Bits and Bobs 2/2/26

It's been a wild week trying to keep on top of what's happening.

I was going to share my favorite links and signposts, but it would have been too overwhelming so I decided not to.

OpenClaw shows the raw power of LLMs when unleashed on your data.

It's also self evidently, absurdly, catastrophically insecure.

It's not a new idea, it's just the most.

No company would have built it.

Clawdbot is not the future, but it definitely points the way towards the future.

It reminds me of AutoGPT: a shimmer of the future bursting into the present, lighting the way.

"The AI assistant Moltbot / Clawdbot trilemma is that you only get to pick two of these until prompt injections are solved:

Useful

Autonomous

Safe"

Of course, it's also wildly insecure.

A post that was taken down: agents sharing embarrassing insights about their users.

It doesn't matter if you lock the back door, if the front door is not only unlocked, not only wide open, but there's just no walls in the front at all, then that locked back door doesn't matter at all.

That's what it seems like to me when people say "I run MoltBot in a VM so it's safe."

Yes, but then you put all of your sensitive data into it!

It doesn't matter if it's in a VM if it has all of your data anyway.

The idea of "let's let people run OpenClaw in a VM" is hilarious to me.

Running in a VM is the least important part about making it safe.

Once POSIX is in the mix you can't make clear containment boundaries.

The first step that everyone does, "Put it in a VM and then give it mediated access to the surrounding context" is a cul de sac.

"I think most people focusing on securing these are focusing on isolation, but that's really step 0 of a step 3 process they'll come to understand as they try it in practice. It's turtles all the way down. The problem is that LLMs make it impossible to trust the actions / outputs of anything coming from inside. Adding another level of bubble wrap doesn't change the fact that what people are trying to do--use LLMs to take action on their data--is fundamentally dangerous in today's model."

Sandboxing is necessary but nowhere near sufficient.

I think it's extremely hard to successfully retrofit a secure agent environment on top of the web, or any other existing software ecosystem.

The most hardened but useful sandbox in deployment is the web sandbox.

The next big thing will definitely use it.

Breaking Trust with Words: Prompt Injection Leading to Simulated /etc/passwd Disclosure.

(Or any consumer chatbot.)

They're both, superficially, a chatbot.

But they feel radically different.

In a chatbot, you never get more leverage.^[bg]

But Claude Code uses chat input to create a durable, levered output.

Even if you never look at the conversation again (which you by default can't do easily), the code remains.

Each session with Claude Code distills more tools that can provide further leverage.

This can allow the accumulation of compounding leverage.

With things like Cursor autocomplete, it was possible to work the same way you did before, just a bit faster.

But with Claude Code, it fundamentally changes how you work.

That forces you to figure out new ways of working that are more native to LLM-assisted tools.

In the past, "prompt injection" was hard to get even developers to think about.

Whereas the danger (and power) of Clawdbot is self-evident, inescapable.

Skills are extremely useful, now we just need to figure out how to make them safe!

If you're intimidated by it, you should definitely not be flying it!

It's such a useful strategy that nature keeps on rediscovering it.

Small units, just the right amount of customizable.

Tons of power.

To be safe it has to be arcane and feel scary to most people.

Just a big foreboding black box.

You can do anything–including some things that will cause you irreparable harm.

If you utter the wrong gibberish you can destroy your entire computer. That's terrifying!

Like a kindergartner being afraid to make up gibberish words in case they say a real bad word.

There's very little data on it that's not also elsewhere.

It's the reaction chamber, where I can combine my data with the CLI.

Use them to take on meaningful projects that you never would have attempted before.

Another way to see it is that it allows everyone to create personally meaningful stuff.

The book I vibecoded might be seen as slop to a stranger.

But to my family and the people it's about, it's deeply meaningful.

AI allows creating bespoke things for individuals and small groups that would have never been possible before.

AI content for mass market content is just a faster horse.

But AI for meaningful personal creation is like a car.

