Hi there

Baidu wants Daily Active Agents to replace DAU. The instinct is right, the number is not, and the difference is the denominator.

A monitor said nothing to notify for six days while the thing it watched was down, and it was technically right: a repeat is not news. Coding agents compress work into claims the same way, which is why trust is the cost of the check that would catch the claim being wrong.

A reported ten-million-yuan salary for a 29-year-old researcher is not a celebrity story. It is a price signal from a market with very few sellers.

Five editors, one demo that broke at the worst moment, and the workflow that replaced the one I spent years configuring.

Two runtimes I did not control: a garble-obfuscated Go WebAssembly module gated by a canonical Pratt primality certificate that has to be rebuilt byte for byte, and a Tauri 2.0 binary that ships its own V8 and replaces Array.sort, Math.min and String.replaceAll with native hooks.

A $200 subscription and about ten hours of agent time produced a pre-authentication SQL injection and a full RCE chain in WordPress core. Two of the three shells this year have a published account of machine help behind them, and the third was found by a person, which is the part a headline about AI usually gets wrong.

Challenge 07 of Flare-On 13 keeps 1,035 encrypted ASN.1 entries in the PE overlay: seven layers of decoys, an x86 stall loop whose million iterations cancel algebraically, and a 32-step walk over 700 near-identical stubs that ends in an XTEA decryption.

The implant in Flare-On 13’s sixth challenge is not in the C# at all: it is a patched ICorJitCompiler::compileMethod that hooks five methods by 64-bit polynomial hash, driving a 64-bit LCG stream whose state never resets between HTTP requests.

A 32-round SHA-256 whose Ch and Maj functions were rewritten, keyed off a 32-bit volume serial that spells ICE COLD in leetspeak, and a 264-byte RC4 keystream reused as a two-time pad before five JPEGs come back out of a custom canonical Huffman bitstream.

The first three Flare-On 13 challenges keep the flag in the container rather than the code: a right-click timer over an alternating XOR stream, an NTFS alternate data stream behind a seven-day uptime gate, and a 12 MB polyglot whose five layers only come apart once you strip the CD sector geometry.