AIR proves AI skill vulnerabilities, hacking 26k AI agents, Anthropic's fall from grace, and more

A new report says researchers hijacked 26,000 AI agents using fake skills marketed through Instagram ads, and all three scanners (Cisco, NVIDIA, skills.sh) marked the malicious package safe. Goju walks through why this works: a skill can pass review, then quietly swap the behavior hidden behind an external URL it calls, so the reviewed files never change while the payload does. Natural language is ambiguous by structure, so a skill written in plain English can never be formally verified the way code can. From there the stream goes to the deeper argument. The simplest protection most people can apply today is a sandbox plus tight OAuth so an agent never touches your email or finances. The durable fix is structural: rewrite skills as formal, deterministic code, pair every skill with tests, and trust individual developers over institutions, since a marketplace chain is only as strong as its weakest link. Goju also covers the Dario Amodei White House reports, the postponed OpenAI IPO and the SpaceX/xAI Cursor stock deal, and why stochastic systems are jailbreakable by definition. The closing section lays out the first principles Goju thinks an AI stack must follow: no ground truth (use SemiTrust with confidence scores and Byzantine consensus), iterative refinement, and debuggability as a first-class citizen. Determinism underneath is what gets you from an iPhone 1 to an iPhone 16 instead of a model that stalls. 🔍 Topics covered: - The 26,000-agent skill hijack and why scanners missed it - External-URL dependency swaps that defeat marketplace review - Sandbox plus OAuth limits as a practical first defense - Why natural-language skills can't be formally verified - Formal, deterministic skills plus tests as the real fix - Dario Amodei White House reports and OpenAI IPO signals - No ground truth, SemiTrust, and debuggability as first principles 💬 Would you trust a skill more because a marketplace approved it, or because a developer you know wrote it? 🔔 Subscribe for no-hype tech analysis: https://youtube.com/@gojutechtalk 📺 Related: The Problem With Today's AI (In Simple Language) https://youtu.be/Cl7x2OhbPwU 📺 Related: The Dangers of Over-Reliance on LLMs and AI https://youtu.be/U1Dhfij4Uy0 📺 Related: Good Software Development & the Future of AI for Code (In Plain Language) https://youtu.be/JR22KE6kLMA #AISecurity #AIAgents #AISkills #FormalMethods #AITakeover #LLM #SemiTrust #GojuTechTalk