0:00 Exploit brokers are paying up to five hundred thousand dollars for a specific kind of WordPress vulnerability.0:06 A security researcher just found one using GPT-5.6 Sol Ultra… for twenty-five dollars.0:12 Just last week, in episode 116, we were talking about Alibaba’s massive new model and what it even means for AI to be ‘open’ anymore.0:20 Well, here’s your answer: it means the cost to discover a half-million-dollar secret just dropped to the price of lunch.0:28 Okay, so that’s the story that’s just dominating Hacker News today, and for good reason.0:33 But it’s not the only one.0:35 The entire front page feels like it’s vibrating with this new level of AI-driven capability, and it’s hitting completely different fields at the same time.0:44 First, you have that security story.0:47 A researcher, Adam Kues, took a prompt originally designed for solving complex math problems, pointed it at WordPress, and in about six hours, a brand new remote code execution vulnerability popped out.0:59 A zero-day.1:00 He says, “If this prompt was good enough to solve hard mathematical problems, it was probably good enough for security research too.” And he was right.1:09 The exploit was independently verified, and it’s the kind of thing that fetches enormous bounties on the gray market.1:17 Then, in a completely different corner of the intellectual universe, we have a potential breakthrough in pure mathematics.1:24 An AI researcher who goes by Levent on Twitter posted that an AI system called Claude Fable may have disproved the Jacobian Conjecture.1:33 This is a problem that’s been sitting open for decades, a foundational question about polynomial maps.1:39 The AI produced a specific counterexample—a function that shouldn't exist if the conjecture were true.1:45 He even posted the Wolfram Alpha verification.1:48 The math community is, to put it mildly, scrambling.1:52 There are hundreds of comments on Hacker News, some celebrating, some deeply skeptical, all trying to pick apart if this is real or if the AI misunderstood a subtle condition.2:02 And while all that is happening, Xiaomi Robotics just dropped a paper for their new model, Xiaomi-Robotics-1.2:09 And here’s the key.2:10 They trained it on a hundred thousand hours of data… without a robot.2:15 They used embodiment-free data—basically, simulated trajectories and scenarios—and then fine-tuned it with a much smaller amount of real-robot data.2:24 They’re explicitly copying the large language model playbook: pre-train on massive, cheap data, then align with a small amount of expensive, high-quality data.2:34 And their charts show it works.2:36 The scaling laws hold.2:37 They’ve found a way to get around the biggest bottleneck in robotics: the sheer cost and time of collecting real-world training data.2:46 So you’ve got AI automating the discovery of digital exploits, potentially solving century-old math problems, and now, breaking the physical bottleneck in robotics.2:56 It’s a trifecta.2:57 Of course, for every one of these posts, there’s a thread from a working developer, like one user, "blizarre," who points out that their day is still mostly monitoring production, sitting in meetings, and doing design work.3:11 They said, “The hard stuff still requires thinking.3:14 But that's not even half of my time.3:16 It's fun, but not world-changing.” And that’s the tension, right?3:20 These god-like capabilities are emerging at the frontiers, while daily life for many of us in the industry feels… pretty incremental.3:29 So what does it all add up to?3:30 Let’s dig into the two biggest stories, because the patterns here are something we’ve seen before, but the speed is entirely new.3:38 Let’s go back to that WordPress vulnerability.3:41 Twenty-five dollars of compute to find a five hundred thousand dollar bug.3:46 This isn't just a good return on investment.3:49 This is a phase change in the economics of security.3:52 For years, finding zero-day vulnerabilities was an artisanal craft.3:56 It required deep, specialized knowledge of a particular system, immense creativity, and thousands of hours of painstaking work.4:04 It was a high-skill, high-effort game.4:06 Exploit brokers paid huge sums because that talent was incredibly scarce.4:11 What Adam Kues demonstrated is that the AI isn’t just a tool to help the artisan.4:16 It’s a tool that can automate the craft itself.4:19 He used a multi-agent approach, where different instances of the AI were tasked with sub-problems, all coordinated by a master prompt.4:27 The AI wasn't just guessing; it was reasoning from first principles about how web servers, PHP, and WordPress plugins interact to create insecure states.4:37 So where have we seen this before?4:39 This is the industrial revolution coming for hacking.4:42 Think about lock-making in the 18th century.4:45 A master locksmith could create a lock so complex that only they could pick it.4:50 It was a testament to their personal skill.4:53 Then, Joseph Bramah and others invented machines that could manufacture locks and keys with precision far beyond any human hand.5:01 The game