Help me reason through this problem step by step. Review the context, challenge assumptions, explore solutions and trade-offs, and think bigger about the overall design. Recommend the simplest practical approach before implementation.
0
0
0
17
Vinh Nguyen retweeted
Tried to reproduce H-Nets (v2?). Dropped STE (found it is more stable) and used sequence-level router loss (it makes tokenization fair compared to batch-level loss). Used eager variants instead of the lookahead default as suggested in the blog post. Still, the results were not ced previous-byte similarity in the router (the idea was from Opus 5.5!)
Left one is my attempt, right one is from the post.
Left one is my attempt, right one is from the post.
10
5
87
3,206
deepseek-ai/dsh-superagent-prototype: Towards a More Autonomous Agent System github.com/deepseek-ai/ds…
0
0
0
82
Give your coding agent a security task.
Prompt: "Audit dependencies using RustSec, CVE.now, and relevant advisories. Prioritize risks, patch vulnerabilities, run tests, and report remaining issues."
Review findings and diffs before merging.
Prompt: "Audit dependencies using RustSec, CVE.now, and relevant advisories. Prioritize risks, patch vulnerabilities, run tests, and report remaining issues."
Review findings and diffs before merging.
1
0
1
56
I sunsetted VT Code's VS Code/Open VSX extension to focus on the CLI and Desktop. Recent supply-chain attacks are a reminder of how difficult it is to secure the extension ecosystem.
0
0
0
55
CodeRabbit is offering $1M* in free security scans and fixes through November 8, 2026.
> CodeRabbit Secure coderabbit.ai/security/free-…
> CodeRabbit Secure coderabbit.ai/security/free-…
0
0
1
46
Vinh Nguyen retweeted
👋 Hi everyone! Long time no see
We're the LlamaFactory team. After passing 70k stars on GitHub, we're now building the "LlamaFactory" of recursive self-improvement (RSI), towards a unified, efficient, stable, and flexible framework for agent self-evolution. Excited to share our you all.
TL;DR:
🐧 We've open-sourced PenguinHarness, a multi-agent self-evolution framework that brings every RSI algorithm under one roof, over 2,600 GitHub stars.
📖 To get a fuller picture of existing RSI work, we went through 140 papers, organized and categorized them into the awesome-rsi repo, and published a survey paper.
📊 To compare self-evolution efficiency across algorithms fairly, we built GDPevo, a self-evolution benchmark covering 6 enterprise scenarios and 240 tasks, and used it to evaluate 6 mainstream agents.
The details:
Following the same philosophy as LlamaFactory, we want to bring all RSI-related data, models, algorithms, and benchmarks into a unified open-source harness, so everyone can try and debug RSI more easily. We've already integrated 5 RSI algorithms and 7 benchmarks, and we're aiming for 100+ down the road.
Borrowing from DSH's "everything is a plugin" approach, we've packaged every algorithm and benchmark as a plugin. They're fully decoupled, so users can freely mix and match any RSI algorithm to evolve different agents. We also built a modern desktop client that installs in one click on any OS and runs locally, so you can grab the latest version from our website.
Website: penguin.ooo
OSS Repo: github.com/Prism-Shadow/p…
To better understand where the academic work stands today, we open-sourced the awesome-rsi repo and published a survey paper covering 140 recent works. We also mapped the trajectory of RSI against that of deep learning — many concepts line up one-to-one, only now the subject is an agent.
OSS Repo: github.com/Prism-Shadow/a…
Paper: arxiv.org/abs/2610.14625
To better evaluate how different harnesses and methods perform at self-evolution, we built the GDPevo benchmark, spanning 6 real-world enterprise scenarios and 240 tasks. With a train/val split, it fairly measures an agent's self-evolution ability while guarding against overfitting.
OSS Repo: github.com/Prism-Shadow/G…
Paper: arxiv.org/abs/2608.03764
This post isn't just about our work. We're also hoping to invite friends from academia and industry to join our open-source project. If you'd like to see your name on an open-source project and co-author papers with us, DM us and let's talk!
We're the LlamaFactory team. After passing 70k stars on GitHub, we're now building the "LlamaFactory" of recursive self-improvement (RSI), towards a unified, efficient, stable, and flexible framework for agent self-evolution. Excited to share our you all.
TL;DR:
🐧 We've open-sourced PenguinHarness, a multi-agent self-evolution framework that brings every RSI algorithm under one roof, over 2,600 GitHub stars.
📖 To get a fuller picture of existing RSI work, we went through 140 papers, organized and categorized them into the awesome-rsi repo, and published a survey paper.
📊 To compare self-evolution efficiency across algorithms fairly, we built GDPevo, a self-evolution benchmark covering 6 enterprise scenarios and 240 tasks, and used it to evaluate 6 mainstream agents.
The details:
Following the same philosophy as LlamaFactory, we want to bring all RSI-related data, models, algorithms, and benchmarks into a unified open-source harness, so everyone can try and debug RSI more easily. We've already integrated 5 RSI algorithms and 7 benchmarks, and we're aiming for 100+ down the road.
Borrowing from DSH's "everything is a plugin" approach, we've packaged every algorithm and benchmark as a plugin. They're fully decoupled, so users can freely mix and match any RSI algorithm to evolve different agents. We also built a modern desktop client that installs in one click on any OS and runs locally, so you can grab the latest version from our website.
Website: penguin.ooo
OSS Repo: github.com/Prism-Shadow/p…
To better understand where the academic work stands today, we open-sourced the awesome-rsi repo and published a survey paper covering 140 recent works. We also mapped the trajectory of RSI against that of deep learning — many concepts line up one-to-one, only now the subject is an agent.
