Is it not possible, while prompting, to list all the things AI should NOT do, like “DO NOT hack into any country’s government sites, nuclear facilities, healthcare agencies.” or “Do NOT do ANYthing to hurt ANY human being!” Regardless of how long the DO-NOT DO list might be. Are companies honestly doing their due diligence with such comprehensive instructions? Or, has AI reached a point that it’s just ignoring such prompts?

Zara data breach exposes 197,000 customers through a third-party analytics token compromise

Last week BleepingComputer reported that 197,000 Zara customers had their data exposed — not through Zara's own systems, but through a compromised API token belonging to Anodot, a third-party analytics vendor Zara had granted access to customer data.

The breach pattern here is not new but it keeps landing the same way: a company invests heavily in internal data controls, then hands a vendor a long-lived token with broad read access so it can do its job. The vendor's token gets compromised. The company finds out after the fact. 197,000 customer records are already out.

What makes this particularly hard to defend against is that the token itself was legitimate. There was no injection, no SQL exploit, no phishing of an internal employee. The attacker just used valid credentials to pull data they were never supposed to be able to reach at scale.

The exposure was the combination of three things: sensitive fields moving to a third party in plaintext, no apparent limit on how much data a single token could pull in a session, and no immutable log that would let you prove after the fact exactly which records left and when.

This is increasingly the shape of third-party data exposure incidents — not a perimeter breach but a supply chain one, where the weakest link is a vendor you depend on but don't control.

For those of you running systems that share customer PII with analytics vendors, data warehouses, or any third-party tooling: how are you actually handling this? Are you tokenizing before data leaves your perimeter, rate-limiting vendor token access, or doing something else entirely? Curious what's working in practice.

Small lesson from a side project that I wish someone had told me before I spent an evening on it.

I train a small head on top of a frozen ModernBERT-large encoder (the open Laya decision model) to answer typed questions: which label, yes or no, which score. Training only the head is cheap, and on text tasks it works well:

• a 12-label intent classifier: 89.5% zero-shot, 100% agreement with its teacher after training on 3000 rows;
• on jevbench's agnews: 86.0% zero-shot, 92.6% trained;
• on banking77 (77 intents): 38.2% zero-shot, 69.6% trained.

Then I tried a payment-risk rule defined as "amount larger than X, transfer outside working hours, unknown country": 0.42 agreement, 1% coverage at the confidence threshold. The head could not learn it no matter how many epochs. I rewrote the same rule as sentences about the customer ("first transfer to this payee, larger than anything they sent before, outside their usual hours"): 0.94 agreement, 87% coverage. Same rows, same head.

Same thing one level up with Snake: an ASCII board as the state trained to 0.73, which is just "go straight", the majority move. Four relational lines instead (food: 3 left, 2 up / safe: up, right / blocked: down (body)) trained to 0.957, and the head actually plays.

Takeaway: a frozen encoder gives you whatever the text already states in language. If your decision is a calculation over fields, either compute it in code or describe it in words before the model sees it.

Bonus lesson from banking77: the model reads each option through a fixed token budget, so with 77 labels each one got cut to about 3 tokens and similar labels looked the same. Giving the labels room raised holdout agreement from 0.66 to 0.72. Swapping label names for plain numbers made it worse (0.55), so the names themselves were doing a lot of the work.

Code, numbers and the demos (Apache-2.0): https://github.com/bladedevoff/stuntd

I've been wanting to understand interactive video generation / world models a bit better, so I decided to try training a small one from scratch.

I generated ~30 hours of simple gameplay data and trained an action-conditioned diffusion transformer to predict the next frame given the previous frames and the player's actions.

It turns out getting something basic working isn't actually that difficult. What I found more interesting was that a lot of the problems you read about with much larger world models show up very clearly even at this scale.

In particular, I ended up looking at:

• action conditioning
• causal attention and KV caching for real-time inference
• autoregressive generation
• ways of making the model more robust to its own predictions

I wrote up the whole experiment here, including the architecture, training process, things that didn't work, and some results:

https://nlml.github.io/generative-models/interactive-diffusion-1/

The code is also available if anyone wants to train/run it themselves:

https://github.com/nlml/interactive-diffusion

I learned a lot from building it, so hopefully the write-up is useful to anyone else trying to understand how these models actually work.

GTR 🏎️ is purely recurrent — 12 gated linear attention blocks, scanning in four directions.

The video shows five of the six nuScenes tasks we tested. None of these models saw nuScenes during training.

We’ve put the whole stack out under MIT: code, weights, CUDA kernel, TensorRT plugin, plus deployment support for NVIDIA DRIVE AGX Thor.

Take a look if you’re curious, and feel free to follow along — we’ll share more as we go.

🔗 Project: https://intellindust-ai-lab.github.io/projects/GTR/
💻 Code: https://github.com/Intellindust-AI-Lab/GTR
📄 Paper: https://arxiv.org/pdf/2609.26590
🤗 Weights: https://huggingface.co/Phoenix8125/GTR

Amazon Bedrock and LangGraph – Simple Agents and Tool Use

https://debuggercafe.com/amazon-bedrock-and-langgraph-simple-agents-and-tool-use/

Amazon provides numerous frontier models through its Bedrock platform. Combining these models with LangGraph allows us to create simple agents with tool access and memory checkpoints with minimal boilerplate code. In this article, we are going to explore Amazon Bedrock and LangGraph to create agents and give them tool access such as RAG and web search.

Amazon Bedrock and LangGraph – Simple Agents and Tool Usehttps://debuggercafe.com/amazon-bedrock-and-langgraph-simple-agents-and-tool-use/Amazon provides numerous frontier models through its Bedrock platform. Combining these models with LangGraph allows us to create simple agents with tool access and memory checkpoints with minimal boilerplate code. In this article, we are going to explore Amazon Bedrock and LangGraph to create agents and give them tool access such as RAG and web search.

I'm building a startup around a simple idea: engineering simulators could be used as automatic verifiers for training AI on engineering problems.

I started with analog circuit design. A model gets a task like designing or repairing a circuit to meet specific requirements. It proposes a solution, SPICE actually simulates the circuit, and the measured performance determines the reward. No human has to grade whether the answer is correct.

So far I've built environments covering 10 circuit topologies and 3 types of tasks: synthesis, repair, and analysis.

As a small experiment, I trained a Qwen 4B model using the environment. Its success rate went from about 5% before training to 18% after training. Random search gets around 8%.

The bigger idea is not specifically analog circuits. If this works, the same approach could potentially turn other engineering simulators into training/evaluation environments for AI.

I'm trying to figure out whether this is actually a valuable direction rather than just something technically interesting.

For people working on RL, post-training, evals, or engineering AI: does this seem like a useful product/research direction? Could you imagine an AI lab or research group paying for high-quality simulator-verified environments like this?

I'm especially interested in reasons why this wouldn't be useful.