Most zkML projects try to verify entire AI models, but that quickly becomes expensive and impractical. After reading the DSperse paper from @inference_labs, the biggest takeaway is the idea of targeted verification — proving only the critical parts of ML inference instead of circuitizing the whole model. That approach can massively reduce memory usage and proving time while still keeping high-value computations auditable. Feels like a more realistic path for scalable decentralized AI. 🚀

I read Rialo's proof-carrying computation post. Dense content, technically. The RISC-V choice finally makes complete sense SP1, RISC Zero, and most modern zkVMs speak the same language. Being able to verify proofs natively without having to simulate a foreign execution model is a real architectural advantage. Jan Camenisch being on the team also hits differently after reading this. 30 years in cryptography, 30,000+ citations that kind of research depth is rare in L1s. One open question though: input validation is left to the developer. A proof says "this computation was executed correctly" it doesn't say "these inputs reflect ground truth." For RWA applications that depend on real world data, that's a critical distinction. They tucked it in the appendix, but it's one of the harder questions here. Still research quality, architectural coherence, and team composition rarely come together like this. @RialoHQ

🚨 "Mini Shai-Hulud" infects high-frequency open-source components; echarts-for-react affected The open-source component echarts-for-react, with 1.1 million weekly downloads, has recently been compromised with malicious code. Hundreds of packages under Alibaba’s data visualization suite AntV have also been impacted. The incident originated from the compromise of the developer account "atool," allowing hackers to inject obfuscated code into underlying components. The infected version 3.2.7 was released for only 19 minutes before vulnerability scanners flagged it as fully compromised. The malicious worm has been named "Mini Shai-Hulud," resulting in a supply chain security score of zero. 23pds, Chief Information Security Officer at SlowMist, shared the post and issued a warning to developers to check for exposure.

JUST IN: GitHub says internal repositories were breached. So far, there is no evidence customer data or private repos were leaked, but the investigation is ongoing. If you have API keys or sensitive credentials in code, even private repos, now is the time to rotate them.

🚨 Supply chain attack compromises hundreds of open-source packages 🚨 Over 630 malicious versions published across 317 packages in 20 minutes. Attackers gained control of a developer account to distribute malware. Key projects such as Antv are among those affected. Primary goal: Steal credentials and access sensitive information. A reminder of the vulnerability within the digital ecosystem.

I know a lot of you people won’t understand how important this is yet. writing formal specs used to be one of the hardest parts of verification because it required deep expertise and took time. @Aptos integrating AI into that workflow changes it pace completely -AI-assisted…

89%. That's the increase in attacks by AI-enabled adversaries in 2025, taken from CrowdStrike's 2026 Global Threat Report. The fastest recorded eCrime breakout time this year: 27 seconds. What used to take the world's best hackers days now takes an hour. What took an hour now takes minutes. AI democratized the attack. A criminal gang now operates at the level of a small nation state. Volume. Speed. Autonomy. The response has been more monitoring. More detection. More patching. That's not wrong. But it doesn't scale with the threat. When the attack surface grows 89% in a year, defense needs to be in the architecture - not the maintenance plan.

there are several reasons behind the recent wave of hacks & it’s genuinely painful to watch promising solutions collapse due to poor security judgment & lack of critical thinking: 1- a huge number of builders today lean too heavily on AI-generated code & copy, paste, deploy. very few actually audit or deeply understand what they’re shipping. ironically, attackers can likely use the same AI systems to identify and exploit weaknesses in the exact code AI helped generate. 2- new attack vectors are emerging faster than most teams can comprehend. many vulnerabilities are only recognized after the damage is done & a large portion of these evolving exploits are likely being accelerated by AI as well. 3- auditing standards have become questionable in many cases. while auditors alone aren’t the root cause, weak reviews combined with careless development create the perfect conditions for disaster. i’m not even touching on social engineering attacks because if a team fails to enforce proper OPSEC and internal security discipline that points to a much deeper level of incompetence.