We post-trained a model that pen tests instead of refusing your code
I'm Dimitrios at Cosine. Quick orientation first: the read-only scan is free and you can run it right now: that's the part to try. The pen-test mode is gated behind written authorisation, because it's live offensive testing against real systems; I'll explain that below, it's not a paywall thing. The reason this exists: most "AI security" tools wrap a general model, so they inherit its refusals, point one at a real offensive task and it hedges or declines, because the base model was trained to. We went the other way and post-trained our own model for offensive security, so it does the work instead of apologising for it. It's our model, not a wrapper. Under the hood it's a multi-agent swarm: an orchestrator splits the job across subagents running in parallel, each owning a slice, then synthesises one report. That's what gets a polyglot microservice repo done in one pass. The fair objection to a model that doesn't refuse, pointed at your code: how is that not reckless? I think refusals are the wrong layer to put safety in. A model that refuses is both useless (won't do the job) and unsafe (you're trusting a probability distribution to hold a hard line). So we don't ask the model to behave — we enforce it in the harness. A runtime guard written in Go intercepts every tool call before it runs. In scan mode it hard-blocks every mutating tool and any non-read-only shell command and the model can decide whatever it wants, the guard won't let it write. In pen-test mode the same guard pins the agent's network scope to the targets you authorised; it can't reach anything else. Safety is deterministic and sits below the model, not inside it. Two modes, one CLI: - Security Scan - read-only audit of a local codebase, every finding tied to a file and line. Free, runnable today. - Pen Test - the swarm attacks systems you authorise and hands back the request it sent and the response your code gave. Gated behind written authorisation. Demo target and to be straight about it: Bank of Anthos, Google's open-source reference bank. Known app, some intentionally-soft bits — which is why I picked it, so you can reproduce the run instead of trusting a screenshot. The scan found an integer overflow in the transfer path that would let you forge an account balance, plus the usual injection/auth/secrets classes. It's a closed binary (brew/curl/winget), runs locally, by Cosine. Run it behind a firewall and `tcpdump` exactly what it does before you trust it on anything real. Install is free; the scan runs on a $20 Cosine subscription; pen test is scoped per engagement. I'll be in the thread all day. The harness-vs-refusals design is the part I most want torn apart - tell me where it breaks.
AI Analysis
Analysis coming soon.
Similar Products
A factory simulator game built on Spreadsheets
I would say this is the real factory simulator game haha
Housecat.com
Hey we are Housecat. I've spend the last 15 years building dev tools at Heroku, Convox (YC S15), and Segment. Dev tools have gotten insanely good over the decades, now we're working to level up productivity tools for everyday work. Housecat is an email inbox running on an single-tenant agent computer with a durable workflow engine and connections to common tools for day-to-day work. My primary workflow with the product is for customer support: get a support email, trigger a triage process, open a GitHub issue, spin up a coding agent to fix it, and update the customer along the way. All from the same UI and sandbox. We've experimented with lots of different approaches to new workspace tools, and learned that many people still need a great GUI. We've landed on the email inbox as a very familiar and permanent surface and are building tools and automations directly inside it. Under the hood every user gets their own single-tenant sandbox VM and persistent SSD on exe.dev. User connections to Google, Slack, GitHub, etc. are managed in an external service so the VM and agent are subject to external governance and don’t have direct access to secrets. Durable workflows are built on DBOS.dev. Running interactive and deterministic workflows directly inside an email couldn’t feel more different than chatting about emails in Claude.app. The app is built on HTMX, Unix, Go, and SQLite. The app is source available to users and the Linux VM is fully open for a user and their agent to poke around. You can try it out at https://home.housecat.com/beta. It requires a Google / Gmail connection for the email app, which you can revoke any time. We'd love to share more and learn how the community here is managing email, agentic chat, and custom workflows for their work.
Designing a Static Site Generator for iPhone
Show HN: Designing a Static Site Generator for iPhone
Computable
Hey we are Computable. We spent years building trading infrastructure at Jump Trading and Coinbase. From that point of view, compute looks like energy markets before 2000: everything trades through private bilateral leases, there’s no visible price, and nothing can be resold. The same H100 rents at a 2x spread depending on who’s asking, and once you sign a 24-month lease, it can never change hands. So we built a market for GPU nodes, sold by the calendar week. Here are three things you can do on it that you can’t do anywhere else: - Buy exactly the weeks you need. Three nodes for the last two weeks of October means you pay for those two weeks and walk away when the run is done. You don't have to commit to 6-24 months, and there's no flexibility premium. - Sell back what you don’t use. If your plans change, unused weeks turn back into cash: we keep a market quote posted on every position, so there’s always a price to hit. - Buy (or sell) the future. Lock January in July at a price you set, so the cost of a future run is known before another 40% H100 rate jump makes it not. The first auction is live now at https://market.getcomputable.com: a block of nodes, August through the end of January. Bidding closes July 31. The bids are sealed. You bid how many nodes, which weeks, and your price. Every clearing price gets published after settlement, because nobody knows what a GPU week is worth and we want the prints to exist in public. Happy to go deep in the comments on anything, including the clearing mechanism, which is a packing problem and was fun to design!
A canvas-based note taking and organizer app
So I've been working on this app for a very long time now. Started off by wanting an app that separates long form notes from short form notes visually and keeps everything organized on a canvas. The app features: -Sticky notes for quick, small notes and A4 notes for long form documents -A quick mode that uses local storage to quickly open the app and jot down a thought on the canvas -A PDF export option that exports your notes into 3 custom designed PDF styles -Visual hierarchy to replicate file structure instead of a linear fashion, where your files are notes, stacks are folders and labels are names for your folders Would love to continue working on this app if you guys like the concept.