home.social

Search

125 results for “leak”

  1. The Philosopher King @philosopherkinglife.wordpress.com@philosopherkinglife.wordpress.com

    How to Use AI Agents for Personal Finance and Wealth Building: The Master of Coin Guide (2026)

    Why Most People Use Artificial Intelligence Backwards (And How to Fix It)

    Every day, millions of people open an AI chat window and ask the wrong question: "What stock should I buy today?" or "How do I get rich quickly with AI?" They treat artificial intelligence like a carnival oracle, hoping a single prompt will absolve them of the discipline required to build wealth. When the oracle gives them generic, recycled advice, they walk away convinced that AI is overhyped.

    The divide between those who build sovereign wealth in the coming decade and those who remain trapped in financial noise comes down to a single shift: moving from passive AI chatbots to autonomous AI agents.

    According to Backbase’s 2026 AI in Wealth Management analysis, while 95% of financial institutions have experimented with generative AI, only 27% report substantial impact because most remain stuck in passive chat pilots rather than deploying agentic workflows. Meanwhile, McKinsey’s 2035 Wealth Management Outlook projects that AI agents and intelligent automation will form the operational backbone of modern wealth management—delivering an estimated 30% to 40% productivity leap in portfolio intelligence and financial research.

    You no longer need a Wall Street family office to command that same operational backbone. In the philosophical framework of The Philosopher King, your mind is the fifth-dimensional architect, and AI agents are four-dimensional force multipliers. Here is the step-by-step guide to building your own autonomous AI agent workflow to master your coin, reclaim your time, and eliminate emotional financial mistakes.

    Step 1: Shift from Single Prompts to a Multi-Agent Financial Council

    A chatbot waits for you to ask a question and gives you a single stream of text. An AI agent is given an objective, access to real-world tools (such as web search, financial data APIs, and spreadsheets), and the autonomy to break a complex goal into sequential steps.

    When managing your personal treasury—what we call the discipline of the Master of Coin—relying on a single AI persona creates blind spots. Instead, structure your workflow as a three-agent council built on deliberate discipline (the meticulated kind):

    • The Intelligence Scout (Macro and Fundamental Research Agent): Configured to scan earnings transcripts, SEC filings, macroeconomic liquidity trends, and sector developments on a recurring schedule, distilling hours of noisy financial media into a five-minute first-principles brief.
    • The Treasury Comptroller (Cash-Flow and Allocation Auditor): Tasked with auditing your monthly burn rate, identifying recurring subscription bloat, tracking your savings velocity, and calculating whether your actual asset allocation matches your target risk profile.
    • The Red-Team Adversary (Risk and Pre-Mortem Agent): Programmed with a single directive: to ruthlessly challenge your investment ideas. Whenever you are tempted by market euphoria or FOMO, this agent stress-tests your thesis by finding every balance-sheet weakness, valuation risk, and macroeconomic headwind you ignored.

    Step 2: Choose Your AI Agent Stack and Connect Your Financial Data

    Whether you are a non-technical sovereign investor or a developer building custom pipelines, the open-source and commercial ecosystem for AI agents has matured rapidly. As documented in McKinsey’s 2026 State of AI Global Survey, agentic orchestration is now one of the fastest-scaling capabilities worldwide. Depending on your technical comfort, consider these proven building blocks:

    • Model Context Protocol (MCP) for Secure Data Connections: Introduced as an open standard by Anthropic and detailed in the official Model Context Protocol documentation, MCP acts like a universal USB-C port for AI applications. It allows your AI agent to securely read local CSV exports, Google Sheets ledgers, and market data feeds without uploading your private credentials to untrusted third parties.
    • CrewAI for Role-Based Financial Teams: If you want specialized agents to collaborate on a research report, CrewAI lets you define distinct roles (for example, a Fundamental Analyst Agent and a Risk Manager Agent) that hand off structured outputs to one another automatically.
    • LangGraph for Stateful, Auditable Workflows: Built by the LangChain team, LangGraph models agent workflows as a stateful graph with built-in checkpointing and human-in-the-loop pauses—ideal when you want an agent to pause and wait for your explicit approval before logging or executing a decision.
    • OpenAI Agents SDK and Microsoft AutoGen for Multi-Agent Debate: Using the OpenAI Agents SDK or Microsoft AutoGen, you can pit a Bull Agent against a Bear Agent on any asset class, forcing both agents to cite verifiable data until only the strongest first-principles truth survives.

    Step 3: Enforce the "Human-in-the-Loop" Sovereign Rule

    One of the most common questions people ask when researching AI for investing is: "Should I connect an AI agent directly to my brokerage account and let it trade autonomously?"

