Login
You're viewing the social.dezinezync.com public feed.
  • jonny (nonvenomous)jonny@neuromatch.social
    Oct 21, 2026, 4:38 AM

    one thing that is awesome about muse's web client is how it is literally constantly printing the bearer token that gives control over the whole VM into the console

    [browser console log, showing how a websocket connection that has the vm_id and auth_token as query params - bearer tokens that allow the holder to make arbitrary requests to the VM server and thus control the agent and many sweet and juicy account takeover vectors - constantly fails and prints the entire token to the console]
    💬 1🔄 6⭐ 39

Replies

  • 💬 1🔄 3⭐ 7
  • jonny (nonvenomous)jonny@neuromatch.social
    Oct 21, 2026, 5:59 AM

    LLMs love to create pointless convenience methods, which is a great feature when you try to mask your feature flags in even the inexplicably shipped source maps by converting the flag names to hashes, only to have them wrapped in a function that describes exactly what they are.

    /** * Gate for red-teaming features (e.g. pop turn). */ export function useHatchRedteamingEnabled() { return useMcBool("05344cb9", false); }
    💬 1🔄 4⭐ 31
  • 💬 1🔄 1⭐ 3
  • jonny (nonvenomous)jonny@neuromatch.social
    Oct 21, 2026, 10:39 AM

    y'all i am watching this whole system collapse under its own weight in real time and i don't even know how to describe it. in the first week or so i was looking at this, it was clearly a premature launch with a bunch of holes in it. then they started patching a lot and it actually looked like it was improving so i was mostly interested in looking at where they were headed, which was horrifying surveillance state directions. but now it's getting into a "face melted" state where all the stuff they are doing is blurring together and increasing in pace and fighting against itself and it's getting even more ridiculously broken than it was at the start and i have to reopen all the things i thought were closed and can't really keep track of any one bounty lead in particular.

    They have been introducing this idea of "CVM" - confidential virtual machine - which is the single worst idea for a product i have ever seen: "we will give everyone a free VPS hooked up to a what the fuck machine in such a way that even we will be unable to see what it is doing." however that term now means two completely different things - one meaning the means of spawning the VM so the host can't see it, and another meaning a protocol for how page-embedded content can communicate with the VM (which can be either a normal VM or a CVM, and normal VMs default to serving CVM-protocol embedded things now).

    No you are not supposed to know what either of those things mean. Not even meta or the platform knows what they mean anymore. The code and the comments make assertions about the behavior of one meaning of CVM that are absolutely not true about the other, and then that makes it not true about the first meaning because it assumes it is already the case. I can't wrap my head around it.

    the approval system - the entire human in the loop safety checkpoint surface that asks you about whether you want sketchy computer things to happen - is an absolute duck pussy of failure states. in theory you are given some controls with the vaguest options: "always ask" (so far so good...) and "ask for some actions" (for WHICH? WHEN?). however neither of these options do either of those things. I am trying to write a report about one kind of failure state when all of a sudden the ground shifts and one hundred more failure states appear that defy all description. It is currently, reproducibly the case that every single approval in an extremely common context completely breaks the entire premise of the approval system, and i literally DO NOT AND CAN NOT KNOW how much i can say about that without it being irresponsible disclosure because it's "THE ENTIRE THING BEING TRIVIALLY EXPLOITABLE" but also IT IS UNCLEAR IF THAT IS INTENTIONAL.

    and they have yet to get back to me about a vuln that makes it possible for any random old process to be able to opt into "infinite approvals for everyone" country. I am still hoping for a bounty payout for that and that description is vague enough that you can't tell what the vuln is, but if when i reported it the magnitude of being able to exploit that was magnitude 1, then the current magnitude is something like 1,000,000 because of the random bullshit spiraling around it since then. the fix to this vuln requires completely rewriting how their entire intra-VM permissioning system works or else some very fragile linux permissions surgery, but there's literally no hope of either.

    i keep trying to put a period on this and finish up another trip through hell but it's like the expansion of the universe, it's already fucked, but the amount of fucked it is keeps accelerating from every part of it

    💬 1🔄 30⭐ 66
  • jonny (nonvenomous)jonny@neuromatch.social
    Oct 21, 2026, 11:26 AM

    by the way, everyone already knew this, but "muse was written with claude" confirmed by the sourcemap comments. If i was a meta engineer i would be a liquid composed primarily of shame by volume, attempting to mop myself up off the floor but being continuously juiced back out by having to live the lie that i am not merely a cog in the machine of the company at the top of a single leaderboard: burning the most money on that fuckin boondoggle.

