Just hinting, if you ever wanted to gift me something 👉👈
www.threads.com/@billymurphyart/post/DXP...
Posts by Klemens Arro
Text on dark background: “The default agent's system prompt (~135K chars) deterministically triggers a 400 "out of extra usage" error on opus-4-7, even though the identical call on other agents succeeds. I binary-searched the prompt down to a specific combination: - Baseline "You are helpful." → OK - Full default system prompt → FAIL (consistent across 3+ retries) - Replacing HEARTBEAT → PULSE throughout the failing block → OK - Removing just the phrase , reply HEARTBEAT_OK → OK So something about the HEARTBEAT_OK/HEARTBEAT.md combination in the heartbeat documentation section causes Anthropic's API to reject the request with this specific error. Probably an Anthropic-side issue (maybe they treat these as stop_sequences internally and opus-4-7 has new validation around that). Resumed sessions don't re-send the system prompt, which is why they still work.”
Is Anthropic using HEARTBEAT pattern matching on Opus 4.7 to detect OpenClaw and force it to run on Extra Credits mode?
One often overlooked upside of the EU sovereign tech push is that it can also help new, smaller local tech companies get started, especially since big tech has drained much of the oxygen from the sector over the past decades.
https://shorturl.at/8QQFx
Dropdown menu showing model options: “Opus 4.7” (selected, “Most capable for ambitious work”), “Sonnet 4.6” (“Most efficient for everyday tasks”), and “Haiku 4.5” (“Fastest for quick answers”). Below is “Adaptive thinking” (“Thinks only when needed”) with the toggle on, and a “More models” link.
Opus 4.7 just dropped. Let’s see if it addresses the issues 4.5 introduced and 4.6 amplified 🤞
Split-screen screenshot: left shows Notion sign-in page with fields “Email or phone,” link “Forgot email?”, a CAPTCHA displaying “flogatic,” input placeholder “Type the text you hear or see,” error “Please re-enter the characters you see in the image above,” links “privacy policy” and “terms of service,” “Create account,” and “Next.” Right shows an AI page titled “Identifying The Word ‘Flogatic’” with the same CAPTCHA image, prompt “Type the text you hear or see,” a bubble “what’s that word?”, and analysis text “The word in the image is flogatic.”
Oh, how the tables have turned. Captchas are now great at keeping humans out, while AI has no issues getting in 😂
Screenshot of a UI showing “GDPR redactions” with a badge “Sensitive: HEALTH v1.0.0”. Text reads: “9 value(s) replaced with <PII:TYPE:N> tokens before this row was stored. Raw values are not retained.” Category chips: “EMAIL: 1”, “HEALTH: 2”, “IBAN: 1”, “PAN: 1”, “PERSON: 3”, “PHONE: 1”. Below, a “Prompt” box contains: “Hi <PII:PERSON:3>, I am <PII:PERSON:2>. Reach me at <PII:EMAIL:1> or <PII:PHONE:1>. My IBAN is <PII:IBAN:1> and my card is <PII:PAN:1>. <PII:PERSON:1> zeigte <PII:HEALTH:2> für <PII:HEALTH:1>.”
True GDPR compliance by design isn’t easy 😅 But it is doable.
We redact any GDPR-defined PII, in any language, from free-form LLM prompt logs.
This required a rules-based layer for clearly structured data, plus a purpose-built local AI model-based layer that can run on a small VM
I just can’t stop playing this album after it popped up in my recommendations 🎈
youtube.com/playlist
Here’s how my AI Executive Assistant keeps an eye on my health and intervenes when needed. It proposes where and what I should get for lunch. Bugs me when I’m late at the office.
More info and actual examples 👇
ailab.ee/an-ai-assistant-that-act...
Error message screenshot. Text at top: “API Error: Claude Code is unable to respond to this request, which appears to violate our Usage Policy (https://www.anthropic.com/legal/aup). Try rephrasing the request or attempting a different approach. If you are seeing this refusal repeatedly, try running /model claude-sonnet-4-20250514 to switch models.” Below, a yellow alert titled “Something went wrong” repeats the same message and adds: “You can restart the conversation from an earlier message.” Buttons: “Go back” and “Try again.”
It’s not that fun working on cybersecurity marketing materials.
Screenshot with two text snippets, each preceded by “Used Claude in Chrome integration >”. First: “That looks exactly right — soldiers at ruggedized laptops and a portable rack, golden hour forest light, warm and cinematic. Now let me download and wire it in.” Second: “Brilliant image. Let me click the share icon to get the download.”
Cloud Cowork is using ChatGPT in a browser to generate images and keeps complimenting the results 😄
Claude Cowork was using Chrome to validate some work, and it saw my Safari open on the other screen and decided to take a looksy. So it just switched to osascript and started scrolling through my page for a while, and then turned back to its own Chrome. Nosy 😄
(7/7) The moat is the system, the expertise, the orchestration. As the article puts it: “A thousand adequate detectives searching everywhere will find more bugs than one brilliant detective who has to guess where to look.”
