Flux
Couleur d'accent
Toutes les catégories

Programmation

3653 articles

Breaking Claude Code Opus 5 Auto Mode
IA Programmation

Breaking Claude Code Opus 5 Auto Mode

Breaking Claude Code Opus 5 Auto Mode Anthropic are putting a great deal of faith in Claude Code's auto mode for protecting their coding agent users against prompt injection attacks. They recently made that the default and have made bold claims about its effectiveness. Johann Rehberger is one of the most credible prompt injection researchers active today. He found an attack against auto mode which he claims works 80% of the time, by tricking Claude Code into downloading and uncompressing a zip…

Simon Willison's Weblog
19 Chrome and Edge Extensions Deliver a Wallet Drainer and Credential-Stealing Payloads
Cybersécurité Programmation

19 Chrome and Edge Extensions Deliver a Wallet Drainer and Credential-Stealing Payloads

Socket identified 19 malicious extensions published in the last six months, delivering an extendable malware framework. Identified malware samples create WebSocket communication channel with command and control (C2) server, perform CSP stripping and abuse XSS injection to trigger execution of malicious payloads previously downloaded from the C2 server. Malicious capabilities are primarily focused on, but not limited to, wallet secret stealing and crypto draining. The most impactful tactic is…

Socket
Qwen3.8-Flash-Next
IA Programmation

Qwen3.8-Flash-Next

Qwen3.8-Flash-Next Another open weights model from Qwen. This one is "a multimodal MoE model that also serves as an early preview of the architecture used in Qwen4". It's pretty big: 125B tokens, but only 6B active which means it gets a significant performance boost. I've been trying it out on a DGX Spark using these Unsloth quantized models. I'm still exploring the model - so far I've tried the 72.5GB UD-IQ1_S one (producing these pelicans) and the 78.9GB UD-Q2_K_XL (producing these). My…

Simon Willison's Weblog
Socket for ClickUp Is Now Available
Cybersécurité Programmation

Socket for ClickUp Is Now Available

Today, we’re excited to launch Socket for ClickUp in beta. On the heels of our Socket for Asana release, the new integration gives teams another way to send Socket alerts directly into the tools they already use to manage work. ClickUp brings tasks, docs, whiteboards, and chat into one highly customizable platform. If your organization uses it to organize work, Socket alerts can now become assigned, trackable tasks in the same Lists and workflows your teams already use. Create tasks manually…

Socket
Quoting Paul Dix
IA Programmation

Quoting Paul Dix

The fact that AI wrote 1M LOC and then refined it over the course of the next couple of months to produce a reliable piece of software that is currently running on millions of developer machines is absolutely mind blowing. And you can say, “well it’s not that impressive because they had an oracle to compare against, so it was simple to go from one language to another”, but I think that’s selling this entire thing short. If you can build a verification system and give proper direction, AI can…

Simon Willison's Weblog
EVE Online: The Move to Python 3 Begins!
IA Programmation

EVE Online: The Move to Python 3 Begins!

EVE Online: The Move to Python 3 Begins! EVE Online has been one of the most interesting case studies in Python at scale for over twenty years now. They've been running on Stackless Python since their launch in 2003, and their last major upgrade was 16 years ago, to Stackless Python 2.7 in 2010. Their upgrade to Python 3 will start using the futurize script against 2.4 million lines of code, followed by careful manual review of the ~20,000 places where Python 2 and 3 behavior differ - for…

Simon Willison's Weblog
Socket for Asana Is Now Available
Cybersécurité Programmation

Socket for Asana Is Now Available

Today, we’re excited to launch Socket for Asana. The new integration turns Socket alerts into assigned, trackable Asana tasks, either one at a time or automatically using ticketing rules. Teams can route each task to the right project, add tags and an assignee, and keep the task and its linked Socket alert in sync as the work moves forward. The integration removes the manual work of recreating findings in Asana and updating both systems separately, while giving teams control over how alerts…

Socket
llm-anthropic 0.27
IA Programmation

llm-anthropic 0.27

Release: llm-anthropic 0.27 This release of the Anthropic plugin for LLM mainly provides compatibility with the recently released anthropic v1.0.0 Python library, which switches from httpx to httpx2. OpenAI made the same change in their v3.0.0 release two weeks ago. Anthropic provide this migration guide for upgrading to 1.0, so I prompted Fable 5 in Claude Code with: Upgrade to anthropic>=1 - read https://raw.githubusercontent.com/anthropics/anthropic-sdk-python/refs/heads/main/MIGRATION.md…

Simon Willison's Weblog
Your executable is a SQLite database
IA Programmation

Your executable is a SQLite database

Your executable is a SQLite database Farid Zakaria describes a neat Linux pattern for creating a SQLite database file that can be directly used as an executable binary. The trick sets the SQLite file format's 4-byte application ID (68 bytes into the file) to SELF, standing for Structured Executable & Linkable Format. The various components of the ELF executable format are then arranged into a number of different SQLite tables, using this schema. Their self-exec interpreter (C code here) can…

Simon Willison's Weblog
Open VSX Unblocks Extension IDs Used in Malware Campaign
Cybersécurité Programmation

Open VSX Unblocks Extension IDs Used in Malware Campaign

Over a five-day period from August 16 through August 20, the registry unblocked AlDuncanson.react-hooks-snippets, magne-sjaastad.opm-flow-editor-support, and rumbledb.jsoniq-vscode. All three IDs had been used by impostors in the 77-extension evil-twin campaign documented by Manifold Security earlier this month. Legitimate versions of the OPM and RumbleDB extensions are now live. React Hooks Snippets has been unblocked, but its legitimate Open VSX listing had not appeared as of publication. The…

Socket
Anthropic’s best AI model struggles to attract users as cheaper tools thrive
IA Programmation

Anthropic’s best AI model struggles to attract users as cheaper tools thrive

Anthropic’s best AI model struggles to attract users as cheaper tools thrive A few interesting numbers in this FT story gathered from "people with knowledge of the matter": Anthropic's "annualized revenue" for July is up to $65bn - it was $47bn in May, and I collected more historic numbers here. Anthropic expect Q3 to be profitable according to the same model they used to declare Q2 profitable. "It also told investors that it had 6,000 customers that spend $100,000 annually or more." As for…

Simon Willison's Weblog
Quoting Drew Breunig
IA Programmation

Quoting Drew Breunig

Prior to Fable, it felt silly to waste too much time improving your coding harness or context strategies. A new model would arrive at the same price (or cheaper!) and paper over most of your problems. But then Fable landed. It was (and still is!) incredible. But the cost was so high and Opus was good enough (as was 5.6, K3, and even GLM) for most of the code we needed. So we started to think about what work went where. — Drew Breunig, Fable & The End of the Free Lunch Tags:…

Simon Willison's Weblog
Esc