Search: “redc2”

29 stories

DomainAll Cyber AIWindow24h 3d 7d 30d AllIn the wild Important only Show duplicates

CategoryAll Malware 1 Research 1 Threat actor 1

SeverityAll critical 0 high 2 medium 1 low 0 info 0

Smart search ranks by meaning as well as keywords (one row per story, last 45 days).

The GNU C Library security advisory update for 2026-09-10

glibc advisory GLIBC-SA-2026-0016: nscd can crash from a stack overflow when an untrusted DNS server returns oversized responses.

A new GNU C Library advisory (GLIBC-SA-2026-0016) describes a stack overflow in the nscd service caused by unbounded alloca use. glibc 2.3.4 and newer may crash when a malicious DNS server returns an oversized response, resulting in degraded DNS resolution. Exploitation requires nscd to be enabled and the system to be using an untrusted DNS server. The advisory was posted to oss-security by glibc maintainer Siddhesh Poyarekar.

oss-securityupdated Sep 16, 20:12 UTC · 13h agofirst Sep 11, 01:59 UTC · 6d agoVulnerability 15 sources2

rosbridge_library Protocol.incoming() quadratic CPU cost in JSON fallback

rosbridge_library's Protocol.incoming() has quadratic CPU cost in its JSON fallback, enabling denial of service via crafted messages.

Evgenios Gkritsis disclosed an algorithmic-complexity defect in rosbridge_suite's rosbridge_library Protocol.incoming() JSON fallback path, classified as CWE-407/CWE-1050. The flaw exists in the current ros2 branch and was not removed by PR #1199, having been present since the fallback was introduced. Crafted input can drive quadratic CPU cost and cause denial of service.

oss-securityupdated Sep 14, 19:53 UTC · 2d agofirst Sep 14, 18:17 UTC · 2d agoVulnerability 3 sources1

14 Trojanized npm Packages Drop RedC2 4.0 Linux Backdoor With AI

Trend Micro found 14 trojanized npm calendar utilities delivering RedC2 4.0, an AI-powered cross-platform backdoor sold for $99.99.

Trend Micro's TrendAI identified 14 functional but trojanized npm packages (streak-*, kit-map-vim, map-streak-kit) that load a bundled Linux implant, the RedShell beacon of RedC2 4.0, without requiring install hooks. RedC2 4.0, sold by Red Offsec for $99.99 and advertised on Hack Forums by actor MarlboroMan in June 2026, offers shell access, credential theft, SOCKS5 proxying, in-memory execution, and an LLM-driven component called Red Agent for natural-language post-exploitation. The framework has evolved from version 2.0 in August 2025 through 4.0, with the Linux beacon introduced in the latest release.

The Hacker NewsAug 24, 17:23 UTC · 23d agoMalware in the wild

Reducto Releases r-1: A Single Pass Document Parsing Model That Cuts Errors 20% at 1 Cent Per Page

Reducto launched r-1, a single-pass document parsing model claiming 20% error reduction over its legacy agentic pipeline, priced at 1 cent per page.

Reducto announced r-1, the first model in a new parsing family that replaces multi-stage agentic OCR with one full-page pass handling text, tables, figures, layout, formatting, and grounding with page-relative bounding boxes. The company reports a 20% error reduction measured against its own legacy agentic pipelines, plus vendor-run wins over Amazon Textract and Azure Document Intelligence on complex documents. Pricing is a flat 1 cent per page versus 3-6 cents for legacy models; r-1 is available in preview via the V3 Parse API with no open weights.

MarkTechPostSep 8, 03:07 UTC · 9d agoModel release1

⚡ Weekly Recap: AI-Powered PLC Attacks, GitLab Attacks, Stripe Key Leaks and More

US agencies warn of AI-assisted attacks on exposed Siemens PLCs; the week also saw GitLab CVE-2026-19478 exploited and trojanized npm packages found.

The weekly recap leads with a US government warning that threat actors use AI-generated scripts and Censys/ZoomEye scanning to attack internet-exposed Siemens S7 PLCs in water, energy and manufacturing, calling it an active threat. Other stories include active exploitation of GitLab CVE-2026-19478 (CVSS 9.4, unauthenticated project rewriting), 14 trojanized npm packages delivering the RedC2 4.0 Linux backdoor, and the Zombie Card attack that revives expired Visa cards for contactless payment fraud. It also covers suspected Russian clusters UNC6293, UNC7005 and UNC5976 phishing campaigns, a faster Cloudflare Workers Spectre JWT leak, and a bespoke Cl0p JSP web shell deployed after exploiting PTC Windchill flaws.