    For the vast majority of individual investors, the answer is an emphatic no. As highlighted in Forbes Finance Council’s analysis on AI agents in finance and McKinsey’s research on AI agent performance management, autonomous agents require strict governance boundaries, audit trails, and human oversight.

    "An AI agent is your tireless chief of staff in the fourth dimension, but your consciousness remains the sovereign on the throne. Never abdicate final judgment to a machine."

    To protect your capital while maximizing leverage, enforce these four iron rules:

    1. Read-Only Access by Default: Give your agents read access to market data, news feeds, and sanitized CSV exports of your budget—never raw write/withdrawal permissions to your primary bank or brokerage accounts.
    2. Require Source Citations on Every Claim: Instruct your research agents to attach a direct link to the primary filing, earnings release, or statistical dataset for every number they report, eliminating hallucinated metrics.
    3. Automate the Preparation, Never the Conviction: Use agents to compress 10 hours of reading into 15 minutes of structured synthesis, freeing your mind to make low time-preference decisions with clarity.
    4. Log Every Thesis for Post-Mortem Review: Have your agent archive every investment decision alongside the exact assumptions you held at the time, creating an unvarnished mirror of your cognitive biases over time.

    Step 4: Copy This 15-Minute Daily "Master of Coin" AI Routine

    You do not need a complex server cluster to start today. Begin with a simple, repeatable daily cadence using scheduled AI tasks:

    • 06:00 AM — The Sovereign Morning Brief: Schedule an AI agent to scan overnight macroeconomic developments, central bank releases, and any material news affecting your watchlist, delivering a bulleted summary stripped of sensationalist clickbait before you open your eyes.
    • Sunday Evening — The Red-Team Portfolio Audit: Feed your current asset allocation and investment thesis into an adversarial prompt: "Act as a first-principles risk officer. Identify the top three hidden correlations, liquidity risks, or macro assumptions that could cause a 25% drawdown in this portfolio over the next 12 months."
    • First of the Month — The Capital Velocity Check: Have your agent categorize the prior month’s cash flows into three buckets—Sovereign Asset Accumulation, Productive Skill/System Building, and Fleeting Consumption—so you can see exactly where your life-force is compounding or leaking.

    Join the Conversation: How Are You Using AI Agents to Master Your Coin?

    We are living through the greatest democratization of analytical leverage in human history. Those who pair ancient philosophical restraint with modern agentic intelligence will operate with the clarity of an institution and the agility of a sovereign individual.

    I want to hear from you in the comments below:

    1. Are you currently using AI agents or scheduled workflows to research investments, track expenses, or stress-test your financial decisions?
    2. Which part of managing your personal finances drains the most time or emotional energy—and how would you design an AI agent to take it off your plate?
    3. Where do you draw the line between automated AI analysis and human intuition when putting your capital at risk?

    Drop your thoughts, favorite prompts, or questions in the comments—let us sharpen our frameworks together.

    All is One | One is All

    #aiAgents #ArtificialIntelligence #automation #financialSovereignty #howTo #MasterOfCoin #personalFinance #wealthBuilding
    #aiagents #artificialintelligence #automation #financialsovereignty #howto #masterofcoin
  2. Dev Community @[email protected]

    The Machine Week ran from October 13 to 22, and it produced 5 incidents where automation or AI agents did the heavy lifting. The headline number: a nation-state actor fired 2,900 sign-in attempts per minute at 2,250 Microsoft 365 tenants using an open-source AI pentest framework, reaching privileged access in under three hours.

    ConnectWise / Storm-0940: AI Agents at Machine Speed


    What happened: On October 15, Storm-0940 — a China-state-aligned group Microsoft tracks since 2021 — used ARTEX, a Go-based agentic AI penetration-testing framework, to compromise ConnectWise Cloud Backup's application credentials. From there, AI agents automated password spraying at 2,900 attempts per minute across 2,250+ downstream Microsoft 365 tenants, authenticating via already-trusted ConnectWise app identities without interactive sign-in. Microsoft disclosed the attribution on October 21.

    Why it matters: The headline is "nation-state attack." The real risk is that ARTEX is open source. Any actor with a stolen OAuth app credential can now compress a multi-week intrusion into hours, and your MFA won't stop an app identity that's already trusted. Audit every third-party OAuth app registered in your tenant and revoke any you can't name.

