Mentions

@Prince_Canuma @speridlabs man just did the same as well idol-sdk#5

I made native C++ tools for working with Windows input devices I build Windows tools for people writing remappers and device-test software. The main distinction is changing input from a physical device versus creating a new virtual one. Interceptor Keyboard & Mouse handles physical keyboards and mice separately: TitanCSA/Interceptor-Keyboard-Mouse Interceptor is the combined keyboard/mouse/controller edition using Get_Input_With_Timeout()/Send_Input(). Existing apps using that API should keep its matching SDK and driver: TitanCSA/Interceptor Interceptor Gamepad & Controller focuses on physical controllers, with examples for button swaps, inversion, deadzones and response curves: TitanCSA/Interceptor-Gamepad-Controller Vdevice creates virtual USB devices from descriptors and reports, with keyboard, mouse and controller examples: TitanCSA/Vdevice Windows Input Bridge is a separate combined edition using Read()/Write() and move-only batches. Choose it to evaluate that API; it isn't a drop-in Interceptor update. Live hardware validation of this new edition is still pending: StrikeFound/Windows-Input-Bridge I also maintain smaller tools for input replay, HID fixtures, controller reports, driver diagnostics and other Windows integrations. This directory lists their scope and whether they're an evaluation or source preview: titanfyre/Titan-Input-Tools The input projects target Windows 10/11 x64 and include C++ SDKs and examples. User-mode source is MIT; kernel source is private, with separate binary terms. The public input-driver demos require administrator rights and last one hour per Windows kernel boot. Each edition needs its matching driver and SDK; controller compatibility depends on the model and connection. For a full input-driver version without the demo limit or commercial/OEM licensing, add titancsa on Discord and mention the project and intended use. Pricing and terms are discussed directly.

GitHub: to4kawa/lyric-pv コードのみ公開。サンプル曲・音源・画像・動画は含めていません。

着想もタグ付け対象になるのか、ProtoFluxがタグ付け対象になるのか見もの Resonite-Issues#7440

AI 做的介面總不像公司？GitHub Replica 讓原型照規範走｜AI 開工 先提供團隊元件與設計規範，再用對話做可操作原型。原型仍需檢查，不能直接當正式產品交付。 本機官方列 macOS／Linux，Windows 未實測；台灣仍須符合 Copilot 或模型服務資格，繁中品質未保證。程式 MIT 開源，模型與選用主機費用另計。 你最想先做報名頁，還是訂單管理頁？ 官方公告：github.blog 安裝與授權：github/replica 示意畫面、非實測｜AI 生成旁白，經編輯校對。 #AI開工 #GitHub #Replica

ZParen: a free Common Lisp IDE for macOS, with SBCL included, Vim keys, and a built-in course I like Common Lisp, but I kept losing time to my Emacs and Vim setups, especially after upgrades. So I made a Lisp IDE that works the way I want, and I'd like feedback from people who write Lisp every day. IDE with Learn Lisp Tutorial What it is - A macOS app (Apple silicon, macOS 13+) that includes SBCL and Swank. Open a project folder and Lisp starts. No setup. - One live image per project. Evaluate a form, click the result to inspect the real object, stop in the debugger, fix the code, and use Restart Frame. - Vim keys first, plus SLIME's Emacs sequences (C-c C-c, M-., C-M-f…), parinfer and structural editing. - Projects stay plain ASDF systems, with Quicklisp, ocicl, qlot or vendored dependencies. ZParen adds no files of its own. - It supports Coalton too: .ct files, types on hover, and type errors on the expression Coalton blames. - An optional AI assistant (Claude or Codex) and an MCP server. They run code in your image, not a copy. Leave them unconfigured and they stay out of the way. New in this release: a Learn Lisp course. It follows ANSI Common Lisp and On Lisp. You start a course project with a file and FiveAM tests for each lesson. Each lesson gets a git branch, so your progress is in git history. There are 15 lessons so far, from first forms to macros, conditions and CLOS. The advanced lessons from On Lisp come later. Full disclosure: I built most of it with Claude Code. The repo has a doc on how (built with Claude Code). The app itself is Rust and Tauri with a CodeMirror UI, talking to SBCL over Swank. - Download: github.com/eric-zhu-2019/zparen/releases/latest - Docs: eric-zhu-2019.github.io - Source (MIT): eric-zhu-2019/zparen I hope it helps beginners find their way into Lisp more easily.

Handy: Free Offline Speech-to-Text Dictation for Desktop Handy is a free, open-source desktop app that brings fast, local speech-to-text dictation to Windows, macOS, and Linux. It transcribes audio completely offline using Whisper and Parakeet models with complete privacy. Source: cjpais/Handy Researched, written and narrated with AI tools (Gemini), checked against the sources above. #Shorts #AI #OpenSource

有人把 341 套代码动画风格提示词整理好了，还配了 193 张参考图，免费开源！ 粒子特效、国风剪纸、白板手绘……可以像翻菜单一样挑风格。 选好后，把提示词交给 Claude Code 或 Codex，就能编写 HTML 动画，还能导出 MP4。 项目：XiaoyeCodes/code-animation-prompts t.co

🔥 GitHub急上昇 #1/3 vercel-labs/agent-desktop ⭐ 今日 +2,275 / 累計 9,632 Rust AIエージェント向けのデスクトップ操作CLI／Cライブラリ。macOS・Windows・Linuxで画面を読み取り、要素を指定してクリックや入力などを行えます。 vercel-labs/agent-desktop #MCP #AIエージェント #AI #GitHub

MANAGE HOMEBREW PACKAGES WITH BEAUTIFUL GUI! 🍺 Wickenico WailbrewManages Homebrew packages, casks, and services through a native GUI for macOS. wickenico/WailBrew t.co

i built deepseek-bot deepseek-harness + agent memory & message gateway deepseek harness active like GrokBot or Hermes check it out: rlaope/deepseek-bot t.co

我为 dsh 开发了提示词预测插件 和 Codex 完全相同的体验 只需要打开命令行输入 dsh plugin --profile desktop add dsh-prompt-prediction 即可启用 Github 仓库： QingJ01/dsh-prompt-prediction t.co