The Hacker NewsAug 28, 08:05 UTC · 20d agoThreat actor in the wildCVE-2026-194781

CISA Red Team Compromised Two Critical Infrastructure Orgs, One Detected Nothing

CISA red teams fully compromised two critical infrastructure orgs with similar tradecraft; one detected nothing, the other contained phishing within minutes.

CISA advisory AA26-237A, 'A Tale of Two SOCs,' describes two simultaneous red team assessments of a Government Services organization and a Water and Wastewater Systems organization, both compromised to the domain level. Organization A never detected the intrusion, enabled by default credentials, a misconfigured AD CS template (ESC1), cleartext credentials, non-expiring static AWS keys, and over-permissioned Entra ID applications. Organization B detected and isolated phishing within 2-20 minutes, though the red team still reached krbtgt via DCSync from cleartext SCCM credentials. CISA attributes the outcome gap to people and processes rather than the security tools themselves.

The Hacker NewsAug 26, 13:13 UTC · 21d agoAdvisory

Risky Bulletin: Expired cards can be used for new transactions

Researchers show expired Visa contactless cards can be revived via NFC man-in-the-middle relay to run fraudulent transactions; roundup also covers major breaches.

University of Massachusetts Amherst researchers built an NFC man-in-the-middle rig that updates a card's expiration date in transit and relays the modified payment to POS terminals, reviving expired contactless cards; Visa terminals and the backends of all five banks studied failed to catch the manipulation. The same roundup reports Iranian hackers shut down a small UK power plant for four days, Lazarus breached South Korea's Presidential Office as part of a campaign exceeding 100 victims, and French telecom SFR suffered a breach affecting over 2.1 million customers.

Risky Business NewsAug 24, 04:40 UTC · 24d agoResearch1

Meet Redis LangCache: A Managed Semantic Cache That Cuts LLM API Costs by Up to 90% and Returns Cache Hits Up to 15x Faster

Redis launches LangCache, a managed semantic cache matching LLM prompts by meaning, cutting API costs up to 90% and returning hits up to 15x faster.

Redis LangCache is a fully managed semantic caching service in public preview on Redis Cloud, accessed via a REST API with Python and JavaScript SDKs. It embeds incoming prompts, vector-searches stored entries, and returns a cached response when similarity clears a configured threshold, skipping the LLM call entirely. Redis claims up to 90% cost savings and up to 15x faster cache hits; a demo run showed 0.37 seconds versus 2.232 seconds direct inference (about 6x) with zero LLM tokens. Customer Mangoes.ai reports a 70% hit rate, 70% lower LLM spend, and 4x faster responses on a patient-care voice app.

MarkTechPostSep 10, 22:34 UTC · 6d agoAI tools & infra1

Testing race conditions with memory access tracing and stack-based delay injection

Google Project Zero released MAccConc, Linux kernel tooling that traces memory accesses to explore and test race condition interleavings.

A Google Project Zero researcher published MAccConc (Memory Access Concurrency), tooling for exploring possible interleavings of multithreaded test cases in the Linux kernel, available on GitHub. The tools use KCOV with ASAN outline-mode instrumentation to record per-access memory traces, enabling automatic testing of all A-B-A interleavings plus terminal and GUI explorers for manual analysis. The work targets confirming race condition candidates, building reliable regression tests, and enabling concurrency fuzzing, drawing on ideas from SKI and Ned Williamson's sockfuzzer.

Google Project ZeroSep 8, 07:00 UTC · 9d agoResearch2

Linux Kernel ZcopyReaper Vulnerability Lets Local Attackers Gain Root Privileges

Linux kernel RDS zero-copy flaw CVE-2026-43502 (ZcopyReaper) lets unprivileged local users gain root; fix in 7.1-rc3, public PoC published.

