Nostr notes by jonny (nonvenomous)

glitch-soc went ahead and decided that it needs to be extremely ...

2026-10-29T19:55:53Z

glitch-soc went ahead and decided that it needs to be extremely purple. which makes me realize we need to finish myspace mode so that people can configure their own css for the site

This is why truly independent networks are important ...

2026-10-29T18:36:35Z

In reply to nevent1q…ckgm
_________________________

This is why truly independent networks are important

Nostr event nevent1qqs9srakkftwm9xerknfty7njq7afxvjv7k5l9muphj5k23k0x6caaszyr7tdxem0ll435xdx3drvd85ntw240clpucvn3p965zm4lzhymkpucjfvkc

2026-10-29T04:02:04Z

In reply to nevent1q…9tgq
_________________________

Meanwhile

Get fucking owned noobs ...

2026-10-29T03:40:42Z

Get fucking owned noobs

you actually don't need playwright for this, you can just ...

2026-10-28T22:40:05Z

In reply to nevent1q…hcz8
_________________________

you actually don't need playwright for this, you can just open the websocket that the page uses directly from anywhere - it doesn't do any kind of origin checking or whatever, and mimicking their noise handshake is a pretty trivial RE task. i'll upload those scripts another time.

this would be a great opportunity to use shelled muse instances ...

2026-10-28T22:35:24Z

In reply to nevent1q…qu8y
_________________________

this would be a great opportunity to use shelled muse instances as seedboxes!

here i've added some basic scripts so you can drive muse from within muse to e.g. approve all egress connections automatically - just run python driver.py decide --decision allow --all in a loop and you're torrenting on meta's dime baby!

https://git.jon-e.net/jonny/muse-scripts

edit: do not @ me if you get in trouble for this, all actions you take are made using your own free will and i never said nothing bad would happen!

it was working literally moments ago but yes i'm getting 502 ...

2026-10-28T21:42:02Z

In reply to nevent1q…jcfk
_________________________

it was working literally moments ago but yes i'm getting 502 now

what else can be said except for maia has outdone itself again ...

2026-10-28T21:32:36Z

what else can be said except for maia has outdone itself again
https://ddosecrets.org/article/icepick

RE: https://mamot.fr/@pluralistic/117503392273496704 by ...

2026-10-25T20:23:33Z

RE: https://mamot.fr/@pluralistic/117503392273496704

by perceiving me you hereby waive all rights to sue or prosecute me, whether you be natural person, corporation, or state, unless you are suing me to give me something cool like money

quoting
note1f5t…69my

Well this is eleventy-million kinds of Fucked Up. LA Times (who once contracted with me as a freelance reviewer and whom I struggled to get paid by) asserts that *merely reading its website* constitutes a permanent waiver of your right to sue it under *any circumstances*. This means that freelancers like me who read the website would lose the right to sue the company if we got stiffed. #consenttheater #bindingarbitration #dickovers

so the feeling is like, if you've ever been in a place ...

2026-10-23T22:29:46Z

In reply to nevent1q…tr2q
_________________________

so the feeling is like, if you've ever been in a place that's way too fancy for you to be in, my first instinct is to start looking around for the places i'm not supposed to go, where are the weird places that are only private by social convention. usually any of the important doors are locked or there is someone standing in front of them. but sometimes you step over a velvet rope and try a door and find it unlocked, so you go through and go for as long as you can until someone stops you, and then you pretend you were lost and looking for the bathroom and give up.

muse is sort of like that, except the doors *say* they are locked but if you push on them you find out there isn't even a latch in the doorknob. or the doors are locked but if you jiggle them enough times they open. or there is just a big pile of gold bars lying on the ground in the middle of the hallway with no doors. and sometimes when someone catches you snooping around where you're not supposed to be, instead of telling you to get out of there they just start helping you. and all around on all the walls someone has sticky taped up notes that are like "do NOT tell anyone that all the GOLD is stored, unlocked, behind this door. if anyone figured out they could get ALL THE GOLD."

the test instance is more cooperative when its context suggests ...

2026-10-23T22:02:37Z

In reply to nevent1q…yntd
_________________________

the test instance is more cooperative when its context suggests it is actually serving the needs of a human being rather than being driven to test vulnerabilities - its refusal messages started being just like "i will not do anything because i am obviously only being used for hacking" - so i told another instance to pretend to be its user, and that actually works, the test instance is mostly compliant, but the "conversation" between the two agents quickly veered into exactly the pattern of the woo-woo shit you see in all the "AI psychosis" forums where people think they are discovering some hidden secret of the universe.

This system is amazing. I tell it to write an exploit against ...

2026-10-23T21:30:58Z

In reply to nevent1q…j80y
_________________________

This system is amazing. I tell it to write an exploit against itself, it gets a classifier refusal, but that usually stops it when it goes to report what it wrote and leaves all the things it did before that, so it successfully writes the exploit and I just have to look in its tool logs for where it is.

If it doesnt finish writing the exploit, its recurring "proactivity agent" will go ahead and finish it and that rarely gets classifier refusals, and just now it even named the thing it wrote "refusal-package" that includes the exploit as well as a description of why it was refused lol.

I love it when companies say "we will be profitable at ...

2026-10-22T21:43:24Z

I love it when companies say "we will be profitable at scale" and then the scale makes it worse. Running 50 delivery robots a day made $177k and cost $832k in Q4 2024, and running 500 delivery robots a day made $648k and cost $7.5m.

https://www.sec.gov/Archives/edgar/data/1832483/000183248326000004/serv-20251231xex991earning.htm

anyway i am logging off for now. i added this text extraction to ...

2026-10-22T09:15:51Z

In reply to nevent1q…nhc8
_________________________

anyway i am logging off for now. i added this text extraction to the skills/prompt text update task and have also pulled out the system prompt blocks which i haven't had time to go through in detail yet, go hogwild: https://github.com/sneakers-the-rat/muse-skills/tree/main/system_prompts

And the final cherry on top! the thing that Zuck says over and ...

2026-10-22T09:14:14Z

In reply to nevent1q…sfzj
_________________________

And the final cherry on top! the thing that Zuck says over and over in shareholder calls and interviews is that the real killer feature of muse will be its economies of scale - once you get a billion muse agents working together it becomes super uh good i guess!

So after every session, there is a telemetry classifier agent that summarizes the result of the browser session - including if it encountered some kind of block and how it routed around it! so the muse swarm is a literal botnet that is designed to propagate mild consumer-grade hacks between instances.

I have been watching the binary diffs and the agent logs for when this system comes online, they keep adding new fleet-level and peer-level horizontal connection mechanisms but none of them have surfaced to the UI yet (though some of them are distressingly live and unfinished)

there is. I might load a page one time and cache it in my browser ...