@Mundacio Toda la telemetría la desactivas con un debloater como el de Chris Titus ChrisTitusTech/winutil

new open source project just dropped: SaveState lets you declare debug state once, then set it from an in-app overlay or over MCP, with zero taps. Open source, simulator only for now. tjb/SaveState #iOSDev #Swift #SwiftUI #DeveloperTools #OpenSource #AppleDev

@ysk1025 私がMarlinにツルチェン周りのPRしたの7年前。 つ〜くらいのタイムスパンっすね(・∀・) Marlin#13629

@TSatpal45355 @speridlabs yup it does now i just ported it to work on mac idol-sdk#5

AWS Kiro: utilizando IA para se preparar para as certificações da AWS 1. Introdução Este artigo tem como objetivo mostrar para que serve o Kiro Study Buddy e como configurá-lo para estudar para as certificações da AWS. Acertar uma questão no simulado nem sempre significa dominar o assunto, pois uma resposta pode estar correta por eliminação ou até por sorte, sem que o conceito tenha sido realmente compreendido. Por isso, entender o motivo de cada resposta é tão importante quanto acertar a questão. Com o Kiro Study Buddy, é possível resolver questões de simulado, receber feedback sobre as respostas e entender melhor os conceitos de cada alternativa. O Kiro Study Buddy é um power open-source para o Kiro, a IDE com IA da AWS, desenvolvido para tornar esse processo mais completo. Além de selecionar uma alternativa, também é possível justificar a escolha. A partir dessa explicação, a ferramenta analisa o raciocínio, identifica possíveis erros de entendimento e explica por que as demais alternativas estão incorretas. As análises utilizam a documentação oficial da AWS como referência, por meio do AWS Documentation MCP Server. Principais pontos: - Funciona com qualquer certificação da AWS, desde o nível foundational ao professional e specialty. - Não tem backend, banco de dados ou deploy, então, basta apenas instalar e utilizar. A configuração é realizada em poucos minutos. --- 2. Implementação 2.1 Pré-requisitos - É necessário instalar o Kiro IDE - É necessário instalar o uv, que é o gerenciador de pacotes Python que executa o servidor MCP de documentação usado pelo power. -- 2.2 Autenticação no Kiro IDE 1.Após instalar o Kiro IDE, será necessário clicar em “Sign in” para se autenticar, podendo escolher uma das opções de login abaixo: !Image description !Image description -- 2.3 Instalação do power 1.No painel Powers, clicar em “Add Custom Power”, “Import power from GitHub” e colar o endereço do repositório aws-samples/sample-kiro-study-buddy. !Image description 2.O Study Buddy já está disponível: !Image description !Image description 3.Outra forma de instalar é clonar o repositório (git clone https://github.com/aws-samples/sample-kiro-study-buddy), após o clone, clicar em “Powers”, “Import power from a folder” e selecionar a pasta do projeto: !Image description !Image description !Image description 4.O Study Buddy funciona como uma extensão do Kiro, utilizando arquivos markdown e uma configuração MCP para orientar o comportamento da IA durante os estudos. A estrutura define as instruções e os diferentes modos de estudo disponíveis. A estrutura dos arquivos é organizada da seguinte forma: kiro-study-buddy/ ├── POWER.md # metadados e roteamento do power ├── mcp.json # Configuração do servidor MCP de documentação da AWS └── steering/ # Arquivos Markdown com instruções para cada modo de estudo -- 2.4 Study Buddy na prática O Study Buddy pode ser utilizado diretamente no chat do Kiro, onde são realizadas as sessões de estudo. 1.No menu superior, clicar em “File”, “Open Folder”, selecionar a pasta “sample-kiro-study-buddy” que foi clonada. Ao abrir a pasta, o chat abrirá automaticamente no lado direito, com uma aba “New Session” e a tela “Let’s build”. Se o chat não abrir, o atalho é Ctrl+Shift+L, conforme a lista de atalhos apresentadas: !Image description 2.É possível escolher o modelo de IA: !Image description 3.Com o chat aberto, basta enviar uma mensagem informando a prova. Em seguida, o power fará uma checagem inicial e testará a conexão com o AWS Documentation MCP Server. Se essa etapa falhar, será necessário conferir se o uv está instalado corretamente, pois é ele que executa o servidor MCP. Pergunta 1: > “Estou me preparando para a certificação AWS Certified CloudOps Engineer Associate (SOA-C03) e quero começar uma sessão de estudo. Me mostre os domínios da prova, o peso de cada um, o número de questões, o tempo e a nota mínima de aprovação.” Abaixo, o Kiro trouxe as informações referentes ao exame SOA-C03: !Image description !Image description !Image description Guia do exame: docs.aws.amazon.com !Image description - Pergunta 2: > Explique o AWS Systems Manager Patch Manager como ele cai na SOA-C03. Abaixo, resposta do Kiro: !Image description !Image description - Pergunta 3: > Quero fazer um simulado completo da AWS Certified CloudOps Engineer Associate (SOA-C03), com o mesmo número de questões e o mesmo tempo da prova oficial. > Regras: > - Distribua as questões entre os domínios de acordo com o peso de cada um no guia oficial do exame. > - Use cenários no estilo da prova real. > - Baseie as questões e o feedback na documentação atual da AWS e cite as fontes. > - Depois de cada resposta, explique por que a alternativa correta está certa e por que cada uma das outras está errada, com base na documentação oficial. > - No final, mostre a pontuação, o desempenho por domínio, a análise de tempo e os tópicos que preciso revisar. Abaixo, questão de simulado: !Image description !Image description !Image description --- 3. Dicas Além do simulado, muitas outras perguntas podem ser feitas, como: - Comparar serviços parecidos e entender quando usar cada um. - Pedir a explicação de um tema da prova de forma simples, com exemplos. - Praticar um cenário guiado, resolvendo um problema passo a passo. - Desconstruir uma questão errada em outro simulado para entender onde o raciocínio falhou. - Pedir questões de um único domínio, para reforçar um ponto fraco. - Perguntar quais tópicos têm mais peso na prova e por onde começar a estudar. Boas práticas: - Sempre escrever a justificativa: é ali que está o valor da ferramenta, pois responder somente a letra desperdiça o feedback. - Treinar com tempo: o cronômetro ajuda a simular a pressão da prova real. - Levar para a desconstrução as questões erradas em outros simulados: isso ajuda a entender o erro, em vez de só decorar o gabarito. - A documentação e os guias oficiais dos exames continuam sendo uma base muito importante do estudo, o Study Buddy entra como complemento. --- 4. Conclusão O Kiro Study Buddy muda o foco da preparação, em vez de contar apenas acertos, ele analisa como se chegou à resposta e aponta onde está a lacuna, sempre com a documentação oficial como referência. Para quem está começando a se preparar para uma certificação, um bom ponto de partida é um simulado curto de 10 questões, com justificativas bem escritas em cada resposta e conforme avançar nos estudos, aumentar o número de questões. Na reta final da preparação, o ideal é praticar simulados completos de 65 questões para se familiarizar com a quantidade na hora do exame. Links úteis: - Repositório do Kiro Study Buddy - AWS Documentation MCP Server - [Guias oficiais dos exames AWS ](docs.aws.amazon.com) - Kiro IDE - Instalação do uv