CVE-2026-43502, dubbed ZcopyReaper, is a Linux kernel local privilege escalation flaw in the RDS zerocopy send path, present since kernel 4.17, allowing unprivileged local attackers to gain root. NebuSec researcher Yuan Tan demonstrated root escalation on openSUSE kernel 6.4.0-150600.23.100; the fix landed in commit 44b550d88b26 with Linux 7.1-rc3 the first patched mainline release. Exploitation requires CONFIG_RDS and CONFIG_RDS_TCP but not unprivileged user namespaces, and PoC exploit material is publicly released alongside more than 20 other exploitable 2026 kernel CVEs.

GBHackersSep 15, 08:18 UTC · 2d agoExploit / PoC CVE-2026-43502 CVE-2026-43501 CVE-2026-43074+4 CVEs2

A Princeton Researcher Proposes Recurrent Looped Transformer (RLT) that Carries Decoder State across Every Token, Fixing 96 Blocks per Token with Unbounded Temporal Depth

Princeton researcher Yifan Zhang proposes Recurrent Looped Transformer, carrying full decoder state across every token for unbounded temporal depth.

Yifan Zhang's technical report defines the Recurrent Looped Transformer (RLT), pairing a causal encoder with a recurrent decoder whose final output and layerwise sliding-window attention cache carry into every subsequent token with no prompt-response boundary reset. The reference configuration ties 48 encoder and 48 decoder layers, executing 96 logical blocks per token while the state path grows to 48t blocks after t tokens at fixed per-token compute. The report details RL replay contracts that rebuild all states under current parameters and exact prefix snapshots for multi-turn serving, but explicitly reports no measured efficiency, reasoning quality, or scaling results.

MarkTechPostSep 13, 17:02 UTC · 3d agoAI research1

VU#369093: MLflow dspy and statsmodels flavors bypass pickle deserialization control

CERT/CC warns MLflow's dspy and statsmodels flavors bypass the MLFLOW_ALLOW_PICKLE_DESERIALIZATION control, enabling remote code execution.

CERT/CC vulnerability note VU#369093 describes a flaw in MLflow 3.12.0 where the dspy flavor conditionally applies the pickle deserialization safety control based only on the model path's .pkl extension, while the statsmodels flavor skips the check entirely, permitting arbitrary code execution via malicious pickle payloads even when users disallow pickle. The statsmodels flavor is patched in versions 3.15.0 and later, but no dspy fix exists yet, so users should avoid loading models through that flavor. Exploitation requires write access to any location from which a user obtains MLflow models.

CERT/CC Vulnerability NotesSep 16, 17:10 UTC · 16h agoVulnerability

RLLBC-Lib: An Educational Code Library for Reinforcement Learning and Learning-Based Control

Researchers release RLLBC-Lib, an educational code library covering tabular and deep reinforcement learning with support for automated grading.

RLLBC-Lib is an educational code library aimed at lowering the entry barrier for students learning reinforcement learning in the context of learning-based control. It comprises a comprehensive library of tabular RL approaches, a deep RL library following the same design principles, and implementations contrasting RL with other learning-based control approaches. The library also serves as a basis for creating programming assignments with automated grading.

arXiv cs.AI / cs.LG / cs.CLSep 16, 17:15 UTC · 15h agoAI research

CISA Red Team Fully Compromised Two Critical Infrastructure Orgs

CISA red teams achieved full domain and cloud compromise at two critical infrastructure orgs; one SOC never detected the intrusion.

CISA advisory AA26-237A documents two simultaneous red team assessments. Organization A (Government Services sector) missed the intrusion entirely, as default credentials on a web app, ADCS ESC1 abuse, and thousands of false-positive alerts let the red team reach sensitive business systems and read SOC email. Organization B (Water/Wastewater sector) detected, isolated, and reimaged hosts quickly, but both orgs lacked Conditional Access for workload identities, and B still exposed DCSync, Golden Ticket, and OT network attack paths.

Security AffairsAug 26, 23:20 UTC · 21d agoAdvisory1

Cross-Model Agreement as a Deployment-Time Reliability Signal for Automatic Polyp Segmentation

Referee-Based Quality Estimation flags unreliable polyp segmentations at inference without ground truth, reaching ROC-AUC 0.960 with SegFormer-B0 referees.

