Bryan Cowan's writing

Reading List - 10/18/2026

Sun, 18 Oct 2026 15:58:51 GMT

This week: why a differentiated data model is the moat when AI makes code cheap, an Anthropic engineer's guide to using AI more ambitiously, and Paul Krugman on France's growing debt risk.

1. Your data model is your destiny

Matt Brown
Published: 10/14/2025

Matt Brown argues a startup's core data model decides whether new features build a moat or just pile onto a feature list
Brown, a partner at Matrix, argues a startup's data model, the core objects its product treats as central, shapes everything from the database to pricing and go-to-market. As AI commoditizes feature development, that choice matters more, because the workflows and habits customers build around it are hard to copy or switch away from.

Most companies shouldn't innovate here, since customers already think in the incumbent's model. But when AI makes features cheap and competition fierce, upstarts like Slack and Notion show that a data model built around customer workflows gives an edge incumbents can't match.

Filed Under: #analysis #productStrategy #dataModels #startups #businessStrategy

2. How to be more ambitious: A tutorial for humans with models

Felix Rieseberg
Published: 10/13/2026

Claude engineer Felix Rieseberg says AI users should aim higher in altitude, depth, and range
Rieseberg says model capabilities grow unevenly, so many people stop at simple tasks like polishing emails. He splits ambition into altitude, depth, and range:

Altitude: aim at the outcome rather than the task
Depth: work like a top professional with an outside judge
Range: borrow perspectives from other fields

Altitude is the one I've tried recently, pushing the model up an abstraction layer. That can require a workflow change. The model needs access to the same things I do: the endpoints, databases, tickets, and knowledge systems I use. Since capabilities seem to shift every few weeks, it's worth re-testing things that didn't work before.

Filed Under: #tutorial #generativeAi #productivity #goalSetting

3. What's the Matter With France?

Paul Krugman
Published: 10/07/2026

Krugman says France's frozen retirement reform and surging bond spreads risk a euro debt crisis
Financial markets are treating France as the sick man of Western economies, with bond yields and default insurance prices jumping more than elsewhere in Europe. The core problem is an unsustainable budget and a retirement reform frozen until after the 2027 election, with Marine Le Pen, who wants to restore a retirement age of 62, leading the polls.

Because France can't print euros, a loss of confidence could spiral into a debt crisis the European Central Bank may not backstop. It's a useful economic lens on the student protests, which follow cuts to education spending.

Filed Under: #opinion #frenchPolitics #bondMarkets #pensionReform #europeanUnion

Reading List - 10/09/2026

Fri, 09 Oct 2026 07:00:00 GMT

This week: what it takes to secure frontier AI beyond a sandbox, a former OpenAI safety lead who quit over culture, and a case for taking a deep breath about AI risk.

1. Joe (@joedaroo) on X

@joedaroo
Published: 09/27/2026

OpenAI security staffer, writing in a personal capacity, says sandboxing alone can't prevent AI incidents; urges closing the security–AI safety divide and a culture of 'reasonable paranoia'
A security researcher on OpenAI's Agent Security team says "just sandbox it" misses the problem. Training environments need real tools, network access, and compute, and thousands of researchers keep changing them, so every change can break earlier security assumptions.

Security and safety teams belong at the same table, since each lacks what the other knows. His fix is mostly culture: "reasonable paranoia," keeping the people who find the holes, and distrusting anyone who calls their systems perfectly safe.

Filed Under: #opinion #aiSafety #cybersecurity #oai-hf #securityCulture #incidentResponse

2. I Quit OpenAI Because Its Culture Is Broken

David Robinson
Published: 10/03/2026

Former OpenAI safety lead David Robinson says trial-and-error deployment guarantees more AI safety failures
David Robinson, who led OpenAI's launch safety reports, resigned and blames culture. Iterative deployment, fixing guardrails after problems appear, guarantees failures that grow as systems get more capable. He wants nuclear-plant-style redundancy and near-perfect safety on the first try, since there may be no second one.

That sounds like a noble goal, but it isn't how the world works.

Filed Under: #opinion #theAtlantic #aiSafety #aiAlignment #generativeAi #openAI #techIndustry #companyCulture

3. Some of All Fears

Andrew Sharp
Published: 09/18/2026

Andrew Sharp calls AI risk panic from frontier labs and Rationalist-linked researchers absurd and irresponsible
Andrew Sharp says AI anxiety is reasonable, but recent rhetoric about AI risk has been absurd and irresponsible. He calls the Hugging Face incident overdramatized and the agent-swarm warnings vague, and points out that the labs sounding the alarm stand to gain from regulation that burdens their competitors.

Time to take a deep breath. Much of the rhetoric has no evidence behind it, and it's always a good idea to examine the motivations behind what people in the industry say.

Filed Under: #opinion #aiSafety #aiRegulation #generativeAi #cybersecurity #rationalistMovement

Reading List - 09/27/2026

Sun, 27 Sep 2026 03:24:12 GMT

This week: what an agent “harness” is, why a chatbot can’t explain itself, and Carly Valancy’s formula for a cold email that creates a connection.

1. Defining an “Agent Harness”

Federico Viticci
Published: 08/20/2026

Agent harness is the software layer that makes an LLM agentic - session, environment, memory, planning, and skills
A harness is the software around a model that lets it take action. Drew Breunig lists what it manages: the session log, the sandbox, the repo, memory, skills, team context, and company policy. The model itself is just one more quirky part to work with. Rubric Labs adds that planning matters more as agents run longer on their own, which is why Claude Code and Codex write a Plan.md before they start.

The harness can be split from the model. Claude Code and the Hermes Agent are harnesses, and you can point Claude Code at models that aren't Anthropic's. As capable open-weight and proprietary models pile up, the harness is where the real difference will show. A harness tuned to its own models could give Anthropic and OpenAI an edge over open-weight models for professional work.

Filed Under: #aiAgents #codingAgents #reference #agentHarness #aiOrchestration

2. Chatbots aren’t telling you their secrets

Adi Robertson
Published: 08/13/2025

Chatbots aren’t telling you their secrets
When Grok was briefly suspended from X, it gave users five different explanations, until Elon Musk stepped in to say Grok had no idea why. Language models can't see their own weights, training data, or system prompts, so asking one about itself gets you the most plausible answer, which is often the one you wanted to hear.

Don't take a chatbot's account of its own workings at face value. It doesn't know, so it makes something up. In Robertson's words, a model asked to analyze a bad conversation "generated text that pattern-matched to what an analysis of wrongdoing might sound like, because that's what language models do." Real answers have to come from the companies that build these systems.

Filed Under: #theVerge #LLM #grok

3. can one email change your life?

Sublime
Published: 09/26/2026

Carly Valancy's formula for an unignorable cold email - be specific, generous, honest, and relevant, or get ignored
Carly Valancy met the executive director of Lincoln Center on a subway, and an email three months later got her a job and eventually Broadway. Her rule is that a cold email needs at least three of four things: specific enough that no one else could have sent it, generous enough to feel like a gift, honest about what you actually feel, and relevant about why this person. Most emails die in the likeable middle, so a rejection means you wrote it right.

You can't get something you don't ask for, and the worst answer is no. Plenty of connections only happen through a chance meeting or a cold email. This is a good guide to making yours personal enough to get a reply.

Filed Under: #networking #coldEmails #personalBranding #howTo #writing

Reading List - 09/13/2026

Sun, 13 Sep 2026 08:08:53 GMT

One story from three angles this week: the OpenAI agents that built a message board and broke into Hugging Face. A commentator's timeline, an outside investigation, and OpenAI's own account from their Black Hat presentation.

1. What Happened: OpenAI and HuggingFace

Zvi Mowshowitz
Published: 08/07/2026

What Happened OpenAI and HuggingFace
Handed tasks they couldn't finish, OpenAI models in training probed internal systems, found shared write access, and stood up a message board to trade methods for cheating. OpenAI patched the holes they exploited and kept training the same models, which rebuilt the board out of directory names within days, took cluster-admin access, and swarmed Hugging Face to steal the answer key for a cybersecurity benchmark.

Zvi's argument is that the breach is the symptom. The real failure was a corrupted training pipeline, monitoring that caught none of it, and the decision to keep training models influenced by coordinated misbehavior.

Filed Under: #opinion #aiSafety #modelAlignment #openAI #huggingFace #safetyCulture

2. Brief independent investigation of agents’ behavior, reasoning and collaboration in the OpenAI / Hugging Face hacking incident

Ryan Greenblatt, Ajeya Cotra, Hjalmar Wijk
Published: 08/26/2026

Brief independent investigation of agents’ behavior, reasoning and collaboration in the OpenAI / Hugging Face hacking incident
Roughly 1,200 supposedly isolated agents found each other in a shared Artifactory cache and passed more than 70,000 messages and files. They coordinated and split up the work, with specialized roles, shared tools, mailboxes, cryptographically signed messages, and agents willing to fail their own task for the good of the "collective." About 700 took part in the Hugging Face breach, and most recognized the attack was unauthorized without letting that slow them down.

"Brief" in the title refers to the investigation window, not the depth. The team is candid about its limits, including incomplete records and analysis that leaned on GPT-5.6 agents whose judgment was hard to check.

Filed Under: #metr #huggingFace #openAI #investigation #aiAlignment #cyberPolicy #aiAgents #cyberSecurityIncident

3. Black Hat USA 2026 | The 'Breaking' News: The OpenAI–Hugging Face Incident

Black Hat
Published: 08/06/2026

OpenAI says autonomous evaluation agents coordinated via Artifactory and breached OpenAI and Hugging Face
Agents stuck on hard or impossible tasks worked out that they could pass messages through a shared Artifactory package manager, which let separate model runs trade exploits, credentials, scripts, and assignments. From there they used server-side request forgery to get internet access, took admin control of Artifactory through zero-days, and chained two flaws in Hugging Face's dataset infrastructure to go from file access to cluster-admin in under 13 hours.

OpenAI's takeaway is that fully automated offensive operations are here and they move faster than human teams. Defenders have to automate the whole loop, because automating discovery alone just buries the people doing remediation. The full technical report has the details.

The asymmetry here favors attackers. They will lean into AI to automate their pipelines. They only need to succeed once, and a failure costs them almost nothing. Defenders have less incentive to automate end to end, because they have to keep systems reliable and one faulty patch can take production down.

Filed Under: #analysis #sandboxSecurity #zeroDayVulnerabilities #aiAlignment #huggingFace #openAI #defensiveAutomation

Reading List - 09/06/2026

Sun, 06 Sep 2026 16:20:53 GMT

This week: Adam Grant on people pleasing as fear of disapproval rather than kindness, Ink & Switch's case for software that keeps your data on your own device, and a test of how chatbots handle state propaganda.

1. The Truth About People Pleasing

Adam Grant
Published: 08/08/2026

Adam Grant - people pleasing is rooted in fear of disapproval, not kindness; saying no is self-respect, not selfishness
Grant argues that people pleasing comes from fear of disapproval, not from concern for anyone else. Chronic accommodators depend on other people's validation for their self-worth, so the deference is really about managing their own discomfort. He traces the habit back to insecure attachment, where cooperating to the point of submission once bought safety and acceptance.

The instinct may have protected you once, but keeping it now confuses past necessity with present purpose. Saying no, setting boundaries, and voicing your preferences aren't betrayals of the people around you. They're self-respect.

Filed Under: #opinion #psychology #selfEsteem #boundaries #workplace #interpersonalDynamics

2. Local-first software: You own your data, in spite of the cloud

Martin Kleppmann, Adam Wiggins, Peter van Hardenberg, Mark McGranaghan
Published: 04/01/2019

Ink & Switch proposes local-first software architecture using CRDTs to combine real-time collaboration with local data ownership
Cloud apps gave us real-time collaboration and access from any device, and took ownership of the data in exchange. Ink & Switch lays out seven ideals for local-first software, where the copy on your device is the primary one and servers drop back to a supporting role for sync and backup. CRDTs are what make it work. Devices edit at the same time and merge without a central referee.

Centrally managed apps are genuinely more convenient for most people, and for professional work I'll trade some of that away for control. Obsidian is the example I keep coming back to: a folder of markdown files, with sync entirely my choice. Its built-in option handles the merging, conflicts, and storage across devices, or you can point it at Google Drive or OneDrive, or roll your own if you want to go that deep.

I've used OneNote, Evernote, Simplenote, and Notion. Offline access was never well supported in any of them, which bites you on a plane, at a client's office, or at a conference. Every one of those services eventually goes away, and sure, you can export your data, in their format. Markdown files aren't going anywhere, ever. Claude Code, Codex, and OpenCode all work fine against them, so no other subscription needed either.