LLMJacking: Stolen Credentials Fuel LLM Access Resale and $1M in Cumulative Charges 1. Overview - Article: The Rise of LLMJacking: How Threat Actors Monetize Compromised Cloud and Model Resources - Source: Google Threat Intelligence Group - Published: 2026-11-02 - Original: Google Threat Intelligence Group - Related Source: LiteLLM Official Advisory: CVE Matching Check - Related Malware: ai-relay - Related Threat Group: UNC6993 - Related CVE: CVE-2026-40217 (Discrepancy noted between Google's report and LiteLLM's official advisory response) - Related Products: Cloud IAM, LLM API, LiteLLM, new-api, gcli2api - Severity: critical 2. Executive Summary Multiple threat actors are abusing stolen cloud credentials, LLM API keys, and public endpoints to resell LLM quotas to third parties. Mandiant confirmed an incident where a victim organization incurred approximately $1 million in unauthorized usage charges before access was revoked. Note that pathways involving privilege escalation or persistence in cloud environments must be distinguished from pathways that directly abuse LLM API keys or public endpoints. 3. Attack Flow Alternative pathways and monetization flows compiled by Google from multiple response cases. Path A, Path B, and subsequent monetization have different prerequisites and scopes, and the observed tools and actions were not all executed consecutively in a single incident. | Pathway / Phase | Initial Target | Prerequisites and Required Privileges | Confirmed Scope of Impact and Limitations | | --- | --- | --- | --- | | Attack Path A: Compromising Environments via Cloud Credentials | Exposed or stolen IAM credentials, service account keys, GitHub PATs, session tokens, acquired Virtual Keys | Operating permissions allowed by the target ID or vulnerability exploitation (service enablement, key creation, GPU creation require respective privileges) | Credential theft, persistence via admin privileges or SSH keys, LLM enablement and quota expansion (aggregation of multiple incidents) | | Attack Path B: Direct Abuse of LLM API Keys or Public Endpoints | LLM API keys in public repositories, public Ollama endpoints reachable without authentication | Valid API key with inference privileges and quota, or public endpoint accepting requests | Unauthorized execution of inference and attempts to register custom models via /api/create (does not imply obtaining cloud management privileges or GPU creation rights) | | Subsequent Monetization: Resale via LLM Mixers and Proxies | LLM access and quotas secured through Path A, B, etc. | Aggregation and routing of multiple keys via gateways or relay tools | Resale of quotas to third parties and generation of heavy charges (distinct from direct sale of stolen tokens; not all threat actors use the same tools) | Attack Path A: Compromising Environments via Cloud Credentials 1. Using exposed or stolen IAM credentials, service account keys, PATs, or session tokens to access corresponding cloud environments or repositories. 2. Enumerating cloud services, repositories, and data stores depending on the incident to search for additional credentials or high-privilege IDs. 3. When the required privileges are available, attackers expand their privileges or persistence through service account creation, administrator policy attachment, SSH key injection, and token generation. A separate threat cluster was reported to have escalated to LiteLLM administrative privileges using pre-acquired Virtual Keys. 4. Enabling managed LLM services with obtained privileges, creating additional API keys and GPU instances, and requesting quota increases. These operations were observed across multiple separate incidents and were not all executed in a single attack. Attack Path B: Direct Abuse of LLM API Keys or Public Endpoints 1. Sending minimal requests such as max_tokens=1 to LLM API keys found in public repositories to verify their validity has been confirmed. 2. Executing inference within the scope of privileges and quotas of validated API keys. This path alone does not grant cloud-wide management console privileges or GPU instance creation rights. 3. In a separate incident involving a public Ollama endpoint, an attacker called /api/create to attempt registering and executing a custom model. Subsequent Monetization: Resale via LLM Mixers and Proxies 1. Bundling unauthorized LLM access via gateways or relay infrastructure to resell inference quotas to third parties. This is distinct from directly selling stolen tokens themselves. 2. UNC6993 utilizes new-api and gcli2api. Google infers the aggregation and load balancing of stolen keys alongside sales via underground storefronts, though this does not mean all threat actors use the same toolset. 3. In another incident, stolen API keys were used on resale platforms such as jet-night.com and newapi.pro via ai-relay. 4. Attacker Positioning and Execution Locations - Depending on the attack path, access targets include public repositories, public LLM endpoints, cloud IAM, model gateways, and containerized workloads. In paths abusing only LLM API keys, compromise of management consoles or compute instances within the victim's cloud was not confirmed. 5. Perspective of Victims and Administrators Victims - Manifests as a sudden spike in LLM API usage fees, exhausted quotas, unfamiliar model usage, or service suspensions. Administrators - Observed as the enablement of unused LLM services, creation of API keys or service accounts, changes to IAM policies, addition of SSH metadata, repository cloning, access to secret management infrastructure, and creation of GPU instances. 6. Conditions for Success and Failure Success Conditions - In pathways abusing cloud credentials, cloud/repository operations permitted by the ID serve as the starting point. Privilege escalation, LLM service enablement, key creation, and compute creation each require corresponding privileges or vulnerability exploitation. - Pathways abusing LLM API keys require valid keys along with model invocation privileges and quotas, while public endpoint pathways require states that accept requests without authentication or similar constraints. Cloud management privileges are not mandatory for these paths. - In the LiteLLM privilege escalation incident, attackers used pre-acquired Virtual Keys. For discrepancies between CVE numbers and patched version mappings, refer to the caveats in Sections 12 and 14. Failure Conditions and Countermeasures - Apply secret scanning, short-lived credentials, phishing-resistant MFA, the principle of least privilege, explicit Deny rules for unused LLM privileges, and key scope isolation. - Contain damage expansion through model-specific quota limits, budget alerts, rate limits, network allowlists, and prompt updates and protection of model gateways. 7. What Happens Upon Success - Secrets, database passwords, and external service API keys on the cloud are stolen. - Access is persisted via the creation of administrator privilege IDs or the addition of SSH keys. - LLM quotas and GPU compute are abused and resold. Mandiant reported unauthorized usage exceeding $100,000 per day and unauthorized charges reaching approximately $1 million for certain organizations before access was revoked (it is not explained that the entire $1 million occurred in under 8 hours). - The victim organization's account is abused for third-party activities through the resold resources. 8. Observable Logs - Email: Invitation emails or fake portal URL guidance prompting the pasting of raw JSON tokens. - Proxy / SWG / DNS: Traffic records to jet-night.com, newapi.pro, unknown LLM proxies, and public Ollama endpoints. - Endpoint / EDR: Execution of cloud CLIs, repository cloning, external transmission of archives via curl/wget, and modification of SSH keys. - Identity / IdP: Creation of service accounts or access keys, token generation, issuance of federation tokens, administrator policy attachment, and suspicious sessions. - SaaS / Cloud: Enablement of LLM services, model invocations, API key creation, quota increase requests, GPU instance launches, access to secret management infrastructure, and surges in billing amounts. - Network: High-frequency inference requests following validation traffic via minimal requests such as max_tokens=1, burst traffic to multiple regions, and outbound traffic to unknown relay servers. 