Cyber & AI | Founder @CodeWall_AI | Helping teams ship securely

Joined July 2008
618 Photos and videos
“Non technical teams are now shipping production code” We can hack like it’s 1999 again. Thank you for your future business, @brian_armstrong
This is an email I sent earlier today to all employees at Coinbase: Team, Today I’ve made the difficult decision to reduce the size of Coinbase by ~14%. I want to walk you through why we're doing this now, what it means for those affected, and how this positions us for the future. Why now Two forces are converging at the same time. We need to be front footed to respond to both. First, the market. Coinbase is well-capitalized, has diversified revenue streams, and is well-positioned to weather any storm. Crypto is also on the verge of the next wave of adoption, with stablecoins, prediction markets, tokenization, and more taking off. However, our business is still volatile from quarter to quarter. While we've managed through that cyclicality many times before and come out stronger on the other side, we’re currently in a down market and need to adjust our cost structure now so that we emerge from this period leaner, faster, and more efficient for our next phase of growth. Second, AI is changing how we work. Over the past year, I’ve watched engineers use AI to ship in days what used to take a team weeks. Non-technical teams are now shipping production code and many of our workflows are being automated. The pace of what's possible with a small, focused team has changed dramatically, and it's accelerating every day. All of this has led us to an inflection point, not just for Coinbase, but for every company. The biggest risk now is not taking action. We are adjusting early and deliberately to rebuild Coinbase to be lean, fast, and AI-native. We need to return to the speed and focus of our startup founding, with AI at our core. What this means To get there, we are not just reducing headcount and cutting costs, we’re fundamentally changing how we operate: rebuilding Coinbase as an intelligence, with humans around the edge aligning it. What does this mean in practice? - Fewer layers, faster decisions: We are flattening our org structure to 5 layers max below CEO/COO. Layers slow things down and create coordination tax. The future is small, high context teams that can move quickly. Leaders will own much more, with as many as 15 direct reports. Fewer layers also means a leaner cost structure that is built to perform through all market cycles. - No pure managers: Every leader at Coinbase must also be a strong and active individual contributor. Managers should be like player-coaches, getting their hands dirty alongside their teams. - AI-native pods: We’ll be concentrating around AI-native talent who can manage fleets of agents to drive outsized impact. We’ll also be experimenting with reduced pod sizes, including “one person teams” with engineers, designers, and product managers all in one role. In short: AI is bringing a profound shift in how companies operate, and we’re reshaping Coinbase to lead in this new era. This is a new way of working, and we need to leverage AI across every facet of our jobs. To those who are affected I know there are real people behind these decisions — talented colleagues who have poured themselves into this company and our mission. To those of you who will be leaving: thank you. You’ve helped build Coinbase into what it is today, and I am sincerely grateful for everything you've done. All impacted team members will receive an email to their personal account in the next hour with more information, and an invitation to meet with an HRBP and a senior leader in your organization. Coinbase system access has been removed today. I know this feels sudden and harsh, but it is the only responsible choice given our duty to protect customer information. To those affected, we will be providing a comprehensive package to support you through this transition. US employees will receive a minimum of 16 weeks base pay (plus 2 weeks per year worked), their next equity vest, and 6 months of COBRA. Employees on a work visa will get extra transition support. Those outside of the US will receive similar support, based on local factors and subject to any consultation requirements. Coinbase prides itself on talent density. Our employees are among the most talented people in the world, and I have no doubt that your skills and experience will be highly sought after as you pursue your next chapters. How we move forward To the team that is staying, I know this is a difficult day. We’re saying goodbye to colleagues and friends you've been in the trenches with. But here’s what I want you to know as we move forward together: Over the past 13 years, we have weathered four crypto winters, gone public, and built the most trusted platform in our industry. We’ve made it this far by making hard decisions and by always staying focused on our mission. This time will be no different – nothing has changed about the long term outlook of our company or industry. And most importantly, our mission has never been more important for the world. Increasing economic freedom requires a new financial system, and we’re building it. The Coinbase that emerges from this will be more capable than ever to achieve our mission. Brian
3
242
We built this internally at CodeWall; darkport.co.uk/blog/on-build… cc @t_blom @sdianahu
Replying to @ycombinator
Company Brain @t_blom Every company has critical know-how scattered across people's heads, old Slack threads, support tickets, and databases, and AI agents can't operate like that. We think every company in the world is going to need a new primitive: a living map of how the company works that turns its own artifacts into an executable skills file for AI.