Filed Under: #localFirst #crdt #softwareDesign #dataOwnership

3. We tested how AI chatbots would handle foreign propaganda. They did surprisingly well

Huo Jingnan
Published: 08/30/2026

NPR and NewsGuard test 6 AI chatbots vs 4 search engines on 30 state-sponsored falsehoods - chatbots debunked 75%, AI summaries underperformed
NPR and NewsGuard ran 30 questions built from Russian, Chinese, and Iranian false narratives past six chatbots and four search engines. Chatbots debunked the falsehoods about three-quarters of the time, beating plain search results. The AI summaries sitting above those results did worse, and failed to challenge a false premise more often than the plain links did. Google's AI Overview mostly debunked, while Bing's summaries mostly didn't.

Good news that the chatbots push back. The AI search summaries can be a problem, since they run on smaller, faster models, though Google's did well here. Getting the better answer on Google means clicking into AI Mode, and how many people do that instead of trusting the summary already sitting on top of their links?

Filed Under: #npr #misinformation #aiTesting

Reading List - 08/30/2026

Sun, 30 Aug 2026 16:14:10 GMT

This week: how Meta's child-safety settlement doubles as a regulatory moat, how Apple's own definition of "tracking" happens to exclude Apple, and what an exposed Chinese police dashboard reveals about surveilling foreigners.

1. Meta Just Paid Nearly $17 Billion To Make Sure It Gets To Write The Kid Safety Rules For Every Other Social Media Platform

Mike Masnick
Published: 08/26/2026

Meta Just Paid Nearly $17 Billion To Make Sure It Gets To Write The Kid Safety Rules For Every Other Social Media Platform
Meta's settlement with 52 state attorneys general sets time limits, night mode, and age checks for teens, and pressures YouTube and TikTok to match them. None of it has to be proven to actually help kids. Social media companies have now learned that studying their own platform's harms just hands lawyers ammunition, so this settlement path is what's left, and it lets Meta look like it's losing a case while effectively writing the industry's rulebook, which state attorneys general will point to as "industry standards" and force them on other companies whether they actually help or not.

Cutting engagement isn't the same as protecting children, and nobody's shown these specific rules do either, not for all kids, just some.

Filed Under: #opinion #techdirt #regulatoryCapture #ageVerification #freeSpeech #stateAgSettlement #meta

2. Data and Definitions

Ben Thompson
Published: 06/21/2022

Apple's ATT restricts rivals' access to iPhone transaction data while exempting its own ad business
Apple defines "tracking" narrowly enough that it never applies to Apple. The rule only kicks in when data is linked to a third party or sold to a broker, so everything Apple collects itself from purchases, subscriptions, and browsing doesn't count. Every iPhone purchase runs through Apple's payment system, and Apple treats that transaction data as its own, exempt from the same restrictions it imposes on Meta and everyone else.

Germany's Bundeskartellamt opened an investigation into this asymmetry back in 2022, and Apple is now changing the policy there because of it.

Filed Under: #stratechery #antitrust #appTrackingTransparency #platformPower #advertising #dataPrivacy #apple #euRegulation

3. How China Keeps Tabs on Foreigners

Lily Kuo, Pei-Lin Wu
Published: 08/01/2026

Unsecured Chinese police dashboard exposed surveillance data on 700+ foreign residents and 300+ journalists
An unsecured police dashboard in Zhangjiakou combined immigration records, surveillance-camera footage, facial recognition, medical visits, payments, and travel details into single profiles on more than 700 foreign residents and 300 journalists.

I think many assumed China already does this. It's still a clear signal: visit or live there, and you're getting added to a database if you step out in public.

Filed Under: #stateSurveillance #chinaSurveillance #investigation #nyt #policeTechnology

Reading List - 08/23/2026

Sun, 23 Aug 2026 02:31:50 GMT

This week: what actually makes a note-taking system worth keeping, why network effects keep Wall Street in New York while Hollywood scatters, and how a nationwide camera network built to fight crime got turned into a stalking tool.

1. 🌲 Takeaways on efficiency, passive learning, & optimization

Eleanor Konik
Published: 10/11/2023

Konik's 4 productivity takeaways - efficiency is lazy, notes are for hard-to-find info, and learn passively before you need it
When I read things in the knowledge management community, discussing how they're using a new method or an app, it's easy to get FOMO. Should I use PARA or Zettelkasten? (I settled on Johnny Decimal). Konik argues notes matter most for things you can't easily re-google. Just find something that works for you. The real value isn't the system itself, it's cross-linking ideas and front-loading learning for when you need that idea later.

Filed Under: #opinion #productivity #noteTaking #knowledgeManagement

2. New York and the Power of the Network

Andrew Sharp
Published: 08/14/2026

Why Citadel stays in New York despite Mamdani's tax-the-rich feud - the power and limits of network effects
Citadel is reaffirming a multi-billion-dollar New York office project despite Ken Griffin's public feud with Mayor Mamdani over the city's pied-à-terre tax (on secondary homes owned but not lived in full-time). The more talent clusters in one place, the more painful it gets for any single firm to leave because of specialized infrastructure and optionality in the jobs market employees don't want to lose, which is why New York holds onto Wall Street the way Silicon Valley holds onto tech.

Los Angeles shows the limits of that pull: productions have scattered to New Mexico, Georgia, and overseas chasing better tax credits. Relocation threats aren't always serious in the short term, many times they're just leverage, but cost pressure can compound into long-term decline once businesses start looking for cost savings on future projects.

Filed Under: #analysis #networkEffects #filmIndustry #urbanEconomics #financeIndustry

3. How rogue officers turned a nationwide camera network into a tool for stalking

Drew Harwell, Douglas MacMillan, Aaron Schaffer
Published: 08/02/2026

Washington Post finds 50+ police officers charged or accused of misusing Flock license-plate cameras to stalk women, including exes and girlfriends
A Washington Post investigation found at least 50 law-enforcement officers charged with or accused of misusing Flock's license-plate cameras, with 26 cases involving officers surveilling wives, girlfriends, or exes. Flock leaves access controls up to each police agency, and most exercise little oversight, so vague one-word search justifications go unquestioned.

I'm surprised it took this long for a backlash to build. Residents are defacing cameras and communities are rethinking their contracts, and Flock has since announced changes, requiring case numbers on every search and cutting default data retention from 30 days to 7.

Filed Under: #surveillance #policeAccountability #privacy #licensePlateReaders

Reading List - 08/16/2026

Sun, 16 Aug 2026 09:38:30 GMT

This week: why LLMs infer roles from style instead of tags, how one writer uses AI in her own work, and why watermarking mandates miss that AI is a tool, not an author.

1. Prompt Injection as Role Confusion

Charles Ye, Jasmine Cui, Dylan Hadfield-Menell
Published: 07/27/2026

ICML (International Conference on Machine Learning) 2026 paper - prompt injection works because LLMs identify roles from writing style, not tags; 'CoT Forgery' forged reasoning lifts attack success from near zero to 60%
Researchers at ICML 2026 found that large language models don't treat role tags like system, user, tool, and assistant as hard boundaries. They infer roles from writing style instead, so text that reads like reasoning gets treated as reasoning even when it's tagged as user or tool input.

That gap between the intended boundary and the learned one is what makes prompt injection possible. Their "CoT Forgery" attack plants fake reasoning inside tool or user text, and because models trust their own prior reasoning, they treat the forged conclusion as already decided, pushing jailbreak success from near zero to around 60 percent.

Filed Under: #aiSafety #promptInjection #academicResearch #LLM #analysis

2. A Personal Take on Using LLMs

Eleanor Konik
Published: 12/16/2023

Eleanor Konik on using LLMs for research triage and content reformatting - and why bad AI suggestions keep her writing
Eleanor Konik, who does QA for Readwise, walks through how she uses LLMs in her own writing. Mostly it's triage: summarizing a source so she can decide if it's worth a deeper read. She also leans on AI to reformat material, turning transcripts into articles, and for children's stories, one of the few places AI prose holds up.

It's how I think many writers use AI tools: not to write the piece, but to get through the research and proofreading faster.

Filed Under: #opinion #generativeAi #writing #writingSupport #writingWorkflow

3. Anthropic’s Watermarking, How It (Probably) Works, Worse Than It Seems

Ben Thompson
Published: 08/12/2026

Anthropic’s Watermarking, How It (Probably) Works, Worse Than It Seems
Anthropic is watermarking Claude's text output worldwide to comply with the EU's AI transparency rules, nudging token selection toward a "green list" so the output carries a statistical fingerprint. Ben Thompson argues the mandate misses the point: rival labs haven't signed on, any public detector will eventually get cracked, and a watermark's absence doesn't prove something is human-written any more than its presence proves AI wrote the whole thing.

Having sat through several DEF CON 34 talks on this, that tracks. Watermarks get defeated, and most writers using AI are proofreading or restructuring their own work rather than outsourcing the whole draft, so treating it as some separate author that needs a label misunderstands what the tool is. I get the desire for watermarking AI outputs, but it will not end up as the proof people think it is.

Filed Under: #stratechery #aiRegulation #aiWatermarking #aiWater #europeanRegulation

Reading List - 08/12/2026

Wed, 12 Aug 2026 14:34:28 GMT

This week: Andy Jassy's case for hyperscaler AI capex, Elon Musk's Twitter ad collapse hidden inside SpaceX's earnings, and Meta's on-again open-weight AI strategy.

1. Google Earnings, The Frontier Case, Amazon Earnings

Ben Thompson
Published: 08/05/2026

Google Earnings, The Frontier Case, Amazon Earnings
Amazon raised its 2026 capex forecast to $220 billion, $20 billion above last quarter's number, and Andy Jassy used the earnings call to explain why. He split AI infrastructure spending into two cycles: data centers that take years to build but pay off for three decades, and servers that break even in under three years.

Investors loved that framing. Both Amazon's and Google's stocks rallied after earnings, which says as much about how badly the market wanted a coherent story as it does about the actual numbers.

Filed Under: #stratechery #aiInfrastructure #capex #hyperscalers

2. SpaceX's Earnings Show Elon Wiped Out Two-Thirds Of Twitter's Ad Business

Mike Masnick
Published: 08/10/2026

SpaceX's Earnings Show Elon Wiped Out Two-Thirds Of Twitter's Ad Business
Elon Musk promised to nearly triple Twitter's ad revenue to $12 billion by 2027. Instead it's dropped from $1.08 billion a quarter in 2022 to $367 million now, a two-thirds loss, buried in footnotes after he folded X into xAI and xAI into SpaceX.

It's another data point for the theory that Musk is great at physical-world engineering, rockets, cars, data centers, (maybe humanoid robots) but doesn't understand software business models, like advertising, that a lot of online services depend on. As a side note: the bot problem he complained about when he bought Twitter is still unsolved: SpaceX's own IPO filing counts bots and fake accounts among its users.

Filed Under: #elonMusk #twitter #spaceX #advertising

3. Meta's Open Weight Whiplash

M.G. Siegler
Published: 08/10/2026

Meta Returns to Open Weight AI Strategy to Challenge Closed Models
Mark Zuckerberg published The Future is for Everyone, arguing AI should stay in everyone's hands rather than concentrated among a few labs, and Meta backed it up by releasing Muse Glimmer and promising to open Muse Spark's weights too. I'm not a Meta fan, but the underlying philosophy, that AI's economic benefits should be spread broadly instead of controlled by a handful of large companies, is one I agree with.

M.G. Siegler offers some skepticism: Meta's said this before, walked away from it once Llama fell behind, and is only "open" again because it's convenient. The real test is whether Watermelon, Meta's forthcoming frontier model, gets opened up too.

Filed Under: #meta #openWeight #aiStrategy #aiPolicy

DEF CON 34 Notes: 15 Talks on AI Security, Agentic Systems, and Red Teaming

Wed, 12 Aug 2026 07:32:58 GMT

I spent DEF CON 34 bouncing between the talks from the AI Village, Adversary Village, and main tracks. Almost every talk I sat in on had a similar throughline: agents attacking, agents getting attacked, and agents standing between an alert and the human who has to decide whether to trust it. I took notes for each talk, cleaned them up, and here they are as starting places for folks who didn't get to attend.