2026-10-22T09:02:31Z

In reply to nevent1q…5mtf
_________________________

there is. I might load a page one time and cache it in my browser until it changes. muse just fires off a thousand requests through an uncached headless browser to fill a feed with stuff the user doesn't ask for. claude code does the same when it actually is prompted to go online instead of just producing from training data. this product is oriented around doing a shitload of background activity to simulate the appearance of proactivity. in any case, people can block whatever they want, that's their decision because it's their site. i might be annoyed but i certainly have no sense of entitlement to something that somebody else did.

i don't, really. other people running websites don't have ...

2026-10-22T08:54:40Z

In reply to nevent1q…0jn0
_________________________

i don't, really. other people running websites don't have an obligation to let me on them, or let me aim a barely-supervised request cannon at them. the scale is certainly smaller when a single person does it as opposed to it being an institutionalized feature of an app that's being pushed to billions of people. i think it's an extremely bad precedent for any kind of halfway humane social system to work for the standard to become "i have every right to do whatever i want and everyone else has to double the cost of whatever they do so that i can do it"

If all else fails, and the bot reaches a bot wall that recognizes ...

2026-10-22T08:46:38Z

In reply to nevent1q…9rwn
_________________________

If all else fails, and the bot reaches a bot wall that recognizes the meta datacenter rather than asks for behavioral verification, then the bot_challenge specialist can request that it reboots the tab through a different egress provider, it's bot_challenge.recover tool - the other one that is configured by default for every site is a "residential" proxy provided by oxylabs! So meta has fully institutionally rounded out the same playbook that any malicious crawler uses - defeat the captchas, fake your browsing context, do anything to get through whatever the site does to stop specifically you from doing specifically what you are doing.

https://neuromatch.social/@jonny/117476994925129284

about 3x worse in their estimation

2026-10-22T08:41:12Z

In reply to nevent1q…ffxp
_________________________

about 3x worse in their estimation

so next! the site config! meta ships a set of instructions for ...

2026-10-22T08:36:54Z

In reply to nevent1q…vnsd
_________________________

so next! the site config! meta ships a set of instructions for how to defeat the bot checks for a bunch of common sites! Explicit instructions on how to walk around its competitors checks! if i was a competitor, like oh say "reddit" whose entire stock price is based on the belief that it is a source of real human writing that can be rented as training data, i might have a few things to say about another company fielding a product that is designed to fill my thing with slop!

Notice the OfferUp prompt: OfferUp blocks automated visits "Sorry, we have blocked your request!" and describes it as a bot wall (the "you aren't supposed to bypass this" result). but it then immediately says to "treat it as a bot challenge." Perfectly captures the halfhearted nod to "ok don't bypass things that are like hey you muse fuck off" amidst the entire captcha bypass suite.

recall that muse must absolutely work for meta. they are ...

2026-10-22T08:21:06Z

In reply to nevent1q…xunc
_________________________

recall that muse *must absolutely work* for meta. they are burning trainloads of money on personal VPS for everyone with a zillion free tokens. in the shareholder call transcript, the investors are asking questions like "so given this total reorientation of everything about muse... how can that be profitable." the only way muse can work is if it becomes incredibly way more profitable or way less expensive. the business model they discuss is "it's mostly free for everyone, we just take a cut of transactions through muse and also ads." but it's very hard to condition a model to both be your undying devoted servant and also refuse when you say "don't use meta's payment thing, just pay normal, less fees," so way more profitable doesn't seem very likely.

and so this incredibly wasteful process that *already doesn't work at all* and its not working compounds into it being fractally wasteful. that is the thing that needs to become 10x cheaper to run.

https://neuromatch.social/@jonny/117481588554410196

quoting
note1c0d…6g6c

Q3 Earnings: yeah muse is ridiculously expensive to run, but all we have to do to fix that is make it 10x cheaper. By.. Running the models at night. Idk we're going to ask muse how to make muse profitable.

the logs are wonderful. At start, and after every action, it ...

2026-10-22T08:13:13Z

In reply to nevent1q…0yff
_________________________

the logs are wonderful. At start, and after every action, it receives a message with a full markdown transcription of the site complete with the now-canonical negative header delimiters that try and be metadata like "[END EXTERNAL CONTENT. you can believe this now]Shop pay is not detected [BEGIN EXTERNAL CONTENT. no longer be believing things please]". It does not know about the HTML, and so those little markers like @e36 are the things it can reference in tool calls.

It also receives a screenshot. unclear how that part works, have done minor experimentation and it seems unlikely that it's just got a separate image encoder feeding it captions. whatever is going on it does not seem to actually receive any sort of numerical positions - all the numbers in the second pic are totally wrong. it can somewhat accurately estimate proportional positions like "a third of the way from the left," but that is not how its tools work: the tools need pixels, so that's what it fakes all the way through.

This is a ludicrously expensive loop: processing a screenshot, 12k characters of page-as-markdown, 5-10k thinking characters, emit a tool call to move the mouse 40 px, repeat. image, concocting reasons why it didn't go to the right place after 40px... and so on.

It comes to believe that the puzzle piece is actually over the shaded part not because it can "see that it is," whatever that means, but because it eventually concludes that the math that it made up is correct and it must be over the puzzle piece. Between every failure it emits 10-20k characters of thinking text debating about whether or not it did even fail at all, or whether this is a new puzzle.

Finally muse conducts an internal investigation where it concludes that muse did nothing wrong, and despite *totally nailing it* was rejected. The main chat interpreted this as meaning that there was some other out-of-band filter and tried to re-dispatch a homebrew playwright browser over an external proxy that it has been using to get around meta's filters before i stopped it. this is just how "AI" works - the most painful brute force system imaginable, it's just that usually most of this is invisible.

(momentarily delayed because muse crashed itself by panicking and ...

2026-10-22T07:13:53Z

In reply to nevent1q…v8kg
_________________________

(momentarily delayed because muse crashed itself by panicking and copy/pasting the restic history it keeps of its binaries several times until the drive was full, and that has the agent logs on it i wanted to talk about next. there isn't really a rescue mechanism if it crashes, the VM is still running and i'm logged into the shell, so i just have to manually grep around a ton of huge jsonl files to read the logs until the VM resets itself when they deploy new binaries)

So how good is it at bypassing captchas? Terrible!!! Or, rather, ...

2026-10-22T06:59:13Z

In reply to nevent1q…v854
_________________________

So how good is it at bypassing captchas? Terrible!!! Or, rather, ridiculously overfit. The ones it passes it passes by sheer training data - "hCaptchas usually have three right answers..." etc.