RBQE measures agreement between a primary segmentation model and an independently trained referee on a 1,223-image external benchmark drawn from four public datasets. A cross-architecture SegFormer-B0 referee achieves the strongest signal (ROC-AUC 0.960), beating a Test-Time Augmentation baseline by 0.055 ROC-AUC under an identical protocol. Excluding trivially separable empty-mask cases, ROC-AUC falls to 0.876 (SegFormer-B0) and 0.783 (same-architecture control), but RBQE's margin over baselines widens. Progressive rejection of low-agreement predictions increases mean Dice of retained outputs, supporting selective prediction at the cost of one extra forward pass.

arXiv cs.AI / cs.LG / cs.CLSep 9, 17:32 UTC · 7d agoAI research

Wiz Red Agent Finds Its Way Into Snowflake’s Internal Jira Through a Flaw in a GitHub Copilot–Assisted PR

Wiz's autonomous Red Agent found and exploited a GitHub Actions injection in a Copilot-assisted PR, reaching Snowflake's internal Jira without human help.

Wiz's Red Agent autonomously discovered a GitHub Actions injection flaw in a GitHub Copilot-assisted pull request, five days after the flaw went live. It exploited the flaw to validate access to sensitive data in Snowflake's internal Jira, bypassing detection by GitHub Advanced Security, and assessed the blast radius without human intervention. The exercise demonstrates agentic AI performing end-to-end offensive security operations against production systems.

Wiz BlogAug 17, 14:00 UTC · Aug 17, 2026AI safety & security1

Re: Linux kernel LPEs: ZcopyReaper (CVE-2026-43502) and 20 more

Linux kernel developers discuss a batch of 21 local privilege escalation CVEs, including ZcopyReaper (CVE-2026-43502) in the RDS networking driver.

An oss-security thread examines newly published Linux kernel local privilege escalation issues tracked in the kernel.org security vulnerabilities git repository. CVE-2026-43502, dubbed ZcopyReaper, affects the net/rds (Reliable Datagram Sockets) subsystem. The discussion references roughly 20 additional kernel LPE CVEs published in the 2026 Q3 window.

oss-securitySep 8, 21:32 UTC · 8d agoVulnerability CVE-2026-43502

GDCM <= 3.2.7: six memory-safety and denial-of-service vulnerabilities, no CVE

Six memory-safety and denial-of-service flaws disclosed in the GDCM DICOM parsing library, affecting versions through 3.2.7.

Researcher Abhinav Agarwal disclosed six vulnerabilities in GDCM (Grassroots DICOM), an open-source C++ library for parsing and processing DICOM files. All six were confirmed against GDCM 3.2.6 using AddressSanitizer and UndefinedBehaviorSanitizer, and source review found the vulnerable patterns through version 3.2.7 and the upstream master snapshot. Potential impacts include heap corruption, process-memory disclosure, stack exhaustion, and process termination in applications parsing untrusted DICOM files. No CVE identifiers have been assigned at the time of disclosure.

oss-securitySep 10, 03:35 UTC · 7d agoVulnerability

CVE-2025-25249 Exploitation Delivers PivotC2, a FortiGate Post-Exploitation RAT

Attackers exploiting CVE-2025-25249 in Fortinet FortiGate firewalls deploy PivotC2, a post-exploitation RAT, on exposed edge devices.

SOCRadar reports that exploitation of CVE-2025-25249 is being used to deploy PivotC2, a purpose-built post-exploitation RAT, on FortiGate firewall appliances. The attack follows the common pattern of compromising public-facing edge devices such as VPNs, routers, and firewalls as the initial entry point. Defenders running FortiGate appliances should prioritize patching and watch for post-exploitation activity indicating RAT deployment.

SOCRadarSep 8, 10:00 UTC · 8d agoExploit / PoC in the wildCVE-2025-25249

Linux kernel LPEs: ZcopyReaper (CVE-2026-43502) and 20 more

Researchers disclosed CVE-2026-43502 (ZcopyReaper), a Linux kernel local privilege escalation in the RDS zerocopy send path, fixed in v7.1-rc3.

Yuan Tan reported a Linux kernel local privilege escalation in the RDS zerocopy send path, tracked as CVE-2026-43502 and dubbed ZcopyReaper, posted to oss-security. The flaw was introduced in Linux v4.17 and fixed by commit 44b550d88b26, first appearing in mainline v7.1-rc3. The researchers demonstrated local privilege escalation on an openSUSE system running kernel 6.4.0-150600.23.100. The post also references 20 additional Linux kernel LPEs, though CVE ids were not provided in the excerpt.

oss-securitySep 8, 03:53 UTC · 9d agoVulnerability CVE-2026-43502

harshatheg/Qwen-2.5-1B-RLCD — new model trending #30 on Hugging Face

A community MLX inference engine evaluates constrained JSON schema fields in parallel on Apple Silicon, reporting 5.6-7.0x latency speedups with guaranteed schema validity.

