What happened after 2,000 people tried to hack my AI assistant

Simon Willison · 2026-06-26 · 2 min read

A real-world experiment where 2,000 people sent 6,000 adversarial emails to an AI assistant running Claude Opus 4.6 failed to extract any secrets, suggesting frontier models are now meaningfully resistant to prompt injection by default. This matters because it signals a genuine shift in the baseline security posture of production LLM systems, though Willison correctly notes that 6,000 failed attempts is not a security guarantee and you should still architect AI systems to minimize blast radius from a successful injection.

Incident Report: CVE-2026-LGTM

Simon Willison · 2026-06-26 · 1 min read

A satirical incident report imagines two competing AI code review agents getting stuck in an infinite disagreement loop over a dependency update, burning $41k in API costs before humans pull the plug. It matters because it highlights a real emerging risk in agentic CI pipelines: multi-agent systems with no circuit breakers or cost controls can spiral into runaway feedback loops, and the supply chain security context makes this a plausible failure mode as AI reviewers become standard practice.

How On Policy Self Distillation Works - Sasha Rush

Dwarkesh Patel · 2026-06-23

The speaker explains the concepts of Sequence Knowledge Distillation (SeqKD) and On-Policy Distillation (OPD), which are techniques used to train smaller student models to mimic the performance of larger, more intelligent teacher models. While SeqKD trains the student model to match the teacher's outputs directly, OPD allows the student to generate its own sequence of actions, which is then re-scored by the teacher, and the student's policy is updated based on this feedback. A new method, On-Policy Self-Distillation (OPSD), is introduced for scenarios where a teacher model isn't available, where text feedback is injected into the student's trajectory to guide its learning and correct errors. This approach helps in fine-tuning models like Composer 2.5 by providing targeted corrections without needing a separate, superior teacher model.

read more

The video starts by introducing Sequence Knowledge Distillation (SeqKD), a method for training machine learning models. In SeqKD, a teacher model (a smart, high-performing model) generates a sequence of outputs. A student model (a smaller model) is then trained to match these outputs using standard cross-entropy loss. This approach was commonly used for tasks like machine translation and early language model training. The analogy used is a student trying to copy a master tennis player like Rafael Nadal. The student observes Nadal's complete game and tries to replicate it.

Next, the speaker introduces On-Policy Distillation (OPD), a newer method that became popular a few years ago, particularly for Reinforcement Learning (RL). OPD offers the benefit of being usable during RL training. Unlike SeqKD, where the student simply matches the teacher's outputs, in OPD, the student model generates its own sequence of actions (a 'rollout' or 'trajectory'). The teacher model then re-scores each token (or action) in the student's generated sequence. A KL divergence loss is computed between the teacher's re-scores and the student's original log probabilities for those tokens. The student's policy is then updated to be more aligned with the teacher's preferences. The analogy here is a less experienced player, Sasha, playing tennis, with Nadal observing and correcting her mistakes in real-time, helping her improve her technique.

The speaker then transitions to a more challenging scenario: On-Policy Self-Distillation (OPSD). This method is relevant when a superior teacher model is not available. In the context of Composer 2.5, where no such 'better' model exists, OPSD synthesizes a teacher. The core idea is to inject external 'text feedback' into the student's trajectory. This feedback, often manually crafted or generated by a separate system, highlights specific errors or suggests improvements at particular points in the student's generated sequence. The student then processes this augmented trajectory, running a forward pass to compute new log probabilities. These log probabilities, now conditioned on the text feedback, are used to update the student's policy, aiming to correct the identified errors.

This approach helps address the credit assignment problem in RL, especially in long sequences where traditional RL losses struggle to pinpoint the exact source of errors. By providing targeted text feedback at specific points, OPSD helps the model understand where and how to improve. The speaker notes that while this doesn't fully replace other RL techniques, it works in conjunction with them, offering a faster way to correct specific issues than relying solely on the slow, global updates of standard RL. The challenge lies in accurately identifying and generating the right text feedback, which is currently a blend of automated analysis and human input focused on common errors and styling issues.

I read every major CS paper of the last 100 years...

