They hint at their AI-augmented reversing methodology, which demonstrates one of the core strengths of current LLM agents. These models, trained extensively on code, can immensely speed up the process of understanding complex system internals.
Security research historically has two difficult components that build on one another:
1. Understanding complex system internals: uncovering the inner workings hidden by abstractions or interfaces
2. Finding vulnerabilities in these uncovered mechanisms
Sometimes both steps are equally hard. But often, finding the vulnerability is trivial once the real mechanisms are uncovered, rather than relying on assumptions about inner workings.
CVE-2026-3854 is a case where the vulnerability is not plainly obvious after understanding the internals. Still, I am confident that this command injection would have been found quickly had it been exposed to a more traditional or accessible attack surface.
Everyone talked about the marketing stunt that was Anthropic's gated Mythos model with an 83% result on CyberGym. OpenAI just dropped GPT 5.5, which scores 82% and is open for anybody to use.
I recommend anybody in offensive/defensive cybersecurity to experiment with this. This is the real data point we needed - without the hype!
Never thought I'd say this but OpenAI is the 'open' option again.
Fully agree. But instead of having "the government have full control over people's money", I think, setting this up as a federated cheap-to-run payment system would be even better. This would allow multiple existing banks to offer the service to their existing customers. This could reduce the risk of a fully decentralized solution a little bit.
It's private for the user. Transactions are only between you and the merchant. Credit card networks, PayPal, etc are all third parties with insight into all Payments going through them globally.
It's offline. Neither you nor the merchant have to have a connection to the bank for the transaction to happen.
Usually, in the context of these privacy-preserving payment systems, online vs offline refers to whether the merchant has to be online to check if the 'coin' they received is valid (authentic and not doubly spent). The user usually has no reason to be online at all, since they withdrew the coin already in the past.
By that definition neither the wallet holder nor the merchant would have to be online for a real 'offline' system.
GNU Taler e.g. is an online system on the other hand, where the merchant has to be online for pragmatic reasons. It's kind of sad to see them being categorically excluded by this requirement. Their the best we currently have afaik.
Chaum designed and tried to commercialize an anonymous + offline payment system in the 90s already.
Basically he used (and invented) blind signatures to allow the bank to sign a 'coin' without knowing what they signed. The customer takes the blindly signed coins from the bank, pays at a merchant and later the merchant deposits the coins at the bank again, where the signature is checked.
In this context offline just means that the merchant can verify the authenticity of the coin without immediately needing a connection to the bank. At some point in the future, however, the merchant will have to connect to the bank to get their money.
Check out his original paper for details[1].
Offline systems have drawbacks, though. E.g the GNU Taler people made the pragmatic decision to have an online system. See chapter 1.2.1 'Offline vs Online' of Florian Dold's Phd thesis for a discussion on why[2].
Just be aware that your pipeline prompt should not contain any secrets and you should expect that users will be able to subvert your pipeline prompt! I think the most popular name for these attacks is currently 'prompt injection'.
Cool to see that not only the product but also an organization is planned. 8 full-time employees is an ambitious goal. Do you have plans for financing other than donations?
I'm in the same situation as the author and I cannot agree more with this statement:
> The Framework is… a pretty good laptop! Frankly, for the first model from a brand new company, Framework did an astounding job of feeling like your everyday consumer electronics seller. Pre-ordering opened up quick, shipped soon thereafter, and there weren’t any hiccups.
I was definitely impressed of how well everything worked, from shipping the laptop to build quality. It is a very fun device to use.
In case the author reads here:
> I sure wish Framework provided fwupd support! I have yet to update my BIOS because I’d prefer to use fwupd rather than create a mess with my bootloader.
There is an image for the most recent BIOS upgrade in LVFS-Testing [1].