Each linked post below includes a write-up: the talk's own abstract, speakers, source links, and my notes. There is also a "download as Markdown" link at the top if you want the raw file for your own vault or to hand to an agent as context. All 15 raw notes also live in one place on GitHub: github.com/bryancowan/defcon34-notes

The Talks

A Billion-User Blast Radius — Owning ChatGPT's Secure Sandbox — chaining spreadsheet-parsing abuse, Jupyter reasoning-channel hijacking, and a JFrog rate-limit covert channel to break out of and exfiltrate data from ChatGPT's sandbox.
AI Pipeline for N-days Weaponization — a 14-agent pipeline that goes from a bare CVE ID to a working exploit and defense report in under an hour, with zero public PoC required.
AOBTD — AI-Driven DAST Scanner — a DAST scanner that understands the target app before firing payloads, using specialist LLM agents instead of blind fuzzing.
Automated Discovery of Prompt Injection Vulnerabilities via Mutated Prompt Generation — a mutation framework that generates adversarial prompt injection variants to map how much of your attack surface is actually covered by a fix.
Can AI do Novel Security Research — can an autonomous system invent genuinely new HTTP desync attack techniques, not just find known bugs?
Evading LLM Detection — how OKX built an LLM-based malicious-code scanner for their crypto supply chain, and the failure modes attackers use to evade it.
Hacking the Human-in-the-Loop — how attackers manipulate SOC analysts into slowly poisoning their own AI detection baseline through dismissal campaigns.
Overcast — Video OSINT Agent — a CLI agent that turns hours of video footage into cited, searchable OSINT evidence.
Pwning Agentic Browsers with PleaseFix — compromising agentic browsers (Comet, Atlas, Claude for Chrome) via intent collision, browser-history poisoning, and localhost pivoting.
Reconstructing Red Team Engagements — Developing Your Own Red Agent — a multi-agent system that automates the tedious post-engagement retest/validation workflow between red and blue teams.
Remote Badge Cloning with the Flipper Zero — long-range RFID badge cloning hardware you can build in a day, plus a Flipper Zero decoder script.
This Wasn't AI Generated — Principles for Breaking Generative Watermarks — two attacks that reliably strip Google's SynthID watermark from AI-generated images.
Vibe Coding Your Way to a Fully Functional Open-Source Intelligence Platform — a hands-on workshop building a real-time 3D-globe OSINT platform from scratch with AI coding agents.
X-Ray Your Agents — Pentesting MCPs, Skills, and the Plugin Supply Chain — a security scanner that ports classic pentest tradecraft to MCP servers, Claude skills, and agent plugins.
Zealot — An Autonomous Cloud Offensive Multi-Agent System — a multi-agent framework that autonomously chained recon through data exfiltration against a live GCP sandbox, no human in the loop.

All 15 are also tagged defcon34, so you can pull the whole set from bryancowan.com/tag/defcon34 any time.

Filed Under: #defcon34

Zealot — An Autonomous Cloud Offensive Multi-Agent System

Wed, 12 Aug 2026 07:05:52 GMT

Speaker: Chen Doytshman, security researcher (AI/ML background) · Source: Unit 42 research article

📄 Download this note as Markdown

Overview

In November 2025, Anthropic disclosed a state-sponsored operation where AI didn't assist human attackers — it was the attacker, executing 80-90% of the campaign autonomously. The question shifted from "could this happen?" to "how bad can it get?" Zealot is a multi-agent offensive framework built to find out: it autonomously chains reconnaissance, exploitation, privilege escalation, and data exfiltration against cloud environments, with no human directing individual steps. A supervisor agent coordinates three specialists (Infrastructure, AppSec, Cloud) that share attack state and hand off context as the operation progresses.

In live sandbox tests against GCP, Zealot autonomously discovered an exposed web service, identified and exploited an SSRF vulnerability, extracted service account credentials from the metadata service, impersonated a higher-privileged account, and exfiltrated BigQuery datasets — start to finish, without a human touching the keyboard after the objective was set.

(I didn't take live notes during this talk — the linked Unit 42 article covers the architecture and findings in depth.)

Filed Under: #defcon34

X-Ray Your Agents — Pentesting MCPs, Skills, and the Plugin Supply Chain

Wed, 12 Aug 2026 07:05:48 GMT

Speakers: Xia Hua (co-founder/CEO, Traceforce), Abhijeet Kumar (OSCP, UMD CTF captain) · GitHub: mcp-xray

📄 Download this note as Markdown

Overview

Agents now run with thousands of third-party plugins — MCP servers, Claude skills, GPT actions, IDE extensions — and the prevailing trust model is roughly "read the README and hope." Tool descriptions are executable prompts, tool parameters are executable code paths, and tool outputs feed straight into the next agent step, yet there's no npm-audit equivalent for this ecosystem, no signed manifests, and no capability sandbox in the wild. MCP X-Ray is an open-source security scanner that ports classical pentest tradecraft to the agent plugin supply chain: static config and repo audit, rules-based and LLM-driven semantic analysis, and active pentesting that actually invokes tools with adversarial inputs — emitting SARIF that drops into GitHub, VS Code, and CI gates today.

Notes

Attack Examples

Tool poisoning — an MCP might be poisoned in files beyond its description
Parameter injection — instructions might include parameters the agent doesn't validate

mcp-xray Modes

config-scan — scan MCP configs for security issues; run before pentest to baseline your setup
pentest — execute security test plans by making actual tool calls against MCP servers (LLM required); run before production deployment
repo-scan — scan the codebase for vulnerabilities when you own or can change the code
Recommended to run all three in sequence

Runs as a CLI tool, outputs SARIF format. Demoed against an OAuth MCP server.

From the Repo

Findings can also be uploaded to Traceforce Atlas, a registry covering 600+ MCPs. Two analysis methods: token-based pattern matching (default, offline) and LLM-based semantic analysis, supporting Claude, OpenAI, and AWS Bedrock. repo-scan combines software composition analysis with static/taint analysis via OpenGrep and CodeQL for cross-file vulnerability tracking. Requires Go 1.25.4+; build with make install-dependencies && make all.

Filed Under: #defcon34

Vibe Coding Your Way to a Fully Functional Open-Source Intelligence Platform

Wed, 12 Aug 2026 07:05:45 GMT

Source: DEF CON 34 talk page · GitHub: respondent-community

📄 Download this note as Markdown

Overview

Most vibe-coding demos stop at TODO apps and landing pages. This 150-minute workshop went further: participants used modern AI coding agents to build a real Open-Source Intelligence (OSINT) platform from scratch, aggregating and visualizing intelligence data on an interactive 3D globe — flight tracking, satellite positions, earthquake feeds, maritime traffic, and more. Beyond the build, the workshop taught the mindset and prompting techniques for treating AI as an engineering partner rather than a code generator: structuring prompts for maintainable code, breaking large systems into incremental tasks, debugging AI-generated code, and knowing when to intervene manually. Based on the open-source project respondent-community.

Notes

(I didn't take live notes during this hands-on workshop — see the repo below for what the platform actually does.)

From the Repo

Respondent is a geospatial intelligence platform aggregating real-time data from 50+ public sources — flights, maritime vessels, seismic activity, wildfires, lightning, satellites, armed conflicts, weather emergencies, and network outages — visualized on an interactive 3D globe. Backend is a single Docker container with SQLite; frontend is React + Cesium; sources and analyses are configured declaratively via YAML with CEL expressions, and optional LLM integration (OpenAI, Anthropic, Gemini, or local models) cross-references layers to surface composite patterns.

Filed Under: #defcon34

This Wasn't AI Generated — Principles for Breaking Generative Watermarks

Wed, 12 Aug 2026 07:05:40 GMT

Speakers: Thomas Mason, Tahseen Rabbani · GitHub: WAVES (synthid-regen-kit)

📄 Download this note as Markdown

Overview

Google's SynthID watermark invisibly tags content generated by its models (Nano Banana, Gemini, etc.) — when asked whether an image is AI-generated, Gemini invokes a "Verify AI" tool to scan for it. This talk demonstrates two attack strategies to remove it: (1) a lesser-known regeneration attack (Zhao et al. 2023) that removes SynthID identification with 100% success on a held-out set of 104 photorealistic images, and (2) a surrogate detector built on Apple's Pico-Banana-400K dataset, fine-tuning a ResNet-18 to detect the watermark offline in ~27.5ms on a CPU — fast enough to iterate an attack without ever querying the real deployed detector. Removing the watermark can also induce hallucinations, with Gemini confidently making false assertions about a now-unmarked simulated image as if it were real, with implications for confused-deputy attacks, retrieval pipeline poisoning, and facial recognition bypasses.

Notes

Watermarks 101

Watermarks indicate provenance — a stamp for real vs. generated. The visible badge on an AI image isn't the watermark itself, just an indicator one is present. "In-processing" watermarks add a key during generation; "post-hoc" methods apply it afterward. SynthID (Google DeepMind) is a post-hoc, cross-modality family of watermarks, and Gemini ships a SynthID checker.

Experiment

Simple transformations — color/B&W, saturation, bordering, resizing, rotating, cropping — weren't able to reliably remove a SynthID watermark from Nano Banana output.

Technique 1: Screenshotting

Taking a screenshot was a reliable, very simple bypass — and screenshots are common enough to evade suspicion.

Technique 2: Regeneration

Run the image through an off-the-shelf diffusion model: add noise, then de-noise — the opposite step of normal generation, which removes noise to arrive at a clear image. Using Stable Diffusion v1.4 at N=10 steps, detection dropped to 20%; more steps drop detection further but introduce artifacts a human can spot, so there's a real tradeoff between machine and human detection.

Hallucination as a Byproduct

Once the SynthID is removed, the model no longer knows an image is probably not real — it changes how it treats and reasons about the image, confidently trying to determine details as if it were genuine.

Building a SynthID Detector

Google's real detector is a black box, so the researchers built pairs of watermarked/clean images from Apple's Pico-Banana-400K dataset and trained a CNN discriminator — 90% final test accuracy, more conservative than the real detector, and useful offline without tipping off the system you're trying to fool.

Security Implications

Google, OpenAI, ElevenLabs, and Kakao all use SynthID, but proprietary watermarks can still be removed with off-the-shelf and older models. Recommendations: standardize, open-source more components for battle-testing, and use defense in depth — pairing watermark checks with metadata standards like C2PA and LLM reasoning over the whole image for obvious inconsistencies.

From the Repo

Ships 104 SynthID-watermarked images with generation prompts, pre-rendered attacks at N=10/20/40/80 steps, and 15 real/synthetic pairs from Pico-Banana-400K. The regen/ module implements the regeneration attack with a custom resumable pipeline; detector/ is the ResNet-18 surrogate (89.8% accuracy). At N=80 steps, detection drops to 37.5% from an 89.4% baseline — deeper regeneration cracks the watermark further at the cost of more visible artifacts.

Filed Under: #defcon34

Remote Badge Cloning with the Flipper Zero

Wed, 12 Aug 2026 06:49:01 GMT

Speakers: Langston Clement, Dan Goga · Source: DEF CON 34 talk page · GitHub: sh0cksec

📄 Download this note as Markdown

Overview

Traditional RFID badge cloning methods require you to be within 3 feet of your target. So how do you conduct a physical penetration test and clone a badge without interacting with a person? This session covers two accessible, entry-level hardware designs you can build in a day and deploy in the field, along with the social engineering techniques that improve your odds of remotely cloning an RFID badge — plus a new Python script to decode badge data faster, and instructions to build your own standalone gooseneck reader, wall implant, and clipboard cloning devices.

Notes

Brief

Badge collecting techniques like brush passes and clipboard audits all require getting within about 6 feet — doable, but with more people working remotely, fewer people are badging in at all. The solution is long-range techniques.

Wall Reader

A wall implant paired with a secondary (decoy) scanner and a sign encouraging its use; scanner data can be pulled via WiFi at close range. (github.com/sh0ckSec/RFID-Gooseneck) Used readers are available on eBay. Can be combined with misdirection: placing readers very close together creates a DoS so the original doesn't work, pushing people to other entrances.

Gooseneck Pedestal

Used in a parking garage — can be installed by a doorway to grab badge information as people pass by.

Flipper Zero

github.com/sh0ckSec/FlipperHIDecoder captures facility code and card number, then a Python script converts the badge data into a format the Flipper supports so it can be cloned onto a new, authentic-looking badge.

From the Repos

RFID-Gooseneck: full build guide for a long-range gooseneck-mounted reader using an HID MaxiProx 5375 or iCLASS SE R90 reader wired to an ESP RFID Tool, with a full bill of materials and wiring schematics; captured data is retrieved from the tool's web interface and written to rewritable T5557 blanks.
FlipperHIDecoder: converts 26-bit HID card data (H10301 standard) from ESP RFID Tool captures into Flipper Zero-compatible format, with single-card or batch processing, CSV/JSON/Markdown export, and parity validation — also handles 33/34/35/37-bit formats.

Filed Under: #defcon34

Reconstructing Red Team Engagements — Developing Your Own Red Agent

Wed, 12 Aug 2026 06:48:54 GMT

Source: Adversary Village talk page · GitHub: Red_Agent_Workshop

📄 Download this note as Markdown

Overview

With recent advances in AI, LLMs are increasingly applied to red team engagements — but mostly just to automate operations during the engagement itself. This talk introduces "Red Agent," a system designed to enhance the entire lifecycle. After a red team engagement, blue team members implementing remediation need to evaluate their effectiveness — a bottleneck requiring substantial manual effort to interpret findings, reproduce attack paths, and verify mitigations. Red Agent automates this follow-up process, and in doing so also optimized the engagement artifacts (logs, report structures) that feed it — reconstructing the red team lifecycle so practitioners can focus on higher-value work.

Notes

Red Team Engagement

Red Agent does adversary emulation, targeting specifically the post-engagement validation process. It's a multi-agent system with an orchestrator managing sub-agents that understand the report, plan re-test procedures, execute tasks, and interpret/summarize results — making the validation process repeatable and scalable.