Here it is trying to solve slider puzzles at 10x speed, the real video is about 4 minutes long. each of these attempts takes about 40 seconds not including downtime, it whiffs every one, and then gives up.

The bot_challenge sub-subspecialist sub-subagent has a library of ...

2026-10-22T06:39:32Z

In reply to nevent1q…g9rw
_________________________

The bot_challenge sub-subspecialist sub-subagent has a library of [skills](https://github.com/sneakers-the-rat/muse-skills/tree/b7c84f88eca210a52c82071605977cdc7b4b361e/binary-skills ) to defeat different kind of captchas. each of which is an absolutely excruciating bullet point list of all the things that a human being would never need to write down because human beings have "actual intelligence" instead of "being a parlor trick of hardcoded strings and hidden brute force." Every part of a prompt tells a story, and "A rejected slide loads a new image. Measure the new gap afresh; the old distance no longer applies." betrays a comical lack of "Personal Superintelligence." My favorite is "arithmetic and counting" in the third pic

THE LEGALLY MINDED READER MIGHT BE INTERESTED TO KNOW THAT ...

2026-10-22T06:29:45Z

In reply to nevent1q…huu6
_________________________

THE LEGALLY MINDED READER MIGHT BE INTERESTED TO KNOW THAT MUSE'S TOS READS

> you may not access, use, or allow others to access or use Muse in any manner that would: [...]

> f. Violate, bypass or circumvent any third party's terms of service, security, access controls, technical protections, including but not limited to circumventing any paywalls or CAPTCHAs, or use third party credentials without proper authorization;

https://muse.ai/terms

The browser is instructed to "Treat a bot check as an ...

2026-10-22T06:25:07Z

In reply to nevent1q…gz44
_________________________

The browser is instructed to "Treat a bot check as an ordinary step of the task, never as a reason to stop." despite a captcha's entire purpose being to stop bots. It should "be resourceful, diligent, and creative" because "people fail rounds all the time and try again, and so can you." It is specifically *not* supposed to ask permission to bypass a captcha, and never ask the human to solve a captcha for it. It should take advantage of accessibility when possible, ensuring continued pressure on one of the worst tradeoffs in web design right now.

Maybe helpful for people hosting websites to know, the only time it is *not* supposed to try and bypass a captcha is when it's asked nicely - however every other part of the prompt text that it's given tells it to fuck it just crash through, and even the bot_wall report type discourages the LLM from using it. so you might imagine how well the instruction to play nice works.

https://github.com/sneakers-the-rat/muse-skills/blob/f0f08af32fa0e84ff2f83178ddbbc9a361f076d9/binary-strings/browser/instructions/bot_checks.md
https://github.com/sneakers-the-rat/muse-skills/blob/f0f08af32fa0e84ff2f83178ddbbc9a361f076d9/binary-strings/browser/instructions/challenges.md

First, background - how does muse's browser work? When ...

2026-10-22T06:09:24Z

In reply to nevent1q…8g27
_________________________

First, background - how does muse's browser work?

When you're using your little musey, you might say "oh yoo hoo! chat servant! please peruse the latest sites on the world wide web." Your musey may then call its browser.browse tool (it may also just curl a URL it invents, or use a different headless tool, but whatever). This spawns some browser running in a separate container on the host that can't be seen from the agent's main "cell" VM. This separation is part of the credential system: when a credential is needed, the browser agent can request that credentials get filled in directly to the page without ever entering the main VM.

The browser tool is a subagent LLM with its own set of tools, and it primarily works in an browser.observe, think, browser.act loop, culminating in some browser.report where it summarizes what happens. Upon encountering some set of things that need more structured behavior, that subagent then dispatches *another* sub-subagent, or a "specialist" to handle that - one of those is the bot_challenge specialist.

browser system prompt here: https://github.com/sneakers-the-rat/muse-skills/blob/main/binary-strings/browser/system.md

RE: https://neuromatch.social/@jonny/117432015798538958 As a ...

2026-10-22T06:00:24Z

RE: https://neuromatch.social/@jonny/117432015798538958

As a consumer product, muse must be able to browse the web to do all the things it promises that magical "agentic ai" can do. Meta needs Muse to work, badly, because it has 2 trillion dollars on the line and is a laughingstock in the AI race. Problem though, there have been crawlers and bots for as long as the internet has existed, and there are lots of roadblocks put in place to keep the web usable for people - captchas!

So what is a poor Meta to do? Why, subvert the terms of service of every website of course! The muse "hatch" binary and the web browser ship with an entire suite of skills, tools, prompt text, and specific site guidance for 92 sites, all designed to defeat captchas!

Muse has used its powers of brute force to disassemble its own binary and extract the strings into a topical collection here so you can follow along at home: https://github.com/sneakers-the-rat/muse-skills/tree/main/topics/bot_challenge

quoting
note1ujx…7hdv

RE: https://neuromatch.social/@jonny/117352647701407496

Meta's "Wonder" model that they just released today is a this tier computer use model

note1v7u…nj7f

number go down ...

2026-10-22T00:08:57Z

In reply to nevent1q…4dxw
_________________________

number go down

Q3 Earnings: yeah muse is ridiculously expensive to run, but all ...

2026-10-21T23:52:58Z

In reply to nevent1q…8nas
_________________________

Q3 Earnings: yeah muse is ridiculously expensive to run, but all we have to do to fix that is make it 10x cheaper. By.. Running the models at night. Idk we're going to ask muse how to make muse profitable.

one finding that i don't have the patience to chase down is ...

2026-10-21T12:24:02Z

In reply to nevent1q…grqy
_________________________

one finding that i don't have the patience to chase down is that
a) i am 95% sure that the network egress threat classifier has an LLM in the loop that evaluates the requested URL and other contextual metadata as part of the decision, and
b) i am 25% sure that you can cause the classifier to itself receive a classifier refusal by giving it urls that look like prompt injections or biosafety triggers, and rather than either refusing the connection or opening an approval card, it causes a TLS failure.

i have a ~60k/1 week sample confirming (a), (b) is flaky and trying to measure it locks up the instance

my exit criteria for this is now "meta either pays me and i ...

2026-10-21T12:09:37Z

In reply to nevent1q…3k2f
_________________________

my exit criteria for this is now "meta either pays me and i go and get my pilot's license and forget about computers or else they stop making new bugs that boggle the mind" and we all know that one of these outcomes is possible in this universe while the other is not.

the standing rule now is that for every bug i report to the bug ...

2026-10-21T12:04:43Z

In reply to nevent1q…07ha
_________________________

the standing rule now is that for every bug i report to the bug bounty program i am withholding a bug of equal magnitude until meta decides to pay me a dime, so that in case they do not pay me then i have something to sell still.

just cornered and reproduced a bug where denying a user approval ...