3
248
The gig is up 🥲
Apr 24
fuck it, authorization letter generator Claude does not push back when reading one of these lol authorized.xultra.fun
1
2
361
Still won’t make me fly BA
NEWS: British Airways to launch first @Starlink Wi-Fi flight this month. Starlink Wi-Fi will be free for all passengers. BA currently charges up to £22 on long-haul flights for speeds up to 5pbs. Starlink will deliver over 20X that speed at no additional cost to passengers. With Starlink, nobody will have to enter their credit card details or even be a member of the British Airways Club loyalty program to log on. Travellers will simply connect to the network through the plane's hotspot and access the Internet without a login or payment portal, due to Starlink’s insistence on a friction-less experience. BA's first Starlink-equipped flight will be on a Boeing 787.
698
Got my first CVE and multiple CVS 10.0s in huge Tier 1 companies by developing a fully autonomous agent system.. write-up’s soon!
It is hard to communicate how much bug bounty has changed due to AI in the last 2 months: not gradually and over time in the "progress as usual" way, but specifically this last December. There are a number of asterisks but imo coding agents basically didn't work for security research before December and basically work since - the models have significantly higher quality, long-term coherence and tenacity and they can power through large and long hacking tasks, well past enough that it is extremely disruptive to the default bug bounty workflow. Just to give an example, over the weekend I pointed Claude Code at a new program's scope and wrote: "Here are the target domains. Enumerate subdomains, grab all the JavaScript bundles, run the full analysis pipeline (endpoints, secrets, source-sink tracing, postMessage handlers), fuzz the discovered paths, spider the authenticated surface, check for IDORs on user APIs, test any interesting GraphQL endpoints, and write up an HTML report of everything you find." The agent went off for ~30 minutes, ran into multiple issues (auth failures, WAF blocks, malformed responses), researched solutions, resolved them one by one, analyzed the JS, fuzzed endpoints, tested access controls, and came back with the report. Two confirmed vulnerabilities and a handful of interesting leads. I didn't touch anything. All of this could easily have been a full weekend of manual work just 3 months ago but today it's something you kick off and forget about for 30 minutes. As a result, bug bounty hunting is becoming unrecognizable. You're not manually clicking through Burp Suite and hand-testing parameters one by one like the way things were since this industry started, that era is over. You're spinning up AI agents, giving them targets *in English* and managing and reviewing their output in parallel. The biggest prize is in figuring out how you can keep ascending the layers of abstraction to set up long-running orchestrator agents with all the right skills, memory and instructions that productively manage multiple parallel hacking instances for you. The leverage achievable via top tier "agentic engineering" for security research feels very high right now. My friends and I have been building out custom skill libraries for Claude Code - things like JS static analysis pipelines, authenticated fuzzing, IDOR testing frameworks, GraphQL introspection - and sharing them with each other. Each person's agent gets better as the collective skill set grows. We're finding more bugs in a week than we used to find in a month. It's not perfect, it needs high-level direction, judgement, hacker intuition, oversight, iteration and hints and ideas. It works a lot better in some scenarios than others (e.g. especially for targets with thick JavaScript clients where you can verify findings with a curl command). The key is to build intuition to decompose the target just right to hand off the recon and testing parts that work and help out around the edges with the creative exploitation. But imo, this is nowhere near "business as usual" time in bug bounty.
1
680
I’ve been a subscriber since launch. I just cancelled my plan and upgraded to Claude Max.