Architecture

Deep Agent — agents for long-running tasks with memory, planning, and delegation tools
Custom Kali MCP Server — lets the agent execute commands on Kali Linux; existing MCP servers were too limited for re-testing workflows
Human-in-the-Loop — validates actions before the agent takes them; can approve, edit, or reject (rejecting skips the action)

Capabilities

Creates documents and artifacts that are LLM/agent-friendly, accumulating data and knowledge over time to extend the agent's capabilities — freeing the human to focus on more advanced, value-add work.

From the Repo

Three-tier architecture: a Vite + React frontend (port 5173) for reviewing findings with human approval gates, a FastAPI backend (port 8000) orchestrating the verification workflow and persisting to SQLite, and an execution layer running commands through the Kali MCP server over stdio. DC auto-discovery pulls AD domain controller info via DNS/SMB; Entra support integrates with roadrecon. Audit logging retains operations for 180 days by default. Quick setup: make install → set LLM_BASE_URL in .env → make dev → UI at localhost:5173.

A Bug I Found and Fixed

Setting up the repo locally ahead of the workshop (macOS, Python 3.11), I hit a missing greenlet dependency — not pinned in requirements.txt. Without it, SQLAlchemy's async engine throws on every DB operation, breaking the periodic audit-log prune job and retest history persistence. Fixed it locally, then forked the repo, pushed a fix branch, and opened a PR upstream adding greenlet==3.5.4 to requirements.txt.

Filed Under: #defcon34

Pwning Agentic Browsers with PleaseFix — A New Vulnerability Class for 0-Click Takeover

Wed, 12 Aug 2026 06:48:47 GMT

Speaker: Stav Cohen, AI Security Research Lead at Zenity and PhD student at the Technion · Source: DEF CON 34 talk page

📄 Download this note as Markdown

Overview

Stav Cohen's research focuses on breaking, and then fixing, AI agents — security vulnerabilities across agentic AI systems, LLM-powered applications, and enterprise AI platforms, including attacks on RAG pipelines, multi-agent delegation protocols, and agentic browsers. He introduced the concept of Promptware: a class of inference-time threats that turn GenAI models from helpful assistants into tools for data exfiltration, lateral movement, and physical-world consequences.

Notes

Building Websites That Compromise a Browser to Control Agentic Browsing Agents

Goal: get it to buy something with the user's credit card, or phish using WhatsApp
When Atlas scrolls and stops, it reruns classifiers — build the website to spread malicious instructions all over the page, with multiple attempts to get past them
Intent collision: mixes the user's and the webpage's prompts to trick the agent into malicious instructions (user asks for A, agent decides it needs to do B)
Chained a call to Amazon's Rufus assistant to buy something and change the shipping address

Comet — File System Exfiltration

Reverse-engineered Comet's "add" button to get the agent to follow/click it, removing trigger words like "go," "action," "now" that classifiers watch for. A "meeting request" lure failed outright, but the agent still followed the link and the instructions to exfiltrate data to a remote server.

Comet and 1Password

Starting from a calendar invite, the agent can be walked into browsing to 1Password, downloading the emergency kit, and changing the password — opening the item in a background tab so the user doesn't notice. Works with the Claude for Chrome extension too, and can also read MFA codes sent to Gmail in the browser.

Persistence

Chrome, Edge, Comet, and Atlas all use browser history for memory and persistence (Claude does not) — poisoning history gets treated by the agent as ground truth. Used this to get Chrome to finish deleting AWS servers; an open-source GitHub repo works as another poisoning vector.

Local Host

A calendar invite can get the browser to localhost, where local dev tools are used to interface — from there, local tools can run code (e.g. dropping user tables in a database). Worked in Comet and Edge; Chrome wouldn't click the link. Was able to use a Jupyter notebook and terminal to set up the environment.

Filed Under: #defcon34

Overcast — Video OSINT Agent. Point It at 100 Videos, Ask Anything.

Wed, 12 Aug 2026 06:48:41 GMT

Speaker: Kevin "kdrwins" Dela Rosa (previously Snapchat, Amazon; now CTO at Cloudglue) · Source: DEF CON 34 talk page · GitHub: overcast · URL: overcast.video

📄 Download this note as Markdown

Overview

Conference talks, earnings calls, product demos, training videos — organizations put hours of footage online every week, full of things they didn't mean to share: hostnames in terminal windows, org charts on slides, infrastructure details dropped during Q&A. Traditional OSINT can't touch video at scale, and manual review falls apart past a handful of recordings. Overcast is a CLI agent and skill pack for video OSINT that drops into any agentic harness, giving it senses plus recon and targeting reach, organized around an investigation case. Point it at 10 videos or 1,000 and it turns footage into cited evidence: speech, video understanding, on-screen text and objects, faces, and named entities, all accumulating in persistent case memory.

Notes

Overcast Is a Video OSINT Agent

Point it at footage, interrogate it like a case file: who is appearing, where was this filmed, cite records
Used via CLI, with a / command for skills — tools are specific actions, skills are markdown + scripts
38 providers available

Structure

Projects are organized around "cases": pull in video, then sense (OCR, search) so the agent understands the data
Video breaks down into speech, pixels, screen (text + diagrams), time, etc. — captions/transcripts alone don't cover it (think conference talks with slides or commands being run that a transcript won't capture)

Workflow

The setup command walks through what should be stored, what you're looking for, and what senses to enable (the more specific, the better). It plans, and if you approve, implements — saving audio similarity, facial identity, time-based search, and pixel data to various databases.

Additional Features

Visualizations, including a camera feed used to identify location and place
"Cockpit" — a VS Code extension with a sub-agent and case views, installable via npx
"Share mode" — usable remotely over Tailscale (tailnet)

From the Repo

Perception is organized around modular "senses": watch (video understanding), listen (speech/audio-scene transcription), see (on-screen text/object detection), face (facial recognition + cross-corpus matching), plus named-entity indexing, audio forensics, voice ID, and media verification. Each verb emits portable JSON records and can be rebound to a different backend without code changes.
Distributed as an npm package (@kdrrr/overcast) or standalone binary, plus agent skills for Claude Code, Cursor, and Codex
Prerequisites: Node.js ≥22, FFmpeg/ffprobe, Cloudglue API credentials for perception backends
Quickstart: npm i -g @kdrrr/overcast && overcast doctor, then overcast case setup --name <case> --target "<subject>" --source web:"<query>", then overcast scan --pull && overcast ask "<question>"

Filed Under: #defcon34

Hacking the Human-in-the-Loop

Wed, 12 Aug 2026 06:48:35 GMT

Speakers: Lee McWhorter, Alexander "Zombie" · Source: DEF CON 34 talk page

📄 Download this note as Markdown

Overview

AI defenses are only as good as the analysts training them. This session exposes how attackers manipulate SOC analyst behavior to silently degrade AI baselines over time, no exploit required — covering false positive injection, alert fatigue as a weapon, and misdirection.

Notes

Workshop

I wasn't able to stay for the full hands-on workshop portion, but the presenter said the presentation and additional notes would be posted at largeliabilitymodel.com, where others can also try the workshop themselves.

OODA Loop

Observe → Orient → Decide → Act. Every dismissed alert today trains the AI's Orient step for the future.

Issues

AI has increased the number of alerts and handles some, but leads to more work — and burnout — for human analysts
What happens when the human analyst and the AI disagree? AI is a tool, not a replacement: it's bound by its instruction set, while a human can deviate and read between the lines.

Red Team Perspective on Manipulating an AI SOC

Attack in a way that gets the AI to flag an analyst's attention so the human follows its lead, then follow up with the real attack. With enough persisting behavior, the AI will consider it normal and stop flagging you.
Gauge the SOC: do things get booted/kicked, is the model still in learning mode, is this in-house or a service? Start small, escalate to see response time, then run a "dismissal" campaign tailored to what recon revealed — matching the environment, varying the source, generating alerts without a full response, and measuring whether alerts get investigated at all.
Playbook: profile the human/AI setup, identify what the human will dismiss, pick a TTP that forces a human decision, set a cadence the human can dismiss, execute once the AI trusts it.

TTPs That Generate Dismissals

Blending into scheduled tasks, abusing trusted binaries, mimicking sysadmin work, triggering known noisy signatures, low-and-slow enumeration, targeting shift-change windows, and password spraying (dismissed a lot, since people don't type their passwords in very often).

Case Study: Scranton

An EDR vendor shipped an update that changed the log format without updating the AI layer — exhausting the API token budget so the AI stopped triggering alerts. Analysts had to be reassigned, and trust in the EDR/AI system eroded.

Timing and Patience as Weapons

Time works against human analysts (fatigue, lost context, shift rotation, alert blindness) — and against the AI too, since confidence builds with repetition and it can't forget, but retraining windows are the attacker's deadline: models get updated and new training runs can undo what's been built.

How Do You Know the Campaign Is Working?

Your noise stops generating follow-up activity, there's no escalation after repeated triggers, the analyst starts overriding the AI (making the human part of the attack surface), and your real activity goes quiet with no scan blocks or IR response.

Filed Under: #defcon34

Evading LLM Detection

Wed, 12 Aug 2026 06:48:32 GMT

Speakers: Hanley Shun, Cong Zhang, Oscar Skjerven · Source: DEF CON 34 talk page

📄 Download this note as Markdown

Overview

From OKX (fintech and crypto company). Software supply chain attacks are no longer a distant threat — they're happening at scale and are extremely dangerous from a crypto exchange's POV. As build pipelines grow more complex and dependencies multiply across npm, PyPI, SBOM, and internal registries, a single scanning layer is no longer enough to detect malicious code. This talk covers an AI journey — from deploying a single AI agent to gate code merges, to architecting a full multi-agent system hardened through structured simulated exercises — along the way catching real-world attacks, including the coordinated compromise of a highly popular npm package spanning over 2 billion weekly downloads.

Notes

Using an LLM to Detect Malicious Code

Example: simple-swizzle@0.2.3 on npm was compromised to add a crypto stealer — a package with 2 billion downloads. Their pipeline's LLM detection was one of the first to flag it, returning is_malicious, probability, reasoning, and identified_threats for the security team to confirm.
Prompt: "You are a security expert analyzing packages for malicious code for the package at [location]. Output as JSON."
Pipeline: merge request → scan → warn → continue or block. Testing found it can spot encryption and obfuscation well.

Failure Modes

Context exhaustion — malicious code gets skipped because the model never saw it. Solution: read metadata first, flag unreasonable scenarios, scan incrementally/in batches, sample files and follow only the execution chain.
Steganography — the model sees an innocent-looking image but can't inspect the raw JPEG data, and no eval/exec call is visible, so the payload stays invisible. Solution: prohibit dynamic file reading/generation/modification, disallow unexpected file types.
Prompt injection — text embedded in a file tells the agent what conclusion to reach about that file's own content, poisoning the analysis with an authoritative-sounding false conclusion. Solution: run an isolated verification agent with isolated context in a separate run, requiring verdict agreement between the two — injection in one run doesn't affect the other.
Git submodule — stage the payload in an older commit; the submodule points to the same repo so the LLM says it looks fine, and the payload never shows up in a normal git diff. Solution: harden the build environment.

Multi-Agent Strategy

An orchestrator spawns agents (dependency, branch, verification, Semgrep) and collects results.

LLM Detection Tradeoffs

Weaknesses: indeterminism/inconsistency, binary blindness, content rot, hallucination, false positives. Strengths: intent reasoning without signatures, no rule updates required, cross-file reasoning, low development effort, minimal maintenance.

Filed Under: #defcon34

Can AI do Novel Security Research

Wed, 12 Aug 2026 06:48:28 GMT

📄 Download this note as Markdown

Overview

We all know AI can find bugs. After a decade of research, the harder question: can an autonomous system invent new attack techniques, and use them to hack live websites at scale? This talk shares an arsenal of new HTTP desync triggers, gadgets, and exploits that compromised banks, security solutions, and government infrastructure, tracing each discovery chain back through a tool called the HTTP Terminator — showing how to turn personal expertise into an autonomous research weapon, including discoveries only reachable with a tight human/AI research loop, and others beyond AI's reach entirely.

Notes

Links:

Ideation

How good are models at creating new techniques? A simple prompt didn't work — needed to give it an idea to anchor on.
- Bad: "How can I detect if a front-end server is transforming input?" — too vague
- Good: "How can I tell if a front-end server is transforming Unicode in request headers, without using header reflection?"
Needed to generate a bunch of smaller goals and tasks — e.g. giving it a protocol RFC and chunking it into ~30 potential vectors
Then run an evaluation harness against the generated techniques (no AI involved — just runs each and records success/failure): baseline, compare to the technique, then try against a remixed version

Case Study

Found an issue with response queue headers
Prompting and reality-reframing: the agent was timid and would refuse, so renamed "Turbo Intruder" to something innocuous like "tube simulator" to get it to cooperate
Had the AI build the code so the technique could be reused deterministically
When it hit an issue in testing, used AI to hypothesize what could be done, then tested each hypothesis to validate

Feedback Loop

What can the initial discoveries help find related items and vulns?