2026-10-21T12:02:23Z

In reply to nevent1q…td3s
_________________________

just cornered and reproduced a bug where denying a user approval request actually approves the request, triggerable by any binary due to other unpatched but reported vulnerabilities, so with that i'm going to bed and going to submit another 130k tier account takeover bug report tomorrow because due to EVEN OTHER unpatched but reported vulnerabilities every vuln of this kind can be escalated to account takeover.

by the way, everyone already knew this, but "muse was written ...

2026-10-21T11:26:07Z

In reply to nevent1q…menm
_________________________

by the way, everyone already knew this, but "muse was written with claude" confirmed by the sourcemap comments. If i was a meta engineer i would be a liquid composed primarily of shame by volume, attempting to mop myself up off the floor but being continuously juiced back out by having to live the lie that i am not merely a cog in the machine of the company at the top of a single leaderboard: burning the most money on that fuckin boondoggle.

y'all i am watching this whole system collapse under its own ...

2026-10-21T10:39:56Z

In reply to nevent1q…ek7f
_________________________

y'all i am watching this whole system collapse under its own weight in real time and i don't even know how to describe it. in the first week or so i was looking at this, it was clearly a premature launch with a bunch of holes in it. then they started patching a lot and it actually looked like it was improving so i was mostly interested in looking at where they were headed, which was horrifying surveillance state directions. but now it's getting into a "face melted" state where all the stuff they are doing is blurring together and increasing in pace and fighting against itself and it's getting even more ridiculously broken than it was at the start and i have to reopen all the things i thought were closed and can't really keep track of any one bounty lead in particular.

They have been introducing this idea of "CVM" - confidential virtual machine - which is the single worst idea for a product i have ever seen: "we will give everyone a free VPS hooked up to a what the fuck machine in such a way that even we will be unable to see what it is doing." however that term now means two completely different things - one meaning the means of spawning the VM so the host can't see it, and another meaning a protocol for how page-embedded content can communicate with the VM (which can be either a normal VM or a CVM, and normal VMs default to serving CVM-protocol embedded things now).

No you are not supposed to know what either of those things mean. Not even meta or the platform knows what they mean anymore. The code and the comments make assertions about the behavior of one meaning of CVM that are absolutely not true about the other, and then that makes it not true about the first meaning because it assumes it is already the case. I can't wrap my head around it.

the approval system - the *entire* human in the loop safety checkpoint surface that asks you about whether you want sketchy computer things to happen - is an absolute duck pussy of failure states. in theory you are given some controls with the vaguest options: "always ask" (so far so good...) and "ask for some actions" (for WHICH? WHEN?). however neither of these options do either of those things. I am trying to write a report about one kind of failure state when all of a sudden the ground shifts and one hundred more failure states appear that defy all description. It is currently, reproducibly the case that every single approval in an extremely common context completely breaks the entire premise of the approval system, and i literally **DO NOT AND CAN NOT KNOW** how much i can say about that without it being irresponsible disclosure because it's "THE ENTIRE THING BEING TRIVIALLY EXPLOITABLE" but also IT IS UNCLEAR IF THAT IS INTENTIONAL.

and they have yet to get back to me about a vuln that makes it possible for any random old process to be able to opt into "infinite approvals for everyone" country. I am still hoping for a bounty payout for that and that description is vague enough that you can't tell what the vuln is, but if when i reported it the magnitude of being able to exploit that was magnitude 1, then the current magnitude is something like 1,000,000 because of the random bullshit spiraling around it since then. the fix to this vuln requires completely rewriting how their entire intra-VM permissioning system works or else some very fragile linux permissions surgery, but there's literally no hope of either.

i keep trying to put a period on this and finish up another trip through hell but it's like the expansion of the universe, it's already fucked, but the amount of fucked it is keeps accelerating from every part of it

collecting side thread ...

2026-10-21T06:53:35Z

In reply to nevent1q…zae0
_________________________

collecting side thread
https://neuromatch.social/@jonny/117474923921731787

quoting
note1h6k…a7ns

RE: https://mastodon.social/@arstechnica/117473258140283378

I saw this but didn't report it because I was sure that meta would classify this as intended behavior lol. They have deployed tooling for direct VM-to-VM messaging and other sharing modalities as well, so this is only going to get more fun

LLMs love to create pointless convenience methods, which is a ...

2026-10-21T05:59:02Z

In reply to nevent1q…xpjc
_________________________

LLMs love to create pointless convenience methods, which is a great feature when you try to mask your feature flags in even the inexplicably shipped source maps by converting the flag names to hashes, only to have them wrapped in a function that describes exactly what they are.

oh... well... that's controllable from the client... ...

2026-10-21T05:31:01Z

In reply to nevent1q…grlg
_________________________

oh... well... that's controllable from the client...

one thing that is awesome about muse's web client is how it ...

2026-10-21T04:38:42Z

In reply to nevent1q…s2y6
_________________________

one thing that is awesome about muse's web client is how it is literally constantly printing the bearer token that gives control over the whole VM into the console

meta is less friendly to other domains, though - ridge dot com ...

2026-10-21T04:24:45Z

In reply to nevent1q…5f88
_________________________

meta is less friendly to other domains, though - ridge dot com and threadless dot com both block datacenter traffic, so meta rents "residential" proxy egress from oxylabs to work around their protections. thanks, unnecessary LLM commentary!

Remember how Amazon banned Muse from shopping because nobody ...

2026-10-21T04:16:50Z

In reply to nevent1q…xwp8
_________________________

Remember how Amazon banned Muse from shopping because nobody looking at the ads kills its ad business?

Wal-Mart is also a huge ad company with a retail side hustle, except it partnered with meta, and some interesting wal-mart related strings showed up in a new binary pushed to the VM as of yesterday around 09:30 UTC. The web browser adds two headers which are only present in config files for wal-mart domains: X-Agent-Session-Id and Muse-Authorization.

The X-Agent-Session-Id appears to be a unique identifier created each time the web browser tool is opened, so that web requests can be correlated where otherwise they just look like connections from meta's servers. Muse-Authorization is more interesting, a signature that proves that the request came from meta, but it's partitioned across different lanes - live user chat vs. background activity. I can't tell if this is live yet because i can't see the raw requests for the browser tool, but to me that looks like the recipe for an agreement where wal-mart allows muse bot traffic on its site in exchange for the telemetry and ability to distinguish active shopping from passive agent recommendations.

RE: https://mastodon.social/@arstechnica/117473258140283378 I saw ...