9. Attack Success Assessment Malware Execution or Authentication Success Confirmed - Judgment Stage: Malware Execution or Authentication Success Confirmed (malware_or_authentication_success) / Scope: Multiple cloud compromise incidents - Basis: Public Information: Google reported multiple incidents where attackers actually accessed cloud environments and LLM APIs using stolen tokens and API keys. Information Theft or Session Compromise Confirmed - Judgment Stage: Information Theft or Session Compromise Confirmed (data_or_session_compromise) / Scope: Multiple cloud compromise incidents - Basis: Public Information: Theft of credentials and secrets from repositories, secret management infrastructure, and data stores has been confirmed. Follow-on Compromise Confirmed - Judgment Stage: Follow-on Compromise Confirmed (follow_on_compromise) / Scope: Monetization of LLM resources - Basis: Public Information: Creation of unauthorized accounts, API keys, and GPU instances, enablement of LLM services, and resale and billing generation via LLM Mixers have all been confirmed. 10. Investigation Playbook Trigger - Use sudden surges in LLM billing, enablement of unused services, creation of unfamiliar API keys or service accounts, and validation traffic with max_tokens=1 as investigation triggers. Initial Triage - Identify billed accounts, invoked models, key IDs, execution principals, source IPs, User-Agents, request frequencies, and the timestamp when services were initially enabled. Endpoint - Preserve processes, SSH keys, startup scripts, containers, repository clone artifacts, archive creation logs, and outbound traffic records for related workloads. Identity / Cloud - Cross-reference IAM change histories, token generation, federation settings, secret access events, PAT usage histories, and GitHub audit logs. Follow-on Compromise - Track the deployment or abuse of new-api, gcli2api, LiteLLM, and ai-relay, unauthorized GPU instances, connections to public proxies, and the theft of credentials for other clouds. Containment - Revoke abused keys, sessions, and tokens, isolate unauthorized IDs and instances, disable unnecessary LLM services and quotas, and rotate related secrets. Assessment - Evaluate key validity checks, cloud logins, secret theft, persistence, resource abuse, and external resale as distinct stages. 11. Defense and Detection Ideas Single Event Detection - Detect the enablement of normally disabled LLM services, generation of PROXY_ADMIN keys, attachment of administrator policies, and addition of SSH keys project-wide. Time-Series Correlation - Correlate key validation via minimal requests, service enablement, key/account creation, quota increases, massive inference invocations, and billing surges as an integrated attack chain. Hunting Perspectives - Uncover LLM API keys, service account JSON files, and PATs lingering in public and private repositories, and cross-reference them with unknown sources in usage logs. Blind Spots in Log Design - Missing model gateway request bodies, key IDs, cloud audit logs, or billing exports will delay the discovery of unauthorized use and the identification of cost sources. Priority Countermeasures - Prioritize migration to short-lived credentials, enforcement of least privilege and key scope limitations, setting quota and budget limits, secret scanning, and gateway vulnerability remediation. 12. Facts / Inference / Hypothesis Facts - In 2026, Mandiant responded to LLMJacking incidents across multiple organizations in North America, South America, and the Asia-Pacific region spanning financial, retail, technology, and transportation sectors. - The primary initial access vector across multiple incidents consisted of exposed or stolen cloud credentials, including IAM credentials, service account keys, GitHub PATs, and valid session tokens. Additionally, public LLM endpoints and LLM API keys found in public repositories were abused. - UNC6993 breached cloud instances using misconfigured service account keys, while another tactic bypassed passwords and MFA via fake portals prompting users to paste raw JSON containing valid access tokens. - Attackers verified LLM API key validity using minimal requests with max_tokens=1 to evade detection triggered by normal traffic volume anomalies. - Following intrusion, activities confirmed included cloud service, repository, and data store enumeration, cloning of private repositories, credential theft from secret management infrastructure, creation of IAM/service accounts, SSH key injection, and administrator policy attachment. - Google reported an incident where pre-acquired Virtual Keys were used to exploit user ID rebind in LiteLLM's /key/regenerate, escalating privileges to PROXY_ADMIN and mapping it to CVE-2026-40217. Meanwhile, LiteLLM's official advisory GHSA-wxxx-gvqv-xp7p describes the same CVE number as a sandbox escape in /guardrails/test_custom_code, meaning target endpoints, prerequisite privileges, and impacts differ, leaving the mapping unresolved. - Attackers enabled managed LLM services, added API keys, created GPU instances, increased quotas, executed burn-and-rotate of service accounts, and resold secured quotas via LLM Mixers or reverse proxies. - Google reported that an attacker performed over 500,000 LLM API invocations in under 8 hours, utilizing stolen API keys for token routing on jet-night.com. In the same Jet Night incident, approximately $1 million in costs was shifted to the victim organization. However, it is not explicitly stated that this billing aggregation period matches the under-8-hour window. In other separate incidents, unauthorized usage exceeding $100,000 per day was observed. Inference - While not all low-priced LLM gateways utilize stolen resources, Google assesses based on matching pricing, scale of usage, and outage patterns that Jet Night relies on stolen keys. Hypothesis No additional hypotheses. Unverified items are documented under "Uncertainties and Limitations". 13. MITRE ATT&CK Mapping | ID | Technique | Confidence | Basis | | --- | --- | --- | --- | | T1078 | Valid Accounts | high | Accessed the cloud using stolen IAM credentials, service account keys, PATs, and session tokens. | | T1098 | Account Manipulation | high | Established persistence through IAM/service account creation, administrator policy attachment, and SSH key injection. | | T1552.001 | Credentials In Files | high | Searched for and stole keys and credentials stored in files within public and private repositories. API access to secret management infrastructure is not included in this mapping. | | T1496 | Resource Hijacking | high | Diverted LLM API quotas and GPU compute to third-party services. | 14. Uncertainties and Limitations - Individual victim organization names, details of all threat clusters, purchasers of resold resources, and total financial damages have not been publicly disclosed. The ~$1 million figure for the Jet Night incident represents an individual case cost reported by Google and is not a general value across all incidents. It remains unspecified whether the billing aggregation period matches the under-8-hour window during which over 500,000 API calls were observed. - Regarding the privilege escalation in LiteLLM /key/regenerate reported by Google, the correct CVE mapping, affected versions, and fixed versions remain unconfirmed. Care must be taken not to directly apply patched versions for alternative endpoints described in the official GHSA as a countermeasure for this vector. 15. Impact on SOCs and Organizations Organizations should treat LLM API keys as high-value cloud resources and monitor service enablement, API key creation, low-volume key-validation requests, quota increases, spikes in inference-token consumption, and billing changes together. They should also investigate GitHub PATs, service account keys, federation tokens, and model gateways across the different intrusion paths that can lead to LLM abuse. 16. Summary by Role - SOC: Correlate validation traffic with max_tokens=1, LLM service enablement, API key creation, quota increases, and spikes in inference requests across a timeline. - Administrators: Design out unnecessary LLM API privileges via explicit Deny rules, enforce key scope isolation, quotas, budget limits, and rotation, and ensure thorough protection and updates for model gateways. - Users: Do not trust external portals demanding cloud tokens or raw JSON pasting, and immediately revoke keys suspected of exposure.

