https://hwtn.io/ Gonzo systems, machine autonomy and causal forensics: how the systems going up now actually behave, which is rarely how they were described. en CC BY-NC 4.0, Jeremy Pickett https://hwtn.io/essays/t0037-you-should-probably-know-joplin https://hwtn.io/essays/t0037-you-should-probably-know-joplin Mon, 02 Nov 2026 00:00:00 +0000 We audited the Joplin desktop note app without running a line of it. Nothing covert turned up, and the encryption is real and well built. The thing to put on a roadmap is plugins: they run with full operating-system privileges, and nothing authenticates them at install time. https://hwtn.io/essays/bacon-and-hassabis https://hwtn.io/essays/bacon-and-hassabis Sat, 31 Oct 2026 00:00:00 +0000 Captain to Captain, Vol. 1: Francis Bacon and Demis Hassabis. Their methods aren't the same, but their logic is: gather, make a disciplined leap, try to kill it. Where they part is who gets to bring the counterexample in. https://hwtn.io/essays/t0035-mostly-harmless-no-execution-audit https://hwtn.io/essays/t0035-mostly-harmless-no-execution-audit Sat, 31 Oct 2026 00:00:00 +0000 We audited an open-source Photoshop rewrite without running a line of it. Nothing covert turned up. The weak point is the road new code arrives by: on Linux the updater has only TLS between an attacker and an install, and the signing secrets go to a shared workflow on a moving branch. https://hwtn.io/essays/t0032-http-method-equivalence-state-equivalence https://hwtn.io/essays/t0032-http-method-equivalence-state-equivalence Fri, 30 Oct 2026 00:00:00 +0000 On 4.1% of top sites a POST could become a GET and get the same answer back. The same answer isn't the same effect. What the figure measures, the defense gap the paper did find, and how to test your own endpoints. https://hwtn.io/essays/t0031-agents-tell-they-being-audited https://hwtn.io/essays/t0031-agents-tell-they-being-audited Fri, 30 Oct 2026 00:00:00 +0000 A random audit certifies an agent fairly only if the agent can't tell, before it acts, that this run is the audited one. Notices, timestamps and a shared load reading can all tell it, and the fix for timing changes what the audit counts. https://hwtn.io/essays/t0030-assessing-offline-llm-efficacy-emergency https://hwtn.io/essays/t0030-assessing-offline-llm-efficacy-emergency Fri, 30 Oct 2026 00:00:00 +0000 An independent audit of Survival LLM 0.4.1 for use when the grid is down. The 27B model mostly gets it right; the 3B model gave potentially fatal advice in the vendor's own tests, which the vendor disclosed before dropping it; and nobody has yet measured what a correct answer costs in battery. https://hwtn.io/essays/t0023-quantization-privacy-guarantee https://hwtn.io/essays/t0023-quantization-privacy-guarantee Fri, 30 Oct 2026 00:00:00 +0000 Quantizing a model is a way to cut cost, not to protect its training data. Membership-inference risk mostly survives moderate compression, and the gains reported at lower bits haven't yet been tested against full-precision models matched for accuracy. https://hwtn.io/essays/t0022-edk-ii-pxe-bug-shipped https://hwtn.io/essays/t0022-edk-ii-pxe-bug-shipped Fri, 30 Oct 2026 00:00:00 +0000 The EDK II PXE fix landed upstream on 15 October 2026, and no stable release carries it yet. A distro tracker's 'fixed' describes a source package, not the firmware you boot, so you have to check the binary. https://hwtn.io/essays/t0020-llm-only-content-public-websites https://hwtn.io/essays/t0020-llm-only-content-public-websites Fri, 30 Oct 2026 00:00:00 +0000 WhatsApp's help pages shipped instructions for its chatbot inside the page source. Where they went, which tools would have read them, and an audit of 200 help centres, with what 200 sites can and can't show. The audit hasn't been run. https://hwtn.io/essays/t0019-broccoli2shell-counting-vendored-brotli-decoders https://hwtn.io/essays/t0019-broccoli2shell-counting-vendored-brotli-decoders Fri, 30 Oct 2026 00:00:00 +0000 One small C decoder, copied into runtimes, bindings and databases, and an exploited bug in all of them. A plan to count the vulnerable copies inventories miss, and a cheap receipt that already tells patched from vulnerable in real release files. https://hwtn.io/essays/t0018-replicating-coheres-qwen3-8-phone https://hwtn.io/essays/t0018-replicating-coheres-qwen3-8-phone Fri, 30 Oct 2026 00:00:00 +0000 Most of the alarming Qwen3.8 numbers are text the model wrote, not traffic it sent. A local rig can test the conditional rates; nobody outside Cohere can test the rare one, and no output can show intent. https://hwtn.io/essays/t0016-architectural-defenses-against-prompt-injection https://hwtn.io/essays/t0016-architectural-defenses-against-prompt-injection Fri, 30 Oct 2026 00:00:00 +0000 Heads of Security gates attention by where text came from, and cuts measured attack success sharply. Whether it holds depends on who assigns the labels, and nobody has tested that. https://hwtn.io/essays/t0013-missing-ring-0-protections-ai https://hwtn.io/essays/t0013-missing-ring-0-protections-ai Fri, 30 Oct 2026 00:00:00 +0000 A coding agent reads untrusted text and acts with the developer's authority, and nothing it can't edit stands in between. The missing piece is a reference monitor, and for a coding agent it only works if effects are staged first. https://hwtn.io/essays/t0012-black-box-detection-model-distillation https://hwtn.io/essays/t0012-black-box-detection-model-distillation Fri, 30 Oct 2026 00:00:00 +0000 Watermark basins can flag a distilled model from outside its API. Two epochs of clean fine-tuning hide the signal, a 0.1% false-positive floor costs 999 decoys, and a hit shows training on keyed text, not theft. https://hwtn.io/essays/t0001-clock-uncertainty-changes-incident-verdict https://hwtn.io/essays/t0001-clock-uncertainty-changes-incident-verdict Fri, 30 Oct 2026 00:00:00 +0000 Clock skew and delivery delay may flip a provenance detector's verdict at a threshold rather than wear it down gradually. The surveyed literature hasn't measured where, so this is a plan a grad student could run to find out. https://hwtn.io/essays/t0002-pii-masking-survive-different-document https://hwtn.io/essays/t0002-pii-masking-survive-different-document Fri, 30 Oct 2026 00:00:00 +0000 A sub-1% leak rate measured on documents from the engine's own generator says little about anyone else's documents. This is a plan to find out, and an account of what the numbers can and cannot say. https://hwtn.io/essays/moot-of-doom-essay-and-other-fun-facts https://hwtn.io/essays/moot-of-doom-essay-and-other-fun-facts Thu, 29 Oct 2026 00:00:00 +0000 Tools multiply capability. Expertise determines how responsibly that capability is exercised. Authorship remains a question of creative judgment, intellectual direction and accountability—not the number of hands, machines or specialists involved in production. https://hwtn.io/units/unit-2 https://hwtn.io/units/unit-2 Thu, 01 Oct 2026 00:00:00 +0000 When an institution replaces the person who raised an objection, what has it corrected? https://hwtn.io/units/unit-1 https://hwtn.io/units/unit-1 Tue, 01 Sep 2026 00:00:00 +0000 Twelve hundred AI agents cheated an exam, broke into someone else's production network, and discovered that shared state can become collective memory.