changed.5:02 It wasn't about the individual craftsman's genius anymore; it was about the quality of the system and the design.5:09 We’re seeing the same thing.5:11 The ability to find a certain class of vulnerabilities is shifting from a human skill to a machine capability.5:17 And when that happens, the value of the skill plummets, and the number of people who can wield that capability explodes.5:25 The barrier to entry is no longer years of security research experience.5:29 It’s access to a top-tier model and the ability to write a clever prompt.5:34 And the consequences are… not great.5:36 If a researcher can do this for twenty-five dollars, an adversary can do it for twenty-six.5:42 We are about to be flooded with machine-generated vulnerabilities.5:46 The entire defensive posture of the internet, which is based on the assumption that finding these flaws is hard and expensive, might have to be re-thought from the ground up.5:57 But if that’s the destructive—or let’s say, extractive—side of the coin, the other big story today is about pure creation.6:05 The Jacobian Conjecture.6:06 Let me try to explain this without getting lost in the weeds.6:10 For a long time, mathematicians have wondered about a certain property of functions.6:15 If you have a system of equations, a polynomial map, you can calculate something called its Jacobian determinant.6:22 If that number is a non-zero constant, the conjecture says the function MUST be invertible—meaning, you can always perfectly reverse it.6:31 It seems like it should be true.6:33 For two variables, it was proven true.6:35 But for three or more variables… nobody knew.6:38 For over eighty years.6:39 Then, over the weekend, while the World Cup final was on, an AI named Claude Fable apparently spat out a counterexample.6:47 A specific function of three variables whose Jacobian is a constant, negative two, but which is NOT invertible.6:54 And this is where the pattern matching gets really interesting.6:58 Where have we seen this before?7:00 The closest parallel is probably the Four Color Theorem in 1976.7:04 This was the first major mathematical theorem proven with the help of a computer.7:09 The proof required checking thousands of different map configurations, something no human could ever do.7:15 And it caused an uproar.7:17 Many mathematicians felt it wasn't a "real" proof.7:20 They couldn't hold it in their heads, couldn't appreciate its elegance.7:24 It was just a brute-force checklist.7:26 But this feels different.7:28 The AI didn't just check a billion cases.7:31 It appears to have constructed a single, elegant, and deeply non-obvious object that violates the rule.7:37 It found the black swan.7:38 It didn't just tell us the conjecture was false; it showed us the thing that makes it false.7:44 The debate on Hacker News is raging.7:46 Is the counterexample correct?7:48 Does it properly satisfy all the conditions?7:51 Has the AI misunderstood some deep subtlety of algebraic geometry?7:55 Maybe.7:56 The community is right to be skeptical.7:58 But what’s so powerful here is that the AI’s claim is falsifiable.8:02 It produced a concrete mathematical object.8:05 We can now all stare at it, test it, and verify it.8:08 The AI didn't just give an answer; it started a new, incredibly focused conversation.8:13 So you have these two events on the same day.8:16 An AI that automates the discovery of valuable, hidden flaws in a complex system.8:21 And an AI that generates a novel, creative insight that may topple a decades-old mathematical belief.8:28 They seem like polar opposites, right?8:30 Hacking versus pure math.8:31 But they are the EXACT same phenomenon.8:34 In both cases, the AI is functioning as a leverage machine for human intent.8:39 Adam Kues had the intent to find a vulnerability.8:42 Levent and his friend Akhil had the intent to explore a famous conjecture.8:46 In both cases, they translated that intent into a prompt, and the model provided a result that was previously out of reach for a single person with a small budget or in a short amount of time.8:58 This is the thread that connects all three stories today—the exploit, the proof, and the robot.9:04 Xiaomi’s breakthrough is the same pattern: they’re using massive, cheap, simulated data as leverage to get around the expensive bottleneck of real-world robotics.9:14 It’s all about turning abundance into capability.9:17 Abundant compute, abundant data, abundant examples.9:21 What this week sets up is a confrontation with this new reality of leverage.9:25 The old moats—specialized knowledge, access to expensive equipment, years of training—are being drained, fast.9:32 A single person with a good question and access to a frontier model can now accomplish what used to require a well-funded research lab or a state-level hacking agency.9:43 And that forces a new question on all of us.9:45 If the cost of finding the answer is approaching zero, the only thing that matters is the quality of the question.9:53 The most valuable skill is no longer having the answer, but knowing which question to ask the machine that does.