    Arista VCO: The Third Zero-Day in Four Months


    What happened: On October 22, Arista published Security Advisory SA 0199 for CVE-2026-114625, a SQL injection in VeloCloud Orchestrator (on-prem) rated CVSS 9.9 that lets any logged-in user — down to "Enterprise Read Only" — escalate to superuser operator. It is the third exploited VCO zero-day since July 2026. Affected builds: 5.2.x before 5.2.3.18, 6.1.x before 6.1.3.10, 6.4.x before 6.4.2.12. Arista confirmed active exploitation at the time of disclosure.

    Why it matters: The headline is "patch VCO." The real risk is that three zero-days in one product within four months means the same code path is being probed repeatedly, and on-prem VCO is the control plane for your entire SD-WAN. If you can't patch within 48 hours, isolate the orchestrator from the internet.

    OVHcloud CLI: 94 Minutes on GitHub


    What happened: On October 19, a compromised OVHcloud developer GitHub account was used to replace the download binaries for five CLI releases (v0.11.0 through v0.15.0) with a secret-stealing trojan. The malicious builds were live for 94 minutes (14:47–16:21 UTC+2) before detection. The trojan harvested cloud credentials, SSH keys, and environment variables from the local disk.

    Why it matters: The headline is "don't download OVHcloud CLI." The real risk is that any CLI you curl | sh or brew install is a supply chain target, and a 94-minute window is enough for a CI pipeline to pull it. Pin your CLI tools by SHA-256 and verify release artifacts before execution.

    Patch Tuesday: 1,413 CVEs and a MotW Bypass


    What happened: On October 13, Microsoft shipped the largest Patch Tuesday in its history: 1,413 CVEs, including CVE-2026-96951, an actively exploited Windows Shell security feature bypass (CVSS 8.8) that defeats Mark of the Web. CISA added it to the KEV catalog the same day with a federal remediation deadline of October 16. The same week, Palo Alto patched an exploited PAN-OS RCE and Cisco patched an exploited Secure Email Gateway flaw.

    Why it matters: The headline is "patch Windows." The real risk is that MotW is the last line between a downloaded file and Office Protected View or SmartScreen. A bypass means a single malicious attachment can now land in a sandbox-less context. Verify your endpoint actually applies the October 13 cumulative update, not just the patch metadata.

    The Wider Machine Week: Automation Everywhere


    Plex2Shell. Four chained Plex Media Server CVEs were patched on October 16. Crypto miners and a proxy backdoor appeared within 24 hours of the proof of concept. If you run Plex at home, it's already been scanned.

    Capcom. On October 22, Capcom confirmed a breach of CAPCOM ID exposing 11.7 million account email addresses. Hackers also changed login passwords for 196 accounts and leaked dates of birth for 43.

    Nikkei. On October 19, Japanese media group Nikkei disclosed its third breach in a month. Attackers used stolen credentials from October 7 to access a cloud development service, exposing 1.83 million records.

    Oracle Health. On October 7, Oracle reported a breach of its healthcare unit affecting nearly 20 million US patients. Compromised data includes Social Security numbers, home addresses, and medical records.

    Japan NPA. On October 21, the National Police Agency said personal information for approximately 125,000 officers and staff across 20 prefectural forces was compromised through an attack on cloud provider Arcadia.

    What This Means for You


    • "AI-powered attacks are a future threat" → Storm-0940 used an open-source AI framework to hit 2,250 tenants at 2,900 attempts per minute; the tool is already public, and the bottleneck is a stolen OAuth app credential, not the AI.
    • "Zero-days are rare and dramatic" → Arista shipped its third VCO zero-day in four months; "rare" is a pattern you're not tracking, and the patch window for on-prem appliances is measured in days, not hours.
    • "Supply chain attacks target big companies" → OVHcloud CLI was a developer tool with a 94-minute exposure window; if your pipeline pulls a CLI without verifying the hash, you were in the window.
    • "Patch Tuesday is a formality" → 1,413 CVEs in one release, one of them a MotW bypass that defeats the sandbox your endpoint security relies on; "patched" means the cumulative update is actually deployed, not just scheduled.

    If an AI agent can reach your M365 tenant, your SD-WAN control plane, and your local SSH keys through three different trust paths in the same afternoon, you don't have a patching problem — you have a trust-boundary problem.#ai #themachineweek #security #software #coding #development #engineering #inclusive #community
    The Machine Week: The Week Attackers Almost Went Full Autopilot

    #ai #security #community #software #coding #development
  3. Dev Community @[email protected]

    For two weeks, Claude planned and reviewed my code changes and Xiaomi's MiMo-V2.6-Pro wrote them. That was 95 work orders across 14 of my repos, and 62 of them merged. At list prices, MiMo's side of those 62 changes cost $14.22. The same tokens at Claude Opus 5.5 prices come to $355.

