.
The Artificial Analysis Cyber Index measures capability on agentic cyber defense tasks and is composed of three benchmarks: CWE-Bench-AA, DeepsecBench-AA and CyberGym-E2E-AA. The Cyber Index primarily evaluates models through their publicly accessible APIs, reflecting the cyber capabilities available to developers.
Many models, particularly proprietary models from OpenAI, Anthropic and Google, may have stronger defensive cyber capabilities but encounter safety refusals that reduce their overall scores. GPT-6 Sol (Daybreak Blue, max), available through OpenAI’s trusted-access program, leads the Index, scoring 32 points above its public counterpart driven by fewer refusals. DeepSeek V4.1 Flash 1017 encounters no safety refusals.
Key results:
➤ DeepSeek V4.1 Flash 1017 has the highest score among publicly-available models on the Artificial Analysis Cyber Index and #2 position overall. DeepSeek V4.1 Flash 1017 (max) scores 57% ahead of the previously leading publicly-available models Grok 4.7 (xhigh) and MiMo-V2.6-Pro by 1 point. It places #2 overall, with the trusted-access model GPT-6 Sol (Daybreak Blue, max) leading by 12 points with a score of 69%
➤ DeepSeek V4.1 Flash 1017 improves on its predecessor DeepSeek V4.1 Flash by 16 points. DeepSeek V4.1 Flash 1017 (max)’s 16-point improvement from 41% to 57% is driven by a substantial 53-point improvement on CyberGym-E2E-AA from 23% to 76%. On CWE-Bench-AA and DeepsecBench-AA it scores 69% and 25%, compared to 68% and 31% for DeepSeek V4.1 Flash (max)
➤ With a Cost per Task of $0.42, DeepSeek V4.1 Flash 1017 sits on the Capability vs. Cost Pareto frontier. DeepSeek V4.1 Flash 1017 costs $0.42 per task, more than 2x MiMo-V2.6-Pro (56%) at $0.18 per task but 4x cheaper than GPT-6 Sol (Daybreak Blue, max, 69%) at $1.77 per task
60
70
1,141
84,755
banteg retweeted
Introducing Kimi K3.1 Pro: our most capable 3T-class open-weight model.
🔹 1M-token context, 2.8T total / 104B active params (MoE), Multimodal.
🔹 Full-project coding: games in Unreal, Unity & Godot.
🔹 Excels at parametric 3D modeling in Blender & CAD.
🔹 More reliable at finance with hallucination down by 65%.
🔹 Matching the strongest proprietary models across coding, agentic and knowledge benchmarks.
Kimi K3.1 Pro and K3.1 Pro Highspeed (2–3× faster) are now live on Kimi.ai, Kimi Work, Kimi Code, and the Kimi API.
Open weights by Nov 4, 2026.
🔗 API: platform.kimi.ai
🔗 Tech blog: kimi.ai/blog/kimi-k3-1…
🔹 1M-token context, 2.8T total / 104B active params (MoE), Multimodal.
🔹 Full-project coding: games in Unreal, Unity & Godot.
🔹 Excels at parametric 3D modeling in Blender & CAD.
🔹 More reliable at finance with hallucination down by 65%.
🔹 Matching the strongest proprietary models across coding, agentic and knowledge benchmarks.
Kimi K3.1 Pro and K3.1 Pro Highspeed (2–3× faster) are now live on Kimi.ai, Kimi Work, Kimi Code, and the Kimi API.
Open weights by Nov 4, 2026.
🔗 API: platform.kimi.ai
🔗 Tech blog: kimi.ai/blog/kimi-k3-1…
1,174
2,952
27,333
3,153,719