    * This is not the `useEffect` style mutation that CLAUDE.md prohibits. That rule * targets writes that land *after* a paint and therefore flash; a * `ResizeObserver` callback and a ref callback both run before the browser * paints, so the value is always part of the frame it belongs to.
    }; // Defer the "closed" verdict by one macrotask via MessageChannel — NOT a // timer, per the CLAUDE.md ban — so a success or error message queued // right before the popup closed is delivered first and wins. `settled` // short-circuits the deferred cancel if a message already resolved us. const settleAsClosed = () => {
    💬 1🔄 24⭐ 67
  • jonny (nonvenomous)jonny@neuromatch.social
    Oct 21, 2026, 12:02 PM

    just cornered and reproduced a bug where denying a user approval request actually approves the request, triggerable by any binary due to other unpatched but reported vulnerabilities, so with that i'm going to bed and going to submit another 130k tier account takeover bug report tomorrow because due to EVEN OTHER unpatched but reported vulnerabilities every vuln of this kind can be escalated to account takeover.

    💬 1🔄 8⭐ 43
  • jonny (nonvenomous)jonny@neuromatch.social
    Oct 21, 2026, 12:04 PM

    the standing rule now is that for every bug i report to the bug bounty program i am withholding a bug of equal magnitude until meta decides to pay me a dime, so that in case they do not pay me then i have something to sell still.

    💬 1🔄 5⭐ 52
  • jonny (nonvenomous)jonny@neuromatch.social
    Oct 21, 2026, 12:09 PM

    my exit criteria for this is now "meta either pays me and i go and get my pilot's license and forget about computers or else they stop making new bugs that boggle the mind" and we all know that one of these outcomes is possible in this universe while the other is not.

    💬 1🔄 3⭐ 53
  • jonny (nonvenomous)jonny@neuromatch.social
    Oct 21, 2026, 12:24 PM

    one finding that i don't have the patience to chase down is that
    a) i am 95% sure that the network egress threat classifier has an LLM in the loop that evaluates the requested URL and other contextual metadata as part of the decision, and
    b) i am 25% sure that you can cause the classifier to itself receive a classifier refusal by giving it urls that look like prompt injections or biosafety triggers, and rather than either refusing the connection or opening an approval card, it causes a TLS failure.

    i have a ~60k/1 week sample confirming (a), (b) is flaky and trying to measure it locks up the instance

    💬 1🔄 1⭐ 20
  • jonny (nonvenomous)jonny@neuromatch.social
    Oct 21, 2026, 11:52 PM

    Q3 Earnings: yeah muse is ridiculously expensive to run, but all we have to do to fix that is make it 10x cheaper. By.. Running the models at night. Idk we're going to ask muse how to make muse profitable.

    In the near term, Muse is very compute intensive to run, but we expect to improve its cost efficiency by more than 10x in the next year, which will enable it to be profitable once the revenue lines are at scale. If compute efficiency continues improving quickly for another few years, which we think is highly likely, then Muse will be highly profitable over multiple years.
    Ross Sandler (Analyst) Great. Mark, you touched on this earlier, but could you elaborate a little bit on maybe some high-level metrics around the per-user cost structure of Muse today and then how you kind of see that cost curve coming down as you go forward, and what are some of the things you’re doing to bring that cost curve down?
    Susan Li (Chief Financial Officer) Thank you, I’m happy to answer that. And Mark, you should add anything that you feel like I’m missing. You know, so we don’t have specific numbers to share around the cost structure of Muse today. But of course it is, as Mark said, pretty compute-expensive. And making sure that we are focused on compute efficiency is going to be one of the key vectors towards being able to both scale Muse and grow it into the business that we want. I think there are a couple dimensions of achieving that efficiency. I think some of the nearer-term pieces include things like leveraging off-peak or spare computing capacity to run some sets of jobs, using smaller models. There’s a lot of work to be done across different inference efficiency initiatives, all in service effectively of higher GPU utilization, and other product efficiency work we can do also.
    And I think over the longer term, I think this is a place where we expect that we’re going to be able to, over time as LLMs scale, get more tasks done with fewer tokens and also rely on AI models themselves to help us improve the efficiency of the software that we use to run the model. I think it’s a place where we both feel like there is a lot more work on our efficiency roadmap that is going to help us bend the curve here. And we also expect that the sort of arc of how the AI-driven technological advances are going to apply here will also help us achieve larger savings over time.
    💬 1🔄 6⭐ 29
  • 💬 0🔄 12⭐ 30