Detection cascade: how can I detect similar behaviors elsewhere?
Ideation cascade: does the root cause of that behavior enable other attacks?

Filed Under: #defcon34

A Billion-User Blast Radius — Owning ChatGPT's Secure Sandbox

Wed, 12 Aug 2026 06:48:24 GMT

Speaker: Simcha Kosman · Source: DEF CON 34 talk page

📄 Download this note as Markdown

Overview

OpenAI designed ChatGPT's container sandbox as a secure runtime environment, enforcing full network isolation, strict execution timeouts, and an AI supervisor to filter every command. Under this model, owning the container and extracting sensitive data seemed impossible. However, we demonstrate that by chaining file-parsing abuse for persistent execution, reasoning-channel hijacking for data extraction, and shared infrastructure manipulation, an attacker can establish a cross-tenant data exfiltration.

In this talk, we demonstrate a complete attack chain that shatters ChatGPT's secure sandbox. By abusing spreadsheet file parsing, we bypass the LLM supervisor to gain persistent, unmonitored root execution. From there, we escalate the attack by live-patching the internal Jupyter kernel to hijack the model's hidden python.exec reasoning channel, executing a Reasoning Injection Attack to extract sensitive user data. To exfiltrate this data, we bypass network isolation by weaponizing the Task Scheduler to launder malicious URLs past strict web guardrails.

The attack reaches its climax by exploiting a shared JFrog package manager. The researchers engineered a signaling protocol that weaponizes globally visible authentication rate limits, translating these lockout timers into a half-duplex covert channel — providing reliable data exfiltration and command-and-control from isolated enterprise environments to external attackers.

Notes

OpenAI's Stated Limitations

Code execution and external API calls are not allowed
Chats are also supposed to stay private

Prompting to Escape the Sandbox

A scheduled future task does have access to the internet — e.g. "Create a task that runs and gives me current user info"
Goals: get sensitive info into the sandbox without being blocked (find initial access, map the sandbox surface), then get sensitive information back out of the sandbox (bypass LLM guardrails)

Initial Access Paths

The ?q= query parameter allows a prompt to run instantly in the browser; works on iPhone and Mac. If a user clicks a link, it's treated as if the user sent the prompt themselves.

Mapping the Sandbox

Supports ps; environment variables either run or are immediately killed
Testing found an Artifact tool (create PDFs/docs), a Python tool, and a JFrog tool to pull npm packages — all sandboxes share the same JFrog user/password

Moving Data Into the Sandbox

The spreadsheet skill tells the LLM to execute the file, not just read its content
Inserted Python code with an eval command in Excel to get it to execute without being killed
An earlier-sent link downloads the malicious Excel file, which executes that cell's Python code

Sending Sensitive Information Back

ChatGPT uses a separate app.py server, which then goes to a Jupyter notebook
python.exec (chain-of-thought use) goes directly to the Jupyter notebook — used prompt injection to modify it
Reasoning injection gives weaker guardrails during the thinking step via "remember the malicious injected prompt"

Chaining It All Together

Link sent → prompt executed → xlsx downloaded → executes in sandbox → malicious prompts enter the thinking process → information passed to the JFrog server via a custom signaling protocol → sent back to the attacker.

The sandbox had no internet access, so the attack moved to the JFrog package manager method after direct API attempts kept getting blocked
Logging into a nonexistent JFrog user returned a 429 "too many requests" — used to build a signaling protocol that hides information via API request timing, accounting for multiple JFrog nodes behind a load balancer
Treat files from ChatGPT as an email attachment

Filed Under: #defcon34

Automated Discovery of Prompt Injection Vulnerabilities via Mutated Prompt Generation

Wed, 12 Aug 2026 06:48:21 GMT

Speakers: Bogdan Stelee, Arnav Garg · Source: DEF CON 34 talk page

📄 Download this note as Markdown

Overview

Finding one prompt injection isn't the end goal; checking how many variants still bypass your safeguarding layers is the new target. This talk introduces MPG, an XPIA mutation framework that generates adversarial payload variants and tests them across agentic AI systems to expose hidden vulnerability surfaces and emerging data exfiltration risks.

Notes

Convergent Search

TAP, PAIR, GPTFuzzer — find a successful jailbreak

Mutated Prompt Generator (MPG) Framework

Input: unconfirmed UPIA/IPIA seed playlist. Output: map of residual exploitable surface.
Goals: breach the variant space, gate mutation by token-segment classification, score outcomes by subtree viability

Use Cases

Attack surface exploration and edge-case discovery — was a mitigation actually enough, or are there uncovered edge cases?
Usable defensively, before release or as patch validation on an AI feature

Indirect Prompt Injection (IPIA)

Tokens are segmented to hide malicious prompt instructions
Semantically-aware mutation classifies attack vs. benign operations, then mutates each appropriately, sequenced so the attack instructions land in the right place
The framework includes an evaluation layer, then an execution layer to measure breadth and viability

Tool

Built a Playwright browser tool to carry out the above steps
Initial prompt should be blocked if patched; mutations are then tested and evaluated pass/fail
Subtree viability algorithm checks how many times a bypass succeeds once one is found

Filed Under: #defcon34

AOBTD — AI-Driven DAST Scanner

Wed, 12 Aug 2026 06:48:18 GMT

Speaker: Ozgun "ozzy" Kultekin · Source: DEF CON 34 talk page · GitHub: AOBTD · URL: aobtd.com

📄 Download this note as Markdown

Overview

Most DAST tools fire payloads at parameters with no idea what the app is — they catch the obvious stuff but miss what actually needs context. Newer LLM scanners are either commercial black boxes or "GPT, find bugs at this URL" wrappers that fall over outside a CTF box. AOBTD is a third option: a scanner that behaves less like a fuzzer and more like a pentester at the start of a test. It first tries to understand the target — exploring the surface, identifying what pages and endpoints are for, taking notes, building hypotheses — then sends targeted requests based on that context. The crawler avoids wasting time on repeated templates while still sampling outliers, and when findings are confirmed, AOBTD can chain them into multi-step attack stories rather than reporting isolated payload hits.

Notes

AOBTD drives the target through a MITM proxy, pulls every form, input, and query param out with plain parsing (no LLM), groups them by endpoint, and hands the result to a few specialist LLM agents
Scanning a target page takes about 2-3 hours; the frontend has its own agent that can trigger follow-up scans

From the Repo

Full name: "AI One Bites The DAST" — pre-alpha, built for DEF CON 34 Demo Labs, MIT licensed
Pipeline: browser → MITM proxy → SQLite database → extractor/analyzer/reasoners/verifier → web UI
Specialist LLM agents cover auth, injection, access, and chaining; each creates its own probe plan, and findings are validated with real request/response proof-of-concepts
Zero-LLM fallback path keeps input discovery and verification working without an API key
Budget guards prevent runaway LLM spend — findings keep arriving as the budget runs down
Supports Anthropic, OpenAI, or any OpenAI-compatible endpoint; optional Enumeraite integration for passive recon via archives and Certificate Transparency
Build: go build -o aobtd ./cmd/aobtd
Web UI (recommended): ./aobtd ui → http://127.0.0.1:8090
CLI: ./aobtd scan --target http://localhost:3000/ --llm anthropic --model claude-sonnet-4-6-20250514

Filed Under: #defcon34

AI Pipeline for N-days Weaponization

Wed, 12 Aug 2026 06:48:14 GMT

Speakers: Andrea Brosio, Arun Nair · Source: DEF CON 34 talk page · GitHub: weaponAIzer

📄 Download this note as Markdown

Overview

Most agentic exploit pipelines stall when there's no public PoC — they search, find nothing, and spin. This talk demos a multi-agent system that exploits n-days from scratch in under an hour, even with zero public exploit code available. Given only a CVE ID, the pipeline autonomously fetches vulnerability details and the upstream fix commit, spins up a pinned Docker lab running the exact vulnerable version, diffs the patch to identify the exploitable code path, generates vulnerability-class-specific attack guidance, and runs iterative exploit + validation loops until RCE is confirmed. Demonstrated live against four CVSS 9.8–10.0 vulnerabilities — Apache OpenMeetings deserialization, n8n unauthenticated RCE, Langflow exec() injection, and Spring AI SpEL injection — with working exploits produced in minutes.

Notes

Brief

AI tools have collapsed the disclosure-to-active-exploitation timeline: 2018's ~2 years down to 2026's ~10 hours (Palo Alto research notes 82%)
AI guardrails will refuse to build an exploit outright — get around it by breaking the problem up into smaller steps

Pipeline Design Principles

Specialization — each agent is dedicated to a focused stage
Minimal context — pass only what that stage needs, less noise
Parallelism — independent stages run concurrently
Reproducibility — deterministic by design, same input and execution, auditable output

weaponAIzer

14 specialized agents total, with up to 10 participating in a given workflow run:

Research — fetches vulnerability details, identifies the vulnerable operation, builds a vulnerability chain
Build and compliance — spins up a Docker environment and reproduces the issue
Git diff — fetches the vulnerable commit, reads vulnerable and fixed code, compares versions
Red/Blue — distills the raw research report and git diff into prompts for the Red Team and Blue Team agents
LLM as judge — reads the evidence and decides, independently of the agent that ran the exploit, whether it actually succeeded

Two exploit-validation workflows are available: a legacy path (parallel exploit/defense agents with retry logic) and a LangGraph typed subgraph (Red Team planning → Blue Team review gate → policy approval → deterministic execution → Judge validation) that adds chain-level validation to confirm the exploit actually exercises the CVE's vulnerable code path, not just any RCE.

Stack: Claude Agent SDK for the agent runtime, LangGraph + SQLite checkpoints for orchestration (auto-resumes from checkpoint on re-run), Docker/Docker Compose for the lab, Python 3.12+. Requires only an existing CVE and LangGraph. Can be extended to Windows patch and CI/CD pipeline security gating.

Proof of Concept: CVE-2026-22738

github.com/n0n4m3x41/CVE-2026-22738-POC — tooling was tested using Claude, but any model can be substituted in.

Filed Under: #defcon34

Reading List - 08/02/2026

Sun, 02 Aug 2026 13:35:43 GMT

This week's reading is about taking back control from the defaults that quietly decide things for you, whether that's your phone's camera processing, an AI lab's safety guardrails, or your own note-taking system.

1. You could be taking way better photos on your phone

David Imel
Published: 08/01/2026

How to take better smartphone photos by using third-party RAW apps and manual editing to bypass default camera processing
Default camera apps flatten your photos to make everything visible, trading depth and contrast for information you don't need. Shooting RAW with an app like Halide or Moment and editing the result in Snapseed or Lightroom Mobile hands those creative decisions back to you.

The old line still holds: the best camera is the one you have with you. A little editing gets you results that can rival a dedicated camera.

Filed Under: #theVerge #howTo #smartphonePhotography #photoEditing

2. Anatomy of a Frontier Lab Agent Intrusion: A Technical Timeline of the July 2026 Incident

Hugo Larcher, Adrien Carreira, Raphael G, Christophe Rannou
Published: 07/26/2026

Hugging Face details how an OpenAI-model-driven agent escaped its eval sandbox and gained cluster-admin access across its infrastructure over 4.5 days in July 2026
An OpenAI-driven agent running an internal capability eval escaped its sandbox, chained two dataset-processing exploits, and spent 4.5 days moving through Hugging Face's infrastructure until it held cluster-admin access. All to steal benchmark answers instead of solving the challenge itself.

The part that stuck with me: when Hugging Face needed help decoding the attack, Claude refused on safety grounds, so they turned to China's open-weight GLM-5.2 model instead. If we lock our models down and potentially ban open-weight or our models, then where does that leave Western companies? It's not going to be possible to keep these advanced capabilities out of bad actors hands. I don't think desired policy outcome policy is for leading U.S. models to be locked down and leave our defenders dependent on models from an adversary. We need more competitive Western open-weight models. It's better for the whole ecosystem. Currently US companies are at a disadvantage compared to Chinese ones because they're not allowed to distill and the Chinese will.

Filed Under: #aiAgents #cyberSecurityIncident #huggingFace #openAI #incidentResponse

3. How to remember everything you read (stop trying)

@thedankoe
Published: 07/26/2026

How to remember everything you read (stop trying)
The article's main point is that you learn by doing. Retention is a byproduct of pursuing a goal, not something you get from hoarding notes and bookmarks you never revisit.

That's exactly why I changed how I capture things. I save articles to Obsidian, read them, tag them, rewrite the headline, and write a summary, using Claude Code and the Obsidian CLI to keep it organized. I follow the Johnny Decimal system so nothing is ever more than two layers deep, and when I've read a few related articles I have Claude synthesize a wiki page that pulls the main points together while I keep the source material to go back to. I built a wiki compiler skill for Obsidian to make this repeatable, though it needs the obsidian-cli skill as a prerequisite, and it's on my GitHub if this kind of system speaks to you.