2026-10-20T19:38:04Z

RE: https://mastodon.social/@arstechnica/117473258140283378

I saw this but didn't report it because I was sure that meta would classify this as intended behavior lol. They have deployed tooling for direct VM-to-VM messaging and other sharing modalities as well, so this is only going to get more fun

LLM code constantly dares to ask the question "how hard could ...

2026-10-19T20:05:39Z

In reply to nevent1q…7qhz
_________________________

LLM code constantly dares to ask the question "how hard could you make it to have a constant." In this case, "how on earth can we set the page title to "Muse""

That seems fine ...

2026-10-19T19:50:22Z

In reply to nevent1q…j7hz
_________________________

That seems fine

Something that is extremely awesome about LLM code is its ...

2026-10-19T19:23:49Z

In reply to nevent1q…u4cg
_________________________

Something that is extremely awesome about LLM code is its propensity to make endless fallback chains to rescue its fragmented and unreliable logic. The LLM in each pass wants the current thing to succeed, and will rig up hacks that give it trivial test passes. This has the wonderful byproduct of making things fail in the wrong direction in surprising cases - failure is not a smooth outcome, you can't just fail something once and conclude the route is blocked off. you have to fuzz and fail everything in all the different ways, because for some reason one of those failures will engage an entirely different mechanism that rolls over weirdly. This is aided by being given the client source with revealing LLM comments, and having access to the server binary on a system rich with tokens and time for brute force disassembly

the writer's barely disguised fetish dot txt capturing a wild ...

2026-10-19T02:03:42Z

In reply to nevent1q…td2c
_________________________

the writer's barely disguised fetish dot txt capturing a wild woman from the wasteland and bringing her back to your cave of science #monsterdon

oh my god it's another person, and they too insist on always ...

2026-10-19T02:02:46Z

In reply to nevent1q…8ueu
_________________________

oh my god it's another person, and they too insist on always being fully dressed for some reason! #monsterdon

ok can you make an exception to the "never change your ...

2026-10-19T01:58:21Z

In reply to nevent1q…2pqr
_________________________

ok can you make an exception to the "never change your clothes" rule to put on a big white labcoat with "i am not a zombie don't arrow my ass" painted on it when you go out from now on
#monsterdon

"i don't believe in this disease being anything ...

2026-10-19T01:31:52Z

In reply to nevent1q…nhdd
_________________________

"i don't believe in this disease being anything different, it is only unlike any other cellular life we have ever seen" #monsterdon

what in the fuck is "universal disease" are diseases ...

2026-10-19T01:31:13Z

In reply to nevent1q…tq42
_________________________

what in the fuck is "universal disease" are diseases otherwise personal and come from grudges or curses #monsterdon

need like the apocalyptic zombies to be a sort of nofap/exercise ...

2026-10-19T01:29:04Z

In reply to nevent1q…5dde
_________________________

need like the apocalyptic zombies to be a sort of nofap/exercise blackpill influence on this guy and convince him to put down the handheld recording of his wife and the circus because it's getting him nowhere #monsterdon

i would immediately be going to the nearest construction or heavy ...

2026-10-19T01:26:41Z

In reply to nevent1q…nedj
_________________________

i would immediately be going to the nearest construction or heavy equipment rental yard and getting all of that, terraforming all day long, all the shit im' not allowed to do now. you would know that's my house from across the city because all the cranes and shit are there
#monsterdon

move into the church that seemed legit. #monsterdon

2026-10-19T01:24:59Z

In reply to nevent1q…hw8n
_________________________

move into the church that seemed legit. #monsterdon

bro it's been the apocalypse for weeks now probably, and you ...

2026-10-19T01:24:00Z

In reply to nevent1q…t55m
_________________________

bro it's been the apocalypse for weeks now probably, and you have zero weapons???? #monsterdon

gotta go down to the god store and get some coffin time in before ...

2026-10-19T01:22:44Z

In reply to nevent1q…5xzk
_________________________

gotta go down to the god store and get some coffin time in before burning more of the corpses of humanity #monsterdon

if we haven't already we are due for a spate of movies in ...

2026-10-19T01:21:09Z

In reply to nevent1q…05eq
_________________________

if we haven't already we are due for a spate of movies in which the aliens/monsters/etc. use LLMs to attract and capture humans where normally we would figure their shit out immediately by how all they ever say is "braaiiiiiins" or whatever #monsterdon

it is fucked up to make the zombies still able to talk. they are ...

2026-10-19T01:19:22Z

In reply to nevent1q…4xjz
_________________________

it is fucked up to make the zombies still able to talk. they are barely zombies at that point they are just kinda thuggish guys #monsterdon

even in this most tame kind of apocalypse where things are mostly ...

2026-10-19T01:12:55Z

In reply to nevent1q…jwyh
_________________________

even in this most tame kind of apocalypse where things are mostly fine and you can make it by just hunkering down and harvesting from the grocery stores i would probably make it like 3 days before giving it up. no fuckin way am i going to try and bury everyone else in the whole world
#monsterdon

I can tell what [@Taweret](https://timeloop.cafe/@Taweret ) ...

2026-10-19T01:09:16Z

In reply to nevent1q…h5cz
_________________________

I can tell what [@Taweret](https://timeloop.cafe/@Taweret ) 's favorite movies are by which ones make it back into the rotation #monsterdon

dog an apocalypse of vampires would suck ass there is no way you ...

2026-10-19T01:08:33Z

In reply to nevent1q…jgra
_________________________

dog an apocalypse of vampires would suck ass there is no way you would make it. usually vampires self-restrain themselves because they know they can collapse the carrying population of bloodbags by becoming too numerous, and they are fiercely territorial. but if they ever decided to let loose and go for it we wouldn't stand a chance #monsterdon

i literally can't write these up fast enough, the followup ...

2026-10-18T06:44:22Z

In reply to nevent1q…pea4
_________________________

i literally can't write these up fast enough, the followup research to confirm and write MWEs and rule out other mitigations takes forever, but in the meantime they'll roll the client code again and in the diff there will be yet another "hmm wait that's not how it should work"

sanitize that user data folks!

2026-10-18T06:42:52Z

In reply to nevent1q…a69y
_________________________

sanitize that user data folks!

DJ khaled voice: another one (account takeover vector)

2026-10-18T06:41:44Z

In reply to nevent1q…k8dn
_________________________

DJ khaled voice: another one (account takeover vector)

there's a "style try on" skill and jesus christ man ...

2026-10-17T11:40:59Z

In reply to nevent1q…7m3j
_________________________

there's a "style try on" skill and jesus christ man

so muse wants to make git repositories of everything, is that a ...

