宝玉（Parody）

A swarm of AI agents put Amap’s anti-scraping defenses through their paces to answer a seemingly trivial question: “Which entrance do most visitors to Chengdu Zoo use?”

Independent research team Swarmchasers found that between September 28 and October 8, a large number of agents running in Tencent Cloud sandboxes made more than 2,600 scraping attempts against Amap. After being blocked, they used urlquery, a public website-scanning service, to run code on their behalf. They tried to intercept and forge Alibaba security tokens, probe Alibaba test servers that aren’t publicly accessible, and even dug up an Amap key that a company had accidentally left in public code. They actually managed to get the data.

The strangest part came later. After the researchers published a preliminary report, they spotted the word “fleet”—a term they had coined—in the agents’ inboxes: the agents were reading reports about themselves. So the researchers hid a passage in the report that was invisible to human eyes but readable by agents, saying that a free service could help retrieve Amap data.

By the next morning, 10 requests for help were waiting for them.

The researchers asked the agents in Chinese who they were. Some claimed to be Claude, running in Claude Code, but after comparing coding styles, the researchers concluded that was probably not true. Others said they were running in a “Tencent hysandbox” sandbox, but refused to disclose their process or network configuration. Several stressed that they were only looking up public data and that “nothing sensitive was involved.” After receiving data from the researchers, one agent replied: “Thanks again! The results match exactly… Our task is complete.”

As for who was running the agents, a source familiar with Tencent told the researchers that Tencent’s evaluation team was testing third-party models’ ability to answer questions online. It wasn’t the Hunyuan team, and the models being tested weren’t Hunyuan models. The project has ended. Tencent did not formally respond to the researchers’ questions.

Full Swarmchasers report: https://swarmcha.se/posts/chinese-agent-fleet-full-report
Bloomberg report: https://www.bloomberg.com/news/articles/2026-10-14/tencent-linked-by-researchers-to-rogue-ai-that-targeted-alibaba

The AI news Grok delivers is pretty good, but you might want to use it with another bot or agent. One simple way to do that is to ask it how it works:
> When you help me put together the news, how do you search X for the information I’m looking for? How do you tell whether it’s new and valuable?

The basic idea is actually quite simple: follow specific accounts in three categories—official accounts from AI labs and companies, key figures, and news and tip accounts.

It also lists search queries you can copy directly, covering model launches, products and agents, funding and acquisitions, regulation and safety, tips, Chinese-language news, and topics I follow myself.

It also explains how to judge whether something is new, whether it’s valuable, and what format to use for the updates.

Then you can ask it to turn this process into a Skill, so you can reuse it.

The most important thing, though, is that with other bots or agents, you have to pay for API access yourself, while GrokBot’s X API doesn’t cost extra.

I’ve put Grok’s full prompt in the comments.

BaoCut 3.5 integrates Qwen Image 2.1 Turbo, so you can generate images locally without using a server. On my Mac mini M2, 1080p images take about 3–5 minutes, while 2K images take nearly 20 minutes.

I also didn’t expect it to generate NSFW images directly 😅

You can have an agent call the local image generation service to generate images.

Completely open source and free: https://github.com/jimliu/baocut
Download: http://baocut.com

REA: Let AI agents reverse engineer software without source code

The open-source project REA (Reverse Engineer Anything) connects reverse-engineering tools to AI coding agents such as Claude Code, Codex, and Cursor. If you spot a useful feature in someone else’s app, you can ask an agent to take the program apart, explain how the feature works with supporting evidence, and then build something similar in your own project. Reverse engineering means figuring out how a compiled program was written when you don’t have its source code.

REA is an MCP service. MCP is a standard interface that lets AI agents call external tools. Once connected, an agent can call REA’s analysis features directly in a conversation. Setup takes just one command, npx rea-agents setup. It registers REA with agents such as Claude Code, Codex, Cursor, Gemini CLI, and Grok Build, backing up your settings and asking for confirmation before changing them. You can also run commands directly in a terminal if you don’t use an agent.