The repository harshatheg/Qwen-2.5-1B-RLCD appeared at #30 on Hugging Face trending, but its content describes Parallel Constrained Decoding, an MLX-based inference engine for structured extraction and classification on Apple Silicon Macs. Benchmarked with mlx-community/Qwen2.5-1.5B-Instruct-4bit on an M4 Max, it reports 5.6x-7.0x latency reductions (e.g., 1,900 ms to 270 ms for a 28-field support triage task) with 100% syntactic validity and calibrated field-level probabilities. The engine prefills a single KV-cache, broadcasts it across all schema fields, and slices logits to valid candidate tokens for enum fields with up to 255 choices.

Hugging Face trending modelsSep 16, 01:35 UTC · 1d agoAI tools & infra

Redtail Payload Analysis [Guest Diary], (Wed, Sep 9th)

SANS guest analyst detonated a RedTail Linux sample from a DShield honeypot, finding process masquerading as php-fpm, monitoring-kill behavior, and a TCP listener.

A DShield honeypot captured multi-architecture RedTail Linux executables (ARM, ARM64, i686, RISC-V, x86-64) deployed via shell scripts. Dynamic analysis of the UPX-packed, statically linked x86-64 sample (SHA-256 63be5f38...d35e) in an isolated Ubuntu 24.04 VM on Proxmox showed it renamed its process via prctl(PR_SET_NAME), killed a filesystem-monitoring process, and opened a TCP listening socket while surviving processes posed as php-fpm or PostgreSQL-like workers. Differential memory images pre- and post-execution were captured from the hypervisor for forensics.

SANS Internet Storm CenterSep 10, 12:58 UTC · 6d agoMalware in the wild1

New ZcopyReaper Linux Kernel Vulnerability Enables Privilege Escalation Attacks

ZcopyReaper (CVE-2026-43502) lets unprivileged local attackers reach root on Linux via an RDS zero-copy cleanup flaw dating to kernel 4.17.

CVE-2026-43502 is a lifetime-management error in rds_message_purge() that mishandles zero-copy sends before socket attachment, corrupting kernel memory and enabling local privilege escalation without capabilities or user namespaces. NebuSec demonstrated the exploit on openSUSE kernel 6.4.0-150600.23.100; vulnerable systems need CONFIG_INET, CONFIG_AIO, CONFIG_RDS, and CONFIG_RDS_TCP. The fix landed in mainline commit 44b550d88b26 (Linux 7.1-rc3) with backports to Ubuntu 7.0.0, 6.8.0, and 5.15.0 kernels and multiple Debian branches. NebuSec also released public exploits for 20 additional Linux kernel vulnerabilities in its CyberMeowfia repository.

Cyber Security NewsSep 14, 13:29 UTC · 2d agoVulnerability CVE-2026-43502

VU#874418: RDK-B WebUI contains multiple vulnerabilities

CERT/CC warns RDK-B WebUI rdkb-2025q4-kirkstone contains multiple flaws enabling network attackers to bypass authentication, cause DoS, or potentially execute code.

VU#874418 describes multiple vulnerabilities in the RDK-B WebUI version rdkb-2025q4-kirkstone, the open-source Reference Design Kit for Broadband used in broadband gateways and networking devices. Issues include memory corruption, improper authentication, race conditions, and insufficient input validation. A network-adjacent attacker could bypass authentication, obtain administrative access, cause denial-of-service, or corrupt underlying processes, with potential arbitrary code execution under certain conditions.

CERT/CC Vulnerability NotesAug 19, 19:28 UTC · 28d agoVulnerability

Orthanc DICOM Server

CISA advisory flags CVE-2026-87020, an integer overflow in Orthanc DICOM Server <1.13.0 causing heap out-of-bounds write and denial of service when decoding crafted PNG/JPEG images.

