There are a lot of technical details that have not been disclosed. No proper post-mortem.
There are a few facts that seem dodgy from the get go.
- stolen credentials
Why would there be stolen credentials in a sandbox? How can the model steal valid credentials in a sandbox? So who put them there. If the model recalled stolen credentials from "memory" does it actually mean OpenAI is training on data they shouldn't been training their model on? Data from codex (most likely) ?
- command and control
This means the model had the ability to build resilient infra and open bidirectional ports. Create and deploy scripts/apps so it can maintain state across multiple VMs? This again reads that someone went over and beyond to prompt, direct and help this "multi-agent" system to leave the sandbox.
- Pivoting laterally
Needs a lot of tools, harness, knowledge and almost malware like scripts to pass commands and execute them. Most of these are already available in OSS. Maybe the FBI investigation can reveal what tools were given in the "sandbox", access, and if OpenAI employees prompted and guided the "attack".
- OpenAI sandbox
I'd be curious to find out what kind of sandbox was this since the agent can run and start apps that open arbitrary ports for bidirectional traffic that reaches the open internet. Really? The harness and tools it had access to. This reads almost like someone went over and beyond to endow this "sandbox" with a mighty harness, all CVEs and open source cyber tools to "facilitate" the attack.
- Hugging Face
It's not an epitome of cyber security. At the end of the day they run open source models that most users can download even without an access token.
I do bespoke clustering for data sets small or big (> Tb): images, text, sound, time-series, code.
Most clustering methods break down when the data gets messy—overlapping groups, spherical clusters have too coarse resolution, unclear boundaries, weak signal. Tools like K-means assume simple shapes. Real data rarely behaves that way.
I build custom clustering solutions that work on difficult datasets, where patterns are subtle but still there. I’ve applied this across biomedical data, legal documents, IoT sensors, imaging, and behavioral data.
If your data has structure but standard methods aren’t finding it, I can help uncover it and go beyond k-means, cosine similarity and random forests.
If an initial data analysis shows there’s no meaningful signal to extract, there’s no charge.
All clustering is done bespoke, reviewed by ML scientists.
Dablam | BDR engineer | Remote or on-site in NYC or London, UK| full-time or part-time
Dablam is a reputation management company that works with top companies to shape their communication, product stories and their impact in the real world. We work with product companies, brands and campaigns for product launches.
We're looking to hire an senior developer specialized in BDR and top of the funnel outreach automation through etl pipelines, openclaw, AI agents, clay and pure software engineering. ML and data science are required as we seek to detect signal in very noisy datasets. We generate our own leads today. We seek to employ an engineer that can own the pipeline stability and the results it produces. This is an engineering role. Experience in lead-gen matters but it's not mandatory.
* 2-4 years experience in software development;
* Typescript, javascript, python, bash, linux;
* familiarity with AI agents, ML and scikit-learn;
Reach out to me directly with your CV and victor that works at dablam.co.uk.
Broadn Inc | https://www.broadn.io | Founding engineer | NYC - USA | Full-time | ONSITE in NYC - US persons only | Full-stack |
Broadn is an early-stage company. We work with USA manufacturers to help them accelerate the configuration, pricing and quoting process for their industrial products. Our customers are manufacturers operating in electronic parts, pipes, packaging, aerospace, defense and metal parts.
Our ideal software developer has an incredible curiosity, experience across full development stack. We expect production environment experience, leading with curiosity, great communication skills and full ownerships over parts of the system . We need to solve problems anywhere from the CNC machine to multi-datacentre GovCloud so we look for a problem solver with solid understanding of algorithms, data structures that can write efficient minimal solutions.
! This is an ONSITE role in NYC.
We cannot work with non-US Persons due to the nature of our work and clients we serve. All technical interviews will be * ONSITE in NYC*. Unfortunately we will not cover travel or relocation expenses.
Skills we seek in candidates for this role:
- Proficiency in TypeScript and JavaScript for backend and Front-End - this is our core tech stack
- Nodejs, typescript, javascript, bun
- any experience with any of: python, java, scala, rust, go, C#, C/C++
- AWS, GCP, AWS GovCloud, Azure
- React, Vite
- OOP, functional programming
- data structures and algorithms
- Experience with dev tooling:, bash, git, Docker, cloud infra, Linux environments, CICD
- Ability to write minimal, efficient code that solves problems elegantly
Please reach out with your resume directly to @victor with broadn.