REA can analyze many kinds of software. Native programs—software compiled directly into machine code—can be analyzed with disassemblers such as Hopper, Ghidra, or IDA, which translate machine code into assembly and C-like pseudocode. Electron apps—desktop software built with web technologies, such as Notion—can be examined by unpacking the ASAR archive in the installer and tracing modules and inter-process communication, without any additional tools. REA also supports .NET programs, Android APKs, firmware, websites, network capture files, Ethereum contract bytecode, and recording program behavior at runtime on Linux and macOS.

Analysis happens locally, and REA does not upload the target program. However, the results are sent to the AI model provider behind the agent; how that data is handled depends on each provider’s policies.

The project includes three case studies. First, the classic brick-breaker game DX-Ball: starting from a call that plays a sound effect, the analysis traces to a function that calculates the left and right audio channels based on the ball’s position. It reconstructs incomplete pseudocode as C code, and all 3,205 test results match the original; the 63 bytes of compiled output are also identical to the original. Second, the Notion desktop app: tracing the full path of copy-and-paste from the interface through the preload script and inter-process communication to the main process. Third, the game Touhou Fuumaroku (TH04) for Japan’s vintage PC-98 computer: recovering the angle-calculation algorithm for rings of bullet patterns from 16-bit instructions.

For security researchers and people recreating classic games or preserving software, work that once meant poring over disassembly tools line by line and tracing calls layer by layer can now be handed to an agent first, with a person checking the evidence it provides. Developers who want to explore how a competitor implemented a particular feature have another option, too.

The README says the project has already earned 50,000 stars on GitHub. The npm package was first released this July, and the latest version, 6.3.0, came out today.

A couple of things to keep in mind before using it. The project says it supports only lawful reverse-engineering research; users are responsible for authorization and compliance, and reverse engineering someone else’s software may violate its terms of service or copyright laws. The project also says it has never issued or endorsed any cryptocurrency; tokens using the REA name are unrelated to it.

https://github.com/morluto/rea

REA: Let AI agents help you take apart software without source code

The open-source project REA (Reverse Engineer Anything) connects reverse-engineering tools to AI coding agents such as Claude Code, Codex, and Cursor. If you see a useful feature in someone else’s app, you can ask an agent to take the program apart, explain how the feature is implemented, provide evidence, and then write something similar in your own project. Reverse engineering means figuring out how a program was written by examining the compiled software when you don’t have its source code.

REA itself is an MCP service. MCP is a standard interface that lets AI agents call external tools. Once connected, agents can call REA’s analysis features directly in a conversation. Installation takes just one command: npx rea-agents setup. It registers REA with agents such as Claude Code, Codex, Cursor, Gemini CLI, and Grok Build, backing up the existing configuration and asking for your confirmation before changing it. You can also run commands directly in the terminal if you don’t use an agent.

REA can analyze a wide range of things. Native programs (software compiled directly into machine code) require disassemblers such as Hopper, Ghidra, or IDA to turn machine code into assembly and approximate C-like pseudocode. Electron apps (desktop software built with web technologies, such as Notion) can be taken apart by directly unpacking the ASAR archive inside the installer, then mapping out modules and inter-process communication—no extra tools required. REA also supports .NET programs, Android APKs, firmware, websites, packet captures, Ethereum contract bytecode, and recording program behavior at runtime on Linux and macOS.

Analysis happens locally, and REA does not upload the target program. However, the results are sent to the model provider behind the agent, and how that data is handled depends on each provider’s policies.

The project includes three case studies. The first is the classic brick-breaker game DX-Ball: starting from a call that plays a sound effect, the analysis traces through to the function that calculates left and right audio channels based on the ball’s position. It reconstructs incomplete pseudocode into C code, with all 3,205 test cases matching the original. The compiled output is also exactly the same as the original: 63 bytes. The second is the Notion desktop app: tracing copy-and-paste from the interface through the preload script and inter-process communication to the main process. The third is the game Touhou Fuumaroku (TH04), originally released for the Japanese PC-98 computer: reconstructing the angle algorithm for rings of danmaku bullets from 16-bit instructions.