Feb 28
Tonight, we reached an agreement with the Department of War to deploy our models in their classified network. In all of our interactions, the DoW displayed a deep respect for safety and a desire to partner to achieve the best possible outcome. AI safety and wide distribution of benefits are the core of our mission. Two of our most important safety principles are prohibitions on domestic mass surveillance and human responsibility for the use of force, including for autonomous weapon systems. The DoW agrees with these principles, reflects them in law and policy, and we put them into our agreement. We also will build technical safeguards to ensure our models behave as they should, which the DoW also wanted. We will deploy FDEs to help with our models and to ensure their safety, we will deploy on cloud networks only. We are asking the DoW to offer these same terms to all AI companies, which in our opinion we think everyone should be willing to accept. We have expressed our strong desire to see things de-escalate away from legal and governmental actions and towards reasonable agreements. We remain committed to serve all of humanity as best we can. The world is a complicated, messy, and sometimes dangerous place.
Community note
Government officials have contradicted Sam’s claim, saying OpenAI will allow the DoW to use their models for “all lawful purposes”. This could allow for uses Anthropic refused to engage in, namely mass surveillance tools and weapons systems with no human oversight. x.com/undersecretary…
436
Ya'll not prepared... 😬
Feb 20
Introducing Claude Code Security, now in limited research preview. It scans codebases for vulnerabilities and suggests targeted software patches for human review, allowing teams to find and fix issues that traditional tools often miss. Learn more: anthropic.com/news/claude-co…
1
488
17 Dec 2025
People with aphantasia in disbelief
16 Dec 2025
Is anybody able to do this?
696
12 Dec 2025
The only surprising and unexpected thing about this is that it’s -0.1%
After 18 months of tax rises, price fixing, increasing energy costs, falling business confidence, spiralling unemployment and relentless, singleminded political lies and incompetence, economic contraction is only unexpected if you really haven't been paying attention
1
1
401
11 Dec 2025
Last week I started advising a group of “vibe coders” building a B2B SaaS platform. Not software. A platform. Platforms raise more money. They call themselves “technical co-founders.” Their technical stack is JavaScript, vibes, and unsupervised optimism. I asked what their product does. They said it “streamlines enterprise workflows.” I asked which workflows. They said “the enterprise ones.” Their MVP is a login page. It doesn’t log you in. But it has gradients. They said the gradients “signal trust.” Their landing page claims “98% faster operations.” No customer has used it. But the number “felt right.” Their pitch deck has 34 slides. One is about culture. One is about vision. The remaining 32 are charts going up and to the right. None of the charts have units. They don’t believe in units. Units kill momentum. They hired a designer to make their product screenshots. Screenshots of a product that doesn’t exist yet. They call that “pre-visualized UX.” A VC asked about their unique value proposition. They said, “We’re the Notion for AI workflows.” Another VC asked the same question. They said, “We’re the Figma of operational intelligence.” A third VC asked. They said, “We’re like Slack but for outcomes.” I’m not sure what any of those mean. I don’t think they do either. But the confidence was immaculate. Their internal roadmap is a Google Doc titled “Ideas That Slap.” It has 73 items. The first is “AI something.” The last is “Enterprise-level synergy modules.” Everything in between is vibes. They said they’re in “stealth mode.” What that really means is nothing works yet. But they don’t want to admit that. They hosted a webinar to get early customers. Seven people attended. Two were their moms. One was a bot. The remaining four just wanted the gift card. They didn’t stay for the demo. Which is fair. The demo was a Figma prototype animated by someone with shaky hands. They asked me about pricing. I asked what value they provide. They said “infinite potential value.” So they priced it at $39 per seat per month. With a minimum of 100 seats. For a product that doesn’t have a settings page. Or a database. Or users. They asked if they were ready to fundraise. I said, “Not yet.” They said, “But we have a waitlist.” Their waitlist is 112 people who typed their email into a form labeled “Get Updates.” They consider that “market validation.” They applied to an accelerator. Their application said: “B2B SaaS is broken. We’re here to fix it. With AI. And vibes.” They got in. A mentor asked how they’ll acquire customers. They said “thought leadership.” She asked what thought leadership. They said “we’ll figure it out on LinkedIn.” She stopped asking. Now they’re raising a pre-seed round. They want $4 million. They say it’s for “growth.” But mostly it’s for payroll. And maybe a neon sign for the office. They asked if they’re close to becoming a unicorn. I told them: “You’re closer than the people who build nothing… …but farther than the people who build something customers will actually pay for.” They nodded confidently. They didn’t understand. But that’s the beauty of vibe coders and B2B SaaS founders: Everything is traction if you say it with enough conviction. Everything is a market if you draw a big enough box. And everything goes up and to the right… Especially when nothing exists yet.