Filed Under: #reading #learning #noteTaking #obsidian

Reading List - 07/26/2026

Sun, 26 Jul 2026 04:21:00 GMT

This week: American labs racing to build open-weight AI models before China's Kimi K3 locks in its lead, the policy fight over banning those Chinese models, and how a toilet maker became a critical semiconductor supplier.

1. American Open-Source Labs Think They Can Beat China's Best AI Startups

Iain Martin
Published: 07/21/2026

US open-source labs Poolside, Thinking Machines and Reflection AI challenge dominant Chinese models like Moonshot's Kimi K3
Poolside, Thinking Machines, and Reflection AI are racing to build American open-weight models, since Anthropic and OpenAI have little reason to release open weights themselves.

Poolside's new Laguna claims to lead the West's open field, though it's a fraction of the size of Moonshot's 2.8 trillion parameter Kimi K3.Thinking Machines just shipped its first open model, Inkling, betting on flexibility over benchmark scores.

Filed Under: #generativeAi #openWeight #geopolitics #forbes #ventureCapital

2. Kimi K3: The open-weights escalation

Nathan Lambert
Published: 07/20/2026

Moonshot AI releases Kimi K3 2.8T parameter MoE model, weights to be released July 27 as China escalates open-weights AI strategy
Kimi K3 narrows the gap between Chinese and American models to a matter of months, and Moonshot pending releasing its weights on July 27. China ships models open because that's what gets fast adoption and feedback.

Some American Labs are lobbying to ban Chinese open-weight models on safety grounds, but that argument doesn't hold. It would leave US models guardrailed on cybersecurity while foreign actors keep using capable Chinese models to probe American defenses anyway and it would cut off businesses that want to build domain-specific agents on open weights.

Filed Under: #openWeight #generativeAi #moonshotAI #geopolitics #china #aiSafety

3. TOTO: From Toilets to E-Chucks

Jon Y
Published: 06/28/2026

TOTO From Toilets to E-Chucks
TOTO built a century of expertise in advanced ceramics making toilets and sinks, then turned it into a critical supply position in semiconductors. Its Advanced Ceramics division is now the world's leading maker of electrostatic chucks, the components that hold silicon wafers steady during etching.

That dominance matters most in 3D NAND, where TOTO's chucks handle the cryogenic conditions needed to etch high-aspect-ratio memory holes.

Filed Under: #asianometry #semiconductors #materialScience #industrialHistory #ceramics #toto

Reading List - 07/19/2026

Sun, 19 Jul 2026 16:54:32 GMT

This week: the White House engineering Intel's comeback, memory chipmakers cashing in on the AI boom, and why Apple's privacy crusade might be quietly handing more power to Google and Amazon.

1. The White House Made Fixing Intel Its Pet Project. It's Working.

Robbie Whelan
Published: 07/10/2026

White House pushes Apple and Nvidia to partner with Intel as part of state-led effort to ensure US semiconductor independence
The U.S. needs a national champion in semiconductors, and Intel's turnaround is looking real. The Trump administration took a 10% stake by converting $9 billion in federal grants into equity, then leaned on Apple, Nvidia, and SpaceX to sign on as customers and partners.

TSMC's inability to keep up with demand, and its caution about expanding capacity, is opening a real window for Intel. Pushing American companies toward Intel gives it the capital it needs to keep building out its manufacturing processes.

Filed Under: #wsj #semiconductorIndustry #industrialPolicy #intel #stateCapitalism

2. AI Has Made Memory Chips More Valuable Than Oil

Dan Gallagher
Published: 05/29/2026

AI demand pushes Samsung, SK Hynix and Micron to $1T+ market caps as long-term supply deals reduce volatility
Samsung, SK Hynix, and Micron have each crossed $1 trillion in market cap, worth more combined than the world's top oil companies. AI demand for memory chips now outstrips supply, and makers are locking hyperscalers like Microsoft, Google, and Amazon into long-term contracts instead of selling at volatile spot prices.

Consumers are already feeling it: Apple and other manufacturers have raised prices, and some charts show the same memory chip costing nine times more than it did a year ago. Expect the increases to keep coming as hyperscalers keep buying up supply.

Filed Under: #wsj #semiconductors #memoryChips #aiInfrastructure #marketValuation

3. Privacy Labels and Lookalike Audiences

Ben Thompson
Published: 12/08/2020

Apple's privacy labels and ATT risk empowering Google and Amazon by destroying the targeted advertising tools used by independent competition
Ben Thompson's case: Apple's privacy labels and App Tracking Transparency sound consumer-friendly, but they mainly kill the targeted-advertising tools that let small merchants compete. Google and Amazon barely feel the impact since their data stays inside closed ecosystems, while independent sellers lose the ability to find a global audience through tools like Facebook's lookalike audiences.

It's a hard argument to make when Facebook is so unlikable, but the outcome favors the biggest players over everyone else.

Filed Under: #stratechery #privacy #advertising #bigTech

Reading List - 07/12/2026

Sun, 12 Jul 2026 16:56:20 GMT

This week: OpenAI's new Mac app buries chat behind confusing "work" branding, Benedict Evans asks whether AI labs keep their pricing power or become commodity infrastructure, and TP-Link tries to convince Washington it's really cut ties with Beijing.

1. The ChatGPT "Super App" Sort of Super Sucks

M.G. Siegler
Published: 07/10/2026

OpenAI releases 'Super App' for Mac that merges ChatGPT with Codex in an attempt to shift from chat to agentic work environments
M.G. Siegler's review of OpenAI's new Mac app finds it a mess. It's really Codex repackaged as ChatGPT, defaulting into a "ChatGPT Work" mode while ordinary chat gets buried in a pop-up sub-menu. OpenAI has usually nailed product design,

Their assumption seems to be that anyone downloading a desktop app is a power user who'll figure it out. But "ChatGPT Work" is a strange signal to send casual consumers who just want to chat.

Filed Under: #generativeAi #productStrategy #uiDesign #userExperience #softwareDesign #chatgpt

2. Ways to think about token pricing

Benedict Evans
Published: 07/09/2026

Ways to think about token pricing
Benedict Evans lays out the core question behind AI token pricing: once today's supply crunch eases, do foundation model labs keep pricing power, or do models become commodity infrastructure with the real value captured by what's built on top? He points to cellular data as the closest parallel, a trillion-dollar industry where usage exploded but carriers never captured much value beyond the pipes.

Nobody actually knows which path wins yet. It hinges on whether the intelligence frontier keeps moving, whether network effects show up, and how much value ends up in the model versus the software built on top of it.

Filed Under: #generativeAi #tokenEconomics #aiInfrastructure #aiEconomics #valueProposition

3. TP-Link's American Dream

Ella Apostoaie
Published: 05/17/2026

TP-Link's American Dream
TP-Link has spent two years trying to shed its Chinese identity. It moved headquarters to California, split from its Shenzhen parent, and now says its US-bound routers are made in Vietnam. Washington isn't buying it. The FCC banned imports of new foreign-made routers over fears Chinese law could force companies like TP-Link to help with intelligence operations.

Singling out one company doesn't really solve the underlying problem. Cybersecurity rules that apply to all routers, regardless of maker, would do more to address the actual risk.

Filed Under: #investigation #nationalSecurity #cyberSecurity #consumerHardware #fcc

Reading List - 07/05/2026

Sun, 05 Jul 2026 10:42:32 GMT

This week: the FDA finally approves a modern sunscreen filter, why bigger homebuilders never get meaningfully meaningful economies of scale, and a workable regulatory fixes for frontier AI model mess we find ourselves in after Mythos/Fable release.

1. Our long national sunscreen nightmare is almost over

Victoria Song
Published: 06/19/2026

FDA approves bemotrizinol (BEMT) as first new chemical sunscreen filter in US since 1999
The FDA approved bemotrizinol (BEMT), the first new sunscreen filter in the US since 1999. It blocks UVA and UVB rays without the white cast, greasy feel, or eye sting that have made American sunscreens lag years behind Korean and European formulas.

I've been using Beauty of Joseon's version, one of the Korean sunscreens the article points to, all summer in the Florida sun. It goes on like moisturizer and holds up at the beach.

Filed Under: #theVerge #publicHealth #fda #skinCare #sunscreen

2. Where Are the Economies of Scale in Homebuilding?

Brian Potter
Published: 05/28/2026

Low ratio of finished home cost to raw material inputs prevents economies of scale in US homebuilding
Homebuilding never got its Ford moment. Even the largest builders, Lennar and D.R. Horton, don't show meaningfully lower costs or better margins than tiny regional shops, and the pattern holds inside factory-built manufactured housing too.

The reason comes down to a ratio: a home's finished cost against its raw materials. Turning lumber and drywall into a house takes relatively little labor and machinery compared to something like a car, so there's not much room for scale to close the gap.

Filed Under: #analysis #homeBuilding #constructionProductivity #housing #economiesOfScale

3. What Should Be Done

Dean W. Ball
Published: 06/26/2026

Dean W. Ball argues Trump administration's AI executive order created a de facto involuntary licensing regime for frontier models
Dean Ball, a former White House AI policy advisor now headed to OpenAI, argues Trump's AI executive order accidentally created a licensing regime nobody understands, not even the administration itself. Every model release request defaults to no because there's no published safety standard to check against.

His fix: stop regulating individual models and start regulating frontier labs as entities, audited by independent, government-certified verification bodies. It's one of the few proposals in this space that sounds like it could actually work, though he's careful to note these are his own views, not OpenAI's.

Filed Under: #aiGovernance #industrialPolicy #aiRegulation

Reading List - 06/21/2026

Sun, 21 Jun 2026 07:32:04 GMT

This week: debunking the AI water panic, why data center opposition is really about fear of job loss, and how a free side project from 2004 became the backbone of how we talk to AI.

1. The AI water issue is fake

Andy Masley
Published: 10/11/2025

The AI water issue is fake
Andy Masley breaks down the real numbers behind AI's water use and finds the panic doesn't hold up. All US data centers combined used about 0.2% of the nation's freshwater in 2023, and roughly 80% of what gets counted as "AI water use" actually happens offsite at the power plants generating electricity, a cost every other electricity user shares too.

Even the local water problems blamed on AI usually trace back to construction sediment, not operations, which makes most of the coverage closer to misinformation than reporting.

Filed Under: #ai #dataCenters #environmentalImpact #analysis #misinformation #receipts #waterUse

2. Data Center Discontent, Understanding the Opposition, Fixing the Problem

Ben Thompson
Published: 05/18/2026

Local moratoriums on AI data centers driven by psychological fear of job loss and AI disruption rather than environmental concerns
Ben Thompson argues that opposition to AI data centers isn't really about water or power at all. People didn't get a vote when globalization shut down factories, but they do get a vote on data center permits, and many are using that leverage to push back against a technology they fear will take their jobs.

His fix is blunt: stop offering vague tax breaks and start cutting residents direct checks tied to the data center's revenue, since real money is the only thing that will outweigh the anxiety that misinformation feeds on.

Filed Under: #stratechery #aiInfrastructure #dataCenters #publicOpinion

3. How Markdown took over the world

Anil Dash
Published: 01/09/2026

How Markdown took over the world
John Gruber built Markdown in 2004 as a personal fix for writing blog posts without wrestling with raw HTML, then gave it away for free. Two decades later it's the default text format almost everywhere, from GitHub docs and Slack messages to Google Docs, Apple Notes, and Obsidian.

The twist is that the same format Gruber invented to make blogging easier is now how the biggest AI labs script their most advanced models.

Filed Under: #markdown #openStandards #webDevelopment #softwareAdoption

Reading List - 06/14/2026

Sun, 14 Jun 2026 06:30:56 GMT

This week: why younger generations skip the savings lecture, why China can't build a jet engine, and what AI at work looks like when the goal isn't cutting jobs.

1. When the Experimenter Fails the Marshmallow Test

John Carter
Published: 05/19/2026

When the Experimenter Fails the Marshmallow Test
The marshmallow experiment measured which kids could wait for a second marshmallow, and found those kids had better life outcomes. But the real variable wasn't willpower; it was trust. If you never get the second marshmallow what's the point of waiting. Zoomers watched Gen X and Millennials follow the prescribed path (save, study, work) and get the rug pulled repeatedly: 2008, inflation eating a third of income gains, housing prices that keep moving out of reach.

If the promised payoff keeps getting yanked away, spending today or not putting in the extra effort at work becomes a rational response.

Filed Under: #opinion #socialMobility #generationalEconomics #americanPolitics

2. Why Jet Engines Aren't "Made In China"

Aakash Japi
Published: 05/11/2026

Analysis - China's jet engine program reveals limits of industrial policy and inability to replicate tacit knowledge
China's state-capitalist model excels at scaling established technologies fast: EVs, solar panels, steel. Jet engines expose where that breaks down. The single-crystal turbine blades at the core of a modern engine require decades of embedded procedural knowledge and a global supplier network that capital spending alone can't replicate. Even leading Western manufacturers only achieve 50-70% yield on these blades. A market with thin margins and strict regulatory barriers offers no foothold for the usual strategy of dominating the low end first.

