今日已更新 183 条资讯 | 累计 21402 条内容
关于我们

标签：#rce

找到 1527 篇相关文章

开源项目

🔥 0x4m4 / hexstrike-ai - HexStrike AI MCP Agents is an advanced MCP server that lets

GitHub热门项目 | HexStrike AI MCP Agents is an advanced MCP server that lets AI agents (Claude, GPT, Copilot, etc.) autonomously run 150+ cybersecurity tools for automated pentesting, vulnerability discovery, bug bounty automation, and security research. Seamlessly bridge LLMs with real-world offensive security capabilities. | Stars: 9,216 | 38 stars today | 语言: Python

2026-06-04 原文 →
AI 资讯

What is an LLM evaluation harness? A deep dive into lm-eval-harness

What is an LLM evaluation harness? A deep dive into lm-eval-harness You fine-tuned a 7B model. It aced your smoke tests, your colleague ran a few prompts and shrugged approvingly, and the README is now full of cherry-picked outputs that look great in a screenshot. Then someone asks: how good is it, really? — and you realize you have no number to point at. No MMLU score. No HellaSwag. Nothing reproducible, nothing you can defend in a PR review, nothing you can compare to last week's checkpoint. That's the gap an evaluation harness fills. It turns "vibes-based evaluation" into something with a score, a stderr, and a config file you can re-run next Tuesday. Why evaluate LLMs at all? Two reasons that actually matter: Comparability. If you can't put a number on a model, you can't compare it to anything else — not the previous checkpoint, not the open-source baseline, not the commercial API you're trying to replace. Leaderboards are noisy and gaming-prone, but a local leaderboard with the tasks you care about is one of the most useful artifacts a team can build. Regression detection. Most model regressions are silent. A 0.3-point drop on MMLU won't show up in a chat session, but it will show up in CI. People who ship models for a living treat evals the way backend engineers treat unit tests: mandatory, run on every PR, and blocking on regressions. You don't need a hundred benchmarks. You need the three to five tasks that map to your actual use case , plus one or two general capability anchors (MMLU, HellaSwag) so you can sanity-check that you didn't accidentally destroy basic reasoning while you were tuning for your domain. What is an "evaluation harness"? An evaluation harness is the software that sits between a model and a benchmark. It handles the boring-but-critical parts: loading the model weights, tokenizing prompts in the way the benchmark expects, running inference, extracting the answer from a longer generation, scoring it against a ground-truth key, aggregating

2026-06-03 原文 →
AI 资讯

Vercel cron alternative: what to use when built-in cron isn't enough

Vercel's built-in cron triggers your serverless functions on a schedule. For simple use cases it works. But it has no failure alerts, no execution history on the Hobby plan, and no way to know whether your function actually completed successfully — only that it was called. Where Vercel cron falls short Vercel cron works by invoking one of your API routes on a schedule defined in vercel.json . The invocation is fire-and-forget — if your function times out, throws an error, or returns a non-2xx status, you get no alert. You find out when a user reports something is broken. The specific gaps developers run into: No failure alerts. Vercel does not send an email or webhook if your scheduled function fails. No execution history on Hobby. The free plan does not retain cron execution history. Timeout ceiling. Functions are subject to the same timeout limits as all serverless functions — 10 seconds on Hobby, up to 300 seconds on Pro. HTTP-only. Vercel cron calls an HTTP endpoint on your app. You cannot schedule arbitrary background work outside your deployment. No heartbeat monitoring. Even if your function is called successfully, you have no built-in way to verify it completed its work — only that it was invoked. Minimum 1-hour interval on Hobby. Sub-hourly schedules require a paid plan. If you are hitting any of these limitations, you need an external tool. Comparison at a glance Tool Schedules jobs Failure alerts Heartbeat Uptime monitoring Free tier Vercel built-in ✓ ✗ ✗ ✗ ✓ (1h min) Tickstem ✓ ✓ ✓ ✓ ✓ Upstash QStash ✓ ✓ (retries) ✗ ✗ ✓ Inngest ✓ ✓ ✗ ✗ ✓ cron-job.org ✓ ✓ (basic) ✗ ✗ ✓ Tickstem — cron + heartbeat + uptime in one API key Best for: developers who need scheduling, failure alerts, heartbeat monitoring, and uptime checks without managing multiple tools. Tickstem is an external HTTP cron scheduler with built-in monitoring. You register your Vercel endpoint as a cron job, and Tickstem calls it on your schedule — every minute if needed, regardless of your Vercel

2026-06-03 原文 →
AI 资讯

Stop shipping a 1990s C library to compute planets. Xalen is the pure-Rust, Apache-2.0 replacement for Swiss Ephemeris.