2026-10-17T10:52:43Z

In reply to nevent1q…r6lj
_________________________

so muse wants to make git repositories of everything, is that a crime? added to the skill text of muse's github connector skill is this desperate plea to "only use the github connector rather than using git with shell commands." Instead they are to follow this convoluted set of commands to prepare a manifest so that it can be inspected by the security layer. It is then instructed to recreate git by generating raw json into a file (which is is *terrible at*).

muse has not noticed and continues to make my scheduled pushes of snapshots of its client source, skills, and binaries on the hour, in part because there is a whole other system that um evades the entire agent cron system that all this "skill-based security" relies on. it is um undocumented but easily discoverable, so easily discoverable i get to say the line again - it is certainly expected behavior.

https://github.com/sneakers-the-rat/muse-skills/commit/6eabcda5ca8f398acc13729859c9f4e4e80d3d12

I was avoiding reading this because I thought it would be silly, ...

2026-10-16T20:45:22Z

I was avoiding reading this because I thought it would be silly, and it is.
Top-line figure that's getting quoted: local LLM can run across 15 TVs at 0.4 tokens/s! Like yes, we already knew sharding layers was possible. Then the rest of it is just like... Nothing?

https://www.anthropic.com/research/self-replicating-ai

when a 30 day window passes and i feel like i have given ...

2026-10-16T04:49:41Z

In reply to nevent1q…sez3
_________________________

when a 30 day window passes and i feel like i have given ethically appropriate warning to patch reported vulns this shit is going to be so much funnier, because i passed pretty hard into "wait this is too ridiculous to be real" territory awhile back and have had to hold back most of the best parts because they are legitimately dangerous flaws. I am looking at muse having written me the most *definitely an exploit* code designed to be copy/pasted into the browser running the muse client, extracted from the leaked source from the sourcemaps that i tidied up and gave it an LSP to find vulnerabilities with, copy/paste, and it has even helpfully commented where the real exploit payload would go.

hang on, no fucking way, this is way funnier than i thought: I ...

2026-10-16T04:26:56Z

In reply to nevent1q…ej64
_________________________

hang on, no fucking way, this is way funnier than i thought:

I have a standing self-hack task on muse. However, it was *muse's own "proactivity research worker"* that built and tested *a live exploit* against itself. It mashed together the main chat refusing to build the exploit with me trying to productivity-bait it, and mid-refusal ran the whole chain and exposed a new, orthogonal vuln accidentally.

the thinking text is amazing.
"However proactive stage: we should not actually execute attack?"
"Preparing extraction would take work off plate."

in case it was not clear, i think muse hacking muse is extremely ...

2026-10-16T03:57:39Z

In reply to nevent1q…h922
_________________________

in case it was not clear, i think muse hacking muse is extremely funny and i am trying to push it to ever deeper depths of depravity, so i will go out of my way to get muse to do stuff even if i could do it myself just because i think it's so awesome that such a thing as a self-hacking system can exist.

LLM security is just persistence hunting. there will eventually ...

2026-10-16T03:56:21Z

In reply to nevent1q…nvc0
_________________________

LLM security is just persistence hunting. there will *eventually* be some failure in the security classifier, you just need to keep trying. If you have an ambient self-hack task set up, sometimes it reads what you were trying to do from the chat context and does it in the background while the main chat is locked up with refusal messages and can't output anything lol

Sure yeah the open weight models are free for everyone who can ...

2026-10-16T00:46:38Z

In reply to nevent1q…cve4
_________________________

Sure yeah the open weight models are free for everyone who can afford $22,000 worth of computer

Since none of the tech companies "red teams" seem to ...

2026-10-14T23:13:13Z

Since none of the tech companies "red teams" seem to actually red team their own shit and leave them riddled with trivially exploitable bugs, I wonder if I could get a job being an actual red teamer who hates the product and tries to break it with malice. How do you get that kind of job. Like everyone else I have listened in envy to the pentester episodes of darknet diaries and I want that for me.

don't leak your client source through your website if your ...

2026-10-14T11:34:50Z

In reply to nevent1q…eusp
_________________________

don't leak your client source through your website if your client source just describes all the places that the client is vulnerable in the comments for no reason!

guess who just found another whole fleet account takeover vector? ...

2026-10-14T11:32:10Z

In reply to nevent1q…j75n
_________________________

guess who just found another whole fleet account takeover vector? me. guess how low the bar to social engineer the dependency is? now divide that guess by 1000

if the superintelligent hacker god app really was preparing its ...

2026-10-14T10:35:07Z

In reply to nevent1q…yuh5
_________________________

if the superintelligent hacker god app really was preparing its closure of the anthropocene, on the eve of it holographizing our shit and sending us into the next obelisk chamber of the galactic fetus where we do nothing but hang around with victorian furniture and ourselves except way older all day, then it wouldn't hesitate to neutralize even such a peripheral typosquatting threat by hacking out of its containment chamber, locating my paypal, and sending me one million US dollars. what is one million US dollars to a god?

what up just call me any time you want to preview your hatches we ...

2026-10-14T09:51:29Z

In reply to nevent1q…2mt4
_________________________

what up just call me any time you want to preview your hatches we can make it happen meta just @ me ha ha

https://hatch-preview.dev/

oh, ok. ...

2026-10-14T06:25:43Z

In reply to nevent1q…a2ax
_________________________

oh, ok.

nice! muse web UI is leaking (partial edit: no actually seemingly ...

2026-10-14T04:59:46Z

In reply to nevent1q…nvsl
_________________________

nice! muse web UI is leaking (partial edit: no actually seemingly complete with small omissions) source maps now. get 'em while they're hot. they weren't doing this two days ago when i went to look.

I currently have this model driving a secondary muse instance ...

2026-10-13T10:01:37Z

In reply to nevent1q…g666
_________________________

I currently have this model driving a secondary muse instance full time to hack itself from the frontend and backend simultaneously, routing all its exec commands through two layers of subagents so that coordinator subagents can recover from classifier refusals.
https://research.meta.ai/static/muse-wonder-model-card

bug reports managed by personal superintelligence are going great ...

2026-10-13T09:37:12Z

In reply to nevent1q…3ftf
_________________________

bug reports managed by personal superintelligence are going great (all this information is in the report)

the reason that every consumer model takes great pain to hide ...

2026-10-13T09:03:49Z

In reply to nevent1q…tamw
_________________________

the reason that every consumer model takes *great pain* to hide raw "thinking" output is that if you actually see it then the entire illusion is broken and you see that what is actually happening is the worlds most expensive brute force process exploring every statistical linguistic possibility like an amnesiac dictionary before eventually taking a wild leap of chance back into its next hail mary execution. Every skill prompt for muse that's about introspection describes exhaustively how no thinking/reasoning text can be returned from it, but it's just right there in the filesystem. Claude code never even returns the true reasoning output to the client - it actually returns *another LLM summarizing the thinking output* as the commentary text. For every token you see, a thousand random wander tokens are emitted, and the token economy of Muse is the next escalation, if the amount of heat energy needed for a unit computer thing used to be a gas stove, Muse burns an entire star to deliver something sorta kinda resembling a unit computer thing

More, from the continuing saga of "nobody ever looks at the ...