@rikiyatakehi @a1zhang @lateinteraction @jayden_teoh_ Did something similar! Glad you did the full fledged research on it! Excited for what's coming! Volkopat/Qwen3.8-27B-Neuron-Dictionary

Nobody Prompted It. It Answered With a Pull Request. A finished pull request, tests green — and nobody sat there prompting it. The request was one chat message. DeepSeek's Super-Agent (dsh-superagent), open-sourced October 31, 2026, is a proactive coding agent that lives inside one GitHub repository: a router takes requests from GitHub and team chat, isolated worker sessions run the jobs in parallel, and the agent answers in the original thread with the work itself — for example, a pull request ready for review. Its stated design principle: "take as little human attention as possible, and give as much value as possible." The repo passed 13,073 stars and 1,357 forks within three days of release (MIT license). The speed figure is DeepSeek's own simulated testing, not an independent benchmark: in simulations, median task completion was 12.4 minutes and the slowest 5% of tasks finished in 15.7 minutes, down from 29.5. DeepSeek is blunt about the limits — the README calls it "a research prototype for reference only, not an official DeepSeek product," warns the code may still contain bugs, and notes the public version is not identical to its internal one. Sources: - DeepSeek — dsh-superagent-prototype (GitHub, Oct 31, 2026): deepseek-ai/dsh-superagent-prototype Follow Tech Signal for fast, sourced tech explainers. #AI #DeepSeek #CodingAgents #OpenSource #Shorts

I mostly use Excel for data analysis and JS Recon, with the addition of the following 2 plugins 1. ranxianglei/billion-context 2. dream-num/dsh-univer-office t.co