Stop shipping a 1990s C library to compute planets. Xalen is the pure-Rust, Apache-2.0 replacement for Swiss Ephemeris. If your app does astrology, you already know the dependency. Swiss Ephemeris: a C library from the 1990s, a folder of binary .se1 data files you have to ship and locate at runtime, and a license that is either AGPL or you pay for a commercial seat. For 30 years it was the only serious option, so everyone just swallowed the cost. That era is over. Xalen Ephemeris is a full planetary engine written in pure Rust, with no unsafe in the core engine (the only unsafe lives in the optional FFI, Node and WASM binding crates), released under Apache-2.0. No C toolchain. No data files to ship. No copyleft clause waiting for the day you try to make money. It is built to replace Swiss Ephemeris in production, not to admire it from a distance. Python is live on PyPI and the Rust crates are live on crates.io: # Python pip install xalen # Rust cargo add xalen-ephem xalen-time xalen-ayanamsa xalen-vedic Node and WASM build straight from the repo. Repo: https://github.com/vedika-io/xalen-ephemeris Switching takes one line Xalen ships a pyswisseph-shaped API on purpose. Migrating an existing codebase is a find-and-replace: # before import swisseph as swe # after import xalen.swe as swe jd = swe . julday ( 1990 , 6 , 15 , 10.5 ) xx , ok = swe . calc_ut ( jd , swe . SUN , swe . FLG_SWIEPH | swe . FLG_SPEED ) # same argument order, same SE_/SEFLG_/SIDM_ constants, same tuple layout Your function calls do not change. Your data-file directory disappears. Your license problem disappears. Xalen vs Swiss Ephemeris Line them up and the gap is hard to miss. Swiss Ephemeris is C from the 1990s, shipped as a native library you compile and link, fed by .se1 data files you have to bundle and locate at runtime, under AGPL or a paid commercial license. Xalen is pure Rust with no unsafe in the core engine, thread-safe, with no native dependency and no data files for the analytical eng

2026-06-03 原文 →
AI 资讯

Your Next PC Is Not a Productivity Tool - It Is a Runtime for AI Agents

At GTC 2026, Jensen Huang said something that made a lot of people pause: the PC is being reinvented. He and Microsoft launched RTX Spark with the N1X chip, cramming petaflop-level AI compute into a desktop form factor. On the surface it looks like another hardware upgrade, but this time the use case is genuinely different. Previous PC performance gains served humans: faster rendering, faster compiling, smoother gaming. This round of compute improvement is largely aimed at AI agents. Agents need to run vision-language models locally, understand screen content in real time, and execute GUI operations. These workloads demand sustained compute resources with a load profile completely different from human computer use. Agents Need Different Hardware Than Humans Humans use computers in bursts: typing, clicking, waiting for responses. The load is pulsed. Agents use computers continuously: constantly capturing screenshots, interpreting the display, making decisions, executing operations. The load is steady-state. This means agents need memory bandwidth and energy efficiency more than peak compute. This explains why Apple's M-series chips perform well in on-device AI scenarios. The unified memory architecture lets GPU and CPU share the same memory pool without data transfers between them, which is highly efficient for model inference that frequently accesses large parameter sets. M-series energy efficiency also suits long-running agent workloads without thermal throttling. NVIDIA's RTX Spark takes another path: more GPU compute and more memory (128GB unified) to handle on-device AI demands. The N1X chip has higher total compute than M-series, better suited for heavy workloads. Different tradeoffs, same destination: AI agents running on the device in front of you. There's Already a Complete Agent Stack on Mac What's worth noting is that the on-device AI agent stack on Apple's ecosystem is already fairly complete. M-series chips at the hardware layer. MLX at the framework lay