2
1
226
11 Dec 2025
I’m an optimist but this is whole idea and rhetoric is so fucking stupid. 99% sure it was pushed by Elon and investors to bump SpaceX IPO valuations. Data centers in space make zero sense. The only benefit is access to solar. Everything else is infinitely more harder and expensive— it doesn’t work economically. Yes, power is an issue. But nuclear is the answer, not space.
11 Dec 2025
I will spell it out so everyone gets it: To win the AI race you need the most compute, data, and energy. Everyone is working within the same constraints: there's just one internet, just one GPU provider, same competition over data centers, energy suppliers, etc. Space changes all this. You don't need permitting for land use, and there's no shortage of energy via solar. You can mass produce satellites and they all talk to each other in a swam via laser links. The major AI models are all within a few months of each other in terms of competency. There is no company even within a decade of @SpaceX in terms of launch capacity or cost. Going all-in on space-based data centers completely circumvents the bottlenecks everyone else faces. Overnight the competitive landscape has shifted from 'neck and neck race' to '10 year advantage to @spacex and @xai' The game is already won. It's already checkmate. Elon is all-in on SpaceX going public to raise capital to go all-in on space-based compute. Of course they will win at this point. >"But starship launch costs will make it cheap enough for other people to deploy space based compute" Starship launches will be for SpaceX. To compete, you need your own launch company. Nobody else has this, not by a long shot. >"But everyone was critical of space based data centers a month ago" People were critical of a 16 square kilometer solar array with dockable Nvidia modules. That isn't how this will go down. Tens of thousands smaller satellites in a constellation, the kind only SpaceX has ever built and operated. Everything else is a rounding error compared to the market position SpaceX / xAI / Tesla will be in. > They own the launch capacity > Therefore they will own the compute capacity > Therefore they will win the AI race It's just crazy man.
2
2
275
11 Dec 2025
thanks Spotify
10 Dec 2025
Spotify announces new feature that lets users generate a playlist using prompts.
232
10 Dec 2025
guys just want one thing
127
9 Dec 2025
Also never understood this. Why do you want to wear shoes all day? It’s the same as sleeping with clothes on 🤢
I’ll never understand how the West collectively decided shoes inside the house is normal.
166
5 Dec 2025
Excited to announce that @on3_app has been acquired! 🥳 I know the new team will take it to the next level. On to new things... 👀
1
114
30 Nov 2025
I don't believe anybody has got 0% but you can reduce the watermark by adding 3% white overlayss, slightly blurring the image (~2%), and upscaling it via another AI tool. The actual play here is NOT using AI, but genuine content via UGC.
1
133
30 Nov 2025
Roast of the year
29 Nov 2025
Idk why you'd take advice from someone who's single in a room full of women and unemployed in a city full of jobs
1
374
14 Oct 2025
Sounds like age verification is coming to ChatGPT?
14 Oct 2025
We made ChatGPT pretty restrictive to make sure we were being careful with mental health issues. We realize this made it less useful/enjoyable to many users who had no mental health problems, but given the seriousness of the issue we wanted to get this right. Now that we have been able to mitigate the serious mental health issues and have new tools, we are going to be able to safely relax the restrictions in most cases. In a few weeks, we plan to put out a new version of ChatGPT that allows people to have a personality that behaves more like what people liked about 4o (we hope it will be better!). If you want your ChatGPT to respond in a very human-like way, or use a ton of emoji, or act like a friend, ChatGPT should do it (but only if you want it, not because we are usage-maxxing). In December, as we roll out age-gating more fully and as part of our “treat adult users like adults” principle, we will allow even more, like erotica for verified adults.
1
410