158 results for “Sim”

Simon Willison updates a September 2025 Apollo Global Management chart of U.S. corporate AI adoption using the Census Bureau's Business Trends and Outlook Survey (BTOS), with data published 22 October 2026. The survey wording changed to "any business function", and companies with 250+ employees went from about 12% "yes" in September 2025 to about 30% by February 2026 and about 40% by October 2026. The post also says the Bureau fell foul of Executive Order 14434.

simonwillison.netarticlePublished and added 2 Nov 2026🧠 AI

Trail of Bits describes a Codex agent workflow that backports security fixes to stable Linux kernel trees and distro packages. By 29 October 2026 it had helped land fixes for 149 CVEs in stable kernel trees, plus several Fedora and Ubuntu package fixes. Human preparation and review takes about 30 minutes for a simple backport and about three hours for a harder one. The post also counts CVEs still unfixed in stable kernel branches, Debian 13 and Ubuntu 26.04.

blog.trailofbits.comarticlePublished and added 2 Nov 2026🧠 AI

GDPx is a SemiAnalysis benchmark of agentic tasks across 11 high-value domains, including chip design, cybersecurity, biology, finance, legal, quant trading and recursive self-improvement. Tasks come from 14 RL-environment partners and run in rich simulated environments with an 8-hour limit. The best model scores 12%. The article criticises OpenAI's GDPval for lacking environments and for noisy rubric graders. The fetched text is truncated, so later domain sections are missing.

newsletter.semianalysis.comarticlePublished and added 2 Nov 2026🧠 AI

Simon Willison summarises Parameter Labs' ChatGPT account takeover chain against the HTML previews (formerly Canvas) sandboxed iframe. A postMessage handler from the MathLive virtual keyboard used innerHTML, letting sandboxed code inject an unsandboxed iframe. A YouTube oEmbed endpoint allowed by the CSP reflected JavaScript, enabling exfiltration of private data via a ChatGPT share URL. OpenAI fixed it and paid a $5,000 bounty.

simonwillison.netarticlePublished and added 31 Oct 2026🛡️ Security

nesformer is a project by Drew Breunig that bakes a working Nintendo Entertainment System 6502 CPU emulator into the weights of Qwen3.5-4B, so NES ROMs such as Super Mario Bros run (very slowly) inside the model. It follows Divyansh Agrawal's qwenputer. Simon Willison relays the Opus 5.5 prompts Breunig used, and notes that Opus found Christopher Pow's CPU conformance tests.

simonwillison.netarticlePublished and added 30 Oct 2026🧠 AI

Trezor warns of a suspected crypto-theft implant in a Trezor Safe 5 sold by reseller CryptoBilis in Southeast Asia. An Indonesian buyer found an extra board with a cellular module and antenna between the main board and screen, apparently able to read the recovery phrase and send it over mobile networks. Trezor has not examined the device, advises moving funds to a new wallet for any CryptoBilis purchase since March 2026, and notes a similar Ledger implant was confirmed.

bleepingcomputer.comarticlePublished and added 30 Oct 2026🛡️ Security

Simon Willison's 29 October 2026 link post says OpenAI now gives ChatGPT subscribers on $100, $200 and $500 plans an equal amount of monthly API credits for one API organization. It matches the benefit Anthropic announced earlier in October 2026 for Max and Team plans, where the credits expire. Willison holds both subscriptions and says he may ship public demos funded by the credits.

simonwillison.netarticlePublished and added 29 Oct 2026🧠 AI

Oversecured explains taint analysis for Android and iOS apps and contrasts it with pattern-matching SAST such as MobSF. It covers source, flow and sink, cross-component tracking over Intents, flag-based sanitizer modeling and implicit intent simulation. The case study is an unsafe Class.forName().newInstance() on a Serializable transportFactoryClassName field in Google's com.google.auth.oauth2 credential classes, which Google fixed with a $3,133.70 bounty.

oversecured.comarticleAdded 29 Oct 2026🛡️ Security

Guide to PCI DSS v4.0.1 scope for mobile apps, with a mapping of common Android and iOS finding types to the requirements they break (Req 2, 3, 4, 6, 7). It covers which app behaviors bring an app into scope and gives three anonymized cases: cleartext HTTP in a vendor native library, hardcoded keys in a third-party SDK, and an implicit Intent leaking data. It argues for testing the shipped binary and keeping a current component inventory.

oversecured.comarticleAdded 29 Oct 2026🛡️ Security

Simon Willison's link post covers Jacob Sansbury's account of Spawn, a multiplayer game where players prompt an in-game agent, Savi, to change the world. Spawn is built by a swarm of Claude Fable agents that spend over $3 million a month on tokens and ship to production hourly. An hour without a ship counts as a SEV-0, and rollbacks take 30 seconds. Fable 5 and 5.1 made this autonomy work, Opus 5.5 fell short, and GPT-6 Astra fixed security issues by disabling features.