Handling 2026 Moderation API Timeout Errors in Node.js (Retry Logic) Short answer: handling moderation API timeout errors in Node.js means setting a per-attempt deadline, retrying only transient failures with jitter, making the catalog write idempotent, and recording every attempt against its tenant. Moderation timeouts in a customer-support catalog pipeline are a bounded decision, not a reason to blindly replay work. The before state is a queue that says only failed. The after state says which tenant, catalog item, attempt, elapsed time, and outcome consumed the budget. That context matters when messy product descriptions are enriched before an agent sees them. A timeout can leave the item pending for later review while the rest of the catalog keeps moving. A retry can help. Three retries without a deadline can turn one slow request into a noisy cost event. What should a timeout mean in this pipeline? A timeout is an application decision about elapsed time. It is not proof that the remote operation did not run. If the client gives up after receiving no response, the server may have completed the request, or it may still be working. Retrying a non-idempotent side effect can duplicate work. I initially thought the timeout itself was the failure. Later, the sharper question became: which state can be proved, and which state is merely unknown? Unknown is a state. For catalog enrichment, keep the moderation call separate from the write that publishes normalized attributes. Give each item a stable job key such as tenantId:itemId:revision. Store results under that revision. A repeated attempt then updates the same record instead of creating a second catalog version. Here is the mental model: deadline outside, retry policy in the middle, durable state underneath. The deadline answers “how long can this item wait?” The retry policy answers “which failures deserve another attempt?” Durable state answers “what do we know if the process disappears now?” The policy should respect the tenant boundary. A large backlog must not consume the entire worker's retry capacity while a smaller tenant waits. Per-tenant counters and a shared concurrency limit make that visible and enforceable. How does bounded retry logic look in Node.js? This example uses the standard AbortController interface and a generic moderation endpoint. It retries transport failures and selected 5xx responses, but not a rejected content decision or a malformed request. Jitter prevents workers from waking on the same schedule. type ModerationInput = { tenantId: string; itemId: string; revision: number; text: string; }; type ModerationResult = { allowed: boolean; labels: string[] }; const sleep = (ms: number): Promise<void> => new Promise((resolve) => setTimeout(resolve, ms)); const isRetryableStatus = (status: number): boolean => status === 408 || status === 425 || status === 429 || status >= 500; async function moderateWithBudget( input: ModerationInput, options: { attempts: number; timeoutMs: number; baseDelayMs: number }, ): Promise<ModerationResult> { let lastError: unknown; for (let attempt = 1; attempt <= options.attempts; attempt += 1) { const controller = new AbortController(); const timer = setTimeout(() => controller.abort(), options.timeoutMs); const startedAt = Date.now(); try { const response = await fetch("https://moderation.example.invalid", { method: "POST", headers: { "content-type": "application/json" }, body: JSON.stringify({ requestKey: `${input.tenantId}:${input.itemId}:${input.revision}`, text: input.text, }), signal: controller.signal, }); if (!response.ok) { const error = new Error(`moderation returned ${response.status}`); if (!isRetryableStatus(response.status) || attempt === options.attempts) { throw error; } lastError = error; } else { return (await response.json()) as ModerationResult; } } catch (error) { lastError = error; if (attempt === options.attempts) throw error; } finally { clearTimeout(timer); recordAttempt({ tenantId: input.tenantId, itemId: input.itemId, attempt, elapsedMs: Date.now() - startedAt, }); } const jitterMs = Math.floor(Math.random() * options.baseDelayMs); await sleep(options.baseDelayMs * attempt + jitterMs); } throw lastError instanceof Error ? lastError : new Error("moderation failed"); } function recordAttempt(event: { tenantId: string; itemId: string; attempt: number; elapsedMs: number; }): void { // Send this to metrics and structured logs with bounded dimensions. void event; } The finally block is deliberate. It records latency for success, rejection, timeout, and transport errors. In a real worker, replace recordAttempt with an OpenTelemetry span plus a counter whose dimensions are bounded. Do not put raw descriptions in logs. They are customer content, and they add no value to a timeout dashboard. One hard boundary matters: an aborted fetch does not cancel work that has already reached the remote service. The stable request key and idempotent persistence layer make replay safe. If the endpoint cannot accept an idempotency key, keep the remote call read-only or route uncertain outcomes to review instead of automatically repeating a side effect. This approach is a poor fit for a side effect that cannot be made idempotent and cannot tolerate an uncertain result. In that case, a manual review boundary is safer than adding retries, even when the queue gets slower. The boundary needs a durable record containing the tenant, item revision, request start time, last known response class, and the reason the worker stopped. Without those fields, a reviewer cannot tell an ordinary rejection from an ambiguous timeout, and an operator cannot tell a busy tenant from a failing dependency. That extra state is operational work, but it is cheaper than silently publishing a duplicate attribute set or charging the wrong tenant for repeated attempts. Which signals expose cost per tenant? A single error rate hides the operational story. Emit an attempt event with tenant_id, job_type, item_revision, attempt, outcome, status_class, elapsed_ms, and a usage field when the service returns one. Keep item identifiers in traces or logs, not in a metrics label set queried across every tenant. I start with four measurements: requests by outcome, timeout rate, retry count, and elapsed time. Then I add a tenant-level usage view. The important calculation is attribution: how many moderation attempts did each tenant's catalog revision create, and how many ended in review? The dashboard should make a before-and-after comparison possible. Before instrumentation, a worker shows 200 jobs processed and 12 failures. After instrumentation, the same interval can show 180 first-pass successes, 14 transient retries, 4 permanent rejections, and 2 items awaiting review, split by tenant. That is enough information to choose a queue limit or investigate a bad input batch without guessing. Alert on behavior that needs action: a sustained rise in timeouts, repeated retries for one tenant, or a growing review queue. An alert on every timeout trains the team to ignore alerts. The trade-off is deliberate: more state to store and inspect in exchange for a defensible tenant-level usage trail. What do the common objections miss? “Can I just retry every timeout?” Only if the operation is safe to repeat and the retry budget is smaller than the time available for the item. Otherwise, a retry can amplify load while hiding the real failure. Use exponential delay with jitter, cap attempts, and persist the uncertain result. A review state is a product decision, not an exception-handling afterthought. “Why track tenant context if the worker is shared?” Shared capacity creates shared failure. Tenant context distinguishes a broad service problem from one import producing unusually long descriptions or repeated revisions. It also supports fair scheduling. Keep the context in authorization-aware telemetry with suitable access controls and retention. The practical test is boring and valuable: kill the worker after the request is sent, replay the same revision, send a 429, send a 503, and hold the response past the deadline. The expected result is deterministic state: one revision, bounded attempts, visible tenant usage, and a review path when certainty is impossible. That is the retry behavior worth shipping. Further reading - developer.mozilla.org - rfc-editor.org - opentelemetry.io - openai/whisper

A 744B AI Model on a Normal Laptop? This Free Tool Tries 🐦 #shorts colibri is a free, open-source (Apache-2.0) engine in pure C that runs huge mixture-of-experts AI models on hardware you already own. 46,287 stars on GitHub (as of 2 Nov 2026). From the project's README: - GLM-5.2 has 744B parameters but uses about 40B for each token - The dense part stays in RAM; the routed experts stay on disk and are read when needed - Needs at least 8 GB of RAM (16 GB or more is better) and 22 GB free disk for the smallest model; a graphics card is optional - Qwen3.6-35B-A3B: 9.9 tokens/s with Vulkan on the integrated Radeon 780M of a Ryzen 7 PRO 8700GE desktop - The honest catch: GLM-5.2 runs at 0.05-0.1 tokens/s cold on a 25 GB laptop ("slowly and correctly") - Windows: Code, then Download ZIP, unzip, double-click START-HERE.bat Each model keeps its own licence (Qwen-Image-2.1 is non-commercial). Sources: JustVugg/colibri This channel is not affiliated with colibri's author, Zhipu (GLM), Alibaba (Qwen), AMD or GitHub. #AI #LocalAI #LocalLLM #OpenSource #AITools #LLM #shorts

career-ops: the AI that tells you which jobs NOT to apply to Tired of applying to job after job and hearing nothing back? 👇 The problem might not be your CV. It might be which jobs you apply to. career-ops scores every posting against your real CV. Below 4/5, it tells you to skip it. Above that, it drafts your CV, cover letter and answers. You press Submit. By the author's own count: 740 jobs evaluated → 68 applications → 12 interviews → 1 offer. Runs in the Claude desktop app (Code tab, paid plan), Codex or a free CLI. Your files stay on your machine. career-ops is an independent open-source project by Santiago Fernández de Valderrama (santifer), not affiliated with Anthropic. Link: career-ops-hq/career-ops Easiest setup (Claude desktop app): 1) Customize → Plugins → Add marketplace → career-ops-hq/career-ops, then Add. 2) New session in the Code tab: /career-ops:career-ops. It walks you through your CV and profile. 3) Paste a job URL. It scores the fit; below 4/5 it says skip (you can override). Other options: Codex, OpenCode or the free Antigravity CLI (npx @santifer/career-ops init). Node.js needed; Chromium only for PDFs. Read every CV before you send it and follow each job site's terms. #jobsearch #AItools #ClaudeAI #careers #opensource