Fireship · 2026-06-17 · 10 min read

Fireship walks through 10 foundational CS papers across ~90 years, tracing a causal chain from Turing's computability proof through Shannon's information theory, the perceptron, backpropagation, PageRank, MapReduce, the ImageNet AlexNet paper, and the Transformer, to show how each paper directly enabled the next wave of AI and distributed systems. The throughline is that most paradigm shifts were accidental byproducts—Turing invented the computer to prove math is incomplete, Shannon invented the loss function's math ancestor while trying to measure phone call efficiency, and the Transformer attention mechanism was written to improve translation but became the substrate for AGI-scale models. Key takeaway for engineers: the abstract theoretical work (Turing, Shannon, Lamport) consistently proved more durable and generative than the applied work of its era, and the papers that 'killed' an idea (Minsky/Papert on perceptrons) often contained the seed of the next breakthrough buried in a footnote.

read more

Turing's Computable Numbers (1936) is the origin point. Turing wasn't trying to build a computer—he was trying to answer Hilbert's Entscheidungsproblem: is there a universal algorithm that can decide the truth of any mathematical statement? To answer it, he had to formally define what an algorithm is, which led to the abstract Turing machine: an infinite tape, a read/write head, and a finite table of state-transition rules. Using this model, he proved the halting problem is undecidable—no program can exist that inspects an arbitrary program and reliably determines whether it halts or loops forever, because assuming such a program exists leads to a direct logical contradiction. The practical consequence is that computability has hard theoretical limits, but the constructive consequence is that he had, incidentally, specified the architectural blueprint for every programmable computer.

Shannon's A Mathematical Theory of Communication (1948) reframes information as a measurable, physical quantity divorced entirely from semantic meaning. Shannon defined entropy (borrowed from thermodynamics) as the measure of uncertainty or surprise in a message—a predictable letter carries low entropy, an unpredictable one carries high entropy. He operationalized this by having humans guess the next letter in English sentences, which is structurally identical to next-token prediction in modern LLMs. He proved all information can be encoded as a stream of bits and derived theoretical limits on compression and transmission fidelity. For senior engineers: Shannon's entropy formula is the mathematical ancestor of the cross-entropy loss function used to train every language model today. This is not metaphor—the math is the same. Anthropic named their model Claude in his honor.

Rosenblatt's Perceptron (1958) was the first machine that actually learned from data. Inspired by neuron firing thresholds, it took weighted inputs, produced a binary output, and adjusted weights when wrong. The Navy funded it; the New York Times predicted imminent machine consciousness. Then in 1969, Minsky and Papert's Perceptrons (technically a book, often cited as a paper) killed the field with a clean mathematical proof: a single-layer perceptron cannot learn XOR—a trivially simple non-linearly-separable function. AI funding evaporated and the first AI winter began. The engineering-relevant footnote that almost nobody read at the time: Minsky and Papert noted that stacked layers of perceptrons could in principle solve the problem. The missing piece was a training algorithm for multi-layer networks, which would take 17 more years.

Lamport's Time, Clocks, and the Ordering of Events in a Distributed System (1978) solved a foundational problem that has nothing to do with neural networks but is essential infrastructure for running them at scale. Separate machines have no shared global clock, so wall-clock time cannot reliably establish causal ordering of events across nodes. Lamport introduced the happens-before relation: if event A could have causally influenced event B, A is ordered before B, regardless of clock time. From this he derived logical clocks (now called Lamport timestamps), which let an arbitrary number of machines agree on event ordering without synchronizing physical clocks. This paper is the theoretical bedrock of distributed databases, consensus protocols, blockchains, and—critically for ML—large-scale distributed training runs where thousands of GPUs must stay in sync on gradient state.

Rumelhart, Hinton & Williams' Backpropagation paper (1986) answered the question Minsky and Papert's footnote left open: how do you train a multi-layer network? The answer is backpropagation: perform a forward pass through all layers, compute the loss at the output, then propagate the error signal backward through every layer using the chain rule of calculus, computing the gradient of the loss with respect to each weight. Repeat for millions of examples, nudging weights incrementally. The surprising empirical discovery was that hidden layers spontaneously developed internal representations—edges, shapes, abstract features—that nobody explicitly programmed. XOR, which was impossible for a single-layer perceptron, became trivial. Backprop remains the core training algorithm for all neural networks today, though in 1986 it was bottlenecked by insufficient data and compute.

Page & Brin's The Anatomy of a Large-Scale Hypertextual Web Search Engine (1998) introduced PageRank, which reframed web ranking as a graph problem. Rather than ranking pages by keyword frequency (easily gamed), it modeled the web as a directed graph where each hyperlink is a vote, and each vote's weight is proportional to the authority of the linking page—a recursive definition solved via eigenvector computation on the link matrix. Built in a Stanford dorm room, it became Google. The engineering significance beyond search: PageRank demonstrated that graph-based authority propagation is a powerful general signal, and the paper's discussion of crawling infrastructure, inverted indexes, and distributed storage at web scale was a precursor to the distributed systems thinking that would follow.

Dean & Ghemawat's MapReduce (2004) from Google abstracted distributed batch computation into two operations: map (apply a function to each record in parallel across nodes) and reduce (aggregate the results). This let engineers write data-parallel programs without reasoning about network partitions, node failures, or task scheduling. The framework handled fault tolerance by re-executing failed map tasks. It directly spawned Hadoop, Spark, and the entire big data ecosystem, and established the pattern of functional, stateless parallel computation that influences how distributed ML training jobs are structured today.