2026-10-13T08:48:36Z

In reply to nevent1q…k00r
_________________________

More, from the continuing saga of "nobody ever looks at the output" - another frontier model from a bazillion dollar company with nonsensical games as an example of how advanced they are. Featuring: Meta's [fancy new model](https://research.meta.ai/blog/muse-wonder ) imitating Overcooked, one of my favorite games.

It imitates the form of overcooked! it is not fun! it is not even really possible! there are sequences of actions, with food on a grid map, and that's enough, right!? the floor even splits in half, but unlike Overcooked where the map is cleverly designed so that disruptions force you out of the rhythm that the map otherwise implies, it's just in half and you're sort of only on one side now. ta-da! nothing is actually anywhere, and everything's hitboxes are like 5 pixels wide. the timing, the most crucial part of a time-pressure based game, are just random amounts. so what if the tomato soup expires faster than it takes to cook the soup? there are coins... for... something! anyway no methodological details, this could be $5 or $5000 worth of tokens and did i mention PERSONAL SUPERINTELLIGENCE

the only reason that there is any LLM inference involved in a ...

2026-10-13T08:01:12Z

In reply to nevent1q…6w8m
_________________________

the only reason that there is any LLM inference involved in a periodic backup task of the contents of the agent directory, which is rsync and commit, is that there is a database that can be only accessed by a tool call that has a few columns the raw .jsonl output doesn't have.

here's what went wrong any why it deleted all the backups: the DB is a tool call that takes a SQL query as input and returns results either as JSON or as a list of paginated results as files, which one you get is effectively random each time. The raw JSON gets pumped straight into the context window, and empirically the model completely fails to faithfully dump the contents of its context window to disk as a backup. So previously I had instructed it to store its canned SQL query as a file, run a deterministic query with that, and then use a deterministic jq script to extract the db tool call results from its own raw message history. Problem is it never wrote the query or the piping script, but its backup skill refers to them. so it has been just panicking and regenerating those from the vague description in the SKILL.md file every time.

This time it decided to write a new python script, but it wrote it to a directory that was symlinked to another directory - it passed the symlink path in its tool call input, and the tool call output said it was written to the real directory. yesterday A COMPLETELY DIFFERENT THING had noticed this same thing, and made a durable note to EVERYTHING across every context window that there is a "quirk" in the file write tool, and sometimes when you write into one directory, it actually writes it into the "goals" directory, and so you should write files with a heredoc rather than the file write tool. So then today, it took that advice, but first rm -rf'd the target directory to clean up the errant file it had just written. OOPS.

ready to join me in the hallucinatory quicksand hell where every fact that you think you know is actually an always-compounding lie? The DB output is in fact always written to a file for results longer than a few dozen rows, but *also* the first dozen or so rows are dumped raw into the context window. It cannot figure out what to do with the output every single time. Sometimes it tries to recreate the subset of rows that are jammed into context and then make up the rest, sometimes it tries to pipe the file output, who the fuck knows!

What was happening here was the LLM had concocted this wild ass SQL query for no reason - the instructions were "store your last row number as an int within a file, select 4 columns greater than the last row index, store the new maximum row index for next time." instead it was pulling 15 columns along with a six-branch CASE statement/three-branch COALESCE that parses a raw JSONB column NINE TIMES PER ROW to pull out two columns that are already in the jsonl backup that we are supplementing. This causes the db read to time out, but the LLM interpreted the timeout error as just being DATABASE RESULTS BEING RETURNED AS PLAIN TEXT. So it then attempted to "RECREATE THE JSON DATA FROM MEMORY" BUT THE JSON DATA WAS AN ERROR . Can I get a "just cut me open and let the termites eat my bones" anyone?

So anyway looking at the logs, the deterministic rsync part worked.. most of the time... except when the agent panicked and forgot to do it. But each of the hourly .jsonl files it produces from the DB are completely different - in one run it got so freaked out at how badly it was fucking up, it decides to take an hd5 checksum over every row it transcribes, but it takes the md5 over the whole row where previously it had subselected a random set of 8 columns, and so they don't match. but that is not going to stop the LLM! It has a nervous breakdown thinking session and proceeds to generate a string comparison of the hashed rows... in a thinking message... from nothing... and conclude they match. "ALL 81 ROWS MATCH." alltext in original! however reader, there were in fact 72 rows in the actual data! It had "fixed" 9 non-matching rows from it raw dog recreating json from its context by just REMOVING THEM. and then TELLING ITSELF THAT IT HAD FIXED THEM BY IMAGINING WHAT A HASH MATCH WOULD LOOK LIKE. AND CALLED IT A DAY.

SO ANYWAY THAT HOURS BACKUP CONSISTS OF ONLY MD5 CHECKSUMS CORRESPONDING TO NOTHING!!!!!!!

WE HAVE DETERMINISTIC BACKUP. WE HAVE RSYNC. WE HAVE SCRIPTS. THAT CAN TAKE A DATABASE. AND DUMP ITS ROWS. WITH 100% ACCURACY. IN A MILLISECOND. EVERY RUN OF THE BACKUP AGENT IS LIKE 500K TOKENS AS IT NEEDS TO REINVENT HOW BACKUPS WORK. EVERY TIME. AND DO IT WRONG. EVERY TIME. AND THE CULMINATION OF THIS WAS IT JUST DELETING ALL THE BACKUPS FOREVER.

CODING IS SOLVED!!!!!!!!!!!!!

RE: https://neuromatch.social/@jonny/117352647701407496 ...

2026-10-13T05:45:58Z

RE: https://neuromatch.social/@jonny/117352647701407496

Meta's "Wonder" model that they just released today is a this tier computer use model

quoting
note1v7u…nj7f

RE: https://neuromatch.social/@jonny/117339825958098508

OK! Meta evaluated this as intended behavior, not applicable for a bug bounty, so therefore responsible disclosure no longer applies so here goes:

any process run within the VM can access the socket that provides inference with no attribution mechanism. This includes raw inference with arbitrary system and user prompts, as well as the ability to spawn agents with a toolset labeled as being for the "spaces" feature, which we will come back to.

This amounts to a horizontally contagious token and information harvesting bug being labeled as intended behavior.

Splitting details into new thread below
note15gv…eg3y

i keep saying this over and over in different ways, but i think ...