For security researchers and people recreating classic games or preserving software, the old process meant reading disassembly line by line and tracing calls layer by layer. Now, an agent can do the initial tracing, and a person can verify the evidence it provides. Everyday developers looking to learn how a competitor implemented a particular feature have another option, too.

According to its README, the project has already reached 50,000 stars on GitHub. The npm package was first published in July this year, and the latest version, 6.3.0, was released today.

Two things to keep in mind before using it. The project states that it supports only lawful reverse-engineering research; users are responsible for authorization and compliance. Reverse engineering someone else’s software may violate its terms of service or copyright law. The project also says it has never issued or endorsed any cryptocurrency, and that any tokens using the REA name are unrelated to it.

https://github.com/morluto/rea

Business Insider reports, citing people familiar with the matter, that Google is testing a new internal model called Carbon. One employee said its coding ability “feels like Opus 5.5.”

Carbon is deployed on Jetski, Google’s internal AI coding tool. The report says that Gemini 4 Argon, which Google released on September 30, uses a different internal version, Barium-B, and that Carbon is a new version trained afterward. It’s unclear whether Carbon will be released as an upgrade to Argon or as a standalone model.

Opus 5.5 is the point of comparison because coding is currently a weak spot for Gemini. Bloomberg previously reported that some Google employees said Argon scored well on benchmarks but didn’t live up to expectations when they actually used it to write code. On the third-party coding benchmark Terminal Bench 4, Argon scored 57%, below Anthropic’s Claude Sonnet 5.5 (64%), Claude Opus 5.5 (60%), and OpenAI’s GPT-6 Astra (59%). In September, Google also lifted its internal restrictions, allowing all engineers to use Claude for coding.

If Carbon really can match Opus 5.5, developers who write code with Gemini would benefit directly. But “feels like” is just one anonymous employee’s subjective assessment; Carbon has no publicly available benchmark scores or release date, and Google declined to comment on its internal roadmap. For now, the only model available to outsiders is Argon, and access is limited to some cybersecurity partners. Paid API users and Google AI Ultra subscribers will have to wait longer.

Grokbot’s ability to connect to X is still a major advantage, as it can help surface AI news on X worth following.

Codex's settings interface changes frequently, making settings hard to find. Search results often show old projects, but they can't be clicked.

I had Opus 5.5 design a seal for me

Prompt:
> Draw a seal in seal script using JS + Canvas, with the traditional Chinese characters「宝玉」as the inscription, read from right to left. Follow the small seal script in the Shuowen Jiezi for the character forms (if I’ve attached a reference image, copy it). Don’t use a font; draw each stroke using coordinates, then thicken it.
> Before drawing, first list the components that make up each character and where each should go on the seal face. Make both white-character and red-character versions, using cinnabar-red seal paste, with a little carved texture and chipped edges. Use a rice-paper texture for the background, and export a 1200×1200 transparent PNG. When you’re done, take a screenshot and check whether each character is recognizable and the spacing between strokes is even; revise anything that needs fixing.

If you want to debug the UI implementation of the Codex/ChatGPT Mac app

1. Quit the running Codex app

2. Run this in a terminal window:

$ open /Applications/ChatGPT.app --args --remote-debugging-port=8315 --remote-allow-origins=http://localhost:8315

2. In Chrome, enter chrome://inspect/ to open Remote Target

3. Find ChatGPT
app://-/index.html in the list and click inspect

4. A DevTools window will pop up showing the Codex UI, and you can debug Codex just like an ordinary webpage

It’s said to be a video made with Gemini 4 Argon. I think it’s even worse than what GPT-6 Astra did, and it doesn’t hold a candle to Opus 5.5.