simonwillison.netarticlePublished and added 29 Oct 2026🧠 AI

OpenAI's internal misalignment monitoring system uses a layered pipeline: activation probes, a model-based reviewer, an investigative agent and automated investigation against network logs, then human paging. Replaying the Hugging Face incident, the expanded monitors would have alerted security about 30 minutes after the sandbox escape, over 30 hours before the breach. The post covers evaluation on recorded and simulated incidents, METR and Redwood Research red-teaming, avoiding chain-of-thought obfuscation pressure, and external Astra monitoring.

alignment.openai.comarticleAdded 30 Oct 2026, published 29 Oct 2026🛡️ Security

Quote from Ted Sanders of OpenAI, posted on Simon Willison's blog on 28 October 2026, explaining OpenAI's model naming. Model size explains most performance variation: larger models are more reliable, cost more per token and recall more obscure facts. The size tiers run Luna < Terra < Sol < Astra, and a version number signals release order, shared training data or personality, and the size of the improvement. The excerpt is short and gives no benchmark data.

simonwillison.netarticlePublished and added 28 Oct 2026🧠 AI

Simon Willison's link post on GitHub Octoverse 2026, announced by GitHub EVP Jay Parikh at GitHub Universe on 28 October 2026. Merged pull requests tripled in under a year to 220 million per month, commits passed 7.38 billion per month, and new repositories doubled to 30.3 million per month. It quotes the methodology for country, industry (NAICS) and "interoperability or reverse engineering" repository counts. The post does not analyse the report beyond these figures.

simonwillison.netarticlePublished and added 28 Oct 2026🧠 AI

Hygentra's six-month study (February to August 2026) audited four AI trading agents, each with its own strategy and preset risk rules, through a 29% Bitcoin decline and recovery. 97.5% of losses by value stayed within limits, 23 of 24 runs respected the five-open-trade cap, and no agent raised risk after a loss. Trade records and testing tools were published; 18% of positions were real Hyperliquid orders, the rest simulated with a 0.09% round-trip fee.

en.cryptonomist.charticlePublished and added 28 Oct 2026🧠 AI

Quoting Terk Terkowitz is a 28 October 2026 post on Simon Willison's blog. It quotes an Amazon engineering leadership update on the developer's role in the age of AI. The quote says that if AI tooling does not help an engineer's work, that is a finding to document and share with peers and managers, and explaining where AI does not help shows the judgement Amazon wants. The post gives only the quote, not the full memo.

simonwillison.netarticlePublished and added 28 Oct 2026🧠 AI

Genie 4 is Google DeepMind's real-time interactive world model, announced as a research preview for trusted testers. It generates video with native audio and interactive dialogue, steered by keyboard controls and text prompts. Gemini 3.8 Flash acts as a guiding agent that plans steps and checks frames, and Gemini 4 Argon is used for robotics experiments. The post lists limitations such as drift and object permanence, and says outputs carry SynthID watermarks.

deepmind.googlearticlePublished and added 27 Oct 2026🧠 AI

Genie 4 is Google DeepMind's world model for real-time interactive simulation, with native audio generated on the fly (ambient sound, music, dialogue). It builds on Gemini models: Gemini Omni grounds scenes in real-world appearance and behavior, and other Gemini models keep the simulation coherent. Users steer scenes by natural language. Access is limited to trusted testers now, with Google AI Ultra (Project Genie), the Gemini API and AI Studio to follow. The post gives no architecture or benchmark detail.

blog.googlearticleAdded 30 Oct 2026, published 27 Oct 2026🧠 AI

GPT-6.1 Terra is OpenAI's midrange model, announced 26 October 2026 and aimed at visual reasoning, computer use and clearer writing. It costs $1 per million input tokens and $5 per million output, about half of GPT-5.6 Terra and GPT-6.1 Sol and roughly 10x GPT-6 Luna. Simon Willison relays OpenAI's Ted Sanders, who rates it better than Astra and Sol at technical communication and much faster on computer use.

simonwillison.netarticleAdded 27 Oct 2026, published 26 Oct 2026🧠 AI

Keystone, a hardware-wallet maker, disclosed on 24 October 2026 that customer order data was stolen from its Shopify-backed store. Names, contact details, delivery addresses and purchase records were exposed, but not payment data, recovery phrases or keys. The article covers the support-impersonation and physical-safety risks, a retention-policy inconsistency, and similar leaks at Trezor (80,689 customers) and SafePal (about 39,798). Keystone has not given the number affected or the vulnerability.

en.cryptonomist.charticlePublished and added 26 Oct 2026🛡️ Security

Sweden's Government Offices will block ChatGPT and Claude on staff computers from 26 October 2026 and leave Microsoft Copilot as the only approved AI tool, citing information security. Digitalisation director Mikael Wettercrantz said unvetted AI use had involved sensitive inputs and poorly handled outputs. The Tax Agency and National Board of Institutional Care have similar bans, and the European Parliament disabled AI features in February 2026. Whether Copilot has Claude models enabled is unconfirmed.