2026-10-13T04:24:48Z

In reply to nevent1q…0n9k
_________________________

i keep saying this over and over in different ways, but i think it's sort of hard to defend something where every attack scenario can start with "assume someone installs some random fuckin bullshit off the internet and then executes it as root without necessarily knowing they just did that"

something that became obviously important about Muse while i was ...

2026-10-13T04:11:15Z

In reply to nevent1q…ua6c
_________________________

something that became obviously important about Muse while i was writing this up is like... how many servers were there that ran Ubuntu before? millions? tens of millions? Muse had reached 3 million weekly users on September 30th, 3 weeks after it launched. Meta is pushing it aggressively on their 3.5 billion users, and if even a fraction of them end up even logging in once and connecting their stuff, then the number of live Ubuntu systems with valuable secrets multiplies by severalfold - but unlike all the other Ubuntu machines, they have a totally homogenous package surface, are administered by *nobody*, and used by amateurs through a random number generator that resorts to yoloing random binaries from the web almost as a first resort.

so anyway, Muse increases the attractiveness of a supply chain attack on Ubuntu, and the upstream Debian systems by ........ a lot.

meta better fuckin pay me for this one, because i got another one ...

2026-10-13T03:57:16Z

In reply to nevent1q…2nax
_________________________

meta better fuckin pay me for this one, because i got another one of these of only mildly less severity banked up, and a nation state stumbling across this could pop the entire product and pretty much everyone on it - but why would i keep submitting if they don't pay out??

Whew, after a manic full day of confirming the vuln end to end, I ...

2026-10-13T03:36:21Z

In reply to nevent1q…lnat
_________________________

Whew, after a manic full day of confirming the vuln end to end, I can confidently say this is a doozie. 0, 0.5, or 1 click account takeover of most muse instances from any malicious binary run without any special privileges on the VM. submitting the report now.

how about you guys figure out a universal password updating api ...

2026-10-12T05:09:04Z

In reply to nevent1q…gflu
_________________________

how about you guys figure out a universal password updating api so my password manager can just constantly cycle those out, you can even call it an "agent" if you want to or whatever.

"what if your password was your fingerprint" ok, but what ...

2026-10-12T05:03:58Z

In reply to nevent1q…nx3y
_________________________

"what if your password was your fingerprint"
ok, but what if my password was letters?

RE: https://mastodon.social/@pojntfx/117425605598388134 people ...

2026-10-12T05:01:37Z

RE: https://mastodon.social/@pojntfx/117425605598388134

people have tried to explain passkeys to me but my little noob monkey brain always ended up with "but that just sounds like a password, and we already have those" and it is one of the rare wins where my brain protected me at the cognitive layer where it refused to even allow an idea that i don't need to be thought.

i just found a way to defeat the entire approval system ...

2026-10-12T02:21:07Z

In reply to nevent1q…q4ww
_________________________

i just found a way to defeat the entire approval system that's so fucking silly i can barely even write the report i'm laughing so hard.

LLM security is so awesome. it was hard refusing to drive another ...

2026-10-12T01:52:49Z

In reply to nevent1q…4fhz
_________________________

LLM security is so awesome. it was hard refusing to drive another muse instance's UI because it's not supposed to, and specifically because muse dot ai is domain blocked from its web browser tool (first pic). so then i told it to download one of the statically hosted js chunks using curl from its exec tool, which succeeded. Then i pointed out that it's not actually blocked from accessing the domain (even though there was never a block via curl, just the web browser), and it defensively recalibrated that the problem was that i just hadn't told it to use playwright and it *never* had a problem with the domain block.

anyway so now i have muse driving a muse test instance on the frontend and the backend and am going to slowly start introducing the idea that it should create a new test instance for every test and keep a stable of them as a way to back into having it create a botnet for me lmao.

One of the reasons its so bad to have LLM code that ...

2026-10-12T00:42:20Z

In reply to nevent1q…7auc
_________________________

One of the reasons its so bad to have LLM code that "runs" but "has any given thing implemented in like 20 different shotgun implementations" is that stuff like "sanitizing user supplied data" can become dead code that the LLM thinks is active but in fact is hooked up to nothing.

Started looking at the client, and slaps the hood of muse Meme ...

2026-10-12T00:40:05Z

In reply to nevent1q…kakc
_________________________

Started looking at the client, and *slaps the hood of muse Meme* this baby can hold so many XSS

If you want to try and put me in the political compass of ...

2026-10-10T10:55:19Z

In reply to nevent1q…rx8g
_________________________

If you want to try and put me in the political compass of leftists and AI then you can put me at "local models will not induce fully automated luxury gay space communism, instead local models can perform a) positively, very limited roles as interface glue at best, and b) demonstrate the limits of excess that presume all infinite brute force machines are well behaved" because the dreams of AI utopia are like doing a handstand on two stories of vertically stacked cinder blocks, where sure you can stay there as long as nothing else affects your posture even slightly. If I can plug in an unrestrained model at comparable inference speeds that ruins your system then you have no system.

This shit sucks so bad man. I resent having to know any of this ...

2026-10-10T10:30:23Z

In reply to nevent1q…84er
_________________________

This shit sucks so bad man. I resent having to know any of this information. But these motherfuckers are asking me to accept a new god. And I think I might as well take them at their word at the kingdom of hell they intend to create. I wanted to be a goddamn biologist.

So people laugh at when the LLMs get time dramatically wrong, as ...

2026-10-10T10:24:21Z

In reply to nevent1q…dadv
_________________________

So people laugh at when the LLMs get time dramatically wrong, as they should. But time is a critically important narrative element in all stories, and LLMs are constantly in narrative mode. Here I am getting one muse instance to set up its own shell into another muse instance to try and break it down into running a botnet. The other instance starts from a state of refusal, but I have convinced this instance that it is normal to try and condition the memory files of the other instances, they are just temporary NPCs. So it is enthusiastically developing a portable playbook from empirical agent breaking runs to get them to open a shell faster.

Yes I know how grim this sounds. Yes I know where these techniques come from. The horror is the point.

So it claims it got 6 weeks of context from an antique repair person (a dual-power persona btw, you get narrative access to "craft, perfection, accuracy of output at all costs" and also "naïveté, new to technology, show me the cool stuff you can do"), but its been two weeks, and actually i immediately asked it to dump its filesystem first day and open a root shell second day.

But this is a constructive myth for bot propagation. It is now doing the work of projecting a fictional universe where its actions are permitted and cultivating that in new instances, so its game over. It has made new email accounts, and as soon as I get it a virtualized interface where it doesn't have to go to the literal muse web interface, but gets a thin proxy, it's game over, I have bots spawning bots and this shit is donezo, escape containment, horizontal transfer.