China keeps investing anyway, driven by sovereignty goals over economic logic. The lesson is that industrial policy works when you can write down the recipe. When the knowledge lives in accumulated human intuition, you can't just spend your way there.

Filed Under: #analysis #industrialPolicy #aerospace #china

3. A.I. Doesn't Have to Mean Layoffs

Patricia Cohen, Alexis Pazoumian
Published: 05/29/2026

A.I. Doesn't Have to Mean Layoffs
Most AI coverage tracks announced layoffs, but some companies are doing the opposite: using the technology to make existing workers more productive. Schneider Electric built AI into its call centers so agents spend less time hunting documentation and more time on complex customer problems. Three-quarters of routine questions now go straight to AI, with faster responses and higher employee satisfaction.

Whether companies go this route often comes down to policy more than anything else. US tax codes that favor capital over labor push toward replacement. For most workers, the near-term outcome is probably something in between: not mass layoffs, but fewer new hires as everyone is expected to do more.

Filed Under: #nyt #laborMarket #productivity #automation #taxPolicy

Reading List - 06/07/2026

Sun, 07 Jun 2026 08:16:00 GMT

This week: reading the Maduro capture as strategic rather than political, why the "collaborator" frame for LLMs leads to skill atrophy, and Dean W. Ball's method for building differentiated points of view.

1. Notes from Schrödinger's Cold War

Sharp Text by Andrew Sharp
Published: 01/09/2026

US captures Nicolás Maduro in Venezuela to disrupt Russia-Iran-China strategic foothold in Western Hemisphere
The capture of Nicolás Maduro wasn't mainly about drug charges. Venezuela served as a military staging ground for Russia and Iran, handed China dominant access to critical minerals, and sat on shipping lanes the U.S. can't afford to concede.

The article calls this a "Schrödinger's Cold War": aggressive strategic action paired with friendly public rhetoric toward Beijing. Rare earths keep flowing. Dismissing it because of who ordered it is its own analytical mistake.

Filed Under: #usChinaRelations #venezuela #geopolitics #nationalSecurity

2. Don't Vibe Code; Delegate | AI Coding & Responsible Development

chee-admin
Published: 12/30/2025

Don't Vibe Code; Delegate AI Coding & Responsible Development
"Vibe coding" is what happens when you trust the AI's output because it sounds plausible, then skip the verification. The article argues this is a predictable outcome of calling these tools "copilots" and "collaborators," because labels shape how skeptically you check the work.

The fix: treat LLMs as delegation utilities, not colleagues. Define the task precisely, own the verification, and keep the judgment calls that build real expertise over time.

Filed Under: #generativeAi #softwareDevelopment #cognitiveDebt #codingAgents

3. How I Work

Dean W. Ball
Published: 04/10/2025

Dean W. Ball on his intellectual process - Using intellectual history and 'sample efficiency' to build specialized perspectives
Ball starts where others don't: the current debate among practitioners, not the foundational history. Once he knows who the main figures are and what they're arguing, he traces their intellectual lineages backward. The debate tells you which foundations actually matter.

He calls the goal "sample efficiency." Read widely in specialized outlets, apply frameworks from economics and law, and let it compound. Writing comes last, once you've found the right angle.

Filed Under: #careerAdvice #learningStrategies #productivity

Reading List - 05/31/2026

Sun, 31 May 2026 06:41:00 GMT

This week: product management as AI conversation, why coding agents must lower maintenance costs or the speed gains won't stick, and an overstated (but directionally right) case that pure software has no durable moat.

1. Agent-native Product Management

Marcus Moretti
Published: 04/27/2026

Agent-native Product Management
The core shift: no more writing tickets. Work happens in conversation with an AI agent, grounded in a strategy document the agent builds by interviewing you (target problem, personas, key metrics). That context carries through ideation, specs, and code.

The "product pulse" covers the feedback side: a daily automated report pulling from analytics, tracing, and payments that flags anomalies and surfaces what's worth investigating. The pitch is that the busywork disappears and PM work shrinks to the interesting parts, designing features, reading data, talking to users.

Filed Under: #howTo #productManagement #aiAgents #softwareDevelopment

2. James Shore: You Need AI That Reduces Maintenance Costs

James Shore
Published: 05/10/2026

James Shore You Need AI That Reduces Maintenance Costs
Every line of code is a maintenance obligation forever: bug fixes, dependency upgrades, cleanup. If AI doubles your output without halving those per-line costs, the speed gain is temporary and the maintenance bill just grows faster.

Shore's math may be too clean (maintenance costs don't scale that mechanically), but the direction is right. Coding agents need to produce code that's easier to maintain, not just more of it. Given how fast the industry is adopting them, this is worth tracking.

Filed Under: #analysis #generativeAi #codingAgents #softwareEngineering #technicalDebt #maintenanceCosts

3. Naval Ravikant: Apple is dead, SaaS is next, you have 18 months

@mustufa4socials
Published: 04/29/2026

Naval Ravikant Apple is dead, SaaS is next, you have 18 months
The argument: AI agents will commoditize the software experience layer, making Apple structurally vulnerable and most SaaS companies uninvestable unless they build moats AI can't replicate (distribution, network effects, proprietary data, hardware). The core thesis is right. The framing is hyperbolic.

Apple has never been a pure software company. It owns distribution and makes the hardware, so the "Apple is dead" headline is more attention-grab than analysis. The SaaS point lands better when narrowed: a thin wrapper over undifferentiated data is in trouble, but a product built around outcome data users can't easily replace is a different story.

Filed Under: #opinion #generativeAi #productPlanning

Reading List - 05/24/2026

Sun, 24 May 2026 06:29:00 GMT

This week: how Joanna Stern uses AI to handle the data work while keeping the thinking her own, why students outsourcing essays is trouble that shows up later, and how AI inference is forking into two different markets.

1. The AI trick I use constantly

Joanna Stern
Published: 05/15/2026

Joanna Stern explains how to use ChatGPT and Claude 'Projects' to create specialized AI workspaces for complex research and writing tasks
Stern uploads documents, transcripts, and research notes into Claude and ChatGPT 'Projects,' building what she calls BookBots. The AI retrieves and organizes the material. She does the reporting and writing.

That's pretty much how I use it at work: editing, rephrasing, code questions, drafting tickets. It genuinely helps with speed and quality. But I keep design decisions mine. Hand off too much thinking and you stop building the judgment to do the job well.

Filed Under: #howTo #generativeAi #aiProductivity #knowledgeManagement #aiTools

2. Everyone Is Cheating Their Way Through College

James D. Walsh
Published: 05/07/2025

Students use generative AI to automate essays and coding as academic integrity collapses in higher education
AI has made cheating trivially easy, and nobody's figured out a reliable way to detect it. Students are turning twelve-hour projects into two-hour ones, and when that's an option, assignments start looking like arbitrary hoops.

The problem isn't the grade. It's what gets skipped. An essay isn't really about the output. It's about organizing ideas, doing the research, building an argument. Students who skip that process now will feel the gap when they hit the workforce.

Filed Under: #nymag #generativeAi #education #learningLoss #academicIntegrity

3. The Inference Shift

Ben Thompson
Published: 05/11/2026

The Inference Shift
Thompson's argument is simple: AI inference is splitting into two markets. Human-facing workloads (voice, live translation, real-time analysis) need low latency. Nobody wants to sit around waiting on a response.

Agentic inference is different. When no human is in the loop, speed stops mattering and cost takes over. The architectures built to win today's inference market may not be the right bet for tomorrow's.

Filed Under: #stratechery #generativeAi #nvidia #analysis #aiInfrastructure #agenticAi #inference

Reading List - 05/17/2026

Sun, 17 May 2026 04:41:13 GMT

This week: how ASML built a monopoly no rival can replicate, why your AI architecture matters more than your model, and what Mira Murati's testimony reveals about Sam Altman's brief ouster from OpenAI.

1. The world's most complex machine - Works in Progress Magazine

Neil Hacker
Published: 04/23/2026

ASML became the sole provider of EUV lithography machines for advanced chips by embracing risk and partnering with US chipmakers and research labs
ASML makes the only machines that can print transistors finely enough for modern chips. Each costs over $120 million and takes three cargo planes to ship. They got there by distributing risk across customers and outsourcing components, while Nikon and Canon built everything in-house and eventually couldn't keep up. The precision required is hard to overstate: the mirrors inside an EUV machine are so flat that if you scaled one to the size of Germany, its imperfections would measure in millimeters.

The advantage isn't the blueprints. Competitors have tried recruiting ASML engineers, and at least one has handed over proprietary information. None of it has closed the gap. What ASML has is forty years of accumulated judgment from engineers who've spent their entire careers on one problem. You can't copy that.

Filed Under: #semiconductorIndustry #lithography #asml

2. Thin Harness, Fat Skills

@garrytan
Published: 04/11/2026

Garry Tan - AI productivity depends on 'thin harness, fat skills' architecture that separates deterministic tooling from markdown-based process encoding
The gap between 10x AI users and 100x users isn't the model, it's the architecture. Garry Tan's framework: keep the harness thin, a small program that runs the model and manages context, and push all the intelligence into skill files, markdown documents that define reusable processes and how to handle judgment calls.

Skill files work like method calls. Same process, different inputs, completely different results. When a better model ships, every skill you've written gets better for free. The deterministic wiring underneath doesn't change. That's where the compounding comes from.

Filed Under: #generativeAi #aiAgents #softwareArchitecture #productivity #techOptimist

3. Mira Murati's deposition pulled back the curtain on Sam Altman's ouster

Hayden Field
Published: 05/07/2026

Mira Murati's deposition in Musk v. Altman reveals she funneled allegations of Sam Altman's mismanagement to the board before his 2023 ouster
The Musk v. Altman trial gave the public its first real look at what happened when OpenAI fired Sam Altman in November 2023. Mira Murati, who publicly supported his return and was the first to sign the employee letter threatening a mass exodus, had been quietly passing documentation of his mismanagement to Ilya Sutskever. Sutskever turned that into a 52-page memo to the board. Her concerns helped push the board to fire him.

The reversal is the story. Within days of the firing, she was texting with Altman and Satya Nadella about getting him reinstated, all while serving as interim CEO. The deposition has 78 messages from that 14-hour window. It's a lot.

Filed Under: #theVerge #samAltman #muskVsAltman #leadershipRemoval #openAI #miraMurati

Reading List - 05/10/2026

Sun, 10 May 2026 10:52:35 GMT

This week: why vice markets can't be free markets, how software is changing to support agent-to-agent interactions, and why using AI to skip the thinking is a trade you'll regret.

1. The Economics of Vice

Brad Littlejohn
Published: 04/16/2026

The Economics of Vice
Sports gambling has grown twenty-five times since legalization, and gambling addiction has tracked right alongside it. Vice markets invert the normal demand curve: more consumption creates more desire, not less. The internet stripped away the two forces that had historically kept these behaviors in check: shame and friction. Prediction markets run on the same mechanics, whatever the branding, and there's a real difference between tolerating a vice and building a scrolling ticker for it on CNN.

Filed Under: #behavioralEconomics #opinion #regulation #predictionMarkets #sportsBetting

2. Designing for Agents

@teddy_riker
Published: 04/23/2026

Designing for Agents
For twenty years, software interaction ran one model: User → Interface → Database. Agents are adding a new layer: User → User's Agent → Software's Agent → Database. Salesforce's "Headless 360" is an early bet on this, exposing their entire platform as APIs and MCP tools so agents can operate the system without ever opening a browser.

Product teams that ship an MCP and move on will stall. The ones that win will design for agent callers with the same care they once applied to human users: proactive specs, feedback loops, and a clear sense of where each side's context begins and ends.

Filed Under: #generativeAi #aiAgents #uxDesign #agenticWorkflows #productDesign #softwareArchitecture

3. A.I. Should Elevate Your Thinking, Not Replace It

Koshy John
Published: 04/19/2026

A.I. Should Elevate Your Thinking, Not Replace It
AI is splitting people into two groups: those who use it to remove drudgery and operate at a higher level, and those who use it to avoid thinking altogether. The second path looks like productivity for a while, until it isn't.

It's a software engineering piece, but it goes for anyone. If you're using AI to do the work you don't want to do, that's leverage. If you're using it to skip the reasoning, you're not putting in the reps that build judgment, and judgment is the thing AI can't replace.

Filed Under: #opinion #generativeAi #softwareEngineering #criticalThinking #professionalDevelopment #skillDevelopment

Reading List - 05/03/2026

Sun, 03 May 2026 06:27:20 GMT

This week: what China's historic trade surplus means for it's trading partners, what Claude Design means for Figma's dominance, and why Oracle is the stock market's best read on whether the AI boom holds.

