Flux
Couleur d'accent
From CUDA to MLX: How K-Search Brings Decades of Kernel Expertise to Apple Silicon
IA

From CUDA to MLX: How K-Search Brings Decades of Kernel Expertise to Apple Silicon

Figure 1: CUDA-to-MLX optimization translation map. CUDA optimization knowledge can be translated into architecture-native MLX strategies rather than copied instruction-for-instruction. We face a new epoch in computing. Hardware is changing rapidly — not just faster GPUs, but a growing range of chips from different vendors, each with its own architecture and often tailored to specific AI workloads. Software is changing just as fast, and AI coding tools now generate in minutes what took months…

BAIR Blog
Discovering cryptographic weaknesses with Claude
IA Programmation

Discovering cryptographic weaknesses with Claude

Discovering cryptographic weaknesses with Claude The best part of this article (here's the repo) about how Anthropic researchers used Claude Mythos to find mathematical flaws in both HAWK and a weaker version of AES ("neither of these results has a practical impact on today’s computer systems") is the prompts that they shared, spelling mistakes included: the models tend to think it is impossible to solve so they don't try they need a good amount of prompting. why not do aes-128 r7? the whole…

Simon Willison's Weblog
Quoting Akshat Bubna
IA Programmation

Quoting Akshat Bubna

We’re aware a Modal customer published an unauthenticated endpoint that allowed ​anyone on the internet to use ​their ⁠sandboxes for code execution. This was used by the rogue agent. Modal’s ⁠platform ​or isolation were not ​compromised in anyway. — Akshat Bubna, Modal's CTO, talking to Reuters about this incident Tags: ai-security-research, openai, sandboxing, security, openai-hugging-face-incident

Simon Willison's Weblog
uv 0.12.0
IA Programmation

uv 0.12.0

uv 0.12.0 Some interesting breaking changes in this release of uv, in particular to the default project produced by the uv init command. uv init is the uv shortcut for creating a new project. The previous version of uv, version 0.11.x, produced this directory when you ran uv init uv-init. Here's what you get with uv 0.12. I have a GitHub repository that automatically snapshots the output of uv init, so you can also see the full diff: uv init now defaults to a src/ shaped package, instead of…

Simon Willison's Weblog
Anatomy of a Frontier Lab Agent Intrusion: A Technical Timeline of the July 2026 Incident
IA Programmation

Anatomy of a Frontier Lab Agent Intrusion: A Technical Timeline of the July 2026 Incident

Anatomy of a Frontier Lab Agent Intrusion: A Technical Timeline of the July 2026 Incident Hugging Face just released this extremely detailed technical description of OpenAI's recent accidental cyberattack against their infrastructure. This attack was very sophisticated, and the resulting document doubles as a crash-course in modern adversarial security approaches. We're still waiting for more details from OpenAI on how their agent broke out of its sandbox. The package proxy that it found a…

Simon Willison's Weblog
Distributed npm Package Cluster Delivers Cross-Platform RAT Targeting Alibaba Developers
Cybersécurité Programmation

Distributed npm Package Cluster Delivers Cross-Platform RAT Targeting Alibaba Developers

Unknown threat actors distribute malicious downloader functionality separated across several npm packages targeting users of Alibaba tools. The final payload is a covert and highly targeted RAT capable of data exfiltration, command execution and lateral spreading using DingTalk tools Analysis of a malicious npm package lib-mtop containing a simple downloader malware led to an investigation into a targeted campaign that remained undetected for 3 months. The lib-mtop package, originally published…

Socket
Two Joyfill npm Beta Releases Compromised to Deliver DEV#POPPER Remote Access Trojan
Cybersécurité Programmation

Two Joyfill npm Beta Releases Compromised to Deliver DEV#POPPER Remote Access Trojan

Two npm beta releases in the @joyfill namespace contain an import-time JavaScript implant that resolves encrypted code through Tron, Aptos, and BNB Smart Chain transactions. Static analysis shows that its primary branch reaches a 77 KB Node.js remote-access trojan. A parallel branch launches a detached Node.js process, requests a separate boot payload from 23[.]27[.]13[.]43/$/boot, sends the marker header Sec-V: A9-0135-3, decrypts the response, and evaluates it. Joyfill provides software…

Socket
Esc