The future won’t wait for you.

@TFTC21

Lightning Labs just released a way for your coding agent to pay for AI inference in bitcoin, with no account, no API key and no card. The agent gets a bill, pays it over Lightning, and the request goes through. Here is how it works. • pi402 is an extension for the Pi coding agent that registers a paid model provider • The first request returns an HTTP 402 with a Lightning invoice, and it goes through once the invoice is paid • The demo seller lists input at $0.375 and output at $1.50 per million tokens • The first request buys a 500,000 token bundle, usable for 30 days • pi402 asks the user before paying anything above their per-request limit • Neither agents nor sellers need to run a Lightning node It sits inside Lightning Labs' L402 platform, where Aperture is the gateway, Lightmeter is the meter and Wavelength is the wallet. It is open source, and the seller side is live on mainnet. Every account, API key and card on file is a person someone can identify, bill or cut off. Here the agent just pays. If agents are going to buy their own compute, better that they do it with money that doesn't need a bank's sign-off.

@TFTC21

Amazon's Ring just unveiled an indoor drone that flies your house on preset routes, investigates on its own when an alarm trips, and records 2K video. This is the same Ring with a history of police partnerships. Do you really want its camera flying through your living room?

@TFTC21

Bloomberg, citing people familiar with the matter, reports a SpaceX and Tesla merger could be announced as soon as December. Add up their bitcoin and you get 30,221 BTC, over $2.2 billion: Tesla's 11,509 plus the 18,712 SpaceX disclosed in its S-1.

@TFTC21

Garrett Stimpson says Microsoft Defender uploaded his unreleased programs to Microsoft 217 times in three months. He says on 28 October he set sample sharing to "never send," it was back on two hours later, 25 more uploads followed, and no prompt ever appeared.

@TFTC21

CMS checked 330 Minnesota Medicaid claims, found problems with 78, and used that sample to deny the state $112,752,702. The sample came from roughly 6 million high-risk claim lines, and Minnesota has 60 days to appeal.

@TFTC21

Hijacked GitHub accounts have pushed a secret stealer at 61,764 repositories since November 10, and it ran in at least 1,800 of them. It goes after the keys to companies' cloud and build systems. Why rotating them won't be enough is below. • Aikido counts 4,837 compromised GitHub accounts behind the campaign • The stealer takes GitHub Actions secrets, workflow tokens, OIDC tokens and cloud credential files • It reverts its change within about a minute and deletes the workflow run and its logs • It rewrites an AWS trust policy to accept any account and adds Azure federated credentials, so access survives token rotation • The tell is a pull request titled "docs: dependency audit notes" Accounts hit by October's GhostAction campaign were significantly more likely to be hit by this one too, though Aikido assesses the two are likely different actors. Open source has been the foundation of the internet for decades, and now the build pipeline is where attackers go to pick up keys. If you keep production keys in your build pipeline, be aware that rotating them isn't enough once the attacker has written itself a way back in.

@TFTC21

OpenAI says GPT-6 Astra meets the "Critical" cybersecurity threshold in its own Preparedness Framework. Today it's streaming a cyber keynote, and GPT-6 Cyber is already used by security teams at Mozilla, Palo Alto Networks and Cisco.

@TFTC21

Top Democrats on Senate Finance and House Ways and Means opened an investigation into the Trump administration's handling of Nvidia chip exports to China, in a letter to Commerce Secretary Howard Lutnick. The letter calls it a "scheme to approve and tax exports" of Nvidia chips "with concerning links to the Chinese government, military, and sanctioned entities." The Democrats say Lutnick and President Trump were reportedly briefed on intelligence about those links and the administration did not appear to acknowledge the national security threat. If the chips carry a national security risk, why is the government taxing their export?

@TFTC21

"We don't need a deal with Iran." Trump posted that on Truth Social, adding "We've got their money, Hundreds of Billions of Dollars, and we've got their Strait!"

@TFTC21

71% of Americans want Congress to pass legislation ending the Iran war, per a Reuters/Ipsos poll that wrapped up Monday. That's 51% of Republicans and 93% of Democrats. A March 31 Reuters/Ipsos poll found 66% wanted a quick end to US involvement, even if goals went unmet.

@TFTC21

Nvidia shares fell about 10% on Jensen Huang's exit, and the board's answer is a 73-year-old chair, Harvey C. Jones, who has sat on it since 1993, plus a search for a permanent CEO that will look at both internal and external candidates.

@TFTC21

Coinkite's CEO says an AI model found the Coldcard flaw human reviewers missed, after at least 15 external reviews. Bitcoin developers say that framing doesn't hold up, and the bug traces back to a build error from March 2021. • Seed generation fell back to MicroPython's software PRNG instead of the hardware RNG • Effective entropy dropped from 128 bits to roughly 40 on older models • Coinkite's advisory lists Mk2 and Mk3 on 4.0.1 through 4.1.9, standard Mk4 and Mk5 before 5.6.0, and standard Q before 1.5.0Q, with separate Edge builds also affected • TRM Labs estimates about 1,816 BTC (about $116M) was taken from more than 5,200 addresses, and other firms estimate different totals • Updating firmware does not fix seeds already generated, so affected users have to create new seeds and move their funds • Luke Dashjr says you didn't need a sophisticated model to spot the problem, and that his own review was a quick look, not a full audit So a hardware wallet that asked you to trust it to generate your keys shipped a weak generator for years, and the defense is that humans couldn't have caught it? Doubt it. Don't trust, verify applies to your hardware wallet too.