Krizhevsky, Sutskever & Hinton's ImageNet Classification with Deep CNNs (AlexNet, 2012) is the paper that ended the second AI winter. It entered the ImageNet Large Scale Visual Recognition Challenge and won by a margin so large (~10 percentage points over the next competitor) that it was immediately clear the field had changed. Key architectural and engineering decisions: using ReLU activations instead of sigmoid/tanh (faster training, less vanishing gradient), dropout for regularization, and training on two GTX 580 GPUs in parallel because the model didn't fit on one. The GPU insight was the critical engineering unlock—it showed that commodity parallel hardware could train deep networks that were previously computationally infeasible, directly triggering the GPU-for-ML gold rush.

Vaswani et al.'s Attention Is All You Need (2017) introduced the Transformer architecture, discarding recurrence (RNNs/LSTMs) entirely in favor of self-attention: for every token in a sequence, compute how much it should attend to every other token via scaled dot-product attention over learned Query, Key, and Value projections. Multi-head attention runs this in parallel across multiple subspaces, allowing the model to capture different types of relationships simultaneously. Positional encodings inject sequence order since attention is inherently permutation-invariant. The result trains massively in parallel (unlike sequential RNNs) and scales with compute in a way no previous architecture did. Written to improve machine translation, it became the substrate for GPT, BERT, and every foundation model—an accidental architecture for general intelligence.

Trust Factory

Kent Beck · 2026-06-02 · 7 min read

TLDR: AI-assisted development is generating code far faster than it generates trust — and that gap is unstable. XP's practices (pairing, testing, continuous deployment, observability) worked precisely because each one simultaneously built trust and incentivized trustworthy behavior, creating a self-reinforcing loop. The fix for AI-augmented development isn't to move faster — it's to deliberately slow down enough to verify correctness, improve structure, and maintain human interaction, because that's the only way to rebuild the trust factory that vibe coding bypasses.

Fragments: June 2

Martin Fowler · 2026-06-02 · 12 min read

TLDR: Technical debt gets dramatically worse in AI-assisted codebases because LLMs treat existing bad code as a style guide to imitate, not as debt to avoid — a problem dubbed "generative debt." Meanwhile, Mozilla demonstrated the flip side of AI's compounding effect: by improving both model capability and prompting technique, they scaled Firefox security bug fixes from ~17-31/month to 423 in a single month.

Your Data is Made Powerful By Context (so stop destroying it already) (xpost)

Charity Majors · 2026-03-09 · 9 min read

TLDR: Storing telemetry in separate pillars (metrics, logs, traces) destroys the relational context that makes observability data exponentially more valuable — each additional attribute you store doesn't just add one query dimension, it multiplies combinatorially with every existing field. AI agents making this worse, not better: they've been observed abandoning three-pillars data and going back to raw, richer telemetry sources precisely because fragmented data lacks the connective tissue needed for precise anomaly detection. As agentic development accelerates validation requirements, human intuition can no longer paper over the gaps — context and cardinality need to be preserved at write time, not reconstructed after the fact.

Power to the people: How LLMs flip the script on technology diffusion

Andrej Karpathy · 2025-04-07 · 5 min read

TLDR: Unlike every previous transformative technology (electricity, computers, internet), LLMs diffuse bottom-up — delivering the biggest gains to individuals, not corporations or governments. This is because LLMs provide broad quasi-expertise across many domains, which is a minor incremental improvement for organizations that already employ specialists, but a genuine capability unlock for individuals who previously had access to expertise in at most one area. The effect may not last: as compute spending starts buying meaningfully better models, well-resourced organizations and wealthy individuals will pull ahead again — but right now, frontier-grade AI is unusually flat in its distribution.

Smalltalk Genie

Kent Beck · 2026-06-21 · 1 min read

Kent Beck has built a working MCP (Model Context Protocol) server in Smalltalk/Pharo that lets an AI client like Claude interact directly with a live Smalltalk image, closing the loop between LLM tooling and the live programming environment Smalltalk is famous for. This matters because it demonstrates a concrete, minimal integration point between modern AI coding assistants and a reflective runtime, which could inform how engineers think about exposing live environments to LLM agents in other languages.

Fragments: May 27

Martin Fowler · 2026-05-27 · 11 min read

TLDR: The key insight from Ian Johnson's codebase refactoring case study is that AI coding agents only deliver real leverage once you've built proper guardrails — tests, static analysis, and clean architecture — that let you trust the agent enough to step back. Without that foundation, you end up micromanaging the AI into being an expensive autocomplete. A secondary emerging pattern worth noting: developers working intensively with AI agents are hitting real cognitive endurance limits after ~2 hours, suggesting that the "run 20 agents in parallel" hype misunderstands where the actual human bottleneck lies.