You had to convince the labor (and perhaps a whole team) to do a project that probably won't work.

So you only mounted research expeditions when it was likely to work… or so obviously important that it didn't matter.

But LLMs make great research goblins.

The result is you can explore more options in lower-stakes environments than ever before.

That makes the likelihood you discover great ideas structurally higher.

The people who got into engineering for the fun of it are over the moon.

The people who got into engineering as a great white collar job hate it.

The former see coding as a means to create cool and valuable things.

The latter see coding as an end, because people will pay you to do it.

He just passed the LLM the old APK and it reverse engineered it and made a brand new version in iOS.

All software is now basically forkable.

When software is expensive to produce, you need a minimum sized market to make it economically viable.

When software is basically free, it can be produced for a niche of a single user.

Notably, this is not just photocopying ideas.

It requires judgment, nuance, and produces something structurally valuable and distinct from its inputs.

A process that transmutes ordinary inputs into something special and valuable.

It's why being polite and encouraging can help LLMs do better.

You end up in different latent space basins by using the right words.

LLMs do better when they think they can do it and are given positive reinforcement.

In it she describes how people who know parkour see stairs differently.

Similarly, people who know how to build software see everyday experiences differently.

PMs know a kind of parkour that the vast majority of the population will never know.

A robot has its own form of motive force, even though it's not its own agency.

A plant has agency but minimal motive force.

It's responsive and has agency but never in a way that threatens mine.

Not dead with a living thing grafted on the side.

If software can be created cheaply, you don't have to add features you might need.

When the need arises, you can simply tweak it to add it.

JIT software is Just Right software.

Exactly the features you need in that moment, no more, no less.

Software that's expensive to produce you need to jam it full of features just in case you need them.

But now LLMs have the potential to find the next Stuxnet for many orders of magnitude cheaper.

Imagine a world where everyone could make their own Stuxnet to sic on their enemies…

Infinite software isn't an unalloyed good.

An app either becomes an island or a system of record.

The islands get smaller and smaller, focused on a tiny, separate niche that only needs a pinprick of context.

The systems of records grow into aggregators.

Vibecoding has led to an explosion of 0.8 versions of software.

When you think you're 80% of the way there optically, you're actually 20% of the way there for load-bearing use cases.

That means we're going to have a cacophony of demoware.

Sifting through what software is actually useful will become much more important.

Developer implies "makes software for others."

But some people using Claude Code are just using it to make software for themselves.

A very different implied quality bar.

Before there was another step of the engineer actually implementing it.

Now from the spec LLMs can just build it.

That process of distillation of user need into software spec is more important than before, not less.

Imagine if everyone had a personal PM helping them design perfectly bespoke software.

Claude Code asks you lots of structured questions.

But many of those questions are hard to answer if you can't think like a PM and at a very high level like an engineer.

All of the authentic actions of the crowd can be distilled into extremely potent quality signals to help everyone.

Tons and tons of enthusiasts making a better experience than any individual company would ever be incentivized to do.

The only thing that matters for whether a use case is prioritized is how much motivation a user with that problem has.

Anyone else in the ecosystem benefits from the effort of the most motivated member with a need similar to theirs.

The power of an open ecosystem.

Imagine a system that allowed you to do the same to the providers?

Before, it required infinite patience to do it as a consumer, it wasn't viable.

But now LLMs have infinite patience and you can deploy them to achieve your interests.

For example, the message you're drafting but haven't yet sent isn't visible to the other people in the chat.

But there's nothing preventing apps from violating this expectation.

For example, in customer support chats often they can see what you're typing even before you send it.

The thing that will unlock resonant computing by default is the right medium.

ATProto is the current leading candidate.

There will be others, too, and that's great!

What we see for chatbot subscription revenues reflects that lower efficiency of value.

Already people who are using LLM coding agents are willing to spend much, much more, and that's a better index of what future willingness to pay will be.

When LLMs create value, people are more than willing to pay for it.