    The catch is time. A merged change took 52 minutes from order to merge (median). MiMo was working for less than half of that.

    The setup


    A dispatcher I wrote (about 10,000 lines of stdlib Python) runs each order in its own git worktree and branch, inside a macOS seatbelt sandbox that can only write to that worktree. Claude writes the order, MiMo implements it and runs the project's checks, Claude reviews the diff and either sends it back with feedback or merges it locally. Nothing gets pushed without me.

    Every order leaves a state file and the worker's full event log, with timestamps and token counts for each model call. All the numbers below come from those files, for orders created 11 to 23 October 2026.

    Where the time went


    I could rebuild the full timeline for 33 merged orders (four more sat overnight and I left them out).

    StageShare of wall-clockMedianWaiting in the queue5%0.1 minMiMo working49%30.7 minBetween rounds (review, feedback, waiting)27%6.4 minLast round finished → merged20%11.2 min


    The orders that passed on the first round make it plain. MiMo worked for 16 minutes (median) and the order took 42 minutes end to end.

    Most of the extra 26 minutes is the orchestrator not looking. Its instructions said to check the queue with sleep 595, then review, then merge. The long interval was there to save Claude tokens. It also left up to ten minutes of dead time every time a worker finished. The merge step adds more: it rebases onto whatever landed in the meantime and reruns the full test suite.

    None of this is the model's fault. It's plumbing.

    Is the model itself slower?


    Less than I expected. I compared MiMo's turns with Claude Opus 5.5 turns from my own Claude Code transcripts. They're different tasks, so read this as a rough comparison, not a benchmark.

    Per model callMiMo-V2.6-ProClaude Opus 5.5Calls measured6,6404,537Seconds per call, median6.77.9Seconds per call, mean21.813.2Output speed47 tok/s81 tok/sContext per call, median153K467K


    The typical call is as fast. The slow ones are slower, which pulls the mean up. A MiMo attempt ran 37 calls and 15 minutes (median).

    The context column matters later. MiMo starts every order from a fresh worktree, so it carries about a third of the context my long Claude sessions do.

    The real gap: rework


    Only 24 of the 62 merged orders (39%) went through on the first round. The rest needed one to six more. Each round means another attempt, another review and another wait, and the token bill climbs fast:

    Rounds to mergeOrdersMedian tokens1243.6M2208.9M3814.8M4 or more1031.0M


    I read the review feedback that sent orders back. Nearly all of it falls into five groups:

    1. Failing silently: a missing column, a join that matched zero rows or a button that wasn't found, all treated as success.
    2. Data edge cases: duplicate rows, a date that's object on one side and str on the other, and tickers like NA and NULL that pandas quietly reads as NaN.
    3. Tests that can't fail. One asserted that a static header string was present in the output. Another wrote into the repo's real output folder. One took 113 seconds against a 60-second limit.
    4. New behaviour with no test, or a runbook left describing the old behaviour.
    5. Matching too loosely: a substring check for selected that also hits unselected, or "click the first OK button on the page".

    None of these are hard to get right. They weren't in the order, and the worker didn't go looking for them. A stronger model goes looking more often. That's most of what you pay Claude for.

    The cost math


    Here's the token mix across the 62 merged orders: 97.8% cache reads, 0.56% output. An agent re-reads its whole context on every call, so the token count is roughly calls × context size. It has little to do with how much code gets written.

    That makes the cache-read price the one to compare, and the headline price misleads:

    Per 1M tokensMiMo-V2.6-ProClaude Opus 5.5RatioInput$0.435$4.009×Cache read$0.0036$0.2056×Output$0.87$20.0023×


    On my mix the blended ratio is 25×. A merged change cost MiMo $0.17 at list price (median) against $3.83 for the same tokens at Opus prices. Even the orders that took four or more rounds stayed far cheaper than handing the job to Claude. And Claude doing the work inside my planning session would carry three times the context per call, so its real bill would be higher still.

    I pay for both through subscriptions, not per token, so list prices are a yardstick here, not my invoice. Xiaomi's Token Plan page doesn't say how cache hits count against the monthly quota. Check that before you rely on a ratio.

    The money that actually leaks is on the orchestrator side. Every time Claude wakes up to poll, it re-reads its own large context. Ten polls on a 300K-token session is 3M Claude tokens spent on checking whether anything happened.