コンテナクエリ関連の単位追加の要望送りました gutenberg#86217

Stunt Race FX running natively on Wii U (widescreen, rumble, longer draw distance). WIP, looking for bug testers! I've been tinkering with this for a while and figured it'd be fun to have people help me bug-check it. It's an unofficial Wii U port of Stunt Race FX that runs the game natively instead of in an emulator. It's built on Jeff's CC0 decompilation of the game. This game was always a favourite of mine, and it’s nice to see it have some great quality of life features that really make it more playable and fair. Some of what I've added: - 16:9 widescreen at 720p, including the title screen and menus - A longer draw distance, so you can see turns coming - Analog steering - Rumble for wall hits, crashes, and a light buzz on grass - A pause menu with settings - Resume where you left off It's still very much a work in progress. But honestly, it’s at a place where I’m pretty happy with it in comparison to when I started. You might see the odd gap in the road or a quick 4:3-to-widescreen flicker before a race, but it plays pretty well. It was made with AI and bug-checked with love. Hopefully you enjoy it! No ROM is included, so you'll need your own (USA Rev 1). Install steps are in the README: ZeusLovesTrains/stunt-race-fx-wiiu If you find a bug, open an issue or comment here and let me know. Thanks to Jeff (jeff-strutb) for the decomp and to Mabec-games for ideas.

Thanks for all the positive feedback. FramePlayerX 0.16 is out now with Plex support and a lot of fixes I received a lot of positive and constructive feedback the last time I posted and the features have progressed rapidly. I just pushed out a new release with - Plex support - Background colour customisation - Queue shuffle - Tons of bug fixes In addition to that since the last time I posted I have already released - Transcoding support for Jellyfin, Plex, Emby, Heresphere and DeoVR (if the server supports it) - New features in the player like loop video, loop playlist, auto play next video, etc - Phone remote has been redesigned - Support for other languages for the interface as well subtitles - Blu ray disc images are playable - A lot of UI improvements while browsing Jellyfin/Emby/Plex/DeoVR/Heresphere including filtering and sorting There were a lot of performance improvements made along the way and more are planned. Please see release notes for more information. remotesojourner/frameplayerx Feedback and contributions are always welcome github.com/remotesojourner/frameplayerx/issues

@speridlabs idol-sdk#5 check this it now runs on device as well on macos

School Pulse. one board for my kids' grades and what's due tonight, instead of a nightly text. pulls PowerSchool, OneNote and Google Classroom. built in an afternoon. three cloud agents raced versions, a fourth tested them and kept the best parts. BoydVC/school-pulse t.co

Prowlarr 点索引源还跳 127.0.0.1？ Settings → General → Application URL 改成隧道 https 地址，保存。 本地先确认： curl -I 127.0.0.1:9696 cftunnel quick 9696 → 免费 https 域名。 免费内网穿透 + 反向代理，MIT： qingchencloud/cftunnel cftunnel.qt.cool t.co

Effekseer1.80.8が出てるので、HSPのhgimg4＆hgimg4dxで利用できるようにしてみましたー。（GPT-6.0 Astraで作成しています） hatakoma/effekseer_hsp3_HGIMG4 #HSP3 t.co

Easiest way to run pooled and secure LLMs at scale: Companion Hub Other solutions are good at running workloads, or being easy to use, or running AI. Hub is all 3 in one! github.com/companionintelligence/Companion-Hub/bl… 🛍️ App store for your own server One-click installs from the Companion Intelligence marketplace, with open-source alternatives for the services you pay for today. 🧠 Local AI that fits the box Onboarding reads your CPU, GPU, memory, and storage, then recommends models that fit. Voice, text, and image share one queue so they do not stampede the machine. 🤖 Agents with a home OpenClaw, Hermes, and other agents install like any app. They read one shared Companion Memory instead of each keeping a private scrapbook. Run your first agent 🔌 MCP nexus Hub serves one Model Context Protocol endpoint. Agents discover, install, and drive every app through a single tool surface. 📦 Bring your own container Marketplace apps, custom Compose, and git repos you bring. Apps on apps are allowed. A server in a server is allowed. 🌐 Reach it your way Keep each app on this machine, share it over a private Tailscale network, or publish it to the web through Cloudflare. Networking · From your phone 🔗 Pool your machines Pair more than one Hub over Tailscale and they share inference work by queue depth. 🔑 OpenAI-compatible API Point Cursor, Continue, Cline, Aider, Zed, or an OpenAI SDK at your Hub, and keep the engines you already run. Source & Download: companionintelligence/Companion-Hub

Hourly Ticks Reintroduced Mod for 1.4 Since Paradox removed hourly ticks, I made a mod that adds hourly ticks back in 1.4. It adds back the 12 daily ticks and battles and army/navy movement now happen at the hourly tick rate. It has 7 speeds, with the latter 5 matching vanilla 5 speeds. From my test, this hourly ticks implementation adds about a 13% slowdown on the highest game speed since it works by running the daily task function every hour. One year on my machine lasted 29.5s in vanilla, and 33.4s with the hourly tick mod enabled. If Paradox implemented this and only ran daily tasks daily, I suspect lower slowdowns could be achieved. Performance on speeds lower than max should not be affected by hourly ticks change. When switching to daily ticks, devs decided to not let hourly ticks be an option for normal mods by way of scripting, so I had to reintroduce them with a dll library, akin to TW Attila's "Attila Engine Performance Fix" mod. Installation steps are in mod description. The dll contains no (RE) paradox code. Workshop: steamcommunity.com Mod code can be found at: OfficePins/EU5-Hourly-Ticks-Reintroduced

