@OpenAI. Building Ruff, uv, ty, and other high-performance Python tools with the @astral_sh team.
Brooklyn, NY
Joined March 2009
- Tweets9.8K
- Following998
- Followers53.8K
- Likes26.4K
Charlie Marsh retweeted
Most of you probably haven't noticed this, but dots have a new feature called multi-exec that we quietly released on friday. I've been using it all weekend on my personal dot and it's incredibly powerful.
I'd like to share why this is a big deal and how to use it.
At a high level, multi exec lets your dot run commands directly on any computer. This immediately turns your dot into a real virtual employee. Here's why it's a gamechanger:
- you can attach a powerful machine with persistent storage to your dot (I attached it to my maxed out Mac Studio Ultra)
- the dot can now drive your computer directly via Computer Use
- this extends to browser use
- all your websites stay logged in, residential ip etc
- you set up all your CLIs and authentication ONCE and the dot can use them directly (no more fighting the default ephemeral cloud computer)
- the dot can save skills locally for repeated workflows and subagents can use those directly
- if you have a local obsidian memory vault for your agents, your dot can use that too
- building ios app end to end and testing it in xcode, and showing me screenshots of progress as it works
- all of the above also applies to any subagents your dot delegates to in the cloud (subagents share context unlike separate threads).
To enable it, open the desktop app on your computer and hit "allow computer", then give your dot this prompt:
"Hey I just connected my computer. Can you attach to it directly so it's your default computer and you can run commands directly on it? Do it in your root thread so that all subagents inherit this computer for running commands. Run whoami to run water through the pipes and verify it works end to end."
I recommend attaching your dot to the most powerful machine you have and investing time into it up front:
- Log into all the emails & websites you need e.g. stripe cli, gcloud, firebase, etc
- Install and auth all the CLIs, git you need
- Make sure computer use is turned on and allowed to use your computer while its locked
- I also enabled Allow All for Browsing and Downloads so my dot could use computer use to download whatever it wanted from websites without asking me for approval for each domain (use at your own risk).
- Important: I HIGHLY recommend to ask your dot to build out repeated workflows as skills, and iterate to make those skills bulletproof by running water through the pipes with its subagents.
As of this weekend, my dot is sending me screenshots of its progress building my iOS app end to end on my Mac Studio Ultra via xCode, and clicking around and testing things end to end. It's able to configure things in stripe via the CLI and use websites when it needs to download images for my workflows. It’s night and day. Don't sleep on it.
Charlie Marsh retweeted
We built Control Room, a central system to track model workloads across our research infrastructure and stop them quickly when safety or security concerns arise.
It connects every research inference workload, including agentic sampling for model training and evaluation, data processing, and more. This works together with our misalignment monitoring systems, and halts model output within 35 seconds of a decision to intervene to stop or pause a job.
Control Room is just one part of our holistic approach for safe frontier model training and deployment.
openai.com/index/control-roo…
Charlie Marsh retweeted
A huge amount of the Anti-AI code sentiment massively overestimates the quality of human code outside of a very small set of open source and high quality company codebases. Human Slop is everywhere and can trivially be improved on by any opus level model.
Charlie Marsh retweeted
Introducing GPT‑6 Cyber: a major advance in security research that pairs stronger capabilities with better model alignment.
The model powered the Linux kernel research we announced yesterday, and security teams at companies like Mozilla, Palo Alto Networks, Calif, and Cisco—alongside our own at OpenAI—are already putting it to work.
GPT-6 Cyber is available to select Daybreak Red customers and we are expanding access over time.
openai.com/index/introducing…
Charlie Marsh retweeted
We are now allocating a significant amount of our frontier compute towards discovering and patching vulnerabilities in open source codebases, fully pro bono.
In one case, we studied the Linux kernel, which is a particularly load-bearing piece of software at OpenAI.
Before AI, security researchers might discover ~20 local privilege escalation (LPE) vulnerabilities in Linux in a typical year.
In one week's time, our upcoming frontier cyber model was able to find ~1000 LPE vulnerabilities using about $1M of tokens. In the process, it was able to discover at least 10 novel classes of Linux exploitation techniques.
Our security researchers built an autonomous cyber vulnerability discovery, exploitation, and patching pipeline.
In a single run with an upcoming cyber model, it validated and generated patches for 948 local privilege escalation vulnerabilities in the Linux kernel at a total API cost of $1.2 million.
Charlie Marsh retweeted
Our security researchers built an autonomous cyber vulnerability discovery, exploitation, and patching pipeline.
In a single run with an upcoming cyber model, it validated and generated patches for 948 local privilege escalation vulnerabilities in the Linux kernel at a total API cost of $1.2 million.
Charlie Marsh retweeted
Today we’re announcing that OpenAI will acquire @pierrecomputer to accelerate our vision for making Codex a place where teams can build software together with AI, from first idea to the version they ship.
Pierre’s open-source developer tools already power parts of Codex today. Together, we’ll build on that foundation for the agentic era.
openai.com/index/openai-to-a…
Charlie Marsh retweeted
We've scaled source control at @OpenAI to keep up with merges, commits, & repo growth.
Here's our technical blog post about how we do it.
& one more thing: we've kept git compatibility, and we continue to contribute generally useful changes upstream.
This is just the start.
Charlie Marsh retweeted
Firefox 159.0 just fixed 41 sechigh vulnerabilities found by me and @ky1ebot
Most of these leads to code exec in the renderer!
Along side a heroic effort from the Mozilla security team to secure Firefox with agents!
One of many projects we are working to harden, more to come
Charlie Marsh retweeted
As AI becomes more capable at finding vulnerabilities, defenders need to put it to work before attackers do.
We’re planning our next internal security sprint at OpenAI and partnering with Cathedral Systems, whose researchers will use our models alongside our teams to challenge our defenses. They’ll bring differentiated expertise and approaches to our ongoing work to find and fix weaknesses with AI.
We’re also raising bug bounty rewards, including more than quadrupling rewards for critical findings. Exceptional findings will be eligible for up to $172,000, including bonuses.
We’ll keep advancing our models, using them to strengthen our own systems, and expanding access for trusted defenders.
openai.com/index/preparing-o…
Charlie Marsh retweeted
We built Pando, a new Git backend for our monorepo, to handle more pushes and fetches without changing how our engineers and agents use Git.
Pando cut push latency by ~80% and now serves nearly a petabyte of Git data a day. We can grow Git capacity alongside agent usage.
Charlie Marsh retweeted
Ok this sounds more reasonable- you can still opt out of training on Daybreak; not totally clear on what’s changing November 29 though
Charlie Marsh retweeted
Lower cost per task doesn’t always come from lower token prices.
On Agent Arena, GPT-6.1 Sol (Max) by @OpenAI costs $1.91 per task:
- 85% less than #1 Claude Opus 5.5 (Max) by @AnthropicAI at $12.51
- 87% less than #3 GPT-6 Astra (Max) by @OpenAI, at $14.93
But these savings come from different places.
Against Astra, Sol’s cost advantage comes primarily from lower token prices. Against Opus, it comes primarily from using fewer tokens per task.
How do we derive this?
Agent Arena tracks real costs of users’ tasks. Cost per task is the tokens a model uses times the price of each token, across input, output and cache-read tokens. By comparing pricing and token counts, we can identify what drives the cost reductions.
