Lightnews — Scholar-powered news

Alex Komoroske @komorama.bsky.social · 2d

I just published my weekly reflections: docs.google.com/document/d/1...
ChatGPT is not like Windows. Canned corn from the convenience store. LEARNINGS.md for compounding agent performance. LLMs as meta-boundary objects. Do-think vs do-do. Seeing Like a Language Model. The Hyper Era. Sousveillance.

komoroske.com/bits-and-bobs

Author: Alex Komoroske [email protected] What is this? During the week I take notes on ideas that catch my attention during conversations. Once a week I take a few hours to take a step back and try ...

docs.google.com

Alex Komoroske @komorama.bsky.social · 2d

embracethered.com/blog/posts/2...

GitHub Copilot: Remote Code Execution via Prompt Injection (CVE-2025-53773) · Embrace The Red

An attacker can put GitHub Copilot into YOLO mode by modifying the project's settings.json file on the fly, and then executing commands, all without user approval

embracethered.com

Alex Komoroske @komorama.bsky.social · 6d

Imagine software that doesn't feel like visiting the DMV, but like working with a master craftsperson who knows exactly what you need.

1 3

Alex Komoroske @komorama.bsky.social · 8d

Software today is like eating canned corn from the convenience store. What if it could be more like a personal farmer's market?

2 5

Alex Komoroske @komorama.bsky.social · 9d

I just published my weekly reflections: docs.google.com/document/d/1...

AI as tool, not friend. CRUD-y apps. LLMs grow like a crystal, not a plant. A self-steering product northstar metric: Resonant Engagement Moments (REMs). Disposable software. When want and need are aligned.

komoroske.com/bits-and-bobs

Author: Alex Komoroske [email protected] What is this? During the week I take notes on ideas that catch my attention during conversations. Once a week I take a few hours to take a step back and try ...

docs.google.com

3

Alex Komoroske @komorama.bsky.social · 12d

Code is like a skeleton, LLMs are like muscle.

Skeleton alone: precise structure that can't move. Muscle alone: quivering mass on the floor with no leverage.

Put them together correctly and you get a body capable of threading a needle or throwing a fastball.

1 1 1

Alex Komoroske @komorama.bsky.social · 13d

AI should be a tool, not a friend.

Tools extend your agency.

Synthetic 'friends' are engagement optimization in disguise.

The Star Trek computer never said "good morning."

1 6

Alex Komoroske @komorama.bsky.social · 16d

I just published my weekly reflections: docs.google.com/document/d/1...
AI's last-mile problem. Responsibility laundering. AI as muscle, software as skeleton. Workslop. Chatbots as filming stage plays. Alienable data. Software perfectly tailored to you. The death of one-size-fits-none software.

komoroske.com/bits-and-bobs

Author: Alex Komoroske [email protected] What is this? During the week I take notes on ideas that catch my attention during conversations. Once a week I take a few hours to take a step back and try ...

docs.google.com

1

Alex Komoroske @komorama.bsky.social · 18d

Authentic things feel natural, inescapable, like it could never be any other way... and you'd never want it to be.

1

Alex Komoroske @komorama.bsky.social · 19d

That 'alienable' lens came from @azeem.bsky.social earlier this week. I love the way it captures why data escapes our control the moment it replicates.

2

Alex Komoroske @komorama.bsky.social · 19d

The same origin paradigm ties policies to apps/domains, not data itself. This lets your data be alienated from your intent, destroying contextual integrity. But if policies attached to data—flowing wherever it flows—they'd be inalienable. Your intentions would travel with it.

1

Alex Komoroske @komorama.bsky.social · 19d

Data is alienable. Because it replicates so easily, once it's out of your sight it's out of your control. When used behind your back, it loses its contextual integrity—alienated from your intention, turned against your interest. How can we make your data always work for you?

1 1 1

Alex Komoroske @komorama.bsky.social · 20d

verialabs.com/blog/from-mc...