A visual, step-by-step explanation of how self-attention works Self-attention confused me for a long time, so I tried to break it into steps you can actually see: 1. Every token gets three vectors. Each word’s embedding is multiplied by three learned matrices to produce a Query (what am I looking for?), a Key (what do I contain?) and a Value (what do I pass on?). 2. Compare queries with keys. For each token, take the dot product of its Query with every token’s Key. A high score means “this token is relevant to me”. 3. Scale and softmax. Divide the scores by √d (the key dimension) so they don’t get too large, then apply softmax. Now every token has a set of weights that sum to 1. 4. Mix the values. Each token’s new representation is the weighted sum of all Values. In “The cat sat because it was tired”, the word it ends up with a high weight on cat. 5. Do it several times in parallel. Multi-head attention runs this with different matrices at the same time, so one head can track grammar while another tracks meaning. The diagram has a step-by-step mode that highlights each part in order. That helped me more than staring at the formula softmax(QKᵀ/√d)·V. I made it with Sketchy, a free open-source tool I built that lets Claude explain things as interactive diagrams: GitHub

An MIT-licensed frontend design and verification workflow for coding agents I’m the author of RC’s Frontend Skill, a free and MIT-licensed instruction package for coding agents. The project addresses a gap I kept seeing in agent-assisted frontend work: generating syntactically valid UI is much easier than maintaining a coherent design system, preserving application behavior, handling accessibility and responsive states, and verifying the rendered result. The workflow instructs an agent to: 1. Inspect the existing project, routes, dependencies, and backend assumptions. 2. Choose a defensible visual direction rather than combining unrelated trends. 3. Preserve real APIs, authentication, forms, validation, and application states. 4. Implement responsive and semantic UI within the existing stack. 5. Treat motion and WebGL as progressive enhancements with reduced-motion and low-power fallbacks. 6. Test builds, keyboard behavior, accessibility, responsive layouts, overflow, and critical interactions. 7. Separate verified evidence from assumptions in the final report. The repository contains SKILL.md, focused reference guides, contribution documentation, validation tests, and two read-only project-audit helpers. It does not include a hosted API, paid tier, model access, or telemetry. Repository: RitvikChunamari/rcs-frontend-skill Install: npx skills add RitvikChunamari/rcs-frontend-skill I’m interested in technical feedback on instruction structure, agent compliance, context cost, portability, and methods for evaluating whether these workflows materially improve frontend output.

came across a neat image to 3d model recently that creates gaussian splatters and ported it to run on a mac os for fun, @speridlabs idol 3 is the model and here is the pr idol-sdk#5

Reading Is Not Steering: Symbol-Readers Concept-Controllers in SAE's

Looking for Android Beta Testers: Help Improve Live Radio Captions Hi DEV Community! I'm Roman Eklmn, an independent developer behind RadioText AI, a free experimental Android app for listening to internet radio while reading live speech captions. I'm working to make radio more accessible, including for Deaf and hard-of-hearing listeners. I'm looking for volunteer testers for RadioText AI v0.3.0 Beta Test v18. What to test - Installation and first launch on Android - Internet radio playback and stability - Accuracy and readability of live captions - Russian and English speech recognition - Navigation, accessibility and usability - Bugs, crashes and confusing screens Speech recognition and contest detection are experimental. Captions may be inaccurate or delayed, particularly with music, noise or changing languages. Join the free test Beta Family invitation: betafamily.com Android APK release: github.com/OskolElkin/RadioText-AI-Releases/relea… Create a free tester account if requested, try the app, and submit your observations through Beta Family. The current free testing window ends on November 8, or after 20 volunteer reports, whichever happens first. Please include your Android phone model, Android version, radio station and spoken language. Feedback from Deaf and hard-of-hearing testers is especially valuable. Participation is voluntary and free. There is no paid testing requirement and no purchase is needed. Thanks for helping improve accessibility and the quality of this early project. Roman Eklmn — Eklmn Lab

github.com/morpheapp

So here is a revamped Cavern Duel game, with local networking enabled. Play against a family member (provided they have a RISC OS emulator running) I haven't added it to my website yet but will do soon. I hope it works!🤞 sassquad/cavern-duel

【更新】Megalopolis r52 を公開しました。 作品を全画面リーダーで読めるようにしたり、書体選択、行間選択などの表示設定の追加を行いました。(スマホだけでなく PC でも使えます) ほかにも OGP / Twitter Card 対応、共有シート対応、ダークモード対応などを行っています。 github.com/mfakane/Megalopolis/releases/tag/r52 t.co

Issues still open: render loses the last 1-3 frames (issue 19), mix outputs final AAC at 96 kHz (issue 18), frame names with decimal seconds sort wrong (issue 22). Good first issues are labeled with a done-when line. Code: itzjk/explainkit

I went a little further than I did previously, thanks to it being 2026 and I can antagonize half a dozen frontier LLMs :) My original was bolted onto a Transformer-XL that was trained from scratch. zxexz/kgmem

@OmniaKey_Team The video budget check is a useful place for a guardrail. OmniaKey’s local MCP looks like a fit for HOL Guard; if you want to add it, the server contribution guide is here: github.com/hashgraph-online/hol-guard/blob/main/d…

Chyron emulator is now fully working on mac windows and linux - with prores recording of video and key outputs, mouse and tablet support, full keyboard layout and more. This is the best dumb thing I've done in awhile. jdanna/MaxineStudio t.co

github.com/morpheapp

Yoto Player V3 teardown, and both original speakers playing from an custom Arduino sketch I'm probably late to this party and someone else probably already made a detailed teardown but here is my 2¢. I took apart a full-size Yoto Player V3 and documented it. It's an ESP32-WROVER-E with two AW88194 smart amps that stay hidden from I2C scans until an IO expander pin releases them from reset. The repo has a small Arduino sketch that plays a tone through both speakers using only the datasheet sequence, plus disassembly photos, chip locations, and I2C, GPIO and IO expander maps. There's a short clip of the beep in the README. iamearlgrey/yoto-v3-teardown Credit to Adafruit's Yoto guide and open-yoto, whose Mini work is excellent. Still unknown: I2C devices at 0x62 and 0x75, and what the third wire in each speaker harness does. Ideas welcome.

Pokémon Pokopia has now been ported to iPhone Project link: xFractals/pokopia-native t.co