    What I'm changing


    Three changes, all dispatched to MiMo this morning (yes, through the same queue):

    • A wait command that blocks until an order changes state and returns at once. It's read-only, so the orchestrator can run it over a mounted path from a VM. That replaces sleep 595.
    • An automatic review as soon as an order's checks pass, run by Claude Sonnet in headless restricted mode. That means no shell, file reads confined to the review worktree and no MCP servers. The verdict is waiting by the time the orchestrator looks.
    • A self-review section in every implementation prompt built from the five groups above, plus an order template with a mandatory "Failure modes" section. Cheap tokens make a self-check worth running.

    Two of the three merged after two review rounds. The reviewer change took nine. It runs outside the sandbox, and for four rounds in a row a reviewer found another way a file planted in the repo could get executed through PATH. In the end I dropped the PATH lookup instead of patching it again. That one order used 127M tokens, about $1.02 at MiMo list prices. At Opus prices the same tokens would have cost more than all 62 orders above did on MiMo.

    The aim is to get first-round merges from 39% to about 60% and take 20 to 25 minutes off a typical order. I'll post the before and after once there are enough orders to compare.

    Limits


    • One person, 14 repos, two weeks, mostly Python. Your mix of work will differ.
    • The Claude timing comes from different tasks than MiMo's, so it says something about speed and nothing about quality.
    • Rounds are counted from the worker's event logs. The wall-clock breakdown covers the 33 orders with complete timestamps.
    • Prices are list prices checked on 25 October 2026: Xiaomi's rates as listed on OpenRouter, Anthropic's from its pricing page.

    If you're splitting work between a planner model and a cheaper worker, measure the gaps between steps before you shop for a faster model. I do this kind of measurement as a routing audit ([email protected]). If you've measured your own split, I'd like to compare numbers.#ai #llm #agents #productivity #software #coding #development #engineering #inclusive #community
    I routed two weeks of coding to a model 25x cheaper than Opus. The model wasn't the slow part.

    #ai #community #software #coding #development #engineering
  4. Aptivi @[email protected]

    Aptivi Weekly Tech News Issue #21 (Week 43 – 10/24/2026)

    Every week, we collect every event that happened within Aptivi, our projects, and other interesting tech news. This issue shows you the brief summary of our project releases and some of our articles posted on the Aptivi Blog and on the Newsroom, as well as some links to other interesting resources, such as the most intriguing tech news during the week.

    As technology evolves quickly, we have to move quickly with the current to make sure that we don’t miss any of the interesting technology-related events, such as new releases and other interesting events that revolutionize the tech world.

    What happened at Aptivi?

    During this week, sets of events have happened at Aptivi, and we have chosen to summarize some of the most intriguing events that we have covered here at Aptivi Blog and Aptivi Newsroom, as well as other Aptivi updates in case they happen.

    Linux 7.3 was officially available as a general release after seven release candidates.

    Samsung started globally rolling out the One UI 9.0 update for the Galaxy A37 and the Galaxy S23, starting from Europe. Additionally, the stable update had landed to the LTE version of the Galaxy A07, starting from countries like Indonesia and the Philippines. Additionally, Samsung has prepared the new One UI 9.0 Watch Beta for the Galaxy Watch8 and Watch7.

    Additionally, you can check out this week’s issue of Linux Weekly Digests in this link.

    There are some other updates that happened with Aptivi. We have announced our first big milestone that will happen on November 5th, which is a big leap since our major rebrand that happened back in February. Meanwhile, we’ve officially started supporting our projects that run on One UI 9.0, which is based on Android 17.

    Most intriguing tech news

    Here, we collect some of the most intriguing news that caught our attention, and our readers can explore this list below:

    Please note that the order of events are listed in the descending order from the newest to the oldest.

    Summary

    This week, Aptivi started providing official support for those who are using projects on Android phones and tablets running One UI 9.0, while announcing a big release date on November 5th.

    In the other hand, Linux 7.3 was available as a general release after seven release candidates, and Samsung started pushing One UI 9.0 for the Galaxy S23, Galaxy Z Fold/Flip5, and A37 globally, as well as the Galaxy A07’s One UI 9.0 in countries like Indonesia and the Philippines.

    So, thank you to whoever read our posts, liked them, and commented on them, whether it’s on the Fediverse or not. We appreciate your interaction, engagement, and support, and this motivates us into going ahead moving forward.

    #news #Tech #Technology #update #Weekly #WeeklyNews
    #news #tech #technology #update #weekly #weeklynews
  5. Ann1944 @ann1944

    crooksandliars.com/2026/10/lea

Next page
Share on Mastodon

Enter the server where you have an account.