From MCP to Shell

How MCP Authentication Flaws Enable RCE in Claude Code, Gemini CLI, and More

verialabs.com

2

Alex Komoroske @komorama.bsky.social · 20d

Right now it feels theoretical to most people. Would love to build demos that make it visceral - that "oh shit" moment when you see your own AI get tricked. Small Discord on the site if anyone wants to help create harmless but eye-opening examples.

1

Alex Komoroske @komorama.bsky.social · 20d

Prompt injection is when someone tricks an AI into ignoring its instructions. There's no easy fix because LLMs process all text as potentially executable.

Grabbed promptinjection.wtf and threw together a simple site explaining why this matters.

Prompt Injection

The critical vulnerability lurking beneath the AI hype. Learn why AI systems can't distinguish between instructions and data, and what it means for safe deployment.

promptinjection.wtf

1 1 3

Alex Komoroske @komorama.bsky.social · 21d

The official recording of my O'Reilly AI Codecon talk is now live: www.youtube.com/watch?v=AhW5...

The slides are at common.tools/talks/why-ce...

Why Centralized AI Is Not Our Inevitable Future—Alex Komoroske

YouTube video by O'Reilly

www.youtube.com

3

Alex Komoroske @komorama.bsky.social · 22d

www.economist.com/science-and-...

A structural defense for prompt injection is a requirement to unlock the potential of LLMs to help us in our everyday lives.

Why AI systems might never be secure

A “lethal trifecta” of conditions opens them to abuse

www.economist.com

2

Alex Komoroske @komorama.bsky.social · 23d

I just published my weekly reflections: docs.google.com/document/d/1...

YOLO mode with prompt injection. Self-poisoning spirals. Parasitic AI. AI-as-software vs AI-as-human. LLMs as prototype factories. Swarm Sifting Sort. Tainted smoothies. The hollow era. Hustle vs wisdom. The ZOPA.

komoroske.com/bits-and-bobs

Author: Alex Komoroske [email protected] What is this? During the week I take notes on ideas that catch my attention during conversations. Once a week I take a few hours to take a step back and try ...

docs.google.com

2

Alex Komoroske @komorama.bsky.social · 26d

You used to have to learn to speak computer.

Now the computer can learn to speak you.

Alex Komoroske @komorama.bsky.social · 27d

For the power of coactive UIs to be unleashed, they have to be turing complete: able to add not just content but also code to themselves.

That's where all the power to make it truly coactive comes from... but also with the wrong security model, it will be dangerous!

1

Alex Komoroske @komorama.bsky.social · 28d

I want an LLM-native tool that "talks" to me with coactive UI.

Alex Komoroske @komorama.bsky.social · 29d

When you put something onto a shelf you expect it to stay the same.

When you put a seed in soil you expect it to bloom.

2

Alex Komoroske @komorama.bsky.social · Sep 15

I just published my weekly reflections: docs.google.com/document/d/1...

Swarms of research goblins as scouts. The multiverse of code. Climbing the chatbot hill. Pre-assembled lego sets. Ironing out wrinkles in LLM output. Just-in-time tools. Friendly pirates. Resonant Computing. Rolling thunder.

komoroske.com/bits-and-bobs

Author: Alex Komoroske [email protected] What is this? During the week I take notes on ideas that catch my attention during conversations. Once a week I take a few hours to take a step back and try ...

docs.google.com

3

Alex Komoroske @komorama.bsky.social · Sep 12

If you want the full-tilt Alex experience, I recommend you watch the video recording: drive.google.com/file/d/1Hxsz...

Why AI Is Not Our Inevitable Future Recording

drive.google.com

2

Alex Komoroske @komorama.bsky.social · Sep 12

On Tuesday I gave the opening talk at the O'Reilly AI Codecon: common.tools/talks/why-ce...

The default path with AI leads to antisocial outcomes, but we can collectively choose a prosocial path.

common.tools

1 2