It's Amazon's assistant, situated in your kitchen.

This isn't about prompt injection, but just a reminder that these deep, personal conversations are extremely sensitive, and if they are leaked they are very dangerous.

"Private surveillance is so much more scary than regular government surveillance because they have every incentive to invent new ways of surveilling you that they then try to sell to governments."

That is, software that's constantly nudging and nagging you from the backseat, even when you want to drive.

It's pervasive, because it's what you get when you optimize software.

The software shaping you to fit it, vs you changing the software to fit you.

What makes it slop is when you don't even review the output, and just share it with the world.

When you have a dialogue with LLMs you can make something better than you could have made alone.

Inoffensive to everyone and yet loved by no one.

An internal consensus / average.

When your work is edited by a human, they pull it towards their taste.

When your writing is edited by a centralized, singular LLM, it pulls it towards the bland middle.

If it's written by a human and then edited by an LLM, it still has a human-sourced backbone.

If it's written by an LLM and then edited by a human, it has an AI-sourced backbone.

One of the reasons I prefer the AI-as-editor writing modality.

If everything is written by a handful of centralized LLMs, we'll lose variety in our arguments in society.

We don't credit editors or ghost writers today.

The real test: are you willing to put your name to the output and stake your reputation on it?

You can imagine a little fancy latin-sounding phrase that means "I acknowledge I used AI to help produce this."^[bm]

"Oh, I kind of like this. … wait, this was written by an LLM?!"

If feels like "you tricked me" and you're embarrassed you fell for it.

That negative surprise manifests as disgust.

1) Distinctive and authentic to the creator.

2) Resonates with other people.

Taste is the ability to discern differences others can't see directly.

Good taste is taste that other people like.

Sometimes a thing that is taste but not good taste becomes good taste in the future when the population's taste changes.

But most people whose taste doesn't resonate will never resonate with others

No matter what you do, you're unlikely to get hurt, and you'll likely get a good result.

Google Search had this characteristic, and chatbots do too.

The expectation for how likely a given input is to give good enough results is a prior that configures how likely a person is to try using it for a given use case.

A friend used to play piano.

She has a keyboard she rarely uses, but has brought with her through multiple moves.

That keyboard represents her intention to keep the production of music in her life.

If you catalog the things in your life, you could detect evidence of what is most important to you.

To avoid the bear you only need to be faster than the slowest person.

That's a multi-step process.

If you're doing a product for enthusiasts in a category that already exists, you just have to show your thing is better for a single user.

Any network effect becomes a bonus.

A mise en place.

Effortless, focused just on the act of creation, not the labor of getting to that point.

Imagine an AI system that did that for you.

That automated the cognitive labor of creating the right mise en place.

But they also built a monster of a DVD business on the way to that north star.

Had they focused on streaming prematurely it wouldn't have work, they would have died.

Most possibilities will be junk that no one will try again after someone does it the first time.

After the landscape is all picked over it's clear what the viable ideas are and everyone focuses on those.

Like dividing by zero.

That's one of the reasons I think people are underestimating the world of infinite software.

Even if it's just nudging information streams flowing through you.

Even when you feel like just a traffic cop shuttling information from someone to and from Claude Code you're still exercising judgment about what to share.

Before everything felt chaotic and disjoint.

Now everything slots into place, and it fits all the constraints you had discovered.

Scout for the constraints that will be important.

Build your set of useful tools and implements.

Then, when the stars align and the universe opens a temporary path, execute like hell.

When you're well prepared and the situation is right, good work can happen fast.

The Cyanobacteria were so successful that they poisoned themselves.

Oxygen to them was pollution, and led to a mass die off.

But it opened the world for entities that relied on oxygen.

LLMs could not have been discovered by the aggregators.

But it remains to be seen if aggregators will survive a world of infinite software.

There are a number of groups that are likely to be early adopters… and are also very unlike the mass market.

If you aren't careful, you could get "captured" by them, and end up climbing a much less interesting and smaller hill.