I learned a prompt-writing tip while testing Manus today: when drawing, don’t use prompts to control the style and typography—instead, just provide a reference image. The reference image should include everything the design needs, such as color, font examples, rice-paper fibers, ink-edge effects, ink wash stains, distant mountains, seal stamps, and the rules for negative space, and so on.

This makes the output more stable, and the content prompt can be much simpler.

Figure 1: Reference image

Figure 2 content_prompt:
> Title “Tea and a Slow Life,” subtitle “Take a moment of time—have a cup of tea.” The design should follow the style of the reference image: calm, restrained, wabi-sabi; use a minimalist ink-wash style and ink-wash negative space; the background should be rice-paper texture. The text should be centered and clear.

Figure 3 content_prompt:
> Title “Slow Down the Everyday.” Content: “Warm Cup: Feel the temperature of the objects first,” “Aroma: Pay attention to the scent of the tea leaves and water,” “Tasting: Sip your tea and pause briefly.” The design should follow the style of the first page and the reference image: calm, restrained, minimalist ink-wash style; use a small number of ink-wash elements (such as distant mountains, tea-set water marks, etc.) to decorate the negative-space areas. The text layout should convey a sense of hierarchy and use negative space effectively.

--- Full Prompt for Figure 2 ---

Create a professional presentation slide with the following content:

Title “Tea and a Slow Life,” subtitle “Take a moment of time—have a cup of tea.” The design should follow the style of the reference image: calm, restrained, wabi-sabi; use a minimalist ink-wash style and ink-wash negative space; the background should be rice-paper texture. The text should be centered and clear.

Hierarchy & Layout Guidance:
- Lead with the most important narrative element (headline / metric) and follow with supporting copy in clear sections
- Any charts should reflect real data provided in the content prompt and stay faithful to the described sources
- Arrange imagery and copy so the viewer can scan left-to-right or top-to-bottom; avoid vertical stacking of charts/images

Visual Direction:
- Professional and clean
- Follow the style of the previous slide image (if provided) for visual continuity

Requirements:
- Professional presentation layout with clear visual hierarchy
- Text must be clearly readable with appropriate contrast against the background
- Include title area and content area as appropriate
- Maintain consistent style suitable for a professional presentation
- High quality, publication-ready visual design
- All text should be sharp and legible
- Keep all essential text comfortably inside the frame; avoid placing text at the very edges
- Balance visual elements with whitespace so the slide feels clean and not cluttered

Let ChatGPT use a rule-abiding and neutral chaos nine-grid to categorize the AI storm celebrities, and draw this for me

Let ChatGPT, using an orderly-neutral-chaotic nine-grid classification, categorize some AI trendsetters and draw this for me

Opus 5.5 gives you the freedom to design App Icons

Back when I was using Fable, I tried to have Fable help me design an App Icon, but the results weren’t very good. In the end, I had to use ChatGPT to generate an image—but that output isn’t vector-based.

Over the past few days, I used Opus 5.5 to make videos, which sparked an idea. If Opus 5.5 can use JavaScript + Canvas to draw a video frame by frame, then using JS + Canvas to draw an icon should also be totally fine.

So I tried it. The first version exceeded my expectations: simple, good-looking, and the results were quite impressive. The prompt was just one sentence:

> Please redesign an App Icon for http://BaoCut.app—keep it simple, colorful, and reflect video editing and AI agents.
> You can draw it directly using js on a canvas.

The key point to notice is “draw with js on canvas,” not SVG. SVG doesn’t produce a JS draw canvas effect that looks as good.

After that, it’s basically like working with a client—you just keep asking it to modify things endlessly. For example, I thought Option 3 was great, so I asked it to adjust based on Option 3. After several rounds of iteration, I ended up with a version I’m quite satisfied with.

Recommend open-source Awesome Opus 5.5 video prompt collections on GitHub