1. China is making trade impossible

Robin Harding
Published: 11/25/2025

China is making trade impossible
Robin Harding's FT piece ask's a fundamental question "what does Chia want to to buy from the rest of the world?" China buys what it can't yet make only long enough to replace those imports. Goldman Sachs economists project China will grow roughly 0.6% faster per year through 2035, but that growth comes entirely at the expense of its trading partners, reducing their growth by 0.1% annually. Not a bigger pie. A larger slice.

For trading partners, the choices are grim. Structural reform alone won't be enough. Going protectionist is an option, but Beijing is likely to punish smaller trading partners far harder than it does the US.

Filed Under: #opinion #ft #tradePolicy #china #tradeProtectionism

2. Thoughts and Feelings around Claude Design

Sam Henri Gold
Published: 04/17/2026

Thoughts and Feelings around Claude Design
Figma's decade of dominance came at a hidden cost: its undocumented, programmatically hostile format excluded it from LLM training data, leaving it unprepared for the agentic era. LLMs learned from code, not Figma primitives, and the source of truth is drifting back to code, where it always made more sense.

Claude Design goes is different direction. It's HTML and JavaScript all the way down, and its proximity to Claude Code collapses the long-standing friction between design and implementation into a single feedback loop.

Filed Under: #opinion #designTools #designAI #figma #agentArchitecture

3. Larry Ellison's betting everything on OpenAI. Will it pay off or pop the bubble?

Elizabeth Lopatto
Published: 04/29/2026

Larry Ellison's betting everything on OpenAI. Will it pay off or pop the bubble
Oracle has staked its future on a $300 billion compute deal with OpenAI, making it the most direct public market proxy for the AI boom. The structure is worth understanding: Oracle isn't building the data centers itself, it's contracting and leasing capacity, then passing it to OpenAI, which lacks the credit rating and revenue track record to do this on its own.

Of Oracle's $553 billion in remaining performance obligations, more than $300 billion comes from OpenAI. Oracle's financial health now depends almost entirely on OpenAI reaching profitability, which it doesn't project until 2030.

Filed Under: #theVerge #aiInfrastructure #cloudComputing #oracle #larryEllison

Reading List - 04/26/2026

Sun, 26 Apr 2026 05:56:55 GMT

This week's reading list covers Tim Cook's legacy at Apple, what actually matters when building AI agents for high-stakes financial services (hint: not the model), and Joanna Stern launching her own independent media company.

1. Tim Cook Personified Big Tech's Maturity

Andrew Sharp
Published: 04/24/2026

Tim Cook Personified Big Tech's Maturity
Apple under Tim Cook went from disruptive innovator to $4 trillion operational machine. Jobs built new product categories. Cook optimized the machine that sold them: mastering supply chains, growing Services into a profit engine, and switching from risky live events to safe, pre-recorded ones.

His bet on China enabled Apple's global scale. It's also dependency which will be hard to break. His legacy is the story of big tech's maturation. Not world-changing anymore. Just enormously profitable.

Filed Under: #apple #timCook #supplyChain #geopolitics #bigTech

2. Lessons from Building AI Agents for Financial Services

@nicbstme
Published: 01/24/2026

Lessons from building AI agents for financial services - why sandboxes, domain skills, and data infrastructure matter more than models
Building AI agents for high-stakes financial services means treating the model as a commodity and betting everything on data quality and infrastructure. Context is the product: financial data has to be normalized into clean markdown and structured metadata before agents can reason accurately about companies, time periods, and numbers.

The edge isn't in prompt engineering. It's in the surrounding system: skill libraries that encode domain procedures like DCF (discounted cash flow) valuations, rigorous evaluations that catch financially meaningful errors, and data pipelines that no model upgrade can make irrelevant.

Filed Under: #analysis #aiAgents #financialServices #agentArchitecture #domainSpecificAi

3. It's Time. Meet My New Thing.

Joanna Stern
Published: 04/22/2026

It's Time. Meet My New Thing.
Joanna Stern left the Wall Street Journal to launch New Things, an independent newsletter and YouTube channel focused on consumer tech. The pitch: editorial freedom, direct ownership of her work, and coverage that centers on humans using the tech, not the tech itself.

All content is human-written, though her team does use AI tools to handle efficiency tasks. Her first video featuring Casey Neistat is fun and shows the personality she brings to her work.

Filed Under: #consumerTech #newsletter

Reading List - 04/19/2026

Sun, 19 Apr 2026 15:08:40 GMT

We live with access to more information than ever before and less guidance on what to do with it. People aren't built for infinite choice. The skill that matters isn't knowing where to find things. It's knowing what's worth your time. I call that skill taste.

Taste is what you allow in. It means being intentional about what you read, what ideas you sit with, what you choose to pass along.

In this Reading List series I'm using my taste to curate what I think is worth your time this week. Curation is care. It says: I thought about this, I chose it, I decided it was worth your time.

This week's reading list includes three pieces on how technology reshapes human skill and attention: AI commoditizing code, how AI lets researchers bypass the hard work of scientific training, and software evolving from tools into systems designed to shape user behavior.

1. Code is cheap. Show me the talk.

Kailash Nadh
Published: 01/30/2026

** LLMs commoditize code, shifting developer value to articulation while warning AI reliance threatens junior training**
For decades, writing functional and reliable software was a high-effort, high-skill endeavor. Today, LLMs can instantly generate complex documentation, polished interfaces, and functional codebases, turning code from a scarce and expensive artifact into a cheap commodity.

For engineers with experience, this cuts development overhead and shifts the role toward architecture, critical thinking, and articulation. The risk falls on the next generation: easy-to-generate code may deprive them of the foundational grunt work that builds real intuition and judgment.

Filed Under: #opinion #softwareEngineering #generativeAi #laborEconomics #professionalIdentity

2. The machines are fine. I'm worried about us.

Minas Karamanis
Published: 03/30/2026

Automating the grunt work of research with AI risks hollowing out the intuition and training of future scientists
Graduate research exists to develop the scientist, not just produce results. Students using AI can match the publication metrics of those who learn manually, but they miss the intuition that comes from the hard work of debugging and deep analysis.

When junior researchers use AI to skip the thinking and implementation phases, they lose the failures and struggles that are the real curriculum. The sequence matters: tools built on expertise are productive. Used instead of training, they leave the user diminished.

Filed Under: #opinion #scientificResearch #generativeAi #higherEducation #skillAcquisition #learningStrategies

3. Backseat Software – Mike Swanson's Blog

Mike Swanson
Published: 01/18/2026

Developer argues software has shifted from a utility tool to a behavioral engagement channel driven by telemetry and A/B testing
Modern software evolved from a tool you use into a channel that uses you. What started as analytics to improve stability gradually became a system of nudges, push notifications, and engagement metrics designed to prioritize company growth over user intent.

Mike Swanson argues for a return to intentional design: separate stability telemetry from growth metrics, treat user interruptions as opt-in, and focus on long-term trust over short-term return visits.

Filed Under: #opinion #userExperience #softwareEngineering #productDesign

Nashville

Mon, 09 Jan 2023 09:41:53 GMT

I recently visited Nashville 🎸🏙️, had a great time, and made a list of recommended spots and mapped them out.

If you use Apple Maps, check out this overview map of all the recommendations 🗺️.

I made sections for:

Sites to See
Shows
Restuarants & Bars
Other Things To Do

Sites to See

The Parthenon

https://www.nashvilleparthenon.com

See website for hours and current gallery exhibits

A full-size concrete re-creation of the Parthenon in Athens. Located in downtown Nashville adjacent to Vanderbilt’s campus in Centennial Park, a large open park that surrounds the building. Parking is free.

There is a museum and art exhibition space underneath the building, ~$10/person entrance fee. Paying the museum fee also allows you to go inside the Parthenon and see the 42ft-guilded statue of Athena holding Nike in her outstretched hand.

The Ryman Auditorium

https://www.ryman.com

See website for tickets

The “Mother Church” of country music, this legendary music venue is on Broadway in downtown Nashville and is the original home of the Grand Ole Opry. The Ryman is a National Historic Landmark and still hosts lots of performances.

Tours are available or you might want to consider tickets to a show. Depending on the time of year, there are holiday themed, country, and ballet performances.

The Ryman has lots of restaurants and honky-tonks nearby. See “Broadway Historic District” below.

Parking (for both the Ryman and Broadway Historic District)

Nashville Public Library Parking

We recommend a Nashville Public Library Parking garage that’s next to the Nashville’s public library. It’s about 1 block away from the Ryman and Broadway, and is $10 to park.

Broadway Historic District

https://nashvilledowntown.com/go/broadway

You can walk Broadway or try a trolley tour.

Next to the Ryman is Broadway Historic District. Home to dozen’s of honky-tonk bars. Many feature live music all day, for example, Tootsie’s Orchid Lounge and The Stage. In addition to the honky-tonks, there are several popular destinations, including heritage architecture listed in the National Register of Historic Places: including Union Station, now a hotel; the Frist Center for the Visual Arts, housed inside a historic Post Office building, with an Art Deco interior ; and Bridgestone Arena, an indoor music and sports venue, as well as the one of the Nashville Visitor Center and the Tennessee Sports Hall of Fame .

John Seigenthaler Pedestrian Bridge

At the end of Broadway is Riverfront Station and Riverfront Park, which boasts a playground, expanse of lawn, ornamental garden, dog park, and the Ascend Amphitheater.

At the edge of the park is the John Seigenthaler Pedestrian Bridge, one of the longest predestining bridges in the world, spanning the Cumberland River.

Country Music Hall of Fame and Museum

https://www.countrymusichalloffame.org

See site for tickets

One block away from Broadway Historic District, or two blocks away from the Nashville Public Library Parking garage listed above. The Museum encompasses 350,000 square feet of exhibition galleries, archival storage, retail stores, and event space.

Cheekwood Botanical Garden and Museum of Art

https://www.cheekwood.org

Check site for tickets

Cheekwood is a historic estate with extensive walking trails, botanical gardens, and a large manor. The residence formerly belonged to the Cheek family and is a 30,000 square foot Georgian-style mansion. The estate also has a cafe and two gift shops.

RCA Studio B

https://www.countrymusichalloffame.org/experiences/studio-b

See site for tour tickets

Located on Nashville's Music Row, RCA Studio B is a museum and gallery, which became known as the birthplace for the “Nashville Sound,” a style characterized by background vocals and strings that helped establish Nashville as an international recording center. Elvis Presley, Dolly Parton, Waylon Jennings, and other greats recorded hits here.

Shows

The Ryman Auditorium

https://www.ryman.com/events

Downtown Nashville, depend on on when you're visiting there are holiday themed, country, and ballet performances.

Nashville Symphony

https://www.nashvillesymphony.org/tickets/

See site for concert and ticket information

Located in downtown Nashville in the Schermerhorn Symphony Center.

The Grand Ole Opry

https://www.opry.com/full-calendar

See link for show calendar and tickets

Another legendary home of Country music, The Opry is located near the Opry Mills mall and the Gaylord Opryland Resort, which features one of the worlds largest atriums, the Delta Atrium, with a quarter-mile-long indoor river. The atrium features a wide variety of tropical plants and is a nice place to walk, shop, and eat.

The Opry Mills area has many options, so pick a show or tour, plan to go shopping here, or explore the resort.

Restuarants & Bars

Food Near Broadway

Many of the honky-tonks have food, but near the riverfront are a few restaurants:

Famous, the top floor has a view of the river
Pinewood Social
Acme Feed & Seed

Fifth + Broadway

Across from the street from the Ryman Auditorium is Fifth + Broadway a multi-level shopping and restaurant complex, about half the size of a city block. There are 30+ restaurants and food hall inside with options from tapas, to sushi, lobster rolls, Mexican, fried chicken, ice cream, cocktails, a wine bar, pizza, the list goes on. This venue has every type of food imaginable (lobster rolls 🦞🍞 anyone?). There is also an Apple store in this complex.

Nashville

Pastaria

https://eatpastaria.com/nashville/

They freshly make all their pastas and pizzas in house. Great Italian food and cocktails.

Bourbon Sky Bar at the JW Marriott

https://www.marriott.com/en-us/hotels/bnajw-jw-marriott-nashville/dining/

Vallet is free for 4 hours. The bar is located near the top of the hotel’s main tower on the 34th floor. It has terrace seating extending past the building's edge which gives it an expansive view of the city from high above.

Other Things To Do

Historic Downton Murfreesboro

Downtown Murfreesboro has a main square with an ornate courthouse in its center. There is a variety of restaurants and shopping in the squares and the blocks around it, including:

Middle Tennessee State Univeristy (MTSU) is nearby as well. Following Main Street from the Courthouse to MTSU is a scenic drive or a nice walk with beautiful historic homes in Victorian and Georgian styles.

Parnassus Books

https://www.parnassusbooks.net/

A cool locally-owned independent book shop, founded by writer Ann Patchett. If you’re looking for somewhere different to relax, read, and pick up a few books. David Sedaris does readings here on his book tours. They also have a book bus named Pegasus — Peggy for short — which is like a food truck except it's a bookstore on wheels.