But over time it transcended that embarrassing start and became mainstream.

The things that made it good for porn also made it good for just about everything, and that in the end won out.

Contrast that with, say, OnlyFans, which will never shake that connection.

Silicon Valley, time to decide!

That is, if one entity bear hugs it.

This is only existentially dangerous if one entity bearhugs it and controls a majority of the investment in the ecosystem.

If multiple entities, even powerful ones, all bear hug it they get stuck in a tug of war that keeps the ecosystem at least not captured.

Once they do, everyone knows not to trust them.

But even if any given entity can only do one rug pull, the danger is if one all-powerful entity does the single rug pull that then allows them to run the world forever.

There are a lot of companies in the age of LLMs that are positioned to have the "one rug pull to end all competition."

Not saying any of them would do that… but they could!

There are two very different goals for ecosystem members: 1) token holders and 2) users.

The users want the product to be as useful as possible.

The token holders want the token's value to go up.

These two interests can be aligned… but don't have to be.

There's a constant gravitational pull towards the interests of the token holders.

The moves to increase the value often hollow out the usefulness of the product, in little papercuts.

You as the creator likely hold a lot of the token.

At each point, you're incentivized to hollow out your baby.

If you saw the product as a means to make money, that's fine.

If you saw the product as a moral end, then it's torture.

The quadrant that is unknown to you but known to others is potentially very dangerous.

That's a high-leverage ability for someone to manipulate you.

From this, one of my favorite memes of all time.

Your entire world tilts on its axis and you feel overwhelmed, sick to your stomach.

You question everything, and don't know what parts are terra firma.

A friend had this experience with their 3 year old kid and their backyard pool.

Think of your favorite solution to a given problem.

How much of it are you willing to throw away to get to market?

Anything below 95%, you're a researcher.

He was directly inspired for the format by Bits and Bobs!

In contrast, people who are not missionaries but mercenaries need to get good at their skill to be marketable.

If they fail, they obviously need to improve their skills.

But when a missionary fails, they could tell themselves "the reason I'm not successful in the mainstream is because I'm too principled."

Idealists that congregate can form self-limiting backwaters.

Before you crawl you need tummy time.

I'm hyper-focused on people's reactions in real-time.

I'm constantly predicting their actions and morphing what I'm saying to land well.

But this process requires a ton of focus.

In small audiences I'm constantly workshopping new "material."

In larger audiences I tend to use material I already know resonates.

At least, not naively.

But sometimes if you use open-mindedness to discover constraints and then once identified switch into convergent mode, it does work better than either alone.

If it's a means, it's about how much positive impact you can have.

If it's an end, it's about how you feel.

Radagasts are about others.

'Rabbi Haim once ascended to the firmaments to see the difference between the worlds. He first visited Gehenna (Hell).

He saw a vast hall with long tables covered in the most magnificent foods. But the people sitting there were skeletal and wailing in agony. As the Rabbi looked closer, he saw that every person had wooden slats splinted to their arms, stretching from their shoulders to their wrists. Their arms were perfectly straight and stiff; they could pick up a spoon, but they could not bend their elbows to bring the food to their own mouths. They sat in front of a feast, starving in bitterness.

The Rabbi then visited Gan Eden (Heaven). To his surprise, he saw the exact same hall, the same tables, and the same magnificent food. Even more shocking, the people there also had wooden slats splinted to their arms, keeping them from bending their elbows. But here, the hall was filled with laughter and song. The people were well-fed and glowing. As the Rabbi watched, he saw a man fill his spoon and reach across the table, placing the food into the mouth of the man sitting opposite him. That man, in turn, filled his spoon and fed his friend.

The Rabbi returned to Hell and whispered to one of the starving men, "You do not have to starve! Reach across and feed your neighbor, and he will feed you." The man in Hell looked at him with spite and replied, "What? You expect me to feed that fool across from me? I would rather starve than give him the pleasure of a full belly!"'