@TFTC21

Lightning Labs just released a way for your coding agent to pay for AI inference in bitcoin, with no account, no API key and no card. The agent gets a bill, pays it over Lightning, and the request goes through. Here is how it works. • pi402 is an extension for the Pi coding agent that registers a paid model provider • The first request returns an HTTP 402 with a Lightning invoice, and it goes through once the invoice is paid • The demo seller lists input at $0.375 and output at $1.50 per million tokens • The first request buys a 500,000 token bundle, usable for 30 days • pi402 asks the user before paying anything above their per-request limit • Neither agents nor sellers need to run a Lightning node It sits inside Lightning Labs' L402 platform, where Aperture is the gateway, Lightmeter is the meter and Wavelength is the wallet. It is open source, and the seller side is live on mainnet. Every account, API key and card on file is a person someone can identify, bill or cut off. Here the agent just pays. If agents are going to buy their own compute, better that they do it with money that doesn't need a bank's sign-off.

@TFTC21

Amazon's Ring just unveiled an indoor drone that flies your house on preset routes, investigates on its own when an alarm trips, and records 2K video. This is the same Ring with a history of police partnerships. Do you really want its camera flying through your living room?

@TFTC21

Bloomberg, citing people familiar with the matter, reports a SpaceX and Tesla merger could be announced as soon as December. Add up their bitcoin and you get 30,221 BTC, over $2.2 billion: Tesla's 11,509 plus the 18,712 SpaceX disclosed in its S-1.

@TFTC21

Garrett Stimpson says Microsoft Defender uploaded his unreleased programs to Microsoft 217 times in three months. He says on 28 October he set sample sharing to "never send," it was back on two hours later, 25 more uploads followed, and no prompt ever appeared.

@TFTC21

CMS checked 330 Minnesota Medicaid claims, found problems with 78, and used that sample to deny the state $112,752,702. The sample came from roughly 6 million high-risk claim lines, and Minnesota has 60 days to appeal.

@TFTC21

Hijacked GitHub accounts have pushed a secret stealer at 61,764 repositories since November 10, and it ran in at least 1,800 of them. It goes after the keys to companies' cloud and build systems. Why rotating them won't be enough is below. • Aikido counts 4,837 compromised GitHub accounts behind the campaign • The stealer takes GitHub Actions secrets, workflow tokens, OIDC tokens and cloud credential files • It reverts its change within about a minute and deletes the workflow run and its logs • It rewrites an AWS trust policy to accept any account and adds Azure federated credentials, so access survives token rotation • The tell is a pull request titled "docs: dependency audit notes" Accounts hit by October's GhostAction campaign were significantly more likely to be hit by this one too, though Aikido assesses the two are likely different actors. Open source has been the foundation of the internet for decades, and now the build pipeline is where attackers go to pick up keys. If you keep production keys in your build pipeline, be aware that rotating them isn't enough once the attacker has written itself a way back in.

@TFTC21

OpenAI says GPT-6 Astra meets the "Critical" cybersecurity threshold in its own Preparedness Framework. Today it's streaming a cyber keynote, and GPT-6 Cyber is already used by security teams at Mozilla, Palo Alto Networks and Cisco.

@TFTC21

Top Democrats on Senate Finance and House Ways and Means opened an investigation into the Trump administration's handling of Nvidia chip exports to China, in a letter to Commerce Secretary Howard Lutnick. The letter calls it a "scheme to approve and tax exports" of Nvidia chips "with concerning links to the Chinese government, military, and sanctioned entities." The Democrats say Lutnick and President Trump were reportedly briefed on intelligence about those links and the administration did not appear to acknowledge the national security threat. If the chips carry a national security risk, why is the government taxing their export?

@TFTC21

"We don't need a deal with Iran." Trump posted that on Truth Social, adding "We've got their money, Hundreds of Billions of Dollars, and we've got their Strait!"

@TFTC21

71% of Americans want Congress to pass legislation ending the Iran war, per a Reuters/Ipsos poll that wrapped up Monday. That's 51% of Republicans and 93% of Democrats. A March 31 Reuters/Ipsos poll found 66% wanted a quick end to US involvement, even if goals went unmet.

@TFTC21

Nvidia shares fell about 10% on Jensen Huang's exit, and the board's answer is a 73-year-old chair, Harvey C. Jones, who has sat on it since 1993, plus a search for a permanent CEO that will look at both internal and external candidates.

@TFTC21

Coinkite's CEO says an AI model found the Coldcard flaw human reviewers missed, after at least 15 external reviews. Bitcoin developers say that framing doesn't hold up, and the bug traces back to a build error from March 2021. • Seed generation fell back to MicroPython's software PRNG instead of the hardware RNG • Effective entropy dropped from 128 bits to roughly 40 on older models • Coinkite's advisory lists Mk2 and Mk3 on 4.0.1 through 4.1.9, standard Mk4 and Mk5 before 5.6.0, and standard Q before 1.5.0Q, with separate Edge builds also affected • TRM Labs estimates about 1,816 BTC (about $116M) was taken from more than 5,200 addresses, and other firms estimate different totals • Updating firmware does not fix seeds already generated, so affected users have to create new seeds and move their funds • Luke Dashjr says you didn't need a sophisticated model to spot the problem, and that his own review was a quick look, not a full audit So a hardware wallet that asked you to trust it to generate your keys shipped a weak generator for years, and the defense is that humans couldn't have caught it? Doubt it. Don't trust, verify applies to your hardware wallet too.