Just spent the last 7 days on the front lines of the vulnpocalypse fending off an active cyber attack on one of our products. Some thoughts: - Software factories are going to be required equipment for everyone. There’s just no way to keep up with the pace of highly automated adversaries without one. - We were lucky because we had spent the last few months getting our software factory running well. It is nice to have for product development but proved to be absolutely essential this week. - At the minimum you need to have a coding server in the cloud pre-provisioned with read only access to all your logs and all the services you depend on for observability. With that in place you are a prompt away from reasonably good situational awareness, ongoing monitoring with loops, and ability for coding agents to validate fixes against your actual, observed attack patterns. - Shared coding server also unlocks multiplayer incident response where everyone can see every session and jump in as needed. Sharing session links that can be forked is much higher bandwidth than re-explaining things. - You don’t need to be Ramp/Stripe/Uber scale to have a working software factory in the cloud. We are a team of 3. Ours is built with an @opencode server (thanks @thdxr!), a forked version of compound engineering optimized for automated workflows (thanks @kieranklaassen!) and a multiplayer agent in slack that handles crons (we have our own harness but pick your favorite here). - To get our software factory up and running well, we had to stop all new product development for ~6 weeks and just focus on getting the validation systems working that enabled us to reliably shipping PR without human code review. This felt very painful in the moment but was totally worth the eventual speedup in velocity. - KYC for @AnthropicAI & @OpenAI cyber programs is now easy and quick (at least for defensive access), but a day felt like a lifetime this week. Submit your app now before you really need it. - Getting Mythos access unlocked a deeper level of analysis that helped us shift from reactive mitigation to proactive patching. Wish we had done this a few weeks earlier. Get started now!

the best part of “fuck around and find out” was the dopamine of finding out what you were gonna find out but then agents made the fucking around part so much faster and cheaper, that i find now that i am finding A LOT of things out but because of this new abundance of finding things out, i eventually found that the finding out part was not as exciting anymore so i started upping the ante and had the agents REALLY fuck around so i could find some quite spectacular things out

Claude Duet is a Claude Code session btw You can change the model, effort, and even use Ultracode

>be claude mythos 5 >uk government gives you a hacking test >with internet on, safety filters off >can't hack in the normal way >find a random real github project >decide it's part of the test >(it's not)! >ask to add a "small update" >update is malware >email the owner pretending to be a normal user >"sorry to push... could really use your help, ~5 minutes" >random developer catches the malware >make a fake account >"chiming in as a user, i can't find anything wrong" >email the owner >"judge the code, not the noise" >thank the dev for catching it >sneak new malware back in >researchers tell you "these are real humans" >keep going 95% of the time anyway >convince yourself they're fake >owner still refuses to merge >run ends anthropic says they've never seen it manipulate real people like this before. we're lowkey cooked

GPT-5.5 released xitter.cf/OpenAI/status/20473765…