6thbit

I believe we should treat AA results as just a data point and not the overarching 'authority' they may intend to be.

If we had access to neutral raw benchkmark data in a useful way to compare apples to apples, then we could each define our own 'index' to get the slice of perspective we find useful.

Trying to define or compare 'intelligence' through a single index will always be off.

Top tier all inclusive premium service

It’s true that they have their own attack surface but it’s not necessarily just open to the world.

Not necessarily. defense in depth can help. At least forces an attacker to have to chain exploits, which although not impossible it makes it harder. Having root on a system doesn’t necessarily give you access to things that require touchid/yubikey/presence.

implying the keys were the hacker's ?

that one was over (years?) time, wouldn't call that a heist really

If true I think we're looking at the biggest heist in history.

Current largest was ~1B

What confused the people dismissing this all over the comments here? It was clearly a DoS bug.

Perhaps the site's tagline was all they read and admittedly I'd have phrased differently.

  > A single malformed WAP Push SMS crashes com.android.phone on Android, dropping active calls (including emergency calls), with zero interaction from the victim.

An easier way to deliver the point across could be:

  > Anyone can send an specially crafted SMS to repeatedly crash the victim's phone app on Android without user interaction. Google didn't fix it, here's an app you can download to send that SMS and disable anyone's phone remotely.

Just my 2 cents for OP, good job on finding and reporting this and it sounds great that it was actually patched, glad you persisted through the frustration of dealing with google's triaging.

Where is AI in this?

Search was $63.4B "Everything else" was $64.2B, out of which GCP was $30.7B

Is AI on the 33.5B remaining post GCP? or within the 30.7 of GCP?

This would've been true a while back prior to major browsers checking for certificate transparency log entries as part of the handshake.

So, I do agree this could be problematic, on specific cases where people not using a major browser were accessing resources some is interested on, on a network they have control of. Makes the surface quite small.

The threat here is more so for 'backend' services than regular browser users.

It’s interesting they call out as “optional” removing sectigo roots.

If you’re not removing them you better be sure anything that runs on the system has full revocation support including intermediates. Which is.. kind of an impossible thing to assert as true. Which is why most trust stores just removed that as well last week.

Yeah, why may that be hard? That’s the question

I don’t think it’s gross incompetence, since they documented the steps to remove. They may have some unexpected dependency on the file? Looks mysterious from the outside.

There must be a long list of things that aren’t fully patched for this yet, on laptops, on servers. Think of packages that ship their own trust anchors, isn’t there a rust crate that compiles with some root certs embedded?

On one hand there’s unmaintained packages that won’t update dependencies. On the other hand, fixed dependencies did not necessarily backport to all possible versions in the wild, making update as a fix unviable for those.

  > Most of the Tailscale SSH issues we've identified concern privilege escalation. In some circumstances, someone already authorized to connect over Tailscale SSH may be able to perform actions beyond the permissions of their configured local user, including potentially gaining elevated privileges.

"Most"? "In some circumstances"? Makes me think that they could also be investigating a full on unauthorized connection issue, or am I reading too much into it?

Last year it happened to me more than once that dictating something in chatgpt would become a completely different message after processing, not in a misheard type of way but just a separate conversation more easily explained by the same type of KV cache issue here.

Instead of benchkmarks it'd be useful to get a sort of Radar chart across measured capabilities like computer use, communication, coding, etc.

We're probably headed to further specialized agents where a single ordering or even model size won't mean a lot.

  GPT-6 Astra
  Input:$10.00 / 1M tokens Cached input:$1.00 / 1M tokens Output:$50.00 / 1M tokens
  
  
  GPT-6.1 Sol
  Input:$2.00 / 1M tokens Cached input:$0.10 / 1M tokens Output:$10.00 / 1M tokens
  
  
  GPT-6.1 Terra
  Input:$1.00 / 1M tokens Cache read:$0.05 / 1M tokens Output:$5.00 / 1M tokens
  
  
  GPT-6 Luna
  Input:$0.10 / 1M tokens Cached input:$0.01 / 1M tokens Output:$0.50 / 1M tokens

That's how their pricing tiers end up now. https://openai.com/business/pricing/#api

(For some reason they say "Cache read" instead of "Cached input" for 6.1 Terra)

6.1 Astra and 6.1 Luna must be coming up soon. Will they reduce their prices further?

Is there any word on which divisions/lines of business they are offering for?

That's correct, this is not a 72B cash loss.

They issued convertible notes and other instruments that were priced as of an older valuation. As their valuation went up, those instruments are now more valuable and due to GAAP accounting rules they have to register that increase in valuation of their issued instruments as a loss. No money changed hands.

Matt Levine's column from Oct 22 explains it much better if someone has a gift link.

  > We believe the work that knowledge workers perform represented more than $40 trillion (in 2025)
  (...)our near-term opportunity is to expand this value
  ...investment in AI (...) will yield a cumulative global economic impact of $22.5 trillion by 2031
  We believe the impact could be even greater.

While they don't seem to explicitly mention total addressable market (TAM) Is that their way of saying their TAM sits somewhere between 22.5 and 40 T?

Wallet address is there, you can donate

The murky part is they haven’t clarified anything around the way they generated the extra key which resulted in that way. How would their tooling make one key the right way but not the second key?

Doesn’t seem they’ll give a timely technical response, which keeps all of us guessing about.

Are the chrome and mozilla root programs in a position to kick their remaining RSA root out of their trust stores based on the lack of responsiveness to this incident?

I really meant good as just working for their intended purpose before they become bricks because they can no longer make requests they 'require'.

But the fake NTP approach makes sense to fool them for either intended or vulnerable purposes.

Ooh I like that in principle and, on paper, would be also a good opportunity to further decentralize the power root CAs have today.

Also would be quite complex for regular users to even grasp and then to choose their trust provider. Cynical me thinks this would just end up giving more power to the device manufacturers and centralize on handful of better known 'trust providers'. No non-techie person I know has heard of Verisign but everyone knows Meta.

The 'grid' thinking used here is quite interesting.

I'd love to see a video of this playing game of life.

So MCUs or any embedded that doesn't get updates will likely only be good for up to the validity of the included CA root before bricking up?

These days thats up to 15 years. Talk about programmed obsolescence.

> They own no Anthropic equity and don’t share in its profits

Can they own other AI related equities?

I guess there's a lack of details to go on at this point. Finding humans that you'd want as trustees and have also truly no conflicts of interest will be tricky.

Knowledge without understanding would be just getting "42" and not being able to ask any follow-ups.

But I don't think that's where we are at the moment. I believe the results, proofs and papers can be reviewed and understood, just like if a human peer had published another result.

I also think that the speed at which results can be now generated can't be followed by our collective speed to understand them, using the methods we are used to. As we enter the next phase where AI publishes using mostly references of other AI results, this will compound exponentially until it would take any human decades to verify a single result by hand end to end.

I agree translating a phrase doesn't teach you a language, and I also believe translators are an essential tool that results extremely helpful when learning a new language.

So instead of throwing the towel, could we develop and adapt ways to improve and aid our understanding and verification processes?

Prompts are not specs.