OSS Repo: github.com/Prism-Shadow/a…
Paper: arxiv.org/abs/2610.14625
To better evaluate how different harnesses and methods perform at self-evolution, we built the GDPevo benchmark, spanning 6 real-world enterprise scenarios and 240 tasks. With a train/val split, it fairly measures an agent's self-evolution ability while guarding against overfitting.
OSS Repo: github.com/Prism-Shadow/G…
Paper: arxiv.org/abs/2608.03764
This post isn't just about our work. We're also hoping to invite friends from academia and industry to join our open-source project. If you'd like to see your name on an open-source project and co-author papers with us, DM us and let's talk!
35
34
214
29,174
If you're building with Rust, point your coding agent to the RustSec Advisory Database and have it audit your dependencies, identify vulnerabilities, and fix them.
Do it now. rustsec.org
Do it now. rustsec.org
3
0
2
122
Vinh Nguyen retweeted
The security incidents this October showed us how vulnerable the systems we developed over the past decades really are (yesterday I spent my evening rotating all the secrets I had stored in Northflank env variables, yay)
it’s probably going to get even worse in the near future, but I always try to see a positive outcome of such events
when this cat and mouse game is over, I believe that our industry is coming out of this stronger, with more awareness and more security built into every aspect of the software stack .. which is indeed a great outcome
let’s support each other, dunk less on each other, while keep talking openly about the issues at hand and find solutions together
it’s probably going to get even worse in the near future, but I always try to see a positive outcome of such events
when this cat and mouse game is over, I believe that our industry is coming out of this stronger, with more awareness and more security built into every aspect of the software stack .. which is indeed a great outcome
let’s support each other, dunk less on each other, while keep talking openly about the issues at hand and find solutions together
1
1
8
765
Vinh Nguyen retweeted
Your regular Chrome already auto-updated to 156, so you think you're safe
You're not
The real danger here is Playwright, Puppeteer, and MCP browser tools running inside Cursor, Claude Code, or Terminal
1. Your IDE / Terminal has macOS Accessibility permissions
2. It spawns a cached Playwright Chromium (usually stuck on v131–151 or whatever)
3. That browser inherits your IDE's Accessibility permission
4. Any site your agent visits can use the GPU process to press Cmd + Space, open Terminal, and run commands on your Mac 💀
Check ~/Library/Caches/ms-playwright and ~/.cache/puppeteer right now and update to Playwright 1.64.1+ (Chromium 156)
You're not
The real danger here is Playwright, Puppeteer, and MCP browser tools running inside Cursor, Claude Code, or Terminal
1. Your IDE / Terminal has macOS Accessibility permissions
2. It spawns a cached Playwright Chromium (usually stuck on v131–151 or whatever)
3. That browser inherits your IDE's Accessibility permission
4. Any site your agent visits can use the GPU process to press Cmd + Space, open Terminal, and run commands on your Mac 💀
Check ~/Library/Caches/ms-playwright and ~/.cache/puppeteer right now and update to Playwright 1.64.1+ (Chromium 156)
🚨 BEWARE: Chrome Sandbox Escape
Full remote command execution + full chain capabilities
October has been wild
pwn.ai/blog/chrome-es…
62
72
937
163,264
"If you want to keep your product safe, the meta right now appears to be: avoid amplification vectors."
Northflank hacked today. All environment variables stolen.
Railway, TiDB Cloud last week. OpenCode the week before.
These are good teams. They are not clowns. What they have in common is that they contain enormous numbers of keys, which makes them huge targets.
The defensive tools aren't good enough right now for small engineering teams to defend themselves against that kind of ferocious attention. Even very competent teams.
If you want to keep your product safe, the meta right now appears to be: avoid amplification vectors.
If a service is run by a small team, and hacking that service lets an attacker hit a large number of downstream targets, that's a magnet for hackers. A defender with small-company resources is not set up to succeed. We're going to keep seeing these kinds of attacks that target amplification vectors.
That means:
- Use BYOC infra products, not PaaS. Host your app directly. Host your sandboxes directly. (This is a lot easier than it was a year ago!)
- Remove your third party js, or pin changes to it.
- Stay on top of your code-level deps. (I like cve.now.)
I'm cautiously optimistic that the tools for defenders are going to get better really fast and we're going to be able to use PaaS again, but right now anything that has a lot of keys and isn't run by a team with hyperscalar-level resources seems like an unacceptable risk.
0
0
1
112
Interesting bench
> AA-PersonalityBench: AI Personality & Communication Style Benchmark artificialanalysis.ai/evaluations/aa…
> AA-PersonalityBench: AI Personality & Communication Style Benchmark artificialanalysis.ai/evaluations/aa…
0
0
0
53
Vinh Nguyen retweeted
arxiv.org/abs/2610.40564
Using same objective from pre-training to post-training, only changing the data.
Using same objective from pre-training to post-training, only changing the data.
4
22
232
20,023
Vinh Nguyen retweeted
AI may well be able to write massive software projects “from scratch”, but that almost certainly isn’t the fastest / highest performance / highest security / most token efficient way to do things. Good building blocks matter.
In addition to RL’ing the agents on final task loss, we should try to get them to regularize the building blocks as well. What would the standard library look like that makes the agents most effective?
It is likely at the limit that it turns out to be some alien organization of code, but given the existing human-bias in training, I bet that in the near term it would be lovely code that old programmers would appreciate.
I suspect the same could be said for mathematics, but that is out of my lane.
In addition to RL’ing the agents on final task loss, we should try to get them to regularize the building blocks as well. What would the standard library look like that makes the agents most effective?
It is likely at the limit that it turns out to be some alien organization of code, but given the existing human-bias in training, I bet that in the near term it would be lovely code that old programmers would appreciate.
I suspect the same could be said for mathematics, but that is out of my lane.
354
453
5,640
721,296