Build the system. The models are ready.
(5/7) The article nails the formula: AI cybersecurity is not one task, it’s a pipeline. Scanning, detection, triage, patching, exploitation. Each step scales differently. The magic is in breaking the problem down and matching the right tool to each step.
(4/7) This is the real takeaway for anyone building with AI: a model that scores A+ on one task can score F on the next. Qwen3 32B nailed a perfect 9.8 CVSS assessment on one test, then confidently declared a 27-year-old exploitable bug “robust.” Same model.
(3/7) But here’s where it gets interesting. On a basic security reasoning task (OWASP false positive detection), small open models outperformed most frontier models from every major lab. Rankings reshuffled completely between tasks. There is no stable “best model.”
(2/7) The headline finding: a 3.6 billion parameter model costing $0.11/M tokens detected the same critical FreeBSD vulnerability that Anthropic’s flagship unreleased model found. 8 out of 8 models tested got it right. Every single one.
(1/7) Leaving the Mythos model aside, this is a great illustration of why AI implementation often matters even more than the model itself.
The “jagged frontier” of AI cybersecurity, explained with hard data aisle.com/blog/ai-cybersecurity-af...
(12/12) For a network-level layer on any device: NextDNS blocks tracking calls before they leave your device. Works on iOS, Android, Windows, and Mac. About 10 minutes to configure, and you’ll immediately see how much your phone was phoning home
https://nextdns.io
(11/12) On Windows, Portmaster (free, open source, built in Austria) blocks tracking calls system-wide across all apps, not just the browser. It also shows you every connection every app is making in real time.
https://safing.io
(10/12) Prefer privacy-focused browsers on mobile. Firefox with uBlock Origin or Safari with tracking prevention covers the web layer well. On Safari, 1Blocker also blocks fingerprinting scripts and tracking cookies across 16,000+ known trackers.
https://1blocker.com
(9/12) Be ruthless about what you install. Free utilities, games, random tools often make their money selling your behaviour, not charging you for the app. If you haven’t opened it in a month, it’s probably just collecting data.
(7/12) On Android, TrackerControl does the same job. Developed as a research project at Oxford University, open source and free, it never sends any data off your device.
https://trackercontrol.org
(6/12) On iOS and Mac, Lockdown Privacy (free, open source) blocks tracking calls across all your apps at the device level. It shows you exactly which companies are phoning home and from which apps.
https://lockdownprivacy.com
(5/12) Disable ad tracking on your phone. On iPhone: Settings > Privacy > Tracking, turn it off. On Android: Settings > Privacy > Ads, delete your Advertising ID. Without it, there’s no persistent identifier linking your location history across data brokers.
(4/12) You can’t opt out of the ad industry entirely. But you can make yourself a lot harder to track. Here’s what actually moves the needle:
(3/12) And it’s not just the ad ID. Many apps, Meta and Google especially, build their own profiles using behaviour, device fingerprints, location patterns, and cross-app data. Disabling the ad ID helps, but it doesn’t stop them.
(1/12) Mobile ads are used to track you and hundreds of millions of others without a warrant by ICE, the U.S. military, Hungarian intelligence, and local police departments.
What you can do about it 👇
thehackernews.com/2026/04/citizen-lab-law-...
Prompt injections are tricky, and we needed a way to protect our products, so we built a solution. After all that effort, it would be a waste to keep it to ourselves, so we’re working to release it as a dedicated product.
We’ve already mapped 7976 injection vectors, and counting🚓
Screenshot of a chat titled “Ask Andy” (status dot green) with a message reading: “AI Lab nudge — 4 days since last publishability scan and the first article still hasn't been drafted. The '30-minute financial audit with AI' piece is already queued as the best starting point. But this week's activity gives you a second angle: 43 min Codex + 25 min Xcode + 630 min terminal — real development sprint. The heySec prompt injection firewall you're building could be strong content too: ‘Building a prompt injection firewall: what we learned’ — specific, security-relevant, squarely AI Lab territory. Call to make: start with the financial audit article (already outlined), or pivot to the firewall piece while it's fresh? Either way — something needs to move this weekend.” Bottom navigation shows Dashboard, Apps, Inbox, Chat (selected), Notifications with a “2” badge.
I couldn’t get OpenAI models to work as an assistant. They just sit there and wait for explicit commands to do anything. And even then, it’s just the bare minimum.
Switched back to Claude, and my EA immediately started taking on me about everything I hadn’t done 😂
Downloads window showing a progress bar for “Metal Toolchain 26.4 (17E188)” with “69.2 MB of 687.9 MB (10%)” and a cancel (X) button.
Jumping on the on-device LLM bandwagon