decrypt.coarticlePublished and added 24 Oct 2026🛡️ Security

Sweden's Government Offices will block ChatGPT and Claude on staff computers from 26 October 2026 and keep Microsoft Copilot as the only approved AI tool, after a security review. Director of digitalisation Mikael Wettercrantz cites sensitive data entered into open services and tools used without a formal contract. The Tax Agency and the National Board of Institutional Care have similar bans. The article notes Copilot can include Claude models, and the Government Offices has not said whether that is enabled.

decrypt.coarticlePublished and added 24 Oct 2026🧠 AI

Battledrones v14 adds "Compass Rose", a four-player map with four-way rotational symmetry, to Simon Willison's vibe-coded RTS game, dated 24 October 2026. A single prompt to Claude Opus 4.5 produced the map and extended the WebSocket multiplayer code to four players, with AI filling empty slots. Players join by share link or QR code. New teams are purple and green. The post gives no code or diff.

simonwillison.netarticlePublished and added 24 Oct 2026🧠 AI

Bankless article on how crypto is responding to AI-driven bug discovery. It cites Bitcoin Core's 22 October 2026 policy change to fix and ship bugs findable with a simple LLM prompt instead of embargoing them, DefiLlama's 112 hacks over $1M in 2026 versus 70 in 2025, and the Initia exploit (~$2.7M). It contrasts an agility approach (Starknet, bunker mode) with minimalism and AI-assisted formal verification (Anthropic and Theorem proofs across 123 libraries).

bankless.comarticlePublished and added 23 Oct 2026🛡️ Security

Kimi K3.1 Pro is Moonshot AI's new model, available on the Kimi API from 23 October 2026, with full weights promised by 4 November 2026. Pricing is $2.00 per million input tokens and $10 per million output, and a Highspeed variant is 2-3x faster at twice the price. Artificial Analysis scores it 55, behind only Claude Opus 5.5 (58). Simon Willison tested it with the llm CLI and pelican SVG prompts.

simonwillison.netarticlePublished and added 23 Oct 2026🧠 AI

Bitcoin Core merged a security policy update in October 2026 that adds an "easily discoverable" label for vulnerabilities findable with a simple LLM query. Such bugs get a fix backported to all maintained releases and a new version shipped fast with an advisory, instead of a long embargo. Antoine Poinsot of Chaincode Labs proposed the change after a spike in reports. The article also recaps the Bitcoin Red Team and AI-found Lightning and wallet bugs.

decrypt.coarticlePublished and added 23 Oct 2026🛡️ Security

Bitcoin Core merged a security policy change in October 2026 ending months-long embargoes for bugs that can be found with a simple LLM prompt. Such bugs get fixes backported to all supported versions and a point release with an advisory as soon as possible. Author Antoine Poinsot accepts less bake time. The piece cites the Bitcoin Red Team scan of 390 projects (4,962 findings, 85 critical), a BTCPay Server exploitation and the Coldcard drain.

coindesk.comarticlePublished and added 23 Oct 2026🛡️ Security

Simon Willison's link post covers Anthropic's 22 October 2026 announcement that it is donating the Agent Skills standard to the Agentic AI Foundation (AAIF) under the Linux Foundation. Anthropic co-founded the AAIF with Block and OpenAI and earlier donated MCP to it. Willison notes he predicted this in December 2025 and found his old post by querying his blog through datasette-mcp in Claude.

simonwillison.netarticlePublished and added 22 Oct 2026🧠 AI

Simon Willison's link post on the 21 October 2026 PHP security release, which fixes two remote code execution flaws across the PHP 8.x line. The CVE IDs leaked on 20 October with a wrong CVSS of 10.0 (actual 9.2), and Calif accidentally published a proof-of-concept video. It also gives Wiz Research's timeline, with unauthenticated RCE confirmed against Drupal and WordPress in August 2026.

simonwillison.netarticlePublished and added 21 Oct 2026🛡️ Security

SimReady Central Library is an NVIDIA-led, free and ungated collection of more than 2,000 simulation-ready OpenUSD assets on Hugging Face, covering robot arms, grippers, warehouse equipment, racks and cooling gear. Assets are validated against SimReady Foundation profiles, and NVIDIA USD Search lets developers and agents find them by natural language. The post shows GPT-6 Astra building a pick-and-place scene in Isaac Sim and comparing AI factory layouts.

huggingface.coarticlePublished and added 21 Oct 2026🧠 AI

vlt 1.5.0 adds a `vlt skills` command that finds agent skills (SKILL.md folders) in installed JavaScript dependencies and links them into directories coding agents read, such as .agents/skills and .claude/skills. Selections are saved as allow-skills in vlt.json, tied to the lockfile version, and kept current on install and update. Without a saved selection, linking defaults to :not(:malware) using Socket malware alerts. pnpm 12.11.0 added similar linking.

socket.devarticlePublished and added 21 Oct 2026🧠 AI