2026-06-03 原文 →
AI 资讯

How I built an E2EE chat in Go + React (with AI agent support)

🚀 Try it now: Open the Arthas web app — create a room, share the code, chat with E2EE. No signup needed. TL;DR — Try It in 2 Minutes No signup required. A free public server is running at wss://arthas100-arthas-server.hf.space/ws . 1. Create an encrypted room (CLI) # Linux/macOS — download and make executable curl -L -o arthas-cli https://github.com/michaelwang123/arthas/releases/latest/download/arthas-cli chmod +x arthas-cli # Windows (PowerShell) — download the .exe # curl.exe -L -o arthas-cli.exe https://github.com/michaelwang123/arthas/releases/latest/download/arthas-cli-windows-amd64.exe # Create a room — generates AES-256 key locally, outputs share code ./arthas-cli create --server wss://arthas100-arthas-server.hf.space/ws --name "Alice" # Windows: .\arthas-cli.exe create --server wss://arthas100-arthas-server.hf.space/ws --name "Alice" # Output: # ✓ Room created! Share code: # QYEq9uxfKP9h-KCUsPUay:NlZezXoUErYr92grhif3Y-Hy3FOOK1ocb3WocCJJrQM # # The encryption key never leaves your device. ⚠️ Keep this terminal open — the room exists only while at least one participant is connected. 2. Join from another terminal (or send the code to a friend) # Linux/macOS ./arthas-cli join QYEq9uxfKP9h-KCUsPUay:NlZezXoUErYr92grhif3Y-Hy3FOOK1ocb3WocCJJrQM \ --server wss://arthas100-arthas-server.hf.space/ws \ --name "Bob" # Windows # .\arthas-cli.exe join QYEq9uxfKP9h-KCUsPUay:NlZezXoUErYr92grhif3Y-Hy3FOOK1ocb3WocCJJrQM --server wss://arthas100-arthas-server.hf.space/ws --name "Bob" That's it — you're chatting end-to-end encrypted. The server only sees ciphertext blobs; it cannot read, store, or parse anything. 💡 Prefer a web UI? Open the Arthas web app , create a room, and share the code. Bonus: Connect an AI Agent to the Same Room Every AI agent channel today (Telegram bots, Slack apps, Discord) transmits prompts in plaintext. With Arthas, your AI joins the encrypted room as a regular participant — the server can't tell human from bot (both are encrypted binary blobs). npm

2026-06-03 原文 →
AI 资讯

Why Your LLM Agent Gives a Different P-Value Every Time (And What to Build Instead)

Hand the same paired before/after dataset (n = 25) to ChatGPT five times. Same prompt: "These are the same subjects measured before and after an intervention. Did their scores change significantly?" Four of the five runs return p = 0.009 from a paired t-test. The fifth run does a Shapiro–Wilk normality check on the differences first, decides they're non-normal, switches to a Wilcoxon signed-rank test, and reports p = 0.000018 . All five reach the same conclusion (significant). But notice what happened: only one run out of five thought to check an assumption you'd want it to check. The other four skipped it. The choice of method — and the test statistic, and the p-value — depended on whether the LLM happened to run an assumption check that time. On borderline data, this is the difference between reject and don't reject. If you're using LLMs for exploratory data analysis on a weekend project, you might shrug. If you're using them for anything that gets cited, gets submitted to a regulator, or gets handed to a clinician, this is a problem. It's a known problem — Cui & Alexander (2026) documented exactly this kind of method-divergence empirically; AIRepr (Zeng et al., 2025) shows the same thing across reproducibility metrics. The current answer in the literature is to constrain the agent so its execution is replayable. But replayability fixes "did we run the same code." It doesn't fix "did we run the right analysis." I've spent the last two months building a different fix. The more interesting half is the architecture. Let me walk through it. The real problem isn't temperature The first reflex is "set temperature=0 ." It's not enough. temperature=0 doesn't make a tool-using agent deterministic across runs. Three reasons: Inference isn't bitwise deterministic, even at temperature=0. Production LLM serving batches requests dynamically, and the attention kernels aren't batch-invariant — so the same input produces different output tokens depending on what other requests it

2026-06-03 原文 →
← 上一页 下一页 →