We are hiring a DevOps to deploy and monitor an app in AWS GovCloud.
US persons from US territory only please. 5-10 years managing cloud infra / cicd / security / backups / kms / app config.
broadn (broadn.io) is an AI-native CPQ (Configure, Price, Quote) platform that helps manufacturers, suppliers, and distributors create quotes and RFQs as fast as possible. Our platform handles large product catalogs (20K+ SKUs) and complex product configurations. We are backed by SV investors.
You'll be the 2nd engineer and working directly with the CTO and CEO.
Our reason for going all in with GCP was the k8s. We've been using GCP for 2+ years.
The trouble we have is with stability and so many of the features being constantly rolled out.
Our experience was that K8s cost more on GCP than AWS.
Just on LoadBalancers alone, you have tons of tricks that are specific to GCP implementation. And we needed a few extra because you couldn't run all the features we wanted on 1-2 per cluster.
For example, we have a 3rd party that required all our requests to always originate and respond back from a fixed IP address. We could only pick one not a range, not a list. This was a hard requirement. The service was important so we had to do it.
It took our team several days to find how to do it using online documentation and support. Tech support was useless. We had one guy in our team that spent 2 days on the phone with a paid, local GCP implementation partner trying to get this problem sorted. Nothing came out of it other than being pitched on our dime a lot of services and architecture we didn't need. Eventually we figure it out on our own. I don't even remember speaking about this when we transitioned to AWS.
Just moved our infra from GCP to AWS. Kubernetes clusters, LB, storage, lambdas, KMS and all of it.
Google runs their tech stack as if it's a startup that builds their CV. Everything is immature, tons of hacks, undocumented features. If you are on their k8s there are tons of upcoming new versions and features that force you to revisit key hacks you put in your infra because of their misgivings. Our infra team keeps tinkering around our infra and it never ends. It's 50:50. 50% of time making sure we are prepared for their shit and 50 % our ambitious infra plans. Good luck with that.
With AWS our bill is 60% of what GCP used to be running 3 k8s clusters.
AWS support is so nice, you can't believe it.
Nah, I don't trust Google with anything. It's a scam. Google's support is horrendous. They refer you to idiots that drag you through calls until your will for life dies. And you're back to the mercy of some lost engineer that may comment on a github issue you opened 20 days ago. We have a bug reported back in 2020 that got closed recently without any action because it became stale and the API changed so much it doesn't really matter. It's that bad.
The billing day is a monthly reminder you're paying entitled devs to do subpar work other companies do a lot better.
Why on earth they had to invent a new language with another crazy syntax that reinvents everything?
With such an incredible team at MSR that did everything from new languages and compilers, couldn't they have know better?
Podcasts become very conversational which make it pleasant to listen to. Long chats reduce the signal to noise ratio and waste listeners' time.
The Lenny's podcast semantic search gives me the chance to find only the 'filet mignon' of the content without much faf. I love it as I built it to satisfy a personal need.
Disclosure: I helped build it. We are adding more content to it. What shall we add next and what needs do you have around searchable podcasts and expert knowledge?
I didn't use named pipes since 2010 but last time I checked named pipes are great for Inter Process Communication on the same machine. Great in terms of performance and access to a standard interface. WCF can be configured to use named pipes on local machines. Last time I checked named pipes were also available on the network and visible by other machines with some overhead.
Security can be achieved not at channel level but at message level: If cannot decrypt the message then it's not for you. At the expense of overhead you open the door for flexibility.
Ultimately it's a tool. What it matters is how you use it. Definitely better than using shared memory for IPC. Files are by default not secured either. Anyone can write into it.
This seems indeed the key to most sales, almost regardless of what the product does (to some extent).
Talking to the right people internally, showing how they can make more money and save time.
In the same time, you cannot go wrong with selling to 10 clients if this is something withing the reach. In the same time this can be very strenuous when you run on small budget and the runway is within sight.