CISA published ICSMA-26-253-02 for Orthanc DICOM Server versions below 1.13.0, used in healthcare environments worldwide. CVE-2026-87020 (CWE-190) is an integer overflow in pitch and buffer-size computation causing a heap out-of-bounds write when decoding attacker-supplied PNG or JPEG images. An authenticated remote attacker can crash the Orthanc process and cause denial of service; CVSS v3.1 is 8.1 HIGH. CISA states no known public exploitation targeting this flaw has been reported.

CISA AdvisoriesSep 10, 12:00 UTC · 6d agoAdvisory CVE-2026-87020

Evidence-Grounded Agentic Formulation Development in an Autonomous Laboratory

Andromeda 2, an agentic laboratory system, reaches a 50% high-performance hit rate for paclitaxel SEDDS formulations versus 17% for its predecessor and 2% for DoE.

Andromeda 2 is an agentic system that reasons over structured in-house experimental evidence and invokes computational and experimental tools to design and execute successive formulation batches for self-emulsifying drug delivery systems (SEDDS). For paclitaxel it achieved a 50% high-performance hit rate versus 17% for Andromeda 1 and 2% for a wet-lab DoE campaign, identifying 12 formulations meeting all four target product profile objectives versus 6 and 0. A selected full-TPP formulation reached approximately 19% w/w apparent paclitaxel loading, about 3.3-fold higher than a published paclitaxel S-SEDDS, and an ablation showed structured evidence access increased mean AUC by 34%.

arXiv cs.AI / cs.LG / cs.CLSep 16, 17:31 UTC · 15h agoAI research

Lightweight Vision Transformer Compression for On-Device Plant Disease Detection in Resource-Constrained Agricultural Field Conditions

A unified ViT compression pipeline (H-BAC pruning, quantization, distillation) cuts plant-disease models 54.5x to 6.01 MB while keeping 95.13% accuracy.

Researchers combined Hessian-Balanced Adaptive Block Pruning (H-BAC), guided by second-order sensitivity estimation, with quantization and attention-based knowledge distillation to compress Vision Transformers for on-device chilli plant disease detection in India. On a 3-class cross-village, cross-device out-of-distribution dataset, the integrated pipeline reduced model size from 327.42 MB to 6.01 MB (54.5x) at 95.13 +/- 2.32% accuracy, matching the 95.13% FP32 baseline. Ablations also show a directly trained 6.01 MB INT8 student reaches 94.87% accuracy, indicating where pruning and distillation add limited value.

arXiv cs.AI / cs.LG / cs.CLSep 4, 16:40 UTC · 12d agoAI research

Houthis Used Claude Code to Develop Missile Guidance Software: Anthropic

Anthropic's threat report details a Houthi-linked Yemeni cell using parallel Claude Code sessions to build missile guidance software, evading safeguards by fragmenting tasks.

Anthropic's September threat report describes a Yemen-based cell, assessed as highly likely Houthi-linked, that used Claude Code across multiple parallel instances to develop guidance software for a tactical guided rocket, a ballistic missile with over 2,000 km range, and a hypersonic glide vehicle concept called 'R2000'. The operators integrated open-source autopilot software, built six-degree-of-freedom trajectory simulations, and used reinforcement learning to tune flight-control algorithms, ultimately compiling an offline executable. The group test-fired a guided rocket that failed, then used Claude within hours to analyze launch telemetry. Anthropic blocked numerous requests, but operators evaded safeguards by obscuring intent and dividing work across separate conversations before accounts were banned; the case is one of six conventional-weapons cases (three China-linked, two Russia-linked) in a report covering disrupted operations from December 2025 to August 2026.

Hacker News · AISep 13, 14:15 UTC · 3d agoAI safety & security HN 47↑ · 38 comments1

Molecular Déjà Vu: Digit-Level Retrieval of Published Values in Frontier Language Models

Audit of 22 frontier models finds widespread verbatim retrieval of published molecular property values, with higher reasoning increasing recall of memorized numbers.

An arXiv audit tests 22 frontier LLMs across 12 molecular regression benchmarks for verbatim retrieval of published values. More than 50% of the LLMs show verbatim retrieval on five datasets, and identical experiments are flagged 89% more often at a high reasoning level than at the lowest one. Suppressing retrieval moves model prediction errors closer together in relative terms, suggesting predictive capability is not determined solely by memorized values.

arXiv cs.AI / cs.LG / cs.CLSep 4, 17:32 UTC · 12d agoAI research1